好消息
a.HCIE 6连过(面试哦)
b.周六HCNP上新一轮课
c.HCNA真题-->HCNP的真题讲解预告(怎么考、在哪考、考什么、为什么)

今晚HCNA课程内容(越来越综合,越来越实用哦)
拓扑如下:
实施华为设备的OSPF以及ACL的案例
1.重要的网络常用的OSPF协议
R1和R2之间模拟专线(向运营商去购买的服务)
动态路由协议最排错思路:1)是否有邻居 2)是否存在于数据库中 3)是否存在于路由表中,最后拿数据去测试ping(telnet)
即使这个网络存在RIP/静态路由也没有问题,是由于OSPF的优先级(域内)优于静态和RIP
OSPF也是专业网络公司的最常见的面试题
OSPF相对RIP高级很多、快速很多
链路状态的IGP协议,可以用于企业网和运营商或者IDC。可以划分区域
1.1 基本配置
ospf 1 router-id 2.2.2.2 //创建OSPF进程1,RID为2.2.2.2(RID代表运行OSPF的某个设备标识,IPv4形式)
area 0.0.0.0 //创建区域0
[R2-ospf-1]int g0/0/0 //进入接口
[R2-GigabitEthernet0/0/0]ospf enable area 0 //该接口开启了OSPF,被放入了OSPF的区域0;同时该接口的信息被放入OSPF的数据库,让其他学到路由。该命令=network x.x.x.x y.y.y.y
[R2]display ospf int

     OSPF Process 1 with Router ID 2.2.2.2
             Interfaces 

Area: 0.0.0.0 (MPLS TE not enabled)
IP Address Type State Cost Pri DR BDR
202.100.1.2 Broadcast DR 1 1 202.100.1.2 0.0.0.0
10.1.5.1 Broadcast Waiting 1 1 0.0.0.0 0.0.0.0
10.1.6.1 Broadcast Waiting 1 1 0.0.0.0 0.0.0.0
邻居的另外一种配置方式:
[R1]ospf router-id 0.0.1.1
[R1-ospf-1]area 0
[R1-ospf-1-area-0.0.0.0]network 202.100.1.0 ?
IP_ADDR<X.X.X.X> OSPF wild card bits //掩码是255.255.255.252(11111100-252)-通配符掩码-》0.0.0.3(00000011)
[R1-ospf-1-area-0.0.0.0]network 202.100.1.0 0.0.0.3 //在进程下某个范围内的设备启动OSPF并通告
[R1-ospf-1-area-0.0.0.0]int g0/0/1.10
[R1-GigabitEthernet0/0/1.10]ospf enable a 0 //接口直接运行OSPF并通告该直连到OSPF数据库
[R1-GigabitEthernet0/0/1.10]int g0/0/1.20
[R1-GigabitEthernet0/0/1.20]ospf enable a 0
[R1-ospf-1-area-0.0.0.0]
1.2 邻居状态机
2.如下:
Dec 7 2017 19:58:44-08:00 R1 %%01OSPF/4/NBR_CHANGE_E(l)[0]:Neighbor changes event: neighbor status changed. (ProcessId=256, NeighborAddress=2.1.100.202, NeighborEvent=HelloReceived, NeighborPreviousState=Down, NeighborCurrentState=Init)
[R1-ospf-1-area-0.0.0.0]
Dec 7 2017 19:58:44-08:00 R1 %%01OSPF/4/NBR_CHANGE_E(l)[1]:Neighbor changes event: neighbor status changed. (ProcessId=256, NeighborAddress=2.1.100.202, NeighborEvent=2WayReceived, NeighborPreviousState=Init, NeighborCurrentState=2Way)
[R1-ospf-1-area-0.0.0.0]
Dec 7 2017 19:58:44-08:00 R1 %%01OSPF/4/NBR_CHANGE_E(l)[2]:Neighbor changes event: neighbor status changed. (ProcessId=256, NeighborAddress=2.1.100.202, NeighborEvent=AdjOk?, NeighborPreviousState=2Way, NeighborCurrentState=ExStart)
[R1-ospf-1-area-0.0.0.0]
Dec 7 2017 19:58:44-08:00 R1 %%01OSPF/4/NBR_CHANGE_E(l)[3]:Neighbor changes event: neighbor status changed. (ProcessId=256, NeighborAddress=2.1.100.202, NeighborEvent=NegotiationDone, NeighborPreviousState=ExStart, NeighborCurrentState=Exchange)
[R1-ospf-1-area-0.0.0.0]
Dec 7 2017 19:58:44-08:00 R1 %%01OSPF/4/NBR_CHANGE_E(l)[4]:Neighbor changes event: neighbor status changed. (ProcessId=256, NeighborAddress=2.1.100.202, NeighborEvent=ExchangeDone, NeighborPreviousState=Exchange, NeighborCurrentState=Loading)
[R1-ospf-1-area-0.0.0.0]
Dec 7 2017 19:58:44-08:00 R1 %%01OSPF/4/NBR_CHANGE_E(l)[5]:Neighbor changes event: neighbor status changed. (ProcessId=256, NeighborAddress=2.1.100.202, NeighborEvent=LoadingDone, NeighborPreviousState=Loading, NeighborCurrentState=Full)
1.3 验证
.[R1-ospf-1-area-0.0.0.0]dis ospf peer bri //查看OSPF的邻居关系

     OSPF Process 1 with Router ID 0.0.1.1
              Peer Statistic Information

Area Id Interface Neighbor id State
0.0.0.0 GigabitEthernet0/0/0 2.2.2.2 Full
<R2>display ospf lsdb //OSPF的数据库的简要信息(NP着重讲)

     OSPF Process 1 with Router ID 2.2.2.2
             Link State Database 

                     Area: 0.0.0.0

Type LinkState ID AdvRouter Age Len Sequence Metric
Router 2.2.2.2 2.2.2.2 295 60 80000009 1
Router 0.0.1.1 0.0.1.1 55 60 80000007 1
Network 202.100.1.2 2.2.2.2 295 32 80000002 0
<R2>dis ip routing-table protocol ospf //通过OSPF得到的路由
Route Flags: R - relay, D - download to fib

Public routing table : OSPF
Destinations : 2 Routes : 2

OSPF routing table status : <Active>
Destinations : 2 Routes : 2

Destination/Mask Proto Pre Cost Flags NextHop Interface

  10.1.10.0/27  OSPF    10   2           D   202.100.1.1     GigabitEthernet0/0/0
  10.1.20.0/27  OSPF    10   2           D   202.100.1.1     GigabitEthernet0/0/0

注意:VRP实施接口下的OSPF的前提是必须在进程下创建区域!!否则VRP
做过的内容:1.接口确实运行了OSPF 区域0 2.确实存在区域0.在HCNP中一个重要的话题就是OSPF邻居的排错
[SW6]display ospf error //广播类型的OSPF要求掩码一致
验证终端到终端通信的前提是网关到网关可以和通信
PC>ping 10.1.20.1

Ping 10.1.20.1: 32 data bytes, Press Ctrl_C to break
Request timeout!
From 10.1.20.1: bytes=32 seq=2 ttl=125 time=109 ms
From 10.1.20.1: bytes=32 seq=3 ttl=125 time=109 ms
From 10.1.20.1: bytes=32 seq=4 ttl=125 time=249 ms
From 10.1.20.1: bytes=32 seq=5 ttl=125 time=109 ms

--- 10.1.20.1 ping statistics ---
5 packet(s) transmitted
4 packet(s) received
20.00% packet loss
round-trip min/avg/max = 0/144/249 ms
在NA中对OSPF的配置,懂得接口和进程去配置基本的OSPF区域0,能够通过OSPF得到路由,使得全网可以通信!
<R1>display ip routing-table protocol ospf
Route Flags: R - relay, D - download to fib

Public routing table : OSPF
Destinations : 4 Routes : 4

OSPF routing table status : <Active>
Destinations : 4 Routes : 4

Destination/Mask Proto Pre Cost Flags NextHop Interface

   10.1.5.0/28  OSPF    10   2           D   202.100.1.2     GigabitEthernet0/0/0
   10.1.6.0/28  OSPF    10   2           D   202.100.1.2     GigabitEthernet0/0/0
  10.1.30.0/28  OSPF    10   3           D   202.100.1.2     GigabitEthernet0/0/0
  10.1.40.0/28  OSPF    10   3           D   202.100.1.2     GigabitEthernet0/0/0

OSPF routing table status : <Inactive>
Destinations : 0 Routes : 0

2.重要的ACL在网络中的实施
概述:
access control list(访问控制列表)
说你行你就行,不行也行
说你不行你就不行,行也不行
基本的防火墙
通配符:
/27:最后一个八位组11100000--通配符掩码-->00011111--2进程变成10进制-->31
acl number 2000 //定义规则
rule 5 permit source 10.1.10.0 0.0.0.31 //允许来自10.1.10.0/27这个范围内的设备来访问
rule 10 deny //其他网络拒绝本设备的VTY
user-interface vty 0 4
acl 2000 inbound //应用ACL到VTY下
[R1-acl-basic-2000]dis acl all //验证访问控制列表
Total quantity of nonempty ACL number is 1

Basic ACL 2000, 2 rules
Acl's step is 5
rule 5 permit source 10.1.10.0 0.0.0.31
rule 10 deny (2 matches)
ACL可以用到哪里:1)VTY来控制远程访问(对数据转发的控制)
user-interface vty 0 4
acl 2000 inbound
2)用在转发接口下(对数据转发的控制)
interface GigabitEthernet0/0/1.10
dot1q termination vid 10
ip address 10.1.10.30 255.255.255.224
traffic-filter inbound acl 2000 //用在转发接口下默认运行通过
3)用于路由策略来匹配理由
4)用在NAT中来匹配流量(easy IP)

5)用在IPSEC ×××中来充当SPD

6)可以用于QoS来匹配流量
ACL分类:1)基本的ACL,匹配整个协议栈,同时只能匹配源,不能批匹配目的
2)高级ACL,匹配不同的协议栈(IP\TCP\UDP\ICMP\IGMP)也能匹配源目IP,源目端口,标识符、分片等等
3)2层的ACL

ACL的顺序问题:1)RULE关键字,数值越小越优先匹配,越精准越要放到靠前的位置
acl number 2000
rule 1 deny source 10.1.0.0 0.0.255.255
rule 5 permit source 10.1.10.0 0.0.0.31
rule 10 deny
#
问题:10.1.10.1--10.1.20.1通信?
2)大部分情况下ACL最后一行隐含拒绝所有
[R1-acl-basic-2000]undo rule 10
acl number 2000
rule 5 permit source 10.1.10.0 0.0.0.31
但是华为设备用于接口下对流量的过滤,默认允许所有
[R1-GigabitEthernet0/0/1.20]traffic-filter inbound acl 2000
请问10.1.20.1-->202.100.1.2通信

0 不
1 能

通配符掩码:0代表固定不变化,1代表变化
acl name ××× 3999
rule 5 permit tcp source 202.100.1.2 0 destination-port eq telnet
rule 10 deny ip
[R1-ui-vty0-4]acl 3999 inbound
<R2>telnet 202.100.1.1 //成功的例子
Press CTRL_] to quit telnet mode
Trying 202.100.1.1 ...
Connected to 202.100.1.1 ...

Login authentication

<R2>telnet -a 10.1.5.1 202.100.1.1 //因为源IP改变了,所以不能成功
Press CTRL_] to quit telnet mode
Trying 202.100.1.1 ...
[R1-ui-vty0-4]dis acl name ×××
Advanced ACL ××× 3999, 2 rules
Acl's step is 5
rule 5 permit tcp source 202.100.1.2 0 destination-port eq telnet (1 matches)
rule 10 deny ip (2 matches)
Password:
作业:
1.用OSPF使得全网通信
2.使用数据过滤,VLAN10是一个财务服务器的VLAN,仅仅允许VLAN30访问
interface GigabitEthernet0/0/1.10
traffic-filter outbound acl name CAIWU
[R1]dis acl name CAIWU
Advanced ACL CAIWU 3998, 2 rules
Acl's step is 5
rule 10 permit ip source 10.1.30.0 0.0.0.15 destination 10.1.10.0 0.0.0.31 (5 matches)
rule 20 deny ip (10 matches)
下节课预告:NAT(ACL)、PPPoE、IPSEC ×××
3.重要的企业网接入互联网(NAT)

对华为来讲:1.实验大量去做-->验证理论 2.面试-->模拟面试