基于eNSP的中大型校园网络规划设计——星海音乐学院校园网络建设

一、项目背景与需求分析

1.1 项目背景

本项目针对星海音乐学院教学、科研、艺术实践及师生生活的多元化网络需求，设计并实现一套高可用、高安全、可扩展的现代化校园网络架构。通过 eNSP 模拟器完整复现从接入层到边界层的全流程部署，覆盖有线网络、无线网络、多校区互联、远程办公接入、服务器集群发布等核心业务场景，满足差异化网络需求。

1.2 核心需求

• 高可靠性：核心设备和链路采用冗余设计，避免单点故障
• 多业务承载：支持有线和无线接入，满足不同区域的业务需求
• 安全认证：实现师生、教学设备和访客的差异化认证
• 多出口冗余：双 ISP 接入，保障外网访问的稳定性
• 分部互联：通过 VPN 实现与分校网络的安全互联
• 可扩展性：网络架构具备良好的扩展能力，适应未来业务增长

二、网络整体架构设计

2.1 拓扑

2.2 分层架构

采用标准的三层网络架构：接入层、汇聚层和核心层，实现网络的分层管理和故障隔离。

2.3 网络拓扑

网络拓扑主要包含以下部分：

• 内网区域：核心路由器、两台汇聚交换机、多台接入交换机
• 服务器区：DHCP 服务器、DNS 服务器、Web 服务器、FTP 服务器和 RADIUS 服务器
• 无线网络：两台 AC 控制器（双机热备）、6 台 AP 设备
• 安全边界：两台防火墙（双机热备）
• 外网区域：模拟 ISP 网络（ISIS+BGP），SSL VPN
• 分校区域：一台防火墙和内部网络，通过 GRE+IPSec VPN 与总部互联

2.4 IP 地址规划

采用192.168.0.0/16作为内网业务网段，10.10.0.0/16作为设备互联和管理网段，完整 VLAN 规划如下：

三、各层详细设计与配置

3.1 接入层交换机

接入层交换机部署在各楼宇的配线间，负责终端设备的接入。主要配置如下：

• MSTP 配置：划分两个实例，实现 VLAN 流量的负载分担
• DHCP Snooping：防止非法 DHCP 服务器，保障地址分配安全
• 端口安全：限制端口最大 MAC 地址数，防止 MAC 地址泛洪
• 端口隔离：同一 VLAN 内的端口隔离，提高网络安全性
• IP 源地址检查：防止 IP 地址欺骗和 ARP 欺骗

关键配置代码：

vlan batch 10 110 120 160 201
stp bpdu-protection
dhcp enable
dhcp snooping enable

stp region-configuration
region-name stp1
revision-level 1
instance 1 vlan 10 20 30 110 120 130
instance 2 vlan 40 50 60 150 160 201
active region-configuration

interface Ethernet0/0/1
port link-type access
port default vlan 10
stp edged-port enable
port-security enable
port-security max-mac-num 2
port-isolate enable group 1
ip source check user-bind enable

interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 2 to 4094
dhcp snooping trusted

3.2 汇聚层交换机

汇聚层采用双单例设计，两台汇聚交换机分别管理不同的 VLAN 范围，同时互为备份。主要配置如下：

• MSTP+VRRP：实现二层和三层的冗余备份，实例 1 的主根在第一台汇聚，实例 2 的主根在第二台汇聚
• DHCP 中继：为各 VLAN 提供 DHCP 中继服务，指向统一的 DHCP 服务器
• OSPF 动态路由：与核心路由器运行 OSPF 协议，实现路由的自动学习和更新

关键配置代码

vlan batch 2 to 3 10 20 30 40 50 60 110 120 130
vlan batch 150 160 201
stp instance 1 priority 0
stp instance 2 priority 4096
dhcp enable
dhcp snooping enable
stp region-configuration
region-name stp1
revision-level 1
instance 1 vlan 10 20 30 110 120 130
instance 2 vlan 40 50 60 150 160 201
active region-configuration
vlan 10
dhcp snooping enable
vlan 20
dhcp snooping enable
vlan 30
dhcp snooping enable
vlan 40
dhcp snooping enable
vlan 50
dhcp snooping enable
vlan 60
dhcp snooping enable
vlan 110
dhcp snooping enable
vlan 120
dhcp snooping enable
vlan 130
dhcp snooping enable
vlan 150
dhcp snooping enable
vlan 160
dhcp snooping enable
vlan 201
dhcp snooping enable
interface Vlanif2
ip address 10.10.2.1 255.255.255.252
ospf network-type p2p
interface Vlanif3
ip address 10.10.3.1 255.255.255.252
ospf network-type p2p
interface Vlanif10
ip address 192.168.10.254 255.255.255.0
vrrp vrid 10 virtual-ip 192.168.10.252
vrrp vrid 10 priority 120
vrrp vrid 10 preempt-mode timer delay 5
dhcp select relay
dhcp relay server-ip 10.10.15.1
interface Vlanif20
ip address 192.168.20.254 255.255.255.0
vrrp vrid 20 virtual-ip 192.168.20.252
vrrp vrid 20 priority 120
vrrp vrid 20 preempt-mode timer delay 5
dhcp select relay
dhcp relay server-ip 10.10.15.1
interface Vlanif30
ip address 192.168.30.254 255.255.255.0
vrrp vrid 30 virtual-ip 192.168.30.252
vrrp vrid 30 priority 120
vrrp vrid 30 preempt-mode timer delay 5
dhcp select relay
dhcp relay server-ip 10.10.15.1
interface Vlanif40
ip address 192.168.40.254 255.255.255.0
vrrp vrid 40 virtual-ip 192.168.40.252
dhcp select relay
dhcp relay server-ip 10.10.15.1
interface Vlanif50
ip address 192.168.50.254 255.255.255.0
vrrp vrid 50 virtual-ip 192.168.50.252
dhcp select relay
dhcp relay server-ip 10.10.15.1
interface Vlanif60
ip address 192.168.60.254 255.255.255.0
vrrp vrid 60 virtual-ip 192.168.60.252
dhcp select relay
dhcp relay server-ip 10.10.15.1
interface Vlanif110
ip address 192.168.110.254 255.255.255.0
vrrp vrid 110 virtual-ip 192.168.110.252
vrrp vrid 110 priority 120
vrrp vrid 110 preempt-mode timer delay 5
dhcp select relay
dhcp relay server-ip 10.10.15.1
interface Vlanif120
ip address 192.168.120.254 255.255.255.0
vrrp vrid 120 virtual-ip 192.168.120.250
vrrp vrid 120 priority 120
vrrp vrid 120 preempt-mode timer delay 5
dhcp select relay
dhcp relay server-ip 10.10.15.1
interface Vlanif130
ip address 192.168.130.254 255.255.255.0
vrrp vrid 130 virtual-ip 192.168.130.252
vrrp vrid 130 priority 120
vrrp vrid 130 preempt-mode timer delay 5
dhcp select relay
dhcp relay server-ip 10.10.15.1
interface Vlanif150
ip address 192.168.150.254 255.255.255.0
vrrp vrid 150 virtual-ip 192.168.150.252
dhcp select relay
dhcp relay server-ip 10.10.15.1
interface Vlanif160
ip address 192.168.160.254 255.255.255.0
vrrp vrid 160 virtual-ip 192.168.160.250
dhcp select relay
dhcp relay server-ip 10.10.15.1
interface Vlanif201
ip address 192.168.201.254 255.255.255.0
vrrp vrid 201 virtual-ip 192.168.201.250
dhcp select relay
dhcp relay server-ip 10.10.15.1
interface Eth-Trunk1
port link-type trunk
port trunk allow-pass vlan 2 to 4094
mode lacp-static
dhcp snooping trusted
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 2 to 4094
dhcp snooping trusted
interface GigabitEthernet0/0/2
port link-type trunk
port trunk allow-pass vlan 2 to 4094
dhcp snooping trusted
interface GigabitEthernet0/0/3
port link-type trunk
port trunk allow-pass vlan 2 to 4094
dhcp snooping trusted
interface GigabitEthernet0/0/4
port link-type trunk
port trunk allow-pass vlan 2 to 4094
dhcp snooping trusted
interface GigabitEthernet0/0/5
port link-type trunk
port trunk allow-pass vlan 2 to 4094
dhcp snooping trusted
interface GigabitEthernet0/0/6
port link-type trunk
port trunk allow-pass vlan 2 to 4094
dhcp snooping trusted
interface GigabitEthernet0/0/7
port link-type access
port default vlan 2
dhcp snooping trusted
interface GigabitEthernet0/0/8
port link-type access
port default vlan 3
dhcp snooping trusted
interface GigabitEthernet0/0/9
eth-trunk 1
interface GigabitEthernet0/0/10
eth-trunk 1
interface GigabitEthernet0/0/11
eth-trunk 1
ospf 1
silent-interface Vlanif10
silent-interface Vlanif20
silent-interface Vlanif30
silent-interface Vlanif40
silent-interface Vlanif50
silent-interface Vlanif60
silent-interface Vlanif110
silent-interface Vlanif120
silent-interface Vlanif130
silent-interface Vlanif150
silent-interface Vlanif160
area 0.0.0.0
network 10.10.2.0 0.0.0.3
network 10.10.3.0 0.0.0.3
area 0.0.0.1
network 192.168.10.0 0.0.0.255
network 192.168.20.0 0.0.0.255
network 192.168.30.0 0.0.0.255
network 192.168.40.0 0.0.0.255
network 192.168.50.0 0.0.0.255
network 192.168.60.0 0.0.0.255
network 192.168.110.0 0.0.0.255
network 192.168.120.0 0.0.0.255
network 192.168.130.0 0.0.0.255
network 192.168.150.0 0.0.0.255
network 192.168.160.0 0.0.0.255
network 192.168.201.0 0.0.0.255

3.3 核心路由器

核心路由器作为全网的高速转发中心，运行 OSPF 骨干区域，连接汇聚层和防火墙。主要配置如下：

• 高速转发：采用硬件转发技术，保障数据包的高速传输
• 多区域 OSPF：将网络划分为多个 OSPF 区域，提高网络稳定性

vlan batch 10 130 200
interface Vlanif10
ip address 10.10.10.1 255.255.255.252
ospf network-type p2p
interface Vlanif200
ip address 10.10.200.1 255.255.255.0
interface Eth-Trunk3
port link-type trunk
port trunk allow-pass vlan 10 130 200
interface Eth-Trunk4
port link-type trunk
port trunk allow-pass vlan 130 200
interface GigabitEthernet0/0/0
interface GigabitEthernet0/0/1
ip address 10.10.11.2 255.255.255.252
interface GigabitEthernet0/0/2
ip address 10.10.15.2 255.255.255.248
interface GigabitEthernet4/0/0
ip address 10.10.2.2 255.255.255.252
ospf network-type p2p
interface GigabitEthernet4/0/1
ip address 10.10.4.2 255.255.255.252
ospf network-type p2p
interface GigabitEthernet4/0/2
ip address 10.10.7.2 255.255.255.252
ospf network-type p2p
interface GigabitEthernet4/0/3
ip address 10.10.8.2 255.255.255.252
ospf network-type p2p
interface GigabitEthernet5/0/0
eth-trunk 4
interface GigabitEthernet5/0/1
eth-trunk 4
interface GigabitEthernet5/0/2
eth-trunk 3
interface GigabitEthernet5/0/3
eth-trunk 3
interface GigabitEthernet5/0/4
eth-trunk 3
interface GigabitEthernet5/0/5
eth-trunk 3
ospf 1
area 0.0.0.0
network 10.10.2.0 0.0.0.3
network 10.10.4.0 0.0.0.3
network 10.10.7.0 0.0.0.3
network 10.10.8.0 0.0.0.3
network 10.10.10.0 0.0.0.3
network 10.10.11.0 0.0.0.3
network 10.10.15.0 0.0.0.7
network 10.10.200.0 0.0.0.255

3.4 DHCP 服务器

部署一台 DHCP 服务器，为全网终端提供 IP 地址分配服务。为每个 VLAN 创建独立的地址池，配置网关、DNS 和排除地址。

dhcp enable
ip pool vlan10
gateway-list 192.168.10.252
network 192.168.10.0 mask 255.255.255.0
excluded-ip-address 192.168.10.253 192.168.10.254
dns-list 10.10.100.30
ip pool vlan20
gateway-list 192.168.20.252
network 192.168.20.0 mask 255.255.255.0
excluded-ip-address 192.168.20.253 192.168.20.254
dns-list 10.10.100.30
ip pool vlan30
gateway-list 192.168.30.252
network 192.168.30.0 mask 255.255.255.0
excluded-ip-address 192.168.30.253 192.168.30.254
dns-list 10.10.100.30
ip pool vlan40
gateway-list 192.168.40.252
network 192.168.40.0 mask 255.255.255.0
excluded-ip-address 192.168.40.253 192.168.40.254
dns-list 10.10.100.30
ip pool vlan50
gateway-list 192.168.50.252
network 192.168.50.0 mask 255.255.255.0
excluded-ip-address 192.168.50.253 192.168.50.254
dns-list 10.10.100.30
ip pool vlan60
gateway-list 192.168.60.252
network 192.168.60.0 mask 255.255.255.0
excluded-ip-address 192.168.60.253 192.168.60.254
dns-list 10.10.100.30
ip pool vlan70
gateway-list 192.168.70.252
network 192.168.70.0 mask 255.255.255.0
excluded-ip-address 192.168.70.253 192.168.70.254
dns-list 10.10.100.30
ip pool vlan80
gateway-list 192.168.80.252
network 192.168.80.0 mask 255.255.255.0
excluded-ip-address 192.168.80.253 192.168.80.254
dns-list 10.10.100.30
ip pool vlan90
gateway-list 192.168.90.252
network 192.168.90.0 mask 255.255.255.0
excluded-ip-address 192.168.90.253 192.168.90.254
dns-list 10.10.100.30
ip pool vlan100
gateway-list 192.168.100.252
network 192.168.100.0 mask 255.255.255.0
excluded-ip-address 192.168.100.253 192.168.100.254
dns-list 10.10.100.30
ip pool vlan110
gateway-list 192.168.110.252
network 192.168.110.0 mask 255.255.255.0
excluded-ip-address 192.168.110.253 192.168.110.254
dns-list 10.10.100.30
ip pool vlan120
gateway-list 192.168.120.250
network 192.168.120.0 mask 255.255.255.0
excluded-ip-address 192.168.120.252 192.168.120.254
dns-list 10.10.100.30
ip pool vlan130
gateway-list 192.168.130.250
network 192.168.130.0 mask 255.255.255.0
excluded-ip-address 192.168.130.251 192.168.130.254
dns-list 10.10.100.30
ip pool vlan140
gateway-list 192.168.140.250
network 192.168.140.0 mask 255.255.255.0
excluded-ip-address 192.168.140.251 192.168.140.254
dns-list 10.10.100.30
ip pool vlan150
gateway-list 192.168.150.252
network 192.168.150.0 mask 255.255.255.0
excluded-ip-address 192.168.150.253 192.168.150.254
dns-list 10.10.100.30
ip pool vlan160
gateway-list 192.168.160.250
network 192.168.160.0 mask 255.255.255.0
excluded-ip-address 192.168.160.251 192.168.160.254
dns-list 10.10.100.30
ip pool vlan200
gateway-list 10.10.200.5
network 10.10.200.0 mask 255.255.255.0
excluded-ip-address 10.10.200.1 10.10.200.4
ip pool vlan201
gateway-list 192.168.201.250
network 192.168.201.0 mask 255.255.255.0
excluded-ip-address 192.168.201.251 192.168.201.254
option 43 sub-option 2 ip-address 10.10.200.5
ip pool vlan121
gateway-list 192.168.121.252
network 192.168.121.0 mask 255.255.255.0
excluded-ip-address 192.168.121.253 192.168.121.254
dns-list 10.10.100.30
ip pool vlan161
gateway-list 192.168.161.252
network 192.168.161.0 mask 255.255.255.0
excluded-ip-address 192.168.161.253 192.168.161.254
dns-list 10.10.100.30
ip pool vlan202
gateway-list 192.168.202.252
network 192.168.202.0 mask 255.255.255.0
excluded-ip-address 192.168.202.253 192.168.202.254
option 43 sub-option 2 ip-address 10.10.200.5
interface GigabitEthernet0/0/1
ip address 10.10.15.1 255.255.255.248
dhcp select global
ospf 1
area 0.0.0.0
network 10.10.15.0 0.0.0.7

3.5 无线网络设计

无线网络采用AC + 瘦 AP架构，两台 AC 控制器做HSB 双机热备，联动 VRRP+BFD 实现快速故障切换，外接winradius实现802.1x的假认证和大量MAC接入认证。

3.5.1 AC 双机热备配置

• VRRP：为管理 VLAN 和业务 VLAN 配置 VRRP，提供虚拟网关
• BFD：检测 AC 之间的链路状态，实现毫秒级故障检测
• HSB：实现 AP 信息和用户会话的热备份，故障切换时用户无感知

AC1 关键配置代码：

vlan batch 110 120 130 140 150 160 200
dhcp enable
bfd
bfd ac1-ac2 bind peer-ip 10.10.200.4 interface Vlanif 200
discriminator local 1
discriminator remote 2
min-tx-interval 100
min-rx-interval 100
commit
interface Vlanif130
ip address 192.168.130.252 255.255.255.0
vrrp vrid 130 virtual-ip 192.168.130.250
vrrp vrid 130 priority 120
vrrp vrid 130 preempt-mode timer delay 30
vrrp vrid 130 track bfd-session 1 reduced 40
dhcp select relay
dhcp relay server-ip 10.10.15.1
interface Vlanif200
ip address 10.10.200.3 255.255.255.0
vrrp vrid 200 virtual-ip 10.10.200.5
vrrp vrid 200 priority 120
vrrp vrid 200 preempt-mode timer delay 30
vrrp vrid 200 track bfd-session 1 reduced 40
dhcp select relay
dhcp relay server-ip 10.10.15.1
interface Eth-Trunk4
port link-type trunk
port trunk allow-pass vlan 110 120 130 140 150 160 200
interface GigabitEthernet0/0/1
eth-trunk 4
interface GigabitEthernet0/0/2
eth-trunk 4
ip route-static 0.0.0.0 0.0.0.0 10.10.200.1
capwap source ip-address 10.10.200.5
hsb-service θ
service-ip-port local-ip 10.10.200.3 peer-ip 10.10.200.4 local-data-port 10241 peer-data-port 10241
service-keep-alive detect retransmit 3 interval 5
hsb-group θ
bind-service θ
track vrrp vrid 200 interface Vlanif 200
hsb-service-type ap hsb-group 0
hsb-service-type access-user hsb-group 0
hsb-group 0
hsb enable

3.5.2 无线业务规划

根据不同区域的业务特点，采用不同的转发模式和认证方式：

3.5.3 多种认证方式实现

• 802.1X 认证：对接 WinRadius 服务器，实现师生账号认证
• MAC 认证：自动识别教学设备的 MAC 地址，无需手动输入账号密码
• PSK 认证：适用于办公和演出区域，提供预共享密钥认证
• Portal 认证：适用于访客区域，通过 Web 页面进行认证，ensp上没有本地portal，要外接portal服务器（复杂），真机上有本地portal，只做开放接入

关键配置代码：

配置无线侧-wlan
regulatory-domain-profile name Xh
country-code cn
创建各 SSID 模板
ssid-profile name music
ssid XH-music
ssid-profile name study
ssid XH-study
ssid-profile name office
ssid XH-office
ssid-profile name dorm
ssid XH-dorm
ssid-profile name performance
ssid XH-performance
ssid-profile name guest
ssid XH-Guest
RADIUS 与 AAA配置
视图下：
radius-server template radius-student
radius-server authentication 10.10.15.5 1812
radius-server accounting 10.10.15.5 1813
radius-server shared-key cipher huawei@123
radius-attribute nas-ip 10.10.200.3
aaa
authentication-scheme auth-student
authentication-mode radius
accounting-scheme acct-student
accounting-mode radius
domain xh
authentication-scheme auth-student
accounting-scheme acct-student
radius-server radius-student
dot1x-access-profile name dot1x
authentication-profile name auth-prof
dot1x-access-profile dot1x
access-domain Xh force
RADIUS认证实现大量mac认证
mac-access-profile name mac-dorm（视图下）
mac-authen username mac-address format without-hyphen
authentication-profile name mac-auth-prof
mac-access-profile mac-dorm
access-domain xh force
安全模版（802.1x，portal，mac，psk）
security-profile name 8021x
security wpa2 dot1x aes
security-profile name psk
security wpa2 psk pass-phrase huawei@123 aes
security-profile name portal
security open
traffic-profile name qos（只建不配，ensp版本过低）
wmm enable
smart-application enable
VAP 模板创建与转发策略绑定
VLAN 110: 琴房 (直接转发 + MAC认证)
vap-profile name vap-music
forward-mode direct
service-vlan vlan-id 110
security-profile portal
authentication-profile mac-auth-prof
ssid-profile music
VLAN 120: 教学 (直接转发 + 802.1X)
vap-profile name vap-study
forward-mode direct
service-vlan vlan-id 120
security-profile 8021x
authentication-profile auth-prof
ssid-profile study
traffic-profile qos
vap-profile name vap-study-2
forward-mode direct
service-vlan vlan-id 121
security-profile 8021x
authentication-profile auth-prof
ssid-profile study
traffic-profile qos
VLAN 130: 办公 (隧道转发 + psk)
vap-profile name vap-office
forward-mode tunnel
service-vlan vlan-id 130
security-profile psk
authentication-profile auth-prof
ssid-profile office
traffic-profile qos
VLAN 140: 宿舍 (直接转发 + 802.1x)
vap-profile name vap-dorm
forward-mode direct
service-vlan vlan-id 140
security-profile 8021x
authentication-profile auth-prof
ssid-profile dorm
VLAN 150: 演出 (直接转发 + PSK)
vap-profile name vap-performance
forward-mode direct
service-vlan vlan-id 150
security-profile psk
ssid-profile performance
VLAN 160: 访客 (直接转发 + Portal)
vap-profile name vap-guest
forward-mode direct
service-vlan vlan-id 160
security-profile portal
ssid-profile guest
vap-profile name vap-guest-2
forward-mode direct
service-vlan vlan-id 161
security-profile portal
ssid-profile guest
ap上线
ap auth-mode mac-auth
ap-id 1 ap-mac 00e0-fcd3-0840
ap-name ap-01
ap-group star-1
ap-id 2 ap-mac 00e0-fce4-2e40
ap-name ap-02
ap-group star-2
ap-id 3 ap-mac 00e0-fca1-1ce0
ap-name ap-03
ap-group star-3
ap-id 4 ap-mac 00e0-fc15-6d20
ap-name ap-04
ap-group star-4
ap-id 5 ap-mac 00e0-fcb7-4280
ap-name ap-05
ap-group star-5
ap-id 6 ap-mac 00e0-fc09-46d0
ap-name ap-06
ap-group star-5
ap组下发
ap-group name star-1
regulatory-domain-profile Xh
vap-profile vap-music wlan 1 radio all
vap-profile vap-study wlan 2 radio all
vap-profile vap-guest wlan 3 radio all
ap-group name star-2
regulatory-domain-profile Xh
vap-profile vap-performance wlan 1 radio all
vap-profile vap-study wlan 2 radio alll
vap-profile vap-guest wlan 3 radio all
ap-group name star-3
regulatory-domain-profile Xh
vap-profile vap-office wlan 1 radio all
vap-profile vap-study wlan 2 radio all
vap-profile vap-guest wlan 3 radio all
ap-group name star-4
regulatory-domain-profile Xh
vap-profile vap-study wlan 1 radio all
vap-profile vap-guest wlan 2 radio all
ap-group name star-5
regulatory-domain-profile Xh
vap-profile vap-dorm wlan 1 radio all
vap-profile vap-study-2 wlan 2 radio all
vap-profile vap-guest-2 wlan 3 radio all

3.5.4 winradius软件的接入

自己搜索下载winradius，以管理员身份运行 WinRadius.exe 右键 WinRadius.exe → “以管理员身份运行”。 第一次运行，会弹框提示：“未发现数据源名称并且未指定默认驱动程序” 这是正常的，还没配数据库。 在 WinRadius 主菜单点：【设置】→【数据库】 在弹出的 ODBC 设置窗口，点一下 【自动配置 ODBC】，点“确定”。 系统会提示：修改了重要参数，需要重启 WinRadius。 关闭 WinRadius，再重新用管理员身份打开 再次打开 WinRadius 后，点菜单：【设置】→【系统】 在“系统设置”窗口里，你会看到几项关键内容：NAS 密钥（有的版本叫“共享密钥”）： huawei@123- 必须和 AC 上的 radius-server shared-key huawei@123 一模一样。 认证端口：1812（RADIUS 标准认证端口） 计费端口：1813（RADIUS 标准计费端口） 点“确定”，重启 WinRadius 让配置生效 在 WinRadius 菜单点：【设置】→【多重密钥】 在弹出的“多重密钥”对话框里：IP [NAS]：填你 AC 的源 IP（也就是 AC 发 Radius 包的源地址，一般是AC 的管理口 ） 如果双机热备，重复两遍 采用密钥：再填一次 huawei@123（和刚才“NAS 密钥”保持一致）。 点 【添加】，你会看到列表里多出一行记录，点“确定”。 在 WinRadius 菜单点：【操作】→【添加账号】 在“添加账号”窗口里：用户名：比如 student1密码：比如 Huawei@123；MAC认证账号和密码都是 如：5489-986a-2939 组名：可以随便写，比如 student（方便以后区分） 地址：留空，表示任何 MAC 都可以用这个账号登录（实验环境推荐，简单）          想限制 MAC，就写 XX:XX:XX:XX:XX:XX 格式。 其他：预付费、到期日、计费方法，做 802.1X 实验时都可以先不管，保持默认即可，点“确定”。 WinRadius 自带一个小工具 RadiusTest.exe，可以在本机模拟 NAS 发认证请求，检查 WinRadius 是否正常 打开 RadiusTest.exe，填写： Radius IP：10.10.15.5（本机 WinRadius IP） Radius Port：1812（认证端口） Secret：huawei@123（和 WinRadius 的 NAS 密钥一致） 用户名：study01 密码：Huawei@123 点“发送”或“测试”： 如果 WinRadius 配置正确，会看到“Access-Accept”之类的成功提示。 打开管理员cmd或powershell上配置去往AC的路由： route add 0.0.0.0 mask 0.0.0.0 10.10.15.2 route add 0.0.0.0 mask 0.0.0.0 10.10.15.3

3.6 防火墙设计

防火墙采用双机热备（HRP）设计，提供安全边界防护。主要功能包括：

• 双 ISP 出口：连接两个 ISP，实现出口冗余和负载分担
• NAT 转换：实现内网地址到公网地址的转换
• 服务器映射：将 DMZ 区的服务器发布到公网
• GRE+IPSec VPN：实现与分校网络的安全互联
• SSL VPN：为移动办公用户提供远程接入
• 安全策略：实现区域间的访问控制

关键配置代码：

防火墙双机热备及基础配置
FW1：
interface GigabitEthernet1/0/0
ip address 10.10.11.1 255.255.255.252
interface GigabitEthernet1/0/1
ip address 10.10.100.1 255.255.255.0
vrrp vrid 100 virtual-ip 10.10.100.254 active
interface GigabitEthernet1/0/2
ip address 172.168.30.1 255.255.255.0
interface GigabitEthernet1/0/3
ip address 202.100.10.1 255.255.255.0
vrrp vrid 10 virtual-ip 202.100.10.254 active
service-manage ping permit
interface GigabitEthernet1/0/4
ip address 202.100.20.1 255.255.255.0
vrrp vrid 20 virtual-ip 202.100.20.254 active
service-manage ping permit
firewall zone trust
add interface GigabitEthernet0/0/0
add interface GigabitEthernet1/0/0
firewall zone untrust
add interface GigabitEthernet1/0/3
add interface GigabitEthernet1/0/4
firewall zone dmz
add interface GigabitEthernet1/0/1
firewall zone name hrp id 4
set priority 90
add interface GigabitEthernet1/0/2
ip ip-prefix bgp-default index 10 permit 0.0.0.0 0
route-policy isp-in permit node 10
if-match ip-prefix bgp-default
route-policy isp-in deny node 20
bgp 65100
router-id 11.11.11.11
peer 202.100.10.3 as-number 64500
peer 202.100.10.3 connect-interface GigabitEthernet1/0/3
peer 202.100.20.3 as-number 64500
peer 202.100.20.3 connect-interface GigabitEthernet1/0/4
ipv4-family unicast
undo synchronization
maximum load-balancing 2
peer 202.100.10.3 enable
peer 202.100.10.3 route-policy isp-in import
peer 202.100.20.3 enable
peer 202.100.20.3 route-policy isp-in import
ip-link check enable
ip-link name isp1
destination 202.100.10.3 interface GigabitEthernet1/0/3 mode icmp
tx-interval 3
times 2
ip-link name isp2
destination 202.100.20.3 interface GigabitEthernet1/0/4 mode icmp
tx-interval 3
times 2
hrp enable
hrp interface GigabitEthernet1/0/2 remote 172.168.30.2
hrp mirror session enable
hrp track interface GigabitEthernet1/0/0
hrp track ip-link isp1
hrp track ip-link isp2
断两条才切换，ensp的限制不能配置
hrp track ip-link isp1 reduced 3000
hrp track ip-link isp2 reduced 3000
ospf 1
default-route-advertise
area 0.0.0.0
network 10.10.11.0 0.0.0.3
network 10.10.100.0 0.0.0.255
area 0.0.0.1
network 10.10.253.0 0.0.0.3
network 10.10.254.0 0.0.0.3
nssa no-summary

防火墙gre+ipsec vpn
FW1：
acl number 3000
rule 5 permit ip source 202.100.10.254 0 destination 202.100.60.1 0
acl number 3001
rule 5 permit ip source 202.100.20.254 0 destination 202.100.60.1 0
ipsec proposal tran
esp authentication-algorithm sha2-256
esp encryption-algorithm aes-256
ike proposal 1
encryption-algorithm aes-256
dh group14
authentication-algorithm sha2-256
integrity-algorithm hmac-sha2-256
prf hmac-sha2-256
ike peer fw3-1
pre-shared-key huawei@123
ike-proposal 1
remote-address 202.100.60.1
ike peer fw3-2
pre-shared-key huawei@123
ike-proposal 1
remote-address 202.100.60.1
ipsec policy gre-ipsec-1 1 isakmp
security acl 3000
ike-peer fw3-1
proposal tran
tunnel local 202.100.10.254
ipsec policy gre-ipsec-2 1 isakmp
security acl 3001
ike-peer fw3-2
proposal tran
tunnel local 202.100.20.254
interface GigabitEthernet1/0/3
ipsec policy gre-ipsec-1
interface GigabitEthernet1/0/4
ipsec policy gre-ipsec-2
policy-based-route
rule name isp1
ingress-interface Tunnel1
action pbr next-hop 202.100.10.3
rule name isp2
ingress-interface Tunnel2
action pbr next-hop 202.100.20.3
interface Tunnel1
mtu 1400
ip address 10.10.254.1 255.255.255.252
tunnel-protocol gre
keepalive period 10
source 202.100.10.254
destination 202.100.60.1
gre key cipher 123456
ospf cost 10
interface Tunnel2
mtu 1400
ip address 10.10.253.1 255.255.255.252
tunnel-protocol gre
keepalive period 10
source 202.100.20.254
destination 202.100.60.1
gre key cipher 123456
ospf cost 20
firewall zone untrust
add interface Tunnel1
add interface Tunnel2

防火墙安全策略+nat-policy+服务器集群映射
ip address-set su-net type object
address 0 192.168.10.0 mask 255.255.255.0
address 1 192.168.20.0 mask 255.255.255.0
address 2 192.168.30.0 mask 255.255.255.0
address 3 192.168.40.0 mask 255.255.255.0
address 4 192.168.50.0 mask 255.255.255.0
address 5 192.168.60.0 mask 255.255.255.0
address 6 192.168.70.0 mask 255.255.255.0
address 7 192.168.80.0 mask 255.255.255.0
address 8 192.168.90.0 mask 255.255.255.0
address 9 192.168.100.0 mask 255.255.255.0
address 10 192.168.110.0 mask 255.255.255.0
address 11 192.168.120.0 mask 255.255.255.0
address 12 192.168.121.0 mask 255.255.255.0
address 13 192.168.130.0 mask 255.255.255.0
address 14 192.168.140.0 mask 255.255.255.0
address 15 192.168.150.0 mask 255.255.255.0
address 16 192.168.160.0 mask 255.255.255.0
address 17 192.168.161.0 mask 255.255.255.0
ip address-set su-net- type object
address 0 172.168.10.0 mask 24
address 1 172.168.20.0 mask 24
rule name local-untrust-local
source-zone local untrust
destination-zone local untrust
service ah
service bgp
service esp
service icmp
service ospf
service protocol udp destination-port 4500
service protocol udp destination-port 500
service protocol udp destination-port 4430
action permit
rule name trust-local-trust
source-zone trust local
destination-zone trust local
service ospf
action permit
rule name trust-untrust
source-zone trust
destination-zone untrust
source-address address-set su-net
action permit
rule name trust-dmz
source-zone trust
destination-zone dmz
source-address address-set su-net
destination-address 10.10.100.0 mask 255.255.255.0
service ftp
service http
service icmp
service dns
action permit
rule name dmz-untrust
source-zone dmz
destination-zone untrust
source-address 10.10.100.0 mask 255.255.255.0
action permit
rule name untrust-dmz
source-zone untrust
destination-zone dmz
destination-address 10.10.100.0 mask 255.255.255.0
service ftp
service http
service icmp
service dns
action permit
nat-policy
rule name gre-ipsec
source-zone trust
destination-zone untrust
source-address address-set su-net
destination-address address-set su-net-
action no-nat
rule name dmz-isp1
source-zone dmz
source-address 10.10.100.0 mask 255.255.255.0
egress-interface GigabitEthernet1/0/3
action source-nat address-group isp1_
rule name dmz-isp2
source-zone dmz
source-address 10.10.100.0 mask 255.255.255.0
egress-interface GigabitEthernet1/0/4
action source-nat address-group isp2_
rule name trust-untrust
source-zone trust
destination-zone untrust
source-address address-set su-net
action source-nat easy-ip
nat address-group isp1 1
mode pat
section 0 202.100.10.1 202.100.10.1
nat address-group isp2_2
mode pat
section 0 202.100.20.1 202.100.20.1
nat server dmz-http-1 protocol tcp global 202.100.10.1 www inside 10.10.100.10 www no-reverse
nat server dmz-http-2 protocol tcp global 202.100.20.1 www inside 10.10.100.10 www no-reverse
nat server dmz-ftp-1 protocol tcp global 202.100.10.1 ftp inside 10.10.100.20 ftp no-reverse
nat server dmz-ftp-2 protocol tcp global 202.100.20.1 ftp inside 10.10.100.20 ftp no-reverse
nat server dmz-dns-1 protocol udp global 202.100.10.1 dns inside 10.10.100.30 dns no-reverse
nat server dmz-dns-2 protocol udp global 202.100.20.1 dns inside 10.10.100.30 dns no-reverse
firewall detect ftp
firewall detect dns

FW3：
ip address-set su-net type object
address 0 172.168.10.0 mask 24
address 1 172.168.20.0 mask 24
ip address-set su-net- type object
address 0 192.168.10.0 mask 24
address 1 192.168.20.0 mask 24
address 2 192.168.30.0 mask 24
address 3 192.168.40.0 mask 24
address 4 192.168.50.0 mask 24
address 5 192.168.60.0 mask 24
acl number 3000
rule 5 permit ip source 202.100.60.1 0 destination 202.100.10.254 0
rule 10 permit ip source 202.100.60.1 0 destination 202.100.20.254 0
ipsec proposal tran
esp authentication-algorithm sha2-256
esp encryption-algorithm aes-256
ike proposal 1
encryption-algorithm aes-256
dh group14
authentication-algorithm sha2-256
authentication-method pre-share
integrity-algorithm hmac-sha2-256
prf hmac-sha2-256
ike peer fw1-1
pre-shared-key huawei@123
ike-proposal 1
remote-address 202.100.10.254
ike peer fw1-2
pre-shared-key huawei@123
ike-proposal 1
remote-address 202.100.20.254
ipsec policy gre-ipsec 1 isakmp
security acl 3000
ike-peer fw1-1
proposal tran
tunnel local 202.100.60.1
ipsec policy gre-ipsec 2 isakmp
security acl 3000
ike-peer fw1-2
proposal tran
tunnel local 202.100.60.1
interface GigabitEthernet1/0/0
undo shutdown
ip address 202.100.60.1 255.255.255.0
service-manage ping permit
ipsec policy gre-ipsec
interface GigabitEthernet1/0/1
undo shutdown
ip address 172.168.1.2 255.255.255.252
service-manage ping permit
interface Tunnel1
mtu 1400
ip address 10.10.254.2 255.255.255.252
tunnel-protocol gre
keepalive period 10
source 202.100.60.1
destination 202.100.10.254
gre key cipher 123456
ospf cost 10
interface Tunnel2
mtu 1400
ip address 10.10.253.2 255.255.255.252
tunnel-protocol gre
keepalive period 10
source 202.100.60.1
destination 202.100.20.254
gre key cipher 123456
ospf cost 20
firewall zone trust
set priority 85
add interface GigabitEthernet0/0/0
add interface GigabitEthernet1/0/1
firewall zone untrust
set priority 5
add interface GigabitEthernet1/0/0
add interface Tunnel1
add interface Tunnel2
route-policy isp-in permit node 10
if-match ip-prefix bgp-default
route-policy isp-in deny node 20
ip ip-prefix bgp-default index 10 permit 0.0.0.0 0
bgp 65100
router-id 33.33.33.33
peer 202.100.60.2 as-number 64500
peer 202.100.60.2 connect-interface GigabitEthernet1/0/0
ipv4-family unicast
undo synchronization
peer 202.100.60.2 enable
peer 202.100.60.2 route-policy isp-in import
ospf 1
default-route-advertise
area 0.0.0.0
network 172.168.1.0 0.0.0.3
area 0.0.0.1
network 10.10.253.0 0.0.0.3
network 10.10.254.0 0.0.0.3
nssa no-summary
route-policy isp-in permit node 10
if-match ip-prefix bgp-default
route-policy isp-in deny node 20
ip ip-prefix bgp-default index 10 permit 0.0.0.0 0
ip route-static 192.168.10.0 255.255.255.0 Tunnel1
ip route-static 192.168.10.0 255.255.255.0 Tunnel2
ip route-static 192.168.20.0 255.255.255.0 Tunnel1
ip route-static 192.168.20.0 255.255.255.0 Tunnel2
ip route-static 192.168.30.0 255.255.255.0 Tunnel1
ip route-static 192.168.30.0 255.255.255.0 Tunnel2
ip route-static 192.168.40.0 255.255.255.0 Tunnel1
ip route-static 192.168.40.0 255.255.255.0 Tunnel2
ip route-static 192.168.50.0 255.255.255.0 Tunnel1
ip route-static 192.168.50.0 255.255.255.0 Tunnel2
ip route-static 192.168.60.0 255.255.255.0 Tunnel1
ip route-static 192.168.60.0 255.255.255.0 Tunnel2
security-policy
rule name local-untrust-local
source-zone local
source-zone untrust
destination-zone local
destination-zone untrust
service ah
service bgp
service esp
service gre
service icmp
service ospf
service protocol udp destination-port 4500
service protocol udp destination-port 500
action permit
rule name trust-untrust
source-zone trust
destination-zone untrust
source-address address-set su-net
action permit
rule name untrust-trust
source-zone untrust
destination-zone trust
source-address address-set su-net-
destination-address address-set su-net
action permit
nat-policy
rule name gre-ipsec
source-zone trust
destination-zone untrust
source-address address-set su-net
destination-address address-set su-net-
action no-nat
rule name trust-untrust
source-zone trust
destination-zone untrust
source-address address-set su-net
action source-nat easy-ip

3.7 骨干路由器设计

外网ISP
AR1：
isis 1
is-level level-2
network-entity 49.0000.0000.0000.0001.00
interface GigabitEthernet0/0/0
ip address 202.100.10.3 255.255.255.0
isis enable 1
isis circuit-level level-2
interface GigabitEthernet0/0/1
ip address 202.100.30.1 255.255.255.0
isis enable 1
interface GigabitEthernet0/0/2
ip address 202.100.40.1 255.255.255.0
isis enable 1
interface LoopBack0
ip address 1.1.1.1 255.255.255.255
isis enable 1
bgp 64500
router-id 1.1.1.1
peer 2.2.2.2 as-number 64500
peer 2.2.2.2 connect-interface LoopBack0
peer 3.3.3.3 as-number 64500
peer 3.3.3.3 connect-interface LoopBack0
peer 202.100.10.1 as-number 65100
peer 202.100.10.2 as-number 65100
ipv4-family unicast
undo synchronization
peer 2.2.2.2 enable
peer 3.3.3.3 enable
peer 202.100.10.1 enable
peer 202.100.10.1 default-route-advertise
peer 202.100.10.2 enable
peer 202.100.10.2 default-route-advertise
AR2：
isis 1
is-level level-2
network-entity 49.0000.0000.0000.0002.00
interface GigabitEthernet0/0/0
ip address 202.100.20.3 255.255.255.0
isis enable 1
isis circuit-level level-2
interface GigabitEthernet0/0/1
ip address 202.100.30.2 255.255.255.0
isis enable 1
interface GigabitEthernet0/0/2
ip address 202.100.50.1 255.255.255.0
isis enable 1
interface LoopBack0
ip address 2.2.2.2 255.255.255.255
isis enable 1
bgp 64500
router-id 2.2.2.2
peer 1.1.1.1 as-number 64500
peer 1.1.1.1 connect-interface LoopBack0
peer 3.3.3.3 as-number 64500
peer 3.3.3.3 connect-interface LoopBack0
peer 202.100.20.1 as-number 65100
peer 202.100.20.2 as-number 65100
ipv4-family unicast
undo synchronization
peer 1.1.1.1 enable
peer 3.3.3.3 enable
peer 202.100.20.1 enable
peer 202.100.20.1 default-route-advertise
peer 202.100.20.2 enable
peer 202.100.20.2 default-route-advertise
AR3：
isis 1
is-level level-2
network-entity 49.0000.0000.0000.0003.00
interface GigabitEthernet0/0/0
ip address 202.100.40.2 255.255.255.0
isis enable 1
interface GigabitEthernet0/0/1
ip address 202.100.50.2 255.255.255.0
isis enable 1
interface GigabitEthernet0/0/2
ip address 202.100.60.2 255.255.255.0
isis enable 1
isis circuit-level level-2
interface GigabitEthernet4/0/0
ip address 100.100.103.20 255.255.255.0
isis enable 1
interface LoopBack0
ip address 3.3.3.3 255.255.255.255
isis enable 1
bgp 64500
router-id 3.3.3.3
peer 1.1.1.1 as-number 64500
peer 1.1.1.1 connect-interface LoopBack0
peer 2.2.2.2 as-number 64500
peer 2.2.2.2 connect-interface LoopBack0
peer 202.100.60.1 as-number 65100
ipv4-family unicast
undo synchronization
peer 1.1.1.1 enable
peer 2.2.2.2 enable
peer 202.100.60.1 enable
peer 202.100.60.1 default-route-advertise

四、功能测试与验证

在 eNSP V1.3 模拟器中完成所有配置后，对各项功能进行了全面测试，测试结果如下：

4.1 MSTP+VRRP 测试

• MSTP 状态：两个实例的根桥分别为两台汇聚交换机，实现了流量负载分担
• VRRP 状态：实例 1 的 VRRP 主设备在第一台汇聚，实例 2 的 VRRP 主设备在第二台汇聚
• 故障切换测试：断开主设备的上行链路，VRRP 在 3 秒内完成切换，业务不受影响

4.2 OSPF 路由测试

• 路由学习：所有设备都能学习到全网的路由信息
• Silent-interface：用户端口没有发送 OSPF Hello 包，保障了网络安全
• 路由汇总：核心路由器上只有汇总后的路由条目，路由表规模较小

4.3 无线网络测试

• AC 双机热备：BFD 会话状态为 Up，HSB 组状态正常，主 AC 故障时备 AC 在 500ms 内接管业务
• AP 上线：所有 6 台 AP 都成功注册到 AC，状态为 Normal
• 认证测试：
  • MAC 认证：连接 XH-music，自动通过认证，获取 IP 地址并正常通信
  • PSK 认证：输入正确密码后，成功连接 XH-performance
  • 802.1X 认证：通过 AC 的 test-aaa 命令测试认证成功，WinRadius 服务器显示认证通过
  • Portal 认证：由于 eNSP 限制，采用开放认证代替，功能正常

4.4 防火墙测试

• HRP 状态：FW1 为 Active，FW2 为 Standby，配置自动同步
• 双 ISP 出口：两条默认路由，实现负载分担
• NAT 转换：内网终端可以正常访问外网
• 服务器映射：外网客户端可以通过公网地址访问 DMZ 区的 Web、FTP 和 DNS 服务器
• GRE+IPSec VPN：隧道接口状态为 Up，总部和分校可以互相访问
• SSL VPN：移动用户可以通过 SSL VPN 接入内网，访问内部资源

4.5 终端连通性测试

• 内网连通性：不同 VLAN 的终端可以互相 ping 通
• 外网连通性：内网终端可以 ping 通 ISP 的公网地址
• 分校连通性：总部终端可以 ping 通分校的终端
• 抓包分析：VPN 流量被 ESP 加密，保障了数据传输安全

五、配置测试与截图（部分）

1.MSTP+VRRP的信息状态

2.汇聚交换机的ospf表，抓包PC机上行无ospf的hello包

3.无线网络的bfd，vrrp，hsb，ap的状态

4.802.1x认证：因为ensp版本的限制，ensp的sta终端无法发送radius报文，即无法完整的实现802.1x认证，只能模拟认证流程，用AC的test-aaa来测试，sta能进入账号密码认证界面，抓包发现有radius包，winradius中表明认证成功

5.MAC认证：连接XH-music，并在winradius上看到认证成功且开启计费，能获得地址并与内外网相互通信

6.psk认证：输入密码，认证成功并通信

7.portal认证：由于ensp的限制，设备本身没有本地portal服务器，外接服务器过于繁杂，就用开放认证代替

8.防火墙的状态：hrp的信息；主备共计十二条nat server，分别对应四个公网出口地址；两条不同ISP运营商的ipsec加密，两条gre主备通道

9.SSL VPN的登录

10.运营商的路由状态

11.内网PC机获取地址，能与内网其他PC机通信，能与外网和分部PC机通信，抓包有esp加密包且伴有ip-link的探测报发送

12.服务器集群外网登录，分别为ftp，web，dns以及与外网通信

六、项目总结与展望

6.1 项目成果

本项目完整实现了星海音乐学院校园网络的设计与部署，通过 eNSP 模拟器验证了所有核心功能。项目亮点包括：

6.2 改进方向

作者留言：

这个项目写了我半个多月，其中有很多磕磕碰碰，我不得不说ensp的版本限制，ensp Pro又要开发者账号，我在华为技术文档与ai的鬼话中半信半疑，删了重配的可让我开心了；在这v1.3版本下我对一些配置应该做的很完善了，但可能还有错误，请海涵！我要出去找实习了，不知前路如何，希望这个项目能给你们一些帮助吧！

最后，希望ping的通

原创声明

本篇星海音乐学院校园网络 eNSP 仿真项目文章为本人独立实操、自主撰写原创内容。全文拓扑规划、VLAN/IP 地址方案、全套设备配置、多认证无线方案、边界安全实验流程均为本机模拟器实操所得，所有截图、配置代码均为本人实操产出，无全文搬运、抄袭网络成套毕业设计、专栏教程行为。 文中华为设备基础命令属于行业公开标准教学技术内容，本人结合艺术院校专属业务场景完成定制化改造设计，具备原创场景设计独创性。本文仅作网络技术课程学习交流，仅离线模拟器演示，不商用、不用于违规网络搭建。未经作者允许，禁止转载商用，抄袭必究。