【正文】 c]rule permit ip source destination [R2acladv3001IPSec]rule permit ip source destination [R2acladv3001IPSec]rule permit ip source destination [R2acladv3001IPSec]rule deny ip [R2acladv3001IPSec]quit[R2] 步驟四：配置到達(dá)企業(yè)分支的IPSec通道創(chuàng)建IKE對等體，對等體名稱為to_main，共享密鑰為tosub并按要求配置對端ip[R2]ike peer to_main [R2ikepeerto_sub]presharedkey tosub [R2ikepeerto_sub]remoteaddress [R2ikepeerto_sub]quit創(chuàng)建安全提議to_sub,驗證算法為sha1[R2]ipsec proposal to_main[R2ipsecproposalto_sub]esp authenticationalgorithm sha1[R2ipsecproposalto_sub]quit[R2]創(chuàng)建安全策略to_main[R2]ipsec policy to_main 1 isakmp[R2ipsecpolicyisakmpto_sub1]security acl 3001[R2ipsecpolicyisakmpto_sub1]ikepeer to_main[R2ipsecpolicyisakmpto_sub1]proposal to_main[R2ipsecpolicyisakmpto_sub1]quit[R2]步驟五：配置G0/1端口，需要按要求配置IP地址，nat以及ipsec通道的穿越。G0/1為外網(wǎng)端口，按要求設(shè)置ip地址[R2]interface GigabitEthernet0/1[R2GigabitEthernet0/0]ip address 設(shè)置該端口為acl3000的內(nèi)網(wǎng)地址轉(zhuǎn)換[R2GigabitEthernet0/1]nat outbound 3000配置ipsec穿越[R2GigabitEthernet0/1]ipsec nonatprocess enable[R2GigabitEthernet0/1]ipsec policy to_main[R2GigabitEthernet0/1]quit[R2]步驟六：配置內(nèi)網(wǎng)口G0/0G0/1為內(nèi)網(wǎng)端口，按要求配置IP地址[R2]interface GigabitEthernet0/0[R2GigabitEthernet0/0]ip address [R2GigabitEthernet0/0]quit[R2]步驟七：配置IP電話綁定ip語音使用內(nèi)網(wǎng)接口IP地址（語音數(shù)據(jù)也能使用ipsec通道加密）[R2]voicesetup[R2voice]sip [R2voicesip]sourcebind signal ipv4 [R2voicesip]quit配置語音實體（本地）[R2voice]dialprogram[R2voicedial]entity 9pots[R2voicedialentity9]line 1/0[R2voicedialentity9] matchtemplate 91234567[R2voicedialentity9] quit配置語音實體（分支）[R2voicedial]entity 8 voip[R2voicedialentity8]matchtemplate 81234567[R2voicedialentity8]address sip ip [R2voicedialentity8]quit[R2voicedial]quit[R2voice]quit[R2]步驟八：配置默認(rèn)路由[R2]ip routestatic 步驟九：配置并啟動dhcp服務(wù)器啟動dhcp服務(wù)[R2]dhcp enable為局域網(wǎng)配置dhcp服務(wù)選項（包括網(wǎng)絡(luò)地址，子網(wǎng)掩碼，默認(rèn)網(wǎng)關(guān)，dns）[R2]dhcp server ippool lan extended [R2dhcppoollan]network ip range [R2dhcppoollan]network mask [R2dhcppoollan]gatewaylist [R2dhcppoollan]dnslist [R2dhcppoollan]quit[R2]任務(wù)六：配置模仿互聯(lián)網(wǎng)ISP路由器R3按要求，本路由器為模擬ISP的功能，只做基本連通性配置（即個端口IP地址配置即可）步驟一：建立物理連接并初始化交換機(jī)配置 確保軟件版本符合要求，所有配置為初始狀態(tài)。如果配置不符合要求，請學(xué)生在用戶視圖下擦除設(shè)備中的配置文件，然后重新啟動設(shè)備以使系統(tǒng)采用缺省的配置參數(shù)進(jìn)行初始化。將路由器系統(tǒng)名稱設(shè)置為R3MSRsystemview[MSR]sysname R3[R3]按要求對各個接口進(jìn)行IP地址的配置[R3]interface GigabitEthernet0/0[R3GigabitEthernet0/0] ip address [R3GigabitEthernet0/0] interface GigabitEthernet0/1[R3GigabitEthernet0/1]ip address [R3GigabitEthernet0/1]interface Ethernet1/0[R3Ethernet1/0] ip address [R3Ethernet1/0]quit[R3]任務(wù)七：配置無線交換機(jī)AC無線交換機(jī)分為有線和無線兩部分配置，有線部分主要對連接S1交換機(jī)的E1/0/1端口進(jìn)行trunk端口配置，以及與無線部分連接的虛擬端口E1/0/9端口的配置；無線部分按要求配置無線ap和無線業(yè)務(wù)的兩個dhcp服務(wù)器、各瘦ap的注冊信息，無線信息等配置。步驟一：建立物理連接并初始化交換機(jī)配置 確保軟件版本符合要求，所有配置為初始狀態(tài)。如果配置不符合要求，請學(xué)生在用戶視圖下擦除設(shè)備中的配置文件，然后重新啟動設(shè)備以使系統(tǒng)采用缺省的配置參數(shù)進(jìn)行初始化。將無線交換機(jī)的系統(tǒng)名稱設(shè)置為ACH3Csystemview[H3C]sysname AC[AC]步驟二：為瘦ap及無線業(yè)務(wù)創(chuàng)建vlan8和9[AC]vlan 8 to 9步驟三：為ap和無線業(yè)務(wù)創(chuàng)建dhcp服務(wù)器并啟動dhcp服務(wù)創(chuàng)建瘦ap的dhcp地址池[AC]dhcp server ippool ap[ACdhcppoolap]network mask [ACdhcppoolap]gatewaylist [ACdhcppoolap]quit[AC]創(chuàng)建無線業(yè)務(wù)的dhcp地址池[AC]dhcp server ippool wlan[ACdhcppoolwlan]network mask [ACdhcppoolwlan]gatewaylist [ACdhcppoolwlan]dnslist [ACdhcppoolwlan]quit[AC]啟動dhcp服務(wù)[AC]dhcp enable[AC]步驟四：創(chuàng)建無線服務(wù)模板模版號1，ssid為XXSXAP1（XX為學(xué)號），加密方式為wep40，wep密鑰為0123456789，并使能模版。[AC]wlan servicetemplate 1 crypto[ACwlanst1]ssid xxsxap1[ACwlanst1]bind WLANESS 0[ACwlanst1] authenticationmethod sharedkey[ACwlanst1] ciphersuite wep40[ACwlanst1]wep defaultkey 1 wep40 rawkey simple 0123456789[ACwlanst1] servicetemplate enable[ACwlanst1]quit[AC]步驟五：為ap和無線客戶的dhcp服務(wù)器分配ip地址，也就是給vlan8和vlan9的vlan端口分配ip地址按要求對vlan8端口分配地址[AC]interface Vlaninterface8[ACVlaninterface8]ip address 按要求對vlan9端口分配地址[ACVlaninterface8]interface Vlaninterface9[ACVlaninterface9]ip address [ACVlaninterface9]quit[AC]步驟六：配置連接有線部分的虛擬端口（G1/0/1）將連接有線部分的虛擬端口（G1/0/1）配置為trunk接口，并允許全部vlan通過[AC]interface GigabitEthernet1/0/1[ACGigabitEthernet1/0/1]port linktype trunk[ACGigabitEthernet1/0/1]port trunk permit vlan all[ACGigabitEthernet1/0/1]quit[AC]步驟七：創(chuàng)建WLANBSS創(chuàng)建WLANBSS0，并將該接口加入到vlan9[AC]interface WLANESS0[ACWLANBSS0]port access vlan 9[ACWLANBSS0]quit[AC]步驟八：將瘦ap注冊信息登記，為其分配模板1，使能無線注冊ap型號[AC]wlan ap ap1 model WA2612AGN id 1注冊ap序列號[ACwlanapap1]serialid 210235A0ALC119002621分配無線模版并使能無線[ACwlanapap1]radio 1 [ACwlanapap1radio] radio enable[ACwlanapap1radio]quit[ACwlanapap1]quit[AC]步驟9：配置默認(rèn)網(wǎng)關(guān)[AC]ip routestatic [AC]任務(wù)八：配置胖AP AP2步驟一：建立物理連接并初始化交換機(jī)配置 確保軟件版本符合要求，所有配置為初始狀態(tài)。如果配置不符合要求，請學(xué)生在用戶視圖下擦除設(shè)備中的配置文件，然后重新啟動設(shè)備以使系統(tǒng)采用缺省的配置參數(shù)進(jìn)行初始化。將ap統(tǒng)名稱設(shè)置為AP2H3Csystemview[H3C]sysname AP2[AP2]步驟二：創(chuàng)建服務(wù)模板模版號3，ssid為XXSXAP2（XX為學(xué)號），加密方式為wep40，wep密鑰為0123456789，并使能模版。[AP2]wlan servicetemplate 3 clear[AP2wlanst3]ssid xxsxap2[AP2wlanst3]ciphersuite wep40[AP2wlanst3]wep defaultkey 1 wep40 rawkey simple 0123456789[AP2wlanst3]servicetemplate enable[AP2wlanst3]quit[AP2]步驟三：創(chuàng)建WLANBSS按要求為wlanbss0接口[AP2]interface WLANBSS0[AP2WLANBSS0]quit[AP2]步驟四：進(jìn)入WLANRadio1/0/1接口關(guān)聯(lián)模版與wlanbss0[AP2]interface WLANRadio1/0/1[AP2WLANRadio1/0/1]servicetemplate 3 interface wlanbss 0[AP2WLANRadio1/0/1]quit[AP2]任務(wù)九：使用WEB界面配置防火墻UTM防火墻的配置重點為區(qū)域的劃分及域間訪問策略步驟一：按表22的要求將防火墻的各個端口分別加入適當(dāng)?shù)膮^(qū)域。步驟二：對各端口設(shè)置IP地址步驟三：設(shè)置默認(rèn)路由指向路由器R1的G0/1端口（）步驟四：設(shè)置各網(wǎng)段的回頭路由指向核心交換機(jī)的VLAN3端口地址（）步驟五：按110要求配置域間策略注：防火墻的配置提交以截圖文檔方式提交， 將設(shè)置接口處于不同的信任區(qū)域的完成界面、路由配置信息界面、定義域間訪問規(guī)則的完成界面截屏并命名保存到“”文檔中并打印。