实验要求：
1、R6为ISP，接口IP地址均为公有地址，该设备只能配置IP地址，之后不能再对其进行任何配置；
2、R1-R5为局域网，私有IP地址192.168.1.0/24，请合理分配；
3、R1、R2、R4，各有两个环回IP地址；R5,R6各有一个环回地址；所有路由器上环回均代表连接用户的接口；
4、R3下面的两台PC通过DHCP自动获取IP地址；
5、选路最佳，路由表尽量小，避免环路；
6、R1-R5均可以访问R6的环回；
7、R6 telnet R5的公有地址时，实际登录到R1上；
8、R4与R5正常通过1000M链路，故障时通过100m链路
实验思路：
1. IP划分和设备上IP怎么配
• 我们把 192.168.1.0/24 这一大网段划成六块来用，既方便管理，又好汇总。
• 骨干链路（6 条点对点链路）就用 192.168.1.0/27 这段，再细分成 6 个／30，小网段里正好两个可用地址，省地址还够用：
• 192.168.1.0/30、.4/30、.8/30、.12/30、.16/30、.20/30
• R1 的两个环回口给 192.168.1.32/27，先切成两个／28：32/28 当 L0，48/28 当 L1。
• R2、R4、R5 的环回也是同套路：
• R2：64/27 → 64/28、80/28
• R4：128/27 → 128/28、144/28
• R5：160/27 → （同样切两个／28）
2. DHCP 设置
• 在 R3 下挂两台 PC，让它们通过 DHCP 自动拿 IP，免得手工一个个敲。
3. 静态路由
• 除了去 192.168.1.0/24 的路由不配，其他子网之间都用静态路由互相打通。
4. 默认路由和 NAT
• 在各路由器上配个缺省路由，保证能到 192.168.1.0/24，内网就能互通了。
• 在 R5 上开 NAT，用 easy ip 发布上公网，这样全网都能上了。
5. 路由优化
• 汇总路由、防环、黑洞路由都要配上，网络更稳更安全。
6. 备份链路
• 通过改路由优先级做备份，主链路挂了自动走备份。
7. 测试故障切换
• 故意把 1000 Mb/s 链路断开，看看流量能不能掉到 100 Mb/s 的备用链路上。
8. Telnet 与 NAT Server
• 用户从 R6 用 Telnet 打 R5 的公网地址，实际会被 NAT 到 R1 上。在 R1 上开启 Telnet 服务，通过 NAT Server 功能把它映射到 R5 公网口，就能远程登录了。
实验配置￥：
ip配置
[R1]interface GigabitEthernet0/0/0
[R1-GigabitEthernet0/0/0]ip address 192.168.1.1 30
[R1-GigabitEthernet0/0/0]interface g0/0/1
[R1-GigabitEthernet0/0/1]ip address 192.168.1.5 30
[R1]interface LoopBack0
[R1-LoopBack0]ip address 192.168.1.33 28
[R1-LoopBack0]interface LoopBack 1
[R1-LoopBack1]ip address 192.168.1.49 28
[R2]interface GigabitEthernet0/0/0
[R2-GigabitEthernet0/0/0]ip address 192.168.1.2 30
[R2-GigabitEthernet0/0/0]interface g0/0/1
[R2-GigabitEthernet0/0/1]ip address 192.168.1.9 30
[R2]interface LoopBack 0
[R2-LoopBack0]ip add 192.168.1.65 28
[R2-LoopBack0]interface LoopBack 1
[R2-LoopBack1]ip address 192.168.1.81 28
[R3]int GigabitEthernet0/0/0
[R3-GigabitEthernet0/0/0]ip address 192.168.1.6 30
[R3-GigabitEthernet0/0/0]interface g0/0/1
[R3-GigabitEthernet0/0/1]ip address 192.168.1.13 30
[R3]interface GigabitEthernet0/0/2
[R3-GigabitEthernet0/0/2]ip add 192.168.1.97 27
[R4]interface g0/0/0
[R4-GigabitEthernet0/0/0]ip address 192.168.1.10 30
[R4-GigabitEthernet0/0/0]int g0/0/1
[R4-GigabitEthernet0/0/1]ip address 192.168.1.14 30
[R4]interface g0/0/2
[R4-GigabitEthernet0/0/2]ip address 192.168.1.17 30
[R4-GigabitEthernet0/0/2]int g4/0/0
[R4-GigabitEthernet4/0/0]ip address 192.168.1.21 30
[R4]interface LoopBack 0
[R4-LoopBack0]ip address 192.168.1.129 28
[R4-LoopBack0]int LoopBack 1
[R4-LoopBack1]ip address 192.168.1.145 28
[R5]interface g0/0/0
[R5-GigabitEthernet0/0/0]ip address 192.168.1.18 30
[R5-GigabitEthernet0/0/0]int g0/0/2
[R5-GigabitEthernet0/0/2]ip address 192.168.1.22 30
[R5]interface g0/0/1
[R5-GigabitEthernet0/0/1]ip address 12.0.0.5 24
[R5]interface LoopBack 0
[R5-LoopBack0]ip address 192.168.1.161 27
[R6]interface g0/0/0
[R6-GigabitEthernet0/0/0]ip add 12.0.0.6 24
[R6]interface LoopBack 0
[R6-LoopBack0]ip address 1.0.0.6 24DHCP配置
[R3]dhcp enable
[R3]ip pool aa
[R3-ip-pool-aa]network 192.168.1.96 mask 27
[R3-ip-pool-aa]gateway-list 192.168.1.97
[R3-ip-pool-aa]dns-list 114.114.114.114 8.8.8.8
[R3-ip-pool-aa]quit
[R3]int g0/0/2
[R3-GigabitEthernet0/0/2]dhcp select global静态路由配置
[R1]ip route-static 192.168.1.64 27 192.168.1.2
[R1]ip route-static 192.168.1.8 30 192.168.1.2
[R1]ip route-static 192.168.1.96 27 192.168.1.6
[R1]ip route-static 192.168.1.12 30 192.168.1.6
[R1]ip route-static 192.168.1.16 30 192.168.1.2
[R1]ip route-static 192.168.1.20 30 192.168.1.2
[R1]ip route-static 192.168.1.16 30 192.168.1.6
[R1]ip route-static 192.168.1.20 30 192.168.1.6
[R1]ip route-static 192.168.1.128 30 192.168.1.6
[R1]ip route-static 192.168.1.128 30 192.168.1.2
[R1]ip route-static 192.168.1.160 27 192.168.1.2
[R1]ip route-static 192.168.1.160 27 192.168.1.6
[R2]ip route-static 192.168.1.128 27 192.168.1.10
[R2]ip route-static 192.168.1.16 30 192.168.1.10
[R2]ip route-static 192.168.1.20 30 192.168.1.10
[R2]ip route-static 192.168.1.12 30 192.168.1.10
[R2]ip route-static 192.168.1.96 27 192.168.1.10
[R2]ip route-static 192.168.1.96 27 192.168.1.1
[R2]ip route-static 192.168.1.4 30 192.168.1.1
[R2]ip route-static 192.168.1.32 27 192.168.1.1
[R2]ip route-static 192.168.1.160 27 192.168.1.10
[R3]ip route-static 192.168.1.32 27 192.168.1.5
[R3]ip route-static 192.168.1.0 30 192.168.1.5
[R3]ip route-static 192.168.1.64 27 192.168.1.5
[R3]ip route-static 192.168.1.64 27 192.168.1.14
[R3]ip route-static 192.168.1.8 30 192.168.1.14
[R3]ip route-static 192.168.1.128 27 192.168.1.14
[R3]ip route-static 192.168.1.16 30 192.168.1.14
[R3]ip route-static 192.168.1.20 30 192.168.1.14
[R3]ip route-static 192.168.1.160 27 192.168.1.14
[R4]ip route-static 192.168.1.64 27 192.168.1.9
[R4]ip route-static 192.168.1.0 30 192.168.1.9
[R4]ip route-static 192.168.1.32 27 192.168.1.9
[R4]ip route-static 192.168.1.32 27 192.168.1.13
[R4]ip route-static 192.168.1.4 30 192.168.1.13
[R4]ip route-static 192.168.1.96 27 192.168.1.13
[R4]ip route-static 192.168.1.160 27 192.168.1.18
[R4]ip route-static 192.168.1.160 27 192.168.1.22
[R5]ip route-static 192.168.1.128 27 192.168.1.17
[R5]ip route-static 192.168.1.96 27 192.168.1.17
[R5]ip route-static 192.168.1.4 30 192.168.1.17
[R5]ip route-static 192.168.1.32 27 192.168.1.17
[R5]ip route-static 192.168.1.0 30 192.168.1.17
[R5]ip route-static 192.168.1.64 27 192.168.1.17
[R5]ip route-static 192.168.1.8 30 192.168.1.17
[R5]ip route-static 192.168.1.12 30 192.168.1.17
[R5]ip route-static 192.168.1.128 27 192.168.1.21
[R5]ip route-static 192.168.1.96 27 192.168.1.21
[R5]ip route-static 192.168.1.4 30 192.168.1.21
[R5]ip route-static 192.168.1.32 27 192.168.1.21
[R5]ip route-static 192.168.1.0 30 192.168.1.21
[R5]ip route-static 192.168.1.64 27 192.168.1.21
[R5]ip route-static 192.168.1.8 30 192.168.1.21
[R5]ip route-static 192.168.1.12 30 192.168.1.21内网ping通测试
[R1]ping 192.168.1.18
PING 192.168.1.18: 56 data bytes, press CTRL_C to break
Reply from 192.168.1.18: bytes=56 Sequence=1 ttl=254 time=3 ms
Reply from 192.168.1.18: bytes=56 Sequence=2 ttl=254 time=2 ms
Reply from 192.168.1.18: bytes=56 Sequence=3 ttl=254 time=2 ms
Reply from 192.168.1.18: bytes=56 Sequence=4 ttl=254 time=2 ms
Reply from 192.168.1.18: bytes=56 Sequence=5 ttl=254 time=2 ms
--- 192.168.1.18 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 2/2/3 ms[R1]ping 192.168.1.161
PING 192.168.1.161: 56 data bytes, press CTRL_C to break
Reply from 192.168.1.161: bytes=56 Sequence=1 ttl=253 time=4 ms
Reply from 192.168.1.161: bytes=56 Sequence=2 ttl=253 time=3 ms
Reply from 192.168.1.161: bytes=56 Sequence=3 ttl=253 time=3 ms
Reply from 192.168.1.161: bytes=56 Sequence=4 ttl=253 time=3 ms
Reply from 192.168.1.161: bytes=56 Sequence=5 ttl=253 time=3 ms
--- 192.168.1.161 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 3/3/4 ms[R4]ping 12.0.0.5
PING 12.0.0.5: 56 data bytes, press CTRL_C to break
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
Request timeout for icmp_seq 3
Request timeout for icmp_seq 4
Request timeout for icmp_seq 5
--- 12.0.0.5 ping statistics ---
5 packet(s) transmitted
0 packet(s) received
100.00% packet lossPS:此时表明内网实现了全网通
全网通配置
配置缺省
[R1]ip route-static 0.0.0.0 0 192.168.1.2
[R1]ip route-static 0.0.0.0 0 192.168.1.6
[R2]ip route-static 0.0.0.0 0 192.168.1.10
[R3]ip route-static 0.0.0.0 0 192.168.1.14
[R4]ip route-static 0.0.0.0 0 192.168.1.18
[R4]ip route-static 0.0.0.0 0 192.168.1.22
[R5]ip route-static 0.0.0.0 0 12.0.0.6R5上配置nat
[R5]acl 2000
[R5-acl-basic-2000]rule permit source 192.168.1.0 0.0.0.255
[R5-acl-basic-2000]int g0/0/1
[R5-GigabitEthernet0/0/1]nat outbound 2000全网通测试
[R2]ping 1.0.0.6
PING 1.0.0.6: 56 data bytes, press CTRL_C to break
Reply from 1.0.0.6: bytes=56 Sequence=1 ttl=251 time=5 ms
Reply from 1.0.0.6: bytes=56 Sequence=2 ttl=251 time=5 ms
Reply from 1.0.0.6: bytes=56 Sequence=3 ttl=251 time=4 ms
Reply from 1.0.0.6: bytes=56 Sequence=4 ttl=251 time=4 ms
Reply from 1.0.0.6: bytes=56 Sequence=5 ttl=251 time=4 ms
--- 1.0.0.6 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 4/4/5 ms
[R5]ping 1.0.0.6
PING 1.0.0.6: 56 data bytes, press CTRL_C to break
Reply from 1.0.0.6: bytes=56 Sequence=1 ttl=254 time=1 ms
Reply from 1.0.0.6: bytes=56 Sequence=2 ttl=254 time=1 ms
Reply from 1.0.0.6: bytes=56 Sequence=3 ttl=254 time=1 ms
Reply from 1.0.0.6: bytes=56 Sequence=4 ttl=254 time=1 ms
Reply from 1.0.0.6: bytes=56 Sequence=5 ttl=254 time=1 ms
--- 1.0.0.6 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 1/1/1 ms
[R4]ping -a 192.168.1.10 1.0.0.6
PING 1.0.0.6: 56 data bytes, press CTRL_C to break
Reply from 1.0.0.6: bytes=56 Sequence=1 ttl=252 time=4 ms
Reply from 1.0.0.6: bytes=56 Sequence=2 ttl=252 time=3 ms
Reply from 1.0.0.6: bytes=56 Sequence=3 ttl=252 time=3 ms
Reply from 1.0.0.6: bytes=56 Sequence=4 ttl=252 time=3 ms
Reply from 1.0.0.6: bytes=56 Sequence=5 ttl=252 time=3 ms
--- 1.0.0.6 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 3/3/4 ms
[R5]ping -a 192.168.1.161 1.0.0.6
PING 1.0.0.6: 56 data bytes, press CTRL_C to break
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
Request timeout for icmp_seq 3
Request timeout for icmp_seq 4
Request timeout for icmp_seq 5
--- 1.0.0.6 ping statistics ---
5 packet(s) transmitted
0 packet(s) received
100.00% packet loss
[R5]ping -a 192.168.1.122 1.0.0.6
PING 1.0.0.6: 56 data bytes, press CTRL_C to break
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
Request timeout for icmp_seq 3
Request timeout for icmp_seq 4
Request timeout for icmp_seq 5
--- 1.0.0.6 ping statistics ---
5 packet(s) transmitted
0 packet(s) received
100.00% packet lossNAT 只认从“公网出口口”（比如 G0/0/1）发出的流量。你要从别的地址发，比如 Loopback，NAT 不认，那就等于白发，ping 肯定失败
黑洞路由配置
[R1]ip route-static 192.168.1.32 27 NULL 0
[R2]ip route-static 192.168.1.64 27 NULL 0
[R4]ip route-static 192.168.1.128 27 NULL 0备份
[R4]ip route-static 0.0.0.0 0 192.168.1.22 preference 61
[R5]ip route-static 192.168.1.0 255.255.255.252 192.168.1.21 preference 61
[R5]ip route-static 192.168.1.4 255.255.255.252 192.168.1.21 preference 61
[R5]ip route-static 192.168.1.8 255.255.255.252 192.168.1.21 preference 61
[R5]ip route-static 192.168.1.12 255.255.255.252 192.168.1.21 preference 61
[R5]ip route-static 192.168.1.32 255.255.255.224 192.168.1.21 preference 61
[R5]ip route-static 192.168.1.64 255.255.255.224 192.168.1.21 preference 61
[R5]ip route-static 192.168.1.96 255.255.255.224 192.168.1.21 preference 61
[R5]ip route-static 192.168.1.128 255.255.255.224 192.168.1.21 preference 61R6 telnet R5的公有地址时，实际登录到R1上
[R1-aaa]local-user wangdaye password cipher wdy12345 privilege level 15
[R1-aaa]local-user wangdaye service-type telnet
[R1]user-interface vty 0 4
[R1-ui-vty0-4]authentication-mode aaa
[R5]int g0/0/1
[R5-GigabitEthernet0/0/1]nat server protocol tcp global current-interface 23 inside 192.168.1.1 23
Warning:The port 23 is well-known port. If you continue it may cause function fa
ilure.
Are you sure to continue?[Y/N]:y[R6]telnet 12.0.0.5
Trying 12.0.0.5 ...
Press CTRL+_ to quit
Connected to 12.0.0.5 ...
Login authentication
Username: admin
Password:
<R1>