configuración final pronaa

8/13/2019 Configuracin Final Pronaa

1/35

Configuracin Final Pronaa

Diagrama de Red

La figura representa la distribucin de los equipos de comunicacin como deben estarinterconectados.

El switch denominado Core, para este escenario, es quien se encarga de:

-Enrutamiento

-Maneja las Vlans

-Servidor DHCP

-Servidor VTP

Los dems switches, solo tienen como funcin, interconectar con los usuarios finales

Redes que maneja la institucin

Red del piso 2: 172.16.2.0/24

Red de servidores: 192.168.1.0/24

Red del piso 6: 172.16.6.0/24


2/35

Red del piso 7: 172.16.7.0/24

Adm de Equipos: 10.10.10.0/24

Red de zona WAN: 30.30.30.0/30

Configuracin de los equipos de comunicacin

Core-Pronaa

!!version 12.4service timestamps debug datetime msec

service timestamps log datetime msecno service password-encryption!hostname Core-Pronaa!boot-start-markerboot-end-marker!!no aaa new-modelmemory-size iomem 5clock timezone PERU -5!

!ip cefno ip domain lookupip domain name pronaa.gob.peno ip dhcp use vrf connectedip dhcp excluded-address 172.16.2.1 172.16.2.9ip dhcp excluded-address 172.16.2.100 172.16.2.254ip dhcp excluded-address 192.168.1.1 192.168.1.39ip dhcp excluded-address 192.168.1.100 192.168.1.254ip dhcp excluded-address 172.16.6.1 172.16.6.9ip dhcp excluded-address 172.16.6.100 172.16.6.254ip dhcp excluded-address 172.16.7.1 172.16.7.9ip dhcp excluded-address 172.16.7.100 172.16.7.254

!ip dhcp pool vlan2

network 172.16.2.0 255.255.255.0domain-name pronaa.gob.pedns-server 30.30.30.1default-router 172.16.2.1lease infinite

!ip dhcp pool vlan4

network 192.168.1.0 255.255.255.0domain-name pronaa.gob.pedns-server 30.30.30.1default-router 192.168.1.1

lease infinite!ip dhcp pool vlan6


3/35

network 172.16.6.0 255.255.255.0domain-name pronaa.gob.pedns-server 30.30.30.1default-router 172.16.6.1lease infinite

!

ip dhcp pool vlan7network 172.16.7.0 255.255.255.0domain-name pronaa.gob.pedns-server 30.30.30.1default-router 172.16.7.1lease infinite

!!!!!!!

!!!!interface Port-channel1switchport trunk native vlan 99switchport mode trunk

!interface Port-channel2switchport trunk native vlan 99switchport mode trunk



!interface FastEthernet0/0switchport trunk native vlan 99switchport mode trunkchannel-group 1 mode on

!interface FastEthernet0/1switchport trunk native vlan 99

switchport mode trunkchannel-group 1 mode on



!

interface FastEthernet0/4switchport trunk native vlan 99


4/35

switchport mode trunkchannel-group 3 mode on

!interface FastEthernet0/5switchport trunk native vlan 99switchport mode trunk

channel-group 3 mode on!interface FastEthernet0/6switchport trunk native vlan 99switchport mode trunkchannel-group 4 mode on


!interface FastEthernet0/8

!interface FastEthernet0/9!interface FastEthernet0/10!interface FastEthernet0/11!interface FastEthernet0/12!interface FastEthernet0/13!interface FastEthernet0/14!interface FastEthernet0/15!interface Vlan1no ip address

!interface Vlan2ip address 172.16.2.1 255.255.255.0no ip redirectsno ip proxy-arpip accounting output-packets

!interface Vlan4ip address 192.168.1.1 255.255.255.0no ip redirects

no ip proxy-arpip accounting output-packets


!interface Vlan7ip address 172.16.7.1 255.255.255.0no ip redirectsno ip proxy-arp

ip accounting output-packets!


5/35

interface Vlan99ip address 10.10.10.1 255.255.255.0no ip redirectsno ip proxy-arpip accounting output-packets

!

interface Vlan300ip address 30.30.30.1 255.255.255.252no ip redirectsno ip proxy-arpip accounting output-packets

!ip http serverno ip http secure-server!!!!!

!control-plane!!!!!!!!!banner motd _CCC

# # ## ##### # # # # # #### ### # # # # # ## # # ## # # # ### # # # # # # # # # # # # # ### ## # ###### ##### # # # # # # # # ### #### ## # # # # # ## # # ## # ## # # # # # # # # # # #### ##

______________________________________________________________

You are trying to access into a private environment. Any

attempt of non authorized ingress will be registered and willgenerate the legal actions that could be taken. DISCONECT !!______________________________________________________________

Esta intentando ingresar en un sistema privado. Cualquieringreso no autorizado sera pasible de las medidas legalescorrespondientes. Sus intentos quedan registrados. SALGA !!______________________________________________________________

_!

line con 0line aux 0


6/35

line vty 0 4login

!!end

Switch R2

!

!version 12.4service timestamps debug datetime msecservice timestamps log datetime msec

no service password-encryption!hostname R2!boot-start-markerboot-end-marker!!no aaa new-modelmemory-size iomem 5no ip routing!!no ip cef!!!!!!!!interface Port-channel1switchport trunk native vlan 99switchport mode trunk

!interface FastEthernet0/0switchport trunk native vlan 99switchport mode trunk


7/35

channel-group 1 mode on!interface FastEthernet0/1switchport trunk native vlan 99switchport mode trunkchannel-group 1 mode on

!interface FastEthernet0/2switchport access vlan 2storm-control broadcast level 50.00storm-control action shutdownspanning-tree portfast


!

interface FastEthernet0/4switchport access vlan 2storm-control broadcast level 50.00storm-control action shutdownspanning-tree portfast




!interface FastEthernet0/8switchport access vlan 2storm-control broadcast level 50.00

storm-control action shutdownspanning-tree portfast


!interface FastEthernet0/10switchport access vlan 2storm-control broadcast level 50.00storm-control action shutdown

spanning-tree portfast!


8/35


!




switchport access vlan 2storm-control broadcast level 50.00storm-control action shutdownspanning-tree portfast


!interface Vlan1no ip addressno ip route-cache


!ip default-gateway 10.10.10.1ip http serverno ip http secure-server!!!

!!!control-plane!!!!!!!!!

banner motd _CCC


9/35

# # ## ##### # # # # # #### ### # # # # # ## # # ## # # # ##

# # # # # # # # # # # # # # ### ## # ###### ##### # # # # # # # # ### #### ## # # # # # ## # # ## # ## # # # # # # # # # # #### ##

______________________________________________________________

You are trying to access into a private environment. Anyattempt of non authorized ingress will be registered and willgenerate the legal actions that could be taken. DISCONECT !!______________________________________________________________

Esta intentando ingresar en un sistema privado. Cualquier

ingreso no autorizado sera pasible de las medidas legalescorrespondientes. Sus intentos quedan registrados. SALGA !!______________________________________________________________

_!line con 0line aux 0line vty 0 4login

!!end

Switch R3

!

!version 12.4service timestamps debug datetime msec

service timestamps log datetime msecno service password-encryption!hostname R3!boot-start-markerboot-end-marker!!no aaa new-modelmemory-size iomem 5no ip routing!

!no ip cef!


10/35

!!!!!!

!!!!!!!!!!!!!

!!!interface Port-channel1switchport trunk native vlan 99switchport mode trunk





spanning-tree portfast!interface FastEthernet0/4switchport access vlan 4storm-control broadcast level 50.00storm-control action shutdownspanning-tree portfast




11/35


12/35

no ip route-cache!interface Vlan99ip address 10.10.10.41 255.255.255.0no ip redirectsno ip proxy-arp

ip accounting output-packets!ip default-gateway 10.10.10.1ip http serverno ip http secure-server!!!!!!control-plane!

!!!!!!!!banner motd _CCC

# # ## ##### # # # # # #### ### # # # # # ## # # ## # # # ### # # # # # # # # # # # # # ### ## # ###### ##### # # # # # # # # ### #### ## # # # # # ## # # ## # ## # # # # # # # # # # #### ##

______________________________________________________________


Esta intentando ingresar en un sistema privado. Cualquieringreso no autorizado sera pasible de las medidas legalescorrespondientes. Sus intentos quedan registrados. SALGA !!______________________________________________________________

_!line con 0line aux 0line vty 0 4

login!


13/35

!end

Switch R4

!

!version 12.4service timestamps debug datetime msec

service timestamps log datetime msecno service password-encryption!hostname R4!boot-start-markerboot-end-marker!!no aaa new-modelmemory-size iomem 5no ip routing!

!no ip cef!!!!!!!!!!!!!!!!!!!!!!!interface Port-channel1switchport trunk native vlan 99switchport mode trunk

!


14/35

interface FastEthernet0/0switchport trunk native vlan 99switchport mode trunkchannel-group 1 mode on


switchport trunk native vlan 99switchport mode trunkchannel-group 1 mode on



storm-control action shutdownspanning-tree portfast!interface FastEthernet0/4switchport access vlan 6storm-control broadcast level 50.00storm-control action shutdownspanning-tree portfast




!




switchport access vlan 6storm-control broadcast level 50.00


15/35



storm-control action shutdownspanning-tree portfast!interface FastEthernet0/12switchport access vlan 6storm-control broadcast level 50.00storm-control action shutdownspanning-tree portfast






!ip default-gateway 10.10.10.1ip http serverno ip http secure-server

!!!!!!control-plane!!!!!!

banner motd _CCC


16/35

# # ## ##### # # # # # #### ### # # # # # ## # # ## # # # ##

# # # # # # # # # # # # # # ### ## # ###### ##### # # # # # # # # ### #### ## # # # # # ## # # ## # ## # # # # # # # # # # #### ##

______________________________________________________________


Esta intentando ingresar en un sistema privado. Cualquier

ingreso no autorizado sera pasible de las medidas legalescorrespondientes. Sus intentos quedan registrados. SALGA !!______________________________________________________________

_!line con 0line aux 0line vty 0 4login

!!end


17/35

Switch R6

!

!version 12.4service timestamps debug datetime msecservice timestamps log datetime msecno service password-encryption!hostname R6!boot-start-markerboot-end-marker!!no aaa new-modelmemory-size iomem 5no ip routing!!no ip cef!!!!!!!!interface Port-channel1switchport trunk native vlan 99switchport mode trunk


!

interface FastEthernet0/1switchport trunk native vlan 99switchport mode trunkchannel-group 1 mode on


!interface FastEthernet0/3switchport access vlan 7

storm-control broadcast level 50.00storm-control action shutdown


18/35

spanning-tree portfast!interface FastEthernet0/4switchport access vlan 7storm-control broadcast level 50.00storm-control action shutdown







!interface FastEthernet0/11switchport access vlan 7

storm-control broadcast level 50.00storm-control action shutdownspanning-tree portfast





19/35




!interface Vlan99ip address 10.10.10.71 255.255.255.0

no ip redirectsno ip proxy-arpip accounting output-packets

!ip default-gateway 10.10.10.1ip http serverno ip http secure-server!!!!!!control-plane!!!!banner motd _CCC

# # ## ##### # # # # # #### ### # # # # # ## # # ## # # # ### # # # # # # # # # # # # # ##

# ## # ###### ##### # # # # # # # # ### #### ## # # # # # ## # # ## # ## # # # # # # # # # # #### ##

______________________________________________________________


Esta intentando ingresar en un sistema privado. Cualquieringreso no autorizado sera pasible de las medidas legales

correspondientes. Sus intentos quedan registrados. SALGA !!______________________________________________________________


20/35

_!line con 0

line aux 0line vty 0 4login

!!end

Resumen de configuracin

Configuracion Vlans Switch Core

#############################################################################

spanning-tree mode pvst

spanning-tree extend system-id

spanning-tree vlan 1-1024 priority 24576

#############################################################################

##################################

logging trap debugging

logging IP_SERVIDOR_SNMP

clock timezone PERU 0


21/35

ip subnet-zero

ip classless

ip routing

no ip domain-lookup

Interfaz de Vlan

Ruta estatica

ip route 0.0.0.0 0.0.0.0 30.30.30.1

ip domain-name pronaa.gob.pe

interface Vlan2

ip address 172.16.2.1 255.255.255.0

no ip redirects

no ip proxy-arp

ip accounting output-packets


22/35

interface Vlan4

ip address 192.168.1.1 255.255.255.0

no ip redirects

no ip proxy-arp


interface Vlan6

ip address 172.16.6.1 255.255.255.0

no ip redirects

no ip proxy-arp


interface Vlan7

ip address 172.16.7.1 255.255.255.0

no ip redirects

no ip proxy-arp


interface Vlan300


23/35

ip address 30.30.30.1 255.255.255.252

no ip redirects

no ip proxy-arp


interface Vlan99

ip address 10.10.10.1 255.255.255.0

no ip redirects

no ip proxy-arp


ip dhcp excluded-address 172.16.2.1 172.16.2.9






ip dhcp pool vlan2

network 172.16.2.0 255.255.255.0


24/35

domain-name pronaa.gob.pe

dns-server 30.30.30.1

default-router 172.16.2.1

lease infinite

ip dhcp pool vlan4

network 192.168.1.0 255.255.255.0




lease infinite

ip dhcp pool vlan6

network 172.16.6.0 255.255.255.0




lease infinite

ip dhcp pool vlan7

network 172.16.7.0 255.255.255.0





25/35

lease infinite

Seteando una mac a una determinada ip

ip dhcp pool isanchez

host 172.16.2.10 255.255.255.0

client-identifier 0100.0e7f.faee.e0

client-name isanchez

Pronaa-SW-CORE#sh vlan brief

VLAN Name Status Ports

---- -------------------------------- --------- -------------------------------

1 default active

2 Vlan-Piso2 active

4 Vlan-Servidores active

6 Vlan-Piso6 active

7 Vlan-Piso7 active

300 Vlan-WAN active

99 MGMT active


26/35

ip access-list standard remoto

permit 172.16.2.10

permit 172.16.2.20

permit 172.16.2.0 0.0.0.255

line vty 0 2

access-class remoto in

Configuracion de Puertos de Acceso

interface GigabitEthernet1/0/4 (para hosts de usuarios)

switchport access vlan 2

switchport mode access

switchport nonegotiate

switchport port-security violation restrict

switchport port-security mac-address sticky

no cdp enable


27/35

storm-control broadcast level 50

storm-control action shutdown

spanning-tree portfast

spanning-tree bpdufilter enable

spanning-tree bpduguard enable

spanning-tree guard root

interface GigabitEthernet3/14 (para servidores)

description Server2

switchport access vlan 4

switchport mode access

spanning-tree portfast

storm-control broadcast level 50

storm-control action trap

Configuracion del DHCP snooping

En el switch Core y acceso:

ip dhcp snooping

no ip dhcp snooping information option

ip dhcp snooping vlan 2 4 6 7


28/35


29/35


ip dhcp snooping trust

logging event link-status

logging event trunk-status

Para interfaces que manejan port-channel

interface GigabitEthernet 1/0/17

description Enlace AC_2960

channel-group 1 mode desirable

switchport trunk encapsulation dot1q

switchport trunk native vlan 99

switchport mode trunk


logging event link-status

logging event trunk-status

interface GigabitEthernet 1/0/18

description Enlace Ac_2960

channel-group 1 mode desirable

switchport trunk encapsulation dot1q

switchport trunk native vlan 99

switchport mode trunk


30/35


31/35

vtp mode Client

vtp domain pronaa.gob.pe

vtp version 2

vtp password pr0n44vtp

En los switches de acceso

ip default-gateway (10.10.10.1) ip_MGMT_Switch_core

Ips para los equipos de comunicacion (VLAN 99)

Core : 10.10.10.1

AC_2960_2A : 10.10.10.21

AC_2960_4A : 10.10.10.41


32/35

AC_2960_4B : 10.10.10.42

AC_2960_6A : 10.10.10.61

AC_2960_6B : 10.10.10.62

AC_2960_7A : 10.10.10.71

AC_2960_7B : 10.10.10.72

Donde 10.10.10.xy x=piso y=# de switch

Limpiar configuracion del Switch

SWITCH> enable

SWITCH# erase startup-config

SWITCH# delete flash:vlan.dat

SWITCH# reload

Configurar velocidad de puerto


33/35

Configurar velocidad:

SW(config)# interface fastethernet 0/2

SW(config-if)# duplex full

SW(config-if)# speed 100

Configurando comunidad

snmp-server community net-pronaa RO

#############################################################################

Algunas capturas del funcionamiento

Comando: show hip dhcp binding


34/35

Comando: show ip dhcp pool

Pruebas de tracert desde redes diferentes


35/35

Direcciones ip asignadas por el servidor DHCP (Core-Pronaa)

configuración final pronaa

Documents