实验拓扑
实验步骤
1、PC配置,PC2,其他类似
2、SW4二层交换机配置(VLAN)
sysname SW4
vlan batch 134 144
cluster enable
ntdp enable
ndp enable
drop illegal-mac alarm
diffserv domain default
drop-profile default
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password simple admin
local-user admin service-type http
interface Vlanif1
interface MEth0/0/1
interface Ethernet0/0/1
port link-type trunk
port trunk allow-pass vlan 2 to 4094
interface Ethernet0/0/2
port link-type access
port default vlan 144
interface Ethernet0/0/3
port link-type access
port default vlan 134
3、三层交换机配置
sysname SW5
vlan batch 154 164 174
interface Vlanif154
ip address 172.16.154.254 255.255.255.0
interface Vlanif164
ip address 172.16.164.254 255.255.255.0
interface Vlanif174
ip address 10.1.174.3 255.255.255.0
interface MEth0/0/1
interface GigabitEthernet0/0/1
port link-type trunk
port trunk pvid vlan 174
port trunk allow-pass vlan 2 to 4094
interface GigabitEthernet0/0/2
port link-type access
port default vlan 154
interface GigabitEthernet0/0/3
port link-type access
port default vlan 164
4.R2上单臂路由的配置
interface Ethernet0/0/0
ip address 10.1.174.2 255.255.255.0
interface Ethernet0/0/1
interface Ethernet0/0/1.1
dot1q termination vid 134
ip address 192.168.134.254 255.255.255.0
arp broadcast enable
interface Ethernet0/0/1.2
dot1q termination vid 144
ip address 192.168.144.254 255.255.255.0
arp broadcast enable
5.R1上DHCP的配置
dhcp enable
ip pool 1
gateway-list 10.0.0.254
network 10.0.0.0 mask 255.255.255.0
dns-list 8.8.8.8
interface GigabitEthernet0/0/0
ip address 200.10.13.2 255.255.255.0
interface GigabitEthernet0/0/1
ip address 10.0.0.254 255.255.255.0
dhcp select global(接口启动全局地址池)
interface GigabitEthernet0/0/2
ip address 10.1.174.1 255.255.255.0
6。路由协议的配置(RIP,或者OSPF)
R1:
rip 1
network 10.0.0.0
network 200.10.13.0
到此内网全部互通
7、ACL配置
LSW5:
acl number 3000
rule 5 deny ip source 172.16.164.1 0 destination 192.168.144.1 0
在出口应用ACL
interface GigabitEthernet0/0/1
traffic-filter outbound acl 3000
R1:地址转换设置
acl number 2000
rule 4 permit source 192.168.134.0 0.0.0.255
nat address-group 1 200.10.13.4 200.10.13.6
interface GigabitEthernet0/0/0
ip address 200.10.13.2 255.255.255.0
nat outbound 2000 address-group 1 no-pat
8、R3配置
interface GigabitEthernet0/0/0
ip address 200.10.13.1 255.255.255.0