一、實驗目的：

1. 搭建企業網站，根據實際進行網路拓撲與IP段規劃：
   行政樓：人力資源部【1樓】
   財務部【2樓】
   行政部【3樓】
   生產車間：生產部【1樓】
   採購部【2樓】
2. 只有行政樓各部門通過NAT訪問公網，生產樓各部門只能訪問內網
3. 使用DHCP自動獲取IP

二、實驗裝置：

交換機（二層）、路由器、防火牆
網線若干
電腦5臺

三、實驗步驟：

1. 連線交換機、路由器、防火牆
2. 配置DHCP池，排除預設閘道器
3. 配置防火牆名稱，啟用防火牆結口VLAN
4. 配置NAT轉換：內網到外網
5. 配置ACL：外網到內網

四、實驗拓撲：

五、配置命令：

**交換機**
vlan database
vlan 10
vlan 20
vlan 30
vlan 40
vlan 50

int fa0/1
sw acc vlan 10
exit
int fa0/2
sw acc vlan 20
exit
int fa0/3
sw acc vlan 30
exit
int fa0/4
sw acc vlan 40
exit
int fa0/5
sw acc vlan 50
exit

配置交換機上聯埠
config terminal
interface fa0/24
switchport mode trunk
end

**路由器**
interface
 
 GigabitEthernet0/1.1
encapsulation dot1Q 10
ip address 192.168.1.1 255.255.255.0
exit
interface GigabitEthernet0/1.2
encapsulation dot1Q 20
ip address 192.168.2.1 255.255.255.0
exit
interface GigabitEthernet0/1.3
encapsulation dot1Q 30
ip address 192.168.3.1 255.255.255.0
exit
interface GigabitEthernet0/1.4
encapsulation dot1Q 40
 

ip address 192.168.4.1 255.255.255.0
exit
interface GigabitEthernet0/1.5
encapsulation dot1Q 50
ip address 192.168.5.1 255.255.255.0
exit

配置DHCP
排除預設閘道器
ip dhcp excluded-address 192.168.2.1
ip dhcp excluded-address 192.168.1.1
ip dhcp excluded-address 192.168.1.254
ip dhcp excluded-address 192.168.2.254
ip dhcp excluded-address 192.168.3.1
ip dhcp excluded-address 192.168.4.1
ip dhcp excluded-address 192.168.5.1
ip dhcp excluded-address 192.168.3.254
ip dhcp excluded-address 192.168.4.254
ip dhcp excluded-address 192.168.5.254

配置池
ip dhcp pool pool10
 network 192.168.1.0 255.255.255.0
 default-router 192.168.1.1 

ip dhcp pool pool20
 network 192.168.2.0 255.255.255.0
 default-router 192.168.2.1

ip dhcp pool pool30
 network 192.168.3.0 255.255.255.0
 default-router 192.168.3.1

ip dhcp pool pool40
 network 192.168.4.0 255.255.255.0
 default-router 192.168.4.1

ip dhcp pool pool50
 network 192.168.5.0 255.255.255.0
 default-router 192.168.5.1

#三層交換機使用
ip helper-address *路由器可達的埠* 

**防火牆**
1、防火牆配置名稱
config terminal 
hostname g408-firewall

2、啟用防火牆結口VLAN
#全部埠預設為vlan1，所以劃分的時候不選vlan1
config  terminal
interface vlan 6
no shutdown
nameif inside
security-level 100
ip address 10.6.6.1 255.255.255.0 

interface vlan 13
no shutdown
nameif outside
security-level 0
ip address 10.4.103.5 255.255.255.0
end
write memory

#因為此防火牆不適用於在配置一個DMZ，所以講DMZ配置在內網的一個主機中
###############
interface vlan 70
no shutdown
nameif DMZ
security-level 50
ip address DMZ的ip 255.255.255.0
end
###################

3、配置防火牆埠
config terminal
interface Ethernet0/0
no shutdown
switchport access vlan 6

interface Ethernet0/1
no shutdown
switchport access vlan 13
end
write memory

4、配置NAT轉換：內網到外網
config terminal
nat (inside) 1 0.0.0.0 0.0.0.0
global (outside) 1 210.38.93.0-210.38.93.255 netmask 255.255.255.0
end 
write memory

5、配置ACL：外網到內網
#出允許
config terminal
access-list 102 extended permit ip any any #允許
access-group 102 in interface outside      #入站：由預設的拒絕變為允許
end
write memory

#103為進入拒絕
access-list 103 extended deny ip 192.168.4.0 255.255.255.0 host 192.168.10.10
access-list 103 extended deny ip 192.168.5.0 255.255.255.0 host 192.168.10.10
access-list 103 extended permit ip any any
access-group 103 in interface inside

6、配置路由
config terminal
route outside 0.0.0.0 0.0.0.0 10.4.103.1 1
route inside 192.168.1.0 255.255.255.0 10.6.6.6 1
route inside 192.168.2.0 255.255.255.0 10.6.6.6 1
route inside 192.168.3.0 255.255.255.0 10.6.6.6 1
route inside 192.168.4.0 255.255.255.0 10.6.6.6 1
route inside 192.168.5.0 255.255.255.0 10.6.6.6 1
end
write memory

7、測試
防火牆：
show route
show conn 
show xlate
show local-host
show arp 

路由器：
show ip route
show arp 
show interface ethernet 0/0 
write memory
show running-config
show interfaces ethernet 0/1
ping 10.4.103.1

備註：
sh xlat檢視轉換表
sh route  (防火牆)
sh ip route (路由器)
sh arp   arp表
sh conn  檢視連線資訊
sh access-list 102   檢視ACL資訊

六、實驗結果：

可以使用DHCP自動獲取IP，只有行政樓各部門通過NAT訪問公網，生產樓各部門只能訪問內網。