1:实验需求
公司拥有多个部门且位于不同网段，各部门均有访问Internet的需求。现要求用户通过二层交换机和路由器访问外部网络，且要求路由器作为用户的网关。
我们按照图示的IP地址进行配置，最终的结果是PC1和PC2可以ping通公网地址192.169.1.2.
2:网络拓补图
这里多说一句哈，华为的ENSP模拟器有的路由器NAT配置了不生效，我在这里使用的是AR1220系列。
3：实验过程
CORE
sy Entersystemview,returnuserviewwithCtrl+Z. [Huawei]undoinfo-centerenable Info:Informationcenterisdisabled. [Huawei]sysnameCORE [CORE]vlanbatch23100//创建vlan23100备用 Info:Thisoperationmaytakeafewseconds.Pleasewaitforamoment...done. [CORE]dhcpenable//全局使能DHCP Info:Theoperationmaytakeafewseconds.Pleasewaitforamoment.done. [CORE]interfaceVlanif2//进入vlanif接口配置IP，DHCP的方式是基于接口 [CORE-Vlanif2]ipaddress192.168.2.25424 [CORE-Vlanif2]dhcpselectinterface [CORE-Vlanif2]quit [CORE]interfaceVlanif3 [CORE-Vlanif3]ipadd192.168.3.25424 [CORE-Vlanif3]dhcpselectinterface [CORE-Vlanif3]quit [CORE]interfaceVlanif100 [CORE-Vlanif100]ipadd192.168.100.224 [CORE-Vlanif100]quit [CORE]interfaceGigabitEthernet0/0/1//设置终端链路类型access [CORE-GigabitEthernet0/0/1]portlink-typeaccess [CORE-GigabitEthernet0/0/1]portdefaultvlan2 [CORE-GigabitEthernet0/0/1]quit [CORE]interfaceGigabitEthernet0/0/2 [CORE-GigabitEthernet0/0/2]portlink-typeaccess [CORE-GigabitEthernet0/0/2]portdefaultvlan3 [CORE-GigabitEthernet0/0/2]quit [CORE]interfaceGigabitEthernet0/0/3//设置链路终端类型，设置为access,路由器才能识别，或者trunk端口设置PVID。 [CORE-GigabitEthernet0/0/3]portlink-typeaccess [CORE-GigabitEthernet0/0/3]portdefaultvlan100 [CORE-GigabitEthernet0/0/3]quit [CORE]iproute-static0.0.0.00.0.0.0192.168.100.1//写一条默认路由，下一跳地址是对端的路由器
ROUTER
sy system-view Entersystemview,returnuserviewwithCtrl+Z. [Huawei]undoinfo-centerenable Info:Informationcenterisdisabled. [Huawei]sysnameROUter [ROUter]interfaceGigabitEthernet0/0/1//我们配置内网的IP接口 [ROUter-GigabitEthernet0/0/1]ipadd192.168.100.124 [ROUter-GigabitEthernet0/0/1]quit [ROUter]iproute-static192.168.0.016192.168.100.2//我们配置到内网的回程路由，即192.168.X.X均可以匹配 [ROUter]iproute-static0.0.0.00.0.0.0192.169.1.2//设置一条默认路由去公网 [ROUter]interfaceGigabitEthernet0/0/0//配置公网的IP地址 [ROUter-GigabitEthernet0/0/0]ipaddress192.169.1.124 [ROUter-GigabitEthernet0/0/0]quit [ROUter]acl2000//建基本ACL2000 [ROUter-acl-basic-2000]rulepermitsource192.168.0.00.0.255.255//允许192.168.X.X的网段 [ROUter-acl-basic-2000]quit [ROUter]interfaceGigabitEthernet0/0/0//进入外网接口，调用acl2000 [ROUter-GigabitEthernet0/0/0]natoutbound2000//nat引用 [ROUter-GigabitEthernet0/0/0]quit [ROUter]displaynatsessionall//这里我们可以看到NAT会话 NATSessionTableInformation: Protocol:ICMP(1) SrcAddrVpn:192.168.2.253 DestAddrVpn:192.169.1.2 TypeCodeIcmpId:08890 NAT-Info NewSrcAddr:192.169.1.1 NewDestAddr:---- NewIcmpId:10259 Protocol:ICMP(1) SrcAddrVpn:192.168.2.253 DestAddrVpn:192.169.1.2 TypeCodeIcmpId:08888 NAT-Info NewSrcAddr:192.169.1.1 NewDestAddr:---- NewIcmpId:10257 Protocol:ICMP(1) SrcAddrVpn:192.168.2.253 DestAddrVpn:192.169.1.2 TypeCodeIcmpId:08889 NAT-Info NewSrcAddr:192.169.1.1 NewDestAddr:---- NewIcmpId:10258 Protocol:ICMP(1) SrcAddrVpn:192.168.2.253 DestAddrVpn:192.169.1.2 TypeCodeIcmpId:08887 NAT-Info NewSrcAddr:192.169.1.1 NewDestAddr:---- NewIcmpId:10256 Protocol:ICMP(1) SrcAddrVpn:192.168.2.253 DestAddrVpn:192.169.1.2 TypeCodeIcmpId:08886 NAT-Info NewSrcAddr:192.169.1.1 NewDestAddr:---- NewIcmpId:10255
公网路由器
sy system-view//我们给它设置一个测试用的IP地址 [Huawei]interfaceGigabitEthernet0/0/0 [Huawei-GigabitEthernet0/0/0]ipadd192.169.1.224 [Huawei-GigabitEthernet0/0/0]quit [Huawei]ping192.169.1.1//测试和公司公网IP的连通性 PING192.169.1.1:56databytes,pressCTRL_Ctobreak Replyfrom192.169.1.1:bytes=56Sequence=1ttl=255time=90ms Replyfrom192.169.1.1:bytes=56Sequence=2ttl=255time=20ms Replyfrom192.169.1.1:bytes=56Sequence=3ttl=255time=30ms Replyfrom192.169.1.1:bytes=56Sequence=4ttl=255time=30ms Replyfrom192.169.1.1:bytes=56Sequence=5ttl=255time=20ms ---192.169.1.1pingstatistics--- 5packet(s)transmitted 5packet(s)received 0.00%packetloss round-tripmin/avg/max=20/38/90ms [Huawei]
测试
我们使用PC1和PC2分别ping公网地址，如下图所示
会话信息
审核编辑：刘清