项目实战案例：中型公司网络构架改革

不久前做过一个小项目,是某公司发展需要,需要对目前网络进行改革:
1.针对于不同的部门划分不同的区域进行网络管理,确保每处区域都可以正常访问公网.
有销售部,财务部,信息安全,高层管理,市场部,服务器区域,2间主讲教室

2.针对目前公司整体的规范化管理需要进行以下网络限制.
a) 禁止除高层管理办公室以外的所有部门上QQ
b) 教师内只得在每天中午12:30-13:30期间可以访问外网.
c) 对服务器区域的所有限制及设定:

!金和OA协同办公系统服务器:允许所有部门人员访问,但只允许信息安全部人员进行
远程管理.金和OA系统采用Windows2003系统,开放3389端口进行远程管理.
!用友U8财务系统,只允许财务部门以及高层管理部门以WEB方式进行访问.
!公司网站服务器.使用LAMP构架方式.允许市场部进行管理,并可以通过ftp方式进行
上传数据或下载数据.其他部门只有WEB访问权限.
!公司远程教育服务器,只允许主讲教师的教师机以及远程端教室的教师机进行访问.

3.配置DHCP服务器,2间主讲教室中分别是两台教师机使用静态IP地址.

4.建立远程教学系统,三家分中心与公司相连,其中一家分中心还另外连接一处本地大学教室.
根据以上叙述,拓扑图如下:



核心路由器配置如下:
interface e0/0
no ip address
lookback 0 (回环)
ipaddress 1.1.1.1 255.255.255.255
配置dhcp
ip dhcp pool xiaoshou
network 192.168.10.0 255.255.255.0
default-router 192.168.10.1
dns-server 202.106.0.20
lease 2
exit
ip dhcp pool caiwu
network 192.168.15.0 255.255.255.0
default-router 192.168.15.1
dns-server 202.106.0.20
lease 2
exit
ip dhcp pool xinxi
network 192.168.20.0 255.255.255.0
default-router 192.168.20.1
dns-server 202.106.0.20
lease 2
exit
ip dhcp pool gaoceng
network 192.168.25.0 255.255.255.0
default-router 192.168.25.1
dns-server 202.106.0.20
lease 2
exit
ip dhcp pool shichang
network 192.168.30.0 255.255.255.0
default-router 192.168.30.1
dns-server 202.106.0.20
lease 2
exit
ip dhcp pool jiaoshi1
network 192.168.35.0 255.255.255.0
default-router 192.168.35.1
dns-server 202.106.0.20
lease 2
exit
ip dhcp pool jiaoshi2
network 192.168.40.0 255.255.255.0
default-router 192.168.40.1
dns-server 202.106.0.20
lease 2
exit
预留IP地址
ip dhcp excluded-address 192.168.10.1
ip dhcp excluded-address 192.168.15.1
ip dhcp excluded-address 192.168.20.1
ip dhcp excluded-address 192.168.25.1
ip dhcp excluded-address 192.168.30.1
ip dhcp excluded-address 192.168.35.1 192.168.35.3
ip dhcp excluded-address 192.168.40.1 192.168.40.3

配置子接口来连接不同的vlan
interface eth0/0.1
encapsulation dot1Q 100
ip address 192.168.10.1 255.255.255.0
ip access-group xiaoshou in
ip nat inside
exit
interface eth0/0.2
encapsulation dot1Q 200
ip address 192.168.15.1 255.255.255.0
ip access-group caiwu in
ip nat inside
exit
interface eth0/0.3
encapsulation dot1Q 300
ip address 192.168.20.1 255.255.255.0
ip access-group xinxi in
ip nat inside
exit
interface eth0/0.4
encapsulation dot1Q 400
ip address 192.168.25.1 255.255.255.0
ip access-group gaoceng in
ip nat inside
exit
interface eth0/0.5
encapsulation dot1Q 500
ip address 192.168.30.1 255.255.255.0
ip access-group shichang in
ip nat inside
exit
interface eth0/0.6
encapsulation dot1Q 600
ip address 192.168.35.1 255.255.255.0
ip access-group jiaoshi in
ip nat inside
exit
interface eth0/0.7
encapsulation dot1Q 700
ip address 192.168.40.1 255.255.255.0
ip access-group jiaoshi in
ip nat inside
exit
interface eth0/0.8
encapsulation dot1Q 800
ip address 192.168.45.1 255.255.255.0
ip access-group server in
ip nat inside
exit
interface eth0/0.9
encapsulation dot1Q 900
ip address 192.168.50.1 255.255.255.0
ip nat inside
exit
interface eth0/0.10
encapsulation dot1Q 1000
ip address 201.241.1.195 255.255.255.224
ip nat outside
exit
默认路由
ip route 0.0.0.0 0.0.0.0 201.241.1.193
配置ospf链路状态的路由协议
router ospf 100
network 192.168.10.0 0.0.0.255 area 0
network 192.168.15.0 0.0.0.255 area 0
network 192.168.20.0 0.0.0.255 area 0
network 192.168.25.0 0.0.0.255 area 0
network 192.168.30.0 0.0.0.255 area 0
network 192.168.35.0 0.0.0.255 area 0
network 192.168.40.0 0.0.0.255 area 0
network 192.168.45.0 0.0.0.255 area 0
network 192.168.50.0 0.0.0.255 area 0
network 201.241.1.192 0.0.0.31 area 0
动态地址转换
ip nat pool liyang 201.241.1.195 201.241.1.198 netmask 255.255.255.0
access-list 1 permit 192.168.0.0 0.0.255.255
ip nat inside source list 1 pool liyang overload
配置ACL 进行安全管理
ip access-list extended caiwu
deny tcp any any eq 135
deny tcp any any eq 136
deny tcp any any eq 137
deny tcp any any eq 138
deny tcp any any eq 445
deny udp any any eq 8000
permit ip any any
ip access-list extended gaoguan
deny tcp any any eq 135
deny tcp any any eq 136
deny tcp any any eq 137
deny tcp any any eq 138
deny tcp any any eq 445
permit ip any any
限制时间
time-range time
periodic daily 12:30 to 13:30
ip access-list extended jiaoshi
deny tcp any any eq 135
deny tcp any any eq 136
deny tcp any any eq 137
deny tcp any any eq 138
deny tcp any any eq 445
deny udp any any eq 8000 (QQ)端口
permit ip any 201.241.1.192 0.0.0.31 time-range time
deny ip any 201.241.1.192 0.0.0.31
permit ip any any
ip access-list extended server
permit tcp any host 192.168.45.2 eq www
permit tcp 192.168.20.0 0.0.0.255 host 192.168.45.2 eq 3389
permit tcp 192.168.15.0 0.0.0.255 host 192.168.45.3 eq www
permit tcp 192.168.25.0 0.0.0.255 host 192.168.45.3 eq www
permit tcp any host 192.168.45.4 eq www
permit tcp 192.168.30.0 0.0.0.255 host 192.168.45.4 eq ftp
permit tcp 192.168.30.0 0.0.0.255 host 192.168.45.4 eq 22
permit ip host 192.168.35.2 host 192.168.45.5
permit ip host 192.168.35.3 host 192.168.45.5
permit ip host 192.168.40.2 host 192.168.45.5
permit ip host 192.168.40.3 host 192.168.45.5
permit ip host 192.168.1.2 host 192.168.45.5
permit ip host 192.168.2.2 host 192.168.45.5
deny ip any any
ip access-list extended shichang
deny tcp any any eq 135
deny tcp any any eq 136
deny tcp any any eq 137
deny tcp any any eq 138
deny tcp any any eq 445
deny udp any any eq 8000
permit ip any any
ip access-list extended xiaoshou
deny tcp any any eq 135
deny tcp any any eq 136
deny tcp any any eq 137
deny tcp any any eq 138
deny tcp any any eq 445
deny udp any any eq 8000
permit ip any any
ip access-list extended xinxi
deny tcp any any eq 135
deny tcp any any eq 136
deny tcp any any eq 137
deny tcp any any eq 138
deny tcp any any eq 445
deny udp any any eq 8000
permit ip any any

交换机配置
interface Vlan1
no ip address
no ip route-cache
shutdown
划分VLAN
interface FastEthernet0/1
switchport mode trunk
interface FastEthernet0/2
switchport access vlan 100
switchport mode access
spanning-tree portfast
interface FastEthernet0/3
switchport access vlan 200
switchport mode access
spanning-tree portfast
interface FastEthernet0/4
switchport access vlan 300
switchport mode access
spanning-tree portfast
interface FastEthernet0/5
switchport access vlan 400
switchport mode access
spanning-tree portfast
interface FastEthernet0/6
switchport access vlan 500
switchport mode access
spanning-tree portfast
interface FastEthernet0/7
switchport access vlan 600
switchport mode access
spanning-tree portfast
interface FastEthernet0/8
switchport access vlan 700
switchport mode access
spanning-tree portfast
interface FastEthernet0/9
switchport access vlan 800
switchport mode access
spanning-tree portfast
interface FastEthernet0/10
switchport access vlan 900
switchport mode access
spanning-tree portfast
interface FastEthernet0/18
switchport access vlan 1000
switchport mode access
spanning-tree portfast
interface FastEthernet0/19
switchport access vlan 1000
switchport mode access
spanning-tree portfast
interface FastEthernet0/22
switchport access vlan 1000
switchport mode access
spanning-tree portfast
interface FastEthernet0/23
switchport access vlan 1000
switchport mode access
spanning-tree portfast

4000路由器配置
interface Loopback0
ip address 2.2.2.2 255.255.255.255
interface Ethernet0
ip address 192.168.50.2 255.255.255.0
interface Ethernet1
no ip address
shutdown
interface Ethernet2
no ip address
shutdown
interface Ethernet3
no ip address
shutdown
配置串口
interface Serial0
ip address 10.1.1.1 255.255.255.0
encapsulation ppp
interface Serial1
ip address 10.1.10.1 255.255.255.0
encapsulation ppp
clock rate 9600
!
interface Serial2
ip address 10.1.20.1 255.255.255.0
encapsulation ppp
interface Serial3
no ip address
shutdown
router ospf 2
log-adjacency-changes
area 1 virtual-link 3.3.3.3
network 10.1.1.0 0.0.0.255 area 1
network 10.1.10.0 0.0.0.255 area 1
network 10.1.20.0 0.0.0.255 area 1
network 192.168.50.0 0.0.0.255 area 0

2500A
interface Loopback0
ip address 4.4.4.4 255.255.255.255
interface Ethernet0
no ip address
shutdown
interface Serial0
ip address 10.1.1.2 255.255.255.0
encapsulation ppp
clock rate 9600
interface Serial1
no ip address
shutdown
router ospf 2
network 10.1.1.0 0.0.0.255 area 1
2500B
interface Loopback0
ip address 5.5.5.5 255.255.255.255
interface Ethernet0
no ip address
shutdown
interface Serial0
ip address 10.1.10.2 255.255.255.0
encapsulation ppp
interface Serial1
no ip address
shutdown
router ospf 3
network 10.1.10.0 0.0.0.255 area 1

2500C
interface Loopback0
ip address 3.3.3.3 255.255.255.255
interface Ethernet0
no ip address
shutdown
interface Serial0
ip address 10.1.20.2 255.255.255.0
encapsulation ppp
clockrate 9600
interface Serial1
ip address 10.2.1.1 255.255.255.0
encapsulation ppp
clockrate 9600
router ospf 8
area 1 virtual-link 2.2.2.2
network 10.1.20.0 0.0.0.255 area 1
network 10.2.1.0 0.0.0.255 area 2

2500D
interface Loopback0
ip address 8.8.8.8 255.255.255.255
interface Ethernet0
ip address dhcp
shutdown
interface Serial0
ip address 10.2.1.2 255.255.255.0
encapsulation ppp
interface Serial1
no ip address
shutdown
router ospf 9
network 10.2.1.0 0.0.0.255 area 2

本文出自 “小_网络工程师” 博客，请务必保留此出处/article/7305021.html