实验需求总分部出口路由器配置 NAT内网 PC 可 ping 通对端外网接口总分部、互联网用户均可访问内网 WEB 服务器网管 VLAN20010.1.200.0/24模拟网管设备 Telnet 管理接入、汇聚、核心交换机。IPVLAN 规划表格设备VLANIP 地址网关PC1VLAN11172.16.1.253/24172.16.1.254PC2VLAN12172.16.2.253/24172.16.2.254Server1 (内部服务器)VLAN13172.16.3.253/24172.16.3.254AR1 模拟网管VLAN14172.16.4.253/24172.16.4.254PC4VLAN15172.16.5.253/24172.16.5.254Client1VLAN16172.16.6.253/24172.16.6.254SW‑ACC 接入VLAN200 管理10.1.200.1/24-SW‑AGG1 汇聚VLAN200 管理10.1.200.2/24-SW‑CORE1 核心VLAN200 管理10.1.200.254/24-核心互联 VLAN100VLAN100172.16.100.0/24-核心互联 VLAN101VLAN101172.16.101.0/24-外网AR2 总部出口外网202.96.10.0/24AR5 分部出口外网202.96.20.0/24ISP1202.96.10.2、202.96.20.1、113.100.10.11、接入交换机 SW‑ACCsysname SW-ACC vlan batch 11 12 200 #PC1 interface Ethernet0/0/1 port link-type access port default vlan 11 #PC2 interface Ethernet0/0/2 port link-type access port default vlan 12 #上联汇聚Trunk interface GigabitEthernet0/0/1 port link-type trunk port trunk allow-pass vlan 11 12 200 #管理VLANIF200 interface Vlanif200 ip address 10.1.200.1 255.255.255.0 #默认路由指向汇聚管理地址 ip route-static 0.0.0.0 0.0.0.0 10.1.200.2 #Telnet AAA配置 aaa local-user admin password cipher 123456 local-user admin privilege level 15 local-user admin service-type telnet quit user-interface vty 0 4 authentication-mode aaa quit2、汇聚交换机 SW‑AGG1sysname SW-AGG1 vlan batch 11 12 200 100 #下联接入Trunk interface GigabitEthernet0/0/2 port link-type trunk port trunk allow-pass vlan 11 12 200 #上联核心Trunk interface GigabitEthernet0/0/1 port link-type trunk port trunk allow-pass vlan 11 12 100 200 #业务网关 interface Vlanif11 ip address 172.16.1.254 255.255.255.0 interface Vlanif12 ip address 172.16.2.254 255.255.255.0 interface Vlanif100 ip address 172.16.100.1 255.255.255.0 #管理VLANIF200 interface Vlanif200 ip address 10.1.200.2 255.255.255.0 #路由 ip route-static 0.0.0.0 0.0.0.0 172.16.100.2 ip route-static 10.1.200.254 255.255.255.255 172.16.100.2 #Telnet AAA aaa local-user admin password cipher 123456 local-user admin privilege level 15 local-user admin service-type telnet quit user-interface vty 0 4 authentication-mode aaa quit3、核心交换机 SW‑CORE1sys sysname SW-CORE1 vlan batch 11 12 13 14 100 101 200 #下联汇聚Trunk interface GigabitEthernet0/0/1 port link-type trunk port trunk allow-pass vlan 11 12 100 200 #连接AR1模拟网管路由器 interface GigabitEthernet0/0/19 port link-type trunk port trunk allow-pass vlan 14 #接入内部服务器Server1 interface GigabitEthernet0/0/0 port link-type access port default vlan 13 #上联总部出口AR2 interface GigabitEthernet0/0/3 port link-type access port de vlan 101 #VLANIF网关 interface Vlanif11 ip address 172.16.1.254 255.255.255.0 interface Vlanif12 ip address 172.16.2.254 255.255.255.0 interface Vlanif13 ip address 172.16.3.254 255.255.255.0 interface Vlanif14 ip address 172.16.4.254 255.255.255.0 interface Vlanif100 ip address 172.16.100.2 255.255.255.0 interface Vlanif101 ip address 172.16.101.2 255.255.255.0 interface Vlanif200 ip address 10.1.200.254 255.255.255.0 #静态路由 ip route-static 172.16.1.0 255.255.255.0 172.16.100.1 ip route-static 172.16.2.0 255.255.255.0 172.16.100.1 ip route-static 0.0.0.0 0.0.0.0 172.16.101.1 #Telnet AAA aaa local-user admin password cipher 123456 local-user admin privilege level 15 local-user admin service-type telnet quit user-interface vty 0 4 authentication-mode aaa quit4、AR1模拟网管路由器sys sysname AR1 interface GigabitEthernet0/0/1 #不考虑子接口的情况下 ip address 172.16.4.253 24 #访问网管VLAN200 ip route-static 10.1.200.0 255.255.255.0 172.16.4.2545、AR2总部出口路由器NAT 服务器映射sysname AR2 #对接核心交换机 interface GigabitEthernet0/0/1 ip address 172.16.101.1 255.255.255.0 #对接ISP1外网口 interface GigabitEthernet0/0/0 ip address 202.96.10.1 255.255.255.0 #NAT感兴趣流整个企业内网网段 acl number 3000 rule permit ip source 172.16.0.0 0.0.255.255 #NAT地址池 nat address-group 1 202.96.10.10 202.96.10.20 interface GigabitEthernet0/0/0 nat outbound 3000 address-group 1 no-pat #NAT Server外网访问内部服务器Server1 172.16.3.253 nat server protocol tcp global 202.96.10.30 80 inside 172.16.3.253 80 #路由 ip route-static 172.16.0.0 255.255.0.0 172.16.101.2 ip route-static 0.0.0.0 0.0.0.0 202.96.10.26、ISP1 运营商路由器sysname ISP1 interface GigabitEthernet0/0/0 ip address 202.96.10.2 255.255.255.0 interface GigabitEthernet0/0/2 ip address 202.96.20.1 255.255.255.0 interface GigabitEthernet0/0/1 ip address 113.100.10.1 255.255.255.0 #回指企业内网路由 ip route-static 172.16.0.0 255.255.0.0 202.96.10.17、AR5分部出口路由器NATsysname AR5 #对接ISP1 interface GigabitEthernet0/0/0 ip address 202.96.20.2 255.255.255.0 #对接分部交换机LSW3 interface GigabitEthernet0/0/1 ip address 172.16.5.254 255.255.255.0 acl number 3000 rule permit ip source 172.16.5.0 0.0.0.255 rule permit ip source 172.16.6.0 0.0.0.255 nat address-group 1 202.96.20.10 202.96.20.20 interface GigabitEthernet0/0/0 nat outbound 3000 address-group 1 no-pat #路由 ip route-static 0.0.0.0 0.0.0.0 202.96.20.1 ip route-static 172.16.0.0 255.255.0.0 202.96.20.18、SW3 分部交换机sys sysname SW3 vlan batch 15 16 #PC4 interface g0/0/1 port link-type access port default vlan 15 #Client1 interface g0/0/2 port link-type access port default vlan 16 #上联AR5分部出口 interface g0/0/19 port link-type trunk port trunk allow-pass vlan 15 16 interface Vlanif15 ip address 172.16.5.254 255.255.255.0 interface Vlanif16 ip address 172.16.6.254 255.255.255.09、ISP2 互联网路由器可选sysname ISP2 interface GigabitEthernet0/0/0 ip address 113.100.10.2 255.255.255.0 interface GigabitEthernet0/0/2 ip address 113.100.30.254 255.255.255.0 interface GigabitEthernet0/0/1 ip address 113.100.20.254 255.255.255.0 ip route-static 0.0.0.0 0.0.0.0 113.100.10.1✅实验验证Telnet 网管测试AR1172.16.4.253执行telnet 10.1.200.1账号admin密码123456依次登录接入、汇聚、核心交换机。SW-ACCSW-AGG1SW-CORE1NAT 互通测试总部 PC1 ping 分部外网口202.96.20.2分部 PC4 ping 总部外网口202.96.10.1通表示 NAT 配置正常。WEB 服务器访问内网 PC 直接访问172.16.3.253互联网 PC 访问公网映射地址202.96.10.30分部 PC4 也可以访问内网服务器。注意点路由器二层口命令portlink‑mode layer2eNSP 中 AR 系列路由器接口切换二层模式no‑pat 为多地址 NAT也可替换为 easy‑ipTelnet 明文不安全生产环境替换 SSHPC 和服务器关闭防火墙开启 HTTP 服务。