0x10 HCNP-R&S 路由策略作业（华为eNSP）

小鱼儿 2022-05-16 12:15 289阅读 0赞

# 实验需求： #

##    1，全网启用ospf，使全网互通   2, 市场部不能访问财务部和研发部   3，公司总部不能访问研发部 ##

# 实验拓扑： #

![70][]

###  配置IP ###

**PC1**

![70 1][]

**PC2**

![70 2][]

**AR3**

<Huawei>sys
    Enter system view, return user view with Ctrl+Z.
    [Huawei]sys AR3
    [AR3]un in en 
    Info: Information center is disabled.
    [AR3]inter g0/0/0
    [AR3-GigabitEthernet0/0/0]ip add 10.1.4.1 24
    [AR3-GigabitEthernet0/0/0]inter g0/0/1
    [AR3-GigabitEthernet0/0/1]ip add 1.1.1.1 24

**AR4**

<Huawei>sys
    Enter system view, return user view with Ctrl+Z.
    [Huawei]sys AR4
    [AR4]un in en
    Info: Information center is disabled.
    [AR4]inter g0/0/1
    [AR4-GigabitEthernet0/0/1]ip add 10.1.5.1 24
    [AR4-GigabitEthernet0/0/1]inter g0/0/0
    [AR4-GigabitEthernet0/0/0]ip ad 2.2.2.1 24

**AR2**

<Huawei>sys
    Enter system view, return user view with Ctrl+Z.
    [Huawei]sys AR2
    [AR2]un in en
    Info: Information center is disabled.
    [AR2]inter g0/0/0
    [AR2-GigabitEthernet0/0/0]ip add 1.1.1.2 24
    [AR2-GigabitEthernet0/0/0]inter g0/0/1
    [AR2-GigabitEthernet0/0/1]ip add 2.2.2.2 24
    [AR2-GigabitEthernet0/0/1]inter g0/0/2
    [AR2-GigabitEthernet0/0/2]ip add 3.3.3.1 24

**AR1**

<Huawei>sys
    Enter system view, return user view with Ctrl+Z.
    [Huawei]sys AR1
    [AR1]un in en
    Info: Information center is disabled.
    [AR1]inter g0/0/0
    [AR1-GigabitEthernet0/0/0]ip add 3.3.3.2 24
    [AR1-GigabitEthernet0/0/0]inte l 1
    [AR1-LoopBack1]ip add 10.1.1.1 24
    [AR1-LoopBack1]inte l 2
    [AR1-LoopBack2]ip add 10.1.2.1 24
    [AR1-LoopBack2]inte l 3
    [AR1-LoopBack3]ip add 10.1.3.1 24

### **配置OSPF** ###

**AR1**

AR1]ospf
    [AR1-ospf-1]area 0
    [AR1-ospf-1-area-0.0.0.0]net 3.3.3.0 0.0.0.255
    [AR1-ospf-1-area-0.0.0.0]qu	
    [AR1-ospf-1]import-route direct

**AR2**

[AR2]ospf
    [AR2-ospf-1]are 0
    [AR2-ospf-1-area-0.0.0.0]net 1.1.1.0 0.0.0.255
    [AR2-ospf-1-area-0.0.0.0]net 2.2.2.0 0.0.0.255
    [AR2-ospf-1-area-0.0.0.0]net 3.3.3.0 0.0.0.255

**AR3**

[AR3]ospf
    [AR3-ospf-1]are 0
    [AR3-ospf-1-area-0.0.0.0]net 10.1.4.0 0.0.0.255
    [AR3-ospf-1-area-0.0.0.0]net 1.1.1.0 0.0.0.255

**AR4**

[AR4]ospf
    [AR4-ospf-1]are 0
    [AR4-ospf-1-area-0.0.0.0]net 10.1.5.0 0.0.0.255
    [AR4-ospf-1-area-0.0.0.0]net 2.2.2.0 0.0.0.255

--------------------

现在全局都是可以ping通的

### 市场部不能访问财务部和研发部 ###

**需要在AR3上加路由策略**

[AR3]acl number 2000
    [AR3-acl-basic-2000]rule deny source 10.1.1.0 0.0.0.255
    [AR3-acl-basic-2000]rule deny source 10.1.2.0 0.0.0.255	
    [AR3-acl-basic-2000]rule permit source any 
    [AR3-acl-basic-2000]q
    [AR3]ospf	
    [AR3-ospf-1]filter-policy 2000 import

![70 3][]

### 公司总部不能访问研发部 ###

**需要在AR4上加路由策略**

[AR4]ip ip-prefix denyPC2 deny 10.1.2.0 24
    [AR4]ospf	
    [AR4-ospf-1]filter-policy ip-prefix denyPC2 import 
    [AR4-ospf-1]qu
    [AR4]ip ip-prefix denyPC2 index 20 permit 0.0.0.0 0 less-equal 32

![70 4][]

[70]: /images/20220516/88655900615043bcabf09b1a0dba9632.png
[70 1]: /images/20220516/694cdc05dd7a48b2973d931c2180928b.png
[70 2]: /images/20220516/9abf8352a056480daf8fb070bb711748.png
[70 3]: /images/20220516/ad35acf95fc14200a895cf745370a3f2.png
[70 4]: /images/20220516/0fa79d8cbc314fd0b8c28b361848d48f.png