核心技术介绍

1、虚拟局域网（VLAN）

2、链路聚合（E-trunk）

3、多生成树协议（MSTP）

4、VLANIF三层逻辑接口

5、虚拟路由冗余协议（VRRP）

6、开放式最短路径优先（OSPF）

7、动态主机配置协议（DHCP）

8、无线局域网集中式管理（AC+AP）

9、防火墙安全策略（Firewall Security Policy）

10、网络地址转换协议（NAT）

        

网络拓扑规划

全局图

        

 核心层

汇聚层

 接入层

        

网络设备配置

规划VLAN

Switch3

<Huawei>system-view 
[Huawei]undo info-center enable 
[Huawei]vlan batch 10 20 30 40

[Huawei]int e0/0/1
[Huawei-Ethernet0/0/1]port link-type access
[Huawei-Ethernet0/0/1]port default vlan 10
[Huawei-Ethernet0/0/1]stp edged-port enable 
[Huawei-Ethernet0/0/1]quit

[Huawei]int e0/0/3
[Huawei-Ethernet0/0/3]port link-type access
[Huawei-Ethernet0/0/3]port default vlan 20
[Huawei-Ethernet0/0/3]stp edged-port enable
[Huawei-Ethernet0/0/3]quit

[Huawei]port-group group-member e0/0/4 to e0/0/5
[Huawei-port-group]port link-type trunk
[Huawei-port-group]port trunk allow-pass vlan all
[Huawei-port-group]quit

Switch4

<Huawei>system-view 
[Huawei]undo info-center enable 
[Huawei]vlan batch 10 20 30 40

[Huawei]int e0/0/1
[Huawei-Ethernet0/0/1]port link-type access
[Huawei-Ethernet0/0/1]port default vlan 30
[Huawei-Ethernet0/0/1]stp edged-port enable 
[Huawei-Ethernet0/0/1]quit

[Huawei]int e0/0/3
[Huawei-Ethernet0/0/3]port link-type access
[Huawei-Ethernet0/0/3]port default vlan 40
[Huawei-Ethernet0/0/3]stp edged-port enable
[Huawei-Ethernet0/0/3]quit

[Huawei]port-group group-member e0/0/4 to e0/0/5
[Huawei-port-group]port link-type trunk
[Huawei-port-group]port trunk allow-pass vlan all
[Huawei-port-group]quit

Switch1

<Huawei>system-view
[Huawei]undo info-center enable 
[Huawei]vlan batch 10 20 30 40

[Huawei]int g0/0/1
[Huawei-GigabitEthernet0/0/1]port link-type trunk
[Huawei-GigabitEthernet0/0/1]port trunk allow-pass vlan all
[Huawei-GigabitEthernet0/0/1]quit

[Huawei]int g0/0/2
[Huawei-GigabitEthernet0/0/2]port link-type trunk
[Huawei-GigabitEthernet0/0/2]port trunk allow-pass vlan all
[Huawei-GigabitEthernet0/0/2]quit

Switch2

<Huawei>system-view
[Huawei]vlan batch 10 20 30 40
[Huawei]undo info-center enable 

[Huawei]int g0/0/2
[Huawei-GigabitEthernet0/0/2]port link-type trunk
[Huawei-GigabitEthernet0/0/2]port trunk allow-pass vlan all
[Huawei-GigabitEthernet0/0/2]quit

[Huawei]int g0/0/3
[Huawei-GigabitEthernet0/0/3]port link-type trunk 
[Huawei-GigabitEthernet0/0/3]port trunk allow-pass vlan all 
[Huawei-GigabitEthernet0/0/3]quit

链路聚合

Switch1

[Huawei]int Eth-Trunk 12
[Huawei-Eth-Trunk12]mode lacp-static 
[Huawei-Eth-Trunk12]trunkport g0/0/3
[Huawei-Eth-Trunk12]trunkport g0/0/4
[Huawei-Eth-Trunk12]port link-type trunk
[Huawei-Eth-Trunk12]port trunk allow-pass vlan all
[Huawei-Eth-Trunk12]display this
[Huawei-Eth-Trunk12]quit

Switch2

[Huawei]int Eth-Trunk 12
[Huawei-Eth-Trunk12]mode lacp-static 
[Huawei-Eth-Trunk12]trunkport g0/0/1
[Huawei-Eth-Trunk12]trunkport g0/0/5
[Huawei-Eth-Trunk12]port link-type trunk
[Huawei-Eth-Trunk12]port trunk allow-pass vlan all
[Huawei-Eth-Trunk12]display this
[Huawei-Eth-Trunk12]quit

部署MSTP

Switch1

[Huawei]stp mode mstp

[Huawei]stp region-configuration 
[Huawei-mst-region]region-name yeslab
[Huawei-mst-region]revision-level 1
[Huawei-mst-region]instance 1 vlan 10 20
[Huawei-mst-region]instance 2 vlan 30 40
[Huawei-mst-region]active region-configuration
[Huawei-mst-region]quit

[Huawei]stp instance 1 root primary 
[Huawei]stp instance 2 root secondary 

[Huawei]display stp region-configuration 

Switch2

[Huawei]stp mode mstp 

[Huawei]stp region-configuration 
[Huawei-mst-region]region-name yeslab
[Huawei-mst-region] revision-level 1
[Huawei-mst-region] instance 1 vlan 10 20
[Huawei-mst-region] instance 2 vlan 30 40
[Huawei-mst-region] active region-configuration
[Huawei-mst-region]quit

[Huawei]stp instance 1 root secondary 
[Huawei]stp instance 2 root primary 

[Huawei]display stp region-configuration 

Switch3

[Huawei]stp mode mstp

[Huawei]stp region-configuration 
[Huawei-mst-region]region-name yeslab
[Huawei-mst-region]revision-level 1
[Huawei-mst-region]instance 1 vlan 10 20
[Huawei-mst-region]instance 2 vlan 30 40
[Huawei-mst-region]active region-configuration 
[Huawei-mst-region]quit

[Huawei]display stp instance 1 brief 
[Huawei]display stp instance 2 brief
[Huawei]display stp region-configuration 

Switch4

[Huawei]stp mode mstp 

[Huawei]stp region-configuration 
[Huawei-mst-region]region-name yeslab
[Huawei-mst-region]revision-level 1
[Huawei-mst-region]instance 1 vlan 10 20
[Huawei-mst-region]instance 2 vlan 30 40
[Huawei-mst-region]active region-configuration
[Huawei-mst-region]quit

[Huawei]display stp instance 1 brief 
[Huawei]display stp instance 2 brief
[Huawei]display stp region-configuration 

配置VLANIF

Switch1

[Huawei]int vlanif 10
[Huawei-Vlanif10]ip address 192.168.10.251 24
[Huawei-Vlanif10]quit

[Huawei]int vlanif 20
[Huawei-Vlanif20]ip address 192.168.20.251 24
[Huawei-Vlanif20]quit

[Huawei]int vlanif 30
[Huawei-Vlanif30]ip address 192.168.30.251 24
[Huawei-Vlanif30]quit

[Huawei]int vlanif 40
[Huawei-Vlanif40]ip address 192.168.40.251 24
[Huawei-Vlanif40]quit

Switch2

[Huawei]int vlanif 10
[Huawei-Vlanif10]ip address 192.168.10.252 24
[Huawei-Vlanif10]quit

[Huawei]int vlanif 20
[Huawei-Vlanif20]ip address 192.168.20.252 24
[Huawei-Vlanif20]quit

[Huawei]int vlanif 30
[Huawei-Vlanif30]ip address 192.168.30.252 24
[Huawei-Vlanif30]quit

[Huawei]int vlanif 40
[Huawei-Vlanif40]ip address 192.168.40.252 24
[Huawei-Vlanif40]quit

配置VRRP

Switch1

[Huawei]int vlanif 10
[Huawei-Vlanif10]vrrp vrid 10 virtual-ip 192.168.10.254
[Huawei-Vlanif10]vrrp vrid 10 priority 120
[Huawei-Vlanif10]quit

[Huawei]int vlanif 20
[Huawei-Vlanif10]vrrp vrid 20 virtual-ip 192.168.20.254
[Huawei-Vlanif10]vrrp vrid 20 priority 120
[Huawei-Vlanif10]quit

[Huawei]int vlanif 30
[Huawei-Vlanif10]vrrp vrid 30 virtual-ip 192.168.30.254
[Huawei-Vlanif10]vrrp vrid 30 priority 110
[Huawei-Vlanif10]quit

[Huawei]int vlanif 40
[Huawei-Vlanif10]vrrp vrid 40 virtual-ip 192.168.40.254
[Huawei-Vlanif10]vrrp vrid 40 priority 110
[Huawei-Vlanif10]quit

[Huawei]display vrrp brief 

Switch2

[Huawei]int vlanif 10
[Huawei-Vlanif10]vrrp vrid 10 virtual-ip 192.168.10.254
[Huawei-Vlanif10]vrrp vrid 10 priority 110
[Huawei-Vlanif10]quit

[Huawei]int vlanif 20
[Huawei-Vlanif10]vrrp vrid 20 virtual-ip 192.168.20.254
[Huawei-Vlanif10]vrrp vrid 20 priority 110
[Huawei-Vlanif10]quit

[Huawei]int vlanif 30
[Huawei-Vlanif10]vrrp vrid 30 virtual-ip 192.168.30.254
[Huawei-Vlanif10]vrrp vrid 30 priority 120
[Huawei-Vlanif10]quit

[Huawei]int vlanif 40
[Huawei-Vlanif10]vrrp vrid 40 virtual-ip 192.168.40.254
[Huawei-Vlanif10]vrrp vrid 40 priority 120
[Huawei-Vlanif10]quit

[Huawei]display vrrp brief 

配置接口IP

Router1

<Huawei>system-view 
[Huawei]undo info-center enable

[Huawei]int LoopBack 0
[Huawei-LoopBack0]ip address 10.1.1.1 32
[Huawei-LoopBack0]quit

[Huawei]int g0/0/0
[Huawei-GigabitEthernet0/0/0]ip address 10.1.101.1 24
[Huawei-GigabitEthernet0/0/0]quit

[Huawei]int g0/0/1
[Huawei-GigabitEthernet0/0/1]ip address 10.1.102.1 24
[Huawei-GigabitEthernet0/0/1]quit

[Huawei]int g0/0/2
[Huawei-GigabitEthernet0/0/2]ip address 10.1.12.1 24
[Huawei-GigabitEthernet0/0/2]quit

[Huawei]int g2/0/0
[Huawei-GigabitEthernet2/0/0]ip address 10.1.15.1 24
[Huawei-GigabitEthernet2/0/0]quit

[Huawei]int g2/0/1
[Huawei-GigabitEthernet2/0/1]ip address 10.1.11.1 24
[Huawei-GigabitEthernet2/0/1]quit

[Huawei]int pos4/0/0
[Huawei-Pos4/0/0]ip address 10.1.13.1 24
[Huawei-Pos4/0/0]quit

Router2

<Huawei>system-view 
[Huawei]undo info-center enable 

[Huawei]int LoopBack 0
[Huawei-LoopBack0]ip address 10.1.2.2 32
[Huawei-LoopBack0]quit

[Huawei]int g0/0/0
[Huawei-GigabitEthernet0/0/0]ip address 10.1.12.2 24
[Huawei-GigabitEthernet0/0/0]quit

[Huawei]int g0/0/1
[Huawei-GigabitEthernet0/0/1]ip address 10.1.103.1 24
[Huawei-GigabitEthernet0/0/1]quit

[Huawei]int g0/0/2
[Huawei-GigabitEthernet0/0/2]ip address 10.1.104.1 24
[Huawei-GigabitEthernet0/0/2]quit

[Huawei]int pos2/0/0
[Huawei-Pos2/0/0]ip address 10.1.14.1 24
[Huawei-Pos2/0/0]quit

Router3

<Huawei>system-view 
[Huawei]undo info-center enable 

[Huawei]int LoopBack 0
[Huawei-LoopBack0]ip address 200.200.200.200 32
[Huawei-LoopBack0]quit

[Huawei]int pos4/0/0
[Huawei-Pos4/0/0]ip address 10.1.14.2 24
[Huawei-Pos4/0/0]quit

[Huawei]int pos6/0/0
[Huawei-Pos6/0/0]ip address 10.1.13.2 24
[Huawei-Pos6/0/0]quit

Switch1

[Huawei]vlan batch 101 103

[Huawei]int vlanif 101
[Huawei-Vlanif101]ip address 10.1.101.2 24
[Huawei-Vlanif101]quit

[Huawei]int vlanif 103
[Huawei-Vlanif103]ip address 10.1.103.2 24
[Huawei-Vlanif103]quit

[Huawei]int g0/0/5
[Huawei-GigabitEthernet0/0/5]port link-type access
[Huawei-GigabitEthernet0/0/5]port default vlan 101
[Huawei-GigabitEthernet0/0/5]quit

[Huawei]int g0/0/6
[Huawei-GigabitEthernet0/0/6]port link-type access
[Huawei-GigabitEthernet0/0/6]port default vlan 103
[Huawei-GigabitEthernet0/0/6]quit

Switch2

[Huawei]vlan batch 102 104

[Huawei]int vlanif 102
[Huawei-Vlanif102]ip address 10.1.102.2 24
[Huawei-Vlanif102]quit

[Huawei]int vlanif 104
[Huawei-Vlanif104]ip address 10.1.104.2 24
[Huawei-Vlanif104]quit

[Huawei]int g0/0/6
[Huawei-GigabitEthernet0/0/6]port link-type access 
[Huawei-GigabitEthernet0/0/6]port default vlan 102
[Huawei-GigabitEthernet0/0/6]quit

[Huawei]int g0/0/7
[Huawei-GigabitEthernet0/0/7]port link-type access
[Huawei-GigabitEthernet0/0/7]port default vlan 104
[Huawei-GigabitEthernet0/0/7]quit

配置OSPF

Router1

[Huawei]ospf 1 router-id 1.1.1.1
[Huawei-ospf-1]area 0

[Huawei-ospf-1-area-0.0.0.0]network 10.1.11.1 0.0.0.0
[Huawei-ospf-1-area-0.0.0.0]network 10.1.101.1 0.0.0.0
[Huawei-ospf-1-area-0.0.0.0]network 10.1.102.1 0.0.0.0
[Huawei-ospf-1-area-0.0.0.0]network 10.1.12.1 0.0.0.0
[Huawei-ospf-1-area-0.0.0.0]network 10.1.15.1 0.0.0.0
[Huawei-ospf-1-area-0.0.0.0]network 10.1.1.1 0.0.0.0

[Huawei-ospf-1-area-0.0.0.0]authentication-mode md5 1 cipher Huawei@123
[Huawei-ospf-1-area-0.0.0.0]dis ospf peer brief 

Router2

[Huawei]ospf 1 router-id 2.2.2.2
[Huawei-ospf-1]area 0

[Huawei-ospf-1-area-0.0.0.0]network 10.1.12.2 0.0.0.0
[Huawei-ospf-1-area-0.0.0.0]network 10.1.103.1 0.0.0.0
[Huawei-ospf-1-area-0.0.0.0]network 10.1.104.1 0.0.0.0
[Huawei-ospf-1-area-0.0.0.0]network 10.1.14.1 0.0.0.0
[Huawei-ospf-1-area-0.0.0.0]network 10.1.2.2 0.0.0.0

[Huawei-ospf-1-area-0.0.0.0]authentication-mode md5 1 cipher Huawei@123
[Huawei-ospf-1-area-0.0.0.0]dis ospf peer brief 

Switch1

[Huawei]ospf 1 router-id 3.3.3.3
[Huawei-ospf-1]area 0

[Huawei-ospf-1-area-0.0.0.0]network 192.168.10.251 0.0.0.0
[Huawei-ospf-1-area-0.0.0.0]network 192.168.20.251 0.0.0.0
[Huawei-ospf-1-area-0.0.0.0]network 192.168.30.251 0.0.0.0
[Huawei-ospf-1-area-0.0.0.0]network 192.168.40.251 0.0.0.0
[Huawei-ospf-1-area-0.0.0.0]network 10.1.101.2 0.0.0.0
[Huawei-ospf-1-area-0.0.0.0]network 10.1.103.2 0.0.0.0

[Huawei-ospf-1-area-0.0.0.0]authentication-mode md5 1 cipher Huawei@123
[Huawei-ospf-1-area-0.0.0.0]dis ospf peer brief 

Switch2

[Huawei]ospf 1 router-id 4.4.4.4
[Huawei-ospf-1]area 0

[Huawei-ospf-1-area-0.0.0.0]network 192.168.10.252 0.0.0.0
[Huawei-ospf-1-area-0.0.0.0]network 192.168.20.252 0.0.0.0
[Huawei-ospf-1-area-0.0.0.0]network 192.168.30.252 0.0.0.0
[Huawei-ospf-1-area-0.0.0.0]network 192.168.40.252 0.0.0.0
[Huawei-ospf-1-area-0.0.0.0]network 10.1.102.2 0.0.0.0
[Huawei-ospf-1-area-0.0.0.0]network 10.1.104.2 0.0.0.0

[Huawei-ospf-1-area-0.0.0.0]authentication-mode md5 1 cipher Huawei@123
[Huawei-ospf-1-area-0.0.0.0]dis ospf peer brief 

 配置DHCP

DHCP服务器

<Huawei>system-view 
[Huawei]undo info-center enable 

[Huawei]int g0/0/0
[Huawei-GigabitEthernet0/0/0]ip address 10.1.11.2 24
[Huawei-GigabitEthernet0/0/0]quit

[Huawei]dhcp enable 

[Huawei]ip pool VLAN10
[Huawei-ip-pool-VLAN10]network 192.168.10.0 mask 255.255.255.0
[Huawei-ip-pool-VLAN10]gateway-list 192.168.10.254
[Huawei-ip-pool-VLAN10]dns-list 114.114.114.114
[Huawei-ip-pool-VLAN10]domain-name yeslab.net
[Huawei-ip-pool-VLAN10]quit

[Huawei]ip pool VLAN20
[Huawei-ip-pool-VLAN20]network 192.168.20.0 mask 255.255.255.0
[Huawei-ip-pool-VLAN20]gateway-list 192.168.20.254
[Huawei-ip-pool-VLAN20]dns-list 114.114.114.114
[Huawei-ip-pool-VLAN20]domain-name yeslab.net
[Huawei-ip-pool-VLAN20]quit

[Huawei]ip pool VLAN30
[Huawei-ip-pool-VLAN30]network 192.168.30.0 mask 255.255.255.0
[Huawei-ip-pool-VLAN30]gateway-list 192.168.30.254
[Huawei-ip-pool-VLAN30]dns-list 114.114.114.114
[Huawei-ip-pool-VLAN30]domain-name yeslab.net
[Huawei-ip-pool-VLAN30]quit

[Huawei]ip pool VLAN40
[Huawei-ip-pool-VLAN40]network 192.168.40.0 mask 255.255.255.0
[Huawei-ip-pool-VLAN40]gateway-list 192.168.40.254
[Huawei-ip-pool-VLAN40]dns-list 114.114.114.114
[Huawei-ip-pool-VLAN40]domain-name yeslab.net
[Huawei-ip-pool-VLAN40]quit

[Huawei]int g0/0/0
[Huawei-GigabitEthernet0/0/0]dhcp select global 
[Huawei-GigabitEthernet0/0/0]quit

[Huawei]ip route-static 0.0.0.0 0.0.0.0 10.1.11.1

Switch1

[Huawei]dhcp enable 

[Huawei]int vlanif 10
[Huawei-Vlanif10]dhcp select relay 
[Huawei-Vlanif10]dhcp relay server-ip 10.1.11.2
[Huawei-Vlanif10]quit

[Huawei]int vlanif 20
[Huawei-Vlanif20]dhcp select relay 
[Huawei-Vlanif20]dhcp relay server-ip 10.1.11.2
[Huawei-Vlanif20]quit

[Huawei]int vlanif 30
[Huawei-Vlanif30]dhcp select relay
[Huawei-Vlanif30]dhcp relay server-ip 10.1.11.2
[Huawei-Vlanif30]quit

[Huawei]int vlanif 40
[Huawei-Vlanif40]dhcp select relay
[Huawei-Vlanif40]dhcp relay server-ip 10.1.11.2
[Huawei-Vlanif40]quit

Switch2

[Huawei]dhcp enable 

[Huawei]int vlanif 10
[Huawei-Vlanif10]dhcp select relay
[Huawei-Vlanif10]dhcp relay server-ip 10.1.11.2
[Huawei-Vlanif10]quit

[Huawei]int vlanif 20
[Huawei-Vlanif20]dhcp select relay
[Huawei-Vlanif20]dhcp relay server-ip 10.1.11.2
[Huawei-Vlanif20]quit

[Huawei]int vlanif 30
[Huawei-Vlanif30]dhcp select relay
[Huawei-Vlanif30]dhcp relay server-ip 10.1.11.2
[Huawei-Vlanif30]quit

[Huawei]int vlanif 40
[Huawei-Vlanif40]dhcp select relay
[Huawei-Vlanif40]dhcp relay server-ip 10.1.11.2
[Huawei-Vlanif40]quit

到此实现了内网互联互通

配置WLAN

VLAN划分

Switch1

[Huawei]vlan 111
[Huawei-vlan101]quit

Switch2

[Huawei]vlan 111
[Huawei-vlan101]quit

[Huawei]int g0/0/4
[Huawei-GigabitEthernet0/0/4]port link-type trunk
[Huawei-GigabitEthernet0/0/4]port trunk allow-pass vlan all
[Huawei-GigabitEthernet0/0/4]quit

Switch3

[Huawei]vlan 111
[Huawei-vlan101]quit

[Huawei]int e0/0/2
[Huawei-Ethernet0/0/2]port link-type trunk 
[Huawei-Ethernet0/0/2]port trunk pvid vlan 111
[Huawei-Ethernet0/0/2]port trunk allow-pass vlan all
[Huawei-Ethernet0/0/2]quit

Switch4

[Huawei]vlan 111
[Huawei-vlan101]quit

[Huawei]int e0/0/2
[Huawei-Ethernet0/0/2]port link-type trunk
[Huawei-Ethernet0/0/2]port trunk pvid vlan 111
[Huawei-Ethernet0/0/2]port trunk allow-pass vlan all
[Huawei-Ethernet0/0/2]quit

AC

<AC6605>system-view 
[AC6605]undo info-center enable

[AC6605]vlan 111
[AC6605-vlan101]quit

[AC6605]int g0/0/1
[AC6605-GigabitEthernet0/0/1]port link-type trunk 
[AC6605-GigabitEthernet0/0/1]port trunk allow-pass vlan all
[AC6605-GigabitEthernet0/0/1]quit

[AC6605]dhcp enable 
[AC6605]int vlanif 111
[AC6605-Vlanif111]ip address 192.168.111.254 24
[AC6605-Vlanif111]dhcp select interface 

AP        [Huawei]display system-information 

AP上线

[AC6605]wlan
[AC6605-wlan-view]regulatory-domain-profile name default
[AC6605-wlan-regulate-domain-default]country-code CN
[AC6605-wlan-regulate-domain-default]quit

[AC6605-wlan-view]ap-group name ap-group1
[AC6605-wlan-ap-group-ap-group1]regulatory-domain-profile default
[AC6605-wlan-ap-group-ap-group1]quit
[AC6605-wlan-view]quit

[AC6605]capwap source int Vlanif 101
[AC6605-wlan-view]ap auth-mode no-auth 
[AC6605-wlan-view]display ap all 

[AC6605-wlan-view]ap-id 0
[AC6605-wlan-ap-0]ap-name AP1
[AC6605-wlan-ap-0]ap-group ap-group1
[AC6605-wlan-ap-0]quit

[AC6605-wlan-view]ap-id 1
[AC6605-wlan-ap-1]ap-name AP2
[AC6605-wlan-ap-1]ap-group ap-group1
[AC6605-wlan-ap-1]quit

[AC6605-wlan-view]ap auth-mode mac-auth 
[AC6605-wlan-view]quit
[AC6605]display ap all

 加密

[AC6605]wlan
[AC6605-wlan-view]security-profile name wlan-net
[AC6605-wlan-sec-prof-wlan-net]security wpa-wpa2 psk pass-phrase a12345678 aes
[AC6605-wlan-sec-prof-wlan-net]quit

[AC6605-wlan-view]ssid-profile name wlan-net
[AC6605-wlan-ssid-prof-wlan-net]ssid yeslab
[AC6605-wlan-ssid-prof-wlan-net]quit

[AC6605-wlan-view]vap-profile name wlan-net
[AC6605-wlan-vap-prof-wlan-net]forward-mode direct-forward 
[AC6605-wlan-vap-prof-wlan-net]service-vlan vlan-pool yeslab
[AC6605-wlan-vap-prof-wlan-net]quit
[AC6605-wlan-view]quit

[AC6605]vlan pool yeslab
[AC6605-vlan-pool-yeslab]vlan 10 20 30 40
[AC6605-vlan-pool-yeslab]quit

[AC6605]wlan
[AC6605-wlan-view]vap-profile name wlan-net
[AC6605-wlan-vap-prof-wlan-net]service-vlan vlan-pool yeslab
[AC6605-wlan-vap-prof-wlan-net]security-profile wlan-net
[AC6605-wlan-vap-prof-wlan-net]quit
[AC6605-wlan-view]quit

[AC6605]wlan 
[AC6605-wlan-view]ap-group name ap-group1
[AC6605-wlan-ap-group-ap-group1]vap-profile wlan-net wlan 1 radio 0
[AC6605-wlan-ap-group-ap-group1]vap-profile wlan-net wlan 1 radio 1
[AC6605-wlan-ap-group-ap-group1]quit
[AC6605-wlan-view]quit

配置防火墙

 ISP

<Huawei>system-view
[Huawei]undo info-center enable 

[Huawei]int LoopBack 0
[Huawei-LoopBack0]ip address 114.114.114.114 32
[Huawei-LoopBack0]quit

[Huawei]int g0/0/0
[Huawei-GigabitEthernet0/0/0]ip address 202.1.10.2 24
[Huawei-GigabitEthernet0/0/0]quit

FireWall

配置IP
<USG6000V1>system-view 
[USG6000V1]undo info-center enable 

[USG6000V1]int g0/0/0
[USG6000V1-GigabitEthernet0/0/0]ip address 202.1.10.1 24
[USG6000V1-GigabitEthernet0/0/0]quit

[USG6000V1]int g1/0/0
[USG6000V1-GigabitEthernet1/0/0]ip address 10.1.15.2 24
[USG6000V1-GigabitEthernet1/0/0]service-manage ping permit 
[USG6000V1-GigabitEthernet1/0/0]quit


划分zone
[USG6000V1]firewall zone trust
[USG6000V1-zone-trust]add int g1/0/0
[USG6000V1-zone-trust]undo add int g0/0/0
[USG6000V1-zone-trust]quit

[USG6000V1]firewall zone untrust 
[USG6000V1-zone-untrust]add int g0/0/0
[USG6000V1-zone-untrust]quit


配置OSPF
[USG6000V1]ospf 1 router-id 6.6.6.6
[USG6000V1-ospf-1]area 0
[USG6000V1-ospf-1-area-0.0.0.0]network 10.1.15.2 0.0.0.0
[USG6000V1-ospf-1-area-0.0.0.0]authentication-mode md5 1 cipher Huawei@123
[USG6000V1-ospf-1-area-0.0.0.0]quit
[USG6000V1-ospf-1]quit

[USG6000V1]display ospf peer brief     status处于ExStart，单播报文发不出去，需要放行流量
[USG6000V1]security-policy 
[USG6000V1-policy-security]rule name permit_local_trust_ospf
[USG6000V1-policy-security-rule-permit_local_trust_ospf]source-zone local 
[USG6000V1-policy-security-rule-permit_local_trust_ospf]destination-zone trust 
[USG6000V1-policy-security-rule-permit_local_trust_ospf]action permit 
[USG6000V1-policy-security-rule-permit_local_trust_ospf]quit
[USG6000V1-policy-security]quit
[USG6000V1]display ospf peer brief      status处于Full


安全策略放行
[USG6000V1]ip route-static 0.0.0.0 0.0.0.0 202.1.10.2
[USG6000V1]ospf 1
[USG6000V1-ospf-1]default-route-advertise always 
[USG6000V1-ospf-1]quit

[USG6000V1]security-policy 
[USG6000V1-policy-security]rule name permit_trust_untrust
[USG6000V1-policy-security-rule-permit_trust_untrust]source-zone trust 
[USG6000V1-policy-security-rule-permit_trust_untrust]destination-zone untrust 
[USG6000V1-policy-security-rule-permit_trust_untrust]action permit 


配置nat
[USG6000V1]nat-policy 
[USG6000V1-policy-nat]rule name EASYIP
[USG6000V1-policy-nat-rule-EASYIP]source-zone trust 
[USG6000V1-policy-nat-rule-EASYIP]destination-zone untrust 
[USG6000V1-policy-nat-rule-EASYIP]action source-nat easy-ip 

以上配置完成后，内外网还是不能互通，问题有待解决。。。

        

实验总结

完成效果

改进之处

1.防火墙配置存在问题，只能防火墙内部互联互通，外部与内部不能进行通信。

        

2.无线设备DHCP可能只能获取到DNS，不能获得IP

因为DHCP地址池没有排除被交换机占有的IP地址

排除IP地址：excluded-ip-address 192.168.10.10 192.168.10.254     

        

 3.边界路由器还未配置BGP

针对以上问题，后续有空会做进一步改进。。。

        

参考来源

中大型企业网实战课程_哔哩哔哩_bilibili

基于ensp的园区网络搭建综合实验

基于eNSP的千人中型校园/企业网络设计与规划