当前位置：首页 > news >正文

作业3—策略路由练习实验

news 2026/8/2 3:55:31

一、实验拓扑图及需求

实验拓扑图

需求

1、Client1属于财务部，Client2属于研发部
2、企业内网存在一个web-server服务器
3、FW上通过ISP路由将电信和联通的路由网段进行导入，并补充缺省路由
公网路由器运行OSPF协议实现公网环境网络可达
4、公网用户1通过电信DNS解析web-server服务器地址，要求通过FW的GE1/0/1接口进入访问
公网用户2通过联通DNS解析web-server服务器地址，要求通过FW的GE1/0/2接口进入访问
5、财务部访问FTP服务器时，通过电信网络通行
研发部访问FTP服务器时，通过联通网络通行
使用策略路由选路机制，并开启IP-LINK检测
策略路由需要基于源IP和用户的认证方式
6、财务部采用免认证方式，研发部采用匿名认证方式，添加用户组和地址组信息
7、外网访问内网采用NAT Server技术进行映射
内网访问外网采用esay-ip方式进行数据访问通信
8、安全策略要求编写精准策略

二、需求分析

三、实验步骤

<sw1>system-view [sw1]sysname sw1 # 创建所需VLAN [sw1]vlan batch 10 20 30 # GE0/0/1 配置Trunk [sw1]interface GigabitEthernet 0/0/1 [sw1-GigabitEthernet0/0/1]port link-type trunk [sw1-GigabitEthernet0/0/1]port trunk allow-pass vlan 10 20 30 [sw1-GigabitEthernet0/0/1]quit # GE0/0/2 Access VLAN10 [sw1]interface GigabitEthernet 0/0/2 [sw1-GigabitEthernet0/0/2]port link-type access [sw1-GigabitEthernet0/0/2]port default vlan 10 [sw1-GigabitEthernet0/0/2]quit # GE0/0/3 Access VLAN20 [sw1]interface GigabitEthernet 0/0/3 [sw1-GigabitEthernet0/0/3]port link-type access [sw1-GigabitEthernet0/0/3]port default vlan 20 [sw1-GigabitEthernet0/0/3]quit # GE0/0/4 Access VLAN30 [sw1]interface GigabitEthernet 0/0/4 [sw1-GigabitEthernet0/0/4]port link-type access [sw1-GigabitEthernet0/0/4]port default vlan 30 [sw1-GigabitEthernet0/0/4]quit

<Huawei>system-view [Huawei]sysname R4 # ========== GigabitEthernet0/0/0 ========== [R4]interface GigabitEthernet 0/0/0 [R4-GigabitEthernet0/0/0]ip address 14.0.0.4 255.255.255.0 [R4-GigabitEthernet0/0/0]shutdown [R4-GigabitEthernet0/0/0]quit # ========== GigabitEthernet0/0/1 ========== [R4]interface GigabitEthernet 0/0/1 [R4-GigabitEthernet0/0/1]ip address 34.0.0.4 255.255.255.0 [R4-GigabitEthernet0/0/1]undo shutdown [R4-GigabitEthernet0/0/1]quit # ========== GigabitEthernet0/0/2 ========== [R4]interface GigabitEthernet 0/0/2 [R4-GigabitEthernet0/0/2]ip address 100.1.1.254 255.255.255.0 [R4-GigabitEthernet0/0/2]undo shutdown [R4-GigabitEthernet0/0/2]quit # ========== GigabitEthernet0/0/3 ========== [R4]interface GigabitEthernet 0/0/3 [R4-GigabitEthernet0/0/3]ip address 101.1.1.254 255.255.255.0 [R4-GigabitEthernet0/0/3]undo shutdown [R4-GigabitEthernet0/0/3]quit [R4]ospf 1 [R4-ospf-1]area 0 [R4-ospf-1-area-0.0.0.0]network 34.0.0.0 0.0.0.255 [R4-ospf-1-area-0.0.0.0]quit [R4-ospf-1]quit

<Huawei>system-view [Huawei]sysname R3 # GigabitEthernet0/0/0 34.0.0.3/24 [R3]interface GigabitEthernet 0/0/0 [R3-GigabitEthernet0/0/0]ip address 34.0.0.3 255.255.255.0 [R3-GigabitEthernet0/0/0]undo shutdown [R3-GigabitEthernet0/0/0]quit # GigabitEthernet0/0/1 23.0.0.3/24 [R3]interface GigabitEthernet 0/0/1 [R3-GigabitEthernet0/0/1]ip address 23.0.0.3 255.255.255.0 [R3-GigabitEthernet0/0/1]undo shutdown [R3-GigabitEthernet0/0/1]quit # GigabitEthernet0/0/2 50.0.0.254/24 [R3]interface GigabitEthernet 0/0/2 [R3-GigabitEthernet0/0/2]ip address 50.0.0.254 255.255.255.0 [R3-GigabitEthernet0/0/2]undo shutdown [R3-GigabitEthernet0/0/2]quit

<Huawei>system-view [Huawei]sysname R2 [R2]interface GigabitEthernet 0/0/0 [R2-GigabitEthernet0/0/0]ip address 12.0.0.2 255.255.255.0 [R2-GigabitEthernet0/0/0]shutdown [R2-GigabitEthernet0/0/0]quit [R2]interface GigabitEthernet 0/0/1 [R2-GigabitEthernet0/0/1]ip address 23.0.0.2 255.255.255.0 [R2-GigabitEthernet0/0/1]undo shutdown [R2-GigabitEthernet0/0/1]quit [R2]interface GigabitEthernet 0/0/2 [R2-GigabitEthernet0/0/2]ip address 200.1.1.254 255.255.255.0 [R2-GigabitEthernet0/0/2]undo shutdown [R2-GigabitEthernet0/0/2]quit [R2]interface GigabitEthernet 0/0/3 [R2-GigabitEthernet0/0/3]ip address 102.1.1.254 255.255.255.0 [R2-GigabitEthernet0/0/3]undo shutdown [R2-GigabitEthernet0/0/3]quit

<Huawei>system-view [Huawei]sysname FW # 1. GigabitEthernet0/0/0 [FW]interface GigabitEthernet 0/0/0 [FW-GigabitEthernet0/0/0]ip address 192.168.0.1 255.255.255.0 [FW-GigabitEthernet0/0/0]undo shutdown [FW-GigabitEthernet0/0/0]quit # 2. GigabitEthernet1/0/0 主接口 [FW]interface GigabitEthernet 1/0/0 [FW-GigabitEthernet1/0/0]portswitch [FW-GigabitEthernet1/0/0]undo shutdown [FW-GigabitEthernet1/0/0]quit # 子接口10：GigabitEthernet1/0/0.10 封装802.1Q VLAN10 [FW]interface GigabitEthernet 1/0/0.10 [FW-GigabitEthernet1/0/0.10]dot1q termination vid 10 [FW-GigabitEthernet1/0/0.10]ip address 192.168.1.254 255.255.255.0 [FW-GigabitEthernet1/0/0.10]arp broadcast enable [FW-GigabitEthernet1/0/0.10]quit # 子接口20：GigabitEthernet1/0/0.20 封装802.1Q VLAN20 [FW]interface GigabitEthernet 1/0/0.20 [FW-GigabitEthernet1/0/0.20]dot1q termination vid 20 [FW-GigabitEthernet1/0/0.20]ip address 192.168.2.254 255.255.255.0 [FW-GigabitEthernet1/0/0.20]arp broadcast enable [FW-GigabitEthernet1/0/0.20]quit # 子接口30：GigabitEthernet1/0/0.30 封装802.1Q VLAN30 [FW]interface GigabitEthernet 1/0/0.30 [FW-GigabitEthernet1/0/0.30]dot1q termination vid 30 [FW-GigabitEthernet1/0/0.30]ip address 192.168.3.254 255.255.255.0 [FW-GigabitEthernet1/0/0.30]arp broadcast enable [FW-GigabitEthernet1/0/0.30]quit # 3. GigabitEthernet1/0/1 [FW]interface GigabitEthernet 1/0/1 [FW-GigabitEthernet1/0/1]ip address 14.0.0.1 255.255.255.0 [FW-GigabitEthernet1/0/1]undo shutdown [FW-GigabitEthernet1/0/1]quit # 4. GigabitEthernet1/0/2 [FW]interface GigabitEthernet 1/0/2 [FW-GigabitEthernet1/0/2]ip address 12.0.0.1 255.255.255.0 [FW-GigabitEthernet1/0/2]undo shutdown [FW-GigabitEthernet1/0/2]quit

地址组

认证策略

IP-link链路探测

策略路由

查看全文

http://www.jsqmd.com/news/1311005/