کتاب جامع
Cisco Packet Tracer

C:\>ping 192.168.1.20

Pinging 192.168.1.20 with 32 bytes of data:

Reply from 192.168.1.20: bytes=32 time<1ms TTL=128
Reply from 192.168.1.20: bytes=32 time<1ms TTL=128
Reply from 192.168.1.20: bytes=32 time<1ms TTL=128
Reply from 192.168.1.20: bytes=32 time<1ms TTL=128

Ping statistics for 192.168.1.20:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss)

Router>enable
Router#configure terminal
Router(config)#hostname R1
R1(config)#no ip domain-lookup
! جلوگیری از گیر کردن روی دستور اشتباه
R1(config)#enable secret Hopa@Enable2026
R1(config)#service password-encryption
R1(config)#banner motd #Authorized access only! HOPA Network#
R1(config)#line console 0
R1(config-line)#password Hopa@Con
R1(config-line)#login
R1(config-line)#logging synchronous
R1(config-line)#exec-timeout 10 0
R1(config-line)#exit
R1(config)#username admin privilege 15 secret Hopa@Admin
R1(config)#ip domain-name hopa.local
R1(config)#crypto key generate rsa general-keys modulus 2048
R1(config)#ip ssh version 2
R1(config)#line vty 0 4
R1(config-line)#login local
R1(config-line)#transport input ssh
R1(config-line)#end
R1#copy running-config startup-config
Destination filename [startup-config]?
Building configuration...
[OK]

SW1(config)#vlan 10
SW1(config-vlan)#name SALES
SW1(config-vlan)#vlan 20
SW1(config-vlan)#name IT
SW1(config-vlan)#vlan 99
SW1(config-vlan)#name MGMT
SW1(config-vlan)#exit
! --- پورت‌های Access ---
SW1(config)#interface range fa0/1 - 10
SW1(config-if-range)#switchport mode access
SW1(config-if-range)#switchport access vlan 10
SW1(config-if-range)#interface range fa0/11 - 20
SW1(config-if-range)#switchport mode access
SW1(config-if-range)#switchport access vlan 20
! --- Trunk ---
SW1(config-if-range)#interface g0/1
SW1(config-if)#switchport mode trunk
SW1(config-if)#switchport trunk native vlan 99
SW1(config-if)#switchport trunk allowed vlan 10,20,99
SW1(config-if)#switchport nonegotiate
! --- آدرس مدیریتی سوئیچ ---
SW1(config-if)#interface vlan 99
SW1(config-if)#ip address 192.168.99.11 255.255.255.0
SW1(config-if)#no shutdown
SW1(config-if)#exit
SW1(config)#ip default-gateway 192.168.99.1
! --- پورت‌های بلااستفاده: امن و خاموش ---
SW1(config)#interface range fa0/21 - 24
SW1(config-if-range)#switchport mode access
SW1(config-if-range)#switchport access vlan 999
SW1(config-if-range)#shutdown

SW1#show vlan brief
VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    G0/2
10   SALES                            active    Fa0/1, Fa0/2, Fa0/3, Fa0/4 ...
20   IT                               active    Fa0/11, Fa0/12, Fa0/13 ...
99   MGMT                             active
999  VLAN0999                         active    Fa0/21, Fa0/22, Fa0/23, Fa0/24

SW1#show interfaces trunk
Port        Mode         Encapsulation  Status        Native vlan
Gig0/1      on           802.1q         trunking      99

Port        Vlans allowed on trunk
Gig0/1      10,20,99

SW1(config)#vtp domain HOPA
SW1(config)#vtp mode server
SW1(config)#vtp password Vtp@123
SW2(config)#vtp domain HOPA
SW2(config)#vtp mode client
SW2(config)#vtp password Vtp@123
SW1#show vtp status

R1(config)#interface g0/0
R1(config-if)#no shutdown
R1(config-if)#interface g0/0.10
R1(config-subif)#encapsulation dot1Q 10
R1(config-subif)#ip address 192.168.10.1 255.255.255.0
R1(config-subif)#interface g0/0.20
R1(config-subif)#encapsulation dot1Q 20
R1(config-subif)#ip address 192.168.20.1 255.255.255.0
R1(config-subif)#interface g0/0.99
R1(config-subif)#encapsulation dot1Q 99 native
R1(config-subif)#ip address 192.168.99.1 255.255.255.0

SW1(config)#interface g0/1
SW1(config-if)#switchport mode trunk
SW1(config-if)#switchport trunk native vlan 99

MLS1(config)#ip routing
! بدون این دستور، سوئیچ لایه ۳ مسیریابی نمی‌کند!
MLS1(config)#vlan 10
MLS1(config-vlan)#vlan 20
MLS1(config-vlan)#vlan 30
MLS1(config-vlan)#exit
MLS1(config)#interface range g0/1 - 2
MLS1(config-if-range)#switchport trunk encapsulation dot1q
MLS1(config-if-range)#switchport mode trunk
MLS1(config-if-range)#exit
MLS1(config)#interface vlan 10
MLS1(config-if)#ip address 192.168.10.1 255.255.255.0
MLS1(config-if)#no shutdown
MLS1(config-if)#interface vlan 20
MLS1(config-if)#ip address 192.168.20.1 255.255.255.0
MLS1(config-if)#interface vlan 30
MLS1(config-if)#ip address 192.168.30.1 255.255.255.0
! --- پورت Routed به سمت روتر اینترنت ---
MLS1(config-if)#interface g0/24
MLS1(config-if)#no switchport
MLS1(config-if)#ip address 10.0.0.2 255.255.255.252
MLS1(config-if)#exit
MLS1(config)#ip route 0.0.0.0 0.0.0.0 10.0.0.1

S1(config)#spanning-tree mode rapid-pvst
S1(config)#spanning-tree vlan 1,10,20 root primary
! معادل: spanning-tree vlan 10 priority 24576
S2(config)#spanning-tree vlan 1,10,20 root secondary
! --- پورت‌های کاربر: PortFast + BPDU Guard ---
S2(config)#interface range fa0/1 - 24
S2(config-if-range)#spanning-tree portfast
S2(config-if-range)#spanning-tree bpduguard enable
! یا به‌صورت سراسری:
S2(config)#spanning-tree portfast default
S2(config)#spanning-tree portfast bpduguard default
S1#show spanning-tree vlan 10
VLAN0010
  Spanning tree enabled protocol rstp
  Root ID    Priority    24586
             This bridge is the root

DIST1(config)#interface range g0/1 - 2
DIST1(config-if-range)#channel-group 1 mode active
DIST1(config-if-range)#exit
DIST1(config)#interface port-channel 1
DIST1(config-if)#switchport trunk encapsulation dot1q
DIST1(config-if)#switchport mode trunk
! روی DIST2 همین دستورات با mode active یا passive
DIST1#show etherchannel summary
Flags:  D - down        P - in port-channel
        S - Layer2      U - in use
Group  Port-channel  Protocol    Ports
------+-------------+-----------+----------------------------------------------
1      Po1(SU)           LACP   Gig0/1(P) Gig0/2(P)

SW1(config)#interface fa0/5
SW1(config-if)#switchport mode access
SW1(config-if)#switchport port-security
SW1(config-if)#switchport port-security maximum 2
SW1(config-if)#switchport port-security mac-address sticky
SW1(config-if)#switchport port-security violation shutdown
SW1#show port-security interface fa0/5
Port Security              : Enabled
Port Status                : Secure-up
Violation Mode             : Shutdown
Maximum MAC Addresses      : 2
Sticky MAC Addresses       : 1

SW1(config)#ip dhcp snooping
SW1(config)#ip dhcp snooping vlan 10,20
SW1(config)#no ip dhcp snooping information option
SW1(config)#interface g0/1
SW1(config-if)#ip dhcp snooping trust
! فقط پورت رو به سرور/روتر واقعی Trust می‌شود
SW1(config-if)#interface range fa0/1 - 24
SW1(config-if-range)#ip dhcp snooping limit rate 10
SW1#show ip dhcp snooping binding

SW1(config)#ip arp inspection vlan 10,20
SW1(config)#interface g0/1
SW1(config-if)#ip arp inspection trust

R1#show ip route
Gateway of last resort is 203.0.113.1 to network 0.0.0.0

     10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks
C       10.1.12.0/30 is directly connected, Serial0/0/0
L       10.1.12.1/32 is directly connected, Serial0/0/0
O       10.2.0.0/24 [110/65] via 10.1.12.2, 00:05:12, Serial0/0/0
S       10.3.0.0/24 [1/0] via 10.1.13.2
S*   0.0.0.0/0 [1/0] via 203.0.113.1

THR(config)#interface g0/0
THR(config-if)#ip address 192.168.1.1 255.255.255.0
THR(config-if)#no shutdown
THR(config-if)#interface s0/0/0
THR(config-if)#ip address 10.0.0.1 255.255.255.252
THR(config-if)#clock rate 128000
! فقط سمت DCE (علامت ساعت روی کابل)
THR(config-if)#no shutdown
THR(config-if)#interface s0/0/1
THR(config-if)#ip address 10.0.0.5 255.255.255.252
THR(config-if)#clock rate 128000
THR(config-if)#no shutdown
THR(config-if)#exit
! --- مسیرهای Static ---
THR(config)#ip route 192.168.2.0 255.255.255.0 10.0.0.2
THR(config)#ip route 192.168.3.0 255.255.255.0 10.0.0.6
! --- مسیرهای پشتیبان (Floating) ---
THR(config)#ip route 192.168.2.0 255.255.255.0 10.0.0.6 200
THR(config)#ip route 192.168.3.0 255.255.255.0 10.0.0.2 200

ISF(config)#ip route 192.168.1.0 255.255.255.0 10.0.0.1
ISF(config)#ip route 192.168.3.0 255.255.255.0 10.0.0.10
ISF(config)#ip route 0.0.0.0 0.0.0.0 10.0.0.1 200

R1(config)#router ospf 1
R1(config-router)#router-id 1.1.1.1
R1(config-router)#auto-cost reference-bandwidth 10000
! برای اینکه لینک‌های 1G و 10G هزینه‌ی متفاوت بگیرند (روی همه‌ی روترها)
R1(config-router)#network 10.1.12.0 0.0.0.3 area 1
R1(config-router)#network 10.1.13.0 0.0.0.3 area 0
R1(config-router)#passive-interface g0/2
! به سمت LAN کاربران Hello نفرستد
R1(config-router)#area 1 range 10.2.0.0 255.255.0.0
! Summarization در ABR

R2(config)#router ospf 1
R2(config-router)#router-id 2.2.2.2
R2(config-router)#passive-interface g0/1
R2(config-router)#exit
R2(config)#interface g0/0
R2(config-if)#ip ospf 1 area 1
R2(config-if)#interface g0/1
R2(config-if)#ip ospf 1 area 1

R3(config)#ip route 0.0.0.0 0.0.0.0 203.0.113.1
R3(config)#router ospf 1
R3(config-router)#router-id 3.3.3.3
R3(config-router)#network 10.1.13.0 0.0.0.3 area 0
R3(config-router)#default-information originate

R1#show ip ospf neighbor
Neighbor ID     Pri   State           Dead Time   Address         Interface
2.2.2.2           1   FULL/BDR        00:00:35    10.1.12.2       Gig0/0
3.3.3.3           1   FULL/DR         00:00:33    10.1.13.6       Gig0/1
R2#show ip route ospf
O*E2 0.0.0.0/0 [110/1] via 10.1.12.1, 00:01:10, GigabitEthernet0/0
O IA 10.1.13.0/30 [110/2] via 10.1.12.1, 00:03:44, GigabitEthernet0/0

R1(config)#router eigrp 100
R1(config-router)#eigrp router-id 1.1.1.1
R1(config-router)#network 192.168.1.0 0.0.0.255
R1(config-router)#network 10.0.0.0 0.0.0.3
R1(config-router)#no auto-summary
R1(config-router)#passive-interface g0/0
R1#show ip eigrp neighbors
R1#show ip eigrp topology
R1#show ip route eigrp

R1(config)#router rip
R1(config-router)#version 2
R1(config-router)#no auto-summary
R1(config-router)#network 192.168.1.0
R1(config-router)#network 10.0.0.0
R1(config-router)#passive-interface g0/0
R1(config-router)#default-information originate

R(config)#router ospf 1
R(config-router)#redistribute eigrp 100 subnets
R(config-router)#redistribute static subnets
R(config)#router eigrp 100
R(config-router)#redistribute ospf 1 metric 100000 100 255 1 1500

R1(config)#interface g0/1
R1(config-if)#ip address 192.168.10.2 255.255.255.0
R1(config-if)#standby version 2
R1(config-if)#standby 10 ip 192.168.10.1
R1(config-if)#standby 10 priority 110
R1(config-if)#standby 10 preempt
R1(config-if)#standby 10 track g0/0 20
! اگر لینک اینترنت قطع شد، 20 واحد از Priority کم کن
R1#show standby brief
Interface   Grp  Pri P State   Active          Standby         Virtual IP
Gig0/1      10   110 P Active  local           192.168.10.3    192.168.10.1

R2(config)#interface g0/1
R2(config-if)#ip address 192.168.10.3 255.255.255.0
R2(config-if)#standby version 2
R2(config-if)#standby 10 ip 192.168.10.1
R2(config-if)#standby 10 preempt

R1(config)#ip dhcp excluded-address 192.168.10.1 192.168.10.20
! رزرو آدرس‌های Gateway، سرور و پرینتر
R1(config)#ip dhcp pool VLAN10-SALES
R1(dhcp-config)#network 192.168.10.0 255.255.255.0
R1(dhcp-config)#default-router 192.168.10.1
R1(dhcp-config)#dns-server 192.168.50.10
R1(dhcp-config)#domain-name hopa.local
R1(dhcp-config)#lease 7
R1(dhcp-config)#option 150 ip 192.168.50.20
! (برای تلفن‌های IP: آدرس TFTP/CME)
R1#show ip dhcp binding
IP address       Client-ID/              Lease expiration        Type
                 Hardware address
192.168.10.21    0001.6378.A1B2           --                     Automatic
R1#show ip dhcp pool
R1#show ip dhcp conflict

MLS1(config)#interface vlan 10
MLS1(config-if)#ip helper-address 192.168.50.10
MLS1(config-if)#interface vlan 20
MLS1(config-if)#ip helper-address 192.168.50.10

R1(config)#clock timezone IRST 3 30
R1(config)#ntp server 192.168.50.10
R1(config)#service timestamps log datetime msec
R1(config)#logging host 192.168.50.10
R1(config)#logging trap informational
R1(config)#snmp-server community Hopa-RO ro
R1(config)#snmp-server community Hopa-RW rw
R1(config)#snmp-server location Tehran-DC-Rack2
R1(config)#snmp-server contact [email protected]
R1(config)#lldp run
R1#show ntp status
R1#show ntp associations
R1#show logging

EDGE(config)#interface g0/0
EDGE(config-if)#ip nat inside
EDGE(config-if)#interface g0/1
EDGE(config-if)#ip address 203.0.113.2 255.255.255.252
EDGE(config-if)#ip nat outside
EDGE(config-if)#exit
EDGE(config)#access-list 1 permit 192.168.0.0 0.0.255.255
EDGE(config)#ip nat inside source list 1 interface g0/1 overload
EDGE(config)#ip route 0.0.0.0 0.0.0.0 203.0.113.1

EDGE(config)#ip nat inside source static tcp 192.168.10.100 80 203.0.113.2 80
! Port Forwarding: هرکس به IP عمومی پورت 80 بیاید به وب‌سرور داخلی می‌رود
EDGE(config)#ip nat inside source static 192.168.10.50 203.0.113.5
! یک‌به‌یک کامل

EDGE(config)#ip nat pool PUBLIC 203.0.113.10 203.0.113.14 netmask 255.255.255.248
EDGE(config)#ip nat inside source list 1 pool PUBLIC overload

EDGE#show ip nat translations
Pro  Inside global       Inside local        Outside local      Outside global
icmp 203.0.113.2:1024    192.168.10.10:1     8.8.8.8:1          8.8.8.8:1
tcp  203.0.113.2:80      192.168.10.100:80   ---                ---
EDGE#show ip nat statistics
EDGE#clear ip nat translation *

MLS1(config)#ip access-list extended GUEST-IN
MLS1(config-ext-nacl)#remark --- Guest: Internet only ---
MLS1(config-ext-nacl)#permit udp 192.168.30.0 0.0.0.255 any eq 53
MLS1(config-ext-nacl)#permit udp any eq 68 any eq 67
MLS1(config-ext-nacl)#deny ip 192.168.30.0 0.0.0.255 10.0.0.0 0.255.255.255
MLS1(config-ext-nacl)#deny ip 192.168.30.0 0.0.0.255 172.16.0.0 0.15.255.255
MLS1(config-ext-nacl)#deny ip 192.168.30.0 0.0.0.255 192.168.0.0 0.0.255.255
MLS1(config-ext-nacl)#permit ip 192.168.30.0 0.0.0.255 any
MLS1(config-ext-nacl)#exit
MLS1(config)#interface vlan 30
MLS1(config-if)#ip access-group GUEST-IN in
!
MLS1(config)#ip access-list extended SALES-TO-SRV
MLS1(config-ext-nacl)#permit tcp 192.168.10.0 0.0.0.255 host 192.168.50.10 eq 80
MLS1(config-ext-nacl)#permit tcp 192.168.10.0 0.0.0.255 host 192.168.50.10 eq 443
MLS1(config-ext-nacl)#permit icmp 192.168.10.0 0.0.0.255 192.168.50.0 0.0.0.255
MLS1(config-ext-nacl)#deny ip 192.168.10.0 0.0.0.255 192.168.50.0 0.0.0.255 log
MLS1(config-ext-nacl)#permit ip any any
MLS1(config)#interface vlan 10
MLS1(config-if)#ip access-group SALES-TO-SRV in

R1(config)#ip access-list standard MGMT-ONLY
R1(config-std-nacl)#permit 192.168.99.0 0.0.0.255
R1(config-std-nacl)#deny any log
R1(config)#line vty 0 4
R1(config-line)#access-class MGMT-ONLY in

MLS1#show access-lists
Extended IP access list SALES-TO-SRV
    10 permit tcp 192.168.10.0 0.0.0.255 host 192.168.50.10 eq www (12 match(es))
    20 permit tcp 192.168.10.0 0.0.0.255 host 192.168.50.10 eq 443
    30 permit icmp 192.168.10.0 0.0.0.255 192.168.50.0 0.0.0.255 (8 match(es))
    40 deny ip 192.168.10.0 0.0.0.255 192.168.50.0 0.0.0.255 log (4 match(es))
    50 permit ip any any
MLS1(config)#ip access-list extended SALES-TO-SRV
MLS1(config-ext-nacl)#15 permit tcp 192.168.10.0 0.0.0.255 host 192.168.50.10 eq 21
MLS1(config-ext-nacl)#no 40
MLS1#show ip interface vlan 10 | include access list

R1(config)#aaa new-model
R1(config)#radius server HOPA-RAD
R1(config-radius-server)#address ipv4 192.168.50.10 auth-port 1812
R1(config-radius-server)#key Hopa@Aaa
R1(config-radius-server)#exit
R1(config)#aaa authentication login default group radius local
! اگر سرور در دسترس نبود از کاربر local استفاده کن
R1(config)#line vty 0 4
R1(config-line)#login authentication default

R1(config)#ipv6 unicast-routing
! بدون این دستور روتر IPv6 را مسیریابی نمی‌کند و RA نمی‌فرستد
R1(config)#interface g0/0
R1(config-if)#ipv6 address 2001:db8:acad:10::1/64
R1(config-if)#ipv6 address fe80::1 link-local
R1(config-if)#no shutdown
R1(config-if)#interface s0/0/0
R1(config-if)#ipv6 address 2001:db8:acad:12::1/64
R1(config-if)#exit
R1(config)#ipv6 route ::/0 2001:db8:acad:12::2
! --- OSPFv3 ---
R1(config)#ipv6 router ospf 10
R1(config-rtr)#router-id 1.1.1.1
R1(config-rtr)#interface g0/0
R1(config-if)#ipv6 ospf 10 area 0
R1(config-if)#interface s0/0/0
R1(config-if)#ipv6 ospf 10 area 0
R1#show ipv6 interface brief
R1#show ipv6 route
R1#show ipv6 ospf neighbor

R1(config)#ipv6 dhcp pool V6-LAN
R1(config-dhcpv6)#address prefix 2001:db8:acad:10::/64
R1(config-dhcpv6)#dns-server 2001:db8:acad:50::10
R1(config-dhcpv6)#domain-name hopa.local
R1(config)#interface g0/0
R1(config-if)#ipv6 nd managed-config-flag
R1(config-if)#ipv6 dhcp server V6-LAN

R1(config)#username R2 password Hopa@Chap
R1(config)#interface s0/0/0
R1(config-if)#encapsulation ppp
R1(config-if)#ppp authentication chap
!
R2(config)#username R1 password Hopa@Chap
R2(config)#interface s0/0/0
R2(config-if)#encapsulation ppp
R2(config-if)#ppp authentication chap
R1#show interfaces s0/0/0 | include Encapsulation|LCP

R1(config)#interface dialer 1
R1(config-if)#encapsulation ppp
R1(config-if)#ip address negotiated
R1(config-if)#mtu 1492
R1(config-if)#ppp chap hostname hopa@isp
R1(config-if)#ppp chap password Isp@Pass
R1(config-if)#dialer pool 1
R1(config-if)#interface g0/1
R1(config-if)#pppoe-client dial-pool-number 1
R1(config-if)#no shutdown

HQ(config)#interface tunnel 0
HQ(config-if)#ip address 172.16.0.1 255.255.255.252
HQ(config-if)#tunnel source g0/1
HQ(config-if)#tunnel destination 2.2.2.2
HQ(config-if)#exit
HQ(config)#ip route 10.20.0.0 255.255.255.0 172.16.0.2
! یا OSPF روی Tunnel0 اجرا کنید

HQ(config)#license boot module c2900 technology-package securityk9
HQ#reload
! روی 2911 ابتدا لایسنس امنیتی را فعال کنید
HQ(config)#crypto isakmp policy 10
HQ(config-isakmp)#encryption aes 256
HQ(config-isakmp)#hash sha
HQ(config-isakmp)#authentication pre-share
HQ(config-isakmp)#group 5
HQ(config-isakmp)#lifetime 86400
HQ(config)#crypto isakmp key Hopa@Vpn2026 address 2.2.2.2
HQ(config)#crypto ipsec transform-set HOPA-TS esp-aes 256 esp-sha-hmac
HQ(config)#access-list 110 permit ip 10.10.0.0 0.0.0.255 10.20.0.0 0.0.0.255
HQ(config)#crypto map HOPA-MAP 10 ipsec-isakmp
HQ(config-crypto-map)#set peer 2.2.2.2
HQ(config-crypto-map)#set transform-set HOPA-TS
HQ(config-crypto-map)#match address 110
HQ(config)#interface g0/1
HQ(config-if)#crypto map HOPA-MAP

HQ#show crypto isakmp sa
dst             src             state          conn-id slot status
2.2.2.2         1.1.1.1         QM_IDLE           1001    0 ACTIVE
HQ#show crypto ipsec sa
    #pkts encaps: 9, #pkts encrypt: 9, #pkts digest: 9
    #pkts decaps: 9, #pkts decrypt: 9, #pkts verify: 9

HQ(config)#ip access-list extended NAT-ACL
HQ(config-ext-nacl)#deny ip 10.10.0.0 0.0.0.255 10.20.0.0 0.0.0.255
HQ(config-ext-nacl)#permit ip 10.10.0.0 0.0.0.255 any
HQ(config)#ip nat inside source list NAT-ACL interface g0/1 overload

ciscoasa(config)#hostname HOPA-FW
HOPA-FW(config)#interface g1/1
HOPA-FW(config-if)#nameif outside
HOPA-FW(config-if)#security-level 0
HOPA-FW(config-if)#ip address 203.0.113.2 255.255.255.248
HOPA-FW(config-if)#interface g1/2
HOPA-FW(config-if)#nameif inside
HOPA-FW(config-if)#security-level 100
HOPA-FW(config-if)#ip address 192.168.1.1 255.255.255.0
HOPA-FW(config-if)#interface g1/3
HOPA-FW(config-if)#nameif dmz
HOPA-FW(config-if)#security-level 50
HOPA-FW(config-if)#ip address 172.16.50.1 255.255.255.0
HOPA-FW(config)#route outside 0.0.0.0 0.0.0.0 203.0.113.1
! --- PAT برای داخل ---
HOPA-FW(config)#object network INSIDE-NET
HOPA-FW(config-network-object)#subnet 192.168.1.0 255.255.255.0
HOPA-FW(config-network-object)#nat (inside,outside) dynamic interface
! --- انتشار وب‌سرور DMZ ---
HOPA-FW(config)#object network WEB-SRV
HOPA-FW(config-network-object)#host 172.16.50.10
HOPA-FW(config-network-object)#nat (dmz,outside) static 203.0.113.3
HOPA-FW(config)#access-list OUT-IN extended permit tcp any host 172.16.50.10 eq www
HOPA-FW(config)#access-group OUT-IN in interface outside
! --- اجازه‌ی پاسخ ICMP ---
HOPA-FW(config)#class-map inspection_default
HOPA-FW(config-cmap)#match default-inspection-traffic
HOPA-FW(config)#policy-map global_policy
HOPA-FW(config-pmap)#class inspection_default
HOPA-FW(config-pmap-c)#inspect icmp
HOPA-FW(config)#service-policy global_policy global

from time import *
from http import *

def main():
    client = HTTPClient()
    def onDone(status, data):
        print("Status:", status)
        print(data[:200])
    client.onDone(onDone)
    client.open("http://192.168.50.10/index.html")
    while True:
        sleep(10)

if __name__ == "__main__":
    main()

from http import *
from time import *
import json

def onTicket(status, data):
    token = json.loads(data)["response"]["serviceTicket"]
    c2 = HTTPClient()
    c2.onDone(lambda s, d: print(d))
    c2.openWithHeaders("http://192.168.99.20/api/v1/network-device",
                       {"X-Auth-Token": token})

c = HTTPClient()
c.onDone(onTicket)
c.post("http://192.168.99.20/api/v1/ticket",
       json.dumps({"username": "admin", "password": "Hopa@Api"}),
       {"Content-Type": "application/json"})
while True:
    sleep(5)

hostname DIST1
ip routing
spanning-tree mode rapid-pvst
spanning-tree vlan 10,30,99 root primary
spanning-tree vlan 20,50 root secondary
!
vlan 10
 name SALES
vlan 20
 name TECH
vlan 30
 name GUEST
vlan 50
 name SERVERS
vlan 99
 name MGMT
vlan 999
 name BLACKHOLE
!
interface range g1/0/1 - 2
 channel-group 1 mode active
interface port-channel 1
 switchport mode trunk
 switchport trunk native vlan 999
!
interface range g1/0/3 - 5
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,30,50,99
!
interface g1/0/24
 no switchport
 ip address 10.0.0.2 255.255.255.252
!
interface vlan 10
 ip address 192.168.10.2 255.255.255.0
 ip helper-address 192.168.50.10
 standby version 2
 standby 10 ip 192.168.10.1
 standby 10 priority 110
 standby 10 preempt
 standby 10 track g1/0/24 20
interface vlan 20
 ip address 192.168.20.2 255.255.255.0
 ip helper-address 192.168.50.10
 standby version 2
 standby 20 ip 192.168.20.1
 standby 20 preempt
interface vlan 30
 ip address 192.168.30.2 255.255.255.0
 ip helper-address 192.168.50.10
 ip access-group GUEST-IN in
 standby version 2
 standby 30 ip 192.168.30.1
 standby 30 priority 110
 standby 30 preempt
interface vlan 50
 ip address 192.168.50.2 255.255.255.0
 standby version 2
 standby 50 ip 192.168.50.1
 standby 50 preempt
interface vlan 99
 ip address 192.168.99.2 255.255.255.0
 standby version 2
 standby 99 ip 192.168.99.1
 standby 99 priority 110
 standby 99 preempt
!
router ospf 1
 router-id 2.2.2.2
 passive-interface default
 no passive-interface g1/0/24
 no passive-interface vlan 99
 network 10.0.0.0 0.0.0.3 area 0
 network 192.168.0.0 0.0.255.255 area 0
!
ip access-list extended GUEST-IN
 permit udp any any eq 67
 permit udp 192.168.30.0 0.0.0.255 host 192.168.50.10 eq 53
 deny ip 192.168.30.0 0.0.0.255 192.168.0.0 0.0.255.255
 deny ip 192.168.30.0 0.0.0.255 10.0.0.0 0.255.255.255
 permit ip 192.168.30.0 0.0.0.255 any
!
ntp server 192.168.50.10
logging host 192.168.50.10
ip domain-name hopa.local
username admin privilege 15 secret Hopa@Admin
crypto key generate rsa general-keys modulus 2048
ip ssh version 2
line vty 0 15
 login local
 transport input ssh

hostname ACC-F1
spanning-tree mode rapid-pvst
spanning-tree portfast default
spanning-tree portfast bpduguard default
vlan 10,20,30,99,999
interface range g0/1 - 2
 switchport mode trunk
 switchport trunk native vlan 999
 switchport nonegotiate
interface range fa0/1 - 20
 switchport mode access
 switchport access vlan 10
 switchport port-security
 switchport port-security maximum 2
 switchport port-security mac-address sticky
 switchport port-security violation restrict
interface range fa0/21 - 24
 switchport mode access
 switchport access vlan 999
 shutdown
interface vlan 99
 ip address 192.168.99.11 255.255.255.0
ip default-gateway 192.168.99.1
ip dhcp snooping
ip dhcp snooping vlan 10,20,30
interface range g0/1 - 2
 ip dhcp snooping trust

hostname EDGE
interface g0/0/0
 ip address 10.0.0.1 255.255.255.252
 ip nat inside
interface g0/0/1
 ip address 10.0.0.5 255.255.255.252
 ip nat inside
interface g0/0/2
 ip address 203.0.113.2 255.255.255.252
 ip nat outside
ip route 0.0.0.0 0.0.0.0 203.0.113.1
ip access-list standard NAT-IN
 permit 192.168.0.0 0.0.255.255
ip nat inside source list NAT-IN interface g0/0/2 overload
router ospf 1
 router-id 1.1.1.1
 network 10.0.0.0 0.0.0.7 area 0
 default-information originate

interface tunnel 1
 ip address 172.16.1.1 255.255.255.252
 tunnel source g0/1
 tunnel destination 2.2.2.2
 ip ospf 1 area 0
interface tunnel 2
 ip address 172.16.2.1 255.255.255.252
 tunnel source g0/1
 tunnel destination 3.3.3.3
 ip ospf 1 area 0
interface tunnel 3
 ip address 172.16.3.1 255.255.255.252
 tunnel source g0/1
 tunnel destination 4.4.4.4
 ip ospf 1 area 0
interface g0/0
 ip address 10.0.10.1 255.255.255.0
 ip ospf 1 area 0
router ospf 1
 router-id 10.0.0.1
 passive-interface g0/0
!
! --- IPsec فقط برای ترافیک GRE ---
crypto isakmp policy 10
 encr aes 256
 authentication pre-share
 group 5
crypto isakmp key Hopa@Wan address 0.0.0.0 0.0.0.0
crypto ipsec transform-set TS esp-aes 256 esp-sha-hmac
access-list 101 permit gre host 1.1.1.1 host 2.2.2.2
access-list 102 permit gre host 1.1.1.1 host 3.3.3.3
access-list 103 permit gre host 1.1.1.1 host 4.4.4.4
crypto map WAN 10 ipsec-isakmp
 set peer 2.2.2.2
 set transform-set TS
 match address 101
crypto map WAN 20 ipsec-isakmp
 set peer 3.3.3.3
 set transform-set TS
 match address 102
crypto map WAN 30 ipsec-isakmp
 set peer 4.4.4.4
 set transform-set TS
 match address 103
interface g0/1
 crypto map WAN

interface tunnel 0
 ip address 172.16.1.2 255.255.255.252
 tunnel source g0/1
 tunnel destination 1.1.1.1
 ip ospf 1 area 0
interface g0/0
 ip address 10.0.20.1 255.255.255.0
 ip helper-address 10.0.10.10
 ip ospf 1 area 0
 ip nat inside
interface g0/1
 ip address 2.2.2.2 255.255.255.252
 ip nat outside
router ospf 1
 router-id 10.0.0.2
 passive-interface g0/0
ip route 0.0.0.0 0.0.0.0 2.2.2.1
ip access-list extended NAT
 deny ip 10.0.0.0 0.0.255.255 10.0.0.0 0.0.255.255
 permit ip 10.0.20.0 0.0.0.255 any
ip nat inside source list NAT interface g0/1 overload

object network WEB
 host 172.16.50.10
 nat (dmz,outside) static 203.0.113.3
object network MAIL
 host 172.16.50.20
 nat (dmz,outside) static 203.0.113.4
access-list OUTSIDE-IN extended permit tcp any object WEB eq www
access-list OUTSIDE-IN extended permit tcp any object WEB eq https
access-list OUTSIDE-IN extended permit tcp any object MAIL eq smtp
access-group OUTSIDE-IN in interface outside
! DMZ (50) → inside (100) به‌طور پیش‌فرض بسته است
! وب‌سرور باید به DB داخلی وصل شود؟ فقط همان پورت:
access-list DMZ-IN extended permit tcp host 172.16.50.10 host 192.168.50.30 eq 3306
access-list DMZ-IN extended deny ip any 192.168.0.0 255.255.0.0
access-list DMZ-IN extended permit ip any any
access-group DMZ-IN in interface dmz

ip sla 1
 icmp-echo 8.8.8.8 source-interface g0/1
 frequency 5
ip sla schedule 1 life forever start-time now
track 1 ip sla 1 reachability
!
ip route 0.0.0.0 0.0.0.0 100.64.1.1 track 1
ip route 0.0.0.0 0.0.0.0 100.64.2.1 10
!
route-map ISP-A permit 10
 match ip address NAT-IN
 match interface g0/1
route-map ISP-B permit 10
 match ip address NAT-IN
 match interface g0/2
ip nat inside source route-map ISP-A interface g0/1 overload
ip nat inside source route-map ISP-B interface g0/2 overload
EDGE#show ip sla statistics
EDGE#show track 1

SW(config)#interface fa0/5
SW(config-if)#switchport mode access
SW(config-if)#switchport access vlan 10
SW(config-if)#switchport voice vlan 100
SW(config-if)#mls qos trust cos
!
CME(config)#ip dhcp pool VOICE
CME(dhcp-config)#network 192.168.100.0 255.255.255.0
CME(dhcp-config)#default-router 192.168.100.1
CME(dhcp-config)#option 150 ip 192.168.100.1
CME(config)#telephony-service
CME(config-telephony)#max-ephones 10
CME(config-telephony)#max-dn 10
CME(config-telephony)#ip source-address 192.168.100.1 port 2000
CME(config-telephony)#auto assign 1 to 10
CME(config)#ephone-dn 1
CME(config-ephone-dn)#number 1001
CME(config)#ephone-dn 2
CME(config-ephone-dn)#number 1002