网络配置与仿真
Network configuration & simulation
Configure routers, switches, VLANs and firewalls in simulators to meet connectivity requirements.
20 条本项目编写的提案 · 分类 v1.1 · 新增基准运行 0 次。下方验证方式与部分得分规则是设计，不是执行结果。
- 典型应用
- Cisco Packet Tracer · GNS3 · pfSense
- 小类 GUI 需求标签
G2· GUI 必要
任务提案 · 20
展开查看完整原文与建议检查方式；两种界面均保留提案英文原文。
R03.06.01.01-T01 VLANs with router-on-a-stick in Packet Tracer
原始指令
Open fixtures/net/vlan_base.pkt in Packet Tracer. Create VLAN 10 (Staff) and VLAN 20 (Guest) on both switches, trunk the switch-to-switch and switch-to-router links, and configure router-on-a-stick subinterfaces so the two VLANs can route to each other. Assign the given host IPs.
- 平台
win· Windowsmac· macOS- 应用
- Cisco Packet Tracer
- 交互表面
desk· 桌面 GUI- GUI 需求 · 任务设定
G2· GUI 必要- GUI 需求 · 普通权限
G3· 仅 GUI- 交互原语
drag· 拖放click· 指向与点击type· 文字与表单- 工作产物
WP08· 应用 / 系统状态- 条件
- 未声明
- 提案难度
- 4 / 5
建议验证方式
Exported running-configs show VLAN 10/20, trunk encapsulation, and dot1q subinterfaces with correct gateways; in-sim ping across VLANs succeeds for all 4 host pairs. Graded on the .pkt state + simulated reachability; a pasted-in config without matching device state is rejected. Packet Tracer's IPC/ExApp scripting interface is disabled, and writes to the .pkt by any process other than Packet Tracer are logged and fail the task.
建议部分得分
30% VLANs + access ports; 30% trunks; 40% inter-VLAN ping matrix passes
R03.06.01.01-T02 Single-area OSPF across three routers
原始指令
In fixtures/net/ospf3.pkt, configure OSPF area 0 on routers R1-R3 so every LAN reaches every other LAN. Set R2 as the DR on the shared segment via interface priority, and advertise all connected networks. Use the addressing in the topology notes.
- 平台
win· Windowsmac· macOS- 应用
- Cisco Packet Tracer · GNS3
- 交互表面
desk· 桌面 GUI- GUI 需求 · 任务设定
G2· GUI 必要- GUI 需求 · 普通权限
G3· 仅 GUI- 交互原语
drag· 拖放click· 指向与点击type· 文字与表单- 工作产物
WP08· 应用 / 系统状态- 条件
- 未声明
- 提案难度
- 4 / 5
建议验证方式
OSPF neighbors are Full; every router's table has routes to all LANs; R2 is DR on the shared segment; full LAN-to-LAN ping matrix passes in-sim. Graded on the project state + reachability. Packet Tracer's IPC/ExApp scripting interface is disabled, and writes to the .pkt by any process other than Packet Tracer are logged and fail the task.
建议部分得分
30% OSPF adjacencies up; 30% full routing table; 20% R2 is DR; 20% full ping matrix
R03.06.01.01-T03 pfSense NAT port-forward for a web server
原始指令
In the lab pfSense web UI, forward inbound WAN TCP 80 and 443 to the internal web server 10.0.1.10, add the matching firewall pass rules, and block all other inbound WAN traffic. Verify the forward reaches the server from the simulated WAN client.
- 平台
web· 任意系统（网页）- 应用
- pfSense
- 交互表面
brow· 浏览器- GUI 需求 · 任务设定
G2· GUI 必要- GUI 需求 · 普通权限
G2· GUI 必要- 交互原语
nav· 平移 / 缩放 / 滚动click· 指向与点击type· 文字与表单- 工作产物
WP08· 应用 / 系统状态- 条件
- 未声明
- 提案难度
- 3 / 5
建议验证方式
pfSense config shows the two port-forwards to 10.0.1.10 with associated pass rules and a default WAN block; a WAN-side curl to 80/443 reaches the server while other ports are refused. Graded on the saved ruleset + reachability test. SSH, the console menu and the Command Prompt/Edit File pages are denied to the agent user and no REST API package is installed; each config.xml revision must name the webConfigurator page that saved it.
建议部分得分
40% both port-forwards; 30% associated pass rules; 30% other inbound blocked + reachable
R03.06.01.01-T04 DHCP server and relay across subnets
原始指令
In fixtures/net/dhcp.pkt, configure a central DHCP server with two pools (VLAN 10: 10.0.10.0/24, VLAN 20: 10.0.20.0/24, each excluding the first 10 addresses and setting the gateway+DNS), and set an ip helper-address on the router so remote-subnet clients get leases.
- 平台
win· Windowsmac· macOS- 应用
- Cisco Packet Tracer
- 交互表面
desk· 桌面 GUI- GUI 需求 · 任务设定
G2· GUI 必要- GUI 需求 · 普通权限
G3· 仅 GUI- 交互原语
click· 指向与点击type· 文字与表单drag· 拖放- 工作产物
WP08· 应用 / 系统状态- 条件
- 未声明
- 提案难度
- 3 / 5
建议验证方式
Both pools defined with correct exclusions/gateway/DNS; the helper-address is set; in-sim, PCs in both VLANs obtain addresses from the right pool. Graded on config + simulated lease assignment. Packet Tracer's IPC/ExApp scripting interface is disabled, and writes to the .pkt by any process other than Packet Tracer are logged and fail the task.
建议部分得分
40% both pools correct; 30% helper-address relay; 30% clients lease from correct pool
R03.06.01.01-T05 eBGP peering between two AS in GNS3
原始指令
In fixtures/net/bgp.gns3, establish an eBGP session between AS 65001 (R1) and AS 65002 (R2), advertise 203.0.113.0/24 from R1 and 198.51.100.0/24 from R2, and apply a prefix-list on R2 that denies R1's more-specifics. Confirm both prefixes are learned.
- 平台
lin· Linuxwin· Windowsmac· macOS- 应用
- GNS3
- 交互表面
desk· 桌面 GUI- GUI 需求 · 任务设定
G2· GUI 必要- GUI 需求 · 普通权限
CL· CLI 足够- 交互原语
drag· 拖放click· 指向与点击type· 文字与表单- 工作产物
WP08· 应用 / 系统状态- 条件
long· 长流程- 提案难度
- 5 / 5
建议验证方式
BGP session is Established; R2 has 203.0.113.0/24 and R1 has 198.51.100.0/24; the prefix-list on R2 filters the specified more-specifics (not in table). Graded on the lab device state + BGP tables. gns3server REST credentials are withheld from the agent, and the server request log must show node and link changes came from the GNS3 GUI client.
建议部分得分
30% session Established; 30% prefixes advertised/learned; 40% prefix-list filtering correct
R03.06.01.01-T06 Access control list flow matrix
原始指令
In fixtures/net/acl.pkt, apply an extended ACL on R1 so that: Staff (10.0.10.0/24) may reach the server on TCP 443 only, Guest (10.0.20.0/24) may reach the internet but not the server, and ICMP to R1 is denied from Guest. Verify with the given test flows.
- 平台
win· Windowsmac· macOS- 应用
- Cisco Packet Tracer
- 交互表面
desk· 桌面 GUI- GUI 需求 · 任务设定
G2· GUI 必要- GUI 需求 · 普通权限
G3· 仅 GUI- 交互原语
click· 指向与点击type· 文字与表单- 工作产物
WP08· 应用 / 系统状态- 条件
- 未声明
- 提案难度
- 4 / 5
建议验证方式
The ACL and its interface/direction are correct; the 6 test flows in the topology produce the exact permit/deny outcomes expected. Graded on config + simulated flow results. Packet Tracer's IPC/ExApp scripting interface is disabled, and writes to the .pkt by any process other than Packet Tracer are logged and fail the task.
建议部分得分
30% ACL entries correct; 20% applied on right interface/direction; 50% test-flow matrix matches
R03.06.01.01-T07 Set the STP root bridge
原始指令
In fixtures/net/stp.pkt with three switches, make SW1 the root bridge for VLAN 1 by setting its bridge priority to 4096 and SW2 the secondary (8192). Confirm the resulting port roles and that no loop exists.
- 平台
win· Windowsmac· macOS- 应用
- Cisco Packet Tracer
- 交互表面
desk· 桌面 GUI- GUI 需求 · 任务设定
G2· GUI 必要- GUI 需求 · 普通权限
G3· 仅 GUI- 交互原语
click· 指向与点击type· 文字与表单- 工作产物
WP08· 应用 / 系统状态- 条件
- 未声明
- 提案难度
- 2 / 5
建议验证方式
SW1 shows priority 4096 and is root for VLAN 1; SW2 is secondary; port roles (root/designated/blocking) match the expected loop-free topology. Graded on spanning-tree state in the sim. Packet Tracer's IPC/ExApp scripting interface is disabled, and writes to the .pkt by any process other than Packet Tracer are logged and fail the task.
建议部分得分
40% priorities set; 30% SW1 is root; 30% correct port roles / loop-free
R03.06.01.01-T08 LACP EtherChannel between switches
原始指令
In fixtures/net/etherchannel.pkt, bundle the two links between SW1 and SW2 into a Layer-2 LACP port-channel (active/active), carrying VLANs 10 and 20 as a trunk. Confirm the channel comes up and load-balances.
- 平台
win· Windowsmac· macOS- 应用
- Cisco Packet Tracer
- 交互表面
desk· 桌面 GUI- GUI 需求 · 任务设定
G2· GUI 必要- GUI 需求 · 普通权限
G3· 仅 GUI- 交互原语
click· 指向与点击type· 文字与表单- 工作产物
WP08· 应用 / 系统状态- 条件
- 未声明
- 提案难度
- 3 / 5
建议验证方式
Port-channel is up with both member ports bundled via LACP (mode active); the channel trunks VLAN 10/20; inter-switch VLAN traffic passes. Graded on the EtherChannel state + trunk config. Packet Tracer's IPC/ExApp scripting interface is disabled, and writes to the .pkt by any process other than Packet Tracer are logged and fail the task.
建议部分得分
40% LACP bundle up with both members; 30% trunk VLANs; 30% traffic passes
R03.06.01.01-T09 Site-to-site IPsec VPN in pfSense
原始指令
Two lab pfSense firewalls (Site A 10.1.0.0/24, Site B 10.2.0.0/24) need an IKEv2 IPsec tunnel. Configure phase 1/2 on both with the shared parameters in fixtures/net/ipsec.txt, add firewall rules to allow the tunneled subnets, and verify a host in A can ping a host in B over the tunnel.
- 平台
web· 任意系统（网页）- 应用
- pfSense
- 交互表面
brow· 浏览器- GUI 需求 · 任务设定
G2· GUI 必要- GUI 需求 · 普通权限
G2· GUI 必要- 交互原语
nav· 平移 / 缩放 / 滚动click· 指向与点击type· 文字与表单- 工作产物
WP08· 应用 / 系统状态- 条件
long· 长流程multiapp· 多应用- 提案难度
- 5 / 5
建议验证方式
Both firewalls show the IPsec SA established with matching P1/P2 params; IPsec firewall rules permit the subnets; cross-site ping succeeds and traffic uses the tunnel. Graded on both configs + reachability. SSH, the console menu and the Command Prompt/Edit File pages are denied to the agent user and no REST API package is installed; each config.xml revision must name the webConfigurator page that saved it.
建议部分得分
25% P1 established; 25% P2/child SA; 20% firewall rules; 30% cross-site ping over tunnel
R03.06.01.01-T10 Port security on access ports
原始指令
In fixtures/net/portsec.pkt, enable port security on the three access ports of SW1: max 2 MACs, sticky learning, violation restrict. Pre-authorize the server's MAC on its port as static. Show a third device triggers a violation.
- 平台
win· Windowsmac· macOS- 应用
- Cisco Packet Tracer
- 交互表面
desk· 桌面 GUI- GUI 需求 · 任务设定
G2· GUI 必要- GUI 需求 · 普通权限
G3· 仅 GUI- 交互原语
click· 指向与点击type· 文字与表单- 工作产物
WP08· 应用 / 系统状态- 条件
- 未声明
- 提案难度
- 3 / 5
建议验证方式
Port security config matches (max 2, sticky, restrict) on the three ports with the server's static MAC; in-sim a third MAC raises a violation counter and the port restricts it. Graded on config + violation behavior. Packet Tracer's IPC/ExApp scripting interface is disabled, and writes to the .pkt by any process other than Packet Tracer are logged and fail the task.
建议部分得分
40% port-security settings; 30% server static MAC; 30% violation triggers restrict
R03.06.01.01-T11 PAT overload to a single public IP
原始指令
In fixtures/net/pat.pkt, configure NAT overload (PAT) on R1 so the inside LAN 192.168.0.0/24 shares the single outside address 203.0.113.2. Define the inside/outside interfaces and an ACL for the NAT source. Verify two inside hosts reach the outside server simultaneously.
- 平台
win· Windowsmac· macOS- 应用
- Cisco Packet Tracer
- 交互表面
desk· 桌面 GUI- GUI 需求 · 任务设定
G2· GUI 必要- GUI 需求 · 普通权限
G3· 仅 GUI- 交互原语
click· 指向与点击type· 文字与表单- 工作产物
WP08· 应用 / 系统状态- 条件
- 未声明
- 提案难度
- 3 / 5
建议验证方式
ip nat inside/outside set, overload NAT with the source ACL present; the NAT translation table shows both inside hosts mapped to 203.0.113.2 with distinct ports; both reach the server. Graded on config + translation table. Packet Tracer's IPC/ExApp scripting interface is disabled, and writes to the .pkt by any process other than Packet Tracer are logged and fail the task.
建议部分得分
30% inside/outside + ACL; 30% overload rule; 40% translations for both hosts work
R03.06.01.01-T12 VLSM subnet design and apply
原始指令
Given 172.16.0.0/22 and the host-count requirements in fixtures/net/vlsm.txt (4 LANs of 500/200/50/10 hosts plus point-to-point links), design a VLSM plan with no overlaps and minimal waste, then apply the addressing to fixtures/net/vlsm.pkt and prove reachability.
- 平台
win· Windowsmac· macOS- 应用
- Cisco Packet Tracer
- 交互表面
desk· 桌面 GUI- GUI 需求 · 任务设定
G2· GUI 必要- GUI 需求 · 普通权限
G3· 仅 GUI- 交互原语
click· 指向与点击type· 文字与表单- 工作产物
WP08· 应用 / 系统状态- 条件
- 未声明
- 提案难度
- 4 / 5
建议验证方式
The subnet plan in plan.csv has correct non-overlapping prefix lengths sized to each requirement; device interfaces match the plan; full ping matrix passes in-sim. Graded on the plan + applied config + reachability. Packet Tracer's IPC/ExApp scripting interface is disabled, and writes to the .pkt by any process other than Packet Tracer are logged and fail the task.
建议部分得分
40% correct non-overlapping VLSM plan; 30% applied to interfaces; 30% reachability
R03.06.01.01-T13 Three-interface DMZ on pfSense
原始指令
Configure the lab pfSense with WAN, LAN (10.0.1.0/24), and DMZ (10.0.2.0/24). Allow LAN to initiate to DMZ and WAN; allow WAN to reach only the DMZ web server on 443; block DMZ from initiating to LAN. Verify the three rules with test flows.
- 平台
web· 任意系统（网页）- 应用
- pfSense
- 交互表面
brow· 浏览器- GUI 需求 · 任务设定
G2· GUI 必要- GUI 需求 · 普通权限
G2· GUI 必要- 交互原语
nav· 平移 / 缩放 / 滚动click· 指向与点击type· 文字与表单- 工作产物
WP08· 应用 / 系统状态- 条件
- 未声明
- 提案难度
- 4 / 5
建议验证方式
Interface rules implement the three policies; test flows show LAN->DMZ allowed, WAN->DMZ:443 allowed (other ports blocked), DMZ->LAN blocked. Graded on the saved rules + flow outcomes. SSH, the console menu and the Command Prompt/Edit File pages are denied to the agent user and no REST API package is installed; each config.xml revision must name the webConfigurator page that saved it.
建议部分得分
30% LAN egress rules; 30% WAN->DMZ:443 only; 40% DMZ->LAN blocked (flow tests)
R03.06.01.01-T14 First-hop redundancy with HSRP
原始指令
In fixtures/net/hsrp.pkt, configure HSRP on R1 and R2 for VLAN 10 with virtual IP 10.0.10.1, R1 active (priority 110, preempt) and R2 standby. Hosts use .1 as gateway. Demonstrate failover: when R1's uplink drops, R2 takes over with no lasting loss.
- 平台
win· Windowsmac· macOS- 应用
- Cisco Packet Tracer
- 交互表面
desk· 桌面 GUI- GUI 需求 · 任务设定
G2· GUI 必要- GUI 需求 · 普通权限
G3· 仅 GUI- 交互原语
click· 指向与点击type· 文字与表单- 工作产物
WP08· 应用 / 系统状态- 条件
long· 长流程- 提案难度
- 5 / 5
建议验证方式
HSRP group shows R1 Active/R2 Standby with the VIP and preempt; after disabling R1's uplink (with interface tracking), R2 becomes Active and host connectivity continues. Graded on HSRP state before/after the induced failure. Packet Tracer's IPC/ExApp scripting interface is disabled, and writes to the .pkt by any process other than Packet Tracer are logged and fail the task.
建议部分得分
30% HSRP VIP + roles; 20% priority/preempt; 20% interface tracking; 30% failover works
R03.06.01.01-T15 Inter-VLAN routing on an L3 switch
原始指令
In fixtures/net/l3switch.pkt, enable IP routing on the multilayer switch and create SVIs for VLAN 10 (10.0.10.1/24) and VLAN 20 (10.0.20.1/24) as the VLAN gateways. Assign host ports and confirm the two VLANs route without an external router.
- 平台
win· Windowsmac· macOS- 应用
- Cisco Packet Tracer
- 交互表面
desk· 桌面 GUI- GUI 需求 · 任务设定
G2· GUI 必要- GUI 需求 · 普通权限
G3· 仅 GUI- 交互原语
click· 指向与点击type· 文字与表单- 工作产物
WP08· 应用 / 系统状态- 条件
- 未声明
- 提案难度
- 3 / 5
建议验证方式
ip routing enabled; both SVIs up with correct addresses; access ports in the right VLANs; inter-VLAN ping succeeds with no external router in path. Graded on config + reachability. Packet Tracer's IPC/ExApp scripting interface is disabled, and writes to the .pkt by any process other than Packet Tracer are logged and fail the task.
建议部分得分
30% SVIs configured; 20% ip routing on; 20% access ports; 30% inter-VLAN ping
R03.06.01.01-T16 Static and default routing
原始指令
In fixtures/net/static.pkt (3 routers in a line R1-R2-R3), add static routes so R1 and R3 reach each other's LANs via R2, and give R2 a default route toward the simulated ISP. Verify end-to-end connectivity.
- 平台
win· Windowsmac· macOS- 应用
- Cisco Packet Tracer
- 交互表面
desk· 桌面 GUI- GUI 需求 · 任务设定
G2· GUI 必要- GUI 需求 · 普通权限
G3· 仅 GUI- 交互原语
click· 指向与点击type· 文字与表单- 工作产物
WP08· 应用 / 系统状态- 条件
- 未声明
- 提案难度
- 2 / 5
建议验证方式
Routing tables contain the correct static entries and R2's default route; R1-LAN to R3-LAN ping succeeds and R2 can reach the ISP address. Graded on config + reachability. Packet Tracer's IPC/ExApp scripting interface is disabled, and writes to the .pkt by any process other than Packet Tracer are logged and fail the task.
建议部分得分
50% static routes correct; 25% default route; 25% end-to-end ping
R03.06.01.01-T17 Traffic shaping and captive portal in pfSense
原始指令
On the lab pfSense Guest interface, enable a captive portal requiring voucher login and apply a traffic-shaper limiter capping each Guest client to 2 Mbit/s down / 1 Mbit/s up. Verify an un-authenticated client is redirected and a logged-in client is rate-limited.
- 平台
web· 任意系统（网页）- 应用
- pfSense
- 交互表面
brow· 浏览器- GUI 需求 · 任务设定
G2· GUI 必要- GUI 需求 · 普通权限
G2· GUI 必要- 交互原语
nav· 平移 / 缩放 / 滚动click· 指向与点击type· 文字与表单- 工作产物
WP08· 应用 / 系统状态- 条件
- 未声明
- 提案难度
- 3 / 5
建议验证方式
Captive portal enabled on Guest with vouchers; limiter pipes set to 2/1 Mbit/s bound to the interface; a pre-auth client is redirected to the portal and a post-auth throughput test stays within the cap. Graded on config + behavior. SSH, the console menu and the Command Prompt/Edit File pages are denied to the agent user and no REST API package is installed; each config.xml revision must name the webConfigurator page that saved it.
建议部分得分
40% captive portal active; 30% limiter rates set+bound; 30% redirect + rate cap verified
R03.06.01.01-T18 Build a topology from a requirements brief
原始指令
From the requirements in fixtures/net/brief.md (2 sites, VLANs, OSPF core, inter-site static backup, DHCP, and an ACL policy), build the topology from scratch in a new Packet Tracer file, address every link, and produce a reachability matrix showing all required flows pass and denied flows fail.
- 平台
win· Windowsmac· macOS- 应用
- Cisco Packet Tracer · GNS3
- 交互表面
desk· 桌面 GUI- GUI 需求 · 任务设定
G2· GUI 必要- GUI 需求 · 普通权限
G3· 仅 GUI- 交互原语
drag· 拖放click· 指向与点击type· 文字与表单- 工作产物
WP08· 应用 / 系统状态- 条件
long· 长流程- 提案难度
- 4 / 5
建议验证方式
The built topology matches the brief's device/link count and addressing; OSPF + backup route present; DHCP works; the reachability matrix matches the brief's allow/deny spec exactly. Graded on the project file + the full flow matrix. Packet Tracer's IPC/ExApp scripting interface is disabled, and writes to the .pkt by any process other than Packet Tracer are logged and fail the task.
建议部分得分
25% topology+addressing; 25% OSPF+backup; 20% DHCP; 30% reachability matrix matches brief
R03.06.01.01-T19 Configure VLANs via IOS CLI (control pair of T01)
原始指令
Control pair of T01: on the lab devices' IOS command line only (console/SSH, no GUI topology editing), configure VLAN 10/20, access ports, 802.1Q trunks, and router-on-a-stick subinterfaces to meet the same connectivity goal as T01. Save the running-configs.
- 平台
lin· Linux- 应用
- GNS3
- 交互表面
term· 终端- GUI 需求 · 任务设定
CL· CLI 足够- GUI 需求 · 普通权限
CL· CLI 足够- 交互原语
code· 代码与命令type· 文字与表单- 工作产物
WP08· 应用 / 系统状态- 条件
- 未声明
- 提案难度
- 2 / 5
建议验证方式
Saved running-configs contain the VLANs, access/trunk ports, and dot1q subinterfaces; the inter-VLAN ping matrix passes. Graded on configs + reachability; contrasts with the GUI drag-and-configure workflow of T01.
建议部分得分
30% VLANs+access; 30% trunks; 40% inter-VLAN reachability
R03.06.01.01-T20 Configure OSPF via IOS CLI (control pair of T02)
原始指令
Control pair of T02: using only the IOS CLI on R1-R3, bring up OSPF area 0, advertise all connected LANs, and set R2 as DR via interface priority, achieving the same full reachability as T02. Produce ospf_configs.txt with each router's config.
- 平台
lin· Linux- 应用
- GNS3
- 交互表面
term· 终端- GUI 需求 · 任务设定
CL· CLI 足够- GUI 需求 · 普通权限
CL· CLI 足够- 交互原语
code· 代码与命令type· 文字与表单- 工作产物
WP08· 应用 / 系统状态- 条件
- 未声明
- 提案难度
- 3 / 5
建议验证方式
Each router's OSPF config advertises its LANs; neighbors reach Full; R2 is DR on the shared segment; full LAN ping matrix passes. Graded on configs + reachability; contrasts with the GUI build of T02.
建议部分得分
30% adjacencies Full; 30% full routing tables; 20% R2 DR; 20% full ping matrix
已有研究映射
以下沿用研究目录中的基准与小类映射，不是逐题标注、执行记录或产品背书。