一、划分vlan
LSW5:(二层交换机: 划分vlan, 数据转发)
vlan batch 20 30
int e0/0/1
port link-type access
port default vlan 20
int e0/0/2
port link-type access
port default vlan 30
int e0/0/3
port link-type trunk
port trunk allow-pass vlan all
Server1: (配置dns)
ip: 172.16.100.1
网关: 172.16.100.254
域名:www.zhyunnet.net
开启dns端口(53)
LSW1: (三层交换机: 路由和转发)
vlan batch 10 20 30 40
dhcp enable
int vlan 20
ip add 192.168.20.254 24
dhcp select interface
dhcp server dns-list 172.16.100.1
int vlan 30
ip add 192.168.30.254 24
dhcp select interface
dhcp server dns-list 172.16.100.1
int vlan 10
ip add 192.168.10.254 24
dhcp select interface
dhcp server dns-list 172.16.100.1
int vlan 40
ip add 172.16.100.254 24
int g0/0/3
port link-type access
port default vlan 40
int g0/0/1
port link-type access
port default vlan 10
int g0/0/2
port link-type trunk
port trunk allow-pass vlan all
二、 pc获得动态IP地址和dns
pc1,pc2, pc3通过dhcp动态分配IP地址。(此时内网已经通了)
(开始处理外网了!!)
三、路由器和外网pc基础配置
LSW1: (交换机没法配置IP地址,可以通过绑定vlan来添加)
vlan 100
int vlan 100
ip add 10.10.10.1 24
int g0/0/4
port link-type access
port default vlan 100
AR1:
int g0/0/0
ip add 10.10.10.2 24
int g0/0/1
ip add 64.1.1.1 24
AR2:
int g0/0/0
ip add 64.1.1.2 24
int g0/0/1
ip add 8.8.8.254 24
int g0/0/2
ip add 9.9.9.254 24
PC4: 8.8.8.8 255.255.255.0 网关8.8.8.254
PC5: 9.9.9.9 255.255.255.0 网关9.9.9.254
四、静态路由(nat和acl的配置,不能解决路由的问题,ping数据是双向的)
LSW1:
ip route-static 0.0.0.0 0.0.0.0 10.10.10.2
AR1:
ip route-static 0.0.0.0 0.0.0.0 64.1.1.2
ip route-static 192.168.0.0 255.255.0.0 10.10.10.1
ip route-static 172.16.100.0 255.255.255.0 10.10.10.1
-- 此时可以测试pc1,pc2, pc3, server1可以ping外网
五、设置acl 和 nat地址转换
AR1:
acl 2000
rule deny source 192.168.10.0 0.0.0.255
rule permit source any
int g0/0/0 # 守门
traffic-filter inbound acl 2000
acl 2001
nat address-group 1 64.1.1.4 64.1.1.8
nat permit source 192.168.0.0 0.0.0.255
int g0/0/1
nat outbound 2001 address-group 1
六、设置nat server公网地址映射
int g0/0/1
nat server global 64.1.1.10 inside 172.16.100.1
(此时,外网可以ping 64.1.1.10来访问内网中的server服务器了)