一、分析过程图二、接入层的配置[sw3]vlan b 2 3 [sw3-GigabitEthernet0/0/3]po li t [sw3-GigabitEthernet0/0/3]po t a v 2 3 [sw3-GigabitEthernet0/0/4]po li t [sw3-GigabitEthernet0/0/4]po t a v 2 3 在sw3上运行stp [sw3]stp region-configuration [sw3-mst-region]region-name aa [sw3-mst-region]instance 1 v 2 [sw3-mst-region]instance 2 v 3 [sw3-mst-region]active region-configuration 让1作为主根2作为备份根 [sw3]stp instance 1 root primary [sw3]stp instance 2 root secondary vrrp配置 [sw3]interface Vlanif 2 [sw3-Vlanif2]ip address 192.168.2.1 24 [sw3-Vlanif2]vrrp vrid 1 virtual-ip 192.168.2.254 [sw3-Vlanif2]vrrp vrid 1 priority 120 [sw3-Vlanif2]vrrp vrid 1 preempt-mode timer delay 20 [sw3-Vlanif2]vrrp vrid 1 track interface GigabitEthernet 0/0/1 reduced 15 监控 [sw3-Vlanif2]vrrp vrid 1 track interface GigabitEthernet 0/0/2 reduced 15 [sw3]interface Vlanif 3 备份 [sw3-Vlanif3]ip address 192.168.3.1 24 [sw3-Vlanif3]vrrp vrid 1 virtual-ip 192.168.3.254[sw4]vlan batch 2 3 [sw4-GigabitEthernet0/0/3]po li t [sw4-GigabitEthernet0/0/3]po t a v 2 3 [sw4-GigabitEthernet0/0/1]int g 0/0/4 [sw4-GigabitEthernet0/0/4]po lin t [sw4-GigabitEthernet0/0/4]po t a v 2 3 生成树预配置 [sw4]stp region-configuration [sw4-mst-region]region-name aa [sw4-mst-region]instance 1 v 2 [sw4-mst-region]instance 2 v 3 [sw4-mst-region]active region-configuration 实例1的备份根实例2的主根 [sw4]int Vlanif 2 [sw4-Vlanif2]ip address 192.168.2.2 24 [sw4-Vlanif2]vrrp vrid 1 virtual-ip 192.168.2.254 [sw4-Vlanif3]ip address 192.168.3.2 24 [sw4-Vlanif3]vrrp vrid 1 virtual-ip 192.168.3.254 [sw4-Vlanif3]vrrp vrid 1 priority 120 [sw4-Vlanif3]vrrp vrid 1 preempt-mode timer delay 20 [sw4-Vlanif3]vrrp vrid 1 track interface GigabitEthernet 0/0/1 reduced 15 [sw4-Vlanif3]vrrp vrid 1 track interface GigabitEthernet 0/0/2 reduced 15[sw5]vlan b 2 3 [sw5-GigabitEthernet0/0/3]po li ac. [sw5-GigabitEthernet0/0/3]po de v 2. [sw5-GigabitEthernet0/0/4]po lin ac [sw5-GigabitEthernet0/0/4]po de v 3 [sw5]int g 0/0/1 [sw5-GigabitEthernet0/0/1]po li t [sw5-GigabitEthernet0/0/1]po t a v 2 3 [sw5-GigabitEthernet0/0/1]int g 0/0/2 [sw5-GigabitEthernet0/0/2]po t a v 2 3 生成树 [sw5]stp region-configuration [sw5-mst-region] region-name aa [sw5-mst-region] instance 1 vlan 2 [sw5-mst-region] instance 2 vlan 3 [sw5-mst-region] active region-configuration二、三层配置1sw3、sw4汇聚层sw1、sw2核心层SW1-SW2VLAN 102 --- 10.10.2.0/24 SW1-SW3VLAN 103 --- 10.10.3.0/24 SW1-SW4VLAN 104 --- 10.10.4.0/24 SW2-SW3VLAN 203 --- 10.20.3.0/24 SW2-SW4VLAN 204 --- 10.20.4.0/24 VRF配置信息 名称VRF RD100:1 RT100:1[sw3]vl b 103 203 [sw3]int g 0/0/1 [sw3-GigabitEthernet0/0/1]po li a [sw3-GigabitEthernet0/0/1]po de v 103 [sw3-GigabitEthernet0/0/1]undo stp enable [sw3-GigabitEthernet0/0/1]int g 0/0/2 [sw3-GigabitEthernet0/0/2]po li a [sw3-GigabitEthernet0/0/2]po de v 203 [sw3]int Vlanif 103 [sw3-Vlanif103]ip address 10.10.3.3 24 [sw3-Vlanif203]ip add 10.20.3.3 24 [sw3-Vlanif203]q [sw3]ospf 1 router-id 3.3.3.3 [sw3-ospf-1]a 0 [sw3-ospf-1-area-0.0.0.0]network 10.10.3.3 0.0.0.0 [sw3-ospf-1-area-0.0.0.0]network 10.10.2.3 0.0.0.0 [sw4]vlan b 104 204 [sw4]int g 0/0/1 [sw4-GigabitEthernet0/0/1]po li ac [sw4-GigabitEthernet0/0/1]po de v 204 [sw4-GigabitEthernet0/0/1]un stp en [sw4-GigabitEthernet0/0/2]po li ac [sw4-GigabitEthernet0/0/2]po de v 104 [sw4-GigabitEthernet0/0/2]un stp en [sw4-GigabitEthernet0/0/2]q [sw4-Vlanif104]ip add 10.10.4.4 24 [sw4-Vlanif204]ip add 10.20.4.4 24 [sw4-Vlanif204]q [sw4]ospf 1 router-id 4.4.4.4 [sw4-ospf-1]a 0 [sw4-ospf-1-area-0.0.0.0]network 10.10.4.4 0.0.0.0 [sw4-ospf-1-area-0.0.0.0]network 10.20.4.4 0.0.0.0sw1和sw2vlan [sw1]ip vpn-instance VRF [sw1-vpn-instance-VRF]route-distinguisher 100:1 [sw1-vpn-instance-VRF-af-ipv4]vpn-target 100:1 both [sw1-vpn-instance-VRF-af-ipv4]q [sw1-vpn-instance-VRF] [sw1-vpn-instance-VRF] [sw1-vpn-instance-VRF]q [sw1] [sw1] [sw1]vlan b [sw1]vlan batch 102 103 104 [sw1-GigabitEthernet0/0/5]po li ac [sw1-GigabitEthernet0/0/5]po de v 103 [sw1-GigabitEthernet0/0/5]un stp en [sw1-GigabitEthernet0/0/5]q [sw1]int g 0/0/6 [sw1-GigabitEthernet0/0/6]po li ac [sw1-GigabitEthernet0/0/6]po de v 104 [sw1-GigabitEthernet0/0/6]un stp en [sw1-GigabitEthernet0/0/6]q [sw1]int g 0/0/4 [sw1-GigabitEthernet0/0/4]po li t [sw1-GigabitEthernet0/0/4]po t a v 102 [sw1-GigabitEthernet0/0/4]un po t a v 1 [sw1-GigabitEthernet0/0/4]un stp en [sw1-GigabitEthernet0/0/4]q [sw2]ip vpn-instance VRF [sw2-vpn-instance-VRF]ro [sw2-vpn-instance-VRF]route [sw2-vpn-instance-VRF]route-distinguisher 100:1 [sw2-vpn-instance-VRF-af-ipv4]q [sw2-vpn-instance-VRF]q [sw2]vlan batch 102 203 204 [sw2-GigabitEthernet0/0/5]un stp en [sw2-GigabitEthernet0/0/6]po li ac [sw2-GigabitEthernet0/0/6]po de v 203 [sw2-GigabitEthernet0/0/6]q [sw2]int g 0/0/4 [sw2-GigabitEthernet0/0/4]po li t [sw2-GigabitEthernet0/0/4]po t a v 102 [sw2-GigabitEthernet0/0/4]un po t a v 1 [sw2-GigabitEthernet0/0/4]un stp en [sw2-GigabitEthernet0/0/4]q sw1和sw2接口ip [sw1]int v 102 [sw1-Vlanif102] [sw1-Vlanif102]ip binding vpn-instance VRF 先绑定在写ip以免ip地址掉 [sw1-Vlanif102]ip add 10.10.2.1 24 [sw1-Vlanif102]q [sw1-Vlanif103]ip binding vpn-instance VRF [sw1-Vlanif103]ip add 10.10.3.1 24 [sw1-Vlanif103]int v 104 [sw1-Vlanif104]ip binding vpn-instance VRF [sw1-Vlanif104]ip ad 10.10.4.1 24 [sw2]int v 102 [sw2-Vlanif102] [sw2-Vlanif102]ip binding vpn-instance VRF [sw2-Vlanif102]ip address 10.10.2.2 24 [sw2-Vlanif102]int v 203 [sw2-Vlanif203]ip binding vpn-instance VRF [sw2-Vlanif203]ip add 10.20.3.2 24 [sw2-Vlanif203]int v 204 [sw2-Vlanif204]ip binding vpn-instance VRF [sw2-Vlanif204]ip add 10.20.4.2 24 这里可以测试他们的连通性路由 [sw1]ospf 1 router-id 1.1.1.1 vpn-instance VRF [sw1-ospf-1]a 0 [sw1-ospf-1-area-0.0.0.0]network 10.10.2.1 0.0.0.0 [sw1-ospf-1-area-0.0.0.0]network 10.10.3.1 0.0.0.0 [sw1-ospf-1-area-0.0.0.0]network 10.10.4.1 0.0.0.0 [sw2]ospf 1 router-id 2.2.2.2 vpn-instance VRF [sw2-ospf-1] [sw2-ospf-1]a 0 [sw2-ospf-1-area-0.0.0.0]network 10.10.2.2 0.0.0.0 EventLoadingDone, NeighborPreviousStateLoading, NeighborCurrentStateFull) [sw2-ospf-1-area-0.0.0.0]network 10.20.3.2 0.0.0.0 [sw2-ospf-1-area-0.0.0.0]network 10.20.4.2 0.0.0.0 修改cost值 [sw3]int v 203 [sw3-Vlanif203]ospf cost 5 [sw4]int v 104 [sw4-Vlanif104]ospf cost 5 [sw4-Vlanif104]q 1和2 [sw4]ip ip-prefix aa permit 192.168.2.0 24 [sw4]ip ip-prefix [sw4]ip ip-prefix bb permit 192.168.3.0 24 [sw4]route-policy aa permit node 10 [sw4-route-policy]if-match ip-prefix aa [sw4-route-policy]apply cost 5 [sw4]route-policy aa permit node 20 [sw4-route-policy]if-match ip-prefix bb [sw4-ospf-1]import-route direct route-policy aa [sw3]ip ip-prefix aa permit 192.168.3.0 24 [sw3]ip ip-prefix bb permit 192.168.4.0 24 [sw3]ip ip-prefix bb permit 192.168.2.0 24 [sw3]route-policy aa permit node 10 [sw3-route-policy]apply cost 5 [sw3]route-policy aa permit node 20 [sw3-route-policy]if-match ip-prefix bb [sw3]ospf [sw3-ospf-1]import-route direct route-policy aa 三、三层配置fwVRRP备份组1 --- VRRP备份组5 VRRP备份组2 --- VRRP备份组6 --- 402 VRRP备份组3 --- VRRP备份组7 --- 403 VRRP备份组4 --- VRRP备份组8 --- 404 VRRP备份组1VRF使用SW1为主SW2为备 VLAN 401 --- 10.40.1.0/24 SW110.40.1.1/24 SW210.40.1.2/24 虚拟IP10.40.1.100 VRRP备份组5FW使用FW1为主FW2为备 VLAN 401 --- 10.40.1.0/24 FW1:10.40.1.10/24 FW2:10.40.1.20/24 虚拟IP10.40.1.200sw1: sw1]vlan b 401 402 [sw1-GigabitEthernet0/0/3]po li t [sw1-GigabitEthernet0/0/3]po t a v 401 402 [sw1-GigabitEthernet0/0/3]q [sw1]in g 0/0/4 [sw1-GigabitEthernet0/0/4]po li t [sw1-GigabitEthernet0/0/4]po t a v 401 402 [sw1-GigabitEthernet0/0/4]q [sw1-Vlanif401]ip binding vpn-instance VRF [sw1-Vlanif401]ip add 10.40.1.1 24 [sw1-Vlanif401]vrrp vrid 1 [sw1-Vlanif401]vrrp vrid 1 virtual-ip 10.40.1.100 [sw1-Vlanif401]vrrp vrid 1 priority 120 [sw1-Vlanif401]vrrp vrid 1 preempt-mode timer delay 60 [sw1-Vlanif401]vrrp vrid 1 track interface GigabitEthernet 0/0/3 [sw1-Vlanif401]q [sw1-Vlanif402]ip binding vpn-instance VRF [sw1-Vlanif402]ip address 10.40.2.1 24 [sw1-Vlanif402]vrrp vrid 2 sw2: [sw2]v b 401 402 [sw2]int g 0/0/3 [sw2-GigabitEthernet0/0/3]po li t [sw2-GigabitEthernet0/0/3]po t a v 401 402 [sw2]int g 0/0/4 [sw2-GigabitEthernet0/0/4]po li t [sw2-GigabitEthernet0/0/4] po t a v 401 402 [sw2-GigabitEthernet0/0/4]q [sw2-Vlanif401]ip binding vpn-instance VRF [sw2-Vlanif401]ip address 10.40.1.2 24 [sw2-Vlanif401]vrrp vrid 1 virtual-ip 10.40.1.100 [sw2-Vlanif402]ip binding vpn-instance VRF [sw2-Vlanif402]ip add 10.40.2.2 24 [sw2-Vlanif402]vrrp vrid 2 virtual-ip 10.40.2.100 [sw2-Vlanif402]vrrp vrid 2 priority 120 [sw2-Vlanif402]vrrp vrid 2 preempt-mode timer delay 60 [sw2-Vlanif402]vrrp vrid 2 track interface GigabitEthernet 0/0/3 reduced 30 fw配置 [FW1]vlan batch 401 t 404 [FW1]interface GigabitEthernet 1/0/0 [FW1-GigabitEthernet1/0/0]ip ad 10.10.10.1 30 [FW1-GigabitEthernet1/0/2]int g 1/0/2.401 [FW1-GigabitEthernet1/0/2.401]ip add 10.40.2.10 [FW1]int g 1/0/2.401 [FW1-GigabitEthernet1/0/2.401]ip add 10.40.2.10 24 [FW1-GigabitEthernet1/0/2.401]vlan-type dot1q 401 [FW1]int g 1/0/2.402 [FW1-GigabitEthernet1/0/2.402] ip add 10.40.1.10 24 [FW1-GigabitEthernet1/0/2.402]vlan-type dot1q 402 [FW1-GigabitEthernet1/0/2.402]q [FW1]int g 1/0/3 [FW1-GigabitEthernet1/0/3]int g 1/0/3.403 [FW1-GigabitEthernet1/0/3.403]ip add 10.40.3.10 24 [FW1-GigabitEthernet1/0/3.403]vlan-type dot1q 403 [FW1-GigabitEthernet1/0/3.403]int g 1/0/3.404. [FW1-GigabitEthernet1/0/3.404]ip add 10.40.4.10 24 [FW1-GigabitEthernet1/0/3.404]vlan-type dot1q 404 [FW1]firewall zone trust [FW1-zone-trust]add int g 1/0/2.401 [FW1-zone-trust]add int g 1/0/2.402 [FW1-zone-trust]q [FW1]firewall zone untrust [FW1-zone-untrust]add int g 1/0/3.403 [FW1-zone-untrust]add int g 1/0/3.404 [FW1-GigabitEthernet1/0/0]q [FW1]firewall zone dmz [FW1-zone-dmz]add int g 1/0/0 [FW1-zone-dmz]q [FW1]q [FW2]vlan b 401 to 404 [FW2]int g1/0/0 [FW2-GigabitEthernet1/0/0]ip add 10.10.10.2 30 [FW2-GigabitEthernet1/0/0]q [FW2]int g 1/0/2.401 [FW2-GigabitEthernet1/0/2.401]vlan-type dot1q 401 [FW2-GigabitEthernet1/0/2.401]int g 1/0/2.402 [FW2-GigabitEthernet1/0/2.402]ip add 10.40.2.20 24 [FW2-GigabitEthernet1/0/2.402]vlan-type dot1q 402 [FW2-GigabitEthernet1/0/2.402]int g 1/0/3.403 [FW2-GigabitEthernet1/0/3.403]ip add 10.40.3.20 24 [FW2-GigabitEthernet1/0/3.403]vlan-type dot1q 403 [FW2-GigabitEthernet1/0/3.403]int g 1/0/3.404 [FW2-GigabitEthernet1/0/3.404]ip add 10.40.4.20 24 [FW2-GigabitEthernet1/0/3.404]vlan-type dot1q 404 [FW2-GigabitEthernet1/0/3.404]q [FW2]firewall zone trust [FW2-zone-trust]add int g1/0/2.401 [FW2-zone-trust]add int g1/0/2.402 [FW2-zone-trust]q [FW2]firewall zone untrust [FW2-zone-untrust]add interface g 1/0/3.403 [FW2-zone-untrust]add interface g 1/0/3.404 [FW2-zone-untrust]q [FW2]firewall zone dmz [FW2-zone-dmz]add int g 1/0/0 [FW2-zone-dmz]q [FW2] 双击热备 [FW1-GigabitEthernet1/0/2.401]vrrp vrid 5 virtual-ip 10.40.2.200 active [FW1-GigabitEthernet1/0/2.401]q [FW1]int g 1/0/2.402 [FW1-GigabitEthernet1/0/2.402]vrrp vrid 6 virtual-ip 10.40.1.200 standby [FW1-GigabitEthernet1/0/2.402]q [FW1]int g 1/0/3.403 [FW1-GigabitEthernet1/0/3.403]vrrp vrid 7 virtual-ip 10.40.3.200 ac [FW1-GigabitEthernet1/0/3.403]q [FW1]int g 1/0/3.404 [FW1-GigabitEthernet1/0/3.404]vrrp vrid 8 virtual-ip 10.40.4.200 standby [FW1-GigabitEthernet1/0/3.404]q [FW1]hrp mirror session enable [FW1]hrp interface GigabitEthernet 1/0/0 remote 10.10.10.2 [FW1]hrp enable [FW2-GigabitEthernet1/0/2.401]vrrp vrid 5 virtual-ip 10.40.1.200 s [FW2-GigabitEthernet1/0/2.401]int g 1/0/2.402 [FW2-GigabitEthernet1/0/2.402]vrrp vrid 6 virtual-ip 10.40.2.200 active [FW2-GigabitEthernet1/0/2.402]int g 1/0/3.403 [FW2-GigabitEthernet1/0/3.403]vrrp vrid 7 virtual-ip 10.40.3.200 standby [FW2-GigabitEthernet1/0/3.404]vrrp vrid 8 virtual-ip 10.40.4.200 active [FW2-GigabitEthernet1/0/3.404]q [FW2]hrp interface g 1/0/0 remote 10.10.10.1 [FW2]hrp enable 路由 HRP_M[FW1]ip route-static 0.0.0.0 0 10.40.3.100 HRP_M[FW1]ip route-static 0.0.0.0 0 10.40.4.100 preference 70 HRP_S[FW2]ip route-static 0.0.0.0 0 10.40.4.100 HRP_S[FW2]ip route-static 0.0.0.0 0 10.40.3.100 preference 70 HRP_S[FW2]ip route-static 192.168.0.0 16 10.40.2.100 HRP_S[FW2]ip route-static 192.168.0.0 16 10.40.1.100 preference 70 安全策略 HRP_M[FW1]security-policy (B) HRP_M[FW1-policy-security]rule name t_to_un (B) HRP_M[FW1-policy-security-rule-t_to_un]source-zone trust (B) HRP_M[FW1-policy-security-rule-t_to_un]destination-zone HRP_M[FW1-policy-security-rule-t_to_un]destination-zone untrust (B) HRP_M[FW1-policy-security-rule-t_to_un]source-address 192.168.0.0 16 (B) HRP_M[FW1-policy-security-rule-t_to_un]action permit (B) HRP_M[FW1-policy-security-rule-t_to_un]q HRP_M[FW1-policy-security]q sw1和sw2补充 [sw1]vlan batch 403 404 [sw1]int g 0/0/1 [sw1-GigabitEthernet0/0/1]po li t [sw1-GigabitEthernet0/0/1]po t a v 403 404 [sw1-GigabitEthernet0/0/2]po li t [sw1-GigabitEthernet0/0/2]po t a v 403 404 [sw1-GigabitEthernet0/0/2]int v 403 [sw1-Vlanif403]ip add 10.40.3.1 24 [sw1-Vlanif403]vrrp vrid 3 virtual-ip 10.40.3.100 [sw1-Vlanif403]vrrp vrid 3 priority 120 [sw1-Vlanif403]vrrp vrid 3 preempt-mode timer delay 60 [sw1-Vlanif403]vrrp vrid 3 track interface GigabitEthernet 0/0/1 reduced 30 [sw1-Vlanif403]q [sw1-Vlanif404]ip add 10.40.4.1 24 [sw1-Vlanif404]vrrp vrid 4 virtual-ip 10.40.4.100 [sw1-Vlanif404]q [sw2]vl b 403 404 [sw2]int g 0/0/1 [sw2-GigabitEthernet0/0/1]po li t [sw2-GigabitEthernet0/0/1]po t a v 403 404 [sw2-GigabitEthernet0/0/2]po li t [sw2-GigabitEthernet0/0/2]po t a v 403 404 [sw2-Vlanif403]ip add 10.40.3.2 24 [sw2-Vlanif403]vrrp vrid 3 virtual-ip 10.40.3.100 [sw2-Vlanif403]int v 404 [sw2-Vlanif404]ip address 10.40.4.2 24 [sw2-Vlanif404]vrrp vrid 4 virtual-ip 10.40.4.100 [sw2-Vlanif404]vrrp vrid 4 priority 120 [sw2-Vlanif404]vrrp vrid 4 preempt-mode timer delay 60 [sw2-Vlanif404]vrrp vrid 4 track interface GigabitEthernet 0/0/1 reduced 30 sw1和sw2路由 [sw1]ip route-static vpn-instance VRF 0.0.0.0 0 10.40.2.200 [sw1]ip route-static vpn-instance VRF 0.0.0.0 0 10.40.2.200 preference 70 [sw2]ip route-static vpn-instance VRF 0.0.0.0 0 10.40.2.200 [sw2]ip route-static vpn-instance VRF 0.0.0.0 0 10.40.1.200 preference 70 [sw1]ip route-static 192.168.0.0 16 10.40.3.200 [sw1]ip route-static 192.168.0.0 16 10.40.4.200 preference 70 [sw2]ip route-static 192.168.0.0 16 10.40.4.200 [sw2]ip route-static 192.168.0.0 16 10.40.3.200 preference 70 四、三层设备路由器的配置SW1-SW2VLAN 201 --- 10.20.1.0/24 SW1-R5VLAN 105 --- 10.10.5.0/24 SW2-R6VLAN 206 --- 10.20.6.0/24 R5-R610.56.0.0/24sw1和sw2补充 [sw1]vlan batch 201 105 [sw1-GigabitEthernet0/0/7]po li ac [sw1-GigabitEthernet0/0/7]po de v 105 [sw1-GigabitEthernet0/0/7]undo stp en [sw1-GigabitEthernet0/0/7]int g 0/0/2 [sw1-GigabitEthernet0/0/2]po li t [sw1-GigabitEthernet0/0/2]po t a v 201 [sw1-GigabitEthernet0/0/2]un stp en [sw1-GigabitEthernet0/0/2]q [sw1]int v 105 [sw1-Vlanif105]ip add 10.10.5.1 24 [sw1-Vlanif201]ip add 10.20.1.1 24 [sw1-Vlanif201]q [sw1]ospf 2 router-id 1.1.1.1 [sw1-ospf-2]a 0 [sw1-ospf-2-area-0.0.0.0]network 10.10.5.1 0.0.0.0 [sw1-ospf-2-area-0.0.0.0]network 10.20.1.1 0.0.0.0 [sw1-ospf-2]q [sw2]vla b 201 204 [sw2]vlan 206 [sw2]int g 0/0/7 [sw2-GigabitEthernet0/0/7]po lin t [sw2-GigabitEthernet0/0/7]po t a v 206 [sw2-GigabitEthernet0/0/7]int g 0/0/2 [sw2-GigabitEthernet0/0/2]po li t [sw2-GigabitEthernet0/0/2]po t a v 201 [sw2-GigabitEthernet0/0/2]undo stp en [sw2-Vlanif201]ip add 10.20.1.2 24 [sw2-Vlanif206]ip address 10.20.6.2 24 [sw2]ospf 2 router-id 2.2.2.2 [sw2-ospf-2]a 0 [sw2-ospf-2-area-0.0.0.0]network 10.20.6.2 0.0.0.0 r6 [r6]int g 0/0/0 [r6-GigabitEthernet0/0/0]ip add [r6-GigabitEthernet0/0/0]ip address 10.20.6.6 24 Aug 11 2026 00:39:17-08:00 r6 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP on the interface GigabitEthernet0/0/0 has entered the UP state. [r6-GigabitEthernet0/0/0]int g 0/0/1 [r6-GigabitEthernet0/0/1]ip add 10.56.0.6 24 Aug 11 2026 00:39:40-08:00 r6 %%01IFNET/4/LINK_STATE(l)[1]:The line protocol IP on the interface GigabitEthernet0/0/1 has entered the UP state. [r6-GigabitEthernet0/0/1]q [r6]os [r6]ospf 1 ro [r6]ospf 1 router-id 6.6.6.6 [r6-ospf-1]a 0 [r6-ospf-1-area-0.0.0.0]network 10.56.0.6 0.0.0.0 [r6-ospf-1-area-0.0.0.0]network 10.20.6.6 0.0.0.0 r5 [r5]int g 0/0/0 [r5-GigabitEthernet0/0/0]ip add [r5-GigabitEthernet0/0/0]ip address 10.10.5.5 24 Aug 11 2026 00:37:29-08:00 r5 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP on the interface GigabitEthernet0/0/0 has entered the UP state. [r5-GigabitEthernet0/0/0] [r5-GigabitEthernet0/0/0]int g 0/0/1 [r5-GigabitEthernet0/0/1]ip add 10.56.0.5 24 [r5-GigabitEthernet0/0/1]q [r5]ospf 1 router-id 5.5.5.5 [r5-ospf-1]a 0 [r5-ospf-1-area-0.0.0.0]network 10.56.0.5 0.0.0.0 [r5-ospf-1-area-0.0.0.0]network 10.10.5.5 0.0.0.0 [r5]int g 0/0/2 [r5]ip route-static 0.0.0.0 0 12.0.0.100 [r5-ospf-1]default-route-advertise [r5-ospf-1]q [r5]acl 2000 [r5-acl-basic-2000]rule permit source 192.168.0.0 0.0.255.255 [r5-acl-basic-2000]q [r5]int g 0/0/2 [r5-GigabitEthernet0/0/2]nat outbound 2000 [r5-GigabitEthernet0/0/2]q [r5] [r6]int g 0/0/2 [r6-GigabitEthernet0/0/2]ip address 13.0.0.6 24 [r6-GigabitEthernet0/0/2]q [r6]ip route-static 0.0.0.0 0 13.0.0.100 [r6]ospf 1 [r6-ospf-1]default-route-advertise [r6-ospf-1]q [r6]acl 2000 [r6-acl-basic-2000]rule permit source 192.168.0.0 0.0.255.255 [r6-acl-basic-2000]q [r6]int g 0/0/2 [r6-GigabitEthernet0/0/2]nat outbound 2000 [r6-GigabitEthernet0/0/2]q isp [ISP]int g 0/0/0 [ISP-GigabitEthernet0/0/0]ip ad 12.0.0.100 24 [ISP]int LoopBack 0 [ISP-LoopBack0]ip address 100.1.1.1 24 五、测试 防火墙旁挂组网双击热备
一、分析过程图二、接入层的配置[sw3]vlan b 2 3 [sw3-GigabitEthernet0/0/3]po li t [sw3-GigabitEthernet0/0/3]po t a v 2 3 [sw3-GigabitEthernet0/0/4]po li t [sw3-GigabitEthernet0/0/4]po t a v 2 3 在sw3上运行stp [sw3]stp region-configuration [sw3-mst-region]region-name aa [sw3-mst-region]instance 1 v 2 [sw3-mst-region]instance 2 v 3 [sw3-mst-region]active region-configuration 让1作为主根2作为备份根 [sw3]stp instance 1 root primary [sw3]stp instance 2 root secondary vrrp配置 [sw3]interface Vlanif 2 [sw3-Vlanif2]ip address 192.168.2.1 24 [sw3-Vlanif2]vrrp vrid 1 virtual-ip 192.168.2.254 [sw3-Vlanif2]vrrp vrid 1 priority 120 [sw3-Vlanif2]vrrp vrid 1 preempt-mode timer delay 20 [sw3-Vlanif2]vrrp vrid 1 track interface GigabitEthernet 0/0/1 reduced 15 监控 [sw3-Vlanif2]vrrp vrid 1 track interface GigabitEthernet 0/0/2 reduced 15 [sw3]interface Vlanif 3 备份 [sw3-Vlanif3]ip address 192.168.3.1 24 [sw3-Vlanif3]vrrp vrid 1 virtual-ip 192.168.3.254[sw4]vlan batch 2 3 [sw4-GigabitEthernet0/0/3]po li t [sw4-GigabitEthernet0/0/3]po t a v 2 3 [sw4-GigabitEthernet0/0/1]int g 0/0/4 [sw4-GigabitEthernet0/0/4]po lin t [sw4-GigabitEthernet0/0/4]po t a v 2 3 生成树预配置 [sw4]stp region-configuration [sw4-mst-region]region-name aa [sw4-mst-region]instance 1 v 2 [sw4-mst-region]instance 2 v 3 [sw4-mst-region]active region-configuration 实例1的备份根实例2的主根 [sw4]int Vlanif 2 [sw4-Vlanif2]ip address 192.168.2.2 24 [sw4-Vlanif2]vrrp vrid 1 virtual-ip 192.168.2.254 [sw4-Vlanif3]ip address 192.168.3.2 24 [sw4-Vlanif3]vrrp vrid 1 virtual-ip 192.168.3.254 [sw4-Vlanif3]vrrp vrid 1 priority 120 [sw4-Vlanif3]vrrp vrid 1 preempt-mode timer delay 20 [sw4-Vlanif3]vrrp vrid 1 track interface GigabitEthernet 0/0/1 reduced 15 [sw4-Vlanif3]vrrp vrid 1 track interface GigabitEthernet 0/0/2 reduced 15[sw5]vlan b 2 3 [sw5-GigabitEthernet0/0/3]po li ac. [sw5-GigabitEthernet0/0/3]po de v 2. [sw5-GigabitEthernet0/0/4]po lin ac [sw5-GigabitEthernet0/0/4]po de v 3 [sw5]int g 0/0/1 [sw5-GigabitEthernet0/0/1]po li t [sw5-GigabitEthernet0/0/1]po t a v 2 3 [sw5-GigabitEthernet0/0/1]int g 0/0/2 [sw5-GigabitEthernet0/0/2]po t a v 2 3 生成树 [sw5]stp region-configuration [sw5-mst-region] region-name aa [sw5-mst-region] instance 1 vlan 2 [sw5-mst-region] instance 2 vlan 3 [sw5-mst-region] active region-configuration二、三层配置1sw3、sw4汇聚层sw1、sw2核心层SW1-SW2VLAN 102 --- 10.10.2.0/24 SW1-SW3VLAN 103 --- 10.10.3.0/24 SW1-SW4VLAN 104 --- 10.10.4.0/24 SW2-SW3VLAN 203 --- 10.20.3.0/24 SW2-SW4VLAN 204 --- 10.20.4.0/24 VRF配置信息 名称VRF RD100:1 RT100:1[sw3]vl b 103 203 [sw3]int g 0/0/1 [sw3-GigabitEthernet0/0/1]po li a [sw3-GigabitEthernet0/0/1]po de v 103 [sw3-GigabitEthernet0/0/1]undo stp enable [sw3-GigabitEthernet0/0/1]int g 0/0/2 [sw3-GigabitEthernet0/0/2]po li a [sw3-GigabitEthernet0/0/2]po de v 203 [sw3]int Vlanif 103 [sw3-Vlanif103]ip address 10.10.3.3 24 [sw3-Vlanif203]ip add 10.20.3.3 24 [sw3-Vlanif203]q [sw3]ospf 1 router-id 3.3.3.3 [sw3-ospf-1]a 0 [sw3-ospf-1-area-0.0.0.0]network 10.10.3.3 0.0.0.0 [sw3-ospf-1-area-0.0.0.0]network 10.10.2.3 0.0.0.0 [sw4]vlan b 104 204 [sw4]int g 0/0/1 [sw4-GigabitEthernet0/0/1]po li ac [sw4-GigabitEthernet0/0/1]po de v 204 [sw4-GigabitEthernet0/0/1]un stp en [sw4-GigabitEthernet0/0/2]po li ac [sw4-GigabitEthernet0/0/2]po de v 104 [sw4-GigabitEthernet0/0/2]un stp en [sw4-GigabitEthernet0/0/2]q [sw4-Vlanif104]ip add 10.10.4.4 24 [sw4-Vlanif204]ip add 10.20.4.4 24 [sw4-Vlanif204]q [sw4]ospf 1 router-id 4.4.4.4 [sw4-ospf-1]a 0 [sw4-ospf-1-area-0.0.0.0]network 10.10.4.4 0.0.0.0 [sw4-ospf-1-area-0.0.0.0]network 10.20.4.4 0.0.0.0sw1和sw2vlan [sw1]ip vpn-instance VRF [sw1-vpn-instance-VRF]route-distinguisher 100:1 [sw1-vpn-instance-VRF-af-ipv4]vpn-target 100:1 both [sw1-vpn-instance-VRF-af-ipv4]q [sw1-vpn-instance-VRF] [sw1-vpn-instance-VRF] [sw1-vpn-instance-VRF]q [sw1] [sw1] [sw1]vlan b [sw1]vlan batch 102 103 104 [sw1-GigabitEthernet0/0/5]po li ac [sw1-GigabitEthernet0/0/5]po de v 103 [sw1-GigabitEthernet0/0/5]un stp en [sw1-GigabitEthernet0/0/5]q [sw1]int g 0/0/6 [sw1-GigabitEthernet0/0/6]po li ac [sw1-GigabitEthernet0/0/6]po de v 104 [sw1-GigabitEthernet0/0/6]un stp en [sw1-GigabitEthernet0/0/6]q [sw1]int g 0/0/4 [sw1-GigabitEthernet0/0/4]po li t [sw1-GigabitEthernet0/0/4]po t a v 102 [sw1-GigabitEthernet0/0/4]un po t a v 1 [sw1-GigabitEthernet0/0/4]un stp en [sw1-GigabitEthernet0/0/4]q [sw2]ip vpn-instance VRF [sw2-vpn-instance-VRF]ro [sw2-vpn-instance-VRF]route [sw2-vpn-instance-VRF]route-distinguisher 100:1 [sw2-vpn-instance-VRF-af-ipv4]q [sw2-vpn-instance-VRF]q [sw2]vlan batch 102 203 204 [sw2-GigabitEthernet0/0/5]un stp en [sw2-GigabitEthernet0/0/6]po li ac [sw2-GigabitEthernet0/0/6]po de v 203 [sw2-GigabitEthernet0/0/6]q [sw2]int g 0/0/4 [sw2-GigabitEthernet0/0/4]po li t [sw2-GigabitEthernet0/0/4]po t a v 102 [sw2-GigabitEthernet0/0/4]un po t a v 1 [sw2-GigabitEthernet0/0/4]un stp en [sw2-GigabitEthernet0/0/4]q sw1和sw2接口ip [sw1]int v 102 [sw1-Vlanif102] [sw1-Vlanif102]ip binding vpn-instance VRF 先绑定在写ip以免ip地址掉 [sw1-Vlanif102]ip add 10.10.2.1 24 [sw1-Vlanif102]q [sw1-Vlanif103]ip binding vpn-instance VRF [sw1-Vlanif103]ip add 10.10.3.1 24 [sw1-Vlanif103]int v 104 [sw1-Vlanif104]ip binding vpn-instance VRF [sw1-Vlanif104]ip ad 10.10.4.1 24 [sw2]int v 102 [sw2-Vlanif102] [sw2-Vlanif102]ip binding vpn-instance VRF [sw2-Vlanif102]ip address 10.10.2.2 24 [sw2-Vlanif102]int v 203 [sw2-Vlanif203]ip binding vpn-instance VRF [sw2-Vlanif203]ip add 10.20.3.2 24 [sw2-Vlanif203]int v 204 [sw2-Vlanif204]ip binding vpn-instance VRF [sw2-Vlanif204]ip add 10.20.4.2 24 这里可以测试他们的连通性路由 [sw1]ospf 1 router-id 1.1.1.1 vpn-instance VRF [sw1-ospf-1]a 0 [sw1-ospf-1-area-0.0.0.0]network 10.10.2.1 0.0.0.0 [sw1-ospf-1-area-0.0.0.0]network 10.10.3.1 0.0.0.0 [sw1-ospf-1-area-0.0.0.0]network 10.10.4.1 0.0.0.0 [sw2]ospf 1 router-id 2.2.2.2 vpn-instance VRF [sw2-ospf-1] [sw2-ospf-1]a 0 [sw2-ospf-1-area-0.0.0.0]network 10.10.2.2 0.0.0.0 EventLoadingDone, NeighborPreviousStateLoading, NeighborCurrentStateFull) [sw2-ospf-1-area-0.0.0.0]network 10.20.3.2 0.0.0.0 [sw2-ospf-1-area-0.0.0.0]network 10.20.4.2 0.0.0.0 修改cost值 [sw3]int v 203 [sw3-Vlanif203]ospf cost 5 [sw4]int v 104 [sw4-Vlanif104]ospf cost 5 [sw4-Vlanif104]q 1和2 [sw4]ip ip-prefix aa permit 192.168.2.0 24 [sw4]ip ip-prefix [sw4]ip ip-prefix bb permit 192.168.3.0 24 [sw4]route-policy aa permit node 10 [sw4-route-policy]if-match ip-prefix aa [sw4-route-policy]apply cost 5 [sw4]route-policy aa permit node 20 [sw4-route-policy]if-match ip-prefix bb [sw4-ospf-1]import-route direct route-policy aa [sw3]ip ip-prefix aa permit 192.168.3.0 24 [sw3]ip ip-prefix bb permit 192.168.4.0 24 [sw3]ip ip-prefix bb permit 192.168.2.0 24 [sw3]route-policy aa permit node 10 [sw3-route-policy]apply cost 5 [sw3]route-policy aa permit node 20 [sw3-route-policy]if-match ip-prefix bb [sw3]ospf [sw3-ospf-1]import-route direct route-policy aa 三、三层配置fwVRRP备份组1 --- VRRP备份组5 VRRP备份组2 --- VRRP备份组6 --- 402 VRRP备份组3 --- VRRP备份组7 --- 403 VRRP备份组4 --- VRRP备份组8 --- 404 VRRP备份组1VRF使用SW1为主SW2为备 VLAN 401 --- 10.40.1.0/24 SW110.40.1.1/24 SW210.40.1.2/24 虚拟IP10.40.1.100 VRRP备份组5FW使用FW1为主FW2为备 VLAN 401 --- 10.40.1.0/24 FW1:10.40.1.10/24 FW2:10.40.1.20/24 虚拟IP10.40.1.200sw1: sw1]vlan b 401 402 [sw1-GigabitEthernet0/0/3]po li t [sw1-GigabitEthernet0/0/3]po t a v 401 402 [sw1-GigabitEthernet0/0/3]q [sw1]in g 0/0/4 [sw1-GigabitEthernet0/0/4]po li t [sw1-GigabitEthernet0/0/4]po t a v 401 402 [sw1-GigabitEthernet0/0/4]q [sw1-Vlanif401]ip binding vpn-instance VRF [sw1-Vlanif401]ip add 10.40.1.1 24 [sw1-Vlanif401]vrrp vrid 1 [sw1-Vlanif401]vrrp vrid 1 virtual-ip 10.40.1.100 [sw1-Vlanif401]vrrp vrid 1 priority 120 [sw1-Vlanif401]vrrp vrid 1 preempt-mode timer delay 60 [sw1-Vlanif401]vrrp vrid 1 track interface GigabitEthernet 0/0/3 [sw1-Vlanif401]q [sw1-Vlanif402]ip binding vpn-instance VRF [sw1-Vlanif402]ip address 10.40.2.1 24 [sw1-Vlanif402]vrrp vrid 2 sw2: [sw2]v b 401 402 [sw2]int g 0/0/3 [sw2-GigabitEthernet0/0/3]po li t [sw2-GigabitEthernet0/0/3]po t a v 401 402 [sw2]int g 0/0/4 [sw2-GigabitEthernet0/0/4]po li t [sw2-GigabitEthernet0/0/4] po t a v 401 402 [sw2-GigabitEthernet0/0/4]q [sw2-Vlanif401]ip binding vpn-instance VRF [sw2-Vlanif401]ip address 10.40.1.2 24 [sw2-Vlanif401]vrrp vrid 1 virtual-ip 10.40.1.100 [sw2-Vlanif402]ip binding vpn-instance VRF [sw2-Vlanif402]ip add 10.40.2.2 24 [sw2-Vlanif402]vrrp vrid 2 virtual-ip 10.40.2.100 [sw2-Vlanif402]vrrp vrid 2 priority 120 [sw2-Vlanif402]vrrp vrid 2 preempt-mode timer delay 60 [sw2-Vlanif402]vrrp vrid 2 track interface GigabitEthernet 0/0/3 reduced 30 fw配置 [FW1]vlan batch 401 t 404 [FW1]interface GigabitEthernet 1/0/0 [FW1-GigabitEthernet1/0/0]ip ad 10.10.10.1 30 [FW1-GigabitEthernet1/0/2]int g 1/0/2.401 [FW1-GigabitEthernet1/0/2.401]ip add 10.40.2.10 [FW1]int g 1/0/2.401 [FW1-GigabitEthernet1/0/2.401]ip add 10.40.2.10 24 [FW1-GigabitEthernet1/0/2.401]vlan-type dot1q 401 [FW1]int g 1/0/2.402 [FW1-GigabitEthernet1/0/2.402] ip add 10.40.1.10 24 [FW1-GigabitEthernet1/0/2.402]vlan-type dot1q 402 [FW1-GigabitEthernet1/0/2.402]q [FW1]int g 1/0/3 [FW1-GigabitEthernet1/0/3]int g 1/0/3.403 [FW1-GigabitEthernet1/0/3.403]ip add 10.40.3.10 24 [FW1-GigabitEthernet1/0/3.403]vlan-type dot1q 403 [FW1-GigabitEthernet1/0/3.403]int g 1/0/3.404. [FW1-GigabitEthernet1/0/3.404]ip add 10.40.4.10 24 [FW1-GigabitEthernet1/0/3.404]vlan-type dot1q 404 [FW1]firewall zone trust [FW1-zone-trust]add int g 1/0/2.401 [FW1-zone-trust]add int g 1/0/2.402 [FW1-zone-trust]q [FW1]firewall zone untrust [FW1-zone-untrust]add int g 1/0/3.403 [FW1-zone-untrust]add int g 1/0/3.404 [FW1-GigabitEthernet1/0/0]q [FW1]firewall zone dmz [FW1-zone-dmz]add int g 1/0/0 [FW1-zone-dmz]q [FW1]q [FW2]vlan b 401 to 404 [FW2]int g1/0/0 [FW2-GigabitEthernet1/0/0]ip add 10.10.10.2 30 [FW2-GigabitEthernet1/0/0]q [FW2]int g 1/0/2.401 [FW2-GigabitEthernet1/0/2.401]vlan-type dot1q 401 [FW2-GigabitEthernet1/0/2.401]int g 1/0/2.402 [FW2-GigabitEthernet1/0/2.402]ip add 10.40.2.20 24 [FW2-GigabitEthernet1/0/2.402]vlan-type dot1q 402 [FW2-GigabitEthernet1/0/2.402]int g 1/0/3.403 [FW2-GigabitEthernet1/0/3.403]ip add 10.40.3.20 24 [FW2-GigabitEthernet1/0/3.403]vlan-type dot1q 403 [FW2-GigabitEthernet1/0/3.403]int g 1/0/3.404 [FW2-GigabitEthernet1/0/3.404]ip add 10.40.4.20 24 [FW2-GigabitEthernet1/0/3.404]vlan-type dot1q 404 [FW2-GigabitEthernet1/0/3.404]q [FW2]firewall zone trust [FW2-zone-trust]add int g1/0/2.401 [FW2-zone-trust]add int g1/0/2.402 [FW2-zone-trust]q [FW2]firewall zone untrust [FW2-zone-untrust]add interface g 1/0/3.403 [FW2-zone-untrust]add interface g 1/0/3.404 [FW2-zone-untrust]q [FW2]firewall zone dmz [FW2-zone-dmz]add int g 1/0/0 [FW2-zone-dmz]q [FW2] 双击热备 [FW1-GigabitEthernet1/0/2.401]vrrp vrid 5 virtual-ip 10.40.2.200 active [FW1-GigabitEthernet1/0/2.401]q [FW1]int g 1/0/2.402 [FW1-GigabitEthernet1/0/2.402]vrrp vrid 6 virtual-ip 10.40.1.200 standby [FW1-GigabitEthernet1/0/2.402]q [FW1]int g 1/0/3.403 [FW1-GigabitEthernet1/0/3.403]vrrp vrid 7 virtual-ip 10.40.3.200 ac [FW1-GigabitEthernet1/0/3.403]q [FW1]int g 1/0/3.404 [FW1-GigabitEthernet1/0/3.404]vrrp vrid 8 virtual-ip 10.40.4.200 standby [FW1-GigabitEthernet1/0/3.404]q [FW1]hrp mirror session enable [FW1]hrp interface GigabitEthernet 1/0/0 remote 10.10.10.2 [FW1]hrp enable [FW2-GigabitEthernet1/0/2.401]vrrp vrid 5 virtual-ip 10.40.1.200 s [FW2-GigabitEthernet1/0/2.401]int g 1/0/2.402 [FW2-GigabitEthernet1/0/2.402]vrrp vrid 6 virtual-ip 10.40.2.200 active [FW2-GigabitEthernet1/0/2.402]int g 1/0/3.403 [FW2-GigabitEthernet1/0/3.403]vrrp vrid 7 virtual-ip 10.40.3.200 standby [FW2-GigabitEthernet1/0/3.404]vrrp vrid 8 virtual-ip 10.40.4.200 active [FW2-GigabitEthernet1/0/3.404]q [FW2]hrp interface g 1/0/0 remote 10.10.10.1 [FW2]hrp enable 路由 HRP_M[FW1]ip route-static 0.0.0.0 0 10.40.3.100 HRP_M[FW1]ip route-static 0.0.0.0 0 10.40.4.100 preference 70 HRP_S[FW2]ip route-static 0.0.0.0 0 10.40.4.100 HRP_S[FW2]ip route-static 0.0.0.0 0 10.40.3.100 preference 70 HRP_S[FW2]ip route-static 192.168.0.0 16 10.40.2.100 HRP_S[FW2]ip route-static 192.168.0.0 16 10.40.1.100 preference 70 安全策略 HRP_M[FW1]security-policy (B) HRP_M[FW1-policy-security]rule name t_to_un (B) HRP_M[FW1-policy-security-rule-t_to_un]source-zone trust (B) HRP_M[FW1-policy-security-rule-t_to_un]destination-zone HRP_M[FW1-policy-security-rule-t_to_un]destination-zone untrust (B) HRP_M[FW1-policy-security-rule-t_to_un]source-address 192.168.0.0 16 (B) HRP_M[FW1-policy-security-rule-t_to_un]action permit (B) HRP_M[FW1-policy-security-rule-t_to_un]q HRP_M[FW1-policy-security]q sw1和sw2补充 [sw1]vlan batch 403 404 [sw1]int g 0/0/1 [sw1-GigabitEthernet0/0/1]po li t [sw1-GigabitEthernet0/0/1]po t a v 403 404 [sw1-GigabitEthernet0/0/2]po li t [sw1-GigabitEthernet0/0/2]po t a v 403 404 [sw1-GigabitEthernet0/0/2]int v 403 [sw1-Vlanif403]ip add 10.40.3.1 24 [sw1-Vlanif403]vrrp vrid 3 virtual-ip 10.40.3.100 [sw1-Vlanif403]vrrp vrid 3 priority 120 [sw1-Vlanif403]vrrp vrid 3 preempt-mode timer delay 60 [sw1-Vlanif403]vrrp vrid 3 track interface GigabitEthernet 0/0/1 reduced 30 [sw1-Vlanif403]q [sw1-Vlanif404]ip add 10.40.4.1 24 [sw1-Vlanif404]vrrp vrid 4 virtual-ip 10.40.4.100 [sw1-Vlanif404]q [sw2]vl b 403 404 [sw2]int g 0/0/1 [sw2-GigabitEthernet0/0/1]po li t [sw2-GigabitEthernet0/0/1]po t a v 403 404 [sw2-GigabitEthernet0/0/2]po li t [sw2-GigabitEthernet0/0/2]po t a v 403 404 [sw2-Vlanif403]ip add 10.40.3.2 24 [sw2-Vlanif403]vrrp vrid 3 virtual-ip 10.40.3.100 [sw2-Vlanif403]int v 404 [sw2-Vlanif404]ip address 10.40.4.2 24 [sw2-Vlanif404]vrrp vrid 4 virtual-ip 10.40.4.100 [sw2-Vlanif404]vrrp vrid 4 priority 120 [sw2-Vlanif404]vrrp vrid 4 preempt-mode timer delay 60 [sw2-Vlanif404]vrrp vrid 4 track interface GigabitEthernet 0/0/1 reduced 30 sw1和sw2路由 [sw1]ip route-static vpn-instance VRF 0.0.0.0 0 10.40.2.200 [sw1]ip route-static vpn-instance VRF 0.0.0.0 0 10.40.2.200 preference 70 [sw2]ip route-static vpn-instance VRF 0.0.0.0 0 10.40.2.200 [sw2]ip route-static vpn-instance VRF 0.0.0.0 0 10.40.1.200 preference 70 [sw1]ip route-static 192.168.0.0 16 10.40.3.200 [sw1]ip route-static 192.168.0.0 16 10.40.4.200 preference 70 [sw2]ip route-static 192.168.0.0 16 10.40.4.200 [sw2]ip route-static 192.168.0.0 16 10.40.3.200 preference 70 四、三层设备路由器的配置SW1-SW2VLAN 201 --- 10.20.1.0/24 SW1-R5VLAN 105 --- 10.10.5.0/24 SW2-R6VLAN 206 --- 10.20.6.0/24 R5-R610.56.0.0/24sw1和sw2补充 [sw1]vlan batch 201 105 [sw1-GigabitEthernet0/0/7]po li ac [sw1-GigabitEthernet0/0/7]po de v 105 [sw1-GigabitEthernet0/0/7]undo stp en [sw1-GigabitEthernet0/0/7]int g 0/0/2 [sw1-GigabitEthernet0/0/2]po li t [sw1-GigabitEthernet0/0/2]po t a v 201 [sw1-GigabitEthernet0/0/2]un stp en [sw1-GigabitEthernet0/0/2]q [sw1]int v 105 [sw1-Vlanif105]ip add 10.10.5.1 24 [sw1-Vlanif201]ip add 10.20.1.1 24 [sw1-Vlanif201]q [sw1]ospf 2 router-id 1.1.1.1 [sw1-ospf-2]a 0 [sw1-ospf-2-area-0.0.0.0]network 10.10.5.1 0.0.0.0 [sw1-ospf-2-area-0.0.0.0]network 10.20.1.1 0.0.0.0 [sw1-ospf-2]q [sw2]vla b 201 204 [sw2]vlan 206 [sw2]int g 0/0/7 [sw2-GigabitEthernet0/0/7]po lin t [sw2-GigabitEthernet0/0/7]po t a v 206 [sw2-GigabitEthernet0/0/7]int g 0/0/2 [sw2-GigabitEthernet0/0/2]po li t [sw2-GigabitEthernet0/0/2]po t a v 201 [sw2-GigabitEthernet0/0/2]undo stp en [sw2-Vlanif201]ip add 10.20.1.2 24 [sw2-Vlanif206]ip address 10.20.6.2 24 [sw2]ospf 2 router-id 2.2.2.2 [sw2-ospf-2]a 0 [sw2-ospf-2-area-0.0.0.0]network 10.20.6.2 0.0.0.0 r6 [r6]int g 0/0/0 [r6-GigabitEthernet0/0/0]ip add [r6-GigabitEthernet0/0/0]ip address 10.20.6.6 24 Aug 11 2026 00:39:17-08:00 r6 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP on the interface GigabitEthernet0/0/0 has entered the UP state. [r6-GigabitEthernet0/0/0]int g 0/0/1 [r6-GigabitEthernet0/0/1]ip add 10.56.0.6 24 Aug 11 2026 00:39:40-08:00 r6 %%01IFNET/4/LINK_STATE(l)[1]:The line protocol IP on the interface GigabitEthernet0/0/1 has entered the UP state. [r6-GigabitEthernet0/0/1]q [r6]os [r6]ospf 1 ro [r6]ospf 1 router-id 6.6.6.6 [r6-ospf-1]a 0 [r6-ospf-1-area-0.0.0.0]network 10.56.0.6 0.0.0.0 [r6-ospf-1-area-0.0.0.0]network 10.20.6.6 0.0.0.0 r5 [r5]int g 0/0/0 [r5-GigabitEthernet0/0/0]ip add [r5-GigabitEthernet0/0/0]ip address 10.10.5.5 24 Aug 11 2026 00:37:29-08:00 r5 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP on the interface GigabitEthernet0/0/0 has entered the UP state. [r5-GigabitEthernet0/0/0] [r5-GigabitEthernet0/0/0]int g 0/0/1 [r5-GigabitEthernet0/0/1]ip add 10.56.0.5 24 [r5-GigabitEthernet0/0/1]q [r5]ospf 1 router-id 5.5.5.5 [r5-ospf-1]a 0 [r5-ospf-1-area-0.0.0.0]network 10.56.0.5 0.0.0.0 [r5-ospf-1-area-0.0.0.0]network 10.10.5.5 0.0.0.0 [r5]int g 0/0/2 [r5]ip route-static 0.0.0.0 0 12.0.0.100 [r5-ospf-1]default-route-advertise [r5-ospf-1]q [r5]acl 2000 [r5-acl-basic-2000]rule permit source 192.168.0.0 0.0.255.255 [r5-acl-basic-2000]q [r5]int g 0/0/2 [r5-GigabitEthernet0/0/2]nat outbound 2000 [r5-GigabitEthernet0/0/2]q [r5] [r6]int g 0/0/2 [r6-GigabitEthernet0/0/2]ip address 13.0.0.6 24 [r6-GigabitEthernet0/0/2]q [r6]ip route-static 0.0.0.0 0 13.0.0.100 [r6]ospf 1 [r6-ospf-1]default-route-advertise [r6-ospf-1]q [r6]acl 2000 [r6-acl-basic-2000]rule permit source 192.168.0.0 0.0.255.255 [r6-acl-basic-2000]q [r6]int g 0/0/2 [r6-GigabitEthernet0/0/2]nat outbound 2000 [r6-GigabitEthernet0/0/2]q isp [ISP]int g 0/0/0 [ISP-GigabitEthernet0/0/0]ip ad 12.0.0.100 24 [ISP]int LoopBack 0 [ISP-LoopBack0]ip address 100.1.1.1 24 五、测试