周峰的博客

large picture of the cover

网络互联项目互联实践配置命令

网络互联项目互联实践配置命令，呕心沥血之做。

实验拓扑图

image

实验要求

  • 配置并检验设备基本配置
  • 配置VLAN
  • 配置VLAN间路由
  • 配置DHCP
  • 配置NAT
  • 配置路由协议
  • 配置Web 服务器、DNS服务器
  • 检验端到端连通性
  • WLAN基本功能（选做)
  • 防火墙基本功能（选做)

开始实验

image-1669449615048

SW1配置

<Huawei>sys
[Huawei]vlan 10
[Huawei-vlan10]vlan 20
[Huawei-vlan20]int vlan 10
[Huawei-Vlanif20]ip ad 192.168.10.1 24
[Huawei]int GigabitEthernet 0/0/21
[Huawei-GigabitEthernet0/0/21]port link-type trunk 
[Huawei-GigabitEthernet0/0/21]port trunk allow-pass vlan 10 20
[Huawei-GigabitEthernet0/0/21]int GigabitEthernet 0/0/22
[Huawei-GigabitEthernet0/0/22]port link-type trunk
[Huawei-GigabitEthernet0/0/22]port trunk allow-pass vlan 10 20
[Huawei]int Eth-Trunk 1    #开始 链路聚合
[Huawei-Eth-Trunk1]trunkport g 0/0/23 to 0/0/24
[Huawei-Eth-Trunk1]port link-type trunk 
[Huawei-Eth-Trunk1]port trunk allow-pass vlan 10 20
[Huawei]int vlan20
[Huawei-Vlanif20]ip ad 192.168.20.2 24

#开始mstp配置
[Huawei]stp region-configuration
[Huawei-mst-region]region-name groupzhoufeng
[Huawei-mst-region]instance 1 vlan 10
[Huawei-mst-region]instance 2 vlan 20
[Huawei-mst-region]active region-configuration
[Huawei-mst-region]qu
[Huawei]stp instance 1 root primary 
[Huawei]stp instance 2 root secondary 
[Huawei]stp mode mstp 

#开始vrrp配置
[Huawei]int vlan 10
[Huawei-Vlanif10]vrrp vrid 1 virtual-ip 192.168.10.254
[Huawei-Vlanif10]vrrp vrid 1 priority 110
[Huawei-Vlanif10]int vlan 20
[Huawei-Vlanif20]vrrp vrid 2 virtual-ip 192.168.20.254
[Huawei-Vlanif20]vrrp vrid 2 priority 100


#开始ospf配置
[Huawei]vlan 80
[Huawei-vlan80]int vlan 80
[Huawei-Vlanif80]ip ad 10.1.80.1 24
[Huawei-Vlanif80]in g0/0/1
[Huawei-GigabitEthernet0/0/1]port link-type access 
[Huawei-GigabitEthernet0/0/1]port default vlan 80
[Huawei]ospf 1
[Huawei-ospf-1]area 0
[Huawei-ospf-1-area-0.0.0.0]network 10.1.80.0 0.0.0.255
[Huawei-ospf-1-area-0.0.0.0]network 192.168.10.0 0.0.0.255
[Huawei-ospf-1-area-0.0.0.0]network 192.168.20.0 0.0.0.255


#开始dhcp中继
[Huawei]dhcp enable
[Huawei]interface Vlanif 10
[Huawei-Vlanif10]dhcp select relay 
[Huawei-Vlanif10]dhcp relay server-ip 10.1.80.2

[Huawei-Vlanif10]interface Vlanif 20
[Huawei-Vlanif20]dhcp select relay
[Huawei-Vlanif20]dhcp relay server-ip 10.1.80.2

#ospf引入直连和静态路由
[Huawei]ospf 1
[Huawei-ospf-1]import-route direct
[Huawei-ospf-1]import-route static

SW2配置

<Huawei>sys
[Huawei]vlan 10
[Huawei-vlan10]vlan 20
[Huawei-vlan20]int vlan 20
[Huawei-Vlanif20]ip ad 192.168.20.1 24
[Huawei]int GigabitEthernet 0/0/21
[Huawei-GigabitEthernet0/0/21]port link-type trunk 
[Huawei-GigabitEthernet0/0/21]port trunk allow-pass vlan 10 20
[Huawei-GigabitEthernet0/0/21]int GigabitEthernet 0/0/22
[Huawei-GigabitEthernet0/0/22]port link-type trunk
[Huawei-GigabitEthernet0/0/22]port trunk allow-pass vlan 10 20
[Huawei]int Eth-Trunk 1   #开始 链路聚合
[Huawei-Eth-Trunk1]trunkport g 0/0/23 to 0/0/24
[Huawei-Eth-Trunk1]port link-type trunk 
[Huawei-Eth-Trunk1]port trunk allow-pass vlan 10 20
[Huawei]int vlan 10
[Huawei-Vlanif10]ip ad 192.168.10.2 24

#开始mstp配置
[Huawei]stp region-configuration
[Huawei-mst-region]region-name groupzhoufeng
[Huawei-mst-region]instance 1 vlan 10
[Huawei-mst-region]instance 2 vlan 20
[Huawei-mst-region]active region-configuration
[Huawei-mst-region]qu
[Huawei]stp instance 2 root primary 
[Huawei]stp instance 1 root secondary 
[Huawei]stp mode mstp 

#开始vrrp配置
[Huawei]int vlan 10
[Huawei-Vlanif10]vrrp vrid 1 virtual-ip 192.168.10.254
[Huawei-Vlanif10]vrrp vrid 1 priority 100
[Huawei-Vlanif10]int vlan 20
[Huawei-Vlanif20]vrrp vrid 2 virtual-ip 192.168.20.254
[Huawei-Vlanif20]vrrp vrid 2 priority 110





#开始ospf配置
[Huawei]vlan 90
[Huawei-vlan90]int vlan 90
[Huawei-Vlanif90]ip ad 10.1.90.1 24
[Huawei-GigabitEthernet0/0/1]int g0/0/1
[Huawei-GigabitEthernet0/0/1]port link-type access 
[Huawei-GigabitEthernet0/0/1]port default vlan 90
[Huawei]ospf 1
[Huawei-ospf-1]area 0
[Huawei-ospf-1-area-0.0.0.0]network 10.1.90.0 0.0.0.255
[Huawei-ospf-1-area-0.0.0.0]network 192.168.10.0 0.0.0.255
[Huawei-ospf-1-area-0.0.0.0]network 192.168.20.0 0.0.0.255

#开始dhcp中继
[Huawei]dhcp enable
[Huawei]interface Vlanif 10
[Huawei-Vlanif10]dhcp select relay 
[Huawei-Vlanif10]dhcp relay server-ip 10.1.90.2

[Huawei-Vlanif10]interface Vlanif 20
[Huawei-Vlanif20]dhcp select relay
[Huawei-Vlanif20]dhcp relay server-ip 10.1.90.2

#ospf引入直连和静态路由
[Huawei]ospf 1
[Huawei-ospf-1]import-route direct
[Huawei-ospf-1]import-route static

SW3配置

<Huawei>sys
[Huawei]vlan 10
[Huawei]vlan 20
[Huawei-vlan20]int g0/0/1
[Huawei-GigabitEthernet0/0/1]port link-type trunk 
[Huawei-GigabitEthernet0/0/1]port trunk allow-pass vlan 10 20
[Huawei-GigabitEthernet0/0/1]int e0/0/1
[Huawei-Ethernet0/0/1]port link-type access 
[Huawei-Ethernet0/0/1]port default vlan 20
[Huawei-Ethernet0/0/1]int e0/0/2
[Huawei-Ethernet0/0/2]port link-type access
[Huawei-Ethernet0/0/2]port default vlan 10
[Huawei-GigabitEthernet0/0/1]int g0/0/2
[Huawei-GigabitEthernet0/0/2]port link-type trunk 
[Huawei-GigabitEthernet0/0/2]port trunk allow-pass vlan 10 20
#开始mstp配置
[Huawei]stp region-configuration 
[Huawei-mst-region]region-name groupzhoufeng

[Huawei-mst-region]instance 1 vlan 10
[Huawei-mst-region]instance 2 vlan 20
[Huawei-mst-region]active region-configuration 
[Huawei]stp mode mstp

SW4配置

<Huawei>sys
[Huawei]vlan 10
[Huawei]vlan 20
[Huawei-vlan20]int g0/0/1
[Huawei-GigabitEthernet0/0/1]port link-type trunk 
[Huawei-GigabitEthernet0/0/1]port trunk allow-pass vlan 10 20
[Huawei-GigabitEthernet0/0/1]int e0/0/1
[Huawei-Ethernet0/0/1]port link-type access 
[Huawei-Ethernet0/0/1]port default vlan 20
[Huawei-Ethernet0/0/1]int e0/0/2
[Huawei-Ethernet0/0/2]port link-type access
[Huawei-Ethernet0/0/2]port default vlan 10
[Huawei-GigabitEthernet0/0/1]int g0/0/2
[Huawei-GigabitEthernet0/0/2]port link-type trunk 
[Huawei-GigabitEthernet0/0/2]port trunk allow-pass vlan 10 20

#开始mstp配置
[Huawei]stp region-configuration 
[Huawei-mst-region]region-name groupzhoufeng

[Huawei-mst-region]instance 1 vlan 10
[Huawei-mst-region]instance 2 vlan 20
[Huawei-mst-region]active region-configuration 
[Huawei]stp mode mstp

AR1配置

#开始ospf配置
<Huawei>sys
[Huawei]int g0/0/0
[Huawei-GigabitEthernet0/0/0]ip ad 10.1.80.2 24
[Huawei-GigabitEthernet0/0/0]int g0/0/1
[Huawei-GigabitEthernet0/0/1]ip ad 10.1.90.2 24
[Huawei]ospf 1
[Huawei-ospf-1]area 0
[Huawei-ospf-1-area-0.0.0.0]network 10.1.80.2 0.0.0.255
[Huawei-ospf-1-area-0.0.0.0]network 10.1.90.0 0.0.0.255


#开始dhcp服务器配置
[Huawei]ip pool vlan10
[Huawei-ip-pool-vlan10]gateway-list 192.168.10.254
[Huawei-ip-pool-vlan10]network 192.168.10.0 mask 255.255.255.0
[Huawei-ip-pool-vlan10]dns-list 30.30.30.2
[Huawei-ip-pool-vlan10]excluded-ip-address 192.168.10.1 192.168.10.2
[Huawei-ip-pool-vlan10]ip pool vlan20
[Huawei-ip-pool-vlan20]gateway-list 192.168.20.254
[Huawei-ip-pool-vlan20]dns-list 30.30.30.2
[Huawei-ip-pool-vlan20]network 192.168.20.0 mask 255.255.255.0
[Huawei-ip-pool-vlan20]excluded-ip-address 192.168.20.1 192.168.20.2
[Huawei]dhcp enable 
[Huawei]int g0/0/0
[Huawei-GigabitEthernet0/0/0]dhcp select global
[Huawei]int g0/0/1
[Huawei-GigabitEthernet0/0/1]dhcp select global 

#配置web服务器IP
[Huawei]int g5/0/0
[Huawei-GigabitEthernet5/0/0]ip ad 192.168.100.1 24 #（web服务器ip配置为192.168.100.2）
[Huawei-GigabitEthernet5/0/0]ospf 1
[Huawei-ospf-1]import-route direct #（ospf中引入直连路由）




[Huawei]int g0/0/2
[Huawei-GigabitEthernet0/0/2]ip ad 192.168.200.1 24
[Huawei-GigabitEthernet0/0/2]

#设置路由
[Huawei]ip ro 20.20.20.0 24 192.168.200.2
[Huawei]ip ro 30.30.30.0 24 192.168.200.2
[Huawei]ip ro 192.168.30.0 24 192.168.200.2

#ospf引入静态路由
[Huawei]ospf 1
[Huawei-ospf-1]import-route static 



#ospf引入直连路由
[Huawei]ospf 1
[Huawei-ospf-1]import-route direct

AR2配置

<Huawei>sys
[Huawei]int g0/0/0
[Huawei-GigabitEthernet0/0/0]ip ad 20.20.20.2 24
[Huawei]int g0/0/2
[Huawei-GigabitEthernet0/0/2]ip ad 19.19.19.2 24
[Huawei-GigabitEthernet0/0/2]int g5/0/0
[Huawei-GigabitEthernet5/0/0]ip ad 30.30.30.1 24

#打路由
[Huawei]ip ro 192.168.30.0 24 19.19.19.1
[Huawei]ip ro 192.168.20.0 24 20.20.20.1
[Huawei]ip ro 192.168.10.0 24 20.20.20.1
[Huawei]ip ro 192.168.100.0 24 20.20.20.1

AR3配置

<Huawei>sys

[Huawei]int g0/0/1
[Huawei-GigabitEthernet0/0/1]ip ad 192.168.30.1 24
[Huawei-GigabitEthernet0/0/1]int g0/0/0
[Huawei-GigabitEthernet0/0/0]ip ad 19.19.19.1 24
#开始配置nat
[Huawei]acl 2000
[Huawei-acl-basic-2000]rule permit source 192.168.30.0 0.0.0.255
[Huawei-acl-basic-2000]int g0/0/0
[Huawei-GigabitEthernet0/0/0]nat outbound 2000
[Huawei]ip ro 0.0.0.0 0 19.19.19.2

FW2配置

#防火墙默认账号：admin
#默认密码：Admin@123


#账号admin
#密码zhoufeng1.
<USG6000V1>sys
[USG6000V1]int g1/0/0
[USG6000V1-GigabitEthernet1/0/0]ip ad 192.168.200.2 24
[USG6000V1-GigabitEthernet1/0/0]int g1/0/1
[USG6000V1-GigabitEthernet1/0/0]ip ad 20.20.20.1 24
[USG6000V1-GigabitEthernet1/0/0]qu
[USG6000V1]firewall zone trust 
[USG6000V1-zone-trust]add interface g1/0/0
[USG6000V1-zone-trust]qu
[USG6000V1]firewall zone untrust 
[USG6000V1-zone-untrust]add interface g1/0/1

#配置nat（easy ip）
[USG6000V1]nat-policy
[USG6000V1-policy-nat]rule name easyip
[USG6000V1-policy-nat-rule-easyip]source-address 192.168.10.0 24
[USG6000V1-policy-nat-rule-easyip]source-address 192.168.100.0 24
[USG6000V1-policy-nat-rule-easyip]source-address 192.168.20.0 24
[USG6000V1-policy-nat-rule-easyip]source-zone trust 
[USG6000V1-policy-nat-rule-easyip]destination-zone untrust
[USG6000V1-policy-nat-rule-easyip]action source-nat easy-ip 
[USG6000V1-policy-nat-rule-easyip]qu
[USG6000V1-policy-nat]rule  name easyip1
[USG6000V1-policy-nat-rule-easyip1]
[USG6000V1-policy-nat-rule-easyip1]rule name easyip1
[USG6000V1-policy-nat-rule-easyip1]source-zone untrust
[USG6000V1-policy-nat-rule-easyip1]destination-zone trust
[USG6000V1-policy-nat-rule-easyip1]source-address 19.19.19.0 mask 255.255.255.0
[USG6000V1-policy-nat-rule-easyip1]source-address 30.30.30.0 mask 255.255.255.0
[USG6000V1-policy-nat-rule-easyip1]action source-nat easy-ip

#防火墙策略
[USG6000V1]security-policy
[USG6000V1-policy-security]rule name fhq
[USG6000V1-policy-security-rule-fhq]source-zone trust
[USG6000V1-policy-security-rule-fhq]destination-zone untrust
[USG6000V1-policy-security-rule-fhq]action permit
[USG6000V1-policy-security-rule-fhq]qu
[USG6000V1-policy-security-rule-fhq]rule name fhq1
[USG6000V1-policy-security-rule-fhq1]source-zone untrust
[USG6000V1-policy-security-rule-fhq1]destination-zone trust
[USG6000V1-policy-security-rule-fhq1]action permit

#允许端口服务
[USG6000V1-policy-security-rule-fhq]INT G1/0/0
[USG6000V1-GigabitEthernet1/0/0]service-manage all permit 
[USG6000V1]int g1/0/1	
[USG6000V1-GigabitEthernet1/0/1]service-manage all permit 
#配置到trust区路由
[USG6000V1]ip ro 192.168.10.0 24 192.168.200.1
[USG6000V1]ip ro 192.168.20.0 24 192.168.200.1
[USG6000V1]ip ro 192.168.100.0 192.168.200.1

#配置默认路由
[USG6000V1]ip ro 0.0.0.0 0 20.20.20.2

web服务器配置

image-1669456579266

dns服务器配置

image-1669456646530
image-1669456694240

结果验证

image-1669452353491
image-1669452394295
image-1669452585710
禁止转载！

site logo

Hi,Friend

© 2026 周峰的博客