首页 > 资讯 > 交换机 > 正文

4路外线（NAT+PBR真实案例）

15-08-28 来源：[db:作者]

收藏我要投稿

三路电信企业宽带固定IP、一路联通企业宽带固定IP。

需求：每个二层下组成一个内网、每个内网分配一路外线（暂时不做故障转移）

设备（1台cisco3560三层交换机、一台cisco2911路由器且只有两个端口、4台二层交换机）

数据走向图：

划分5个vlan，其中4个vlan各对应下面4台二层交换机，也就是对应每个内网，第5个vlan用于扩展路由器外线接口（路由器外线接口采用多IP方案，没有用子接口）

路由器内线与三层交换机采用三层互联（内线对应的三层交换机端口是三层端口）

4个二层交换机所对应三层端口采用vlan上配置IP，没有转换三层端口

路由器上做NAT+PBR实现每个内网对应到一个外网上

R3/R4/R5/R6是公网路由器

C1/C2/C3/C4为每个内网的主机

R2为三层交换机、R1为路由器

SW1/SW2/SW3/SW4 是4台二层交换机

下面我贴出三层交换机和路由器的配置

R2（三层交换机）#show running-config

Building configuration...

Current configuration : 1525 bytes

version 12.4

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

hostname R2

boot-start-marker

boot-end-marker

no aaa new-model

memory-size iomem 5

no ip icmp rate-limit unreachable

ip cef

no ip domain lookup

ip tcp synwait-time 5

interface FastEthernet0/0

interface FastEthernet0/1

interface FastEthernet0/2

interface FastEthernet0/3

interface FastEthernet0/4

interface FastEthernet0/5

no switchport

ip address 100.1.1.2255.255.255.0

interface FastEthernet0/6

switchport access vlan 10

interface FastEthernet0/7

switchport access vlan 20

interface FastEthernet0/8

switchport access vlan 30

interface FastEthernet0/9

switchport access vlan 40

interface FastEthernet0/10

interface FastEthernet0/11

interface FastEthernet0/12

interface FastEthernet0/13

interface FastEthernet0/14

interface FastEthernet0/15

interface Vlan1

no ip address

interface Vlan10

ip address 10.1.1.1255.255.255.0

interface Vlan20

ip address 10.2.2.1255.255.255.0

interface Vlan30

ip address 10.3.3.1255.255.255.0

interface Vlan40

ip address 10.4.4.1255.255.255.0

no ip http server

no ip http secure-server

ip forward-protocol nd

ip route 0.0.0.0 0.0.0.0 100.1.1.1

control-plane

line con 0

exec-timeout 0 0

privilege level 15

logging synchronous

line aux 0

exec-timeout 0 0

privilege level 15

logging synchronous

line vty 0 4

End

R1# show running-config

Building configuration...

Current configuration : 2300 bytes

version 12.4

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

hostname R1

boot-start-marker

boot-end-marker

no aaa new-model

memory-size iomem 5

no ip icmp rate-limit unreachable

ip cef

no ip domain lookup

ip tcp synwait-time 5

interface FastEthernet0/0

ip address 210.25.96.10255.255.255.0 secondary

ip address 156.253.16.20255.255.255.0 secondary

ip address 114.115.25.30255.255.255.0 secondary

ip address 202.103.96.20255.255.255.0

ip nat outside

ip virtual-reassembly

ip policy route-map access

duplex auto

speed auto

interface FastEthernet1/0

ip address 100.1.1.1255.255.255.0

ip nat inside

ip virtual-reassembly

duplex auto

speed auto

no ip http server

no ip http secure-server

ip forward-protocol nd

ip route 10.1.1.0 255.255.255.0 10.1.1.1

ip route 10.1.1.0 255.255.255.0 100.1.1.2

ip route 10.2.2.0 255.255.255.0 10.2.2.1

ip route 10.2.2.0 255.255.255.0 100.1.1.2

ip route 10.3.3.0 255.255.255.0 10.3.3.1

ip route 10.3.3.0 255.255.255.0 100.1.1.2

ip route 10.4.4.0 255.255.255.0 10.4.4.1

ip route 10.4.4.0 255.255.255.0 100.1.1.2

ip nat pool 1 202.103.96.20 202.103.96.20 netmask 255.255.255.0

ip nat pool 2 210.25.96.10 210.25.96.10 netmask 255.255.255.0

ip nat pool 3 156.253.16.20 156.253.16.20 netmask 255.255.255.0

ip nat pool 4 114.115.25.30 114.115.25.30 netmask 255.255.255.0

ip nat inside source list 1 pool 1 overload

ip nat inside source list 2 pool 2 overload

ip nat inside source list 3 pool 3 overload

ip nat inside source list 4 pool 4 overload

access-list 1 permit 10.1.1.0 0.0.0.255

access-list 2 permit 10.2.2.0 0.0.0.255

access-list 3 permit 10.3.3.0 0.0.0.255

access-list 4 permit 10.4.4.0 0.0.0.255

route-map access permit 7

match ip address 4

set ip next-hop 114.115.25.3

route-map access permit 8

match ip address 3

set ip next-hop 156.253.16.10

route-map access permit 9

match ip address 2

set ip next-hop 210.25.96.3

route-map access permit 10

match ip address 1

set ip next-hop 202.103.96.68

control-plane

line con 0

exec-timeout 0 0

privilege level 15

logging synchronous

line aux 0

exec-timeout 0 0

privilege level 15

logging synchronous

line vty 0 4

end

点击复制链接与好友分享!回本站首页