配置VLAN间路由与NAT实现案例
企业网络必须会用到的技术，你都会了吗？这个文档手把手教你，包学会。
一、实验拓扑图.
二、基本配置
- 根本拓扑配置SW1、SW2、SW3的基本配置，包括VLAN、Trunk、管理地址与网关，确保VLAN间可以通信。
1、配置SW1
1）配置VLAN与命名VLAN
vlan 10
name Connect.To.R1
vlan 11
name IT
vlan 12
name Sales
vlan 13
name HR
2）配置所有access接口为快速接口
spanning-tree portfast default
3）配置SW1为生成对的根
spanning-tree vlan 1,10-13 root primary
4）配置access接口，添加到VLAN11
interface FastEthernet0/1
switchport access vlan 11
switchport mode access
5）配置Trunk接口
interface FastEthernet0/2
switchport trunk encapsulation dot1q
switchport mode trunk
interface FastEthernet0/4
switchport trunk encapsulation dot1q
switchport mode trunk
interface FastEthernet0/24
description ##Connect To R1##
switchport access vlan 10
switchport mode access
6）配置VLAN间路由
- 配置核心交换机SW1三层接口地址，作为每个VLAN的网关，实现VLAN间路由。
interface Vlan1
ip address 10.1.1.254 255.255.255.0
interface Vlan10
ip address 10.1.10.254 255.255.255.0
interface Vlan11
ip address 10.1.11.254 255.255.255.0
interface Vlan12
ip address 10.1.12.254 255.255.255.0
interface Vlan13
ip address 10.1.13.254 255.255.255.0
7）配置SW1默认路由
ip route 0.0.0.0 0.0.0.0 10.1.10.253
2、配置SW2
vlan 11
name IT
vlan 12
name Sales
vlan 13
name HR
spanning-tree portfast default
interface FastEthernet0/1
switchport access vlan 12
switchport mode access
interface FastEthernet0/2
switchport mode trunk
interface FastEthernet0/12
switchport mode trunk
interface vlan 1
ip address 10.1.1.12 255.255.255.0
no shut
ip default-gateway 10.1.1.254
3、配置SW3
vlan 11
name IT
vlan 12
name Sales
vlan 13
name HR
spanning-tree portfast default
interface FastEthernet0/1
switchport access vlan 13
switchport mode access
interface FastEthernet0/4
switchport mode trunk
interface FastEthernet0/12
switchport mode trunk
interface vlan 1
ip address 10.1.1.13 255.255.255.0
no shut
ip default-gateway 10.1.1.254
三、配置R1
interface FastEthernet0/0
description ##Connect To SW1##
ip address 10.1.10.253 255.255.255.0
no shut
interface serial0/1/0
description ##Connect To Internet##
ip address 12.1.1.1 255.255.255.0
no shut
ip route 10.1.0.0 255.255.0.0 10.1.10.254 //R1回内部VLAN的回程路由
ip route 0.0.0.0 0.0.0.0 12.1.1.2 //到Internet的默认路由
- 配置PAT-方法1
目标：所有VLAN用户地址转换为外网口Serial0/1/0 IP地址
1）配置ACL
access-list 100 permit ip 10.1.1.0 0.0.0.255 any
access-list 100 permit ip 10.1.10.0 0.0.0.255 any
access-list 100 permit ip 10.1.11.0 0.0.0.255 any
access-list 100 permit ip 10.1.12.0 0.0.0.255 any
access-list 100 permit ip 10.1.13.0 0.0.0.255 any
2）配置ACL关联外网口，关键字overload
ip nat inside source list 100 interface serial0/1/0 overload
3）配置inside和outside接口
interface FastEthernet0/0
ip nat inside
interface serial0/1/0
ip nat outside
- 配置PAT-方法2
目标：不同VLAN用户地址转换为不同地址池地址
1）配置ACL
access-list 110 permit ip 10.1.1.0 0.0.0.255 any
access-list 110 permit ip 10.1.10.0 0.0.0.255 any
access-list 111 permit ip 10.1.11.0 0.0.0.255 any
access-list 112 permit ip 10.1.12.0 0.0.0.255 any
access-list 113 permit ip 10.1.13.0 0.0.0.255 any
2）配置地址池
ip nat pool vlan1and10pool 12.1.1.110 12.1.1.110 netmask 255.255.255.0
ip nat pool vlan11pool 12.1.1.111 12.1.1.111 netmask 255.255.255.0
ip nat pool vlan12pool 12.1.1.112 12.1.1.112 netmask 255.255.255.0
ip nat pool vlan13pool 12.1.1.113 12.1.1.113 netmask 255.255.255.0
3）配置ACL与地址池关联
ip nat inside source list 110 pool vlan1andpool overload
ip nat inside source list 111 pool vlan11pool overload
ip nat inside source list 112 pool vlan12pool overload
ip nat inside source list 113 pool vlan13pool overload
- 配置PAT-方法3
目标：所有VLAN用户地址转换为同一个地址池地址
1）配置ACL
access-list 100 permit ip 10.1.0.0 0.0.255.255 any
2）配置地址池
ip nat pool natpool 12.1.1.110 12.1.1.113 netmask 255.255.255.0
3）配置ACL和地址池关联
ip nat inside source list 100 pool natpool overload
四、配置R2和PCA 作为Internet
1、配置R2
interface serial0/0
ip address 12.1.1.2 255.255.255.0
no shut
interface e0/0
ip address 100.1.1.254 255.255.255.0
no shut
interface loopback0
ip address 2.2.2.2 255.255.255.255
2、配置PCA的IP地址和网关
[cisco@pca ~]$ ifconfig eth0 100.1.1.1 netmask 255.255.255.0 up
[cisco@pca ~]$ route add default gw 100.1.1.254
五、测试
1、在PC1上Ping测试到PC2 PC3 VLAN间的通信
2、在PC1上Ping 测试到Internet 2.2.2.2通信
联系我们
