NE综合实验2：RIP 与 OSPF 动态路由精细配置及ACL访问控制列表 电脑_h3c ne综合实验
NE综合实验2：RIP 与 OSPF 动态路由精细配置及ACL访问控制列表
实验拓扑图
实验需求
1.按照图示配置IP地址
2.按照图示区域划分配置对应的动态路由协议
3.在R7上配置dhcp服务器，能够让pc可以获取IP地址
4.将所有环回⼝宣告进ospf中，将环回⼝7宣告进rip中，将rip路由引⼊ospf
中，ospf路由引⼊rip中
5.要求实现全⽹互通
6.在r3和r6上开启rip的端⼝验证，密码为hyzy
7.在R7上开启rip静默接⼝，要求业务⽹段不允许接收协议报⽂
8.在R5和R4上开启ospf端⼝验证，密码为hyzy
9.要求在R4上配置ftp服务，测试时可以允许所有设备均可登录访问
10.要求在R1上配置telnet服务，测试时可以允许所有设备均可登录访问管理
11.要求拒绝R5访问R1的telnet服务，其他设备均不影响
12.要求拒绝R2访问R4的ftp服务，其他设备均不影响
13.要求拒绝10.1.1.0/24⽹段ping通R1地址
14.要求拒绝10.1.1.1/24地址访问R4地址
15.要求拒绝10.1.1.2/24地址访问R3地址
实验步骤
1 配置IP地址略
2.略
3.在R7上配置dhcp服务器，能够让pc可以获取IP地址
[R7]dhcp enable [R7]dhcp server ip-pool 1[R7-dhcp-pool-1]netbios-type[R7-dhcp-pool-1]network 10.1.1.0 24[R7-dhcp-pool-1]gateway-list 10.1.1.7[R7-dhcp-pool-1]dns-list 114.114.114.114[R7-dhcp-pool-1]expired day 14.将所有环回⼝宣告进ospf中，将环回⼝7宣告进rip中，将rip路由引⼊ospf
中，ospf路由引⼊rip中
在R1R1 ospf1 在area0中宣告R1]ospf 1 router-id 1.1.1.1[R1-ospf-1]ar 0[R1-ospf-1-area-0.0.0.0]network 1.1.1.1 0.0.0.0[R1-ospf-1-area-0.0.0.0]network 10.3.3.0 0.0.0.255[R1-ospf-1-area-0.0.0.0]network 192.168.2.0 0.0.0.255[R1-ospf-1-area-0.0.0.0]network 192.168.1.0 0.0.0.255[R1-ospf-1-area-0.0.0.0]%Jul 14 09:27:32:809 2025 R1 OSPF/5/OSPF_NBR_CHG: OSPF 1 Neighbor 192.168.1.2(GigabitEthernet0/0) changed from LOADING to FULL.%Jul 14 09:29:28:811 2025 R1 OSPF/5/OSPF_NBR_CHG: OSPF 1 Neighbor 192.168.2.3(GigabitEthernet0/1) changed from LOADING to FULL.在R2R2 ospf1 在area0中宣告[R2]ospf 1 router-id 2.2.2.2 [R2-ospf-1]ar 0[R2-ospf-1-area-0.0.0.0]network 2.2.2.2 0.0.0.0[R2-ospf-1-area-0.0.0.0]network 192.168.1.0 0.0.0.255[R2-ospf-1-area-0.0.0.0]network 192.168%Jul 14 09:26:28:606 2025 R2 OSPF/5/OSPF_NBR_CHG: OSPF 1 Neighbor 192.168.1.1(GigabitEthernet0/0) changed from LOADING to FULL.[R2-ospf-1-area-0.0.0.0]network 192.168.3.0 0.0.0.255[R2-ospf-1-area-0.0.0.0]network 100.1.1.0 0.0.0.255[R2-ospf-1-area-0.0.0.0]%Jul 14 09:28:41:649 2025 R2 OSPF/5/OSPF_NBR_CHG: OSPF 1 Neighbor 192.168.3.3(GigabitEthernet0/1) changed from LOADING to FULL.在R3R3 ospf1 在area0中宣告 还有R3也在rip 也需要在rip 宣告[R3]ospf 1 r[R3]ospf 1 router-id 3.3.3.3[R3-ospf-1]ar 0[R3-ospf-1-area-0.0.0.0]network 3.3.3.3 0.0.0.0[R3-ospf-1-area-0.0.0.0]network 192.168.2.0 0.0.0.255[R3-ospf-1-area-0.0.0.0]n%Jul 14 09:31:00:857 2025 R3 OSPF/5/OSPF_NBR_CHG: OSPF 1 Neighbor 192.168.2.1(GigabitEthernet0/0) changed from LOADING to FULL.[R3-ospf-1-area-0.0.0.0]net[R3-ospf-1-area-0.0.0.0]network 192.168.3.0 0.0.0.255[R3-ospf-1-area-0.0.0.0]%Jul 14 09:31:26:127 2025 R3 OSPF/5/OSPF_NBR_CHG: OSPF 1 Neighbor 192.168.3.2(GigabitEthernet0/1) changed from LOADING to FULL.[R3-ospf-1-area-0.0.0.0][R3-ospf-1-area-0.0.0.0][R3-ospf-1-area-0.0.0.0]qu[R3-ospf-1]dis th#ospf 1 router-id 3.3.3.3 area 0.0.0.0 network 3.3.3.3 0.0.0.0 network 192.168.2.0 0.0.0.255 network 192.168.3.0 0.0.0.255#return[R3-ospf-1]qu[R3]rip 1[R3-rip-1]undo summary[R3-rip-1]version 2[R3-rip-1]network 200.1.1.0[R3-rip-1]network 200.2.2.0在R4R4 ospf2 在area0中宣告[R4]ospf 2 router-id 4.4.4.4[R4-ospf-2]area 0[R4-ospf-2-area-0.0.0.0]net[R4-ospf-2-area-0.0.0.0]network 4.4.4.4 0.0.0.0[R4-ospf-2-area-0.0.0.0]net[R4-ospf-2-area-0.0.0.0]network 100.3.3.0 0.0.0.255[R4-ospf-2-area-0.0.0.0]net[R4-ospf-2-area-0.0.0.0]network 172.16.3.0 0.0.0.255[R4-ospf-2-area-0.0.0.0]network 172.16.1.0 0.0.0.255[R4-ospf-2-area-0.0.0.0]%Jul 14 09:35:40:774 2025 R4 OSPF/5/OSPF_NBR_CHG: OSPF 2 Neighbor 172.16.1.5(GigabitEthernet0/1) changed from LOADING to FULL.%Jul 14 09:39:36:773 2025 R4 OSPF/5/OSPF_NBR_CHG: OSPF 2 Neighbor 172.16.3.6(GigabitEthernet0/0) changed from LOADING to FULL.在R5R5 ospf2 在area0中宣告[R5]ospf 2 r[R5]ospf 2 router-id 5.5.5.5[R5-ospf-2]area 0[R5-ospf-2-area-0.0.0.0]net[R5-ospf-2-area-0.0.0.0]network 5.5.5.5 0.0.0.0[R5-ospf-2-area-0.0.0.0]net[R5-ospf-2-area-0.0.0.0]network 172.16.1.0 0.0.0.255[R5-ospf-2-area-0.0.0.0]net[R5-ospf-2-area-0.0.0.0]network 172.16.2.0 0.0%Jul 14 09:35:49:190 2025 R5 OSPF/5/OSPF_NBR_CHG: OSPF 2 Neighbor 172.16.1.4(GigabitEthernet0/0) changed from LOADING to FULL.network 172.16.1.0 0.0.0.255[R5-ospf-2-area-0.0.0.0]network 172.16.2.0 0.0.0.255[R5-ospf-2-area-0.0.0.0]network 100.2.2.0 0.0.0.255在R6R6 ospf2 在area0中宣告 还有R6也在rip 也需要在rip 宣告[R6]ospf 2 router-id 6.6.6.6[R6-ospf-2]ar 0[R6-ospf-2-area-0.0.0.0]net[R6-ospf-2-area-0.0.0.0]network 6.6.6.6 0.0.0.0[R6-ospf-2-area-0.0.0.0]net[R6-ospf-2-area-0.0.0.0]network 172.16.3.0 0.0.0.255[R6-ospf-2-area-0.0.0.0]net[R6-ospf-2-area-0.0.0.0]network 172.16.%Jul 14 09:39:39:157 2025 R6 OSPF/5/OSPF_NBR_CHG: OSPF 2 Neighbor 172.16.3.4(GigabitEthernet0/2) changed from LOADING to FULL.network 172.16.3.0 0.0.0.255[R6-ospf-2-area-0.0.0.0]ne[R6-ospf-2-area-0.0.0.0]network 172.16.2.0 0.0.0.255[R6-ospf-2-area-0.0.0.0]%Jul 14 09:40:04:693 2025 R6 OSPF/5/OSPF_NBR_CHG: OSPF 2 Neighbor 172.16.2.5(GigabitEthernet5/0) changed from LOADING to FULL.[R6-ospf-2-area-0.0.0.0][R6-ospf-2-area-0.0.0.0]di th# area 0.0.0.0 network 6.6.6.6 0.0.0.0 network 172.16.2.0 0.0.0.255 network 172.16.3.0 0.0.0.255#return[R6-ospf-2-area-0.0.0.0]qu[R6-ospf-2]qu[R6]rip 1[R6-rip-1]undo summary[R6-rip-1]version 2[R6-rip-1]network 200.1.1.0 [R6-rip-1]network 200.3.3.0[R6-rip-1]在R7R7 ospf1 ospf2 在area0中宣告 还有R7也在rip 也需要在rip 宣告[R7]ospf 1[R7-ospf-1]ar 0[R7-ospf-1-area-0.0.0.0]net[R7-ospf-1-area-0.0.0.0]network 100.1.1.0 0.0.0.255[R7-ospf-1-area-0.0.0.0]qu[R7-ospf-1]qu[R7]ospf 2[R7-ospf-2]%Jul 14 11:04:23:832 2025 R7 OSPF/5/OSPF_NBR_CHG: OSPF 1 Neighbor 100.1.1.2(GigabitEthernet0/2) changed from LOADING to FULL.[R7-ospf-2]ar 0[R7-ospf-2-area-0.0.0.0]net[R7-ospf-2-area-0.0.0.0]network 100.2.2.0 0.0.0.255[R7-ospf-2-area-0.0.0.0]qu[R7-ospf-2]qu[R7]%Jul 14 11:04:54:628 2025 R7 OSPF/5/OSPF_NBR_CHG: OSPF 2 Neighbor 100.2.2.5(GigabitEthernet5/0) changed from LOADING to FULL.[R7]rip 1[R7-rip-1]undo summary[R7-rip-1]version [R7-rip-1]network 7.7.7.7[R7-rip-1]network 200.2.2.0[R7-rip-1]network 200.3.3.05.要求实现全⽹互通
分析 要实现全网互通 需要R3 6 7相互引路
在R3[R3-rip-1]import-route ospf 1[R3-ospf-1]import-route rip 1在R6[R6-ospf-2]import-route rip 1[R6-rip-1]import-route ospf 2在R7[R7-rip-1]import-route ospf 1[R7-rip-1]import-route ospf 2[R7-rip-1]qu[R7]ospf 1[R7-ospf-1]import-route rip 1[R7-ospf-1]qu[R7]ospf 2[R7-ospf-2]import-route rip 1[R7-ospf-2]qu6.在r3和r6上开启rip的端⼝验证，密码为hyzy
在R3[R3]int g5/0[R3-GigabitEthernet5/0]rip authentication-mode simple plain hyzy在R6[R6]int g0/1[R6-GigabitEthernet0/1]rip authentication-mode simple plain hyzy7.在R7上开启rip静默接⼝，要求业务⽹段不允许接收协议报⽂
[R7]rip 1[R7-rip-1]silent-interface g5/18.在R5和R4上开启ospf端⼝验证，密码为hyzy
在R5[R5]int g0/0[R5-GigabitEthernet0/0]ospf authentication-mode simple plain hyzy[R5-GigabitEthernet0/0]%Jul 14 11:28:16:526 2025 R5 OSPF/5/OSPF_NBR_CHG: OSPF 2 Neighbor 172.16.1.4(GigabitEthernet0/0) changed from FULL to DOWN.%Jul 14 11:29:46:220 2025 R5 OSPF/5/OSPF_NBR_CHG: OSPF 2 Neighbor 172.16.1.4(GigabitEthernet0/0) changed from LOADING to FULL.在R4[R4]int g0/1[R4-GigabitEthernet0/1]ospf authentication-mode simple plain hyzy[R4-GigabitEthernet0/1]%Jul 14 11:29:10:770 2025 R4 OSPF/5/OSPF_NBR_CHG: OSPF 2 Neighbor 172.16.1.5(GigabitEthernet0/1) changed from LOADING to FULL9.要求在R4上配置ftp服务，测试时可以允许所有设备均可登录访问
[R4]ftp server enable [R4]local-user ssz class manage New local user added.[R4-luser-manage-ssz]password simple 123456.com[R4-luser-manage-ssz]service-type ftp[R4-luser-manage-ssz]authorization-attribute user-role level-1510.要求在R1上配置telnet服务，测试时可以允许所有设备均可登录访问管理
[R1]telnet server enable [R1]local-user ssz class manage [R1-luser-manage-ssz]password simple 123456.com[R1-luser-manage-ssz]service-type telnet[R1-luser-manage-ssz]authorization-attribute user-role level-15[R1]user-interface vty 0 4[R1-line-vty0-4]authentication-mode scheme[R1-line-vty0-4]user-role level-1511.要求拒绝R5访问R1的telnet服务，其他设备均不影响
分析：R5拒绝R1的telnet服务的访问
在R1[R1]acl advanced 3000[R1-acl-ipv4-adv-3000]rule deny tcp source 172.16.1.5 0 destination-port eq telnet[R1-acl-ipv4-adv-3000]rule deny tcp source 172.16.2.5 0 destination-port eq telnet[R1-acl-ipv4-adv-3000]rule deny tcp source 100.2.2.5 0 destination-port eq telnet[R1-acl-ipv4-adv-3000]rule deny tcp source 5.5.5.5 0 destination-port eq telnet[R1]interface range g0/0 to g0/2[R1-if-range]packet-filter 3000 inboundtelnet 1.1.1.1Trying 1.1.1.1 ...Press CTRL+K to abortConnected to 1.1.1.1 ...Failed to connect to the remote host! 12.要求拒绝R2访问R4的ftp服务，其他设备均不影响
在R4[R4]acl advanced 3000[R4-acl-ipv4-adv-3000]rule deny tcp source 100.1.1.2 0 destination-port eq ftp[R4-acl-ipv4-adv-3000]rule deny tcp source 192.168.3.2 0 destination-port eq ftp[R4-acl-ipv4-adv-3000]rule deny tcp source 192.168.1.2 0 destination-port eq ftp[R4-acl-ipv4-adv-3000]rule deny tcp source 2.2.2.2 0 destination-port eq ftp[R4]interface range g0/0 to g0/2[R4-if-range]packet-filter 3000 inbound ftp 4.4.4.4Press CTRL+C to abort.13.要求拒绝10.1.1.0/24⽹段ping通R1地址
在R7[R7]acl advanced 3000[R7-acl-ipv4-adv-3000]rule deny icmp source 10.1.1.0 0.0.0.255 destination 1.1.1.1 0[R7-acl-ipv4-adv-3000]rule deny icmp source 10.1.1.0 0.0.0.255 destination 100.3.3.1 0[R7-acl-ipv4-adv-3000]rule deny icmp source 10.1.1.0 0.0.0.255 destination 172.168.3.1 0[R7-acl-ipv4-adv-3000]rule deny icmp source 10.1.1.0 0.0.0.255 d[R7-acl-ipv4-adv-3000]rule deny icmp source 10.1.1.0 0.0.0.255 destination 172.168.1.1 0[R7]int g5/1[R7-GigabitEthernet5/1]packet-filter 3000 inbound 在PC9上ping 1.1.1.1Ping 1.1.1.1 (1.1.1.1): 56 data bytes, press CTRL_C to breakRequest time outRequest time outRequest time outRequest time outRequest time out--- Ping statistics for 1.1.1.1 ---5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss%Jul 14 14:46:25:861 2025 H3C PING/6/PING_STATISTICS: Ping statistics for 1.1.1.1: 5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss.ping 100.3.3.1Ping 100.3.3.1 (100.3.3.1): 56 data bytes, press CTRL_C to breakRequest time outRequest time outRequest time outRequest time outRequest time out--- Ping statistics for 100.3.3.1 ---5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss%Jul 14 14:46:43:980 2025 H3C PING/6/PING_STATISTICS: Ping statistics for 100.3.3.1: 5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss.ping 192.168.1.1Ping 192.168.1.1 (192.168.1.1): 56 data bytes, press CTRL_C to breakRequest time outRequest time outRequest time outRequest time outRequest time out--- Ping statistics for 192.168.1.1 ---5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss%Jul 14 14:47:00:810 2025 H3C PING/6/PING_STATISTICS: Ping statistics for 192.168.1.1: 5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss.ping 192.168.2.1Ping 192.168.2.1 (192.168.2.1): 56 data bytes, press CTRL_C to breakRequest time outRequest time outRequest time outRequest time outRequest time out--- Ping statistics for 192.168.2.1 ---5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss%Jul 14 14:47:15:232 2025 H3C PING/6/PING_STATISTICS: Ping statistics for 192.168.2.1: 5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss.但R1能ping通PC9ping 10.1.1.2Ping 10.1.1.2 (10.1.1.2): 56 data bytes, press CTRL+C to break56 bytes from 10.1.1.2: icmp_seq=0 ttl=252 time=3.080 ms56 bytes from 10.1.1.2: icmp_seq=1 ttl=252 time=2.399 ms56 bytes from 10.1.1.2: icmp_seq=2 ttl=252 time=2.930 ms56 bytes from 10.1.1.2: icmp_seq=3 ttl=252 time=2.656 ms56 bytes from 10.1.1.2: icmp_seq=4 ttl=252 time=2.184 ms--- Ping statistics for 10.1.1.2 ---5 packet(s) transmitted, 5 packet(s) received, 0.0% packet lossround-trip min/avg/max/std-dev = 2.184/2.650/3.080/0.330 ms%Jul 14 15:23:37:341 2025 R1 PING/6/PING_STATISTICS: Ping statistics for 10.1.1.2: 5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss, round-trip min/avg/max/std-dev = 2.184/2.650/3.080/0.330 ms.14.要求拒绝10.1.1.1/24地址访问R4地址
[R7-acl-ipv4-adv-3000]rule deny icmp source 10.1.1.1 0 destination 4.4.4.4 0[R7-acl-ipv4-adv-3000]rule deny icmp source 10.1.1.1 0 destination 172.16.1.4 0[R7-acl-ipv4-adv-3000]rule deny icmp source 10.1.1.1 0 destination 172.16.3.4 0[R7-acl-ipv4-adv-3000]rule deny icmp source 10.1.1.1 0 destination 100.3.3.4 0ping 4.4.4.4Ping 4.4.4.4 (4.4.4.4): 56 data bytes, press CTRL_C to breakRequest time outRequest time outRequest time outRequest time outRequest time out--- Ping statistics for 4.4.4.4 ---5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss%Jul 14 15:48:57:588 2025 H3C PING/6/PING_STATISTICS: Ping statistics for 4.4.4.4: 5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss.15.要求拒绝10.1.1.2/24地址访问R3地址
[R7-acl-ipv4-adv-3000]rule deny icmp source 10.1.1.2 0 destination 3.3.3.3 0[R7-acl-ipv4-adv-3000]rule deny icmp source 10.1.1.2 0 destination 192.168.2.3 0[R7-acl-ipv4-adv-3000]rule deny icmp source 10.1.1.2 0 destination 192.168.3.3 0[R7-acl-ipv4-adv-3000]rule deny icmp source 10.1.1.2 0 destination 200.1.1.3 0[R7-acl-ipv4-adv-3000]rule deny icmp source 10.1.1.2 0 destination 200.2.2.3 0Ping 3.3.3.3 (3.3.3.3): 56 data bytes, press CTRL_C to breakRequest time outRequest time outRequest time outRequest time outRequest time out--- Ping statistics for 3.3.3.3 ---5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss%Jul 14 18:03:04:959 2025 H3C PING/6/PING_STATISTICS: Ping statistics for 3.3.3.3: 5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss.
