1、实验22 公司网络规划实验要求：5个部门之间不能互相访问，但是都可以访问服务区和Internet。服务区不能访问Internet。Internet不能主动发起访问内部服务。实验器材：路由器route(3620);交换机switch(2950),和6台pc等。实验目的：了解vlan的划分；访问控制列表的设置；trunk的封装；以及防火墙的设置等。we如图所示以下是具体的操作：vlan划分部分route: tenconf tint e0/0.1encapsulation isl vlan 1 ip add 192.168.1.1 255.255.255.0no shutint e0/0.2enca
2、psulation isl vlan 2ip add 192.168.2.1 255.255.255.0no shutint e0/0.3encapsulation isl vlan 3ip add 192.168.3.1 255.255.255.0no shutint e0/0.4encapsulation isl vlan 4ip add 192.168.4.1 255.255.255.0no shutint e0/0.5encapsulation isl vlan 5ip add 192.168.5.1 255.255.255.0no shutint e0/0.6encapsulatio
3、n isl vlan 6ip add 192.168.6.1 255.255.255.0no shut switch:envlan databasevlan 2 name vlan2vlan 3 name vlan3vlan 4 name vlan4vlan 5 name vlan5vlan 6 name vlan6crl+zenconf tint fa0/2switchport access vlan 2int fa0/3switchport access vlan 3int fa0/4switchport access vlan 4int fa0/5switchport access vl
4、an 5int fa0/6switchport access vlan 6int fa0/7switchport mode trunkswitchport trunk encapsulation islpc1: 192.168.1.2 255.255.255.0pc2: 192.168.2.2 255.255.255.0pc3: 192.168.3.2 255.255.255.0pc4: 192.168.4.2 255.255.255.0pc5: 192.168.5.2 255.255.255.0pc6: 192.168.6.2 255.255.255.0设置访问控制列表部分；以及防火墙的设置
5、:比较烦琐，我不修改他的设置了，重新在最下面为大家举一部分，其它的参照就可以了route:enconf taccess-list 101 deny tcp 192.168.1.2 0.0.0255 any establishedpermit tcp any any establishedaccess-list102 permit ip 192.168.1.2 0.0.0.255 192.168.2.1 0.0.4.255access-list103 permit ip 192.168.2.2 0.0.0.255 192.168.1.2 0.0.0.255deny ip192.168.2.2 0
6、 0.0.255 192.168.3.2 0.0.4.255access-list 104 permit ip 192.168.3.2 0.0.0.255 192.168.1.2 0.0.0.255deny ip 192.168.3.2 0.0.0.255 192.168.4.2 0.0.3.255.deny ip 192.168.3.2 0.0.0.255 192.168.2.2 0.0.0.255acces-list 105 permit ip 192.168.4.2 0.0.0.255 192.168.1.2 0.0.0.255deny ip 192.168.4.2 0.0.0.255
7、192.168.5.2 0.0.2.255deny ip 192.168.4.2 0.0.0.255 192.168.2.2 0.0.2.255access-list 106 permit ip 192.168.5.2 0.0.0.255 192.168.1.2 0.0.0.255deny ip 192.168.5.2 0.0.0.255 192.168.2.1 0.0.3.255deny ip 192.168.5.2 0.0.0.255 192.168.6.2 0.0.0.255access-list 107 permit ip 192.168.6.2 0.0.0.255 192.168.1
8、.2 0.0.0.255deny ip 192.168.6.2 0.0.0.255 192.168.2.2.1 0.0.4.255int e0/0.1ip access-group 101ip access-group 102 inint e0/0.2ip access-group 101ip access-group 103 inint e0/0.3ip access-group 101ip access-group 104 in int e0/0.4ip access-group 101 ip access-group 105 inint e0/0.5int access-group 10
9、1int access-group 106 inint e0/0.6int access-group 101int access-group 107 inaccess-list 101 permit tcp 192.168.0.0 0.0.7.255 anyint e/0.1ip access-group 101 outaccess-list 102 deny tcp 192.168.3.0 0.0.0.255 anyaccess-list 102 deny tcp 192.168.4.0 0.0.0.255 anyaccess-list 102 deny tcp 192.168.5.0 0.0.0.255 anyaccess-list 102 deny tcp 192.168.6.0 0.0.0.255 anyaccess-list 102 permit tcp 192.168.1.0 0.0.0.255 anyaccess-list 102 permit tcp any any establishedint e0/0.2ip access-group 102 out
