網絡安全技術與應用實訓報告.doc

網絡安全技術與應用綜合實訓報告題 目： 幀中繼網絡設計專 業(yè)： 計算機網絡學生姓名： 學 號： 指導教師： 時 間：2014年11月23日 目錄1前言.32總體設計（拓撲圖）.33網絡設計. .33.1 ACL配置.33.2 Frame-relay 配置.43.3 GRE隧道配置.84 實驗測試.115 實訓總結.121 前言 幀中繼（FrameRelay，FR）是現在廣域網的主干網最流行的連網協議，是一個面向連接的第二層傳輸協議，幀中繼是典型的包交換技術。幀中繼技術以X.25分組交換技術為基礎改造了原有的幀結構，繼承了X.25提供的統計復用功能和采用虛電路交換的優(yōu)點，簡化了可靠傳輸和差錯控制機制，把流量控制和差錯控制任務委托給了本地機完成，減少了網絡時延，降低了通信成本，從而獲得了良好的性能。幀中繼中的虛電路是幀中繼包交換網絡為實現不同DTE之間的數據傳輸所建立的邏輯鏈路，這種虛電路可以在幀中繼交換網絡內跨越任意多個DCE設備或幀中繼交換機。2 總體設計3、網絡設計3.1 ACL配置禁止Server0與內部通信：R6enableR6#configure terminalR6(config)#access-list 1 deny host 192.168.2.10R6(config)#interface fastEthernet 0/1R6(config-if)#ip access-group 1 in3.2Frame-relay 配置R3：Routeren Router#conf terEnter configuration commands, one per line. End with CNTL/Z.Router(config)#hostname R3 R3(config)#int fa0/0 R3(config-if)#ip address 172.18.1.30 255.255.255.0R3(config-if)#no shut %LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to upR3(config-if)#int serial 0/0/0R3(config-if)#encapsulation frame-relayR3(config-if)#no shut%LINK-5-CHANGED: Interface Serial0/0/0, changed state to upR3(config-if)#%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0/0, changed state to upR3(config-if)#interface serial0/0/0.1 point-to-point %LINK-5-CHANGED: Interface Serial0/0/0.1, changed state to up%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0/0.1, changed state to upR3(config-subif)#ip address 192.16.1.1 255.255.255.0 R3(config-subif)#description Link Router6 DLCI 603R3(config-subif)#frame-relay interface-dlci 306 R3(config-subif)#interface serial0/0/0.2 point-to-point%LINK-5-CHANGED: Interface Serial0/0/0.2, changed state to up%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0/0.2, changed state to upR3(config-subif)#ip address 192.16.3.2 255.255.255.0R3(config-subif)#description link to Router9 DLCI 903R3(config-subif)#frame-relay interface-dlci 309R3(config-subif)#end%SYS-5-CONFIG_I: Configured from console by consoleR3#conf terEnter configuration commands, one per line. End with CNTL/Z.R3(config)#router eigrp 100 R3(config-router)#network 172.18.1.0R3(config-router)#network 192.16.1.0R3(config-router)#network 192.168.3.0R3(config-router)#endR6：Routeren Router#conf terEnter configuration commands, one per line. End with CNTL/Z.Router(config)#hostname R6 R6(config)#int fa0/0 R6(config-if)#ip address 172.16.1.1 255.255.255.0R6(config-if)#no shutR6(config)#int s0/0/1 R6(config-if)#ip address 10.0.2.1 255.255.255.0R6(config-if)#no shut %LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to upR6(config-if)#int serial 0/0/0R6(config-if)#encapsulation frame-relayR6(config-if)#no shut%LINK-5-CHANGED: Interface Serial0/0/0, changed state to upR6(config-if)#%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0/0, changed state to upR6(config-if)#interface serial0/0/0.1 point-to-point %LINK-5-CHANGED: Interface Serial0/0/0.1, changed state to up%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0/0.1, changed state to upR6(config-subif)#ip address 192.16.1.2 255.255.255.0 R6(config-subif)#description Link Router6 DLCI 306R6(config-subif)#frame-relay interface-dlci 603 R6(config-subif)#interface serial0/0/0.2 point-to-point%LINK-5-CHANGED: Interface Serial0/0/0.2, changed state to up%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0/0.2, changed state to upR6(config-subif)#ip address 192.16.2.1 255.255.255.0R6(config-subif)#description link to Router9 DLCI 906R6(config-subif)#frame-relay interface-dlci 609R6(config-subif)#end%SYS-5-CONFIG_I: Configured from console by consoleR6#conf terEnter configuration commands, one per line. End with CNTL/Z.R6(config)#router eigrp 100 R6(config-router)#network 172.16.1.0R6(config-router)#network 192.16.1.0R6(config-router)#network 10.0.2.0R6(config-router)#network 192.168.2.0R6(config-router)#endR9：Routeren Router#conf terEnter configuration commands, one per line. End with CNTL/Z.Router(config)#hostname R9 R9(config)#int fa0/0 R9(config-if)#ip address 172.17.1.1 255.255.255.0R9(config-if)#no shutR9(config)#int fa0/1 R9(config-if)#ip address 192.168.1.1 255.255.255.0R9(config-if)#no shut %LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to upR9(config-if)#int serial 0/0/0R9(config-if)#encapsulation frame-relayR9(config-if)#no shut%LINK-5-CHANGED: Interface Serial0/0/0, changed state to upR9(config-if)#%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0/0, changed state to upR9(config-if)#interface serial0/0/0.1 point-to-point %LINK-5-CHANGED: Interface Serial0/0/0.1, changed state to up%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0/0.1, changed state to upR9(config-subif)#ip address 192.16.2.2 255.255.255.0 R9(config-subif)#description Link Router6 DLCI 609R9(config-subif)#frame-relay interface-dlci 906 R9(config-subif)#interface serial0/0/0.2 point-to-point%LINK-5-CHANGED: Interface Serial0/0/0.2, changed state to up%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0/0.2, changed state to upR9(config-subif)#ip address 192.16.3.1 255.255.255.0R9(config-subif)#description link to Router9 DLCI 309R9(config-subif)#frame-relay interface-dlci 903R9(config-subif)#end%SYS-5-CONFIG_I: Configured from console by consoleR9#conf terEnter configuration commands, one per line. End with CNTL/Z.R9(config)#router eigrp 100 R9(config-router)#network 172.17.1.0R9(config-router)#network 192.16.2.0R9(config-router)#network 192.16.3.0R9(config-router)#network 192.168.1.0R9(config-router)#end幀中繼配置：3.3 GRE隧道配置1、配置各臺路由器的IP地址，并且使用Ping命令確認各路由器的直連口的互通。2、 在R9和R4上配置靜態(tài)路由。確保Internet網絡骨干可以相互通信。3、Router6(config)#ip route 0.0.0.0 0.0.0.0 192.168.50.2Router8(config)#ip route 0.0.0.0 0.0.0.0 192.168.60.1在Router9與Router4上配置靜態(tài)默認路由，不僅僅是用于模擬接入路由器。同時還為了確保在創(chuàng)建隧道時，隧道源與隧道目標的IP地址相互可見。以便于實現隧道。3、在Route9路由器上配置GRE隧道。Router(config)#interface tunnel 0啟用GRE隧道。Router(config-if)#ip address 10.1.1.1 255.255.255.0為隧道指定IP地址。Router(config-if)#tunnel source serial 1/1配置隧道的本地源端口。Router1(config-if)#tunnel destination 配置隧道的目標出口。目的端口的IP地址可達性，是通過本地配置的默認路由保證的。192.168.60.2Router(config-if)#exitRouter(config)#4、在Router4路由器上配置GRE隧道。Router(config)#interface tunnel 0Router(config-if)#ip address 10.1.1.2 255.255.255.0Router(config-if)#tunnel source serial 1/0Router(config-if)#tunnel destination 192.168.50.1Router(config-if)#exitRouter(config)#exit5、在Router9上查看隧道接口信息。6、查看Router9的路由表。7、 在Router9上PING路由器Router4的隧道接口。8、 在Router9和Router4分