服务.note

noteId: WEBea7c32718a143daf2bb0f1b2f4431939 · 原始路径：/ALL/世赛题目（练习） - 笔记/第48届/08-集训队解题/C/服务.note · 图片：2 · 附件待处理：0

1、PKI 证书颁发机构：

# EXT-ISP-GW：
# 在存在SSH.KEY的基础上再创建一个私钥，cisco能够同时存在多个私钥
crypto generate rsa label ROOTCA modulus 2048
 
ip http server
crypto pki server ROOTCA
 grant auto
 hash sha512
 lifetime certificate 730
 lifetime ca-certificate 3650
 no shutdown

·申请证书：

# EXT-ISP-GW：
## 地址为 Loopback 1地址:
crypto key generate rsa modulus 2048 label cert
 
crypto pki trustpoint cert
 enrollment url http://8.8.8.8:80
 fqdn none
 ip-address 123.1.1.1
 subject-name cn=123.1.1.1
 revocation-check none
 rsakeypair cert
 
crypto pki authenticate cert
crypto pki enroll cer
 
# IDS-FW：
## 地址为 IspArea 地址：
crypto key generate rsa label cert modulus 2048
 
crypto ca trustpoint cert
 enrollment protocol scep url http://8.8.8.8:80
 fqdn none
 subject-name cn=107.45.128.214
 ip-address 107.45.128.214
 keypair cert
 
crypto ca authenticate cert
crypto ca enroll cert

2、IKEv2 VPN：

# EXT-ISP-GW：
no crypto ikev2 http-url cert
 
crypto ikev2 proposal PROPOSAL 
 encryption aes-cbc-256
 integrity sha256
 group 14
crypto ikev2 policy 1 
 proposal PROPOSAL
crypto ikev2 profile PROFILE
 match identity remote any
 identity local address 123.1.1.1
 authentication remote rsa-sig
 authentication local rsa-sig
 pki trustpoint cert
 
crypto ipsec transform-set TR esp-aes 256 esp-sha256-hmac 
 mode transport
 
crypto ipsec profile PRO
 set transform-set TR 
 set ikev2-profile PROFILE
 
interface Tunnel0
 ip address 111.111.222.1 255.255.255.252
 tunnel source Loopback1
 tunnel mode ipsec ipv4
 tunnel destination 107.45.128.214
 tunnel protection ipsec profile PRO
 
 
# IDS-FW：
crypto ikev2 enable IspArea
crypto isakmp identity address
 
crypto ikev2 policy 1
 encryption aes-256
 integrity sha256
 group 14
 prf sha256
 
crypto ipsec ikev2 ipsec-proposal IKEv2
 protocol esp encryption aes-256
 protocol esp integrity sha-256
 
tunnel-group 123.1.1.1 type ipsec-l2l
tunnel-group 123.1.1.1 ipsec-attributes
 ikev2 remote-authentication certificate
 ikev2 local-authentication certificate cert
 peer-id-validate nocheck
  
crypto ipsec profile PRO
 set ikev2 ipsec-proposal IKEv2
 set trustpoint cert
 
interface Tunnel0
 nameif Tunnel
 ip address 111.111.222.2 255.255.255.252 
 tunnel source interface IspArea
 tunnel destination 123.1.1.1
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile PRO

3、NAT：

# HQ：
## HQ区域nat的acl中需要包含br区域的内网，因为后面有策略路由要用它：
ip access-list extended NAT
 permit ip 172.16.0.0 0.0.255.255 any
 permit ip 10.1.0.0 0.0.255.255 any
 
int g0/1
 ip nat outside
int g0/2-5    //需要包含连接BR的接口
 ip nat inside
 
ip nat inside source list NAT interface g0/1 overload

4、DHCP：

# BR:
ip dhcp pool VLAN10
 network 10.1.10.0 255.255.255.0
 default-router 10.1.10.254 
 dns-server 8.8.8.8
        
# HQ-RTR-02：
ip dhcp pool VLAN10
 network 172.16.191.0 255.255.255.0
 default-router 172.16.191.254 
 dns-server 8.8.8.8
 
# CORE-SW01：
int vlan 10
 ip helper-address 172.16.13.13
 
# CORE-SW02:
int vlan 10
 ip helper-address 172.16.13.13

5、让 INTERNET-SRV 只存在一个 IPv6地址：

int g3
 ipv6 nd prefix 2600:9000:A41C:68FC::/64 no-autoconfig
 ipv6 nd prefix 2600:9000:A41C:68FC::/64 no-advertise

地址：

6、NAT64：

# EXT-ISP-GW：
## 照着题目就能敲出来
ipv6 un
int ra gi 1-3
nat64 enable 
 
nat64 prefix stateful 2026:4839::/96
nat64 v6v4 static 2600:9000:A41C:68FC::4839:2026 20.26.48.39
 
# 重分发该静态路由到bgp：
access-list 10 permit 20.26.48.39
route-map NAT64
 match ip address 10
router bgp 2026
 re stat

7、6rd：

# EXT-ISP：
ipv6 un
ipv6 general-prefix corp 6rd tunnel 4839
 
int tunn 4839
 ipv6 enable
 ipv6 address corp ::/128
 tunnel source Tunnel0
 tunnel mode ipv6ip 6rd
 tunnel 6rd ipv4 prefix-len 16
 tunnel 6rd prefix 2001:DB8:4839::/48
 
ipv6 route 2001:db8:4839::/48 tunnel 4839

# HQ-GW-RTR-02：
ipv6 un
ipv6 general-prefix corp 6rd tunnel 4839
 
int tunn 4839
 ipv6 enable
 tunnel source GigabitEthernet0/5
 tunnel mode ipv6ip 6rd
 tunnel 6rd ipv4 prefix-len 16
 tunnel 6rd prefix 2001:DB8:4839::/48
 tunnel 6rd br 111.111.222.1
 
ipv6 route 2600:9000:A41C:68FC::/64 Tunnel4839 2001:DB8:4839:DE01::

# BR-GW-RTR-01：
ipv6 un
ipv6 general-prefix corp 6rd tunnel 4839
 
int tunn 4839
 ipv6 enable
 tunnel source GigabitEthernet0/7
 tunnel mode ipv6ip 6rd
 tunnel 6rd ipv4 prefix-len 16
 tunnel 6rd prefix 2001:DB8:4839::/48
 tunnel 6rd br 111.111.222.1
 
ipv6 route 2600:9000:A41C:68FC::/64 Tunnel4839 2001:DB8:4839:DE01::

·客户端地址：

ops-02

8、备份服务：

# HQ-GW-RTR-01：
## 确保 corpadmin 用户拥有特权15的级别
mkdir flash:/GW-BACKUP
ip scp server enable    //开启scp服务器

因为 console识别 @是特殊变量，不是字符串，所以要输入这个 @作为字符串密码，就需要输入编码：%40

# HQ-GW-RTR-02：
kron occurrence AA at 3:00 recurring system-startup    //这条没有作用，只是生成一个计划任务
 
file prompt quiet    //必须开启这个，让copy命令非交互，否则会一直有交互的提示
 
event manager applet BACKUP
 event cli pattern "backup" sync yes
 action 1 cli command "enable"
 action 2 cli command "copy running-config scp://corpadmin:w0r1dS%40sh2026!@172.16.10.1/GW-BACKUP/HQ-GW-RTR-02_running.cfg"