NE綜合實驗2：RIP 與 OSPF 動態路由精細配置及ACL訪問控制列表電腦

NE綜合實驗2：RIP 與 OSPF 動態路由精細配置及ACL訪問控制列表

實驗拓撲圖

在這里插入圖片描述

實驗需求

1.按照圖示配置IP地址
2.按照圖示區域劃分配置對應的動態路由協議
3.在R7上配置dhcp服務器，能夠讓pc可以獲取IP地址
4.將所有環回?宣告進ospf中，將環回?7宣告進rip中，將rip路由引?ospf
中，ospf路由引?rip中
5.要求實現全?互通
6.在r3和r6上開啟rip的端?驗證，密碼為hyzy
7.在R7上開啟rip靜默接?，要求業務?段不允許接收協議報?
8.在R5和R4上開啟ospf端?驗證，密碼為hyzy
9.要求在R4上配置ftp服務，測試時可以允許所有設備均可登錄訪問
10.要求在R1上配置telnet服務，測試時可以允許所有設備均可登錄訪問管理
11.要求拒絕R5訪問R1的telnet服務，其他設備均不影響
12.要求拒絕R2訪問R4的ftp服務，其他設備均不影響
13.要求拒絕10.1.1.0/24?段ping通R1地址
14.要求拒絕10.1.1.1/24地址訪問R4地址
15.要求拒絕10.1.1.2/24地址訪問R3地址

實驗步驟

1 配置IP地址略

2.略

3.在R7上配置dhcp服務器，能夠讓pc可以獲取IP地址

[R7]dhcp enable 
[R7]dhcp server ip-pool 1
[R7-dhcp-pool-1]netbios-type
[R7-dhcp-pool-1]network 10.1.1.0 24
[R7-dhcp-pool-1]gateway-list 10.1.1.7
[R7-dhcp-pool-1]dns-list 114.114.114.114
[R7-dhcp-pool-1]expired day 1

4.將所有環回?宣告進ospf中，將環回?7宣告進rip中，將rip路由引?ospf
中，ospf路由引?rip中

在R1
R1 ospf1 在area0中宣告
R1]ospf 1 router-id 1.1.1.1
[R1-ospf-1]ar 0
[R1-ospf-1-area-0.0.0.0]network 1.1.1.1 0.0.0.0
[R1-ospf-1-area-0.0.0.0]network 10.3.3.0 0.0.0.255
[R1-ospf-1-area-0.0.0.0]network 192.168.2.0 0.0.0.255
[R1-ospf-1-area-0.0.0.0]network 192.168.1.0 0.0.0.255
[R1-ospf-1-area-0.0.0.0]%Jul 14 09:27:32:809 2025 R1 OSPF/5/OSPF_NBR_CHG: OSPF 1 Neighbor 192.168.1.2(GigabitEthernet0/0) changed from LOADING to FULL.
%Jul 14 09:29:28:811 2025 R1 OSPF/5/OSPF_NBR_CHG: OSPF 1 Neighbor 192.168.2.3(GigabitEthernet0/1) changed from LOADING to FULL.
在R2
R2 ospf1 在area0中宣告
[R2]ospf 1 router-id 2.2.2.2 
[R2-ospf-1]ar 0
[R2-ospf-1-area-0.0.0.0]network 2.2.2.2 0.0.0.0
[R2-ospf-1-area-0.0.0.0]network 192.168.1.0 0.0.0.255
[R2-ospf-1-area-0.0.0.0]network 192.168%Jul 14 09:26:28:606 2025 R2 OSPF/5/OSPF_NBR_CHG: OSPF 1 Neighbor 192.168.1.1(GigabitEthernet0/0) changed from LOADING to FULL.
[R2-ospf-1-area-0.0.0.0]network 192.168.3.0 0.0.0.255
[R2-ospf-1-area-0.0.0.0]network 100.1.1.0 0.0.0.255
[R2-ospf-1-area-0.0.0.0]%Jul 14 09:28:41:649 2025 R2 OSPF/5/OSPF_NBR_CHG: OSPF 1 Neighbor 192.168.3.3(GigabitEthernet0/1) changed from LOADING to FULL.
在R3
R3 ospf1 在area0中宣告 還有R3也在rip 也需要在rip 宣告
[R3]ospf 1 r
[R3]ospf 1 router-id 3.3.3.3
[R3-ospf-1]ar 0
[R3-ospf-1-area-0.0.0.0]network 3.3.3.3 0.0.0.0
[R3-ospf-1-area-0.0.0.0]network 192.168.2.0 0.0.0.255
[R3-ospf-1-area-0.0.0.0]n%Jul 14 09:31:00:857 2025 R3 OSPF/5/OSPF_NBR_CHG: OSPF 1 Neighbor 192.168.2.1(GigabitEthernet0/0) changed from LOADING to FULL.
[R3-ospf-1-area-0.0.0.0]net
[R3-ospf-1-area-0.0.0.0]network 192.168.3.0 0.0.0.255
[R3-ospf-1-area-0.0.0.0]%Jul 14 09:31:26:127 2025 R3 OSPF/5/OSPF_NBR_CHG: OSPF 1 Neighbor 192.168.3.2(GigabitEthernet0/1) changed from LOADING to FULL.[R3-ospf-1-area-0.0.0.0]
[R3-ospf-1-area-0.0.0.0]
[R3-ospf-1-area-0.0.0.0]qu
[R3-ospf-1]dis th
#
ospf 1 router-id 3.3.3.3area 0.0.0.0network 3.3.3.3 0.0.0.0network 192.168.2.0 0.0.0.255network 192.168.3.0 0.0.0.255
#
return
[R3-ospf-1]qu
[R3]rip 1
[R3-rip-1]undo summary
[R3-rip-1]version 2
[R3-rip-1]network 200.1.1.0
[R3-rip-1]network 200.2.2.0
在R4
R4 ospf2 在area0中宣告
[R4]ospf 2 router-id 4.4.4.4
[R4-ospf-2]area 0
[R4-ospf-2-area-0.0.0.0]net
[R4-ospf-2-area-0.0.0.0]network 4.4.4.4 0.0.0.0
[R4-ospf-2-area-0.0.0.0]net
[R4-ospf-2-area-0.0.0.0]network 100.3.3.0 0.0.0.255
[R4-ospf-2-area-0.0.0.0]net
[R4-ospf-2-area-0.0.0.0]network 172.16.3.0 0.0.0.255
[R4-ospf-2-area-0.0.0.0]network 172.16.1.0 0.0.0.255
[R4-ospf-2-area-0.0.0.0]%Jul 14 09:35:40:774 2025 R4 OSPF/5/OSPF_NBR_CHG: OSPF 2 Neighbor 172.16.1.5(GigabitEthernet0/1) changed from LOADING to FULL.
%Jul 14 09:39:36:773 2025 R4 OSPF/5/OSPF_NBR_CHG: OSPF 2 Neighbor 172.16.3.6(GigabitEthernet0/0) changed from LOADING to FULL.
在R5
R5 ospf2 在area0中宣告
[R5]ospf 2 r
[R5]ospf 2 router-id 5.5.5.5
[R5-ospf-2]area 0
[R5-ospf-2-area-0.0.0.0]net
[R5-ospf-2-area-0.0.0.0]network 5.5.5.5 0.0.0.0
[R5-ospf-2-area-0.0.0.0]net
[R5-ospf-2-area-0.0.0.0]network 172.16.1.0 0.0.0.255
[R5-ospf-2-area-0.0.0.0]net
[R5-ospf-2-area-0.0.0.0]network 172.16.2.0 0.0%Jul 14 09:35:49:190 2025 R5 OSPF/5/OSPF_NBR_CHG: OSPF 2 Neighbor 172.16.1.4(GigabitEthernet0/0) changed from LOADING to FULL.
network 172.16.1.0 0.0.0.255
[R5-ospf-2-area-0.0.0.0]network 172.16.2.0 0.0.0.255
[R5-ospf-2-area-0.0.0.0]network 100.2.2.0 0.0.0.255
在R6
R6 ospf2 在area0中宣告 還有R6也在rip 也需要在rip 宣告
[R6]ospf 2 router-id 6.6.6.6
[R6-ospf-2]ar  0
[R6-ospf-2-area-0.0.0.0]net
[R6-ospf-2-area-0.0.0.0]network 6.6.6.6 0.0.0.0
[R6-ospf-2-area-0.0.0.0]net
[R6-ospf-2-area-0.0.0.0]network 172.16.3.0 0.0.0.255
[R6-ospf-2-area-0.0.0.0]net
[R6-ospf-2-area-0.0.0.0]network 172.16.%Jul 14 09:39:39:157 2025 R6 OSPF/5/OSPF_NBR_CHG: OSPF 2 Neighbor 172.16.3.4(GigabitEthernet0/2) changed from LOADING to FULL.
network 172.16.3.0 0.0.0.255
[R6-ospf-2-area-0.0.0.0]ne
[R6-ospf-2-area-0.0.0.0]network 172.16.2.0 0.0.0.255
[R6-ospf-2-area-0.0.0.0]%Jul 14 09:40:04:693 2025 R6 OSPF/5/OSPF_NBR_CHG: OSPF 2 Neighbor 172.16.2.5(GigabitEthernet5/0) changed from LOADING to FULL.[R6-ospf-2-area-0.0.0.0]
[R6-ospf-2-area-0.0.0.0]di th
#area 0.0.0.0network 6.6.6.6 0.0.0.0network 172.16.2.0 0.0.0.255network 172.16.3.0 0.0.0.255
#
return
[R6-ospf-2-area-0.0.0.0]qu
[R6-ospf-2]qu
[R6]rip 1
[R6-rip-1]undo summary
[R6-rip-1]version 2
[R6-rip-1]network 200.1.1.0 
[R6-rip-1]network 200.3.3.0
[R6-rip-1]
在R7
R7 ospf1 ospf2 在area0中宣告 還有R7也在rip 也需要在rip 宣告
[R7]ospf 1
[R7-ospf-1]ar 0
[R7-ospf-1-area-0.0.0.0]net
[R7-ospf-1-area-0.0.0.0]network 100.1.1.0 0.0.0.255
[R7-ospf-1-area-0.0.0.0]qu
[R7-ospf-1]qu
[R7]ospf 2
[R7-ospf-2]%Jul 14 11:04:23:832 2025 R7 OSPF/5/OSPF_NBR_CHG: OSPF 1 Neighbor 100.1.1.2(GigabitEthernet0/2) changed from LOADING to FULL.[R7-ospf-2]ar 0
[R7-ospf-2-area-0.0.0.0]net
[R7-ospf-2-area-0.0.0.0]network 100.2.2.0 0.0.0.255
[R7-ospf-2-area-0.0.0.0]qu
[R7-ospf-2]qu
[R7]%Jul 14 11:04:54:628 2025 R7 OSPF/5/OSPF_NBR_CHG: OSPF 2 Neighbor 100.2.2.5(GigabitEthernet5/0) changed from LOADING to FULL.
[R7]rip 1
[R7-rip-1]undo summary
[R7-rip-1]version 
[R7-rip-1]network 7.7.7.7
[R7-rip-1]network 200.2.2.0
[R7-rip-1]network 200.3.3.0

5.要求實現全?互通

分析要實現全網互通需要R3 6 7相互引路

在R3
[R3-rip-1]import-route ospf 1
[R3-ospf-1]import-route rip 1
在R6
[R6-ospf-2]import-route rip 1
[R6-rip-1]import-route ospf 2
在R7
[R7-rip-1]import-route ospf 1
[R7-rip-1]import-route ospf 2
[R7-rip-1]qu
[R7]ospf 1
[R7-ospf-1]import-route rip 1
[R7-ospf-1]qu
[R7]ospf 2
[R7-ospf-2]import-route rip 1
[R7-ospf-2]qu

6.在r3和r6上開啟rip的端?驗證，密碼為hyzy

在R3
[R3]int g5/0
[R3-GigabitEthernet5/0]rip authentication-mode simple plain hyzy
在R6
[R6]int g0/1
[R6-GigabitEthernet0/1]rip authentication-mode simple plain hyzy

7.在R7上開啟rip靜默接?，要求業務?段不允許接收協議報?

[R7]rip 1
[R7-rip-1]silent-interface g5/1

8.在R5和R4上開啟ospf端?驗證，密碼為hyzy

在R5
[R5]int g0/0
[R5-GigabitEthernet0/0]ospf authentication-mode simple plain hyzy
[R5-GigabitEthernet0/0]%Jul 14 11:28:16:526 2025 R5 OSPF/5/OSPF_NBR_CHG: OSPF 2 Neighbor 172.16.1.4(GigabitEthernet0/0) changed from FULL to DOWN.
%Jul 14 11:29:46:220 2025 R5 OSPF/5/OSPF_NBR_CHG: OSPF 2 Neighbor 172.16.1.4(GigabitEthernet0/0) changed from LOADING to FULL.
在R4
[R4]int g0/1[R4-GigabitEthernet0/1]ospf authentication-mode simple plain hyzy
[R4-GigabitEthernet0/1]%Jul 14 11:29:10:770 2025 R4 OSPF/5/OSPF_NBR_CHG: OSPF 2 Neighbor 172.16.1.5(GigabitEthernet0/1) changed from LOADING to FULL

9.要求在R4上配置ftp服務，測試時可以允許所有設備均可登錄訪問

[R4]ftp server enable 
[R4]local-user ssz class manage 
New local user added.
[R4-luser-manage-ssz]password simple 123456.com
[R4-luser-manage-ssz]service-type ftp
[R4-luser-manage-ssz]authorization-attribute user-role level-15

10.要求在R1上配置telnet服務，測試時可以允許所有設備均可登錄訪問管理

[R1]telnet server enable 
[R1]local-user ssz class manage 
[R1-luser-manage-ssz]password simple 123456.com
[R1-luser-manage-ssz]service-type telnet
[R1-luser-manage-ssz]authorization-attribute user-role level-15
[R1]user-interface vty 0 4
[R1-line-vty0-4]authentication-mode scheme
[R1-line-vty0-4]user-role level-15

11.要求拒絕R5訪問R1的telnet服務，其他設備均不影響

分析：R5拒絕R1的telnet服務的訪問

在R1
[R1]acl advanced 3000
[R1-acl-ipv4-adv-3000]rule deny tcp source 172.16.1.5 0 destination-port eq teln
et
[R1-acl-ipv4-adv-3000]rule deny tcp source 172.16.2.5 0 destination-port eq teln
et
[R1-acl-ipv4-adv-3000]rule deny tcp source 100.2.2.5 0 destination-port eq teln
et
[R1-acl-ipv4-adv-3000]rule deny tcp source 5.5.5.5 0 destination-port eq telnet
[R1]interface range g0/0 to g0/2
[R1-if-range]packet-filter 3000 inbound
<R5>telnet 1.1.1.1
Trying 1.1.1.1 ...
Press CTRL+K to abort
Connected to 1.1.1.1 ...
Failed to connect to the remote host!

12.要求拒絕R2訪問R4的ftp服務，其他設備均不影響

在R4
[R4]acl advanced 3000
[R4-acl-ipv4-adv-3000]rule deny tcp source 100.1.1.2 0 destination-port eq ftp
[R4-acl-ipv4-adv-3000]rule deny tcp source 192.168.3.2 0 destination-port eq ftp[R4-acl-ipv4-adv-3000]rule deny tcp source 192.168.1.2 0 destination-port eq ftp[R4-acl-ipv4-adv-3000]rule deny tcp source 2.2.2.2 0 destination-port eq ftp
[R4]interface range g0/0 to g0/2
[R4-if-range]packet-filter 3000 inbound 
<R2>ftp 4.4.4.4
Press CTRL+C to abort.

13.要求拒絕10.1.1.0/24?段ping通R1地址

在R7
[R7]acl advanced 3000
[R7-acl-ipv4-adv-3000]rule deny icmp source 10.1.1.0 0.0.0.255 destination 1.1.1
.1 0
[R7-acl-ipv4-adv-3000]rule deny icmp source 10.1.1.0 0.0.0.255 destination 100.3
.3.1 0
[R7-acl-ipv4-adv-3000]rule deny icmp source 10.1.1.0 0.0.0.255 destination 172.1
68.3.1 0
[R7-acl-ipv4-adv-3000]rule deny icmp source 10.1.1.0 0.0.0.255 d
[R7-acl-ipv4-adv-3000]rule deny icmp source 10.1.1.0 0.0.0.255 destination 172.1
68.1.1 0
[R7]int g5/1
[R7-GigabitEthernet5/1]packet-filter 3000 inbound 
在PC9上
<H3C>ping 1.1.1.1
Ping 1.1.1.1 (1.1.1.1): 56 data bytes, press CTRL_C to break
Request time out
Request time out
Request time out
Request time out
Request time out--- Ping statistics for 1.1.1.1 ---
5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss
<H3C>%Jul 14 14:46:25:861 2025 H3C PING/6/PING_STATISTICS: Ping statistics for 1.1.1.1: 5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss.<H3C>ping 100.3.3.1
Ping 100.3.3.1 (100.3.3.1): 56 data bytes, press CTRL_C to break
Request time out
Request time out
Request time out
Request time out
Request time out--- Ping statistics for 100.3.3.1 ---
5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss
<H3C>%Jul 14 14:46:43:980 2025 H3C PING/6/PING_STATISTICS: Ping statistics for 100.3.3.1: 5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss.<H3C>ping 192.168.1.1
Ping 192.168.1.1 (192.168.1.1): 56 data bytes, press CTRL_C to break
Request time out
Request time out
Request time out
Request time out
Request time out--- Ping statistics for 192.168.1.1 ---
5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss
<H3C>%Jul 14 14:47:00:810 2025 H3C PING/6/PING_STATISTICS: Ping statistics for 192.168.1.1: 5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss.<H3C>ping 192.168.2.1
Ping 192.168.2.1 (192.168.2.1): 56 data bytes, press CTRL_C to break
Request time out
Request time out
Request time out
Request time out
Request time out--- Ping statistics for 192.168.2.1 ---
5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss
<H3C>%Jul 14 14:47:15:232 2025 H3C PING/6/PING_STATISTICS: Ping statistics for 192.168.2.1: 5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss.但R1能ping通PC9
<H3C>ping 10.1.1.2
Ping 10.1.1.2 (10.1.1.2): 56 data bytes, press CTRL+C to break
56 bytes from 10.1.1.2: icmp_seq=0 ttl=252 time=3.080 ms
56 bytes from 10.1.1.2: icmp_seq=1 ttl=252 time=2.399 ms
56 bytes from 10.1.1.2: icmp_seq=2 ttl=252 time=2.930 ms
56 bytes from 10.1.1.2: icmp_seq=3 ttl=252 time=2.656 ms
56 bytes from 10.1.1.2: icmp_seq=4 ttl=252 time=2.184 ms--- Ping statistics for 10.1.1.2 ---
5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss
round-trip min/avg/max/std-dev = 2.184/2.650/3.080/0.330 ms
<R1>%Jul 14 15:23:37:341 2025 R1 PING/6/PING_STATISTICS: Ping statistics for 10.1.1.2: 5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss, round-trip min/avg/max/std-dev = 2.184/2.650/3.080/0.330 ms.

14.要求拒絕10.1.1.1/24地址訪問R4地址

[R7-acl-ipv4-adv-3000]rule deny icmp source 10.1.1.1 0 destination 4.4.4.4 0
[R7-acl-ipv4-adv-3000]rule deny icmp source 10.1.1.1 0 destination 172.16.1.4 0
[R7-acl-ipv4-adv-3000]rule deny icmp source 10.1.1.1 0 destination 172.16.3.4 0
[R7-acl-ipv4-adv-3000]rule deny icmp source 10.1.1.1 0 destination 100.3.3.4 0
<H3C>ping 4.4.4.4
Ping 4.4.4.4 (4.4.4.4): 56 data bytes, press CTRL_C to break
Request time out
Request time out
Request time out
Request time out
Request time out--- Ping statistics for 4.4.4.4 ---
5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss
<H3C>%Jul 14 15:48:57:588 2025 H3C PING/6/PING_STATISTICS: Ping statistics for 4.4.4.4: 5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss.

15.要求拒絕10.1.1.2/24地址訪問R3地址

[R7-acl-ipv4-adv-3000]rule deny icmp source 10.1.1.2 0 destination 3.3.3.3 0
[R7-acl-ipv4-adv-3000]rule deny icmp source 10.1.1.2 0 destination 192.168.2.3 0[R7-acl-ipv4-adv-3000]rule deny icmp source 10.1.1.2 0 destination 192.168.3.3 0[R7-acl-ipv4-adv-3000]rule deny icmp source 10.1.1.2 0 destination 200.1.1.3 0
[R7-acl-ipv4-adv-3000]rule deny icmp source 10.1.1.2 0 destination 200.2.2.3 0
Ping 3.3.3.3 (3.3.3.3): 56 data bytes, press CTRL_C to break
Request time out
Request time out
Request time out
Request time out
Request time out--- Ping statistics for 3.3.3.3 ---
5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss
<H3C>%Jul 14 18:03:04:959 2025 H3C PING/6/PING_STATISTICS: Ping statistics for 3.3.3.3: 5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss.