单臂路由-NAT.doc

单臂路由+NAT实验网络拓扑结构：E 0e0.1 10.100.2.1 e0.2 10.100.3.1 e0.3 10.100.4.1E 1192.168.0.253/24校园网192.168.0.254/24SwitchPC-A10.100.2.2VLAN2 PC-B10.100.3.2VLAN3PC-C10.100.4.2VLAN4TRUNKE0/24E0/2E0/3E0/4在路由器E0口上建立三个子接口并配置相应IP地址，并在路由器子接口上封装VLAN标签协议；在交换机上建立三个VLAN，每个VLAN接入一台计算机，计算机的默认网关为各子接口IP 地址；交换机连接路由器的接口要设置为TRUNK模式。命令参考：1.路由器的配置# 配置缺省路由Router ip route-static 0.0.0.0 0.0.0.0 192.168.0.254 preference 60#建立访问控制列表Routeracl 101 match-order auto#设置访问规则#只允许网络地址为10.100的IP进行地址转换Router-acl-101rule normal permit ip source 10.100.0.0 0.0.255.255 destination anyRouter-acl-101rule normal permit ip source 192.168.0.0 0.0.0.255 destination anyRouter-acl-101rule normal deny ip source any destination anyRouter-acl-101 quit#建立地址池pool1Routernat address-group 192.168.0.240 192.168.0.252 pool1/注意每组实验地址池不要重复#将接口和地址池及其访问控制列表相关联Routerinterface Ethernet 1 Router-Ethernet1 ip add 192.168.0.253 255.255.255.0Router-Ethernet1 firewall packet-filter 101 outboundRouter-Ethernet1 nat outbound 101 address-group pool1RouterRouter-Ethernet0inter e0.1 /定义子接口E0.1Router-Ethernet0.1ip add 10.100.2.1 255.255.255.0Router-Ethernet0.1vlan-type dot1q vid 2 /指定以太网子接口属于VLAN2,此命令应用在以太网子接口上。只有配置了该命令之后，以太网子接口才会根据配置的VLAN ID 号在以太网帧头中嵌入VLAN 标签，与该网口相连的交换机接口才能正确处理接收到的帧。Router-Ethernet0.1inter e0.2 /定义子接口E0.2Router-Ethernet0.2ip add 10.100.3.1 255.255.255.0Router-Ethernet0.2vlan-type dot1q vid 3 /指定以太网子接口属于VLAN3Router-Ethernet0.2inter e0.3 /定义子接口E0.3Router-Ethernet0.3ip add 10.100.4.1 255.255.255.0Router-Ethernet0.3vlan-type dot1q vid 4 /指定以太网子接口属于VLAN4Router-Ethernet0.3inter e0Router-Ethernet0undo shut2.交换机的配置 sysEnter system view , return user view with Ctrl+Z.Quidway vlan 2Quidway-vlan2port ethernet 0/2 /将第2端口加入VLAN2Quidway-vlan2vlan 3Quidway-vlan3port eth 0/3 /将第3端口加入VLAN3Quidway-vlan2vlan 4Quidway-vlan4port eth 0/4 /将第4端口加入VLAN4Quidway-vlan4inter e0/24Quidway-Ethernet0/24port link-type trunk /将第24端口设为trunk口Quidway-Ethernet0/24port trunk permit vlan all/允许所有VLAN流量通过Please wait. Done.Quidway-Ethernet0/24dis port trunk /检验TRUNK口配置Now, the following trunking ports exist:Ethernet0/24 /用disp vlan all 命令查看VLAN配置情况。3.在工作站上检查网络是否连通。各工作站相互PING测试连通性。4.在路由器上查看路由表