一、实验拓扑图及需求实验拓扑图需求1、Client1属于财务部Client2属于研发部2、企业内网存在一个web-server服务器3、FW上通过ISP路由将电信和联通的路由网段进行导入并补充缺省路由公网路由器运行OSPF协议实现公网环境网络可达4、公网用户1通过电信DNS解析web-server服务器地址要求通过FW的GE1/0/1接口进入访问公网用户2通过联通DNS解析web-server服务器地址要求通过FW的GE1/0/2接口进入访问5、财务部访问FTP服务器时通过电信网络通行研发部访问FTP服务器时通过联通网络通行使用策略路由选路机制并开启IP-LINK检测策略路由需要基于源IP和用户的认证方式6、财务部采用免认证方式研发部采用匿名认证方式添加用户组和地址组信息7、外网访问内网采用NAT Server技术进行映射内网访问外网采用esay-ip方式进行数据访问通信8、安全策略要求编写精准策略二、需求分析三、实验步骤sw1system-view [sw1]sysname sw1 # 创建所需VLAN [sw1]vlan batch 10 20 30 # GE0/0/1 配置Trunk [sw1]interface GigabitEthernet 0/0/1 [sw1-GigabitEthernet0/0/1]port link-type trunk [sw1-GigabitEthernet0/0/1]port trunk allow-pass vlan 10 20 30 [sw1-GigabitEthernet0/0/1]quit # GE0/0/2 Access VLAN10 [sw1]interface GigabitEthernet 0/0/2 [sw1-GigabitEthernet0/0/2]port link-type access [sw1-GigabitEthernet0/0/2]port default vlan 10 [sw1-GigabitEthernet0/0/2]quit # GE0/0/3 Access VLAN20 [sw1]interface GigabitEthernet 0/0/3 [sw1-GigabitEthernet0/0/3]port link-type access [sw1-GigabitEthernet0/0/3]port default vlan 20 [sw1-GigabitEthernet0/0/3]quit # GE0/0/4 Access VLAN30 [sw1]interface GigabitEthernet 0/0/4 [sw1-GigabitEthernet0/0/4]port link-type access [sw1-GigabitEthernet0/0/4]port default vlan 30 [sw1-GigabitEthernet0/0/4]quitHuaweisystem-view [Huawei]sysname R4 # GigabitEthernet0/0/0 [R4]interface GigabitEthernet 0/0/0 [R4-GigabitEthernet0/0/0]ip address 14.0.0.4 255.255.255.0 [R4-GigabitEthernet0/0/0]shutdown [R4-GigabitEthernet0/0/0]quit # GigabitEthernet0/0/1 [R4]interface GigabitEthernet 0/0/1 [R4-GigabitEthernet0/0/1]ip address 34.0.0.4 255.255.255.0 [R4-GigabitEthernet0/0/1]undo shutdown [R4-GigabitEthernet0/0/1]quit # GigabitEthernet0/0/2 [R4]interface GigabitEthernet 0/0/2 [R4-GigabitEthernet0/0/2]ip address 100.1.1.254 255.255.255.0 [R4-GigabitEthernet0/0/2]undo shutdown [R4-GigabitEthernet0/0/2]quit # GigabitEthernet0/0/3 [R4]interface GigabitEthernet 0/0/3 [R4-GigabitEthernet0/0/3]ip address 101.1.1.254 255.255.255.0 [R4-GigabitEthernet0/0/3]undo shutdown [R4-GigabitEthernet0/0/3]quit [R4]ospf 1 [R4-ospf-1]area 0 [R4-ospf-1-area-0.0.0.0]network 34.0.0.0 0.0.0.255 [R4-ospf-1-area-0.0.0.0]quit [R4-ospf-1]quitHuaweisystem-view [Huawei]sysname R3 # GigabitEthernet0/0/0 34.0.0.3/24 [R3]interface GigabitEthernet 0/0/0 [R3-GigabitEthernet0/0/0]ip address 34.0.0.3 255.255.255.0 [R3-GigabitEthernet0/0/0]undo shutdown [R3-GigabitEthernet0/0/0]quit # GigabitEthernet0/0/1 23.0.0.3/24 [R3]interface GigabitEthernet 0/0/1 [R3-GigabitEthernet0/0/1]ip address 23.0.0.3 255.255.255.0 [R3-GigabitEthernet0/0/1]undo shutdown [R3-GigabitEthernet0/0/1]quit # GigabitEthernet0/0/2 50.0.0.254/24 [R3]interface GigabitEthernet 0/0/2 [R3-GigabitEthernet0/0/2]ip address 50.0.0.254 255.255.255.0 [R3-GigabitEthernet0/0/2]undo shutdown [R3-GigabitEthernet0/0/2]quitHuaweisystem-view [Huawei]sysname R2 [R2]interface GigabitEthernet 0/0/0 [R2-GigabitEthernet0/0/0]ip address 12.0.0.2 255.255.255.0 [R2-GigabitEthernet0/0/0]shutdown [R2-GigabitEthernet0/0/0]quit [R2]interface GigabitEthernet 0/0/1 [R2-GigabitEthernet0/0/1]ip address 23.0.0.2 255.255.255.0 [R2-GigabitEthernet0/0/1]undo shutdown [R2-GigabitEthernet0/0/1]quit [R2]interface GigabitEthernet 0/0/2 [R2-GigabitEthernet0/0/2]ip address 200.1.1.254 255.255.255.0 [R2-GigabitEthernet0/0/2]undo shutdown [R2-GigabitEthernet0/0/2]quit [R2]interface GigabitEthernet 0/0/3 [R2-GigabitEthernet0/0/3]ip address 102.1.1.254 255.255.255.0 [R2-GigabitEthernet0/0/3]undo shutdown [R2-GigabitEthernet0/0/3]quitHuaweisystem-view [Huawei]sysname FW # 1. GigabitEthernet0/0/0 [FW]interface GigabitEthernet 0/0/0 [FW-GigabitEthernet0/0/0]ip address 192.168.0.1 255.255.255.0 [FW-GigabitEthernet0/0/0]undo shutdown [FW-GigabitEthernet0/0/0]quit # 2. GigabitEthernet1/0/0 主接口 [FW]interface GigabitEthernet 1/0/0 [FW-GigabitEthernet1/0/0]portswitch [FW-GigabitEthernet1/0/0]undo shutdown [FW-GigabitEthernet1/0/0]quit # 子接口10GigabitEthernet1/0/0.10 封装802.1Q VLAN10 [FW]interface GigabitEthernet 1/0/0.10 [FW-GigabitEthernet1/0/0.10]dot1q termination vid 10 [FW-GigabitEthernet1/0/0.10]ip address 192.168.1.254 255.255.255.0 [FW-GigabitEthernet1/0/0.10]arp broadcast enable [FW-GigabitEthernet1/0/0.10]quit # 子接口20GigabitEthernet1/0/0.20 封装802.1Q VLAN20 [FW]interface GigabitEthernet 1/0/0.20 [FW-GigabitEthernet1/0/0.20]dot1q termination vid 20 [FW-GigabitEthernet1/0/0.20]ip address 192.168.2.254 255.255.255.0 [FW-GigabitEthernet1/0/0.20]arp broadcast enable [FW-GigabitEthernet1/0/0.20]quit # 子接口30GigabitEthernet1/0/0.30 封装802.1Q VLAN30 [FW]interface GigabitEthernet 1/0/0.30 [FW-GigabitEthernet1/0/0.30]dot1q termination vid 30 [FW-GigabitEthernet1/0/0.30]ip address 192.168.3.254 255.255.255.0 [FW-GigabitEthernet1/0/0.30]arp broadcast enable [FW-GigabitEthernet1/0/0.30]quit # 3. GigabitEthernet1/0/1 [FW]interface GigabitEthernet 1/0/1 [FW-GigabitEthernet1/0/1]ip address 14.0.0.1 255.255.255.0 [FW-GigabitEthernet1/0/1]undo shutdown [FW-GigabitEthernet1/0/1]quit # 4. GigabitEthernet1/0/2 [FW]interface GigabitEthernet 1/0/2 [FW-GigabitEthernet1/0/2]ip address 12.0.0.1 255.255.255.0 [FW-GigabitEthernet1/0/2]undo shutdown [FW-GigabitEthernet1/0/2]quit地址组认证策略IP-link链路探测策略路由