校園網(wǎng)網(wǎng)絡(luò)工程實(shí)施方案

目錄TOC\o"1-3"第一章、總體設(shè)計(jì)21.1用戶需求21.2實(shí)施的目的31.3系統(tǒng)設(shè)計(jì)原那么31.4設(shè)計(jì)依據(jù)和標(biāo)準(zhǔn)41.5網(wǎng)絡(luò)設(shè)備效勞卡41.6系統(tǒng)軟件登記表4第二章、杭電網(wǎng)絡(luò)工程施工方案52.1主要設(shè)備清單52.2施工方案表6第三章、杭電網(wǎng)絡(luò)工程施工過程73.1網(wǎng)絡(luò)設(shè)備詳細(xì)信息和IP地址分配表73.2VLAN間訪問規(guī)那么83.3施工流程83.4施工過程93.4.1Catalyst6506的安裝過程93.4.2配置Catalyst6506的系統(tǒng)參數(shù)93.4.3配置Catalyst6506的VLAN 103.4.4配置配置6509交換機(jī)的三層交換模塊153.4.5配置6506交換機(jī)VLAN間的訪問規(guī)那么153.4.6配置6506交換機(jī)的CDP和SNMP 153.4.7配置6506交換機(jī)的STP 163.4.8配置Catalyst3500的安裝過程163.4.9配置Cisco防火墻PIX520的安裝過程183.4.10配置CACHEENGINE550的安裝過程193.4.11配置Cisco3640的安裝過程223.4.12配置CiscoWorks網(wǎng)管軟件243.5設(shè)備模擬連接調(diào)試階段263.6設(shè)備安裝階段263.7系統(tǒng)連調(diào)階段273.8INTERNET連接27第四章、具體設(shè)備配置實(shí)例294.1Catalyst6506 294.2session15 344.3二級(jí)交換機(jī)Catalyst3500 384.4防火墻PIX520 414.5CACHEENGINE550 444.6Cisco3640路由器45第五章、工程總結(jié)47第一章、總體設(shè)計(jì)1.1用戶需求此網(wǎng)絡(luò)工程所要到達(dá)的主要目標(biāo)如下：(1)支持全?，F(xiàn)有的計(jì)算機(jī)，連接校園內(nèi)實(shí)驗(yàn)大樓、行政大樓、電教大樓、圖書館和成教大樓等，將本校現(xiàn)有的及將來要配置的各種PC、工作站和終端通過高性能的網(wǎng)絡(luò)設(shè)備連接起來，組成分布式、開放性的網(wǎng)絡(luò)環(huán)境，以提高教育科研水平。(2)充分利用原有的主干光纜和樓內(nèi)布線系統(tǒng)，將目前的百兆主干快速以太網(wǎng)升級(jí)到千兆主干、百兆交換到桌面的高速交換式以太網(wǎng)。同時(shí)，保護(hù)原有網(wǎng)絡(luò)設(shè)備投資，將目前運(yùn)行的IBM公司系列網(wǎng)絡(luò)產(chǎn)品有效地集成到升級(jí)系統(tǒng)中。(3)在Internet互連網(wǎng)絡(luò)系統(tǒng)平臺(tái)上，以數(shù)據(jù)庫、Web、電子郵件、為根底的系統(tǒng)；并構(gòu)建內(nèi)部Intranet系統(tǒng)，與已有系統(tǒng)實(shí)現(xiàn)互聯(lián)。(4)網(wǎng)絡(luò)與數(shù)據(jù)平安是目前計(jì)算機(jī)信息技術(shù)所面臨的重要挑戰(zhàn)，解決平安問題的技術(shù)與方案有很多，通過防火墻、webcache效勞器建設(shè)確定完整統(tǒng)一的平安策略〔SecurityPolicy〕也是校園網(wǎng)可靠運(yùn)行的保證。(5)考慮與其它學(xué)校、科學(xué)教育網(wǎng)絡(luò)相連，可通過CERNET與國內(nèi)外其它網(wǎng)絡(luò)相連接、實(shí)現(xiàn)遠(yuǎn)程教學(xué)。(6)網(wǎng)絡(luò)具有友好、一致的用戶界面和豐富的管理應(yīng)用系統(tǒng)。(7)在網(wǎng)絡(luò)升級(jí)根底上規(guī)劃相應(yīng)的應(yīng)用系統(tǒng)，具體包括：

學(xué)校網(wǎng)站的建設(shè)

OA〔辦公管理〕系統(tǒng)建設(shè)：電子郵件、公文處理、檔案管理、會(huì)議管理、電子公告、電子論壇、備忘信息等

多媒體輔助教學(xué)系統(tǒng)

連接原有圖書管理系統(tǒng)

VOD視頻點(diǎn)播及視頻會(huì)議系統(tǒng)1.2實(shí)施的目的分析用戶需求，可知該網(wǎng)絡(luò)工程所含的內(nèi)容包括：(1)運(yùn)用虛擬網(wǎng)技術(shù)，建設(shè)杭電校園千兆主干網(wǎng),使其覆蓋全校各主要建筑物，將學(xué)校內(nèi)各種PC、LAN連接為一個(gè)結(jié)構(gòu)合理、內(nèi)外連通，并支持多種協(xié)議和異種機(jī)的園區(qū)網(wǎng)。(2)通過在信息中心代理效勞器的設(shè)立與科教網(wǎng)相連并可與Internet互連。(3)新校區(qū)的由于其與科教網(wǎng)相連的特殊性，因此可分別設(shè)立獨(dú)立的三個(gè)代理效勞器與Internet互連。(4)根據(jù)科學(xué)的平安策略，通過CiscoPIX520防火墻配置，從而有效的隔絕內(nèi)網(wǎng)和外網(wǎng)，但同時(shí)又能實(shí)現(xiàn)公網(wǎng)對(duì)杭電校內(nèi)網(wǎng)站和對(duì)外開放資源的訪問。(5)通過CacheEgeine505與Cisco6506之間WCCP配置建立高速的Internet訪問通道。(6)通過CiscoWorks網(wǎng)管軟件實(shí)施有效的網(wǎng)絡(luò)管理。1.3系統(tǒng)設(shè)計(jì)原那么·連續(xù)性原那么：充分利用現(xiàn)有資源〔包括現(xiàn)有的網(wǎng)絡(luò)、計(jì)算機(jī)和應(yīng)用資源〕，使系統(tǒng)既能與前期系統(tǒng)相銜接，同時(shí)具有一定的可擴(kuò)充性，為后期工作打下根底?！?shí)用性原那么：在保證使用要求和技術(shù)可行性的前提下，要選擇易于操作、管理、見效的設(shè)計(jì)和設(shè)備?！て桨脖Ｃ茉敲矗涸O(shè)計(jì)中應(yīng)注意各個(gè)環(huán)節(jié)的平安保密，統(tǒng)籌規(guī)劃，不可偏廢?！ば畔⒐蚕碓敲矗涸O(shè)計(jì)必須考慮信息在一定的條件下、一定范圍內(nèi)的共享?！は冗M(jìn)性原那么：系統(tǒng)建設(shè)要與當(dāng)今先進(jìn)的計(jì)算機(jī)網(wǎng)絡(luò)開展技術(shù)相適應(yīng)，保證系統(tǒng)的先進(jìn)性、開放性、高可靠性和可擴(kuò)展性的有機(jī)結(jié)合。1.4設(shè)計(jì)依據(jù)和標(biāo)準(zhǔn)主機(jī)和網(wǎng)絡(luò)設(shè)備的選型符合以下國家和組織的技術(shù)標(biāo)準(zhǔn)和標(biāo)準(zhǔn)：·GB：中華人民共和國國家標(biāo)準(zhǔn)·ISO：國際標(biāo)準(zhǔn)組織·ITU-T：國際電信聯(lián)盟·IEEE：國際電氣與電子工程師協(xié)會(huì)·EIA：電氣工業(yè)協(xié)會(huì)·IEC：國際電工協(xié)會(huì)1.5網(wǎng)絡(luò)設(shè)備效勞卡〔見附件〕1.6系統(tǒng)軟件登記表〔見附件〕第二章、杭電網(wǎng)絡(luò)工程施工方案2.1主要設(shè)備清單杭電校園網(wǎng)升級(jí)改造工程網(wǎng)絡(luò)主干設(shè)備清單：No.ProductNo.DescriptionQty1Ws-c6506Catalyst6506chassis12WS-CAC-1300Catalyst6506Chassisw/1300WACPowerSupply13WS-X6K-S2-MSFC2Catalyst6000SupervisorEngine2-A,2GE,plusMSFC-2&PFC14WS-X6408-GBICCatalyst60008-portGigabitEthernetModule(Req.GBICs)15WS-G54841000BASE-SX"ShortWavelength"GBIC(Multimodeonly)66WS-X6348-RJ-45Catalyst600048-port10/100RJ-45Module17WS-C6500-SFMCatalyst6500SwitchFabricModel18WS-C3524-XL-ENCatalyst3524XLEnterpriseEdition39WS-C3548-XL-ENCatalyst3548XLEnterpriseEdition210WS-G54841000BASE-SX"ShortWavelength"GBIC(Multimodeonly)711CISCO3640Cisco36004-slotModularRouter-ACwithIPSoftware112NM-2FE2W210/100Ethernet2WANCardSlotNetworkModule113PIX-520-1K-CHMidrangePIXFirewall520,two10/100EnetNICs114CE-550CacheEngine550115CWW-5.0Ciscoworksforwindows6.0116JSX-FM-2WIBM82742PortGigabitEthernetModule1Total2.2施工方案表·系統(tǒng)設(shè)備列表☆Cisco6506主交換機(jī)☆Cisco3524二級(jí)換機(jī)☆Cisco3548二級(jí)換機(jī)☆CiscoPIX520防火墻☆CacheEngine550☆Cisco3640路由器環(huán)境檢查〔10分鐘〕☆UPS☆電源質(zhì)量☆溫度和濕度☆接地系統(tǒng)電阻要求設(shè)備開包〔60分鐘〕主交換設(shè)備二級(jí)交換設(shè)路由器防火墻電源線纜系統(tǒng)上電〔20分鐘〕cisco6506主機(jī)系統(tǒng)〔10分鐘〕各CISCO3500系列主機(jī)〔60分鐘〕系統(tǒng)上電正常以及上電失敗的相應(yīng)動(dòng)作對(duì)照系統(tǒng)訂單檢查系統(tǒng)的功能部件〔30分鐘〕中央處理器內(nèi)存磁盤〔內(nèi)置以及外置〕設(shè)備/適配器操作系統(tǒng)安裝〔150分鐘*2〕升級(jí)Cisco3640IOS操作系統(tǒng)的〔150分鐘〕安裝在線幫助，包括Info，電子書籍，配置書籍搜索程序第三章、杭電網(wǎng)絡(luò)工程施工過程3.1網(wǎng)絡(luò)設(shè)備詳細(xì)信息和IP地址分配表(見附表)3.2VLAN間訪問規(guī)那么注：默認(rèn)情況下 VLAN間的IP包訪問不受限制3.3施工流程以下是本次工程中網(wǎng)絡(luò)設(shè)備的施工流程圖開始開始配置6506安裝模塊、配置名字、口令、遠(yuǎn)端控制配置VLAN配置MSFC配置SNMP配置3500安裝模塊、名字、口令、遠(yuǎn)端控制配置VLAN配置SNMP配置網(wǎng)關(guān)配置CE-505名字、口令、遠(yuǎn)端控制配置WCCP配置網(wǎng)關(guān)、DNS配置PIX安裝網(wǎng)卡、名字、口令、端口狀態(tài)配置端口地址配置路由配置平安規(guī)那么配置3640路由器安裝模塊、名字、口令、端口狀態(tài)配置端口地址配置路由配置平安規(guī)那么設(shè)備到位整體聯(lián)調(diào)測試與故障解決3.4施工過程3.4.1Catalyst6506的安裝過程模塊安裝安裝6506的電源模塊；☆WS-X6K-S1A-MSFC2；☆WS-X6408-GBIC；☆WS-G5484；☆WS-X6248-RJ-45；☆WS-C6500-SFMCiscoCatalyst6506由工廠根據(jù)定貨單直接安裝好標(biāo)準(zhǔn)配置的模塊，但電源、路由等尚未安裝，所以首先將待安裝的各模塊拆開，裝入6506的電源插槽。上電檢查6506的各個(gè)模塊的工作狀態(tài)是否正常：接入6506電源，由于6506有兩個(gè)電源作為冗余，所以最好兩個(gè)電源分別接入兩路UPS電源上，這樣即使當(dāng)UPS其中一路電源故障時(shí)，不會(huì)影響整個(gè)6506交換機(jī)的正常遠(yuǎn)行，當(dāng)6506交換機(jī)上電初始化結(jié)束后，從各個(gè)模塊面板上的LED燈的狀態(tài)可以判斷各個(gè)模塊的工作狀態(tài)是否正常。3.4.2配置Catalyst6506的系統(tǒng)參數(shù)當(dāng)6506交換機(jī)初始化結(jié)束后，就進(jìn)入系統(tǒng)單機(jī)配置階段。對(duì)于6506來說，首先需要配置系統(tǒng)參數(shù)，其中包括以下幾個(gè)局部：機(jī)器名、口令和遠(yuǎn)程登陸等。以下是具體配置過程：cisco6506>enablecisco6506>〔enable〕setsystemnamecisco6506說明：配置6506的名字為CISCO6506cisco6506>enablecisco6506>〔enable〕setenablepasswordcisco說明：配置6506的enable口令為ciscocisco6506>enablecisco6506>〔enable〕.3/cisco6506>〔enable〕setiproute.0/54說明：配置6506的CPU模塊上的以太網(wǎng)IP地址為：，且只允許本網(wǎng)段任何地址存取3.4.3配置Catalyst6506的VLAN網(wǎng)絡(luò)IP地址分配策略杭電校園網(wǎng)是覆蓋全院的廣域網(wǎng)絡(luò)，其網(wǎng)絡(luò)主干連接的節(jié)點(diǎn)多，因此，要保證網(wǎng)絡(luò)的有效性和可管理性，網(wǎng)絡(luò)地址的規(guī)劃與分配是十分重要的問題。網(wǎng)絡(luò)地址是一種資源，必須經(jīng)過優(yōu)化的規(guī)劃和設(shè)計(jì)，因?yàn)楹茈y預(yù)測網(wǎng)絡(luò)將來的規(guī)模和應(yīng)用情況的開展，如果規(guī)劃不當(dāng)，將導(dǎo)致地址資源不夠用，網(wǎng)絡(luò)的擴(kuò)展將受到極大的限制；如果規(guī)劃過于龐大，那么在現(xiàn)行運(yùn)行過程中，網(wǎng)絡(luò)的路由將會(huì)復(fù)雜，影響網(wǎng)絡(luò)的效率。網(wǎng)絡(luò)地址的分配應(yīng)遵循以下的原那么：

唯一性：在同一個(gè)互聯(lián)網(wǎng)絡(luò)內(nèi)網(wǎng)絡(luò)地址應(yīng)該保持其唯一性；

簡單性：地址的分配應(yīng)該簡單，防止在主干上采用復(fù)雜的掩碼方式；

連續(xù)性：為同一個(gè)網(wǎng)絡(luò)區(qū)域分配連續(xù)的網(wǎng)絡(luò)地址，便于縮減路由表的表項(xiàng)，提高路由器的處理效率，這種技術(shù)稱為地址疊合〔Summarization〕；

可擴(kuò)充性：為一個(gè)網(wǎng)絡(luò)區(qū)域分配的網(wǎng)絡(luò)地址應(yīng)該具有一定的容量，便于主機(jī)數(shù)量增加時(shí)仍然能夠保持地址的連續(xù)性；

靈活性：地址分配不應(yīng)該基于某個(gè)網(wǎng)絡(luò)路由策略的優(yōu)化方案，應(yīng)該便于多數(shù)路由策略在該地址分配方案上實(shí)現(xiàn)優(yōu)化；

可管理性：地址的分配應(yīng)該有層次，某個(gè)局部的變動(dòng)不要影響上層、全局。在對(duì)一個(gè)具體部門擁有的某個(gè)或幾個(gè)子區(qū)劃分子網(wǎng)時(shí)，要根據(jù)本部門的具體應(yīng)用需求來合理分配子網(wǎng)資源，并且要留有一定的余地，這要從子網(wǎng)數(shù)和某一個(gè)子網(wǎng)所擁有的最大主機(jī)數(shù)兩個(gè)方面來考慮。根據(jù)我們對(duì)杭電校園網(wǎng)的網(wǎng)絡(luò)地址規(guī)劃和分配的了解，我們采用以C類地址為主B類地址為輔的地址分配原那么。前二位〔192.168〕作為公共網(wǎng)絡(luò)地址，第三位作為各VLAN的地址，并第四位的〔254〕作為各VLAN的網(wǎng)關(guān)〔地址分配表見附表〕杭電計(jì)算機(jī)網(wǎng)絡(luò)根據(jù)業(yè)務(wù)功能的不同，可以分為51個(gè)VLAN，51個(gè)VLAN各自獨(dú)立，分別屬于不同的播送域，默認(rèn)情況下不同VLAN間可互相訪問，根據(jù)不同平安策略，access-list表可作訪問控制樓幢機(jī)構(gòu)端口分配VLANIDVLAN命名網(wǎng)關(guān)行政樓黨政辦領(lǐng)導(dǎo)1-18VLAN10DangZheng19人事處19-24VLAN11RenShi教務(wù)處25-27VLAN12JiaoWu科研財(cái)務(wù)28-32VLAN13Xz_1_west研究所33-36VLAN14YanjiuSheng組織、宣傳、綜合37-42VLAN15XuanChuan離休等紀(jì)監(jiān)、后勤、高教等43-46VLAN17Xz_2_west電教CAD1-2VLAN18Cad電教3-4VLAN19DianJiao計(jì)算中心5-10VLAN20Computer_Center408自備房11-14VLAN21Student樓幢機(jī)構(gòu)端口分配VLANIDVLAN命名網(wǎng)關(guān)實(shí)驗(yàn)樓文理學(xué)院1-2VLAN22WenLi機(jī)電分院3-4VLAN23JiDian自動(dòng)化分院5-6VLAN24ZiDongHua財(cái)經(jīng)分院7-8VLAN25Caijing管理分院9-10VLAN26GuanLi計(jì)算機(jī)分院11-12VLAN27JiSuanJi電子分院13-14VLAN28DianZi通信分院15-16VLAN29Tongxin信息分院17-18VLAN30XinXiCAE所19-20VLAN31CAE設(shè)備處21-22VLAN32SB_other網(wǎng)管23-35VLAN37NIC_1(效勞器)37-42VLAN33NIC_2〔備用〕43-48VLAN46NIC_3〔學(xué)生〕計(jì)算機(jī)分院1-2VLAN38proxy3-4VLAN39computer_15-6VLAN40computer_27-8VLAN41computer_39-10VLAN42computer_411-12VLAN43computer_513-14VLAN44computer_6樓幢機(jī)構(gòu)端口分配VLANIDVLAN命名網(wǎng)關(guān)圖書館效勞器VLAN45LIB_server客戶端1-24VLAN36Lib_1具體配置過程如下：cisco6506>〔enable〕setvtpdomainhzdzgxycisco6506>〔enable〕setvtppasswdciscocisco6506>〔enable〕setvlan10namedangzhengcisco6506>〔enable〕setvlan11namerenshicisco6506>〔enable〕setvlan12namejiaowucisco6506>〔enable〕setvlan13namexz_1_westcisco6506>〔enable〕setvlan14nameyanjiushengcisco6506>〔enable〕setvlan15namexuanchuancisco6506>〔enable〕setvlan16namexz_other1cisco6506>〔enable〕setvlan17namexz_othercisco6506>〔enable〕setvlan18namecadcisco6506>〔enable〕setvlan19namedianjiaocisco6506>〔enable〕setvlan20namecomputer_centercisco6506>〔enable〕setvlan21nameshudentcisco6506>〔enable〕setvlan22namewenlicisco6506>〔enable〕setvlan23namejidiancisco6506>〔enable〕setvlan24namezidonghuacisco6506>〔enable〕setvlan25namecaijingcisco6506>〔enable〕setvlan26nameguanlicisco6506>〔enable〕setvlan27namejisuanjicisco6506>〔enable〕setvlan28namedianzicisco6506>〔enable〕setvlan29nametongxincisco6506>〔enable〕setvlan30namexinxicisco6506>〔enable〕setvlan31namecaecisco6506>〔enable〕setvlan32namesb_othercisco6506>〔enable〕setvlan33namenic_2cisco6506>〔enable〕setvlan34namechengjiaocisco6506>〔enable〕setvlan35namelibcisco6506>〔enable〕setvlan36namelib_1cisco6506>〔enable〕setvlan37namenic_1cisco6506>〔enable〕setvlan38nameproxycisco6506>〔enable〕setvlan39namecomputer_1cisco6506>〔enable〕setvlan40namecomputer_2cisco6506>〔enable〕setvlan41namecomputer_3cisco6506>〔enable〕setvlan42namecomputer_4cisco6506>〔enable〕setvlan43namecomputer_5cisco6506>〔enable〕setvlan44namecomputer_6cisco6506>〔enable〕setvlan45namelib_servercisco6506>〔enable〕setvlan46namenic_3cisco6506>〔enable〕setvlan48namedialupcisco6506>〔enable〕setvlan50name408cisco6506>〔enable〕setvlan51namewytypecisco6506>〔enable〕setvlan999namecache!說明：設(shè)置6506的VLAN 名字和VTP模式cisco6506>〔enable〕settrunk2/1nonegotiateisl1-1005,1025-4094cisco6506>〔enable〕settrunk2/2nonegotiateisl1-1005,1025-4094cisco6506>〔enable〕settrunk2/3nonegotiateisl1-1005,1025-4094cisco6506>〔enable〕settrunk2/4nonegotiateisl1-1005,1025-4094cisco6506>〔enable〕settrunk2/5nonegotiateisl1-1005,1025-4094cisco6506>〔enable〕settrunk2/6nonegotiateisl1-1005,1025-4094cisco6506>〔enable〕settrunk2/7nonegotiateisl1-1005,1025-4094cisco6506>〔enable〕settrunk2/8nonegotiateisl1-1005,1025-4094說明：設(shè)置6506的第二模塊1-8口為主干模式，并采用ISL協(xié)議并不可磋商。3.4.4配置配置6509交換機(jī)的三層交換模塊當(dāng)在6506上劃分了VLAN以后，桌面工作站就可以根據(jù)不同的需求分別參加到對(duì)應(yīng)的VLAN中去，不同的VLAN的客戶機(jī)就分別屬于不同的播送域，有各自不同的IP地址段，當(dāng)需要跨網(wǎng)段互相訪問時(shí)，就必須通過路由。6506可以帶三層交換MSFC模塊，本系統(tǒng)中由于在6506上有一個(gè)超級(jí)引擎上配置了一塊MSFC模塊，隨著杭電計(jì)算機(jī)網(wǎng)絡(luò)的開展，系統(tǒng)可能的情況下，就可以利用CISCO的HSRP協(xié)議作熱備份，再配置一臺(tái)或者多臺(tái)支持HSRP協(xié)議的三層交換機(jī)，即當(dāng)其中任何一塊MSFC模塊故障時(shí)，另外一塊可以立即接替原來的模塊繼續(xù)工作，切換時(shí)間很短。我們可實(shí)現(xiàn)51個(gè)VLAN分別優(yōu)先運(yùn)行在多個(gè)三層路由模塊上，這樣在系統(tǒng)無故障時(shí)，能到達(dá)路由數(shù)據(jù)負(fù)載分擔(dān)的目的。3.4.5當(dāng)數(shù)據(jù)在VLAN間路由時(shí)，出于對(duì)各獨(dú)立系統(tǒng)的平安考慮，在各VLAN路由端口上應(yīng)用訪問列表，使VLAN之間的數(shù)據(jù)按規(guī)那么通過。針對(duì)每個(gè)VLAN的所屬機(jī)構(gòu)將平安規(guī)那么量化，再依次應(yīng)用在端口上。Access-list1permitanyany其他VLAN的訪問規(guī)那么見最后的具體配置。3.4.6當(dāng)交換機(jī)需要被網(wǎng)管時(shí)，必須配置交換機(jī)的CDP和SNMP參數(shù)，其中CDP協(xié)議是CISCO公司特有的一種協(xié)議，而SNMP是標(biāo)準(zhǔn)的簡單網(wǎng)絡(luò)管理協(xié)議。其中SNMP協(xié)議需要有一個(gè)COMMUNITYNAME控制對(duì)交換機(jī)的讀寫，在本次工程中，我們定義了以下的COMMUNITYNAME：READWRITE：PRIVATEREADONLY：PUBLIC以下是具體配置命令：cisco6506>enablecisco6506>(enable)setcdpenable說明：啟用6506交換機(jī)的CDP協(xié)議。Cisco6506>(enable)setsnmpenableall說明：啟用6506交換機(jī)的SNMP功能，并啟用默認(rèn)的關(guān)鍵字PUBLIC為只讀，PRIVATE為讀寫。3.4.7配置6506交換機(jī)的由于在設(shè)計(jì)的過程中，為了增加網(wǎng)絡(luò)的可靠性，在核心層交換機(jī)與匯接層交換機(jī)之間、以及核心應(yīng)用中均設(shè)計(jì)了雙冗余鏈路。為了防止這些冗余鏈路所形成的透明橋接問題，必須使生成樹協(xié)議〔STP〕有效工作。啟動(dòng)生成樹cisco6506>(enable)setspantreeenableall3.4.8Catalyst3500系列是CISCO公司的提供1000兆上行端口的桌面交換機(jī)，本次工程中包括3臺(tái)catalyst3524交換機(jī)和2臺(tái)catalyst3548交換機(jī)，配置過程完全一樣。以下是具體配置過程：3524的配置：Currentconfiguration:!version12.0noservicepadservicetimestampsdebuguptimeservicetimestampsloguptimenoservicepassword-encryption!hostnamelib說明：配置3524的NAME為lib。enablesecret5$1$G3SM$DbzVKE3l/fkYHpoi0XUug/enablepasswordcisco說明：配置3524的口令interfaceFastEthernet0/1switchportaccessvlan35說明：配置端口1屬于VLAN135interfaceGigabitEthernet0/1switchportmodetrunkswitchporttrunkencapsulationdot1q說明：兩個(gè)千兆的上行口配置為TRUNK方式。interfaceVLAN1noipdirected-broadcastnoiproute-cache說明：配置VLAN1的IP地址vtpclient說明：配置VTP為CLIENT方式vtpdomainhzdzgxy說明：配置VTP域名為hzdzgxylinevty04passwordciscologinlinevty515passwordciscologin說明：配置遠(yuǎn)程登陸的口令為cisco3.4.9配置Cisco配置PIX的根本屬性將PIX安放至機(jī)架，經(jīng)檢測電源系統(tǒng)后接上電源，并加電主機(jī)。將CONSOLE口連接到PC的串口上，運(yùn)行HyperTerminal程序從CONSOLE口進(jìn)入PIX系統(tǒng)；此時(shí)系統(tǒng)提示pixfirewall>。輸入命令：enable，進(jìn)入特權(quán)模式，此時(shí)系統(tǒng)提示為pixfirewall#。輸入命令：configureterminal，對(duì)系統(tǒng)進(jìn)行初始化設(shè)置。配置以太口參數(shù)：interfaceethernet0auto(auto選項(xiàng)說明系統(tǒng)自適應(yīng)網(wǎng)卡類型)interfaceethernet1autointerfaceethernet2auto配置各功能段的平安級(jí)別：nameifethernet0outsidesecurity0nameifethernet1insidesecurity100nameifethernet2dmzsecurity50配置各網(wǎng)卡的IP地址：ipaddressinsideipaddressdmz指定外部地址范圍：指定要進(jìn)行轉(zhuǎn)換的內(nèi)部地址：nat(inside)1.000nat(dmz)0.000設(shè)置靜態(tài)的地址轉(zhuǎn)換，將真實(shí)地址與提供效勞的私有地址綁定static(dmz,outside)netmask5500static(dmz,outside)11netmask550static(dmz,outside)88netmask550static(dmz,outside)00netmask550static(dmz,outside)22netmask550static(dmz,outside)33netmask550static(dmz,outside)5050netmask550static(dmz,outside)00netmask550static(dmz,outside)2929netmask5500static(dmz,outside)00netmask5500指定要進(jìn)行靜態(tài)轉(zhuǎn)換的IP地址能夠通過的協(xié)議conduitpermiticmpanyany允許所有ICMP通信conduitpermittcphost1rangeftpwwwanyconduitpermittcphost0rangeftpwwwanyconduitpermitudphosteqdomainany50eqwwwanyconduitpermittcphost8rangesmtppop3anyconduitpermittcphost0eqwwwanyconduitpermittcphost29anyconduitpermittcphost0eqtelnetanyconduitpermittcphost3eqwwwany設(shè)置指向內(nèi)、外部網(wǎng)的缺省路由routeoutside.0541routeinside.2531系統(tǒng)允許的主機(jī)對(duì)防火墻端口的TELNET訪問3.4.10配置CACHEENGINE550的安裝過程指定登陸的用戶名和口令useraddadminuid0password1"b9ccbQcQe9"capabilityadmin-accessuseraddwyuid5019password1"eeQQeRRSS"capabilityadmin-access指定主機(jī)名hostnamecisco_ce_505指定以太網(wǎng)的IP地址interfaceethernet0ipaddress255.!interfaceethernet1exit定義網(wǎng)關(guān)!定義DNS名定義域名定義路由iproutecronfile/local/etc/crontab!bypassauth-trafficallcache-cookiesmax-ttldaystext4binary3cache-authenticatedobjectmax-size6144persistent-connectionstimeout8max-idle1000定義WCCP訪問協(xié)議的路由器地址wccpport-list180wccpweb-cacherouter-list-num1weight20password****定義主路由器地址〔在有多路由器情況下〕wccpversion2wccpshutdownmax-wait1!snmp-servercommunitysummernoradius-serverhostauth-port1812radius-serverkey****authenticationloginlocalenableauthenticationconfigurationlocalenabletransaction-logsarchivefiles1transaction-logsenabletransaction-logsexportintervalevery-dayat00:00transaction-logsexportenabletransaction-logssanitizeruleblockdst-port33定義代理效勞器的地址和能夠通過的地址ruleuse-proxy413128domain.*google\ruleuse-proxy413128domain.*whatismyip\ruleno-cacheurl-regex.*cgi-bin.*ruleno-cacheurl-regex.*aw-cgi.*!!end3.4.11配置Cisco3640的安裝過程version12.0servicetimestampsdebuguptimeservicetimestampsloguptimenoservicepassword-encryption定義主機(jī)名hostnamecisco3640!定義訪問的口令enablesecret5$1$sWZw$EdlT9Yphojj6nJVo06bne0enablepasswordcisco3640!!ipsubnet-zero定義域名定義DNS名!定義外地接口的IP地址interfaceFastEthernet2/0noipdirected-broadcastduplexautospeedauto定義內(nèi)部接口的IP地址interfaceFastEthernet2/1noipdirected-broadcastnoiproute-cachenoipmroute-cacheduplexautospeedauto定義網(wǎng)關(guān)ipclassless定義內(nèi)外路由iproutenoipserver!snmp-serverengineIDlocal000000090200000628AC87A1snmp-servercommunitysummerRO!linecon0transportinputnonelineaux0定義遠(yuǎn)程登陸的口令linevty04passwordciscologin!end3.4.12配置CiscoWorks CiscoWorks的設(shè)計(jì)層次為基于國際通用網(wǎng)絡(luò)管理軟件之上的應(yīng)用系統(tǒng)，其結(jié)構(gòu)如以下圖：通過CiscoWorks和CWSI可以很好地實(shí)現(xiàn)對(duì)含有Cisco軟件與硬件產(chǎn)品的企業(yè)網(wǎng)絡(luò)進(jìn)行基于SNMP的監(jiān)視、控制與管理。一、CiscoWorks的安裝1、選取INSTALL二、選用integrateciscoworks5.0withwhatsupgold三、選取需要管理的網(wǎng)絡(luò)設(shè)備四、完成3.5設(shè)備模擬連接調(diào)試階段設(shè)備安裝階當(dāng)單機(jī)調(diào)試完畢后，就進(jìn)入系統(tǒng)連調(diào)階段。由于有多個(gè)單位是多模光纖通路，且不在本地。所以只有先進(jìn)行模擬連接測試。除了線路問題，與以后的實(shí)際情況完全一樣。3.6設(shè)備安裝階段在所有的設(shè)備模擬調(diào)試完畢后，就進(jìn)行設(shè)備的安裝工作。設(shè)備的安裝主要是把實(shí)驗(yàn)樓2樓信息中心機(jī)房里的所有網(wǎng)絡(luò)設(shè)備都安裝到2米的標(biāo)準(zhǔn)機(jī)柜里，并且將信息中心所有的線路根據(jù)VLAN進(jìn)行重新規(guī)劃和整理，各個(gè)網(wǎng)絡(luò)分中心交換機(jī)安裝在1.2米機(jī)柜中。在本次工程安排中，信息中心大樓機(jī)房的2M標(biāo)準(zhǔn)機(jī)柜：用于安裝6509交換機(jī)、效勞器交換機(jī)、樓層交換機(jī)和PIX防火墻等；信息中心原有的2M機(jī)柜用于放置二級(jí)接入交換機(jī)設(shè)備。把所有的設(shè)備都安裝到位以后，再把UPS電源接入到位。3.7系統(tǒng)連調(diào)階段在所有的網(wǎng)絡(luò)設(shè)備都安裝到位以后，包括所有的主機(jī)放置到DMZ區(qū)后。就可以進(jìn)行整個(gè)系統(tǒng)的連調(diào)。3.8INTERNET連接在將整個(gè)系統(tǒng)遷移到10M專線的同時(shí)，我們將PIX防火墻放在系統(tǒng)與外部連接處，以提供網(wǎng)絡(luò)的平安保障。在進(jìn)入內(nèi)部系統(tǒng)后，連接到PIX內(nèi)部網(wǎng)段的PC機(jī)通過上網(wǎng)計(jì)費(fèi)效勞器進(jìn)入統(tǒng)一管理。對(duì)處INTERNET效勞的WEB、DNS、SMTP和POP3效勞器接入PIX效勞器的DMZ段，用于保護(hù)應(yīng)有效勞器的平安和對(duì)內(nèi)外提供效勞。在杭電INTERNET系統(tǒng)中還配置了一臺(tái)WEB高速緩存效勞器，在內(nèi)部用戶訪問外部站點(diǎn)時(shí)，通過WCCP協(xié)議首先訪問CACHEENGINE550效勞器，如CACHEENGINE550效勞器中已有訪問過的站點(diǎn)那么進(jìn)行內(nèi)部訪問從而有效率減少網(wǎng)絡(luò)流量，而到達(dá)高速訪問的目的。整個(gè)連接情況圖示于杭電網(wǎng)絡(luò)拓樸圖：需要說明的幾點(diǎn)：1、防火墻上做了地址轉(zhuǎn)換，將內(nèi)部的私有地址轉(zhuǎn)換成公有地址訪問INTERNET。2、防火墻上開放了用于INTERNET信息發(fā)布所需要的幾個(gè)端口，包括TCP的53，23，25，110，80和UDP的53端口，分別用于DNS，SMTP，POP3和WEB等效勞。3、在防火墻上做了多個(gè)靜態(tài)的地址映射將內(nèi)部地址映射為外部地址。4、保護(hù)應(yīng)用效勞器的平安。這樣當(dāng)INTERNET上的用戶訪問這兩個(gè)公有地址時(shí)防火墻將自動(dòng)將訪問請(qǐng)求轉(zhuǎn)給兩個(gè)內(nèi)部的私有地址。5、CACHEENGINE網(wǎng)絡(luò)流量緩沖的目的。第四章、具體設(shè)備配置實(shí)例4.1Catalyst65066506交換機(jī)模塊配置文檔begin!#*****NON-DEFAULTCONFIGURATION*****!!#time:WedOct312001,04:00:50!#version6.1(2)!setpassword$2$ohhi$Pka/lgvq4acxpVc0ecW660setenablepass$2$F1/Q$NKbNCtkZmFVg2HO7PIhZZ/!#errordetectionseterrordetectionportcounterenable!#systemsetsystemnamecisco6506!#!#vtpsetvtpdomainhzdzgxysetvtppasswdciscosetvlan1namedefaulttypeethernetmtu1500said100001stateactivesetvlan10namedangzhengtypeethernetmtu1500said100010stateactivesetvlan11namerenshitypeethernetmtu1500said100011stateactivesetvlan12namejiaowutypeethernetmtu1500said100012stateactivesetvlan13namexz_1_westtypeethernetmtu1500said100013stateactivesetvlan14nameyanjiushengtypeethernetmtu1500said100014stateactivesetvlan15namexuanchuantypeethernetmtu1500said100015stateactivesetvlan16namexz_other1typeethernetmtu1500said100016stateactivesetvlan17namexz_othertypeethernetmtu1500said100017stateactivesetvlan18namecadtypeethernetmtu1500said100018stateactivesetvlan19namedianjiaotypeethernetmtu1500said100019stateactivesetvlan20namecomputer_centertypeethernetmtu1500said100020stateactivesetvlan21nameshudenttypeethernetmtu1500said100021stateactivesetvlan22namewenlitypeethernetmtu1500said100022stateactivesetvlan23namejidiantypeethernetmtu1500said100023stateactivesetvlan24namezidonghuatypeethernetmtu1500said100024stateactivesetvlan25namecaijingtypeethernetmtu1500said100025stateactivesetvlan26nameguanlitypeethernetmtu1500said100026stateactivesetvlan27namejisuanjitypeethernetmtu1500said100027stateactivesetvlan28namedianzitypeethernetmtu1500said100028stateactivesetvlan29nametongxintypeethernetmtu1500said100029stateactivesetvlan30namexinxitypeethernetmtu1500said100030stateactivesetvlan31namecaetypeethernetmtu1500said100031stateactivesetvlan32namesb_othertypeethernetmtu1500said100032stateactivesetvlan33namenic_2typeethernetmtu1500said100033stateactivesetvlan34namechengjiaotypeethernetmtu1500said100034stateactivesetvlan35namelibtypeethernetmtu1500said100035stateactivesetvlan36namelib_1typeethernetmtu1500said100036stateactivesetvlan37namenic_1typeethernetmtu1500said100037stateactivesetvlan38nameproxytypeethernetmtu1500said100038stateactivesetvlan39namecomputer_1typeethernetmtu1500said100039stateactivesetvlan40namecomputer_2typeethernetmtu1500said100040stateactivesetvlan41namecomputer_3typeethernetmtu1500said100041stateactivesetvlan42namecomputer_4typeethernetmtu1500said100042stateactivesetvlan43namecomputer_5typeethernetmtu1500said100043stateactivesetvlan44namecomputer_6typeethernetmtu1500said100044stateactivesetvlan45namelib_servertypeethernetmtu1500said100045stateactivesetvlan46namenic_3typeethernetmtu1500said100046stateactivesetvlan48namedialuptypeethernetmtu1500said100048stateactivesetvlan50name408typeethernetmtu1500said100050stateactivesetvlan51namewytypeethernetmtu1500said100051stateactivesetvlan999namecachetypeethernetmtu1500said100999stateactivesetvlan1002namefddi-defaulttypefddimtu1500said101002stateactivesetvlan1004namefddinet-defaulttypefddinetmtu1500said101004stateactivestpieeesetvlan1005nametrnet-defaulttypetrbrfmtu1500said101005stateactivestpibmsetvlan47setvlan1003nametoken-ring-defaulttypetrcrfmtu1500said101003stateactivemodesrbaremaxhop7stemaxhop7backupcrfoff!#ipsetiproute.0/54!#setbootcommandsetbootconfig-register0x2setbootsystemflashbootflash:cat6000-sup2.6-1-2.bin!#portchannelsetportchannel4/46-4815setportchannel1/1-233setportchannel4/2-835setportchannel4/9-1436setportchannel4/15-2237setportchannel4/23-3038setportchannel4/31-3839setportchannel4/39-4540setportchannel4/175setportchannel2/1-8362!#defaultportstatusisenable!!#module1:2-port1000BaseXSupervisorsetvlan341/1setvlan451/2settrunk1/1offisl1-1005,1025-4094settrunk1/2offisl1-1005,1025-4094setportchannel1/1-2modeoff!#module2:8-port1000BaseXEthernetsetudldenable2/2-3,2/6,2/8settrunk2/1nonegotiateisl1-1005,1025-4094settrunk2/2nonegotiateisl1-1005,1025-4094settrunk2/3nonegotiateisl1-1005,1025-4094settrunk2/4nonegotiateisl1-1005,1025-4094settrunk2/5nonegotiateisl1-1005,1025-4094settrunk2/6nonegotiateisl1-1005,1025-4094settrunk2/7nonegotiateisl1-1005,1025-4094settrunk2/8nonegotiateisl1-1005,1025-4094setportchannel2/1modeonsetportchannel2/2-8modeoff!#module3empty!#module4:48-port10/100BaseTXEthernetsetvlan224/1-2setvlan234/3-4setvlan244/5-6setvlan254/7-8setvlan264/9-10setvlan274/11-12setvlan284/13-14setvlan294/15-16setvlan304/17-18setvlan314/19-20setvlan324/21-22setvlan334/41-42setvlan374/23-35setvlan464/43-48setvlan484/38setvlan504/37setvlan514/39setvlan9994/40settrunk4/1offnegotiate1-1005,1025-4094settrunk4/2offnegotiate1-1005,1025-4094settrunk4/3offnegotiate1-1005,1025-4094settrunk4/4offnegotiate1-1005,1025-4094settrunk4/5offnegotiate1-1005,1025-4094settrunk4/6offnegotiate1-1005,1025-4094settrunk4/7offnegotiate1-1005,1025-4094settrunk4/8offnegotiate1-1005,1025-4094settrunk4/9offnegotiate1-1005,1025-4094settrunk4/10offnegotiate1-1005,1025-4094settrunk4/11offnegotiate1-1005,1025-4094settrunk4/12offnegotiate1-1005,1025-4094settrunk4/13offnegotiate1-1005,1025-4094settrunk4/14offnegotiate1-1005,1025-4094settrunk4/15offnegotiate1-1005,1025-4094settrunk4/16offnegotiate1-1005,1025-4094settrunk4/17offnegotiate1-1005,1025-4094settrunk4/18offnegotiate1-1005,1025-4094settrunk4/19offnegotiate1-1005,1025-4094settrunk4/20offnegotiate1-1005,1025-4094settrunk4/21offnegotiate1-1005,1025-4094settrunk4/22offnegotiate1-1005,1025-4094settrunk4/23offnegotiate1-1005,1025-4094settrunk4/24offnegotiate1-1005,1025-4094settrunk4/25offnegotiate1-1005,1025-4094settrunk4/26offnegotiate1-1005,1025-4094settrunk4/27offnegotiate1-1005,1025-4094settrunk4/28offnegotiate1-1005,1025-4094settrunk4/29offnegotiate1-1005,1025-4094settrunk4/30offnegotiate1-1005,1025-4094settrunk4/31offnegotiate1-1005,1025-4094settrunk4/32offnegotiate1-1005,1025-4094settrunk4/33offnegotiate1-1005,1025-4094settrunk4/34offnegotiate1-1005,1025-4094settrunk4/35offnegotiate1-1005,1025-4094settrunk4/36offnegotiate1-1005,1025-4094settrunk4/37offnegotiate1-1005,1025-4094settrunk4/38offnegotiate1-1005,1025-4094settrunk4/39offnegotiate1-1005,1025-4094settrunk4/40offnegotiate1-1005,1025-4094settrunk4/41offnegotiate1-1005,1025-4094settrunk4/42offnegotiate1-1005,1025-4094settrunk4/43offnegotiate1-1005,1025-4094settrunk4/44offnegotiate1-1005,1025-4094settrunk4/45offnegotiate1-1005,1025-4094settrunk4/46offnegotiate1-1005,1025-4094settrunk4/47offnegotiate1-1005,1025-4094settrunk4/48offnegotiate1-1005,1025-4094setportchannel4/1-48modeoff!#module5:0-portSwitchFabricModule!#module6empty!#module15:1-portMultilayerSwitchFeatureCard!#module16emptyend4.2session156506路由模塊配置!version12.1servicetimestampsdebuguptimeservicetimestampsloguptimenoservicepassword-encryption!hostnamecisco6506_route/定義主機(jī)名/!!ipsubnet-zeroipwccpweb-cachepasswordhziee/起用WCCP協(xié)議/ipcef/定義域名//定義DNS效勞器/!ipmulticast-routing!!!interfaceVlan1ipwccpweb-cacheredirectout/定義WEBIP包的輸出口/!interfaceVlan10/定義VLAN10//定義VLAN10的網(wǎng)關(guān)和子網(wǎng)地址/!interfaceVlan11!interfaceVlan12!interfaceVlan13!interfaceVlan14!interfaceVlan15!interfaceVlan16!interfaceVlan17!interfaceVlan18!interfaceVlan19!interfaceVlan20!interfaceVlan21!interfaceVlan22!interfaceVlan23!interfaceVlan24!interfaceVlan25!interfaceVlan26!interfaceVlan27!interfaceVlan28!interfaceVlan29!interfaceVlan30!interfaceVlan31!interfaceVlan32!interfaceVlan33!interfaceVlan34!interfaceVlan35!interfaceVlan36!interfaceVlan37!interfaceVlan38!interfaceVlan39!interfaceVlan40!interfaceVlan41!interfaceVlan42!interfaceVlan43!interfaceVlan44!interfaceVlan45!interfaceVlan46!interfaceVlan47!interfaceVlan48!interfaceVlan50!interfaceVlan51!interfaceVlan999!routerrip!routerigrp100!ipclasslessnoipserver!!linecon0transportinputnonelinevty04passwordciscologin!end4.3二級(jí)交換機(jī)Catalyst3500以圖書館二級(jí)交換機(jī)為例Currentconfiguration:!version12.0noservicepadservicetimestampsdebuguptimeservicetimestampsloguptimenoservicepassword-encryption!hostnamelib!enablesecret5$1$G3SM$DbzVKE3l/fkYHpoi0XUug/enablepasswordcisco!!ipsubnet-zero!!!interfaceFastEthernet0/1switchportaccessvlan35!interfaceFastEthernet0/2switchportaccessvlan35!interfaceFastEthernet0/3switchportaccessvlan35!interfaceFastEthernet0/4switchportaccessvlan35!interfaceFastEthernet0/5switchportaccessvlan35!interfaceFastEthernet0/6switchportaccessvlan35!interfaceFastEthernet0/7switchportaccessvlan35!interfaceFastEthernet0/8switchportaccessvlan35interfaceFastEthernet0/9switchportaccessvlan35!interfaceFastEthernet0/10switchportaccessvlan35!interfaceFastEthernet0/11switchportaccessvlan35!interfaceFastEthernet0/12switchportaccessvlan35!interfaceFastEthernet0/13switchportaccessvlan35!interfaceFastEthernet0/14switchportaccessvlan35!interfaceFastEthernet0/15switchportaccessvlan35!interfaceFastEthernet0/16switchportaccessvlan35!interfaceFastEthernet0/17switchportaccessvlan35!interfaceFastEthernet0/18switchportaccessvlan35!interfaceFastEthernet0/19switchportaccessvlan35!interfaceFastEthernet0/20switchportaccessvlan35!interfaceFastEthernet0/21switchportaccessvlan35!interfaceFastEthernet0/22switchportaccessvlan35!interfaceFastEthernet0/23switchportaccessvlan35!interfaceFastEthernet0/24switchportaccessvlan35!interfaceGigabitEthernet0/1switchportmodetrunk!interfaceGigabitEthernet0/2!interfaceVLAN1noipdirected-broadcastnoiproute-cache!!linecon0transportinputnonestopbits1linevty04passwordciscologinlinevty515passwordciscologin!endlib#4.4防火墻PIX520配置明細(xì)PIXVersion4.4(7)nameifethernet0outsidesecurity0nameifethernet1insidesecurity100nameifethernet2dmzsecurity50enablepassword2KFQnbNIdI.2KYOUencryptedpasswd2KFQnbNIdI.2KYOUencryptedhostnameciscopix520fixupprotocolftp21fixupprotocol80fixupprotocolh3231720fixupprotocolrsh514fixupprotocolsmtp25fixupprotocolsqlnet1521namespagerlines24loggingonnologgingtimestampnologgingconsolenologgingmonitornologgingbufferedloggingtrapdebuggingloggingfacility20loggingqueue512interfaceethernet0autointerfaceethernet1autointerfaceethernet2automtuoutside1500mtuinside1500mtudmz1500nofailoverfailovertimeout0:00:00arptimeout14400nat(inside)100nat(dmz)000static(dmz,outside)netmask5500static(dmz,outside)11netmask5500static(dmz,outside)88netmask5500static(dmz,outside)00netmask5500static(dmz,outside)22netmask5500static(dmz,outside)33netmask5500static(dmz,outside)5050netmask5500static(dmz,outside)00netmask5500static(dmz,outside)2929netmask5500static(dmz,outsi