一．需求：
1.不同的PC属于不同的 VLAN ，如图所示；
2.不同的 VLAN 的IP地址为： 192.168.XX.0/24 , XX 是 vlan 号；
3.不同的 VLAN 主机获得IP地址的方式为 DHCP (除特殊需求以外)每个 VLAN 的主机的网关IP地址，均为： 192.168.XX.254/24;
4.vlan88 为 web-server 所在的服务器；网关在 SW5 上；vlan66 为 dhcp-server所在的服务器；网关在 SW6 上；
5.其他 VLAN 的每个主机所用的网关都使用了高可用性技术，增强了网关冗余性和稳定性。
6.交换机之间也使用了防环技术，并且能够针对每个 VLAN 实现流量负载均衡的功能。同时，要求每个 VLAN 的主机，去往主机的网关时，所使用的转发路径是最优的。
7.在公司内部运行 OSPF ，确保不同 VLAN 之间是互通的。不同的 VLAN 属于不同的区域。同时保护 web 和 dhcp 服务器所在的区域不受到外部链路以及其他区域的不稳定的链路的影响。
8.公司的出口路由器为 R1 和 R2 ，但是永远将 R1 作为主出口，出现故障后，出网流量才会自动的切换到 R2 。修复以后，会再次从 R1 转发。
9.内网大量主机都存在访问 Internet的需求，要求使用最节省IP地址的方式实现内网主机上网，但是 vlan 40 属于机密部分，不能访问外网。
10.外网的用户(client-1)，可以访问内部的 web 服务器。
11.外网的用户(SW9)，可以远程控制内网的所有网络设备(不包括R1/R2)，远程访问密码均设置为 HCIE 。(内网中每个设备的管理IP地址，属于管理 VLAN 199)
12.内网的用户中，只能由 vlan 20 中的 PC-2 远程登录管理内网所有设备其他用户均不可以。
二．拓扑图
(一)．二层交换机
lsw1
UNDO T M
SYS
SYS S1
vlan batch 10 20 30 40 66 88
vlan batch 17 27 18 28 199
int e0/0/1
port link-type access
port default vlan 10
q
int e0/0/2
port link-type access
port default vlan 20
q
int e0/0/15
port link-type trunk
port trunk allow-pass vlan all
q
int e0/0/16
port link-type trunk
port trunk allow-pass vlan all
q
生成树
stp mode mstp
stp region-configuration
region-name vlan
instance 1 vlan 10 20
instance 3 vlan 30 40
active region-configuration
q
配置远程登录
int vlanif 199
ip addr 192.168.199.1 24
q
user-interface vty 0 4
user privilege level 3
authentication-mode aaa
aaa
local-user jing password cipher HCIE
local-user jing service-type telnet
q
交换机默认
ip route-static 0.0.0.0 0.0.0.0 192.168.199.7
ip route-static 0.0.0.0 0.0.0.0 192.168.199.8 preference 80
lsw2
UNDO T M
SYS
SYS S2
vlan batch 10 20 30 40 66 88
vlan batch 17 27 18 28 199
int e0/0/3
port link-type access
port default vlan 10
q
int e0/0/4
port link-type access
port default vlan 30
q
int e0/0/5
port link-type trunk
port trunk allow-pass vlan all
q
int e0/0/6
port link-type trunk
port trunk allow-pass vlan all
q
生成树
stp mode mstp
stp region-configuration
region-name vlan
instance 1 vlan 10 20
instance 3 vlan 30 40
active region-configuration
q
配置远程登录
int vlanif 199
ip addr 192.168.199.2 24
q
user-interface vty 0 4
user privilege level 3
authentication-mode aaa
aaa
local-user jing password cipher HCIE
local-user jing service-type telnet
q
交换机默认
ip route-static 0.0.0.0 0.0.0.0 192.168.199.7
ip route-static 0.0.0.0 0.0.0.0 192.168.199.8 preference 80
lsw3
UNDO T M
SYS
SYS S3
vlan batch 10 20 30 40 66 88
vlan batch 17 27 18 28 199
int e0/0/5
port link-type access
port default vlan 20
q
int e0/0/6
port link-type access
port default vlan 40
q
int e0/0/13
port link-type trunk
port trunk allow-pass vlan all
q
int e0/0/14
port link-type trunk
port trunk allow-pass vlan all
q
生成树
stp mode mstp
stp region-configuration
region-name vlan
instance 1 vlan 10 20
instance 3 vlan 30 40
active region-configuration
q
配置远程登录
int vlanif 199
ip addr 192.168.199.3 24
q
user-interface vty 0 4
user privilege level 3
authentication-mode aaa
aaa
local-user jing password cipher HCIE
local-user jing service-type telnet
q
交换机默认
ip route-static 0.0.0.0 0.0.0.0 192.168.199.7 preference 80
ip route-static 0.0.0.0 0.0.0.0 192.168.199.8
lsw4
UNDO T M
SYS
SYS S4
vlan batch 10 20 30 40 66 88
vlan batch 17 27 18 28 199
int e0/0/7
port link-type access
port default vlan 40
q
int e0/0/8
port link-type access
port default vlan 30
q
int e0/0/17
port link-type trunk
port trunk allow-pass vlan all
q
int e0/0/18
port link-type trunk
port trunk allow-pass vlan all
q
生成树
stp mode mstp
stp region-configuration
region-name vlan
instance 1 vlan 10 20
instance 3 vlan 30 40
active region-configuration
q
配置远程登录
int vlanif 199
ip addr 192.168.199.4 24
q
user-interface vty 0 4
user privilege level 3
authentication-mode aaa
aaa
local-user jing password cipher HCIE
local-user jing service-type telnet
q
交换机默认
ip route-static 0.0.0.0 0.0.0.0 192.168.199.8
ip route-static 0.0.0.0 0.0.0.0 192.168.199.7 preference 80
lsw5
UNDO T M
SYS
SYS sw5
vlan batch 10 20 30 40 66 88
vlan batch 17 27 18 28 199
int vlanif 88
ip addr 192.168.88.254 24
undo sh
q
int vlanif 10
ip addr 192.168.10.5 24
undo sh
q
int vlanif 20
ip addr 192.168.20.5 24
undo sh
q
int vlanif 30
ip addr 192.168.30.5 24
undo sh
q
int vlanif 40
ip addr 192.168.40.5 24
undo sh
q
int vlanif 66
ip addr 192.168.66.5 24
undo sh
q
int g0/0/8
port link-type access
port default vlan 88
q
port-group 1
group- g0/0/1 g0/0/2 g0/0/24 g0/0/17 g0/0/5 g0/0/13 g0/0/15
port link-type trunk
port trunk allow-pass vlan all
q
生成树
stp mode mstp
stp region-configuration
region-name vlan
instance 1 vlan 10 20
instance 3 vlan 30 40
active region-configuration
q
stp instance 1 priority 8192
stp instance 3 priority 12288
配置远程登录
int vlanif 199
ip addr 192.168.199.5 24
q
user-interface vty 0 4
user privilege level 3
authentication-mode aaa
aaa
local-user jing password cipher HCIE
local-user jing service-type telnet
q
lsw6
UNDO T M
SYS
SYS sw6
vlan batch 10 20 30 40 66 88
vlan batch 17 27 18 28 199
int vlanif 66
ip addr 192.168.66.254 24
undo sh
q
int vlanif 10
ip addr 192.168.10.6 24
undo sh
q
int vlanif 20
ip addr 192.168.20.6 24
undo sh
q
int vlanif 30
ip addr 192.168.30.6 24
undo sh
q
int vlanif 40
ip addr 192.168.40.6 24
undo sh
q
int g0/0/8
port link-type access
port default vlan 66
q
port-group 1
group- g0/0/3 g0/0/4 g0/0/24 g0/0/16 g0/0/6 g0/0/14 g0/0/18
port link-type trunk
port trunk allow-pass vlan all
q
生成树
stp mode mstp
stp region-configuration
region-name vlan
instance 1 vlan 10 20
instance 3 vlan 30 40
active region-configuration
q
stp instance 1 priority 12288
stp instance 3 priority 8192
配置远程登录
int vlanif 199
ip addr 192.168.199.6 24
q
user-interface vty 0 4
user privilege level 3
authentication-mode aaa
aaa
local-user jing password cipher HCIE
local-user jing service-type telnet
q
lsw7
UNDO T M
SYS
SYS sw7
vlan batch 10 20 30 40 66 88
vlan batch 17 27 18 28 199
int vlanif 66
ip addr 192.168.66.7 24
undo sh
q
int vlanif 10
ip addr 192.168.10.7 24
undo sh
q
int vlanif 20
ip addr 192.168.20.7 24
undo sh
q
int vlanif 30
ip addr 192.168.30.7 24
undo sh
q
int vlanif 40
ip addr 192.168.40.7 24
undo sh
q
port-group 1
group- g0/0/1 g0/0/3 g0/0/24
port link-type trunk
port trunk allow-pass vlan all
q
生成树
stp mode mstp
stp region-configuration
region-name vlan
instance 1 vlan 10 20
instance 3 vlan 30 40
active region-configuration
q
stp instance 1 priority 0
stp instance 3 priority 4096
配置远程登录
int vlanif 199
ip addr 192.168.199.7 24
q
user-interface vty 0 4
user privilege level 3
authentication-mode aaa
aaa
local-user jing password cipher HCIE
local-user jing service-type telnet
q
虚拟网关
int vlanif 10
vrrp vrid 10 virtual-ip 192.168.10.254
vrrp vrid 10 priority 200
q
int vlanif 20
vrrp vrid 20 virtual-ip 192.168.20.254
vrrp vrid 20 priority 200
q
int vlanif 30
vrrp vrid 30 virtual-ip 192.168.30.254
vrrp vrid 30 priority 150
q
int vlanif 40
vrrp vrid 40 virtual-ip 192.168.40.254
vrrp vrid 40 priority 150
q
lsw8
UNDO T M
SYS
SYS sw8
vlan batch 10 20 30 40 66 88
vlan batch 17 27 18 28 199
int vlanif 66
ip addr 192.168.66.8 24
undo sh
q
int vlanif 10
ip addr 192.168.10.8 24
undo sh
q
int vlanif 20
ip addr 192.168.20.8 24
undo sh
q
int vlanif 30
ip addr 192.168.30.8 24
undo sh
q
int vlanif 40
ip addr 192.168.40.8 24
undo sh
q
port-group 1
group- g0/0/2 g0/0/24 g0/0/4
port link-type trunk
port trunk allow-pass vlan all
q
生成树
stp mode mstp
stp region-configuration
region-name vlan
instance 1 vlan 10 20
instance 3 vlan 30 40
active region-configuration
q
stp instance 1 priority 4096
stp instance 3 priority 0
配置远程登录
int vlanif 199
ip addr 192.168.199.8 24
q
user-interface vty 0 4
user privilege level 3
authentication-mode aaa
aaa
local-user jing password cipher HCIE
local-user jing service-type telnet
q
虚拟网关
int vlanif 10
vrrp vrid 10 virtual-ip 192.168.10.254
vrrp vrid 10 priority 150
q
int vlanif 20
vrrp vrid 20 virtual-ip 192.168.20.254
vrrp vrid 20 priority 150
q
int vlanif 30
vrrp vrid 30 virtual-ip 192.168.30.254
vrrp vrid 30 priority 200
q
int vlanif 40
vrrp vrid 40 virtual-ip 192.168.40.254
vrrp vrid 40 priority 200
q
(二)．dhcp配置
dhcp
UNDO T M
SYS
SYS dhcp
int g0/0/0
ip address 192.168.66.6 24
undo shutdown
q
动态地址分配地址池配置
dhcp enable
ip pool 1
network 192.168.10.0 mask 24
gateway-list 192.168.10.254
dns-list 8.8.8.8
lease day 3
excluded-ip-address 192.168.10.1 192.168.10.100
ip pool 2
network 192.168.20.0 mask 24
gateway-list 192.168.20.254
dns-list 8.8.8.8
excluded-ip-address 192.168.20.1 192.168.20.100
lease day 3
ip pool 3
network 192.168.30.0 mask 24
gateway-list 192.168.30.254
dns-list 8.8.8.8
lease day 3
excluded-ip-address 192.168.30.1 192.168.30.100
ip pool 4
network 192.168.40.0 mask 24
gateway-list 192.168.40.254
dns-list 8.8.8.8
lease day 3
excluded-ip-address 192.168.40.1 192.168.40.100
q
动态地址分配启用配置
int g0/0/0
dhcp select global
q
ip route-static 0.0.0.0 0.0.0.0 192.168.66.254
sw7动态地址分配配置
dhcp enable
interface Vlanif10
dhcp select relay
dhcp relay server-ip 192.168.66.6
q
interface Vlanif20
dhcp select relay
dhcp relay server-ip 192.168.66.6
q
interface Vlanif30
dhcp select relay
dhcp relay server-ip 192.168.66.6
q
interface Vlanif40
dhcp select relay
dhcp relay server-ip 192.168.66.6
q
sw8动态地址分配配置
dhcp enable
interface Vlanif10
dhcp select relay
dhcp relay server-ip 192.168.66.6
q
interface Vlanif20
dhcp select relay
dhcp relay server-ip 192.168.66.6
q
interface Vlanif30
dhcp select relay
dhcp relay server-ip 192.168.66.6
q
interface Vlanif40
dhcp select relay
dhcp relay server-ip 192.168.66.6
q
(三)．动态路由
Dhcp
ospf 1 router-id 10.10.10.10
area 66
network 192.168.66.0 0.0.0.255
stub
q
q
lsw5
ospf 1 router-id 5.5.5.5
area 88
network 192.168.88.0 0.0.0.255
stub
q
area 0
network 192.168.199.0 0.0.0.255
q
q
lsw 6
ospf 1 router-id 6.6.6.6
area 66
network 192.168.66.0 0.0.0.255
stub
q
area 0
network 192.168.199.0 0.0.0.255
q
q
lsw 7
int g0/0/2
port link-type access
port default vlan 17
q
int g0/0/4
port link-type access
port default vlan 27
q
int vlanif 17
ip addr 192.168.17.7 24
q
int vlanif 27
ip addr 192.168.27.7 24
q
ospf 1 router-id 7.7.7.7
area 1278
network 192.168.17.0 0.0.0.255
network 192.168.27.0 0.0.0.255
q
area 0
network 192.168.199.0 0.0.0.255
q
area 10
network 192.168.10.0 0.0.0.255
q
area 20
network 192.168.20.0 0.0.0.255
q
area 30
network 192.168.30.0 0.0.0.255
q
area 40
network 192.168.40.0 0.0.0.255
q
q
lsw 8
int g0/0/5
port link-type access
port default vlan 28
q
int g0/0/3
port link-type access
port default vlan 18
q
int vlanif 18
ip addr 192.168.18.8 24
q
int vlanif 28
ip addr 192.168.28.8 24
q
ospf 1 router-id 8.8.8.8
area 1278
network 192.168.18.0 0.0.0.255
network 192.168.28.0 0.0.0.255
q
area 0
network 192.168.199.0 0.0.0.255
q
area 10
network 192.168.10.0 0.0.0.255
q
area 20
network 192.168.20.0 0.0.0.255
q
area 30
network 192.168.30.0 0.0.0.255
q
area 40
network 192.168.40.0 0.0.0.255
q
q
内网出口路由器r1
undo t m
sys
sys r1
int g0/0/0
ip addr 192.168.17.1 24
undo sh
q
int g0/0/1
ip addr 192.168.18.1 24
undo sh
q
int g0/0/2
ip addr 100.100.100.1 24
undo sh
q
ip route-static 0.0.0.0 0.0.0.0 100.100.100.254
ospf 1 router-id 11.11.11.1
default-route-advertise
default type 1
area 1278
network 192.168.17.0 0.0.0.255
network 192.168.18.0 0.0.0.255
q
q
内网出口路由器r2
undo t m
sys
sys r2
int g0/0/0
ip addr 192.168.27.2 24
undo sh
q
int g0/0/1
ip addr 192.168.28.2 24
undo sh
q
int g0/0/2
ip addr 100.100.200.2 24
undo sh
q
ip route-static 0.0.0.0 0.0.0.0 100.100.200.254
ospf 1 router-id 11.11.11.1
default-route-advertise
area 1278
network 192.168.27.0 0.0.0.255
network 192.168.28.0 0.0.0.255
q
q
(四)．外部路由器
isp
undo t m
sys
sys isp
int g0/0/0
ip addr 100.100.100.254 24
undo sh
q
int g0/0/1
ip addr 100.100.200.254 24
undo sh
q
int g0/0/2
ip addr 100.100.1.254 24
q
外部交换机
undo t m
sys
sys sw9
vlan 199
q
interface vlanif199
ip address 100.100.1.199 24
q
ip route-static 100.100.100.2 24 100.100.1.254
?
port-group 1
group-member g0/0/1 g0/0/2 g0/0/3
port link-type access
port default vlan 199
(五)．上网控制
r1
acl 2000
rule 10 deny source 192.168.40.0 0.0.0.255
rule 20 permit source any
int g0/0/2
nat outbound 2000
nat server protocol tcp global 100.100.100.2 12345 inside 192.168.88.8 80
nat server protocol tcp global 100.100.100.2 10001 inside 192.168.199.1 23
nat server protocol tcp global 100.100.100.2 10002 inside 192.168.199.2 23
nat server protocol tcp global 100.100.100.2 10003 inside 192.168.199.3 23
nat server protocol tcp global 100.100.100.2 10004 inside 192.168.199.4 23
nat server protocol tcp global 100.100.100.2 10005 inside 192.168.199.5 23
nat server protocol tcp global 100.100.100.2 10006 inside 192.168.199.6 23
nat server protocol tcp global 100.100.100.2 10007 inside 192.168.199.7 23
nat server protocol tcp global 100.100.100.2 10008 inside 192.168.199.8 23
静态路由 r1
ip route-static 192.168.88.0 24 192.168.17.7 preference 5
ip route-static 192.168.88.0 24 192.168.18.8 preference 8
ip route-static 192.168.199.0 24 192.168.17.7 preference 5
ip route-static 192.168.199.0 24 192.168.18.8 preference 8
r2
acl 2000
rule 10 deny source 192.168.40.0 0.0.0.255
rule 20 permit source any
int g0/0/2
nat outbound 2000
nat server protocol tcp global 100.100.200.1 12345 inside 192.168.88.8 80
nat server protocol tcp global 100.100.200.1 10001 inside 192.168.199.1 23
nat server protocol tcp global 100.100.200.1 10002 inside 192.168.199.2 23
nat server protocol tcp global 100.100.200.1 10003 inside 192.168.199.3 23
nat server protocol tcp global 100.100.200.1 10004 inside 192.168.199.4 23
nat server protocol tcp global 100.100.200.1 10005 inside 192.168.199.5 23
nat server protocol tcp global 100.100.200.1 10006 inside 192.168.199.6 23
nat server protocol tcp global 100.100.200.1 10007 inside 192.168.199.7 23
nat server protocol tcp global 100.100.200.1 10008 inside 192.168.199.8 23
静态路由 r2
ip route-static 192.168.88.0 24 192.168.27.7 preference 5
ip route-static 192.168.88.0 24 192.168.28.8 preference 8
ip route-static 192.168.199.0 24 192.168.27.7 preference 5
ip route-static 192.168.199.0 24 192.168.28.8 preference 8
(六)．内网登录限制
Lsw1
Acl 3000
rule 10 deny tcp source-port eq 23
interface e0/0/1
traffic-filter inbound acl 3000
Lsw2
Acl 3000
rule 10 deny tcp source-port eq 23
interface e0/0/3
traffic-filter inbound acl 3000
interface e0/0/4
traffic-filter inbound acl 3000
Lsw3
Acl 3000
rule 10 deny tcp source-port eq 23
interface e0/0/5
traffic-filter inbound acl 3000
interface e0/0/6
traffic-filter inbound acl 3000
Lsw4
Acl 3000
rule 10 deny tcp source-port eq 23
interface e0/0/7
traffic-filter inbound acl 3000
interface e0/0/8
traffic-filter inbound acl 3000
四．测试
1．内向外
PC1属于vlan10可以自动获得IP，并ping通外网
PC2属于vlan20可以自动获得IP，并ping通外网
PC3属于vlan10可以自动获得IP，并ping通外网
PC4属于vlan30可以自动获得IP，并ping通外网
PC5属于vlan20可以自动获得IP，并ping通外网
PC6属于vlan40可以自动获得IP， ping不通外网
PC7属于vlan40可以自动获得IP， ping不通外网
PC8属于vlan30可以自动获得IP，并ping通外网
2．外向内
Client1可以访问内网server的www服务
sw9 Telnet远程登录sw1
sw9 Telnet远程登录sw2
sw9 Telnet远程登录sw3
sw9 Telnet远程登录sw4
sw9 Telnet远程登录sw5
sw9 Telnet远程登录sw6
sw9 Telnet远程登录sw7
sw9 Telnet远程登录sw8
重点：
dhcp中继要在vrrp的master上
vrrp的master要在mstp的root根上
dhcp的前提条件是全网联通
每个交换机的VLAN配置和mstp配置要一样(mstp的优先级不同)
acl和nat以及traffic-filter 配合使用。
未解决问题：
在R1处ospf无法自动选择路由使得外网访问内网。零时解决方法设置静态路由并且优先级小于ospf的优先级10
原文地址：http://blog.51cto.com/14162269/2346915