[F1000-AK108]+[MS4320v2-28s]企业网应该如何设置

1.https://zhiliao.h3c.com/Theme/details/45972

2.两个楼层网关在同一设备上可以互通。不在同一设备上打通路由就好

交换机设置:

vlan 10
description for bangong123F

vlan 20
description for bangong4F

# 创建DHCP地址池10,给vlan10。

[CORESW1] dhcp server ip-pool 10

[CORESW1-dhcp-pool-vlan10] network 192.168.10.0 mask 255.255.255.0

[CORESW1-dhcp-pool-vlan10] gateway-list 192.168.10.1

[CORESW1-dhcp-pool-vlan10] dns-list 202.101.100.199

[CORESW1-dhcp-pool-vlan10] expired day 30

[CORESW1-dhcp-pool-vlan10] quit

# 创建DHCP地址池20，给vlan20

[CORESW1] dhcp server ip-pool 20

[CORESW1-dhcp-pool-vlan20] network 192.168.20.0 mask 255.255.255.0

[CORESW1-dhcp-pool-vlan20] gateway-list 192.168.20.1

[CORESW1-dhcp-pool-vlan20] dns-list 202.101.100.199

[CORESW1-dhcp-pool-vlan20] expired day 30

[CORESW1-dhcp-pool-vlan20] quit

[CORESW1] interface vlan-interface 10

[CORESW1-Vlan-interface10] dhcp select server

[CORESW1-Vlan-interface10] dhcp server apply ip-pool 10

[CORESW1-Vlan-interface10] quit

[CORESW1 interface vlan-interface 20

[CORESW1-Vlan-interface20] dhcp select server

[CORESW1-Vlan-interface20] dhcp server apply ip-pool 20

[CORESW1-Vlan-interface20] quit

路由设置：

<H3C>system-view

[H3C]acl advanced 3000

[H3C-acl-ipv4-adv-3000]rule 0 permit ip source 192.168.10.0 0.0.0.255

[H3C-acl-ipv4-adv-3000]quit

[H3C]acl advanced 3001

[H3C-acl-ipv4-adv-3001]rule 0 permit ip source 192.168.20.0 0.0.0.255

[H3C-acl-ipv4-adv-3001]quit

[H3C]policy-based-route neiwang node 5

[H3C-pbr-neiwang-5]if-match acl 3000

[H3C-pbr-neiwang-5]apply next-hop 192.168.3.1

[H3C-pbr-neiwang-5]quit

 [H3C]policy-based-route neiwang node 10

 [H3C-pbr-neiwang-10]if-match acl 3001

 [H3C-pbr-neiwang-10]apply next-hop 192.168.4.1

 [H3C-pbr-neiwang-10]quit

访问控制列表：

acl number 3000
rule 10 permit ip source 192.168.10.0 0.0.0.255 destination 192.168.20.0 0.0.0.24

端口设置：

interface GigabitEthernet1/0/1 -10  //接1-3楼的交换机
description to bangong123
port access vlan 10

interface GigabitEthernet1/0/11 -14  //接4楼的交换机
description to bangong4
port access vlan 20

interface GigabitEthernet1/0/15 -18 //接光纤收发器和监控

 port permit vlan all

interface GigabitEthernet1/0/23   //接防火墙 G1/0/0

//trunk

//????

interface GigabitEthernet1/0/24   //接防火墙 G1/0/1

//trunk

//????

防火墙设置：

interface GigabitEthernet1/0/0     //内网接口

ip policy-based-route neiwang

interface GigabitEthernet1/0/1-5   //未使用
port link-mode route

interface GigabitEthernet1/0/6     //300M外网接口       192.168.3.1
port link-mode route
ip address dhcp-alloc

nat outbound

interface GigabitEthernet1/0/7     //1000M外网接口，192.168.4.1
port link-mode route

ip address dhcp-alloc

nat outbound

ip route-static 192.168.10.0 24 192.168.3.1
ip route-static 192.168.20.0 24 192.168.4.1

ip route-static 0.0.0.0 0 192.168.4.1

您好，请知：

1、1-3楼及其他300M，4楼1000M，互为备份，一旦有宽带到期或断网可以转至另一条线路。

答：这种做好路由备份即可，如果有敏感业务需要快速切换，需要做好NQA或BFD探测。

2、4楼需要访问3楼的打印机。

答：业务访问的需求，需要做好VLAN、路由的配置即可。如果流量经过了防火墙，防火墙需要放通相关的安全策略。