【无标题】

SW1
vlan batch 2 to 3    

interface Ethernet0/0/1  
port link-type access
port default vlan 2
 
interface Ethernet0/0/2
port link-type access
port default vlan 2
 
interface Ethernet0/0/3
port link-type access
port default vlan 3

interface GigabitEthernet0/0/1 
port link-type trunk
port trunk allow-pass vlan 2 to 3

SW2
vlan batch 2 to 3

interface Ethernet0/0/1
 port link-type access
 port default vlan 2

interface Ethernet0/0/2
 port link-type access
 port default vlan 3

interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 2 to 3

R1
interface GigabitEthernet0/0/0
ip address 192.168.1.1 255.255.255.252 

dhcp enable    

ip pool v2       
gateway-list 192.168.1.65 
network 192.168.1.64 mask 255.255.255.224 
dns-list 114.114.114.114 8.8.8.8 

ip pool v3
gateway-list 192.168.1.97 
network 192.168.1.96 mask 255.255.255.224 
dns-list 114.114.114.114 8.8.8.8 

interface GigabitEthernet0/0/1.1   
dot1q termination vid 2    
arp broadcast enable  ip address 192.168.1.65 255.255.255.224 
dhcp select global        

interface GigabitEthernet0/0/1.2
dot1q termination vid 3
arp broadcast enable
ip address 192.168.1.97 255.255.255.224 
dhcp select global

R2
interface GigabitEthernet0/0/0
ip address 192.168.1.2 255.255.255.252

interface GigabitEthernet0/0/1
ip address 12.1.1.1 255.255.255.0 

dhcp enable

ip pool v2
gateway-list 192.168.1.129 
network 192.168.1.128 mask 255.255.255.224 
dns-list 114.114.114.114 8.8.8.8 

ip pool v3
gateway-list 192.168.1.161 
network 192.168.1.160 mask 255.255.255.224 
dns-list 114.114.114.114 8.8.8.8

interface GigabitEthernet0/0/2.1
dot1q termination vid 2
ip address 192.168.1.129 255.255.255.224 
arp broadcast enable
dhcp select global

interface GigabitEthernet0/0/2.2
dot1q termination vid 3
ip address 192.168.1.161 255.255.255.224 
arp broadcast enable
dhcp select global
ISP
interface GigabitEthernet0/0/0
ip address 12.1.1.2 255.255.255.0 

interface GigabitEthernet0/0/1
ip address 3.3.3.1 255.255.255.0 

2.OSPF配置
R1
ospf 1 router-id 1.1.1.1    
area 0.0.0.0        
network 192.168.1.0 0.0.0.255   

interface GigabitEthernet0/0/0
ospf authentication-mode md5 1 cipher xiaoli123   

R2
ospf 1 router-id 2.2.2.2 
default-route-advertise always
area 0.0.0.0 
network 192.168.1.0 0.0.0.255 

interface GigabitEthernet0/0/0
ospf authentication-mode md5 1 cipher xiaoli123

dhcp

[R1]dhcp enable

[R1]ip pool 1

[R1-ip-pool-1]network 192.168.1.64 mask 28

[R1-ip-pool-1]gateway-list 192.168.1.65

[R1]ip pool 2
[R1-ip-pool-2]network 192.168.1.80 mask 28
[R1-ip-pool-2]gateway-list 192.168.1.81

进子接口激活：

[R1]int g 0/0/0.1
[R1-GigabitEthernet0/0/0.1]dhcp select global
[R1-GigabitEthernet0/0/0.1]int g 0/0/0.2
[R1-GigabitEthernet0/0/0.2]dhcp select global
[R1-GigabitEthernet0/0/0.2]

nat

easy-ip启动       [R2]acl 2000

抓1.0/24      [R2-acl-basic-2000]rule permit source 192.168.1.0 0.0.0.255

     进对外接口                   [R2]int g 0/0/2

建立映射关系                     [R2-GigabitEthernet0/0/2]nat outbound  2000

R2路由表没有到pc5的203网段，需要写静态路由缺省，指向ISP运营商：

                    [R2]ip route-static 0.0.0.0 0 202.1.1.2

R1路由表也没有PC5的203网段的路由，让边界R2下发一条缺省

进入ospf                            [R2]ospf 1

下发路由（R2配过静态路由 ）       [R2-ospf-1]default-route-advertise 

此时查看R1中已经有了缺省

[R1]dis ip routing-table p ospf

pc1不能访问pc5

[R1]acl 3000

限制网段（vlan 2一台pc写法），不能写死。

[R1-acl-adv-3000]rule deny ip source 192.168.1.64 0.0.0.15 destination 203.1.1.1
00 0.0.0.0

入接口干掉

[R1]int g 0/0/0.1

入方向调用，PC1向上

[R1-GigabitEthernet0/0/0.1]traffic-filter inbound acl 3000

此时pc1无法访问pc5
``