一招鲜——单臂路由+ACL+NAT实验

实验一：

实验要求：全网互通 ,配置ACL使得vlan10和vlan20不通, 配置ACL和R1不能访问webserver

全网互通
路由器R1配置

配置路由器R2

配置交换机sw1

**配置路由器R1:**
[R1]vlan batch  10  20
[R1]int g0/0/0.1     //设置子接口
[R1-GigabitEthernet0/0/0.1]ip a 192.168.1.254 24
[R1-GigabitEthernet0/0/0.1]d t v 10
[R1-GigabitEthernet0/0/0.1]a b e //开启广播
[R1-GigabitEthernet0/0/0.1]int g0/0/0.2
[R1-GigabitEthernet0/0/0.2]ip a 192.168.2.254 24
[R1-GigabitEthernet0/0/0.2]d t v 20
[R1-GigabitEthernet0/0/0.2]a b e 
[R1-GigabitEthernet0/0/0.2]q
[R1]int g0/0/1
[R1-GigabitEthernet0/0/1]ip a 192.168.20.1 24
[R1]ip route-static 0.0.0.0 0.0.0.0 192.168.20.2//配置默认路由
**配置路由器R2**
[Huawei]int g0/0/0
[Huawei-GigabitEthernet0/0/0]ip a 192.168.20.2 24
[Huawei-GigabitEthernet0/0/0]int g0/0/1
[Huawei-GigabitEthernet0/0/1]ip a 192.168.60.254 24
[Huawei]ip route-static 192.168.1.0 24 192.168.20.1
[Huawei]ip route-static 192.168.2.0 24 192.168.20.1  //设置静态路由
**配置交换机sw1**
[SW1]vlan batch 10 20
[SW1]int e0/0/1
[SW1-Ethernet0/0/1]p l a
[SW1-Ethernet0/0/1]p d v 10
[SW1-Ethernet0/0/1]int e0/0/2
[SW1-Ethernet0/0/2]p l a
[SW1-Ethernet0/0/2]p d v 20
[SW1-Ethernet0/0/2]int e0/0/3
[SW1-Ethernet0/0/3]p l a
[SW1-Ethernet0/0/3]p d v 10
[SW1-Ethernet0/0/3]int e0/0/4
[SW1-Ethernet0/0/4] p l a 
[SW1-Ethernet0/0/4]p d v 20
[SW1-Ethernet0/0/4]int e0/0/5
[SW1-Ethernet0/0/5]p l t 
[SW1-Ethernet0/0/5]p t a v a

配置ACL使得vlan10和vlan20不通
配置路由器R1

**配置R1**
[R1]acl 2000
[R1-acl-basic-2000]rule deny source 192.168.1.0 0.0.0.255 //拒绝1.0网段通过
[R1-acl-basic-2000]rule permit source 192.168.2.0 0.0.0.255//允许2.0网段通过
[R1-acl-basic-2000]int g0/0/0.2
[R1-GigabitEthernet0/0/0.2]traffic-filter  outboun	
[R1-GigabitEthernet0/0/0.2]traffic-filter  outbound  acl 2000  //激活

配置ACL和R1不能访问webserver

[R1]acl 3000
[R1-acl-adv-3000]rule deny tcp source any destination 192.168.60.1 0 destination
-port eq 80
[R1-acl-adv-3000]int g0/0/2
[R1-GigabitEthernet0/0/2]traffic-filter outbound acl 3000
[R1-GigabitEthernet0/0/2]q
[R1]acl 3000
[R1-acl-adv-3000]rule deny ip source 192.168.1.0 0.0.0.255 destination 192.168.2
.0 0.0.0.255
[R1-acl-adv-3000]int g0/0/1
[R1-GigabitEthernet0/0/1]traffic-filter outbound acl 3000

实验二、

实验要求：client为公网上的一个用户，R4为内网出口路由器， 内网PC可以访问web sever,并且pc和web sever可以访问公网client,client可以访问内网的web server

配置sw1

[Huawei]sys sw1
[sw1]vlan batch 10 20 100
Info: This operation may take a few seconds. Please wait for a moment...done.
[sw1]int e0/0/1
[sw1-Ethernet0/0/1]p l a 
[sw1-Ethernet0/0/1]p  d v 20
[sw1-Ethernet0/0/1]int e0/0/2
[sw1-Ethernet0/0/2]p l a 
[sw1-Ethernet0/0/2]p d v  10
[sw1-Ethernet0/0/2]int e0/0/3
[sw1-Ethernet0/0/3]p l t 
[sw1-Ethernet0/0/3]p t a v a
[sw1-Ethernet0/0/3] User interface con0 is available

配置RSW

[Huawei]sys RSW1
[RSW1]vlan batch 10 20 100
[RSW1]int g0/0/1
[RSW1-GigabitEthernet0/0/1]p l t 
[RSW1-GigabitEthernet0/0/1]p t a v a
[RSW1-GigabitEthernet0/0/1]int vlanif 100
[RSW1-Vlanif100]ip a 10.0.0.1 24
[RSW1-Vlanif100]int g0/0/2
[RSW1-GigabitEthernet0/0/2]p l a 
[RSW1-GigabitEthernet0/0/2]p d v 100
[RSW1-GigabitEthernet0/0/2]int vlanif 10
[RSW1-Vlanif10]ip a 192.168.10.254 24
[RSW1-Vlanif10]int vlanif 20
[RSW1-Vlanif20]ip a 192.168.20.254 24
[RSW1]ip route-static 0.0.0.0 0 10.0.0.2

配置R1

[Huawei]sys R1
[R1]int g0/0/0
[R1-GigabitEthernet0/0/0]ip a 10.0.0.2 24
[R1-GigabitEthernet0/0/0]int g0/0/1
[R1-GigabitEthernet0/0/1]ip a 20.0.0.1 24
[R1]ip route-static 0.0.0.0 0 20.0.0.2
[R1]ip route-static 192.168.10.0 24 10.0.0.1
[R1]ip route-static 192.168.20.0 24 10.0.0.1
[R1]nat address-group 1 20.0.0.10 20.0.0.20   
[R1]acl 2000   
[R1-acl-basic-2000]rule permit source 192.168.10.0 0.0.0.255
[R1-acl-basic-2000]rule permit source 192.168.20.0 0.0.0.255
[R1-acl-basic-2000]int g0/0/1
[R1-GigabitEthernet0/0/1]nat server protocol tcp global 20.0.0.55 80 inside 192.
168.20.1 80
[R1]ip route-static 192.168.0.0 255.255.0.0 10.0.0.1

配置R2

[Huawei]int g0/0/0
[Huawei-GigabitEthernet0/0/0]ip a 20.0.0.2 24
[Huawei-GigabitEthernet0/0/0]int g0/0/1
[Huawei-GigabitEthernet0/0/1]ip a 100.0.0.254 24
[Huawei]ip route-static 192.168.10.0 24 20.0.0.1
[Huawei]ip route-static 192.168.20.0 24 20.0.0.1