1. 题目及要求

1. 内网IP地址172.16.0.0/16合理分配
2. SW1/2之间互为备份
3. VRRP/STP/VLAN/TRYNK均使用
4. 所有PC通过DHCP获取IP地址

配置思路
eth-trunk—＞vlan—＞trunk干道—＞STP—＞SVI—>VRRP—＞DHCP—>配置路由

2. 完成拓扑图

如下图所示

3. eth-trunk

SW1

[sw1]int Eth-Trunk 0
[sw1-Eth-Trunk0]trunkport GigabitEthernet 0/0/2
[sw1-Eth-Trunk0]trunkport GigabitEthernet 0/0/3

SW2

[sw2]int Eth-Trunk 0
[sw2-Eth-Trunk0]trunkport GigabitEthernet 0/0/2
[sw2-Eth-Trunk0]trunkport GigabitEthernet 0/0/3

4.vlan

给各个交换机上配置vlan，由于交换机内部自身携带vlan1，因此这里只需要给每一台交换机配置vlan2即可，并在PC2和PC4上配置vlan接口accss
SW3和SW4同理

[sw3]vlan 2
[sw3-vlan2]q
[sw3]int g0/0/4
[sw3-GigabitEthernet0/0/4]port link-type access
[sw3-GigabitEthernet0/0/4]port default vlan 2

5.配置trunk干道

SW1和SW2同理

[sw1]int g0/0/4
[sw1-GigabitEthernet0/0/4]port link-type trunk
[sw1-GigabitEthernet0/0/4]port trunk allow-pass vlan all
[sw1-GigabitEthernet0/0/4]int g0/0/5                    
[sw1-GigabitEthernet0/0/5]port link-type trunk          
[sw1-GigabitEthernet0/0/5]port trunk allow-pass vlan all
[sw1-GigabitEthernet0/0/5]q 
[sw1]int Eth-Trunk 0
[sw1-Eth-Trunk0]port link-type trunk          
[sw1-Eth-Trunk0]port trunk allow-pass vlan all

SW3和SW4同理

[sw3]int g0/0/1
[sw3-GigabitEthernet0/0/1]port link-type trunk
[sw3-GigabitEthernet0/0/1]port trunk allow-pass vlan all
[sw3-GigabitEthernet0/0/1]int g0/0/2
[sw3-GigabitEthernet0/0/2]port link-type trunk          
[sw3-GigabitEthernet0/0/2]port trunk allow-pass vlan all

6.配置生成树STP

SW1，SW2，SW3，SW4

[sw1]stp enable
[sw1]stp region-configuration 
[sw1-mst-region]region-name a
[sw1-mst-region]instance 1 vlan 1  
[sw1-mst-region]instance 2 vlan 2 
[sw1-mst-region]active region-configuration 

SW1
定义本地为组1 的主根，组2 的备份根

[sw1]stp instance 1 root primary
[sw1]stp instance 2 root secondary

SW2
定义本地为组1 的备份根，组2 的主根

[sw2]stp instance 1 root secondary 
[sw2]stp instance 2 root primary

7. 配置VRRP（在sw1上和sw2上）

SW1

[sw1]interface Vlanif 1
[sw1-Vlanif1]ip address 172.16.1.1 25
[sw1-Vlanif1]vrrp vrid 1 virtual-ip 172.16.1.126
[sw1-Vlanif1]vrrp vrid 1 priority 110
[sw1-Vlanif1]vrrp vrid 1 track interface GigabitEthernet 0/0/1  reduced 50
[sw1-Vlanif1]q
[sw1]interface Vlanif 2
[sw1-Vlanif2]ip address 172.16.1.129 25
[sw1-Vlanif2]vrrp vrid 1 virtual-ip 172.16.1.254

SW2

[sw2]int Vlanif 1
[sw2-Vlanif1]ip address 172.16.1.2 25
[sw2-Vlanif1]vrrp vrid 1 virtual-ip 172.16.1.126
[sw2-Vlanif1]q
[sw2]interface Vlanif 2
[sw2-Vlanif2]ip address 172.16.1.130 25
[sw2-Vlanif2]vrrp vrid 1 virtual-ip 172.16.1.254
[sw2-Vlanif2]vrrp vrid 1 priority 110
[sw2-Vlanif2]vrrp vrid 1 track interface GigabitEthernet 0/0/1 reduced 50

8.配置DHCP

SW1

[sw1]dhcp enable 
[sw1]ip pool v1
[sw1-ip-pool-v1]network 172.16.1.0 mask 25
[sw1-ip-pool-v1]gateway-list 172.16.1.126
[sw1-ip-pool-v1]q
[sw1]ip pool v2
[sw1-ip-pool-v2]network 172.16.1.128 mask 25
[sw1-ip-pool-v2]gateway-list 172.16.1.254
[sw1]int Vlanif 1
[sw1-Vlanif1]dhcp select global 
[sw1-Vlanif1]q
[sw1]int Vlanif 2
[sw1-Vlanif2]dhcp select global

SW2

[sw2]dhcp enable 
[sw2]ip pool v1
[sw2-ip-pool-v1]network 172.16.1.0 mask 25
[sw2-ip-pool-v1]gateway-list 172.16.1.126
[sw2-ip-pool-v1]q
[sw2]ip pool v2
[sw2-ip-pool-v2]network 172.16.1.128 mask 25
[sw2-ip-pool-v2]gateway-list 172.16.1.254
[sw2]int Vlanif 1
[sw2-Vlanif1]dhcp select global 
[sw2-Vlanif1]q
[sw2]int Vlanif 2
[sw2-Vlanif2]dhcp select global 

9. 配置路由

（1）路由器R1配置IP地址。
R2

R1

（2）交换机配置IP地址
因为交换机接口上不能直接配置IP地址，所以创建vlan使用虚拟接口配置
SW1

[sw1]vlan 100
[sw1-vlan100]q
[sw1]int Vlanif 100
[sw1-Vlanif100]ip address 172.16.0.2 30
[sw1-Vlanif100]q
[sw1]int g0/0/1
[sw1-GigabitEthernet0/0/1]port link-type access 
[sw1-GigabitEthernet0/0/1]port default vlan 100

SW2

[sw2]vlan 100
[sw2-vlan100]q
[sw2]int Vlanif 100
[sw2-Vlanif100]ip address 172.16.0.6 30
[sw2-Vlanif100]q
[sw2]int g0/0/1
[sw2-GigabitEthernet0/0/1]port link-type access 
[sw2-GigabitEthernet0/0/1]port default vlan 100

(3)启用RIP，是私网内部可达

[r2]rip 
[r2-rip-1]version 2
[r2-rip-1]network 172.16.0.0

[sw1]rip
[sw1-rip-1]version 2
[sw1-rip-1]network 172.16.0.0

[sw2]rip
[sw2-rip-1]version 2
[sw2-rip-1]network 172.16.0.0

（4）做ACL，使PC内网可以访问公网

[r2]ip route-static 0.0.0.0 0 12.1.1.2 
[r2]acl 2000
[r2-acl-basic-2000]rule permit source 172.16.0.0 0.0.255.255
[r2-acl-basic-2000]q
[r2]int g0/0/0
[r2-GigabitEthernet0/0/0]nat outbound 2000

[sw1]ip route-static 0.0.0.0 0 172.16.0.1 
[sw1]ip route-static 0.0.0.0 0 172.16.0.5

[sw2]ip route-static 0.0.0.0 0 172.16.0.1 
[sw2]ip route-static 0.0.0.0 0 172.16.0.5

10. 验证

关闭SW1检查备份