【文章內(nèi)容簡介】 if)exitR2(config)int e0/R2(configsubif)standby 2 preemptR2(configsubif)standby 2 ip SW1(config)int vlan 2SW1(configif)standby 1 preempt SW1(configif)standby 1 ip SW1(configif)exitSW1(config)int vlan 3SW1(configif)standby 2 preempt SW1(configif)standby 2 ip SW1(configif)standby 2 priority 200SW1(configif)standby 2 track f0/1 120SW1(configif)exit配置完成后檢查狀態(tài)是否正常R2sh standby brief P indicates configured to preempt. |Interface Grp Prio P State Active Standby Virtual IP Et0/ 1 200 P Active local Et0/ 2 100 P Standby local SW1sh standby brief P indicates configured to preempt. |Interface Grp Prio P State Active Standby Virtual IP Vl2 1 100 P Standby local Vl3 2 200 P Active local 6：SW2 和SW3 之間的鏈路做冗余備份并且保證負載均衡SW2(config)spanningtree vlan 2 root primary SW2(config)spanningtree vlan 3 root secondary SW3(config)spanningtree vlan 2 root secondary SW3(config)spanningtree vlan 3 root primary7：SW2,SW3上做DHCP SNOOPING 和DAISW2Ip dhcp snoopingIp dhcp snooping database weriterelay 15Ip dhcp snooping database flash:/Ip dhcp snooping vlan 2Ip dhcp snooping vlan 3Int r f0/1 4Ip dhcp snooping trust 所有trunk配置為trust，允許轉(zhuǎn)發(fā)DHCP 的請求和回復Int r f0/12 13Ip dhcp snooping limit rate 5 對access接口做DHCP 請求的限速，防止DHCP 的DDOS攻擊由于內(nèi)部WEB服務器使用的是靜態(tài)IP，所以需要ARP ACL來放行服務器的流量Arp accesslist arp_acl permit ip mac Ip arp inspection filter arp_acl vlan 2Ip arp inspection vlan 2Ip arp inspection vlan 3Int r f0/1 4Ip arp inspection trust 所有trunk配置為trustSW3Ip dhcp snoopingIp dhcp snooping database weriterelay 15Ip dhcp snooping database flash:/Ip dhcp snooping vlan 2Ip dhcp snooping vlan 3Int r f0/3 4Ip dhcp snooping trust 所有trunk配置為trust，允許轉(zhuǎn)發(fā)DHCP 的請求和回復Int r f0/12 13Ip dhcp snooping limit rate 5 Ip arp inspection vlan 2Ip arp inspection vlan 3Int r f0/1 4Ip arp inspection trust 8: R4 配置為PPPOE的server，外部移動辦公人員使用PPPOE撥號上網(wǎng)R4(config)vpdn enable R4(config)vpdngroup ADSLR4(configvpdn)acceptdialin R4(configvpdnaccin)protocol pppoe R4(configvpdnaccin)exiR4(configvpdn)bbagroup pppoe globalR4(configbbagroup)virtualtemplate 1R4(configbbagroup)exitR4(config)int virtualtemplate 1R4(configif) ip unnumbered e0/3R4(configif)encapsulation pppR4(configif)ppp authentication pap R4(configif)peer default ip address pool poolR4(configif)exitR4(config)ip local pool pool R4(config)username cisco password ciscoR4(config)int e0/3R4(configif)pppoe enable R4(configif)exit配置完成以后在PC上測試是否能夠正常撥號PPPOE添加新的網(wǎng)絡連接點擊連接已經(jīng)成功撥號了。9：R1配置為EZVPN serverR1(config)aaa newmodel R1(config)aaa authentication login nocon none R1(config)line console 0R1(configline)login authentication noconR1(configline)exitR1(config)aaa authentication login ezvon localR1(config)aaa authorization network ezvpn local R1(config)username cisco password ciscoR1(config)crypto isakmp policy 10R1(configisakmp)authentication preshare R1(configisakmp)encryption 3des R1(configisakmp)hash sha R1(configisakmp)group 2R1(configisakmp)exitR1(config)crypto isakmp client configuration group ezvpngroupR1(configisakmpgroup)acl 101 定義分離隧道R1(configisakmpgroup)key cisco123R1(configisakmpgroup)pool poolR1(configisakmpgroup)exitR1(config)accesslist 101 permit ip anyR1(config)accesslist 101 permit ip any 到總部內(nèi)網(wǎng)的流量走VPN，其他流量正常走internetR1(config)ip local pool pool R1(config)crypto ipsec transformset myset esp3des espshahmac R1(cfgcryptotrans)exitR1(config)crypto dynamicmap dmap 10R1(configcryptomap)set transformset mysetR1(c