1.使用172.16.0.0/16划分网络

1. 172.16.1.0/24

2. 172.16.2.0/24

3. 172.16.3.0/24

4. 172.16.4.0/24

给各个路由器配置接口

[r7]int g0/0/0
[r7-GigabitEthernet0/0/0]ip address 11.1.1.1/24
 
[r7]int g0/0/1
[r7-GigabitEthernet0/0/0]ip address 10.1.1.1/24

配置dhcp

在交换机l2上划分vlan

[Huawei]vlan batch 2 3

[Huawei]interface e0/0/2

[Huawei-Ethernet0/0/2]port link-type access

[Huawei-Ethernet0/0/2]port default vlan 2

[Huawei-Ethernet0/0/2]qu

[Huawei]interface e0/0/3

[Huawei-Ethernet0/0/3]port link-type access

[Huawei-Ethernet0/0/3]port default vlan 3

[Huawei]interface e0/0/1

[Huawei-Ethernet0/0/1]port link-type trunk

[Huawei-Ethernet0/0/1]port trunk allow-pass vlan all

创建地址池

[R5]ip pool 1

[R5-ip-pool-1]network 192.168.1.0 mask 255.255.255.0

[R5-ip-pool-1]gateway-list 192.168.1.1

[R5-ip-pool-1]dns-list 8.8.8.8

[R5-ip-pool-1]qu

[R5]ip pool 2

[R5-ip-pool-2]network 192.168.2.0 mask 255.255.255.0

[R5-ip-pool-2]gateway-list 192.168.2.1

[R5-ip-pool-2]dns-list 8.8.8.8

[R5-ip-pool-2]qu

开启dhcp

[Huawei]dhcp enable

[Huawei]int g0/0/0

[Huawei-GigabitEthernet0/0/0]dhcp select global

[Huawei-GigabitEthernet0/0/0]dot1q termination vid 2

[Huawei-GigabitEthernet0/0/0]arp broadcast enable

[Huawei]int g0/0/1.2

[Huawei-GigabitEthernet0/0/0]dhcp select global

[Huawei-GigabitEthernet0/0/0]dot1q termination vid 3

[Huawei-GigabitEthernet0/0/0]arp broadcast enable

2.使用ospf协议合理划分区域保证安全

[r2]ospf 100 router-id 2.2.2.2
[r2]area 2
[r2-ospf-100-area-0.0.0.0]network 2.2.2.2 0.0.0.0 
[r2-ospf-100-area-0.0.0.0]network 172.16.64.1 0.0.0.0
[r2]area 0
[r2-ospf-100-area-0.0.0.0]network 172.16.32.2 0.0.0.0

3.加快收敛速度

  [R1]interface g0/0/0    
  [R1-GigabitEthernet0/0/0]ospf timer hello 5
  [R1-GigabitEthernet0/0/0]qu
  [R1]interface g0/0/1
  [R1-GigabitEthernet0/0/1]ospf timer hello 5
 

4.router 1为DR没有BDR

[R1]interface g0/0/0
[R1-GigabitEthernet0/0/0]ospf dr-priority 0
[R1]interface g0/0/1
[R1-GigabitEthernet0/0/1]ospf dr-priority 0
   

5.PC2456自动获取ip地址,pc1可以自由访问

[r8]interface g0/0/1.1
[r8-GigabitEthernet0/0/1.1]dot1q termination vid 2
[r8-GigabitEthernet0/0/1.1]ip address 192.168.1.1 24

[r8]interface g0/0/1.1
[r8-GigabitEthernet0/0/1.2]arp broadcast enable 
[r8-GigabitEthernet0/0/1.2]quit

[r1]interface g0/0/0
[r1-GigabitEthernet0/0/0]ip address 0.0.0.0 0 172.16.1.2

8.pc4可以ping 同router 6但不能登陆

acl 3000
rule deny tcp source 192.168.3.0 0.0.0.255 destination 172.16.1.1 255.255.255.255  destination-port eq 23
interface g0/0/1.1
traffic-filter outbound acl 3000

9.pc3可以ping通router 5但是router 5不能ping通pc 3

acl 3000
rule 5 deny icmp source 192.168.4.0 0.0.0.255 destination 192.168.2.0 0.0.0.255 icmp-type echo
interface g0/0/1.2
traffic-filter outbound acl 3000

测试