运维笔记｛网络改造｝之疯言疯语
话说现有网络环境大概是这样的
……….100MB联通光纤总带宽……….
连接Cisco 2960交换机……..
….连接H3C5100路由器x4台………….1/2层各两台(ˇˇ) 想～{每台独立的公网IP做NAT转换}
…连接Cisco3560三层交换机x4台…..对应每台路由器…..{交换机之间使用Trunk口连接}
….连接接入层杂牌交换机x8台….每台3560接两台接入层交换机到桌面交换机…工位。
描述完毕！！！
改造完成环境是那样的呢？ Look看吧
100MB联通光纤总带宽 ………….Nochange
Cisco2960G交换机……………..No change
CiscoASA5510k9X2……………change使用{Failover技术实现热备份}
看看是如何配置的，从最高处开始吧………………..走起
…………..forSW-2960（出口）
CS29SW01(config)#hostname CS29SW01 {来个主机名吧}
CS29SW01(config)#line vty 0 15
CS29SW01(config-line)#password ***********
CS29SW01(config-line)#transport input ssh {开启SSH相对安全点}
CS29SW01(config)#enable security*************
CS29SW01(config-if)#description TO Internet {G0/1口连接internet}
CS29SW01(config-if)#description TO Firewall-01—E0/0 {描述G0/2 口连接ASA防火墙FW01-E0/0端口}
CS29SW01(config-if)#description TO Firewall-02—E0/0 {描述G0/3 口连接ASA防火墙FW02-E0/0端口}
CS29SW01(config)#int vlan 1
CS29SW01(config-if)#ip add 111.101.211.200255.255.255.128 {进入VLAN1 配置管理IP地址}
CS29SW01(config)#ip default-gateway111.101.211.129 {运营商网关}
CS29SW01(config)#wq
……forCisco Asa5510-01防火墙………………………….华丽的分割线…………………………………….
CS55FW(config)# enable password ******encrypted
CS55FW(config)# username fwadmin password**************
CS55FW(config)# int e0/0
CS55FW(config-if)# description OutsidePublic Network {描述 连接公网端口}
CS55FW(config-if)# nameif outside
CS55FW(config-if)# security-level 0
CS55FW(config-if) #ip address 111.101.211.138255.255.255.128 standby 101.211.139
CS55FW(config)# int e0/1
CS55FW(config-if)# description Inside PrivateNetwork {描述 连接内网端口}
CS55FW(config-if)# nameif inside
CS55FW(config-if)# security-level 100
CS55FW(config-if) #ip address 10.1.100.253255.255.255.128 standby 10.1.100.252
CS55FW(config)# int e0/2
CS55FW(config-if)# description LAN/STATEFailover Interface
CS55FW(config-if)# failover
CS55FW(config-if)# failover lan unitprimary
CS55FW(config-if)# failover lan interfaceLanfo Ethernet 0/2
CS55FW(config-if)# failover key **********
CS55FW(config-if)# failover link lanEthernet0/2
CS55FW(config-if)# failover interface iplan 172.31.1.1 255.255.255.0 standby 172.31.1.2
CS55FW(config-if)# global (outside) 1interface
CS55FW(config-if)#nat (inside) 1 10.1.100.0255.255.0.0 {NET 转换}
static (outside,inside) 10.1.100.200 111.101.211.200netmask 255.255.255.255 {映射出口2960的IP地址便于管理}
CS55FW(config)# route outside 0.0.0.00.0.0.0 111.101.211.129 1 {添加默认路由}
CS55FW(config)#wq
……forCisco Asa5510-02防火墙………………………….华丽的分割线…………………………………….
CS55FW(config-if)# failover lan interfaceLanfo Ethernet 0/2
CS55FW(config-if)# failover key **********
CS55FW(config-if)# failover link lanEthernet0/2
CS55FW(config-if)# failover interface iplan 172.31.1.1 255.255.255.0 standby 172.31.1.2
CS55FW(config-if)#no shutdown {会自动同步所有配置到Asa5510-02防火墙}
CS55FW# show failover state {完成后查看配置，OK}
State Last Failure Reason Date/Time
This host - Primary
Active None
Other host - Secondary
Standby Ready Ifc Failure 12:06:48 GMT Mar 30 2011
inside: No Link
====Configuration State===
SyncDone
====Communication State===
Macset
……forCisco3560-sw（core01）………………………….华丽的分割线…………………………………….手写太累了，贴相关配置
Buildingconfiguration...
Currentconfiguration : 2827 bytes
!
version12.2
noservice timestamps log datetime msec
noservice timestamps debug datetime msec
noservice password-encryption
!
hostnameCisco35-Core01
!
interfaceFastEthernet0/9
description Channel-to-Core2f0/9
channel-group 1 mode on
switchport trunk encapsulation dot1q
switchport mode trunk
!
interfaceFastEthernet0/10
description Channel-to-Core2f0/10
channel-group 1 mode on
switchport trunk encapsulation dot1q
switchport mode trunk
!
interfaceFastEthernet0/11
description TO-SW001-F0/1
switchport access vlan 11
!
interfaceFastEthernet0/12
description TO-SW002-F0/1
switchport access vlan 12
!
interfaceFastEthernet0/13
description TO-SW003-F0/1
switchport access vlan 13
!
interfaceFastEthernet0/14
description TO-SW004-F0/1
switchport access vlan 14
!
interfacePort-channel 1
switchport trunk encapsulation dot1q
switchport mode trunk
!
interfaceVlan1
ip address 10.1.200.251 255.255.255.0
shutdown
standby version 2
standby 1 ip 10.1.200.254
standby 1 priority 110
--More--
%HSRP-6-STATECHANGE:Vlan13 Grp 13 state Standby -> Active
standby 1 preempt
standby 0 priority 110
!
interfaceVlan11
ip address 10.1.121.252 255.255.255.0
standby version 2
standby 11 ip 10.1.121.254
standby 11 priority 110
standby 11 preempt
!
interfaceVlan12
ip address 10.1.122.252 255.255.255.0
standby version 2
standby 12 ip 10.1.122.254
standby 12 priority 110
standby 12 preempt
!
interfaceVlan13
ip address 10.1.123.252 255.255.255.0
standby version 2
standby 13 ip 10.1.123.254
standby 13 priority 110
standby 13 preempt
!
interfaceVlan14
ip address 10.1.124.252 255.255.255.0
standby version 2
standby 14 ip 10.1.124.254
standby 14 priority 110
standby 14 preempt
!
interfaceVlan100
ip address 10.1.100.250 255.255.255.0
standby version 2
standby 100 ip 10.1.100.254
standby 100 priority 110
standby 100 preempt
!
routerrip
network 10.0.0.0
!
ipclassless
iproute 0.0.0.0 0.0.0.0 10.1.100.253
linecon 0
!
lineaux 0
linevty 0 4
password cisco
login
linevty 5 15
password cisco
login
forCisco3560-sw（core02）………………………….华丽的分割线…………………………………….手写太累了，贴相关配置
version 12.2
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Cisco35-Core02
enable secret 5$1$mERr$hx5rVt7rPNoS4wqbXKX7m0
username Core1 secret 5 cisco
interface FastEthernet0/1
switchport access vlan 100
!
interface FastEthernet0/9
description Channel-to-Core1f0/9
channel-group 1 mode on
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface FastEthernet0/10
description Channel-to-Core1f0/10
channel-group 1 mode on
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface FastEthernet0/11
description TO-SW001-F0/2
switchport access vlan 11
!
interface FastEthernet0/12
description TO-SW002-F0/2
switchport access vlan 12
!
interface FastEthernet0/13
description TO-SW003-F0/2
switchport access vlan 13
!
interface FastEthernet0/14
description TO-SW004-F0/2
switchport access vlan 14
!
interface Port-channel 1
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface Vlan1
ipaddress 10.1.200.252 255.255.255.0
shutdown
standby version 2
standby 1 ip 10.1.200.254
standby 1 priority 110
standby 1 preempt
standby 0 priority 110
!
interface Vlan11
ipaddress 10.1.121.253 255.255.255.0
standby version 2
standby 11 ip 10.1.121.254
standby 11 priority 105
standby 11 preempt
!
interface Vlan12
ipaddress 10.1.122.253 255.255.255.0
standby version 2
standby12 ip 10.1.122.254
standby 12 priority 105
standby 12 preempt
!
interface Vlan13
ipaddress 10.1.123.253 255.255.255.0
standby version 2
standby 13 ip 10.1.123.254
standby 13 priority 105
standby 13 preempt
!
interface Vlan14
ipaddress 10.1.124.253 255.255.255.0
standby version 2
standby 14 ip 10.1.124.254
standby 14 priority 105
standby 14 preempt
!
interface Vlan100
ipaddress 10.1.100.251 255.255.255.0
standby version 2
standby 100 ip 10.1.100.254
standby 100 priority 105
standby 100 preempt
!
router rip
network 10.0.0.0
!
ip classless
ip route 0.0.0.0 0.0.0.0 10.1.100.253
line con 0
!
line aux 0
!
line vty 0 4
password cisco
login
line vty 5 15
password cisco
login
以上运维笔记为疯言疯语，切勿照搬模仿操作！
Gerry.Yu
2014年11月6日