【华为网络-配置-023】- 一般企业网架构方案（单节点方案）

要求：

1、防火墙 FW1 G1/0/0 接口使用 PPPoE 拨号获取 IP 地址。
2、FW1 配置信任（内网包含服务器）和非信任区域（Internet 外网）。
3、FW1 配置 NAPT 使内网可以上网。
4、核心交换机 LSW1 划分 VLAN 并配置各接口及三层网关地址。
4、核心交换机配置静态路由和 DHCP Server。
5、终端使用 DHCP 自动获取地址，服务器配置静态 IP 地址。
在这里插入图片描述

一、防火墙拨号上网

配置方法可参考站内链接：PPPoE 网络拨号配置

PPPoE 服务端配置（一般由运营商提供，这里只为方便测试）
[ISP]ip pool ppppool
[ISP-ip-pool-ppppool]network 6.6.6.0 mask 24
[ISP-ip-pool-ppppool]gateway-list 6.6.6.1
[ISP-ip-pool-ppppool]quit
[ISP]interface Virtual-Template 1
[ISP-GigabitEthernet0/0/1]pppoe-server bind virtual-template 1
[ISP-GigabitEthernet0/0/1]quit
[ISP-Virtual-Template1]ip address 6.6.6.1 24
[ISP-Virtual-Template1]remote address pool ppppool
[ISP-Virtual-Template1]quit
[ISP]interface GigabitEthernet0/0/1
[ISP]aaa
[ISP-aaa]local-user us01 password cipher abcd1234
[ISP-aaa]local-user us01 service-type ppp

防火墙拨号规则
[FW1]dialer-rule 1 ip permit 
[FW1]interface Dialer 1
[FW1-Dialer1]link-protocol ppp
[FW1-Dialer1]ppp chap user us01
[FW1-Dialer1]ppp chap password cipher abcd1234
[FW1-Dialer1]ip address ppp-negotiate 
[FW1-Dialer1]dialer user us01
[FW1-Dialer1]dialer bundle 1
[FW1-Dialer1]dialer-group 1
[FW1-Dialer1]quit	
[FW1]interface GigabitEthernet 1/0/0
[FW1-GigabitEthernet1/0/0]pppoe-client dial-bundle-number 1
[FW1-GigabitEthernet1/0/0]quit
[FW1]interface GigabitEthernet 1/0/1
[FW1-GigabitEthernet1/0/1]ip address 1.1.1.1 24

二、防火墙 NAT 地址转换配置

[FW1]firewall zone untrust
[FW1-zone-untrust]add interface GigabitEthernet 1/0/0
[FW1-zone-untrust]add interface Dialer 1
[FW1-zone-untrust]quit
[FW1]firewall zone trust
[FW1-zone-trust]add interface GigabitEthernet 1/0/1
[FW1-zone-trust]quit
[FW1]security-policy
[FW1-policy-security]rule name NATInter
[FW1-policy-security-rule-NATInter]source-zone trust
[FW1-policy-security-rule-NATInter]destination-zone untrust
[FW1-policy-security-rule-NATInter]action permit
[FW1-policy-security-rule-NATInter]quit
[FW1-policy-security]quit
[FW1]nat-policy
[FW1-policy-nat]rule name NATPolicy
[FW1-policy-nat-rule-NATPolicy]source-zone trust
[FW1-policy-nat-rule-NATPolicy]destination-zone untrust
[FW1-policy-nat-rule-NATPolicy]action nat easy-ip

静态路由配置
[FW1]ip route-static 0.0.0.0 0 Dialer 1
[FW1]ip route-static 1.1.10.0 255.255.255.0 1.1.1.2
[FW1]ip route-static 1.1.20.0 255.255.255.0 1.1.1.2
[FW1]ip route-static 1.1.100.0 255.255.255.0 1.1.1.2

三、核心交换机 VLAN 划分及接口三层网关等配置

[LSW1]vlan batch 5 10 20 100
[LSW1]interface Vlanif 5
[LSW1-Vlanif5]ip address 1.1.1.2 24
[LSW1-Vlanif5]quit
[LSW1]interface GigabitEthernet 0/0/1
[LSW1-GigabitEthernet0/0/1]port link-type access
[LSW1-GigabitEthernet0/0/1]port default vlan 5
[LSW1-GigabitEthernet0/0/1]quit
[LSW1]interface GigabitEthernet 0/0/2
[LSW1-GigabitEthernet0/0/2]port link-type access
[LSW1-GigabitEthernet0/0/2]port default vlan 10
[LSW1-GigabitEthernet0/0/2]quit
[LSW1]interface GigabitEthernet 0/0/3
[LSW1-GigabitEthernet0/0/3]port link-type access
[LSW1-GigabitEthernet0/0/3]port default vlan 20
[LSW1-GigabitEthernet0/0/3]quit
[LSW1]interface GigabitEthernet 0/0/4
[LSW1-GigabitEthernet0/0/4]port link-type access
[LSW1-GigabitEthernet0/0/4]port default vlan 100
[LSW1]interface Vlanif 10
[LSW1-Vlanif10]ip add	
[LSW1-Vlanif10]ip address 1.1.10.1 24
[LSW1-Vlanif10]quit
[LSW1]interface Vlanif 20
[LSW1-Vlanif20]ip address 1.1.20.1 24
[LSW1-Vlanif20]quit
[LSW1]interface Vlanif 100
[LSW1-Vlanif100]ip address 1.1.100.1 24
[LSW1-Vlanif100]quit

静态路由配置
[LSW1]ip route-static 0.0.0.0 0 1.1.1.1

四、核心交换机 DHCP Server 服务配置

[LSW1]dhcp enable
[LSW1]ip pool pvlan10
[LSW1-ip-pool-pvlan10]network 1.1.10.0 mask 24
[LSW1-ip-pool-pvlan10]gateway-list 1.1.10.1
[LSW1-ip-pool-pvlan10]dns-list 7.7.7.7
[LSW1-ip-pool-pvlan10]quit
[LSW1]interface Vlanif 10
[LSW1-Vlanif10]dhcp select global
[LSW1-Vlanif10]quit
[LSW1]ip pool pvlan20	
[LSW1-ip-pool-pvlan20]network 1.1.20.1 mask 24
[LSW1-ip-pool-pvlan20]gateway-list 1.1.20.1
[LSW1-ip-pool-pvlan20]dns-list 7.7.7.7
[LSW1-ip-pool-pvlan20]quit
[LSW1]interface Vlanif 20
[LSW1-Vlanif20]dhcp select global