4路外线（NAT+PBR真实案例）

三路电信企业宽带固定IP、一路联通企业宽带固定IP。

需求：每个二层下组成一个内网、每个内网分配一路外线（暂时不做故障转移）

 设备（1台cisco3560三层交换机、一台cisco2911路由器且只有两个端口、4台二层交换机）

 

数据走向图：

1. 划分5个vlan，其中4个vlan各对应下面4台二层交换机，也就是对应每个内网，第5个vlan用于扩展路由器外线接口（路由器外线接口采用多IP方案，没有用子接口）

2. 路由器内线与三层交换机采用三层互联（内线对应的三层交换机端口是三层端口）

3. 4个二层交换机所对应三层端口采用vlan上配置IP，没有转换三层端口

4. 路由器上做NAT+PBR实现每个内网对应到一个外网上

   
   

   
   

   R3/R4/R5/R6是公网路由器

   C1/C2/C3/C4为每个内网的主机

   R2为三层交换机、R1为路由器

   SW1/SW2/SW3/SW4 是4台二层交换机

   
   

   
   

   下面我贴出三层交换机和路由器的配置

   R2（三层交换机）#show running-config

   Building configuration...

   
   

   Current configuration : 1525 bytes

   !

   version 12.4

   service timestamps debug datetime msec

   service timestamps log datetime msec

   no service password-encryption

   !

   hostname R2

   !

   boot-start-marker

   boot-end-marker

   !

   !

   no aaa new-model

   memory-size iomem 5

   no ip icmp rate-limit unreachable

   !

   !

   ip cef

   no ip domain lookup

   !

   !

   !

   !

   !

   !

   !

   !

   !

   !

   !

   !

   !

   !

   !

   !

   !

   !

   ip tcp synwait-time 5

   !

   !

   !

   !

   !

   interface FastEthernet0/0

   !

   interface FastEthernet0/1

   !

   interface FastEthernet0/2

  !
interface FastEthernet0/3
!
interface FastEthernet0/4
!
interface FastEthernet0/5
no switchport
ip address 100.1.1.2255.255.255.0
!
interface FastEthernet0/6
switchport access vlan 10
!
interface FastEthernet0/7
switchport access vlan 20
!
interface FastEthernet0/8
switchport access vlan 30
!
interface FastEthernet0/9
switchport access vlan 40
!
interface FastEthernet0/10
!
interface FastEthernet0/11
!
interface FastEthernet0/12
!
interface FastEthernet0/13
!
interface FastEthernet0/14
!
interface FastEthernet0/15
!
interface Vlan1
no ip address
!
interface Vlan10
ip address 10.1.1.1255.255.255.0
!
interface Vlan20
ip address 10.2.2.1255.255.255.0
!
interface Vlan30
ip address 10.3.3.1255.255.255.0
!
interface Vlan40
ip address 10.4.4.1255.255.255.0
!
no ip http server
no ip http secure-server
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 100.1.1.1
!
!
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
line vty 0 4
login
!
!
End





R1# show running-config
Building configuration...

Current configuration : 2300 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
no ip icmp rate-limit unreachable
!
!
ip cef
no ip domain lookup
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
ip tcp synwait-time 5
!
!
!
!
!
interface FastEthernet0/0
ip address 210.25.96.10255.255.255.0 secondary
ip address 156.253.16.20255.255.255.0 secondary
ip address 114.115.25.30255.255.255.0 secondary
ip address 202.103.96.20255.255.255.0
ip nat outside
ip virtual-reassembly
ip policy route-map access
duplex auto
speed auto
!
interface FastEthernet1/0
ip address 100.1.1.1255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
no ip http server
no ip http secure-server
!
ip forward-protocol nd
ip route 10.1.1.0 255.255.255.0 10.1.1.1
ip route 10.1.1.0 255.255.255.0 100.1.1.2
ip route 10.2.2.0 255.255.255.0 10.2.2.1
ip route 10.2.2.0 255.255.255.0 100.1.1.2
ip route 10.3.3.0 255.255.255.0 10.3.3.1
ip route 10.3.3.0 255.255.255.0 100.1.1.2
ip route 10.4.4.0 255.255.255.0 10.4.4.1
ip route 10.4.4.0 255.255.255.0 100.1.1.2
!
ip nat pool 1 202.103.96.20 202.103.96.20 netmask 255.255.255.0
ip nat pool 2 210.25.96.10 210.25.96.10 netmask 255.255.255.0
ip nat pool 3 156.253.16.20 156.253.16.20 netmask 255.255.255.0
ip nat pool 4 114.115.25.30 114.115.25.30 netmask 255.255.255.0
ip nat inside source list 1 pool 1 overload
ip nat inside source list 2 pool 2 overload
ip nat inside source list 3 pool 3 overload
ip nat inside source list 4 pool 4 overload
!
access-list 1 permit 10.1.1.0 0.0.0.255
access-list 2 permit 10.2.2.0 0.0.0.255
access-list 3 permit 10.3.3.0 0.0.0.255
access-list 4 permit 10.4.4.0 0.0.0.255
!
route-map access permit 7
match ip address 4
set ip next-hop 114.115.25.3
!
route-map access permit 8
match ip address 3
set ip next-hop 156.253.16.10
!
route-map access permit 9
match ip address 2
set ip next-hop 210.25.96.3
!
route-map access permit 10
match ip address 1
set ip next-hop 202.103.96.68
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
line vty 0 4
login
!
!
end

本文出自 “波总技术博客” 博客，谢绝转载！