基于eNSP防火墙千人中型校园(企业)网络规划与设计-ensp综合实验.rar

## 企业网络规划一(三层)：  ~~~java 要求： * 完成服务器、防火墙、路由器等接口地址的配置 * 配置Eth-Trunk 链路捆绑实现链路冗余 * 企业内部划分多个vlan,减小广播域大小，提高网络的可靠性 * 配置MSTP+VRRP实现流量负载分担，同时实现冗余，并配置相应的stp优化技术stp收敛，并减少stp震荡 * 所有用户均为自动获取IP地址 * 配置相应的DHCP snooping隔绝非法DHCP server * 配置OSPF和静态路由实现三层路由互通 * 防火墙配置安全策略，放行内网区域到dmz区的流量 * 防火墙配置NAT策略和安全策略，使得用户可以访问外网百度 * 防火墙配置服务器映射和安全策略，允许外网用户Client通过公网地址100.100.100.100访问web服务器 * 防火墙配置相应策略，允许外网用户Client通过公网http://100.100.100.100访问登录web服务器 * 用户能够通过域名(www.baidu.com)访问外网百度 * 内部财务服务器只允许vlan 50用户访问 * LSW1-LSW12交换机都能被telent(huawei 5555) * 无线WLAN配置，且业务vlan 101 102也可以通过域名(www.baidu.com)访问外网百度 ~~~ #### 1、VLAN Trunk配置 ~~~java HX_SW1: <Huawei>sy [Huawei]un in en [Huawei]sysname HX_SW1 [HX_SW1]int Eth-Trunk 1 [HX_SW1-Eth-Trunk1]mode lacp-static [HX_SW1-Eth-Trunk1]trunkport g0/0/7 [HX_SW1-Eth-Trunk1]trunkport g0/0/8 [HX_SW1-Eth-Trunk1]q ------------------------------------ HX_SW2: <Huawei>sys [Huawei]un in en [Huawei]sysname HX_SW2 [HX_SW2]int Eth-Trunk 1 [HX_SW2-Eth-Trunk1]mode lacp-static [HX_SW2-Eth-Trunk1]trunkport g0/0/7 [HX_SW2-Eth-Trunk1]trunkport g0/0/8 [HX_SW2-Eth-Trunk1]q ------------------------------------ HJ_SW4: <Huawei>sy [Huawei]sysname HJ_SW4 [HJ_SW4]int Eth-Trunk 2 [HJ_SW4-Eth-Trunk2]mode lacp-static [HJ_SW4-Eth-Trunk2]trunkport g0/0/4 [HJ_SW4-Eth-Trunk2]trunkport g0/0/5 [HJ_SW4-Eth-Trunk2]q ------------------------------------ JR_SW9: <Huawei>sy [Huawei]un in en [Huawei]sysname JR_SW9 [JR_SW9]int Eth-Trunk 2 [JR_SW9-Eth-Trunk2]mode lacp-static [JR_SW9-Eth-Trunk2]trunkport g0/0/4 [JR_SW9-Eth-Trunk2]trunkport g0/0/5 [JR_SW9-Eth-Trunk2]dis eth-trunk//查看eth-trunk的配置 ~~~ #### 2、VLAN 底层配置 ~~~java JR_SW6: <Huawei>SY [Huawei]un in en [Huawei]sysname JR_SW6 [JR_SW6]vlan batch 20 30 40 50 60 70 80 200 900 [JR_SW6]int g0/0/1 [JR_SW6-GigabitEthernet0/0/1]port link-type trunk [JR_SW6-GigabitEthernet0/0/1]port trunk allow-pass vlan 20 30 900 [JR_SW6-GigabitEthernet0/0/1]int g0/0/2 [JR_SW6-GigabitEthernet0/0/2]port link-type access [JR_SW6-GigabitEthernet0/0/2]port default vlan 20 [JR_SW6-GigabitEthernet0/0/2]int g0/0/3 [JR_SW6-GigabitEthernet0/0/3]port link-type access [JR_SW6-GigabitEthernet0/0/3]port default vlan 30 [JR_SW6-GigabitEthernet0/0/3] ------------------------------------ JR_SW7: <Huawei>SYS [Huawei]un in en [Huawei]sysname JR_SW7 [JR_SW7]vlan batch 20 30 40 50 60 70 80 200 900 [JR_SW7]int g0/0/1 [JR_SW7-GigabitEthernet0/0/1]port link-type trunk [JR_SW7-GigabitEthernet0/0/1]port trunk allow-pass vlan 40 900 [JR_SW7-GigabitEthernet0/0/1]int g0/0/2 [JR_SW7-GigabitEthernet0/0/2]port link-type access [JR_SW7-GigabitEthernet0/0/2]port default vlan 40 [JR_SW7-GigabitEthernet0/0/2]qui ------------------------------------ HJ_SW3: <Huawei>system-view [Huawei]un in en [Huawei]sysname HJ_SW3 [HJ_SW3]vlan batch 20 30 40 50 60 70 80 200 900 [HJ_SW3]int g0/0/1 [HJ_SW3-GigabitEthernet0/0/1]port link-type trunk [HJ_SW3-GigabitEthernet0/0/1]port trunk allow-pass vlan 20 30 40 900 [HJ_SW3-GigabitEthernet0/0/1]int g0/0/2 [HJ_SW3-GigabitEthernet0/0/2]port link-type trunk [HJ_SW3-GigabitEthernet0/0/2]port trunk allow-pass vlan 20 30 40 900 [HJ_SW3-GigabitEthernet0/0/2]int g0/0/3 [HJ_SW3-GigabitEthernet0/0/3]port link-type trunk [HJ_SW3-GigabitEthernet0/0/3]port trunk allow-pass vlan 20 30 900 [HJ_SW3-GigabitEthernet0/0/3]int g0/0/4 [HJ_SW3-GigabitEthernet0/0/4]port link-type trunk [HJ_SW3-GigabitEthernet0/0/4]port trunk allow-pass vlan 40 900 ------------------------------------ JR_SW8: <Huawei>SYS [Huawei]sys [Huawei]sysname JR_SW8 [JR_SW8]vlan batch 20 30 40 50 60 70 80 200 900 [JR_SW8]int g0/0/1 [JR_SW8-GigabitEthernet0/0/1]port link-type trunk [JR_SW8-GigabitEthernet0/0/1]port trunk allow-pass vlan 50 900 [JR_SW8-GigabitEthernet0/0/1]int g0/0/2 [JR_SW8-GigabitEthernet0/0/2]port link-type access [JR_SW8-GigabitEthernet0/0/2]port default vlan 50 ------------------------------------ JR_SW9: <JR_SW9>SYS [JR_SW9]vlan batch 20 30 40 50 60 70 80 200 900 [JR_SW9]int g0/0/3 [JR_SW9-GigabitEthernet0/0/3]port link-type access [JR_SW9-GigabitEthernet0/0/3]port default vlan 60 [JR_SW9-GigabitEthernet0/0/3]qui [JR_SW9]int Eth-Trunk 2 [JR_SW9-Eth-Trunk2]port link-type trunk [JR_SW9-Eth-Trunk2]port trunk allow-pass vlan 60 900 [JR_SW9-Eth-Trunk2]qui ------------------------------------ HJ_SW4: <HJ_SW4>sys [HJ_SW4]vlan batch 20 30 40 50 60 70 80 200 900 [HJ_SW4]int g0/0/1 [HJ_SW4-GigabitEthernet0/0/1]port link-type trunk [HJ_SW4-GigabitEthernet0/0/1]port trunk allow-pass vlan 50 60 900 [HJ_SW4-GigabitEthernet0/0/1]int g0/0/2 [HJ_SW4-GigabitEthernet0/0/2]port link-type trunk [HJ_SW4-GigabitEthernet0/0/2]port trunk allow-pass vlan 50 60 900 [HJ_SW4-GigabitEthernet0/0/2]int g0/0/3 [HJ_SW4-GigabitEthernet0/0/3]port link-type trunk [HJ_SW4-GigabitEthernet0/0/3]port trunk allow-pass vlan 50 900 [HJ_SW4-GigabitEthernet0/0/3]qui [HJ_SW4]int Eth-Trunk 2 [HJ_SW4-Eth-Trunk2]port link-type trunk [HJ_SW4-Eth-Trunk2]port trunk allow-pass vlan 60 900 [HJ_SW4-Eth-Trunk2]qui [HJ_SW4] ------------------------------------ JR_SW10: <Huawei>sys [Huawei]un in en [Huawei]sysname JR_SW10 [JR_SW10]vlan batch 20 30 40 50 60 70 80 200 900 [JR_SW10]int g0/0/1 [JR_SW10-GigabitEthernet0/0/1]port link-type trunk [JR_SW10-GigabitEthernet0/0/1]port trunk allow-pass vlan 70 900 [JR_SW10-GigabitEthernet0/0/1]int g0/0/2 [JR_SW10-GigabitEthernet0/0/2]port link-type access [JR_SW10-GigabitEthernet0/0/2]port default vlan 70 [JR_SW10-GigabitEthernet0/0/2]qui ------------------------------------ JR_SW11: <JR_SW11>sys [JR_SW11]vlan batch 20 30 40 50 60 70 80 200 900 [JR_SW11]int g0/0/1 [JR_SW11-GigabitEthernet0/0/1]port link-type trunk [JR_SW11-GigabitEthernet0/0/1]port trunk allow-pass vlan 80 900 [JR_SW11-GigabitEthernet0/0/1]int g0/0/2 [JR_SW11-GigabitEthernet0/0/2]port link-type access [JR_SW11-GigabitEthernet0/0/2]port default vlan 80 [JR_SW11-GigabitEthernet0/0/2]int g0/0/3 [JR_SW11-GigabitEthernet0/0/3]port link-type access [JR_SW11-GigabitEthernet0/0/3]port default vlan 80 ------------------------------------ HJ_SW5: <Huawei>system-view [Huawei]un in en [Huawei]sysname HJ_SW5 [HJ_SW5]vlan batch 20 30 40 50 60 70 80 200 900 [HJ_SW5]int g0/0/1 [HJ_SW5-GigabitEthernet0/0/1]port link-type trunk [HJ_SW5-GigabitEthernet0/0/1]port trunk allow-pass vlan 70 80 900 [HJ_SW5-GigabitEthernet0/0/1]int g0/0/2 [HJ_SW5-GigabitEthernet0/0/2]port link-type trunk [HJ_SW5-GigabitEthernet0/0/2]port trunk allow-pass vlan 70 80 900 [HJ_SW5-GigabitEthernet0/0/2]int g0/0/3 [HJ_SW5-GigabitEthernet0/0/3]port link-type trunk [HJ_SW5-GigabitEthernet0/0/3]port trunk allow-pass vlan 70 900 [HJ_SW5-GigabitEthernet0/0/3]int g0/0/4 [HJ_SW5-GigabitEthernet0/0/4]port link-type trunk [HJ_SW5-GigabitEthernet0/0/4]port trunk allow-pass vlan 80 900 [HJ_SW5-GigabitEthernet0/0/4]qui ------------------------------------ JR_SW12: <Huawei>sy [Huawei]un in en [Huawei]sysname JR_SW12 [JR_SW12]vlan batch 20 30 40 50 60 70 80 200 900 [JR_SW12]int g0/0/1 [JR_SW12-GigabitEthernet0/0/1]port link-type trunk [JR_SW12-GigabitEthernet0/0/1]port trunk allow-