xiaoqubenbu(config)#int s0/0/0
xiaoqubenbu(config-if)#encapsulation frame-relay xiaoqubenbu(config)#int s0/0/0.102 point-to-point
xiaoqubenbu(config-subif)#ip address 172.30.1.100 255.255.255.0 xiaoqubenbu(config-subif)#frame-relay interface-dlci 102 xiaoqubenbu(config-subif)#description link to fenxiaoqu1 DLCI102 xiaoqubenbu(config-subif)#no shut xiaoqubenbu(config-subif)#exit
xiaoqubenbu(config)#interface s0/0/0.103 point-to-point xiaoqubenbu(config-subif)#ip address 172.16.2.100 255.255.255.0 xiaoqubenbu(config-subif)#frame-relay interface-dlci 103
xiaoqubenbu(config-subif)#description linkto xinjianxiaoqu dlci103 xiaoqubenbu(config-subif)#no shut xiaoqubenbu(config-subif)#no shutdown
xiaoqubenbu(config-subif)#end xiaoqubenbu#conf t
xiaoqubenbu(config)#router ospf 100
xiaoqubenbu(config-router)#network 172.16.2.0 0.0.0.255 area 0 xiaoqubenbu(config-router)#network 172.30.1.0 0.0.0.255 area 0 xiaoqubenbu(config-router)#end xiaoqubenbu#write
校区1路由器相关配置:
Router(config)#hostn fenxiaoqu1 fenxiaoqu1(config)#int s0/0/0
fenxiaoqu1(config-if)#encapsulation frame-relay
fenxiaoqu1(config-if)#frame-relay map ip 172.30.1.100 201 broadcast fenxiaoqu1(config-if)#ip address 172.30.1.200 255.255.255.0 fenxiaoqu1(config-if)#ip ospf network point-to-point fenxiaoqu1(config-if)#no shutdown fenxiaoqu1(config-if)#exit
fenxiaoqu1(config)#router ospf 100
fenxiaoqu1(config-router)#network 172.30.1.0 0.0.0.255 area 0 fenxiaoqu1(config-router)#end fenxiaoqu1#write
36
新建校区路由器相关配置:
Router(config)#hostn xinjianxiaoqu xinjianxiaoqu(config)#int s0/0/0
xinjianxiaoqu(config-if)#encapsulation frame-relay
xinjianxiaoqu(config-if)#frame-relay map ip 172.16.1.100 301 broadcast xinjianxiaoqu(config-if)#ip address 172.16.2.200 255.255.255.0 xinjianxiaoqu(config-if)#ip ospf network point-to-point
//让OSPF的更新报文使用点到点方式，克服帧中继不允许广播和组播报文的问题
xinjianxiaoqu(config-if)#no shutdown xinjianxiaoqu(config-if)#exit xinjianxiaoqu(config)#int F0/0
xinjianxiaoqu(config-if)#ip address 172.16.1.200 255.255.255.0
//此接口为连接到核心交换机的接口
xinjianxiaoqu(config)#router ospf 100
xinjianxiaoqu(config-router)#network 172.16.1.0 0.0.0.255 area 0 xinjianxiaoqu(config-router)#network 172.16.2.0 0.0.0.255 area 0 xinjianxiaoqu(config-router)#end xinjianxiaoqu#write
任务四：WLAN、ACL、NAT和VPN设计
1.无线AP相关设置（以一个AP设置为例，其他AP省略） a.无线AP的IP地址设置，建议从DHCP SERVER得到相应的IP地址，也可以静态设置，静态设置时注意要是AP所属的VLAN规划的网段内的IP,切不能重复。此处以静态设置地址为例，本AP属于VLAN30，设置如下图：
37
b．设置AP的内网地址及开启DHCP作为AP的LAN口连接终端和无线接入终端分发IP地址.如下图:
c.测试AP连接的终端是否能够正确获得IP等相关配置信息
38
2.ACL相关配置
a.三层交换机上要求VLAN的互通满足以下要求： 财务VLAN不允许其他VLAN访问；
hexinjiaohuan0#conf t
hexinjiaohuan0(config)#access-list 100 deny ip 172.16.16.0 0.0.3.255 172.16.4.0 0.0.3.255
hexinjiaohuan0(config)#access-list 100 deny ip 172.16.16.0 0.0.3.255 172.16.8.0 0.0.3.255
hexinjiaohuan0(config)#access-list 100 deny ip 172.16.16.0 0.0.3.255 172.16.12.0 0.0.3.255
hexinjiaohuan0(config)#access-list 100 deny ip 172.16.16.0 0.0.3.255 172.16.20.0 0.0.3.255
hexinjiaohuan0(config)#access-list 100 deny ip 172.16.16.0 0.0.3.255 172.16.24.0 0.0.3.255
hexinjiaohuan0(config)#access-list 100 permit ip any any. hexinjiaohuan0(config)#int vlan 40
hexinjiaohuan0(config-if)#ip access-group 100 in hexinjiaohuan0(config-if)#end
行政办公VLAN可以访问教学及其他VLAN，但其他VLAN不能访问办公VLAN；（此部分内容在模拟软件上无法实现）
39
方法一：使用反向ACL实现：
hexinjiaohuan0(config)#ip access-list extended invlan
hexinjiaohuan0(config-ext-invlan)#permit ip any any reflect kk hexinjiaohuan0(config)#ip access-list extended outvlan hexinjiaohuan0(config-ext-invlan)#evaluate kk hexinjiaohuan0(config-ext-invlan)#deny ip any any hexinjiaohuan0(config)# int vlan 10
hexinjiaohuan0(config-if)# ip access-group invlan in hexinjiaohuan0(config-if)#ip access-group outvlan out
注：ip access-list extended invlan
permit ip any any reflect kk
这一段就是取了流量记录到kk里面，这其实就是缓存，动态更新，和防火墙的原理样 ip access-list extended outvlan evaluate kk deny ip any any
然后在这个acl里面只放行kk那个缓存所记录的流量
方法二：
hexinjiaohuan0(config)# ip access-list extended vlan10toanothervlan hexinjiaohuan0(config-ext-vlan10toanothervlan)#permit ip 172.16.8.0 0.0.3.255 172.16.4.0 0.0.3.255 established hexinjiaohuan0(config-ext-vlan10toanothervlan)#permit ip 172.16.12.0 0.0.3.255 172.16.4.0 0.0.3.255 established hexinjiaohuan0(config-ext-vlan10toanothervlan)#permit ip 172.16.16.0 0.0.3.255 172.16.4.0 0.0.3.255 established hexinjiaohuan0(config-ext-vlan10toanothervlan)#permit ip 172.16.20.0 0.0.3.255 172.16.4.0 0.0.3.255 established hexinjiaohuan0(config-ext-vlan10toanothervlan)#permit ip 172.16.24.0 0.0.3.255 172.16.4.0 0.0.3.255 established hexinjiaohuan0(config-ext-vlan10toanothervlan)#permit ip 172.16.28.0 0.0.3.255 172.16.4.0 0.0.3.255 established hexinjiaohuan0(config)# int vlan 10
hexinjiaohuan0(config)# ip access-group vlan10toanothervlan out
注：假如主机A在其他VLAN中，主机B在VLAN10，当B访问A时（通过IP协议），在端口VLAN10的入方向上都没有应用ACL，所以流量可以通过；然后从A需要返回给B一个流量，“permit ip 172.16.24.0 0.0.3.255 172.16.4.0 0.0.3.255 established”这条命令就是用来识别这个返回的流量的，因为是允许，所以可以通过，也就是说B可以连接A。但如果是A主动发起一个连接请求，这个流量需要从VLAN10端口进入，而在VLAN10端口应
40