大家好，欢迎来到IT知识分享网。
构建一个稳定而安全的企业网络需要依靠一系列技术，因之前给大家分享的文章中，涉及到的技术比较零散，今天给大家整理的这篇文章，是把之前的各个技术点整合到一起，便于大家对之前文章中提到的技术点有个整体概念。
本篇文章中涉及到 IP、VLAN、DHCP、NAT、WLAN等。
企业网络实验配置信息：
相关地址规划：
外网服务器地址：220.220.220.80/24 网关：220.220.220.1/24
外网地址：110.110.110.0/24 网关： 110.110.110.1/24
内网区域有线终端网段：192.168.10.0/24
内网区域无线终端网段：192.168.20.0/24
无线AP管理地址段：192.168.21.0/24
相关vlan划分：
有线终端：vlan10
无线终端：vlan20
无线设备管理：vlan21
设备互联：vlan255
网络拓扑：
详细配置过程：
1、外网区域 AR2配置
<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]undo inf
[Huawei]undo info-center en
Info: Information center is disabled.
[Huawei]
[Huawei]
[Huawei]sys
[Huawei]sysname INter-R2
[INter-R2]
[INter-R2]int
[INter-R2]interface gi
[INter-R2]interface GigabitEthernet 0/0/0
[INter-R2-GigabitEthernet0/0/0]ip add
[INter-R2-GigabitEthernet0/0/0]ip address 110.110.110.1 24
[INter-R2-GigabitEthernet0/0/0]int gi
[INter-R2-GigabitEthernet0/0/0]int gi 0/0/1
[INter-R2-GigabitEthernet0/0/1]ip add 220.220.220.1 24
[INter-R2-GigabitEthernet0/0/1]q
[INter-R2]2、外网server1端 配置
3、出口路由AR1配置
<Huawei>sys
Enter system view, return user view with Ctrl+Z.
#关闭提示信息
[Huawei]undo info-center en
Info: Information center is disabled.
[Huawei]
[Huawei]
#更改设备名称
[Huawei]sysna
[Huawei]sysname AR1
[AR1]
#对接口进行设置
[AR1]int
[AR1]interface gi
[AR1]interface GigabitEthernet 0/0/0
[AR1-GigabitEthernet0/0/0]des
[AR1-GigabitEthernet0/0/0]description to-hexin
[AR1-GigabitEthernet0/0/0]
[AR1-GigabitEthernet0/0/0]ip a
[AR1-GigabitEthernet0/0/0]ip add
[AR1-GigabitEthernet0/0/0]ip address 192.168.255.2 24
[AR1-GigabitEthernet0/0/0]int gi 0/0/1
[AR1-GigabitEthernet0/0/1]des
[AR1-GigabitEthernet0/0/1]description to-waiwang
[AR1-GigabitEthernet0/0/1]ip add 110.110.110.2 24
[AR1-GigabitEthernet0/0/1]q
[AR1]
#创建初级访问控制列表
[AR1]acl number 2002
[AR1-acl-basic-2002]ru
[AR1-acl-basic-2002]rule 5 per
[AR1-acl-basic-2002]rule 5 permit ?
fragment Check fragment packet
none-first-fragment Check the subsequence fragment packet
source Specify source address
time-range Specify a special time
vpn-instance Specify a VPN-Instance
<cr> Please press ENTER to execute command
[AR1-acl-basic-2002]rule 5 permit sour
[AR1-acl-basic-2002]rule 5 permit source 192.168.10.0 0.0.0.255
[AR1-acl-basic-2002]ru
[AR1-acl-basic-2002]rule 10 per
[AR1-acl-basic-2002]rule 10 permit ip ?
^
Error:Too many parameters found at '^' position.
[AR1-acl-basic-2002]rule 10 permit sour
[AR1-acl-basic-2002]rule 10 permit source 192.168.20.0 0.0.0.255
[AR1-acl-basic-2002]
[AR1-acl-basic-2002]q
#将ACL 应用到路由器的出口
[AR1]int gi 0/0/1
[AR1-GigabitEthernet0/0/1]nat out
[AR1-GigabitEthernet0/0/1]nat outbound 2002
[AR1-GigabitEthernet0/0/1]
[AR1-GigabitEthernet0/0/1]
[AR1-GigabitEthernet0/0/1]q
[AR1]
#添加静态路由
[AR1]ip route-static 0.0.0.0 0.0.0.0 110.110.110.1
#添加回城路由
[AR1]ip route-static 192.168.10.0 255.255.255.0 192.168.255.1 description youxian
[AR1]ip route-static 192.168.20.0 255.255.255.0 192.168.255.1 description wuxian
[AR1]4、核心交换机配置
<Huawei>
<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]undo int
[Huawei]undo inf
[Huawei]undo info-center en
Info: Information center is disabled.
[Huawei]
#创建vlan
[Huawei]vlan bat
[Huawei]vlan batch 10 20 to 21 255
Info: This operation may take a few seconds. Please wait for a moment...done.
[Huawei]
#给vlan添加描述信息
[Huawei]vlan 10
[Huawei-vlan10]dest
[Huawei-vlan10]des
[Huawei-vlan10]description youxian
[Huawei-vlan10]vlan 20
[Huawei-vlan20]dest
[Huawei-vlan20]des
[Huawei-vlan20]description wuxian
[Huawei-vlan20]vlan 21
[Huawei-vlan21]dec
[Huawei-vlan21]de
[Huawei-vlan21]description wuxian-manage
[Huawei-vlan21]vlan 255
[Huawei-vlan255]des
[Huawei-vlan255]description hulian-AR1
[Huawei-vlan255]q
[Huawei]
#创建地址池、设置网关，DNS，地址池范围
[Huawei]ip pool vlan10
Info:It's successful to create an IP address pool.
[Huawei-ip-pool-vlan10]gateway-list 192.168.10.1
[Huawei-ip-pool-vlan10]network 192.168.10.0 mask 255.255.255.0
[Huawei-ip-pool-vlan10]dns-list 114.114.114.114
[Huawei-ip-pool-vlan10]q
[Huawei]
[Huawei]ip pool vlan20
Info:It's successful to create an IP address pool.
[Huawei-ip-pool-vlan20]gateway-list 192.168.20.1
[Huawei-ip-pool-vlan20]network 192.168.20.0 mask 255.255.255.0
[Huawei-ip-pool-vlan20]dns-list 114.114.114.114
[Huawei-ip-pool-vlan20]q
[Huawei]
#设置网关ip
[Huawei]interface Vlanif 10
[Huawei-Vlanif10]ip add 192.168.10.1 24
[Huawei-Vlanif10]dhcp select global
Error: Please enable DHCP in the global view first.
[Huawei-Vlanif10]
[Huawei-Vlanif10]q
[Huawei]dhcp en
[Huawei]dhcp enable
Info: The operation may take a few seconds. Please wait for a moment.done.
[Huawei]
[Huawei]interface Vlanif 10
[Huawei-Vlanif10]dhcp select global
[Huawei-Vlanif10]q
[Huawei]
[Huawei]interface Vlanif 20
[Huawei-Vlanif20]ip add 192.168.20.1 24
[Huawei-Vlanif20]dhcp se
[Huawei-Vlanif20]dhcp select gl
[Huawei-Vlanif20]dhcp select global
[Huawei-Vlanif20]q
[Huawei]
[Huawei]interface Vlanif 255
[Huawei-Vlanif255]ip add 192.168.255.1 255.255.255.0
[Huawei-Vlanif255]q
[Huawei]
#将各个接口加入到各自的vlan中
[Huawei]interface GigabitEthernet 0/0/1
[Huawei-GigabitEthernet0/0/1]description to-AR1
[Huawei-GigabitEthernet0/0/1]port link-type access
[Huawei-GigabitEthernet0/0/1]port default vlan 255
[Huawei-GigabitEthernet0/0/1]q
[Huawei]
[Huawei]interface GigabitEthernet 0/0/2
[Huawei-GigabitEthernet0/0/2]port link-type access
[Huawei-GigabitEthernet0/0/2]port default vlan 10
[Huawei-GigabitEthernet0/0/2]q
[Huawei]
[Huawei]int GigabitEthernet 0/0/3
[Huawei-GigabitEthernet0/0/3]port link-type access
[Huawei-GigabitEthernet0/0/3]port default vlan 10
[Huawei-GigabitEthernet0/0/3]q
[Huawei]
[Huawei]interface GigabitEthernet 0/0/23
[Huawei-GigabitEthernet0/0/23]port link-type trunk
[Huawei-GigabitEthernet0/0/23]port trunk allow-pass vlan 20 to 21
[Huawei-GigabitEthernet0/0/23]port trunk pvid vlan 21
[Huawei-GigabitEthernet0/0/23]q
[Huawei]
[Huawei]interface GigabitEthernet 0/0/24
[Huawei-GigabitEthernet0/0/24]description to-AC6005
[Huawei-GigabitEthernet0/0/24]port link-type trunk
[Huawei-GigabitEthernet0/0/24]port trunk allow-pass vlan 20 to 21
[Huawei-GigabitEthernet0/0/24]q
[Huawei]
[Huawei]
#添加上联静态路由
[Huawei]
[Huawei]ip route-static 0.0.0.0 0.0.0.0 192.168.255.2
[Huawei]5、AC 管理配置
[AC6005]
[AC6005]vlan bat
[AC6005]vlan batch 21
Info: This operation may take a few seconds. Please wait for a moment...done.
[AC6005]dhcp en
Info: The operation may take a few seconds. Please wait for a moment.done.
[AC6005]
[AC6005]
[AC6005]vlan 21
[AC6005-vlan21]description wuxian-manage
[AC6005-vlan21]
[AC6005-vlan21]q
[AC6005]
[AC6005]int Vlanif 21
[AC6005-Vlanif21]ip add 192.168.21.1 24
[AC6005-Vlanif21]dhcp select interface
[AC6005-Vlanif21]
[AC6005-Vlanif21]q
[AC6005]
[AC6005]interface GigabitEthernet 0/0/1
[AC6005-GigabitEthernet0/0/1]port link-type trunk
[AC6005-GigabitEthernet0/0/1]port trunk allow-pass vlan 21
[AC6005-GigabitEthernet0/0/1]q
[AC6005]
[AC6005]capwap source interface Vlanif 21
[AC6005]
[AC6005]wlan
[AC6005-wlan-view]
[AC6005-wlan-view]security-profile name wyf-security
[AC6005-wlan-sec-prof-wyf-security]security wpa2 psk pass-phrase 88888888 aes
Warning: The current password is too simple. For the sake of security, you are a
dvised to set a password containing at least two of the following: lowercase let
ters a to z, uppercase letters A to Z, digits, and special characters. Continue?
[Y/N]:y
[AC6005-wlan-sec-prof-wyf-security]q
[AC6005-wlan-view]ssid-profile name wyf
[AC6005-wlan-view]ssid-profile name wyf-ssid
[AC6005-wlan-ssid-prof-wyf-ssid]ssid wyf
Info: This operation may take a few seconds, please wait.done.
[AC6005-wlan-ssid-prof-wyf-ssid]q
[AC6005-wlan-view]vap-profile name wyf-vap
[AC6005-wlan-vap-prof-wyf-vap]service-vlan vlan-id 20
Info: This operation may take a few seconds, please wait.done.
[AC6005-wlan-vap-prof-wyf-vap]ssid-profile wyf-ssid
Info: This operation may take a few seconds, please wait.done.
[AC6005-wlan-vap-prof-wyf-vap]q
[AC6005-wlan-view]sec
[AC6005-wlan-view]security-profile wy
[AC6005-wlan-view]security-profile wyf-security
^
Error: Unrecognized command found at '^' position.
[AC6005-wlan-view]security-profile ?
name Name
[AC6005-wlan-view]security-profile na
[AC6005-wlan-view]security-profile name ?
STRING<1-35> The profile name cannot have a double quotation mark at the firs
t or last character and cannot contain any space or
question mark
[AC6005-wlan-view]security-profile name wyf-security
[AC6005-wlan-sec-prof-wyf-security]
[AC6005-wlan-sec-prof-wyf-security]q
[AC6005-wlan-view]re
[AC6005-wlan-view]regulatory-domain-profile name wyf
[AC6005-wlan-regulate-domain-wyf]q
[AC6005-wlan-view]ap-group name wyf
Info: This operation may take a few seconds. Please wait for a moment.done.
[AC6005-wlan-ap-group-wyf]reg
[AC6005-wlan-ap-group-wyf]regulatory-domain-profile wyf
Warning: Modifying the country code will clear channel, power and antenna gain c
onfigurations of the radio and reset the AP. Continue?[Y/N]:y
[AC6005-wlan-ap-group-wyf]
[AC6005-wlan-ap-group-wyf]radio 0
[AC6005-wlan-group-radio-wyf/0]vap-profile wyf-vap wlan 1
Info: This operation may take a few seconds, please wait...done.
[AC6005-wlan-group-radio-wyf/0]q
[AC6005-wlan-ap-group-wyf]radi
[AC6005-wlan-ap-group-wyf]radio 1
[AC6005-wlan-group-radio-wyf/1]vap
[AC6005-wlan-group-radio-wyf/1]vap-profile wyf-va
[AC6005-wlan-group-radio-wyf/1]vap-profile wyf-vap wla
[AC6005-wlan-group-radio-wyf/1]vap-profile wyf-vap wlan 1
Info: This operation may take a few seconds, please wait...done.
[AC6005-wlan-group-radio-wyf/1]
[AC6005-wlan-group-radio-wyf/1]q
[AC6005-wlan-ap-group-wyf]ap id 0 ty
[AC6005-wlan-ap-group-wyf]ap id 0 ty
[AC6005-wlan-ap-group-wyf]ap-
[AC6005-wlan-ap-group-wyf]ap-?
ap-system-profile Bind AP system profile
[AC6005-wlan-ap-group-wyf]ap-id
[AC6005-wlan-ap-group-wyf]ap-i?
^
Error: Unrecognized command found at '^' position.
[AC6005-wlan-ap-group-wyf]q
[AC6005-wlan-view]ap
[AC6005-wlan-view]ap-
[AC6005-wlan-view]ap-group
[AC6005-wlan-view]ap-id 0 ty
[AC6005-wlan-view]ap-id 0 type-id 56 ap-ma
[AC6005-wlan-view]ap-id 0 type-id 56 ap-mac 00e0-fcb4-3110 ap-sn 210235448310EE0
5741D
[AC6005-wlan-ap-0]ap-
[AC6005-wlan-ap-0]ap-grou
[AC6005-wlan-ap-0]ap-group
[AC6005-wlan-ap-0]ap-?
ap-group AP group
ap-name AP name
ap-system-profile Bind AP system profile
[AC6005-wlan-ap-0]ap-name wyf01
[AC6005-wlan-ap-0]ap-group wyf
Warning: This operation may cause AP reset. If the country code changes, it will
clear channel, power and antenna gain configurations of the radio, Whether to c
ontinue? [Y/N]:y
Info: This operation may take a few seconds. Please wait for a moment.. done.
[AC6005-wlan-ap-0]q
[AC6005-wlan-view]
[AC6005-wlan-view]q
[AC6005]q
<AC6005>save
The current configuration will be written to the device.
Are you sure to continue? (y/n)[n]:y
It will take several minutes to save configuration file, please wait.......
Configuration file has been saved successfully
Note: The configuration file will take effect after being activated
<AC6005>测试：
无线设备STA1、STA2都 能够ping 通 server1和PC1/PC2
同理，有线终端PC 也能够ping通 外网server1和无线终端STA。
写在最后：
自我设限，固步自封，唯有突破极限，才能发掘潜能。以上就是本期整理的《构建稳定而安全的企业网络：网络规划的最佳实践》，自己经历过的风雨，所以知道你也会坚强。你的【点赞】+【关注】，我会自动解读为认可。
作者简介：
我是“网络系统技艺者”，系统运维工程师一枚，持续分享【网络技术+系统运维技术】干货。码字不易，如果您觉得文章还可以，就收藏吧，也许在以后某个时间能够用得到。
免责声明：本站所有文章内容,图片，视频等均是来源于用户投稿和互联网及文摘转载整编而成，不代表本站观点，不承担相关法律责任。其著作权各归其原作者或其出版社所有。如发现本站有涉嫌抄袭侵权/违法违规的内容,侵犯到您的权益，请在线联系站长,一经查实,本站将立刻删除。 本文来自网络,若有侵权，请联系删除，如若转载，请注明出处：https://yundeesoft.com/51990.html
