→跟着大佬学习的b站直通车←

• 目标1：dhcp分配ip地址

• 目标2：内网用户访问www.yzy.com

  sw1

  #
  vlan batch 10 
  #
  interface Ethernet0/0/1port link-type accessport default vlan 10
  #
  interface Ethernet0/0/2port link-type trunkport trunk allow-pass vlan 10
  #
  

  sw2

  #
  vlan batch 20 30
  #
  interface Ethernet0/0/1port link-type accessport default vlan 20
  #
  interface Ethernet0/0/2port link-type accessport default vlan 30
  #
  interface Ethernet0/0/3port link-type trunkport trunk allow-pass vlan 20 30
  #
  

  sw3

  #
  vlan batch 10 20 30 40 50
  #
  interface GigabitEthernet0/0/1port link-type trunkport trunk allow-pass vlan 10
  #
  interface GigabitEthernet0/0/2port link-type trunkport trunk allow-pass vlan 20 30
  #
  interface GigabitEthernet0/0/3port link-type accessport default vlan 40
  #
  interface GigabitEthernet0/0/4port link-type accessport default vlan 50
  #
  dhcp enable
  #
  interface Vlanif10ip address 192.168.10.254 255.255.255.0dhcp select interfacedhcp server dns-list 172.16.100.1
  #
  interface Vlanif20ip address 192.168.20.254 255.255.255.0dhcp select interfacedhcp server dns-list 172.16.100.1
  #
  interface Vlanif30ip address 192.168.30.254 255.255.255.0dhcp select interfacedhcp server dns-list 172.16.100.1
  #
  interface Vlanif40ip address 172.16.100.254 255.255.255.0
  #
  interface Vlanif50ip address 10.10.10.2 255.255.255.0
  #

  Server1
  
  

• 目标3：nat内网用户访问外网

  SW3

  #
  ip route-static 0.0.0.0 0.0.0.0 10.10.10.1
  #
  

  R1

  #nat address-group 1 64.1.1.4 64.1.1.4
  #acl number 2000  rule 5 permit source 192.168.0.0 0.0.255.255
  #
  interface GigabitEthernet0/0/0ip address 10.10.10.1 255.255.255.0 
  #
  interface GigabitEthernet0/0/1ip address 64.1.1.1 255.255.255.0 nat outbound 2000 address-group 1 
  #ip route-static 0.0.0.0 0.0.0.0 64.1.1.10ip route-static 192.168.0.0 255.255.0.0 10.10.10.2
  #
  

  R2

  #
  interface GigabitEthernet0/0/0ip address 64.1.1.10 255.255.255.0 
  #
  interface GigabitEthernet0/0/1ip address 8.8.8.254 255.255.255.0 
  #
  

• 目标4：acl禁止vlan10访问外网 traffic-filter

  R1

  #
  acl number 2001  rule 5 deny source 192.168.10.0 0.0.0.255 rule 10 permit 
  #
  interface GigabitEthernet0/0/0traffic-filter inbound acl 2001
  #
  

• 对视频的补充-目标4用MQC实现

  R1

  #
  acl number 2002  rule 5 permit source 192.168.10.0 0.0.0.255 
  #
  traffic classifier no_vlan10 operator orif-match acl 2002
  #
  traffic behavior no_vlan10deny
  #
  traffic policy no_vlan10classifier no_vlan10 behavior no_vlan10
  #
  interface GigabitEthernet0/0/0ip address 10.10.10.1 255.255.255.0 traffic-policy no_vlan10 inbound

  ↑狗骑吕布了属于是