当前位置：文档库 › 大型企业网络分析案例

大型企业网络分析案例

有线网络结构设计背景

1.1总介绍

中国平安网络，由一个总公司网络、一个分公司网络和一个对外服务区组成。其中总公司网络和分公司网络在不同的地区，总公司和分公司都有公司内部的访问的数据中心（DMZ区）；对外服务区被托管在中国电信。路由器ISP模拟运营商中国电信。

2.1总公司

1）Router1作为边界路由也是核心层路由器；sw1、sw2是核心层交换机；sw3、sw4是汇聚层交换机，其中SW3分别连接了总公司部门1，总公司部门2和总公司部门3；SW4分别连接了总公司部门4，总公司部门5，总公司部门6，总公司Server以及无线路由器1。

2）总公司Server只能为公司内部提供服务，不对外提供服务。部门1,2,3,6均可访问内网Web，Ftp 和DNS服务器，部门4只可以访问内网FTP其他的都不可以访问，部门5可以访问内网Web

3.1分公司

Router9是出口路由器，其中sw5、sw4 是核心交换机，实现冗余架构；sw6、sw7是汇聚层交换机;其中SW6下面连接了部门1和部门2；SW7连接了部门3，部门4，Server 2以及无线路由器2。

内网ACL配置：部门1，2，4可以访问内网中的Web和Ftp服务器，部门3只可以访问内网的ftp 服务器。

4.1中国电信

企业总公司网络的出口路由器router1和分公司网络的出口路由器都与ISP相连接，其中router1和ISP之间使用了ppp广域网协议，启用了chap的认真方式实现与互联网相连；R9使用帧中继技术与ISP 相连。该企业的对外访问服务器托管到中国电信运营商。

二、拓扑结构

总体拓扑：

总公司拓扑：

分公司拓扑：

ISP外网即帧中继：

三、知识点

1.静态路由

2.RIP

3.单区域OSPF

4.EIGRP

5.EIGRP非等价负载均衡

6.ppp封装（chap）

7.帧中继

8.ACL访问控制

9.NAT地址转换10.STP的配置11.VLAN间的路由12 EIGRP手动汇总13.路由重分布14.默认路由15.T elnet 16.双链路冗余的备份17.DHCP的使用

四、主要功能

部门1,2,3,6均可访问内网Web，Ftp和DNS服务器。

部门4只可以访问内网FTP其他的都不可以访问。

部门5可以访问内网Web和Ftp但不可以访问DNS。

部门1，2,4可以访问外网Web以及公司总部的Web，Ftp服务器。部门3只可以访问公司总部的Ftp服务器。

五、主要配置清单

分公司Switch7配置：

(Switch#show running-config

Building configuration...

Current configuration : 2096 bytes

version 12.2

no service timestamps log datetime msec

no service timestamps debug datetime msec

no service password-encryption

hostname Switch

ip dhcp excluded-address 192.168.5.254

ip dhcp excluded-address 192.168.7.254

ip dhcp excluded-address 192.168.8.254

ip dhcp excluded-address 192.168.6.254

ip dhcp pool vlan7

network 192.168.7.0 255.255.255.0

default-router 192.168.7.254

dns-server 192.168.8.100

ip dhcp pool vlan8

network 192.168.8.0 255.255.255.0 default-router 192.168.8.254

dns-server 192.168.8.100

ip routing

spanning-tree mode pvst

interface FastEthernet0/1

interface FastEthernet0/2 switchport access vlan 100 switchport mode access

interface FastEthernet0/3

interface FastEthernet0/4

interface FastEthernet0/5 switchport access vlan 7 switchport mode access

interface FastEthernet0/6 switchport access vlan 8 switchport mode access

interface FastEthernet0/7

interface FastEthernet0/8

interface FastEthernet0/9

interface FastEthernet0/10 !

interface FastEthernet0/11 !

interface FastEthernet0/12 !

interface FastEthernet0/13 !

interface FastEthernet0/14 !

interface FastEthernet0/15 !

interface FastEthernet0/16 !

interface FastEthernet0/17 !

interface FastEthernet0/18 !

interface FastEthernet0/19 !

interface FastEthernet0/20 !

interface FastEthernet0/21 !

interface FastEthernet0/22 !

interface FastEthernet0/23 !

interface FastEthernet0/24 !

interface GigabitEthernet0/1 !

interface GigabitEthernet0/2 !

interface Vlan1

no ip address

shutdown

interface Vlan7

ip address 192.168.7.254 255.255.255.0

interface Vlan8

ip address 192.168.8.254 255.255.255.0

interface Vlan100

ip address 123.123.2.1 255.255.255.0

router eigrp 1

distance eigrp 90 150

redistribute ospf 1 metric 1000 100 255 1 1500 auto-summary

router ospf 1

log-adjacency-changes

network 192.168.6.0 0.0.0.255 area 0 network 192.168.7.0 0.0.0.255 area 0 network 192.168.8.0 0.0.0.255 area 0

ip classless

ip flow-export version 9

line con 0

line aux 0

line vty 0 4

end

总公司sw4

Switch#show run

Building configuration...

Current configuration : 2816 bytes

version 12.2

no service timestamps log datetime msec no service timestamps debug datetime msec no service password-encryption

hostname Switch

ip dhcp excluded-address 192.168.4.254

ip dhcp excluded-address 192.168.5.254

ip dhcp excluded-address 192.168.6.254

ip dhcp excluded-address 192.168.7.254

ip dhcp pool vlan5

network 192.168.5.0 255.255.255.0

default-router 192.168.5.254

dns-server 192.168.7.100

ip dhcp pool vlan6

network 192.168.6.0 255.255.255.0

default-router 192.168.6.254

dns-server 192.168.7.100

ip dhcp pool vlan7

network 192.168.7.0 255.255.255.0

default-router 192.168.7.254

dns-server 192.168.7.100

ip routing

spanning-tree mode pvst

interface FastEthernet0/1

no switchport

ip address 192.168.11.2 255.255.255.0 duplex auto

speed auto

interface FastEthernet0/2

interface FastEthernet0/3

interface FastEthernet0/4

interface FastEthernet0/5 switchport access vlan 5

switchport mode access

interface FastEthernet0/6 switchport access vlan 6

switchport mode access

interface FastEthernet0/7 switchport access vlan 7

switchport mode access

interface FastEthernet0/8

interface FastEthernet0/9

interface FastEthernet0/10

interface FastEthernet0/11

interface FastEthernet0/12

interface FastEthernet0/13

interface FastEthernet0/14

interface FastEthernet0/15

interface FastEthernet0/16

interface FastEthernet0/17

interface FastEthernet0/18

interface FastEthernet0/19

interface FastEthernet0/20

interface FastEthernet0/21

interface FastEthernet0/22

interface FastEthernet0/23

interface FastEthernet0/24

no switchport

ip address 192.168.1.2 255.255.255.0 duplex auto

speed auto

interface GigabitEthernet0/1

interface GigabitEthernet0/2

interface Vlan1

no ip address

shutdown

interface Vlan5

ip address 192.168.5.254 255.255.255.0 !

interface Vlan6

ip address 192.168.6.254 255.255.255.0

interface Vlan7

ip address 192.168.7.254 255.255.255.0

ip access-group 100 out

router rip

version 2

network 192.168.1.0

network 192.168.5.0

network 192.168.6.0

network 192.168.7.0

network 192.168.11.0

ip classless

ip flow-export version 9

access-list 100 permit tcp any host 192.168.7.100 eq www

access-list 100 permit tcp any host 192.168.7.100 eq ftp

access-list 100 permit udp 192.168.2.0 0.0.0.255 host 192.168.7.100 eq domain access-list 100 permit udp 192.168.3.0 0.0.0.255 host 192.168.7.100 eq domain access-list 100 permit udp 192.168.4.0 0.0.0.255 host 192.168.7.100 eq domain access-list 100 permit udp 192.168.7.0 0.0.0.255 host 192.168.7.100 eq domain access-list 100 deny tcp any host 192.168.7.100

access-list 100 deny udp any host 192.168.7.100

access-list 100 permit ip any any

line con 0

line aux 0

line vty 0 4

end

总公司SW3

Switch#show run

Building configuration...

Current configuration : 1791 bytes

version 12.2

no service timestamps log datetime msec no service timestamps debug datetime msec no service password-encryption

hostname Switch

ip routing

spanning-tree mode pvst

interface FastEthernet0/1

no switchport

ip address 192.168.10.2 255.255.255.0 duplex auto

speed auto

interface FastEthernet0/2 switchport access vlan 2 switchport mode access

interface FastEthernet0/3 switchport access vlan 3 switchport mode access

interface FastEthernet0/4 switchport access vlan 4 switchport mode access

interface FastEthernet0/5 !

interface FastEthernet0/6 !

interface FastEthernet0/7 !

interface FastEthernet0/8 !

interface FastEthernet0/9 !

interface FastEthernet0/10 !

interface FastEthernet0/11 !

interface FastEthernet0/12 !

interface FastEthernet0/13 !

interface FastEthernet0/14 !

interface FastEthernet0/15 !

interface FastEthernet0/16 !

interface FastEthernet0/17 !

interface FastEthernet0/18 !

interface FastEthernet0/19 !

interface FastEthernet0/20

interface FastEthernet0/21

interface FastEthernet0/22

interface FastEthernet0/23

interface FastEthernet0/24

no switchport

ip address 192.168.1.1 255.255.255.0 duplex auto

speed auto

interface GigabitEthernet0/1

interface GigabitEthernet0/2

interface Vlan1

no ip address

shutdown

interface Vlan2

ip address 192.168.2.254 255.255.255.0 !

interface Vlan3

ip address 192.168.3.254 255.255.255.0 !

interface Vlan4

ip address 192.168.4.254 255.255.255.0 !

router rip

version 2

network 192.168.1.0

network 192.168.2.0

network 192.168.3.0

network 192.168.4.0

network 192.168.5.0

network 192.168.6.0

network 192.168.10.0

ip classless

ip flow-export version 9

line con 0

line aux 0

line vty 0 4

end

总公司R1

R1#show run

Building configuration...

Current configuration : 1575 bytes

version 12.4

no service timestamps log datetime msec no service timestamps debug datetime msec no service password-encryption

hostname R1

no ip cef

no ipv6 cef

username ISP password 0 123

spanning-tree mode pvst

interface FastEthernet0/0

ip address 172.16.11.1 255.255.255.0 ip nat inside

duplex auto

speed auto

interface FastEthernet0/1

ip address 172.16.22.1 255.255.255.0 ip nat inside

duplex auto

speed auto

interface Serial0/3/0

ip address 63.5.1.1 255.255.255.0 encapsulation ppp

ppp authentication chap

ip nat outside

clock rate 2000000

interface Serial0/3/1

no ip address

clock rate 2000000

shutdown

interface Vlan1

no ip address

shutdown

router rip

version 2

network 63.0.0.0

network 172.16.0.0

network 192.168.1.0

network 192.168.2.0

network 192.168.3.0

network 192.168.4.0

network 192.168.5.0

network 192.168.6.0

network 192.168.7.0

network 192.168.10.0

network 192.168.11.0

ip nat pool abc 63.5.1.10 63.5.1.50 netmask 255.255.255.0 ip nat inside source list 10 pool abc

ip nat inside source static 192.168.7.100 63.5.1.100

ip classless

ip route 0.0.0.0 0.0.0.0 63.5.1.2

ip flow-export version 9

access-list 10 permit 192.168.2.0 0.0.0.255

access-list 10 permit 192.168.3.0 0.0.0.255

access-list 10 permit 192.168.4.0 0.0.0.255

access-list 10 permit 192.168.5.0 0.0.0.255

access-list 10 permit 192.168.6.0 0.0.0.255

access-list 10 permit 192.168.7.0 0.0.0.255

no cdp run

line con 0

line aux 0

line vty 0 4

password cisco

end

分公司SW6

Switch#show running-config

Building configuration...

Current configuration : 1429 bytes

version 12.2

no service timestamps log datetime msec no service timestamps debug datetime msec no service password-encryption

hostname Switch

ip routing

spanning-tree mode pvst

interface FastEthernet0/1 switchport access vlan 100 switchport mode access

interface FastEthernet0/2

interface FastEthernet0/3

interface FastEthernet0/4

no switchport

ip address 192.168.4.2 255.255.255.0 duplex auto

speed auto

interface FastEthernet0/5

interface FastEthernet0/6

interface FastEthernet0/7

interface FastEthernet0/8

interface FastEthernet0/9

interface FastEthernet0/10

interface FastEthernet0/11

interface FastEthernet0/12

interface FastEthernet0/13

interface FastEthernet0/14

interface FastEthernet0/15

interface FastEthernet0/16

interface FastEthernet0/17

interface FastEthernet0/18

interface FastEthernet0/19

interface FastEthernet0/20

interface FastEthernet0/21

interface FastEthernet0/22

interface FastEthernet0/23

interface FastEthernet0/24

interface GigabitEthernet0/1

interface GigabitEthernet0/2

interface Vlan1

no ip address

shutdown

interface Vlan100

ip address 123.123.1.1 255.255.255.0

router eigrp 1

distance eigrp 90 150

redistribute ospf 1 metric 1000 100 255 1 1500 auto-summary

ip classless

ip flow-export version 9

line con 0

line aux 0

line vty 0 4