big expr initialized
This commit is contained in:
336
experiment/gemini.md
Normal file
336
experiment/gemini.md
Normal file
@ -0,0 +1,336 @@
|
|||||||
|
### **企业网络架构设计综合实验方案**
|
||||||
|
|
||||||
|
#### **一、 实验目标**
|
||||||
|
|
||||||
|
本项目旨在模拟一个中型企业的总部网络架构。通过本次实验，你将能够：
|
||||||
|
|
||||||
|
1. **规划与设计网络**: 学习从需求分析到设计拓扑、规划IP和VLAN的完整流程。
|
||||||
|
2. **掌握高可用性技术**:
|
||||||
|
* 使用 **iStack（堆叠）** 技术将两台核心交换机虚拟化为一台，实现设备级冗余。
|
||||||
|
* 使用 **Eth-Trunk（链路聚合）** 提高关键链路的带宽和可靠性。
|
||||||
|
* 使用 **VRRP（虚拟路由冗余协议）** 实现出口网关的冗余备份。
|
||||||
|
* 配置防火墙 **双机热备（HRP）**，确保安全策略的持续性。
|
||||||
|
3. **掌握网络安全技术**:
|
||||||
|
* 利用 **VLAN** 划分不同安全域（如员工区、服务器区）。
|
||||||
|
* 采用 **防火墙旁挂** 方案，通过安全区域和策略控制不同区域间的流量。
|
||||||
|
* 配置 **端口安全**，防止非法设备接入。
|
||||||
|
4. **掌握网络服务配置**:
|
||||||
|
* 配置 **DHCP** 服务器为内部员工自动分配IP地址。
|
||||||
|
* 配置 **NAT** 地址转换，使内网用户能访问互联网。
|
||||||
|
5. **掌握高级路由技术**:
|
||||||
|
* 在核心交换机上配置 **VPN实例（VPN-Instance）**，实现逻辑隔离。
|
||||||
|
* 配置 **OSPF** 动态路由协议和 **静态路由**，实现全网互通。
|
||||||
|
|
||||||
|
#### **二、 网络拓扑与规划**
|
||||||
|
|
||||||
|
##### **1. 逻辑拓扑图**
|
||||||
|
|
||||||
|
我们将采用经典的三层架构：**接入层 -\> 核心层 -\> 出口层**，并旁挂安全设备（防火墙）。
|
||||||
|
|
||||||
|
* **核心层**: 两台华为交换机 (S1, S2) 组成堆叠系统，作为网络核心 **CORE**。
|
||||||
|
* **接入层**:
|
||||||
|
* 一台交换机 (S3) 连接员工区 (VLAN 10)。
|
||||||
|
* 一台交换机 (S4) 连接服务器区/DMZ (VLAN 20)。
|
||||||
|
* **出口层**: 两台华为路由器 (R1, R2) 作为主备出口网关，通过 VRRP 提供单一虚拟网关。
|
||||||
|
* **安全层**: 两台华为防火墙 (FW1, FW2) 以双机热备模式旁挂在核心交换机上。
|
||||||
|
* **模拟互联网**: 使用第三台路由器 (R3) 模拟外部互联网。
|
||||||
|
* **主机**:
|
||||||
|
* PC1, PC2: 员工区主机。
|
||||||
|
* PC3: 服务器区，部署Web服务。
|
||||||
|
* PC4: 外网主机，用于测试访问。
|
||||||
|
* PC5: 管理主机，用于连接设备Console口进行配置。
|
||||||
|
|
||||||
|
##### **2. 设备连接表**
|
||||||
|
|
||||||
|
| 设备名称 | 本地接口 | 连接设备 | 对方接口 | 备注 |
|
||||||
|
| :--- | :--- | :--- | :--- | :--- |
|
||||||
|
| **S1 (CORE)** | GigabitEthernet0/0/1 | S2 | GigabitEthernet0/0/1 | 堆叠链路1 |
|
||||||
|
| | GigabitEthernet0/0/2 | S2 | GigabitEthernet0/0/2 | 堆叠链路2 |
|
||||||
|
| | GigabitEthernet0/0/3 | R1 | GigabitEthernet0/0/1 | Eth-Trunk 1 |
|
||||||
|
| | GigabitEthernet0/0/4 | R2 | GigabitEthernet0/0/1 | Eth-Trunk 2 |
|
||||||
|
| | GigabitEthernet0/0/5 | FW1 | GigabitEthernet0/0/1 | Eth-Trunk 3 (Untrust) |
|
||||||
|
| | GigabitEthernet0/0/6 | FW1 | GigabitEthernet0/0/2 | Eth-Trunk 4 (Trust) |
|
||||||
|
| | GigabitEthernet0/0/7 | S3 | GigabitEthernet0/0/24 | 连接员工区交换机 |
|
||||||
|
| | GigabitEthernet0/0/8 | S4 | GigabitEthernet0/0/24 | 连接服务器区交换机 |
|
||||||
|
| **S2 (CORE)** | GigabitEthernet1/0/3 | R1 | GigabitEthernet0/0/2 | Eth-Trunk 1 |
|
||||||
|
| | GigabitEthernet1/0/4 | R2 | GigabitEthernet0/0/2 | Eth-Trunk 2 |
|
||||||
|
| | GigabitEthernet1/0/5 | FW2 | GigabitEthernet0/0/1 | Eth-Trunk 5 (Untrust) |
|
||||||
|
| | GigabitEthernet1/0/6 | FW2 | GigabitEthernet0/0/2 | Eth-Trunk 6 (Trust) |
|
||||||
|
| **FW1** | GigabitEthernet0/0/3 | FW2 | GigabitEthernet0/0/3 | 心跳线 (HRP) |
|
||||||
|
| **R1** | GigabitEthernet0/0/0 | R3 | GigabitEthernet0/0/0 | 连接模拟Internet |
|
||||||
|
| **R2** | GigabitEthernet0/0/0 | R3 | GigabitEthernet0/0/1 | 连接模拟Internet |
|
||||||
|
| **S3** | GigabitEthernet0/0/1 | PC1 | - | 员工主机 |
|
||||||
|
| | GigabitEthernet0/0/2 | PC2 | - | 员工主机 |
|
||||||
|
| **S4** | GigabitEthernet0/0/1 | PC3 | - | Web服务器 |
|
||||||
|
|
||||||
|
##### **3. IP地址与VLAN规划**
|
||||||
|
|
||||||
|
| 用途 | VLAN ID | 网段 | 网关 | 备注 |
|
||||||
|
| :--- | :--- | :--- | :--- | :--- |
|
||||||
|
| 员工区 | 10 | `192.168.10.0/24` | `192.168.10.254` (Vlanif10) | DHCP分配 |
|
||||||
|
| 服务器区 | 20 | `192.168.20.0/24` | `192.168.20.254` (Vlanif20) | |
|
||||||
|
| CORE -\> Routers | 100 | `10.1.100.0/24` | `10.1.100.254` (Vlanif100) | CORE-R1: `.1`, CORE-R2: `.2`, VRRP: `.253` |
|
||||||
|
| CORE -\> FWs (外) | 200 | `10.1.200.0/24` | `10.1.200.254` (Vlanif200) | CORE-FW1: `.1`, CORE-FW2: `.2`, VRRP: `.253` |
|
||||||
|
| CORE -\> FWs (内) | 300 | `10.1.300.0/24` | `10.1.300.254` (Vlanif300) | CORE-FW1: `.1`, CORE-FW2: `.2`, VRRP: `.253` |
|
||||||
|
| FWs 心跳 | - | `1.1.1.0/30` | - | FW1: `.1`, FW2: `.2` |
|
||||||
|
| Internet 模拟 | - | `202.100.10.0/24` | - | R1-R3: `10.0`, R2-R3: `20.0` |
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
|
#### **三、 详细实验步骤与指令**
|
||||||
|
|
||||||
|
**准备工作**: 使用 `reset saved-configuration` 和 `reboot` 命令清空所有设备配置，并通过Console线连接PC5进行初始配置。
|
||||||
|
|
||||||
|
##### **步骤一：配置核心层 (S1, S2 -\> CORE)**
|
||||||
|
|
||||||
|
**1. 组建堆叠系统**
|
||||||
|
|
||||||
|
* **在 S1 上配置:**
|
||||||
|
```bash
|
||||||
|
<HUAWEI> system-view
|
||||||
|
[HUAWEI] sysname S1
|
||||||
|
[S1] interface stack-port 0/1
|
||||||
|
[S1-stack-port0/1] port interface GigabitEthernet 0/0/1 enable
|
||||||
|
[S1-stack-port0/1] port interface GigabitEthernet 0/0/2 enable
|
||||||
|
[S1-stack-port0/1] quit
|
||||||
|
[S1] stack slot 0 priority 200
|
||||||
|
[S1] save
|
||||||
|
```
|
||||||
|
* **在 S2 上配置:**
|
||||||
|
```bash
|
||||||
|
<HUAWEI> system-view
|
||||||
|
[HUAWEI] sysname S2
|
||||||
|
[S2] interface stack-port 0/1
|
||||||
|
[S2-stack-port0/1] port interface GigabitEthernet 0/0/1 enable
|
||||||
|
[S2-stack-port0/1] port interface GigabitEthernet 0/0/2 enable
|
||||||
|
[S2-stack-port0/1] quit
|
||||||
|
[S2] stack slot 0 renumber 1
|
||||||
|
Warning: The device will reboot. Continue? [Y/N]: y
|
||||||
|
```
|
||||||
|
* **操作**: S2 重启后，将 S1 和 S2 断电。先启动 S1，等待约1-2分钟，再启动 S2。启动完成后，通过 S1 的 Console 口登录，设备名称应变为 `HUAWEI`。
|
||||||
|
```bash
|
||||||
|
<HUAWEI> system-view
|
||||||
|
[HUAWEI] sysname CORE
|
||||||
|
[CORE] display stack
|
||||||
|
# 确认 S1(slot 0) 为 Master，S2(slot 1) 为 Standby
|
||||||
|
```
|
||||||
|
|
||||||
|
**2. 配置链路聚合 (Eth-Trunk)**
|
||||||
|
|
||||||
|
```bash
|
||||||
|
[CORE] interface Eth-Trunk 1
|
||||||
|
[CORE-Eth-Trunk1] mode lacp-static
|
||||||
|
[CORE-Eth-Trunk1] trunkport GigabitEthernet 0/0/3
|
||||||
|
[CORE-Eth-Trunk1] trunkport GigabitEthernet 1/0/3
|
||||||
|
[CORE-Eth-Trunk1] quit
|
||||||
|
# 重复为 Eth-Trunk 2, 3, 4, 5, 6 创建，并加入对应端口
|
||||||
|
```
|
||||||
|
|
||||||
|
**3. 创建 VLAN 和 VLANIF 接口**
|
||||||
|
|
||||||
|
```bash
|
||||||
|
[CORE] vlan batch 10 20 100 200 300
|
||||||
|
[CORE] interface Vlanif10
|
||||||
|
[CORE-Vlanif10] ip address 192.168.10.254 24
|
||||||
|
[CORE-Vlanif10] quit
|
||||||
|
# 为 Vlanif20, 100, 200, 300 配置对应的IP地址
|
||||||
|
```
|
||||||
|
|
||||||
|
**4. 配置接口模式 (Trunk)**
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# 配置连接路由器的链路
|
||||||
|
[CORE] interface Eth-Trunk 1
|
||||||
|
[CORE-Eth-Trunk1] port link-type trunk
|
||||||
|
[CORE-Eth-Trunk1] port trunk allow-pass vlan 100
|
||||||
|
[CORE-Eth-Trunk1] quit
|
||||||
|
# 对 Eth-Trunk 2, 3, 4, 5, 6 及连接接入层交换机的 G0/0/7, G0/0/8 配置相应的Trunk和VLAN
|
||||||
|
# 例如，连接 S3 的 G0/0/7
|
||||||
|
[CORE] interface GigabitEthernet 0/0/7
|
||||||
|
[CORE-GigabitEthernet0/0/7] port link-type trunk
|
||||||
|
[CORE-GigabitEthernet0/0/7] port trunk allow-pass vlan 10
|
||||||
|
[CORE-GigabitEthernet0/0/7] quit
|
||||||
|
```
|
||||||
|
|
||||||
|
##### **步骤二：配置接入层 (S3, S4)**
|
||||||
|
|
||||||
|
* **在 S3 (员工区) 上配置:**
|
||||||
|
```bash
|
||||||
|
[S3] vlan 10
|
||||||
|
[S3] interface GigabitEthernet 0/0/1
|
||||||
|
[S3-GigabitEthernet0/0/1] port link-type access
|
||||||
|
[S3-GigabitEthernet0/0/1] port default vlan 10
|
||||||
|
[S3-GigabitEthernet0/0/1] quit
|
||||||
|
# 对 G0/0/2 重复配置
|
||||||
|
[S3] interface GigabitEthernet 0/0/24
|
||||||
|
[S3-GigabitEthernet0/0/24] port link-type trunk
|
||||||
|
[S3-GigabitEthernet0/0/24] port trunk allow-pass vlan 10
|
||||||
|
[S3-GigabitEthernet0/0/24] quit
|
||||||
|
```
|
||||||
|
* **在 S4 (服务器区) 上做类似配置**，使用 VLAN 20。
|
||||||
|
|
||||||
|
##### **步骤三：配置出口网关 (R1, R2)**
|
||||||
|
|
||||||
|
* **在 R1 上配置:**
|
||||||
|
```bash
|
||||||
|
[R1] interface Eth-Trunk 1
|
||||||
|
[R1-Eth-Trunk1] mode lacp-static
|
||||||
|
[R1-Eth-Trunk1] trunkport GigabitEthernet 0/0/1
|
||||||
|
[R1-Eth-Trunk1] trunkport GigabitEthernet 0/0/2
|
||||||
|
[R1-Eth-Trunk1] quit
|
||||||
|
[R1] interface Eth-Trunk 1.100 // 创建子接口
|
||||||
|
[R1-Eth-Trunk1.100] dot1q termination vid 100
|
||||||
|
[R1-Eth-Trunk1.100] ip address 10.1.100.1 24
|
||||||
|
[R1-Eth-Trunk1.100] vrrp vrid 1 virtual-ip 10.1.100.253
|
||||||
|
[R1-Eth-Trunk1.100] vrrp vrid 1 priority 120 // R1 作为 Master
|
||||||
|
[R1-Eth-Trunk1.100] quit
|
||||||
|
# 配置连接外网的接口
|
||||||
|
[R1] interface GigabitEthernet 0/0/0
|
||||||
|
[R1-GigabitEthernet0/0/0] ip address 202.100.10.1 24
|
||||||
|
[R1-GigabitEthernet0/0/0] quit
|
||||||
|
```
|
||||||
|
* **在 R2 上做类似配置**，IP为`10.1.100.2`，VRRP 优先级为默认(100)。
|
||||||
|
|
||||||
|
##### **步骤四：配置防火墙 (FW1, FW2)**
|
||||||
|
|
||||||
|
* **在 FW1 上配置:**
|
||||||
|
```bash
|
||||||
|
# 1. 配置接口和IP
|
||||||
|
[FW1] interface Eth-Trunk 3
|
||||||
|
[FW1-Eth-Trunk3] mode lacp-static
|
||||||
|
[FW1-Eth-Trunk3] ip address 10.1.200.1 24
|
||||||
|
... // 添加成员接口
|
||||||
|
[FW1] interface Eth-Trunk 4
|
||||||
|
[FW1-Eth-Trunk4] mode lacp-static
|
||||||
|
[FW1-Eth-Trunk4] ip address 10.1.300.1 24
|
||||||
|
... // 添加成员接口
|
||||||
|
[FW1] interface GigabitEthernet 0/0/3
|
||||||
|
[FW1-GigabitEthernet0/0/3] ip address 1.1.1.1 30
|
||||||
|
# 2. 划分安全区域
|
||||||
|
[FW1] firewall zone untrust
|
||||||
|
[FW1-zone-untrust] add interface Eth-Trunk 3
|
||||||
|
[FW1] firewall zone trust
|
||||||
|
[FW1-zone-trust] add interface Eth-Trunk 4
|
||||||
|
[FW1] firewall zone dmz
|
||||||
|
[FW1-zone-dmz] add interface GigabitEthernet 0/0/3
|
||||||
|
# 3. 配置双机热备 (HRP)
|
||||||
|
[FW1] hrp interface GigabitEthernet 0/0/3 remote 1.1.1.2
|
||||||
|
[FW1] hrp enable
|
||||||
|
```
|
||||||
|
* **在 FW2 上做类似配置**，IP地址和 HRP remote 地址相应更改。配置完成后，按 **先主后备** 顺序重启防火墙。
|
||||||
|
|
||||||
|
##### **步骤五：配置路由实现全网互通**
|
||||||
|
|
||||||
|
这是最关键的一步，参考了学长报告中的 "旁挂防火墙" 路由设计。
|
||||||
|
|
||||||
|
* **在 CORE 上配置 VPN 实例和路由:**
|
||||||
|
```bash
|
||||||
|
# 1. 创建VPN实例
|
||||||
|
[CORE] ip vpn-instance Public
|
||||||
|
[CORE-vpn-instance-Public] route-distinguisher 100:1
|
||||||
|
[CORE] ip vpn-instance Private
|
||||||
|
[CORE-vpn-instance-Private] route-distinguisher 200:1
|
||||||
|
# 2. 将接口绑定到VPN实例
|
||||||
|
[CORE] interface Vlanif100
|
||||||
|
[CORE-Vlanif100] ip binding vpn-instance Public
|
||||||
|
[CORE-Vlanif100] ip address 10.1.100.254 24 // 重新配置IP
|
||||||
|
[CORE] interface Vlanif200
|
||||||
|
[CORE-Vlanif200] ip binding vpn-instance Public
|
||||||
|
[CORE-Vlanif200] ip address 10.1.200.254 24
|
||||||
|
# 将 Vlanif10, 20, 300 绑定到 Private 实例并重配IP
|
||||||
|
# 3. 配置路由
|
||||||
|
# Private实例的流量默认全部扔给防火墙内口
|
||||||
|
[CORE] ip route-static vpn-instance Private 0.0.0.0 0.0.0.0 10.1.300.253
|
||||||
|
# Public实例去往内网的流量，下一跳是防火墙外口
|
||||||
|
[CORE] ip route-static vpn-instance Public 192.168.10.0 24 10.1.200.253
|
||||||
|
[CORE] ip route-static vpn-instance Public 192.168.20.0 24 10.1.200.253
|
||||||
|
```
|
||||||
|
* **在 CORE, R1, R2 上配置 OSPF:**
|
||||||
|
```bash
|
||||||
|
# CORE上
|
||||||
|
[CORE] ospf 100 vpn-instance Public
|
||||||
|
[CORE-ospf-100] area 0
|
||||||
|
[CORE-ospf-100-area-0.0.0.0] network 10.1.100.0 0.0.0.255
|
||||||
|
# R1上
|
||||||
|
[R1] ospf 1
|
||||||
|
[R1-ospf-1] area 0
|
||||||
|
[R1-ospf-1-area-0.0.0.0] network 10.1.100.0 0.0.0.255
|
||||||
|
[R1-ospf-1-area-0.0.0.0] network 202.100.10.0 0.0.0.255
|
||||||
|
```
|
||||||
|
* **在 FW1 上配置静态路由 (FW2会自动同步):**
|
||||||
|
```bash
|
||||||
|
# 上行流量（去往外网）
|
||||||
|
[FW1] ip route-static 0.0.0.0 0 10.1.200.254
|
||||||
|
# 下行流量（回到内网）
|
||||||
|
[FW1] ip route-static 192.168.10.0 24 10.1.300.254
|
||||||
|
[FW1] ip route-static 192.168.20.0 24 10.1.300.254
|
||||||
|
```
|
||||||
|
|
||||||
|
##### **步骤六：配置网络服务**
|
||||||
|
|
||||||
|
* **在 CORE 上配置 DHCP:**
|
||||||
|
```bash
|
||||||
|
[CORE] dhcp enable
|
||||||
|
[CORE] interface Vlanif10
|
||||||
|
[CORE-Vlanif10] dhcp select interface
|
||||||
|
[CORE-Vlanif10] dhcp server dns-list 192.168.20.10 // 假设DNS服务器是PC3
|
||||||
|
```
|
||||||
|
* **在 R1 和 R2 上配置 NAT:**
|
||||||
|
```bash
|
||||||
|
# R1上
|
||||||
|
[R1] acl 2000
|
||||||
|
[R1-acl-basic-2000] rule permit source 192.168.10.0 0.0.0.255
|
||||||
|
[R1] interface GigabitEthernet 0/0/0
|
||||||
|
[R1-GigabitEthernet0/0/0] nat outbound 2000
|
||||||
|
# 为Web服务器做静态NAT
|
||||||
|
[R1-GigabitEthernet0/0/0] nat static protocol tcp global 202.100.10.100 80 inside 192.168.20.10 80
|
||||||
|
```
|
||||||
|
在 R2 上做类似配置。
|
||||||
|
|
||||||
|
##### **步骤七：配置安全策略**
|
||||||
|
|
||||||
|
* **在 FW1 的Web管理界面或命令行配置 (FW2会自动同步):**
|
||||||
|
|
||||||
|
1. **Trust -\> Untrust**: 允许员工区访问外网。
|
||||||
|
```bash
|
||||||
|
[FW1] security-policy
|
||||||
|
[FW1-security-policy] rule name staff_to_internet
|
||||||
|
[FW1-security-policy-rule-staff_to_internet] source-zone trust
|
||||||
|
[FW1-security-policy-rule-staff_to_internet] destination-zone untrust
|
||||||
|
[FW1-security-policy-rule-staff_to_internet] source-address 192.168.10.0 24
|
||||||
|
[FW1-security-policy-rule-staff_to_internet] action permit
|
||||||
|
```
|
||||||
|
2. **Untrust -\> Trust**: 允许外网访问Web服务器。
|
||||||
|
```bash
|
||||||
|
[FW1-security-policy] rule name internet_to_web
|
||||||
|
[FW1-security-policy-rule-internet_to_web] source-zone untrust
|
||||||
|
[FW1-security-policy-rule-internet_to_web] destination-zone trust
|
||||||
|
[FW1-security-policy-rule-internet_to_web] destination-address 192.168.20.10 32
|
||||||
|
[FW1-security-policy-rule-internet_to_web] service protocol tcp destination-port 80
|
||||||
|
[FW1-security-policy-rule-internet_to_web] action permit
|
||||||
|
```
|
||||||
|
3. **默认策略**: `any` to `any` 的流量是 `deny` 的。
|
||||||
|
|
||||||
|
* **在 S3 上配置端口安全:**
|
||||||
|
|
||||||
|
```bash
|
||||||
|
[S3] interface GigabitEthernet 0/0/2
|
||||||
|
[S3-GigabitEthernet0/0/2] port-security enable
|
||||||
|
[S3-GigabitEthernet0/0/2] port-security max-mac-num 1
|
||||||
|
[S3-GigabitEthernet0/0/2] port-security mac-address sticky
|
||||||
|
```
|
||||||
|
|
||||||
|
#### **四、 实验验证**
|
||||||
|
|
||||||
|
完成所有配置后，进行以下验证：
|
||||||
|
|
||||||
|
1. **DHCP 验证**: 将 PC1 设置为自动获取 IP，检查是否能获取到 `192.168.10.0/24` 网段的地址。
|
||||||
|
2. **内网连通性**: PC1 `ping` PC2, PC1 `ping` PC3 (Web服务器)。
|
||||||
|
3. **NAT 验证**: PC1 `ping` 外网主机 PC4 的地址，应该能通。
|
||||||
|
4. **Web 服务访问**:
|
||||||
|
* 内网 PC1 打开浏览器访问 `http://192.168.20.10`。
|
||||||
|
* 外网 PC4 打开浏览器访问 `http://202.100.10.100` (R1的NAT地址)。
|
||||||
|
5. **VRRP 故障切换**: 在 PC1 上长 `ping` 外网地址，然后 `shutdown` R1 的 `Eth-Trunk1.100` 接口，观察 `ping` 是否中断（应该只会丢1-2个包）。
|
||||||
|
6. **防火墙 HA 切换**: `display hrp state` 查看主备状态。关闭 FW1 电源，再次查看，FW2 应切换为 Active。
|
||||||
|
7. **端口安全验证**: 将 PC2 的网线拔下，接到 G0/0/2 端口，PC2 应该无法通信。
|
||||||
|
|
||||||
BIN
experiment/labdesign.png
Normal file
BIN
experiment/labdesign.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 301 KiB |
BIN
experiment/labdesign2.png
Normal file
BIN
experiment/labdesign2.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 197 KiB |
BIN
experiment/labdesign3.png
Normal file
BIN
experiment/labdesign3.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 164 KiB |
BIN
experiment/labdesign4.png
Normal file
BIN
experiment/labdesign4.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 163 KiB |
BIN
experiment/labdesignfinal.png
Normal file
BIN
experiment/labdesignfinal.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 93 KiB |
63
experiment/labdisign.md
Normal file
63
experiment/labdisign.md
Normal file
@ -0,0 +1,63 @@
|
|||||||
|
graph TD
|
||||||
|
subgraph Internet [外网区域]
|
||||||
|
style Internet fill:#E6F3FF,stroke:#99CCFF
|
||||||
|
Internet_Cloud(fa:fa-cloud Internet)
|
||||||
|
PC4(fa:fa-laptop PC4 - 外网用户)
|
||||||
|
end
|
||||||
|
|
||||||
|
Internet_Cloud -- WAN链路 --> R3(R3 - 模拟ISP)
|
||||||
|
R3 -- 链路 A --> R1
|
||||||
|
R3 -- 链路 B --> R2
|
||||||
|
|
||||||
|
subgraph Exit_Layer [出口层 - VRRP负载分担]
|
||||||
|
style Exit_Layer fill:#E6FFE6,stroke:#99FF99
|
||||||
|
R1(fa:fa-route R1 - 出口网关)
|
||||||
|
R2(fa:fa-route R2 - 出口网关)
|
||||||
|
end
|
||||||
|
|
||||||
|
subgraph Core_and_Security [核心与安全区_防火墙旁挂]
|
||||||
|
style Core_and_Security fill:#F5F5F5,stroke:#CCCCCC,stroke-width:2px
|
||||||
|
|
||||||
|
subgraph CORE_STACK [核心层_堆叠系统_S1+S2]
|
||||||
|
style CORE_STACK fill:#FFF5E6,stroke:#FFCC99
|
||||||
|
CORE((fa:fa-layer-group CORE))
|
||||||
|
end
|
||||||
|
|
||||||
|
subgraph FW_HA [安全层_防火墙双机热备]
|
||||||
|
style FW_HA fill:#FFECE6,stroke:#FFB399
|
||||||
|
FW1(fa:fa-shield-alt FW1)
|
||||||
|
FW2(fa:fa-shield-alt FW2)
|
||||||
|
end
|
||||||
|
|
||||||
|
FW1 <-.->|HRP 心跳线| FW2
|
||||||
|
end
|
||||||
|
|
||||||
|
subgraph Access_Layer [接入层]
|
||||||
|
style Access_Layer fill:#F0E6FF,stroke:#D1B3FF
|
||||||
|
S3(S3 - 员工区交换机)
|
||||||
|
S4(S4 - 服务器/访客区交换机)
|
||||||
|
end
|
||||||
|
|
||||||
|
subgraph End_Devices [内网终端设备]
|
||||||
|
PC1(fa:fa-computer PC1 <br> 员工区 VLAN 10)
|
||||||
|
Server(fa:fa-server Web服务器 <br> 服务器区 VLAN 20)
|
||||||
|
PC3(fa:fa-wifi PC3 <br> 访客区 VLAN 30)
|
||||||
|
end
|
||||||
|
|
||||||
|
%% 定义连接关系
|
||||||
|
%% 出口层 <--> 核心层
|
||||||
|
R1 -- Eth-Trunk 1 --> CORE
|
||||||
|
R2 -- Eth-Trunk 2 --> CORE
|
||||||
|
|
||||||
|
%% 防火墙旁挂流量路径
|
||||||
|
CORE -- "Untrust区 <br> (VLAN 200)" --> FW1 & FW2
|
||||||
|
FW1 & FW2 -- "Trust区 <br> (VLAN 300)" --> CORE
|
||||||
|
|
||||||
|
%% 核心层 <--> 接入层
|
||||||
|
CORE -- Trunk链路 --> S3
|
||||||
|
CORE -- Trunk链路 --> S4
|
||||||
|
|
||||||
|
%% 接入层 <--> 终端
|
||||||
|
S3 -- Access端口 --> PC1
|
||||||
|
S4 -- Access端口 --> Server
|
||||||
|
S4 -- Access端口 --> PC3
|
||||||
38
experiment/labdisignfinal.md
Normal file
38
experiment/labdisignfinal.md
Normal file
@ -0,0 +1,38 @@
|
|||||||
|
---
|
||||||
|
config:
|
||||||
|
layout: dagre
|
||||||
|
---
|
||||||
|
flowchart TD
|
||||||
|
subgraph Internet["外网区域"]
|
||||||
|
InternetCloud["fa:fa-cloud Internet"]
|
||||||
|
PC4["fa:fa-laptop PC4 - 外网用户"]
|
||||||
|
end
|
||||||
|
subgraph ExitLayer["出口层 - VRRP 负载分担"]
|
||||||
|
R1["fa:fa-route R1"]
|
||||||
|
R2["fa:fa-route R2"]
|
||||||
|
end
|
||||||
|
subgraph SecurityLayer["安全层 - 串联出口"]
|
||||||
|
FW1["fa:fa-shield-alt FW1 (出口安全边界)"]
|
||||||
|
end
|
||||||
|
subgraph CoreStack["核心层 - 堆叠系统 (S1 + S2)"]
|
||||||
|
CORE["fa:fa-layer-group CORE"]
|
||||||
|
end
|
||||||
|
subgraph AccessLayer["接入层"]
|
||||||
|
S3["S3 - 员工区交换机"]
|
||||||
|
S4["S4 - 服务器/访客区交换机"]
|
||||||
|
end
|
||||||
|
InternetCloud -- WAN链路 --> R3["R3 - 模拟ISP"]
|
||||||
|
R3 -- 链路 A --> R1
|
||||||
|
R3 -- 链路 B --> R2
|
||||||
|
R1 -- "Eth-Trunk 1 (R1 to FW)" --> FW1
|
||||||
|
R2 -- "Eth-Trunk 1 (R2 to FW)" --> FW1
|
||||||
|
FW1 -- "Eth-Trunk 2 (FW to CORE)" --> CORE
|
||||||
|
CORE -- Trunk链路 --> S3 & S4
|
||||||
|
S3 -- Access端口 --> PC1["fa:fa-computer PC1<br>员工区 VLAN 10"]
|
||||||
|
S4 -- Access端口 --> Server["fa:fa-server Web服务器<br>服务器区 VLAN 20 (DMZ)"] & PC3["fa:fa-wifi PC3<br>访客区 VLAN 30"]
|
||||||
|
style Internet fill:#E6F3FF,stroke:#99CCFF
|
||||||
|
style ExitLayer fill:#E6FFE6,stroke:#99FF99
|
||||||
|
style SecurityLayer fill:#FFECE6,stroke:#FFB399
|
||||||
|
style CoreStack fill:#FFF5E6,stroke:#FFCC99
|
||||||
|
style AccessLayer fill:#F0E6FF,stroke:#D1B3FF
|
||||||
|
|
||||||
Reference in New Issue
Block a user