一、IP地址规划
VLAN 100  192.168.10.0/24
VLAN 200  192.168.20.0/24
R1 与 R2 互联  10.0.12.0/30
R2 与 AR3 互联  202.100.1.0/30
ISP 侧 PC1  202.100.2.10/24

二、分设备配置

1. 交换机 LSW1
# 创建VLAN
vlan batch 100 200

# 配置接入端口
interface GigabitEthernet 0/0/1
 port link-type access
 port default vlan 100
interface GigabitEthernet 0/0/2
 port link-type access
 port default vlan 200

# 配置与R1互联的Trunk端口
interface GigabitEthernet 0/0/3
 port link-type trunk
 port trunk allow-pass vlan 100 200

# 配置与LSW2互联的Trunk端口
interface GigabitEthernet 0/0/4
 port link-type trunk
 port trunk allow-pass vlan 100 200
2. 交换机 LSW2
# 创建VLAN
vlan batch 100 200

# 配置接入端口
interface GigabitEthernet 0/0/1
 port link-type access
 port default vlan 100
interface GigabitEthernet 0/0/2
 port link-type access
 port default vlan 200

# 配置与LSW1互联的Trunk端口
interface GigabitEthernet 0/0/3
 port link-type trunk
 port trunk allow-pass vlan 100 200
3. 路由器 R1
# 配置子接口与DHCP
interface GigabitEthernet 0/0/0.100
 dot1q termination vid 100
 ip address 192.168.10.254 255.255.255.0
 arp broadcast enable
 dhcp select global
interface GigabitEthernet 0/0/0.200
 dot1q termination vid 200
 ip address 192.168.20.254 255.255.255.0
 arp broadcast enable
 dhcp select global

# 配置DHCP地址池
ip pool VLAN100
 gateway-list 192.168.10.254
 network 192.168.10.0 mask 255.255.255.0
ip pool VLAN200
 gateway-list 192.168.20.254
 network 192.168.20.0 mask 255.255.255.0

# 配置OSPF
ospf 1 router-id 1.1.1.1
 area 0
  network 192.168.10.0 0.0.0.255
  network 192.168.20.0 0.0.0.255
  network 10.0.12.0 0.0.0.3

# 配置与R2互联接口
interface GigabitEthernet 0/0/1
 ip address 10.0.12.1 255.255.255.252
4. 路由器 R2（企业边界）
# 配置互联接口
interface GigabitEthernet 0/0/0
 ip address 10.0.12.2 255.255.255.252
interface GigabitEthernet 0/0/1
 ip address 202.100.1.1 255.255.255.252

# 配置OSPF
ospf 1 router-id 2.2.2.2
 area 0
  network 10.0.12.0 0.0.0.3

# 配置默认路由指向ISP
ip route-static 0.0.0.0 0.0.0.0 202.100.1.2

# 配置ACL禁止VLAN100访问PC1
acl number 3000
 rule 10 deny ip source 192.168.10.0 0.0.0.255 destination 202.100.2.10 0.0.0.0
 rule 20 permit ip source any destination any

# 在出接口应用ACL
interface GigabitEthernet 0/0/1
 traffic-filter outbound acl 3000
5. 路由器 AR3（ISP侧）
# 配置互联接口
interface GigabitEthernet 0/0/0
 ip address 202.100.1.2 255.255.255.252
interface GigabitEthernet 0/0/1
 ip address 202.100.2.254 255.255.255.0

# 配置默认路由指向企业侧
ip route-static 192.168.10.0 255.255.255.0 202.100.1.1
ip route-static 192.168.20.0 255.255.255.0 202.100.1.1