h3c路由器防火墻組網(防火墻Trunk模式組網實驗)實驗拓撲注：如無特別說明，描述中的R1或SW1對應拓撲中設備名稱末尾數字為1的設備，R2或SW2對應拓撲中設備名稱末尾數字為2的設備，以此類推；另外，同一網段中，IP地址的主機位為其設備編號，如R3的g0/0接口若在192.168.1.0/24網段，則其IP地址為192.168.1.3/24，以此類推。實驗需求1.按照圖示配置IP地址，R2，SW3分別配置Loopback0口地址作為OSPF的Router_id，地址格式為X.X.X.X/32，X為設備編號。2.按照圖示配置OSPF，實現全網互通3.將F1060防火墻配置為透明模式，采用Trunk的方式為R1、SW1透傳業務。實驗解法1.配置IP地址（環回口部分略）分析：S5820V2交換機為三層交換機，將接口改為路由模式進行配置IP地址。這里要把MSR36-20路由器接口改為二層模式。步驟1：在SW3上進入g1/0/1接口的接口視圖，修改接口模式為路由模式，配置IP地址為192.168.2.254/24[SW1]interfaceGigabitEthernet1/0/1[SW1-GigabitEthernet1/0/1]portlink-moderoute[SW1-GigabitEthernet1/0/1]ipaddress192.168.2.25424[SW1]interfaceGigabitEthernet1/0/2[SW1-GigabitEthernet1/0/2]portlink-moderoute[SW1-GigabitEthernet1/0/2]ipaddress10.0.0.324步驟2：在R2上進入g0/0接口的接口視圖，修改二層接口模式，創建VLAN，啟用三層接口配置IP地址，并在接口放行相關VLAN。[R2]interfaceGigabitEthernet0/0[R2-GigabitEthernet0/0]portlink-modebridge[R2-GigabitEthernet0/0]portlink-typetrunk[R2-GigabitEthernet0/0]porttrunkpermitvlan10[R2-GigabitEthernet0/0]undoporttrunkpermitvlan1[R2-GigabitEthernet0/0]quit[R2]vlan10[R2-vlan10]quit[R2]interfaceVlan-interface10[R2-Vlan-interface10]ipad10.0.0.2242.按照圖示配置OSPF，實現全網互通分析：實現全網互通，意味著每臺路由器都要宣告本地的所有直連網段，包括環回口所在的網段。同時，每臺路由器手動配置各自環回口的IP地址作為Router-id步驟1：在R2上配置OSPF，按區域宣告所有直連網段和環回口[R2]ospf1router-id2.2.2.2[R2-ospf-1]area0.0.0.0[R2-ospf-1-area-0.0.0.0]network10.0.0.00.0.0.255[R2-ospf-1-area-0.0.0.0]network2.2.2.20.0.0.0[R2-ospf-1-area-0.0.0.0]network192.168.1.00.0.0.255步驟2：在SW3上配置OSPF，按區域宣告所有直連網段和環回口[SW3]ospf1router-id3.3.3.3[SW3-ospf-1]area0.0.0.0[SW3-ospf-1-area-0.0.0.0]network10.0.0.00.0.0.255[SW3-ospf-1-area-0.0.0.0]network1.1.1.10.0.0.0[SW3-ospf-1-area-0.0.0.0]network192.168.2.00.0.0.2553.配置防火墻相關策略放行流量步驟1：登錄防火墻admin/adminlogin:adminPassword:admin步驟2：創建VLAN，并設置對應端口Trunk放行[FW1]vlan10[FW1-vlan10]portGigabitEthernet1/0/0[FW1-vlan10]portGigabitEthernet1/0/1[FW1]interfaceGigabitEthernet1/0/0[FW1-GigabitEthernet1/0/0]portlink-typetrunk[FW1-GigabitEthernet1/0/0]porttrunkpermitvlan10[FW1-GigabitEthernet1/0/0]undoporttrunkpermitvlan1[FW1]interfaceGigabitEthernet1/0/1[FW1-GigabitEthernet1/0/1]portlink-typetrunk[FW1-GigabitEthernet1/0/1]porttrunkpermitvlan10[FW1-GigabitEthernet1/0/1]undoporttrunkpermitvlan1步驟3：配置防火墻安全區域，將接口加入到對應區域[FW1]security-zonenameTrust[FW1-security-zone-Trust]importinterfaceGigabitEthernet1/0/0vlan10[FW1-security-zone-Trust]quit[FW1]security-zonenameUntrust[FW1-security-zone-Untrust]importinterfaceGigabitEthernet1/0/1vlan10[FW1-security-zone-Untrust]quit步驟4:配置一條基本ACL[FW1]aclbasic2000[FW1-acl-ipv4-basic-2000]rule0permitsourceany4.設置防火墻安全策略[FW1]zone-pairsecuritysourcetrustdestinationuntrust[FW1-zone-pair-security-Trust-Untrust]packet-filter2000[FW1-zone-pair-security-Trust-Untrust]quit[FW1]zone-pairsecuritysourceuntrustdestinationtrust[FW1-zone-pair-security-Untrust-Trust]packet-filter2000[FW1-zone-pair-security-Untrust-Trust]quit[FW1]zone-pairsecuritysourcetrustdestinationtrust[FW1-zone-pair-security-Trust-Trust]packet-filter2000[FW1-zone-pair-security-Trust-Trust]quit[FW1]zone-pairsecuritysourceuntrustdestinationuntrust[FW1-zone-pair-security-Untrust-Untrust]packet-filter2000[FW1-zone-pair-security-Untrust-Untrust]quit5.測試結果1.PC之間可以相互PING通ping192.168.2.1Ping192.168.2.1(192.168.2.1):56databytes,pressCTRL_Ctobreak56bytesfrom192.168.2.1:icmp_seq=0ttl=253time=3.000ms56bytesfrom192.168.2.1:icmp_seq=1ttl=253time=2.000ms56bytesfrom192.168.2.1:icmp_seq=2ttl=253time=3.000ms56bytesfrom192.168.2.1:icmp_seq=3ttl=253time=3.000ms56bytesfrom192.168.2.1:icmp_seq=4ttl=253time=2.000msping192.168.1.1Ping192.168.1.1(192.168.1.1):56databytes,pressCTRL_Ctobreak56bytesfrom192.168.1.1:icmp_seq=0ttl=253time=3.000ms56bytesfrom192.168.1.1:icmp_seq=1ttl=253time=2.000ms56bytesfrom192.168.1.1:icmp_seq=2ttl=253time=2.000ms56bytesfrom192.168.1.1:icmp_seq=3ttl=253time=3.000ms56bytesfrom192.168.1.1:icmp_seq=4ttl=253time=2.000ms2.分別查看R2，SW3的OSPF鄰居信息[R2]displayospfpeerOSPFProcess1withRouterID2.2.2.2NeighborBriefinformationArea:0.0.0.0RouterIDAddressPriDead-TimeStateInterface3.3.3.310.0.0.3132Full/DRGE0/1[SW3]displayospfpeerOSPFProcess1withRouterID3.3.3.3NeighborBriefinformationArea:0.0.0.0RouterIDAddressPriDead-TimeStateInterface2.2.2.210.0.0.2134Full/BDRGE1/0/23.分別查看R2，SW3的路由表信息，查看是否學習到相關路由[R2]displayiprouting-tableDestinations:19Routes:19Destination/MaskProtoPreCostNextHopInterface0.0.0.0/32Direct00127.0.0.1InLoop02.2.2.2/32Direct00127.0.0.1InLoop03.3.3.3/32O_INTRA10110.0.0.3GE0/110.0.0.0/24Direct0010.0.0.2GE0/110.0.0.0/32Direct0010.0.0.2GE0/110.0.0.2/32Direct00127.0.0.1InLoop010.0.0.255/32Direct0010.0.0.2GE0/1127.0.0.0/8Direct00127.0.0.1InLoop0127.0.0.0/32Direct00127.0.0.1InLoop0127.0.0.1/32Direct00127.0.0.1InLoop0127.255.255.255/32Direct00127.0.0.1InLoop0192.168.1.0/24Direct00192.168.1.254GE0/0192.168.1.0/32Direct00192.168.1.254GE0/0192.168.1.254/32Direct00127.0.0.1InLoop0192.168.1.255/32Direct00192.168.1.254GE0/0192.168.2.0/24O_INTRA10210.0.0.3GE0/1224.0.0.0/4Direct000.0.0.0NULL0224.0.0.0/24Direct000.0.0.0NULL0255.255.255.255/32Direct00127.0.0.1InLoop0[SW3]displayiprouting-tableDestinations:19Routes:19Destination/MaskProtoPreCostNextHopInterface0.0.0.0/32Direct00127.0.0.1InLoop02.2.2.2/32O_INTRA10110.0.0.2GE1/0/23.3.3.3/32Direct00127.0.0.1InLoop010.0.0.0/24Direct0010.0.0.3GE1/0/210.0.0.0/32Direct0010.0.0.3GE1/0/210.0.0.3/32Direct00127.0.0.1InLoop010.0.0.255/32Direct0010.0.0.3GE1/0/2127.0.0.0/8Direct00127.0.0.1InLoop0127.0.0.0/32Direct00127.0.0.1InLoop0127.0.0.1/32Direct00127.0.0.1InLoop0127.255.255.255/32Direct00127.0.0.1InLoop0192.168.1.0/24O_INTRA10210.0.0.2GE1/0/2192.168.2.0/24Direct00192.168.2.254GE1/0/1192.168.2.0/32Direct00192.168.2.254GE1/0/1192.168.2.254/32Direct00127.0.0.1InLoop0192.168.2.255/32Direct00192.168.2.254GE1/0/1224.0.0.0/4Direct000.0.0.0NULL0224.0.0.0/24Direct000.0.0.0NULL0255.255.255.255/32Direct00127.0.0.1InLoop0