一.实验目的

1.PC1和pc3所在接口为access;属于 vlan2;

Pc2/4/5/6处于同一网段;其中Pc2可以访问pc4/5/6;但pc4可以访问pc5，不能访问pc6

2.PC5不能访问PC6

3.PC1/3与Pc2/4/5/6不在同一个网段

4.所有Pc通过DHCP获取IP地址，且Pc1/3可以正常访问pc2/4/5/6

二.拓扑图

三.IP地址规划

四.设备的配置

AR1的配置

system-view
sysname AR1
dhcp enable

// 创建两个地址池，分别用于VLAN2和VLAN3
ip pool vlan2
 network 192.168.2.0 mask 255.255.255.0
 gateway-list 192.168.2.1
 dns-list 8.8.8.8
ip pool vlan3
 network 192.168.3.0 mask 255.255.255.0
 gateway-list 192.168.3.1  // 注意网关是LSW1的VLANIF3地址
 dns-list 8.8.8.8
quit

// 配置连接交换机的物理接口，并创建子接口
interface GigabitEthernet 0/0/1
 undo shutdown
 quit

interface GigabitEthernet0/0/1.2
 dot1q termination vid 2
 ip address 192.168.2.1 255.255.255.0
 arp broadcast enable
 dhcp select global  // 从全局地址池分配IP
quit

interface GigabitEthernet0/0/1.3
 dot1q termination vid 3
 ip address 192.168.3.254 255.255.255.0
 arp broadcast enable
 dhcp select global
quit
 

LSW1的配置

system-view
sysname LSW1
vlan batch 2 3

// 创建VLANIF3接口，作为PC2/4/5/6的网关
interface Vlanif 3
 ip address 192.168.3.1 255.255.255.0
 dhcp select relay  // 启用DHCP中继
 dhcp relay server-ip 192.168.3.254  // 指向AR1的VLAN3子接口地址
quit

// 配置连接路由器和下级交换机的接口为Trunk
interface GigabitEthernet 0/0/1
 port link-type trunk
 port trunk allow-pass vlan 2 3
 description to_AR1
quit

interface GigabitEthernet 0/0/2
 port link-type trunk
 port trunk allow-pass vlan 2 3
 description to_LSW2
quit

interface GigabitEthernet 0/0/3
 port link-type trunk
 port trunk allow-pass vlan 2 3
 description to_LSW3
quit

// 配置高级ACL 3000，实现PC4/5/6之间的访问控制
acl 3000
 rule 5 deny icmp source 192.168.3.4 0 destination 192.168.3.6 0
 rule 10 deny icmp source 192.168.3.6 0 destination 192.168.3.4 0
 rule 15 deny icmp source 192.168.3.5 0 destination 192.168.3.6 0
 rule 20 deny icmp source 192.168.3.6 0 destination 192.168.3.5 0
 // 注意: 根据实验要求，PC2可访问PC4/5/6，PC4可访问PC5，所以未禁止的流量默认允许
 rule 100 permit ip
quit

// 在网关接口的入方向应用ACL，对进入VLAN3的流量进行过滤
interface Vlanif 3
 traffic-filter inbound acl 3000
quit
 

LSW2的配置

system-view
sysname LSW2
vlan batch 2 3

// 上联口配置为Trunk
interface GigabitEthernet 0/0/1
 port link-type trunk
 port trunk allow-pass vlan 2 3
 description to_LSW1
quit

// 下联口配置为Access，划分到指定VLAN
interface GigabitEthernet 0/0/2
 port link-type access
 port default vlan 2
 description to_PC1
quit

interface GigabitEthernet 0/0/3
 port link-type access
 port default vlan 3
 description to_PC2
quit
 

LSW3的配置

system-view
sysname LSW3
vlan batch 2 3

// 上联口配置为Trunk
interface GigabitEthernet 0/0/1
 port link-type trunk
 port trunk allow-pass vlan 2 3
 description to_LSW1
quit

// 下联口配置为Access
interface GigabitEthernet 0/0/2
 port link-type access
 port default vlan 2
 description to_PC3
quit

interface GigabitEthernet 0/0/3
 port link-type access
 port default vlan 3
 description to_PC4
quit

interface GigabitEthernet 0/0/4
 port link-type access
 port default vlan 3
 description to_PC5
quit

interface GigabitEthernet 0/0/5
 port link-type access
 port default vlan 3
 description to_PC6
quit