实验拓扑:
配置:
[sw1]vlan batch 2 3
[sw1]int e 0/0/1
[sw1-Ethernet0/0/1]port link-type access
[sw1-Ethernet0/0/1]port default vlan 2
[sw1]int e 0/0/2
[sw1-Ethernet0/0/2]port link-type access
[sw1-Ethernet0/0/2]port default vlan 3
[sw1]int g 0/0/1
[sw1-GigabitEthernet0/0/1]port link-type trunk
[sw1-GigabitEthernet0/0/1]port trunk allow-pass vlan all
[sw1]int g 0/0/2
[sw1-GigabitEthernet0/0/2]port link-type trunk
[sw1-GigabitEthernet0/0/2]port trunk allow-pass vlan all
[sw2]vlan batch 2 3
[sw2]int e 0/0/1
[sw2-Ethernet0/0/1]port link-type access
[sw2-Ethernet0/0/1]port default vlan 2
[s2]int e 0/0/2
[sw2-Ethernet0/0/2]port link-type access
[sw2-Ethernet0/0/2]port default vlan 3
[sw2]int g 0/0/2
[sw2-GigabitEthernet0/0/2]port link-type trunk
[sw2-GigabitEthernet0/0/2]port trunk allow-pass vlan all
[R1]int g 0/0/0
[R1-GigabitEthernet0/0/0]ip add 192.168.0.97 28
[R1-GigabitEthernet0/0/0]int g 0/0/2
[R1-GigabitEthernet0/0/2]ip add 192.168.0.82 28
[R1]int g 0/0/1.1
[R1-GigabitEthernet0/0/1.1]ip add 192.168.0.113 28
[R1-GigabitEthernet0/0/1.1]dot1q termination vid 2
[R1-GigabitEthernet0/0/1.1]arp broadcast enable
[R1]int g 0/0/1.2
[R1-GigabitEthernet0/0/1.2]ip add 192.168.0.129 28
[R1-GigabitEthernet0/0/1.2]dot1q termination vid 3
[R1-GigabitEthernet0/0/1.2]arp broadcast enable
[R1]dhcp enable
[R1]ip pool xixi
[R1-ip-pool-xixi]network 192.168.0.112 mask 255.255.255.240
[R1-ip-pool-xixi]gateway-list 192.168.0.113
[R1-ip-pool-xixi]dns-list 114.114.114.114
[R1]ip pool haha
[R1-ip-pool-haha]network 192.168.0.128 mask 255.255.255.240
[R1-ip-pool-haha]gateway-list 192.168.0.129
[R1-ip-pool-haha]dns-list 114.114.114.114
[R1]int g 0/0/1.1
[R1-GigabitEthernet0/0/1.1]dhcp select global
[R1]int g 0/0/1.2
[R1-GigabitEthernet0/0/1.2]dhcp select global
[R1]ip route-static 192.168.0.32 255.255.255.240 192.168.0.98
[R1]ip route-static 192.168.0.16 255.255.255.240 192.168.0.98
[R1]ip route-static 192.168.0.48 255.255.255.240 192.168.0.81
[R1]ip route-static 192.168.0.64 255.255.255.240 192.168.0.81
[R1]ip route-static 192.168.0.0 28 192.168.0.98
[R1]ip route-static 0.0.0.0 0 192.168.0.81
[R2]int l0
[R2-LoopBack0]ip add 192.168.0.1 30
[R2]int l1
[R2-LoopBack1]ip add 192.168.0.5 30
[R2]int l2
[R2-LoopBack2]ip add 192.168.0.9 30
[R2]int g 0/0/0
[R2-GigabitEthernet0/0/0]ip add 192.168.0.98 28
[R2]int g 0/0/1
[R2-GigabitEthernet0/0/1]ip add 192.168.0.17 28
[R2]ip route-static 192.168.0.32 28 192.168.0.18
[R2]ip route-static 192.168.0.48 28 192.168.0.18
[R2]ip route-static 192.168.0.64 28 192.168.0.18
[R2]ip route-static 192.168.0.80 28 192.168.0.97
[R2]ip route-static 192.168.0.112 28 192.168.0.97
[R2]ip route-static 192.168.0.128 28 192.168.0.97
[R2]ip route-static 192.168.0.0 28 NULL 0
[R2]ip route-static 0.0.0.0 0 192.168.0.18
[R2]ip route-static 0.0.0.0 0 192.168.0.97
[R3]int g 0/0/0
[R3-GigabitEthernet0/0/0]ip add 192.168.0.33 28
[R3]int g 0/0/1
[R3-GigabitEthernet0/0/1]ip add 192.168.0.18 28
[R3]ip route-static 192.168.0.96 255.255.255.240 192.168.0.17
[R3]ip route-static 192.168.0.48 255.255.255.240 192.168.0.34
[R3]ip route-static 192.168.0.64 255.255.255.240 192.168.0.34
[R3]ip route-static 192.168.0.80 255.255.255.240 192.168.0.34
[R3]ip route-static 192.168.0.112 255.255.255.240 192.168.0.34
[R3]ip route-static 192.168.0.128 255.255.255.240 192.168.0.34
[R3]ip route-static 192.168.0.0 28 192.168.0.17
[R3]ip route-static 0.0.0.0 0 192.168.0.34
[R4]int g 0/0/0
[R4-GigabitEthernet0/0/0]ip add 192.168.0.34 28
[R4]int g 0/0/2
[R4-GigabitEthernet0/0/2]ip add 192.168.0.81 28
[R4]int g 0/0/1
[R4-GigabitEthernet0/0/1]ip add 192.168.0.49 28
[R4]int g 4/0/0
[R4-GigabitEthernet4/0/0]ip add 192.168.0.66 28
[R4]ip route-static 192.168.0.96 255.255.255.240 192.168.0.82
[R4]ip route-static 192.168.0.16 255.255.255.240 192.168.0.33
[R4]ip route-static 192.168.0.112 255.255.255.240 192.168.0.82
[R4]ip route-static 192.168.0.128 255.255.255.240 192.168.0.82
[R4]ip route-static 192.168.0.0 28 192.168.0.33
[R4]ip route-static 192.168.0.0 28 192.168.0.82
[R4]iP route-static 0.0.0.0 0 192.168.0.50 preference 80
[R4]iP route-static 0.0.0.0 0 192.168.0.65
[R5]int g 0/0/1
[R5-GigabitEthernet0/0/1]ip add 192.168.0.50 28
[R5]int g 4/0/0
[R5-GigabitEthernet4/0/0]ip add 192.168.0.65 28
[R5]int g 0/0/0
[R5-GigabitEthernet0/0/0]ip add 100.1.1.1 24
[R5]ip route-static 192.168.0.96 255.255.255.240 192.168.0.49
[R5]ip route-static 192.168.0.16 255.255.255.240 192.168.0.49
[R5]ip route-static 192.168.0.32 255.255.255.240 192.168.0.49
[R5]ip route-static 192.168.0.80 255.255.255.240 192.168.0.49
[R5]ip route-static 192.168.0.112 255.255.255.240 192.168.0.49
[R5]ip route-static 192.168.0.128 255.255.255.240 192.168.0.49
[R5]ip route-static 192.168.0.0 28 192.168.0.49
[R5]ip route-static 0.0.0.0 0 100.1.1.2
[R5]acl 2000
[R5-acl-basic-2000]rule 5 permit source any
[R5]int g 0/0/0
[R5-GigabitEthernet0/0/0]nat outbound 2000
[ISP]int g 0/0/0
[ISP-GigabitEthernet0/0/0]ip add 100.1.1.2 24
测试:
只允许vlan2上网不允许vlan3上网:
[R5]acl 2000
[R5-acl-basic-2000]undo rule 5
[R5-acl-basic-2000]rule 5 permit source 192.168.0.112 0.0.0.15
测试: