網(wǎng)絡(luò)安全技術(shù)與應(yīng)用實(shí)訓(xùn)報(bào)告.doc

網(wǎng)絡(luò)安全技術(shù)與應(yīng)用綜合實(shí)訓(xùn)報(bào)告題 目： 幀中繼網(wǎng)絡(luò)設(shè)計(jì)專 業(yè)： 計(jì)算機(jī)網(wǎng)絡(luò)學(xué)生姓名： 學(xué) 號： 指導(dǎo)教師： 時 間：2014年11月23日 目錄1前言.32總體設(shè)計(jì)（拓?fù)鋱D）.33網(wǎng)絡(luò)設(shè)計(jì). .33.1 ACL配置.33.2 Frame-relay 配置.43.3 GRE隧道配置.84 實(shí)驗(yàn)測試.115 實(shí)訓(xùn)總結(jié).121 前言 幀中繼（FrameRelay，F(xiàn)R）是現(xiàn)在廣域網(wǎng)的主干網(wǎng)最流行的連網(wǎng)協(xié)議，是一個面向連接的第二層傳輸協(xié)議，幀中繼是典型的包交換技術(shù)。幀中繼技術(shù)以X.25分組交換技術(shù)為基礎(chǔ)改造了原有的幀結(jié)構(gòu)，繼承了X.25提供的統(tǒng)計(jì)復(fù)用功能和采用虛電路交換的優(yōu)點(diǎn)，簡化了可靠傳輸和差錯控制機(jī)制，把流量控制和差錯控制任務(wù)委托給了本地機(jī)完成，減少了網(wǎng)絡(luò)時延，降低了通信成本，從而獲得了良好的性能。幀中繼中的虛電路是幀中繼包交換網(wǎng)絡(luò)為實(shí)現(xiàn)不同DTE之間的數(shù)據(jù)傳輸所建立的邏輯鏈路，這種虛電路可以在幀中繼交換網(wǎng)絡(luò)內(nèi)跨越任意多個DCE設(shè)備或幀中繼交換機(jī)。2 總體設(shè)計(jì)3、網(wǎng)絡(luò)設(shè)計(jì)3.1 ACL配置禁止Server0與內(nèi)部通信：R6enableR6#configure terminalR6(config)#access-list 1 deny host 192.168.2.10R6(config)#interface fastEthernet 0/1R6(config-if)#ip access-group 1 in3.2Frame-relay 配置R3：Routeren Router#conf terEnter configuration commands, one per line. End with CNTL/Z.Router(config)#hostname R3 R3(config)#int fa0/0 R3(config-if)#ip address 172.18.1.30 255.255.255.0R3(config-if)#no shut %LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to upR3(config-if)#int serial 0/0/0R3(config-if)#encapsulation frame-relayR3(config-if)#no shut%LINK-5-CHANGED: Interface Serial0/0/0, changed state to upR3(config-if)#%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0/0, changed state to upR3(config-if)#interface serial0/0/0.1 point-to-point %LINK-5-CHANGED: Interface Serial0/0/0.1, changed state to up%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0/0.1, changed state to upR3(config-subif)#ip address 192.16.1.1 255.255.255.0 R3(config-subif)#description Link Router6 DLCI 603R3(config-subif)#frame-relay interface-dlci 306 R3(config-subif)#interface serial0/0/0.2 point-to-point%LINK-5-CHANGED: Interface Serial0/0/0.2, changed state to up%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0/0.2, changed state to upR3(config-subif)#ip address 192.16.3.2 255.255.255.0R3(config-subif)#description link to Router9 DLCI 903R3(config-subif)#frame-relay interface-dlci 309R3(config-subif)#end%SYS-5-CONFIG_I: Configured from console by consoleR3#conf terEnter configuration commands, one per line. End with CNTL/Z.R3(config)#router eigrp 100 R3(config-router)#network 172.18.1.0R3(config-router)#network 192.16.1.0R3(config-router)#network 192.168.3.0R3(config-router)#endR6：Routeren Router#conf terEnter configuration commands, one per line. End with CNTL/Z.Router(config)#hostname R6 R6(config)#int fa0/0 R6(config-if)#ip address 172.16.1.1 255.255.255.0R6(config-if)#no shutR6(config)#int s0/0/1 R6(config-if)#ip address 10.0.2.1 255.255.255.0R6(config-if)#no shut %LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to upR6(config-if)#int serial 0/0/0R6(config-if)#encapsulation frame-relayR6(config-if)#no shut%LINK-5-CHANGED: Interface Serial0/0/0, changed state to upR6(config-if)#%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0/0, changed state to upR6(config-if)#interface serial0/0/0.1 point-to-point %LINK-5-CHANGED: Interface Serial0/0/0.1, changed state to up%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0/0.1, changed state to upR6(config-subif)#ip address 192.16.1.2 255.255.255.0 R6(config-subif)#description Link Router6 DLCI 306R6(config-subif)#frame-relay interface-dlci 603 R6(config-subif)#interface serial0/0/0.2 point-to-point%LINK-5-CHANGED: Interface Serial0/0/0.2, changed state to up%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0/0.2, changed state to upR6(config-subif)#ip address 192.16.2.1 255.255.255.0R6(config-subif)#description link to Router9 DLCI 906R6(config-subif)#frame-relay interface-dlci 609R6(config-subif)#end%SYS-5-CONFIG_I: Configured from console by consoleR6#conf terEnter configuration commands, one per line. End with CNTL/Z.R6(config)#router eigrp 100 R6(config-router)#network 172.16.1.0R6(config-router)#network 192.16.1.0R6(config-router)#network 10.0.2.0R6(config-router)#network 192.168.2.0R6(config-router)#endR9：Routeren Router#conf terEnter configuration commands, one per line. End with CNTL/Z.Router(config)#hostname R9 R9(config)#int fa0/0 R9(config-if)#ip address 172.17.1.1 255.255.255.0R9(config-if)#no shutR9(config)#int fa0/1 R9(config-if)#ip address 192.168.1.1 255.255.255.0R9(config-if)#no shut %LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to upR9(config-if)#int serial 0/0/0R9(config-if)#encapsulation frame-relayR9(config-if)#no shut%LINK-5-CHANGED: Interface Serial0/0/0, changed state to upR9(config-if)#%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0/0, changed state to upR9(config-if)#interface serial0/0/0.1 point-to-point %LINK-5-CHANGED: Interface Serial0/0/0.1, changed state to up%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0/0.1, changed state to upR9(config-subif)#ip address 192.16.2.2 255.255.255.0 R9(config-subif)#description Link Router6 DLCI 609R9(config-subif)#frame-relay interface-dlci 906 R9(config-subif)#interface serial0/0/0.2 point-to-point%LINK-5-CHANGED: Interface Serial0/0/0.2, changed state to up%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0/0.2, changed state to upR9(config-subif)#ip address 192.16.3.1 255.255.255.0R9(config-subif)#description link to Router9 DLCI 309R9(config-subif)#frame-relay interface-dlci 903R9(config-subif)#end%SYS-5-CONFIG_I: Configured from console by consoleR9#conf terEnter configuration commands, one per line. End with CNTL/Z.R9(config)#router eigrp 100 R9(config-router)#network 172.17.1.0R9(config-router)#network 192.16.2.0R9(config-router)#network 192.16.3.0R9(config-router)#network 192.168.1.0R9(config-router)#end幀中繼配置：3.3 GRE隧道配置1、配置各臺路由器的IP地址，并且使用Ping命令確認(rèn)各路由器的直連口的互通。2、 在R9和R4上配置靜態(tài)路由。確保Internet網(wǎng)絡(luò)骨干可以相互通信。3、Router6(config)#ip route 0.0.0.0 0.0.0.0 192.168.50.2Router8(config)#ip route 0.0.0.0 0.0.0.0 192.168.60.1在Router9與Router4上配置靜態(tài)默認(rèn)路由，不僅僅是用于模擬接入路由器。同時還為了確保在創(chuàng)建隧道時，隧道源與隧道目標(biāo)的IP地址相互可見。以便于實(shí)現(xiàn)隧道。3、在Route9路由器上配置GRE隧道。Router(config)#interface tunnel 0啟用GRE隧道。Router(config-if)#ip address 10.1.1.1 255.255.255.0為隧道指定IP地址。Router(config-if)#tunnel source serial 1/1配置隧道的本地源端口。Router1(config-if)#tunnel destination 配置隧道的目標(biāo)出口。目的端口的IP地址可達(dá)性，是通過本地配置的默認(rèn)路由保證的。192.168.60.2Router(config-if)#exitRouter(config)#4、在Router4路由器上配置GRE隧道。Router(config)#interface tunnel 0Router(config-if)#ip address 10.1.1.2 255.255.255.0Router(config-if)#tunnel source serial 1/0Router(config-if)#tunnel destination 192.168.50.1Router(config-if)#exitRouter(config)#exit5、在Router9上查看隧道接口信息。6、查看Router9的路由表。7、 在Router9上PING路由器Router4的隧道接口。8、 在Router9和Router4分