苏州CCNP交换综合实验思朋信息.docx

1、苏州CCNP交换综合实验思朋信息综合实验实验目的:1、熟练配置二层式网络2、了解交换机安全及配置实验拓扑图:实验说明:此实验为典型的2层式构架网络,中小型网络常采用此构架.实验要求：1) core-1与core-2的相互接口做成ethernetchannel 30. 再将ethernetchannel30设置成trunk模式. Ed-sw,SF-sw与Core-1,Core-2互连的接口也设置成trunk模式,并验证.interface range fa0/23 - 24 switchport trunk encapsulation dot1q switch mode trunk channe

2、l-group 30 mode oninterface Port-channel 30 switchport trunk encapsulation dot1q switchport mode trunkCore1(config)#int range fa0/21-22Core1(config-if-range)#switchport mode trunkCore1(config-if-range)#switchport trunk encapsulation dot1q2) core-1,core-2,edge-sw,FS-sw设置成同一vtp domain,domain name为step

3、-lab,password为step-lab core-1,core-2设置为vtp server模式 edge-sw,SF-SW设置为vtp client模式 在core-1上增加vlan64,65,66,67,95 在core-2,edge-sw,SF-SW学到vlan信息后,把所有交换机的vtp模式设置成transparent.Core1(config)#vtp domain step_labCore1(config)#vtp mode serverCore1(config)#vlan 64,65,66,67,95Core1(config)#vtp mode transparent3)

4、设置Core-1为vlan1,64,65的STP主根,为vlan66,67,95的备份STP根. 设置Core-2为vlan66,67,95的STP主根,为vlan1,64,65的备份STP根.Core1(config)#spanning-tree vlan 1,64,65 root primary Core1(config)#spanning-tree vlan 66,67,95 root secondary Core2(config)#spanning-tree vlan 1,64,65 root secondary Core2(config)#spanning-tree vlan 66,

5、67,95 root primary4) core-1的1-5 port划分到vlan 64 core-1的6-10 port划分到vlan 65 core-1的11-15 port划分到vlan 66 core-1的16-20 port划分到vlan 67 把这些port设置成生成树快速转发模式,启用bpduguard,并测试.启用vlan64,65 port的port-security功能,限制每个port只能学习5个mac地址.Core1(config)#int range fa0/1-5Core1(config-if-range)#switchport access vlan 64Co

6、re1(config-if-range)#switchport mode accessCore1(config)#int range fa0/6-10Core1(config-if-range)#switchport access vlan 65Core1(config-if-range)#switchport mode accessCore1(config)#int range fa0/11-15Core1(config-if-range)#switchport access vlan 66Core1(config-if-range)#switchport mode accessCore1(

7、config)#int range fa0/16-20Core1(config-if-range)#switchport access vlan 67Core1(config-if-range)#switchport mode accessCore1(config)#int range fa0/1-20Core1(config-if-range)#spanning-tree portfastCore1(config-if-range)#spanning-tree bpduguard enableCore1(config)#int range fa0/1-10Core1(config-if-ra

8、nge)#switchport port-security maximum 55) core-2的1-5 port划分到vlan 64 core-2的6-10 port划分到vlan 65 core-2的11-15 port划分到vlan 66 core-2的16-20 port划分到vlan 67 把这些port设置成生成树快速转发模式,禁止这些port收发BPDU信息,并测试. 设置这些port只接收1M/s的broadcast数据包,2M/s的multicast数据包. int range fa0/1-5switchport access vlan 64switchport mode a

9、ccessint range fa0/6-10switchport access vlan 65switchport mode accessint range fa0/11-15switchport access vlan 66switchport mode accessint range fa0/16-20switchport access vlan 67switchport mode accessCore2(config)#int range fa0/1-20Core2(config-if-range)#spanning-tree portfastCore2(config-if-range

10、)#spanning-tree bpduguard enableCore2(config-if-range)#storm-control broadcast level pps 1mCore2(config-if-range)#storm-control multicast level pps 2m6) 设置vlan ip address: core-1 vlan64: 10.9.64.253/24 core-1 vlan65: 10.9.65.253/24 core-1 vlan66: 10.9.66.253/24 core-1 vlan67: 10.9.67.253/24 core-1 v

11、lan95: 10.9.95.253/24 core-1 loopback0: 10.9.100.1/32 core-1与R1互联的接口: 10.9.96.10/30int vlan 64no shutip add 10.9.64.253 255.255.255.0int vlan 65no shutip add 10.9.65.253 255.255.255.0int vlan 66no shutip add 10.9.66.253 255.255.255.0int vlan 67no shutip add 10.9.67.253 255.255.255.0int vlan 95no shu

12、tip add 10.9.95.253 255.255.255.0int loopback 0ip add 10.9.100.1 255.255.255.255int fa0/3no switchportip add 10.9.96.10 255.255.255.252no shut core-2 vlan64: 10.9.64.252/24 core-2 vlan65: 10.9.65.252/24 core-2 vlan66: 10.9.66.252/24 core-2 vlan67: 10.9.67.252/24 core-2 vlan95: 10.9.95.252/24 core-2

13、loopback0: 10.9.100.2/32 core-2与R1互联的接口: 10.9.96.6/30int vlan 64no shutip add 10.9.64.252 255.255.255.0int vlan 65no shutip add 10.9.65.252 255.255.255.0int vlan 66no shutip add 10.9.66.252 255.255.255.0int vlan 67no shutip add 10.9.67.252 255.255.255.0int vlan 95no shutip add 10.9.95.252 255.255.25

14、5.0int loopback 0ip add 10.9.100.2 255.255.255.255int fa0/4no switchportip add 10.9.96.6 255.255.255.252no shutsw2 vlan95: 10.9.95.1/24,缺省网关为10.9.95.254,测试可以相互ping通.int vlan 95no shutip add 10.9.95.1 255.255.255.0 exitip default-gateway 10.9.95.254 sw1 vlan95:10.9.95.2/24,缺省网关为10.9.95.254,测试可以相互ping

15、通.int vlan 95no shutip add 10.9.95.2 255.255.255.0 exitip default-gateway 10.9.95.2547) sw2上启用uplinkfast,并验证.sw2(config)#spanning-tree uplinkfast8) Core-1与Core-2的每个vlan接口都做HSRP, core-1设置成vlan64,65主用设备. core-2设置成vlan66,67,95主用设备.虚拟的IP地址为:10.9.xx.254/24,xx为vlan NO.Core1(config)#int vlan 64Core1(config

16、-if)#standby 1 ip 10.9.64.254 Core1(config-if)#standby 1 priority 105 Core1(config-if)#standby 1 preemptCore1(config-if)#standby 1 track fastEthernet 0/3 20Core1(config-if)#exitCore1(config)#int vlan 65Core1(config-if)#standby 1 ip 10.9.65.254 Core1(config-if)#standby 1 priority 105 Core1(config-if)

17、#standby 1 preemptCore1(config-if)#standby 1 track fastEthernet 0/3 20Core1(config-if)#exitCore1(config)#int vlan 66Core1(config-if)#standby 1 ip 10.9.66.254 Core1(config-if)#standby 1 preemptCore1(config-if)#exitCore1(config)#int vlan 67Core1(config-if)#standby 1 ip 10.9.67.254 Core1(config-if)#sta

18、ndby 1 preemptCore1(config-if)#exitCore1(config)#int vlan 95Core1(config-if)#standby 1 ip 10.9.95.254 Core1(config-if)#standby 1 preemptCore1(config-if)#exitCore2中：int vlan 66standby 1 ip 10.9.66.254 standby 1 priority 105 standby 1 preemptstandby 1 track fastEthernet 0/4 20exitint vlan 67standby 1

19、ip 10.9.67.254 standby 1 priority 105 standby 1 preemptstandby 1 track fastEthernet 0/4 20exitint vlan 95standby 1 ip 10.9.95.254standby 1 track fastEthernet 0/4 20standby 1 preemptexitint vlan 64standby 1 ip 10.9.64.254 standby 1 preemptexitint vlan 65standby 1 ip 10.9.65.254 standby 1 preemptexit9

20、) 设置R1:F0/0:10.9.96.9/30 F0/1:10.9.96.5/30 loopback0:10.9.100.3/32 R1,core-1,core-2启用eigrp路由协议,使所有网络互通,并验证.int fa0/0ip add 10.9.96.9 255.255.255.252no shutexitint fa0/1ip add 10.9.96.5 255.255.255.252no shutexitint loopback 0ip add 10.9.100.3 255.255.255.255exitrouter eigrp 100network 10.0.0.0 no au

21、to-summaryCore1(config-router)#ip routing Core1(config-router)#router eigrp 100Core1(config-router)#network 10.0.0.0 Core1(config-router)#no auto-summaryCore2(config)#ip routing Core2(config)#router eigrp 100Core2(config-router)#network 10.0.0.0 Core2(config-router)#no auto-summary10) R1上启用dhcp serv

22、er功能,为以下网段提供dhcp服务: 10.9.64.0/24 10.9.65.0/24 10.9.66.0/24 10.9.67.0/24 分配10.9.xx.11-10.9.xx.200,xx为vlan NO DNS server: 10.9.100.3 Default-gateway: 10.9.xx.254 Domain-name: 并在core-1,core-2的VLAN接口上启用DHCP广播重定向功能,从定向到R1这台DHCP Server,使dhcp server能够正常为PC提供IP地址服务/默认arp请求只会发到core的下层接口，使用ip helper-address *

23、来实现广播重定向R1(config)#ip dhcp pool testnetwork 10.9.64.0 255.255.255.0dns-server 10.9.100.3default-router 10.9.64.254 domain-name exitip dhcp pool test1network 10.9.65.0 255.255.255.0dns-server 10.9.100.3default-router 10.9.65.254 domain-name exitip dhcp pool test2network 10.9.66.0 255.255.255.0dns-ser

24、ver 10.9.100.3default-router 10.9.66.254 domain-name exitip dhcp pool test3network 10.9.67.0 255.255.255.0dns-server 10.9.100.3default-router 10.9.67.254 domain-name exitip dhcp excluded-address 10.9.64.201 10.9.64.254ip dhcp excluded-address 10.9.64.1 10.9.64.10ip dhcp excluded-address 10.9.65.201

25、10.9.65.254ip dhcp excluded-address 10.9.65.1 10.9.65.10ip dhcp excluded-address 10.9.66.201 10.9.66.254ip dhcp excluded-address 10.9.66.1 10.9.66.10ip dhcp excluded-address 10.9.67.201 10.9.67.254ip dhcp excluded-address 10.9.67.1 10.9.67.10Core1(config)#int vlan 64Core1(config-if)#ip helper-addres

26、s 10.9.96.9 Core1(config-if)#exitCore1(config)#int vlan 65Core1(config-if)#ip helper-address 10.9.96.9 Core1(config-if)#exitCore1(config)#int vlan 66Core1(config-if)#ip helper-address 10.9.96.9 Core1(config-if)#exitCore1(config)#int vlan 67Core1(config-if)#ip helper-address 10.9.96.9 Core1(config-if

27、)#exitCore2(config)#int vlan 64Core2(config-if)#ip helper-address 10.9.96.5 Core2(config-if)#exitCore2(config)#int vlan 65Core2(config-if)#ip helper-address 10.9.96.5 Core2(config-if)#exitCore2(config)#int vlan 66Core2(config-if)#ip helper-address 10.9.96.5 Core2(config-if)#exitCore2(config)#int vla

28、n 67Core2(config-if)#ip helper-address 10.9.96.511) 启用sw1 vlan 64-67的ip dhcp snooping功能,并只允许F0/23-24的dhcp reply数据包.Ip dhcp snooping sw1(config)#ip dhcp snooping vlan 64 sw1(config)#ip dhcp snooping vlan 65sw1(config)#ip dhcp snooping vlan 66sw1(config)#ip dhcp snooping vlan 67int range fa0/23 -24 ip dhcp snooping trust12) 测试core-1或者core-2断电时,网络可以正常运行.