一、实验拓扑

二、实验要求

1、pc1和pc3所在接口为access;属于vlan 2;
pc2/pc4/pc5/pc6处于同一网段;其中pc2可以访问pc4/pc5/pc6; pc4可以访问pc6;pc5不能访问pc6;
2、pc1/pc3与pc2/pc4/pc5/pc6不在同一网段;
3、所有pc通过DHCP获取IP地址，且pc1/pc3可以正常访问pc2/pc4/pc5/pc6;

三、实验思路

1.VLAN基础规划

2.交换机VLAN与接口模式配置

3.路由器单臂路由子接口+DHCP配置

4.配置ACL实现访问控制

四、配置命令

VLAN配置

[sw1]vlan batch 2 to 6

Info: This operation may take a few seconds. Please wait for a moment...done.
[sw1]int g0/0/1
[sw1-GigabitEthernet0/0/1]port link-type access  
[sw1-GigabitEthernet0/0/1]port default vlan 2
[sw1-GigabitEthernet0/0/1]int g0/0/2
[sw1-GigabitEthernet0/0/2]port link-type hybrid 
[sw1-GigabitEthernet0/0/2]port hybrid untagged vlan 3 4 5 6
[sw1-GigabitEthernet0/0/2]dis th
#
interface GigabitEthernet0/0/2
 port hybrid untagged vlan 3 to 6
#
[sw1]int g0/0/4    
[sw1-GigabitEthernet0/0/4]port link-type hybrid 
[sw1-GigabitEthernet0/0/4]port hybrid untagged vlan 3 4 5 6                                                    [sw1-GigabitEthernet0/0/4]port hybrid tagged vlan 2

[sw2] vlan b 2 to 6
Info: This operation may take a few seconds. Please wait for a moment...done.
[sw2]int g0/0/1   
[sw2-GigabitEthernet0/0/1]port link-type access   
[sw2-GigabitEthernet0/0/1]port default vlan 2
[sw2-GigabitEthernet0/0/1]int g0/0/2   
[sw2-GigabitEthernet0/0/2]port link-type hybrid 
[sw2-GigabitEthernet0/0/2]port hybrid pvid vlan 4
[sw2-GigabitEthernet0/0/2]port hybrid untagged vlan 3 to 6

[sw2]port-group  group-member GigabitEthernet 0/0/3 g0/0/4
[sw2-GigabitEthernet0/0/3]port link-type trunk 
[sw2-GigabitEthernet0/0/4]port link-type trunk 
[sw2-port-group]port trunk allow-pass vlan 2 to 6
[sw2-GigabitEthernet0/0/3]port trunk allow-pass vlan 2 to 6
[sw2-GigabitEthernet0/0/4]port trunk allow-pass vlan 2 to 6

[sw3]vlan b 2 to 6
Info: This operation may take a few seconds. Please wait for a moment...done.
[sw3]int g0/0/1
[sw3-GigabitEthernet0/0/1]port link-type hybrid
[sw3-GigabitEthernet0/0/1]port hybrid pvid vlan 5
[sw3-GigabitEthernet0/0/1]port hybrid untagged vlan 3 4 5
[sw3-GigabitEthernet0/0/1]int g0/0/2
[sw3-GigabitEthernet0/0/2]port link-type hybrid
[sw3-GigabitEthernet0/0/2]port hybrid pvid vlan 6
[sw3-GigabitEthernet0/0/2]port hybrid untagged vlan 3 4 6
[sw3-GigabitEthernet0/0/2]int g0/0/3
[sw3-GigabitEthernet0/0/3]port link-type trunk
[sw3-GigabitEthernet0/0/3]port trunk allow-pass vlan 2 to 6

[r1]int g0/0/0
[r1-GigabitEthernet0/0/0]ip add 192.168.1.254 24
[r1-GigabitEthernet0/0/0]int g0/0/0.2
[r1-GigabitEthernet0/0/0.2]ip add 192.168.2.254 24  
[r1-GigabitEthernet0/0/0.2]dot1q termination vid 2  
[r1-GigabitEthernet0/0/0.2]arp broadcast enable 

配置DHCP

[r1]ip pool aa
Info: It's successful to create an IP address pool.
[r1-ip-pool-aa]network 192.168.2.0 mask 24
[r1-ip-pool-aa]gateway-list 192.168.2.254
[r1-ip-pool-aa]dns-list 8.8.8.8 114.114.114.114
[r1]ip pool bb
Info: It's successful to create an IP address pool.
[r1-ip-pool-bb]network 192.168.1.0 mask 24 
[r1-ip-pool-bb]gateway-list 192.168.1.254    
[r1-ip-pool-bb]dns-list 8.8.8.8 114.114.114.114
[r1]int g0/0/0
[r1-GigabitEthernet0/0/0]dhcp select global 
[r1-GigabitEthernet0/0/0]int g0/0/0.2
[r1-GigabitEthernet0/0/0.2]dhcp select global 

五、ping通测试

PC2访问PC4/PC5/PC6

PC4访问PC6

PC5不能访问PC6

PC1访问PC2

PC1访问PC3

PC2访问PC5