1.在接入层交换机上划分vlan，核心交换机设置vlanif网关[SW2]vlan batch 10 20[SW2-Ethernet0/0/2]port link-type access[SW2-Et
.
1.在接入层交换机上划分vlan，核心交换机设置vlanif网关
[SW2]vlan batch 10 20
[SW2-Ethernet0/0/2]port link-type access
[SW2-Ethernet0/0/2]port default vlan 10
[SW2-Ethernet0/0/3]port link-type access
[SW2-Ethernet0/0/3]port default vlan 20
[SW2-Ethernet0/0/1]port link-type trunk
[SW2-Ethernet0/0/1]port trunk allow-pass vlan all
[SW1-GigabitEthernet0/0/2]port link-type trunk
[SW1-GigabitEthernet0/0/2]port trunk allow-pass vlan all
[SW1]vlan batch 10 20
[SW1]int Vlanif 10
[SW1-Vlanif10]ip add 172.16.10.254 24
[SW1-Vlanif10]int Vlanif 20
[SW1-Vlanif20]ip add 172.16.20.254 24
2.使用OSPF协议连通核心交换机和出口路由器
[SW1]vlan 100
[SW1-GigabitEthernet0/0/1]port link-type access
[SW1-GigabitEthernet0/0/1]port default vlan 100
[SW1]int Vlanif 100
[SW1-Vlanif100]ip add 10.1.1.2 24
[SW1-ospf-1-area-0.0.0.0]network 10.1.1.2 0.0.0.0
[AR1-GigabitEthernet0/0/1]ip add 10.1.1.1 24
[AR1-ospf-1-area-0.0.0.0]network 10.1.1.1 0.0.0.0
3.出口路由器使用默认路由连接Internet
[AR1-GigabitEthernet0/0/0]ip add 200.1.1.1 24
[AR1]ip route-static 0.0.0.0 0.0.0.0 200.1.1.2
[Internet-GigabitEthernet0/0/0]ip add 200.1.1.2 24
[Internet]ip route-static 172.16.0.0 255.255.0.0 200.1.1.1
4.核心交换机配置默认路由和出口路由器配置回包路由
[SW1]ip route-static 0.0.0.0 0.0.0.0 10.1.1.1
[AR1]ip route-static 172.16.0.0 255.255.0.0 10.1.1.2
5.配置基于地址池的NAT转换
[AR1]nat address-group 1 200.1.1.10 200.1.1.50 //配置地址池
[AR1]acl 2000
[AR1-acl-basic-2000]rule permit source 172.16.0.0 0.0.255.255 //通过ACL抓取外出路由
[AR1-GigabitEthernet0/0/0]nat outbound 2000 address-group 1 no-pat //在接口应用NAT转换（加NO-PAT表示不转换接口）
[AR1]display nat address-group //查看NAT地址池
[AR1]display nat outbound //查看地址转换
- PC可以ping通外网，在AR1的G0/0/0口抓包也看不到内网IP，配置成功。
