一、项目概述本项目模拟中小型校园局域网综合组网场景整体网络由出口核心层、校园骨干层、园区交换层、接入层、无线 AP 层组成。网络左侧模拟教学院系网络右侧模拟行政部门网络通过出口路由器、防火墙、互联网云环境和外网服务器实现内网互联互通、无线接入、外网访问、服务器资源访问和基本安全隔离。二、整体拓扑与设备清单2.1 拓扑结构全网自上而下分为出口核心层、园区网关层、汇聚层、接入层四级架构出口核心层AR10 主出口路由器、FW1 防火墙、Cloud2 模拟互联网、Server2 外网业务服务器AR10 上连防火墙与外网服务器向下分别对接 AR8、AR9 两台园区网关路由器。园区网关层AR8 作为左片区网关路由器下联汇聚交换机 LSW18AR9 作为右片区网关路由器下联汇聚交换机 LSW19AR8 与 AR9 之间直连互联做冗余备份同时双上联至 AR10规避单链路故障断网问题。汇聚层LSW18、LSW19 两台汇聚交换机分别承接下方所有接入交换机二层转发同时旁挂 AP1、AP2 提供无线网络覆盖。接入层LSW8~LSW12、LSW13~LSW17 共 10 台接入交换机每台接入交换机下联一台 PC 终端每台终端独立划分专属业务 VLAN对应校园不同院系与职能部门。2.2 设备明细路由器AR10、AR8、AR9 交换机LSW18、LSW19、LSW8、LSW9、LSW10、LSW11、LSW12、LSW13、LSW14、LSW15、LSW16、LSW17 防火墙FW1 终端设备PC8~PC17、AP1、AP2 外网设备Server2、Cloud2三、VLAN 与 IP 地址详细规划3.1 业务 VLAN 分配表表格VLAN 编号对应终端所属部门网段地址网关地址网关设备VLAN 10PC81 系192.168.10.0/24192.168.10.254AR8VLAN 20PC92 系192.168.20.0/24192.168.20.254AR8VLAN 30PC103 系192.168.30.0/24192.168.30.254AR8VLAN 40PC114 系192.168.40.0/24192.168.40.254AR8VLAN 50PC125 系192.168.50.0/24192.168.50.254AR8VLAN 60PC136 系192.168.60.0/24192.168.60.254AR9VLAN 70PC14数理部192.168.70.0/24192.168.70.254AR9VLAN 80PC15马院192.168.80.0/24192.168.80.254AR9VLAN 90PC16学工部192.168.90.0/24192.168.90.254AR9VLAN 100PC17财务部192.168.100.0/24192.168.100.254AR93.2 设备互联网段规划AR10 - Server210.0.12.0/24AR10 接口 IP10.0.12.1Server2 地址10.0.12.2AR10 - AR810.0.18.0/24AR1010.0.18.1AR810.0.18.8AR10 - AR910.0.19.0/24AR1010.0.19.1AR910.0.19.9AR8 - AR910.0.89.0/24AR810.0.89.8AR910.0.89.9AR10 - FW110.0.1f.0/24AR1010.0.1f.1FW1 内网口10.0.1f.2FW1 - Cloud2公网网段 202.103.1.0/24FW1 外网口202.103.1.1四、全网核心技术方案二层交换技术接入交换机下联 PC 接口配置 Access 模式划入对应 VLAN接入交换机上联汇聚交换机、汇聚交换机上联网关路由器接口全部配置 Trunk 模式放行所有业务 VLAN实现二层跨设备 VLAN 转发。三层单臂路由AR8、AR9 通过子接口 802.1Q 封装终结所有 VLAN 网关完成不同 VLAN 之间三层转发。动态路由协议全网启用 OSPF 单区域路由协议所有内网网段、设备互联网段全部宣告进 OSPF 进程实现全网路由自动学习无需手动配置静态路由。链路冗余设计AR8、AR9 双上联 AR10同时两台路由器直连建立备份路由主链路断开后 OSPF 自动切换备用链路保证网络不中断。边界安全与 NATFW1 划分 Trust 内网区域、Untrust 外网区域配置源 NAT 策略实现内网所有网段访问互联网配置域间安全策略管控网段访问权限可针对财务部 VLAN100 限制外网访问权限。无线接入LSW18、LSW19 接入 AP 设备上联接口透传管理 VLAN 与业务 VLAN实现无线终端接入校园内网后续可新增 AC 控制器完成 Fit AP 统一管理。五、逐设备详细配置命令5.1 接入交换机配置LSW8~LSW17LSW8VLAN10vlan batch 10 interface GigabitEthernet 0/0/1 port link-type access port default vlan 10 interface Ethernet 0/0/1 port link-type trunk port trunk allow-pass vlan allLSW9VLAN20vlan batch 20 interface GigabitEthernet 0/0/1 port link-type access port default vlan 20 interface Ethernet 0/0/1 port link-type trunk port trunk allow-pass vlan allLSW10VLAN30vlan batch 30 interface GigabitEthernet 0/0/1 port link-type access port default vlan 30 interface Ethernet 0/0/1 port link-type trunk port trunk allow-pass vlan allLSW11VLAN40vlan batch 40 interface GigabitEthernet 0/0/1 port link-type access port default vlan 40 interface Ethernet 0/0/1 port link-type trunk port trunk allow-pass vlan allLSW12VLAN50vlan batch 50 interface GigabitEthernet 0/0/1 port link-type access port default vlan 50 interface Ethernet 0/0/1 port link-type trunk port trunk allow-pass vlan allLSW13VLAN60vlan batch 60 interface GigabitEthernet 0/0/1 port link-type access port default vlan 60 interface Ethernet 0/0/1 port link-type trunk port trunk allow-pass vlan allLSW14VLAN70vlan batch 70 interface GigabitEthernet 0/0/1 port link-type access port default vlan 70 interface Ethernet 0/0/1 port link-type trunk port trunk allow-pass vlan allLSW15VLAN80vlan batch 80 interface GigabitEthernet 0/0/1 port link-type access port default vlan 80 interface Ethernet 0/0/1 port link-type trunk port trunk allow-pass vlan allLSW16VLAN90vlan batch 90 interface GigabitEthernet 0/0/1 port link-type access port default vlan 90 interface Ethernet 0/0/1 port link-type trunk port trunk allow-pass vlan allLSW17VLAN100vlan batch 100 interface GigabitEthernet 0/0/1 port link-type access port default vlan 100 interface Ethernet 0/0/1 port link-type trunk port trunk allow-pass vlan all5.2 汇聚交换机 LSW18 配置vlan batch 10 20 30 40 50 # 下联5台接入交换机Trunk放行VLAN interface Ethernet 0/0/1 port link-type trunk port trunk allow-pass vlan all interface Ethernet 0/0/2 port link-type trunk port trunk allow-pass vlan all interface Ethernet 0/0/3 port link-type trunk port trunk allow-pass vlan all interface Ethernet 0/0/4 port link-type trunk port trunk allow-pass vlan all interface Ethernet 0/0/5 port link-type trunk port trunk allow-pass vlan all # 上联AR8单臂路由Trunk接口 interface GigabitEthernet 0/0/1 port link-type trunk port trunk allow-pass vlan all # 连接AP1接口 interface GigabitEthernet 0/0/2 port link-type trunk port trunk allow-pass vlan all5.3 汇聚交换机 LSW19 配置vlan batch 60 70 80 90 100 # 下联5台接入交换机Trunk放行VLAN interface Ethernet 0/0/1 port link-type trunk port trunk allow-pass vlan all interface Ethernet 0/0/2 port link-type trunk port trunk allow-pass vlan all interface Ethernet 0/0/3 port link-type trunk port trunk allow-pass vlan all interface Ethernet 0/0/4 port link-type trunk port trunk allow-pass vlan all interface Ethernet 0/0/5 port link-type trunk port trunk allow-pass vlan all # 上联AR9单臂路由Trunk接口 interface GigabitEthernet 0/0/1 port link-type trunk port trunk allow-pass vlan all # 连接AP2接口 interface GigabitEthernet 0/0/2 port link-type trunk port trunk allow-pass vlan all5.4 园区网关路由器 AR8 配置# 配置与AR10互联接口 interface Ethernet 0/0/0 ip address 10.0.18.8 255.255.255.0 # 配置与AR9备份互联接口 interface Ethernet 0/0/8 ip address 10.0.89.8 255.255.255.0 # 单臂路由子接口配置各VLAN网关 interface Ethernet 0/0/1.10 dot1q termination vid 10 ip address 192.168.10.254 255.255.255.0 arp broadcast enable interface Ethernet 0/0/1.20 dot1q termination vid 20 ip address 192.168.20.254 255.255.255.0 arp broadcast enable interface Ethernet 0/0/1.30 dot1q termination vid 30 ip address 192.168.30.254 255.255.255.0 arp broadcast enable interface Ethernet 0/0/1.40 dot1q termination vid 40 ip address 192.168.40.254 255.255.255.0 arp broadcast enable interface Ethernet 0/0/1.50 dot1q termination vid 50 ip address 192.168.50.254 255.255.255.0 arp broadcast enable # OSPF动态路由宣告 ospf 1 router-id 8.8.8.8 area 0 network 10.0.18.0 0.0.0.255 network 10.0.89.0 0.0.0.255 network 192.168.10.0 0.0.0.255 network 192.168.20.0 0.0.0.255 network 192.168.30.0 0.0.0.255 network 192.168.40.0 0.0.0.255 network 192.168.50.0 0.0.0.2555.5 园区网关路由器 AR9 配置# 配置与AR10互联接口 interface Ethernet 0/0/0 ip address 10.0.19.9 255.255.255.0 # 配置与AR8备份互联接口 interface Ethernet 0/0/8 ip address 10.0.89.9 255.255.255.0 # 单臂路由子接口配置各VLAN网关 interface Ethernet 0/0/1.60 dot1q termination vid 60 ip address 192.168.60.254 255.255.255.0 arp broadcast enable interface Ethernet 0/0/1.70 dot1q termination vid 70 ip address 192.168.70.254 255.255.255.0 arp broadcast enable interface Ethernet 0/0/1.80 dot1q termination vid 80 ip address 192.168.80.254 255.255.255.0 arp broadcast enable interface Ethernet 0/0/1.90 dot1q termination vid 90 ip address 192.168.90.254 255.255.255.0 arp broadcast enable interface Ethernet 0/0/1.100 dot1q termination vid 100 ip address 192.168.100.254 255.255.255.0 arp broadcast enable # OSPF动态路由宣告 ospf 1 router-id 9.9.9.9 area 0 network 10.0.19.0 0.0.0.255 network 10.0.89.0 0.0.0.255 network 192.168.60.0 0.0.0.255 network 192.168.70.0 0.0.0.255 network 192.168.80.0 0.0.0.255 network 192.168.90.0 0.0.0.255 network 192.168.100.0 0.0.0.2555.6 出口核心路由器 AR10 配置# 对接Server2接口 interface Ethernet 0/0/0 ip address 10.0.12.1 255.255.255.0 # 对接AR8接口 interface Ethernet 0/0/2 ip address 10.0.18.1 255.255.255.0 # 对接AR9接口 interface Ethernet 0/0/1 ip address 10.0.19.1 255.255.255.0 # 对接防火墙FW1接口 interface Ethernet 0/0/3 ip address 10.0.1f.1 255.255.255.0 # OSPF进程配置学习内网路由并发布直连网段 ospf 1 router-id 10.10.10.10 area 0 network 10.0.12.0 0.0.0.255 network 10.0.18.0 0.0.0.255 network 10.0.19.0 0.0.0.255 # 配置默认路由指向防火墙作为互联网出口 ip route-static 0.0.0.0 0.0.0.0 10.0.1f.25.7 防火墙 FW1 基础上网配置# 接口IP配置 interface GigabitEthernet 0/0/0 ip address 10.0.1f.2 255.255.255.0 zone trust interface GigabitEthernet 1/0/0 ip address 202.103.1.1 255.255.255.0 zone untrust # 域间安全策略允许内网访问外网 security-policy rule name trust_to_untrust source-zone trust destination-zone untrust action permit # 源NAT实现内网所有网段上网 nat-policy rule name all_nat source-address 192.168.10.0 mask 255.255.0.0 action nat easy-ip # 默认路由指向互联网云 ip route-static 0.0.0.0 0.0.0.0 202.103.1.25.8 Server2 服务器 IP 设置IP 地址10.0.12.2子网掩码255.255.255.0网关10.0.12.1六、项目连通性测试验证项同 VLAN 下 PC 终端互相 ping验证接入层二层转发正常不同 VLAN 跨网段终端互 ping验证单臂路由与 OSPF 路由学习生效AR8 片区终端 ping 通 AR9 片区所有终端验证双网关互通与冗余链路可用所有内网 PC 访问 Server2 服务器地址 10.0.12.2验证外网服务器资源可正常访问PC 端访问 Cloud2 互联网地址测试 FW1 防火墙 NAT 转换与外网访问功能手动断开 AR8 上联 AR10 线缆使用 AR8 下方 PC 跨网段 ping AR9 网段设备流量经 AR8-AR9 备份链路转发验证链路冗余切换效果。七、项目总结本校园局域网项目严格依照给定拓扑完成全流程部署采用接入 - 汇聚 - 网关 - 出口四层经典园区网架构依托 VLAN 技术完成各院系部门网络逻辑隔离通过单臂路由实现三层跨 VLAN 转发OSPF 动态路由简化全网路由维护成本双网关互联架构提升网络容错能力防火墙部署在网络边界完成安全访问控制与互联网地址转换搭配无线 AP 完成有线无线一体化接入完整覆盖中小型校园网从终端接入到外网出口全流程组网逻辑完全贴合企业真实园区网工程实施规范可直接用于课程设计撰写、实训报告编写与技术博客公开发布。