新北市核心機房網路實作 網路防火牆 無線Thin AP架構設定實務 教育研究發展科 李 煒 80723456-517
新北市高國中小學校園網路架構
學校IP網段說明
新北市教育網路未來架構
校園網路無線認證實務 核心機房動態路由 防火牆設定實務 alfred@ntpc.edu.tw 李煒 80723456-517
課程三個LAB 1.校園L3,兩所學校至少五個vlan Lab 2.dsa3600認證路由實作 Lab 3.OSPF Lab Dsa-wan、wan、lan、intra-1 、 wlan 2.dsa3600認證路由實作 Lab 3.OSPF Lab
新北市高國中小學校園網路架構
Why 動態路由 Static Route 每校至少10個 Vlan,10筆路由 10x300=3000筆路由 管理不易 不易設計備援 Hsrp VRRP
課程內容 建立校園骨幹Dlink 3627 Lab,含出口Wan ntpc Auth 建立forti3950 學校vlan and 10筆靜態路由指到Dlink 3627. 確認dlink3627與forti 3950 可以跨學校vlan ip互通. 建立N7K 與 3950 單一學校ospf路由交換 透過N7K 與 3950 間路由交換，跨校互通 啟動ospf Check nei Check topology table
校園L3 core switch Lab 做出 兩所學校wan Lan Intra-1 wlan 設定一筆static route 到 forti3950 firewall L3 wan 163.20.202.185/29 Firewall interface 163.20.202.190/29 Lan 163.20.66.0/24 Intra-1 10.231.56.0/24 DSA 10.253.56.0/24 Wlan 10.251.56.0/24
指令集 en Config t exit Interface vlan XX Ip add 10.231.56.x 255.255.255.0 No sh Ip route t.t.t.t m.m.m.m d.d.d.d Ip routing
Trouble shoot Sh ip inter bri Sh run inter xx Sh ip route Sh Ip arp Sh mac address
無線認證路由設定
Fortigate 3950 route設定 Router(config)#ip route 10.231.56.0 255.255.255.0 163.20.202.185 Router(config)#ip route 10.241.56.0 255.255.255.0 163.20.202.185 Router(config)#ip route 10.251.56.0 255.255.255.0 163.20.202.185 Router(config)#ip route 10.253.56.0 255.255.255.0 163.20.202.185 Router(config)#ip route 10.247.56.0 255.255.255.0 163.20.202.185 Router(config)#ip route 10.245.56.0 255.255.255.0 163.20.202.185 Router(config)#ip route 10.226.56.0 255.255.255.0 163.20.202.185
OSPF的開始 PC>ping 163.20.224.189 Pinging 163.20.224.189 with 32 bytes of data: Reply from 163.20.224.189: bytes=32 time=31ms TTL=254 Reply from 163.20.224.189: bytes=32 time=16ms TTL=254 Reply from 163.20.224.189: bytes=32 time=15ms TTL=254 Ping statistics for 163.20.224.189: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 15ms, Maximum = 31ms, Average = 19ms PC>ping 163.20.224.186 Pinging 163.20.224.186 with 32 bytes of data: Request timed out. ??????? Why? N7k 尚未設定回來路由 Ospf課程的開
啟動OSPF路由協定 Router ospf router-id 該指令的關鍵字是router ospf，後面接上的數字，指的是Process ID。此數字必須是單一獨特，可以是任意選擇的數字。 這個Process ID數字不需要與其他使用OSPF路由協定的路由器設備上的Process ID相同。
設定OSPF路由協定連接的網路 設定路由器設備所連接的網路區段資訊 Network x.x.x.x y.y.y.y area Z 第一個接上的位址可以是網路位址（Network Address）、子網路位址（Sub-network Address）或是單一電腦的IP位址。 接下來要指定的是遮罩（Wildcard Mask），這個遮罩用來指定所要符合（match）的IP位址。其中，0代表必須符合，而1則代表不比對，就是Don’t Care。
Loopback介面與路由器ID值 Loopback介面是一種特殊的虛擬介面，藉由指定IP到這個Loopback介面上，可以改變路由器的路由器ID值，因為能夠在Loopback介面上指定更大的IP值，以便更改這台路由器的IP值，也因此可以變更DR路由器和BDR路由器的選取。
Ospf名詞解釋 http://www.netadmin.com.tw/article_content.aspx?sn=1304170001&jump=4 Neighbor Adjacent DR BDR DROTHER LSA type Type 5 OE2 Type 7 ON2
Ospf常用指令 Sh ip ospf nei Sh ip ospf database Clear ip ospf pro Sh run Sh ip ospf inter
ABR ASBR STUB NSSA
Forti 3950 ospf設定指令 router ospf 1 log-adjacency-changes area 1256 nssa area 1256 stub area 1256 network 163.20.224.184 0.0.0.7 area 1256 Redistribute static subnets (static route) Redistribute connect subnets Clear ip ospf process Sh ip ospf data
OSPF command Review 1. router ospf process-id 2.ios only enable interface match network cmd 3. network widecard 4. area X 5.sh ip ospf nei 6. sh ip ospf protocol 7.sh ip ospf database
N7k ospf Router(config)#router ospf 1 Router(config-router)#net Router(config-router)#network 163.20.224.184 0.0.0.7 area 1256 Router(config-router)#do sh ip ospf nei Neighbor ID Pri State Dead Time Address Interface 163.20.224.189 1 FULL/DR 00:00:39 163.20.224.189 Vlan200 203.72.153.254 1 FULL/DR 00:00:32 163.20.220.14 Vlan969 172.18.254.254 1 FULL/DROTHER 00:00:34 172.17.11.251 Vlan30 Router(config-router)# 00:47:33: %OSPF-5-ADJCHG: Process 1, Nbr 163.20.224.189 on Vlan200 from LOADING to FULL, Loading Done
3950 redistribute Router(config-router)#redistribute connected su Router(config-router)#redistribute connected subnets Router(config-router)#redistribute st Router(config-router)#redistribute static ? metric Metric for redistributed routes metric-type OSPF/IS-IS exterior metric type for redistributed routes subnets Consider subnets for redistribution into OSPF tag Set tag for routes redistributed into OSPF <cr> Router(config-router)#redistribute sta Router(config-router)#redistribute static su Router(config-router)#redistribute static subnets Router(config-router)#
OSPF NSSA
N7k Sh ip route Gateway of last resort is 192.168.1.254 to network 0.0.0.0 10.0.0.0/24 is subnetted, 7 subnets O N2 10.226.56.0/24 [110/20] via 163.20.224.189, 00:00:02, Vlan200 O N2 10.231.56.0/24 [110/20] via 163.20.224.189, 00:00:02, Vlan200 O N2 10.241.56.0/24 [110/20] via 163.20.224.189, 00:00:02, Vlan200 O N2 10.245.56.0/24 [110/20] via 163.20.224.189, 00:00:02, Vlan200 O N2 10.247.56.0/24 [110/20] via 163.20.224.189, 00:00:02, Vlan200 O N2 10.251.56.0/24 [110/20] via 163.20.224.189, 00:00:02, Vlan200 O N2 10.253.56.0/24 [110/20] via 163.20.224.189, 00:00:02, Vlan200 163.20.0.0/16 is variably subnetted, 7 subnets, 3 masks O N2 163.20.1.0/24 [110/20] via 163.20.220.14, 00:57:59, Vlan969 O N2 163.20.66.0/24 [110/20] via 163.20.224.189, 00:00:02, Vlan200 O N2 163.20.202.184/29 [110/20] via 163.20.224.189, 00:00:57, Vlan200 C 163.20.220.8/29 is directly connected, Vlan969 L 163.20.220.9/32 is directly connected, Vlan969 C 163.20.224.184/29 is directly connected, Vlan200 L 163.20.224.186/32 is directly connected, Vlan200 172.17.0.0/16 is variably subnetted, 2 subnets, 2 masks C 172.17.11.0/24 is directly connected, Vlan30 L 172.17.11.242/32 is directly connected, Vlan30 192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks C 192.168.1.0/24 is directly connected, Vlan11 L 192.168.1.1/32 is directly connected, Vlan11 O N2 203.72.153.0/24 [110/20] via 163.20.220.14, 00:57:59, Vlan969 S* 0.0.0.0/0 [1/0] via 192.168.1.254 Router#ping 10.231.56.254 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.231.56.254, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5),
Fortigate Firewall 模擬學校L3 Router設定 模擬fortigate 3950 一個Vdom設定 Policy設定 模擬三個vlan 及 一個wan 模擬fortigate 3950 一個Vdom設定 向下與dlink 3627 Static Route 向上與cisco nexus 7K ospf 交換路由 Policy設定 實作Thin Ap controller 對照CISCO LAB
interface 設定 port Create Vlan 將vlan加到port 給Ip address 給dhcp派ip 設定interface vlan ip 派dhcp
Routing 設定static route 設定ospf
policy 設定policy nat 設定radius By網段管理
Thin AP 三個步驟參閱 Fortigate ppt
報告完畢 謝謝指教 新北市政府教育局 教育研究發展科 李煒