【正文】 室使用 VLAN 10，秘書部使用 VLAN 11，財務部使用 VLAN 12，企劃部使用 VLAN 13，技術(shù)部使用 VLAN 14，人事部使用VLAN 15，科研部使用 VLAN 16，營銷部使用 VLAN 17。 IP 地址的分配（1 ）本方案為一期工程，為了便于擴展，所以使用 C 類 IP ，每個 VLAN 分配一個 的網(wǎng)段。（2 ）為了便于管理，IP 地址按 VLAN 劃分的順序分配使用，每個 VLAN 中有一定的預留，以備今后擴充網(wǎng)絡使用。IP 地址劃分表序號 VLAN ID 網(wǎng)段 IP 地址段范圍 子網(wǎng)掩碼 三層接口地址（留作備用）1 VLAN 10 ~ 2 VLAN 11 ~ 3 VLAN 12 ~ 4 VLAN 13 ~ 5 VLAN 14 ~ 6 VLAN 15 ~ 7 VLAN 16 ~ 8 VLAN 17 ~ 設備配置用戶總經(jīng)理辦公室：vlan10(1)IP 地址：： 掩碼：秘書部：vlan11(15)IP 地址：： 掩碼：財務部：vlan12(15)IP 地址：： 掩碼：營銷部：vlan13(15)IP 地址：： 掩碼：企劃部：vlan14(15)IP 地址：： 掩碼：技術(shù)部：vlan15(15)IP 地址：： 掩碼：人事部：vlan16(15)IP 地址：： 掩碼：科研部：vlan17(15)IP 地址：： 掩碼：路由R02 配置：GRE VPN 配置：H3Csys[H3C]sysname R02[R02]int e0/0[R02ether0/0]ip add [R02ether0/0]qui[R02]int s0/0[R02S0/0]linkprotocol ppp[R02S0/0]ip add [R02S0/0]qui[R02]int tunnel0[R02Tunnel0]linkprotocol tunnel[R01Tunnel0]ip add [R01Tunnel0]source [R01Tunnel0]destination [R01Tunnel0]qui[R01]ip routestatic serial 0/0 preference 60[R01]ip routestatic tunnel 0 preference 60其它類似總公司略；R01 配置：GRE VPN 配置：H3Csys[H3C]sysname R01[R01]int e0/0[R01ether0/0]ip add [R01ether0/0]qui[R01]int s0/0[R01S0/0]linkprotocol ppp[R01S0/0]ip add [R01S0/0]qui[R01]int tunnel0[R01Tunnel0]linkprotocol tunnel[R01Tunnel0]ip add [R01Tunnel0]source [R01Tunnel0]destination [R01Tunnel0]qui[R01]ip routestatic serial 0/0 preference 60[R01]ip routestatic tunnel 0 preference 60[R01]ip route [R01]ip route 配置 NAT 轉(zhuǎn)換[R01]nat addressgroup pool1[R01]acl 2022[R01acl2022]rule permit source [R01acl2022]rule deny source any[R01acl2022]qui[R01]int s0/0[R01serial0/0]nat outbound 2022 addressgroup pool1[R01serial0/0]nat server global inside tcp[R01serial0/0]nat server global inside smtp udp[R01serial0/0]qui配置高級 acl[R01]firewall enable[R01]firewall default permit[R01]acl number 3000 matchorder auto[R01acladv3000]rule deny ip source any destination any[R01acladv3000]rule permit ip source destination any[R01acladv3000]rule permit ip source destination any[R01acladv3000]rule permit ip source destination any[R01acladv3000]rule permit ip source destination any[R01acladv3000]rule permit ip source destination any[R01acladv3000]rule permit ip source destination any[R01acladv3000]rule permit ip source destination any[R01acladv3000]rule permit ip source destination any[R01]acl number 3001[R01acladv3001]rule deny ip source any destinaton any[R01acladv3001]rule permit tcp source any destination 0 destinationport eq 80[R01acladv3001]rule permit udp source any destination 0 destinationport eq 25[R01acladv3001]qui[R01]int e0/0[R01ether0/0]firewall packetfilter 3000 inbound[R01ether0/0]qui[R01]int s0/0[R01serial0/0]firewall packetfilter 3001 inbound[R01serial0/0]qui[R01]quiR01sav匯聚層SH201 配置：配置 stp 并劃分 vlanH3Csys[H3C]sysname SH201[SH201]vlan 10[SH201VLAN10]port e1/0/3 to e1/0/4[SH201VLAN10]qui[SH201]vlan 11[SH201VLAN11]port e1/0/5[SH201VLAN11]qui[SH201]vlan 12[SH201VLAN12]port e1/0/6[SH201VLAN12]qui[SH201]stp enable[SH201]int e1/0/3[SH201ether0/3]stp disable[SH201ether0/3]int e1/0/4 [SH201ether0/4]stp disable[SH201ether0/4]int e1/0/5[SH201ether0/5]stp disable[SH201ether0/5]int e1/0/6[SH201ether0/6]stp disable[SH201ether0/6]qui[SH201]quiSH201savSH202 配置：配置鏈路聚合并劃分 vlanH3Csys[H3C]sysname SH202[SH202]vlan 13[SH202VLAN13]port e1/0/3[SH202VLAN13]qui[SH202]vlan 14[SH202VLAN14]port e1/0/4[SH202VLAN14]qui[SH202]vlan 15[SH202VLAN15]port e1/0/5[SH202VLAN15]qui[SH202]vlan 16[SH202VLAN16]port e1/0/6[SH202VLAN16]qui[SH202]vlan 17[SH202VLAN17]port e1/0/7[SH202VLAN17]qui[SH202]int e1/0/1[SH202ether1/0/1]duplex full[SH202ether1/0/1]speed 100[SH202ether1/0/1]int e0/2[SH202ether1/0/2]duplex full[SH202ether1/0/2]speed 100[SH202ether1/0/2]qui[SH202]linkaggregation e1/0/1 to e1/0/2 both[SH202]quiSH202sav核心層SH31 配置：H3Csys[H3C]sysname SH31[SH31]int e1/0/1[SH31ether1/0/1]ip add [SH31ether1/0/1]no sh[SH31ether1/0/1]int e1/0/2[SH31ether1/0/2]ip add [SH31ether1/0/2]no sh[SH31ether1/0/2]int e1/0/3[SH31ether1/0/3]ip add [SH31ether1/0/3]no sh[SH31ether1/0/3]qui[SH31]ip route [SH31]defaultrout 配置 stp[SH31]stp enable[SH31]int e1/0/1[SH31ether1/0/1]stp disable[SH31ether1/0/1]int e1/0/2[SH31ether1/0/2]stp disable[SH31ether1/0/2]int e1/0/3[SH31ether1/0/3]stp disable[SH31ether1/0/3]int e1/0/6[SH31ether1/0/6]stp disable[SH31ether1/0/6]int e1/0/7[SH31ether1/0/7]stp disable[SH31ether1/0/7]qui配置鏈路手工匯聚[SH31]int e1/0/6[SH31ether1/0/6]duplex full[SH31ether1/0/6]speed 100[SH31ether1/0/6]int e1/0/7[SH31ether1/0/7]duplex full[SH31ether1/0/7]speed 100[SH31ether1/0/7]qui[SH31]linkaggregation e1/0/6 to e1/0/7 both配置 vlan 的 IP 地址[SH31]vlan 10[SH31vlan10]qui[SH31]int vlaninterface 10[SH31vlaninterface10]ip add [SH31vlaninterface10]qui[SH31]vlan 11[SH31vlan11]qui[SH31]int vlaninterface 11[SH31vlaninterface11]ip add [SH31vlaninterface11]qui[SH31]vlan 12[SH31vlan12]qui[SH31]int vlaninterface 12[SH31vlaninterface12]ip add [SH31vlaninterface12]qui[SH31]vlan 13[SH31vlan 13]qui[SH31]int vlaninterface 13[SH31vlaninterface13]ip add [SH31vlaninterface13]qui[SH31]vlan 14[SH31vlan 14]qui[SH31]int vlaninterface 14[SH31vlaninterface14]ip add [SH31vlaninterface14]qui[SH3