H3C 三层交换机完全支持接入多个路由器,实现不同 VLAN 通过不同路由器访问外网;需通过「VLANIF 配置 + 策略路由(基于源 IP 分流) + 静态路由」实现,普通静态路由无法满足 “按源 VLAN 选网关” 的需求,必须搭配策略路由。
一、组网前提(物理连接)
交换机物理口规划:
交换机GigabitEthernet1/0/1 → 路由器 A LAN 口(互联 VLAN18)
交换机GigabitEthernet1/0/2 → 路由器 B LAN 口(互联 VLAN28)
交换机接用户电脑的端口:根据终端所属 VLAN 配置为access vlan 1或access vlan 2
地址规划补充(需新增互联 VLAN,避免地址冲突):
| 设备 / 网段 | 互联 VLAN | 地址 / 掩码 | 说明 |
|---|---|---|---|
| 交换机 - 路由器 A | VLAN18 | 192.168.18.2/24 | 路由器 A LAN 口为 192.168.18.1 |
| 交换机 - 路由器 B | VLAN28 | 192.168.28.2/24 | 路由器 B LAN 口为 192.168.28.1 |
| 交换机 VLAN1 | VLAN1 | 192.168.0.1/24 | 给用户分配 IP 的网关 |
| 交换机 VLAN2 | VLAN2 | 192.168.1.1/24 | 给用户分配 IP 的网关 |
二、交换机侧完整配置步骤
步骤 1:开启 IP 转发(三层交换机必备)
<H3C> system-view
[H3C] ip routing enable # 开启三层转发功能
步骤 2:创建 VLAN(含用户 VLAN + 互联 VLAN)
[H3C] vlan 1
[H3C-vlan1] quit
[H3C] vlan 2
[H3C-vlan2] quit
[H3C] vlan 18 # 交换机与路由器A的互联VLAN
[H3C-vlan18] quit
[H3C] vlan 28 # 交换机与路由器B的互联VLAN
[H3C-vlan28] quit
步骤 3:配置物理接口(互联口 + 用户口)
(1)互联路由器的接口配置
# 配置接路由器A的接口G1/0/1
[H3C] interface GigabitEthernet 1/0/1
[H3C-GigabitEthernet1/0/1] port link-mode bridge
[H3C-GigabitEthernet1/0/1] port access vlan 18 # 划入互联VLAN18
[H3C-GigabitEthernet1/0/1] undo shutdown
[H3C-GigabitEthernet1/0/1] quit
# 配置接路由器B的接口G1/0/2
[H3C] interface GigabitEthernet 1/0/2
[H3C-GigabitEthernet1/0/2] port link-mode bridge
[H3C-GigabitEthernet1/0/2] port access vlan 28 # 划入互联VLAN28
[H3C-GigabitEthernet1/0/2] undo shutdown
[H3C-GigabitEthernet1/0/2] quit
(2)用户接口配置(示例:G1/0/10 接 VLAN1 用户,G1/0/20 接 VLAN2 用户)
# VLAN1用户口
[H3C] interface GigabitEthernet 1/0/10
[H3C-GigabitEthernet1/0/10] port link-mode bridge
[H3C-GigabitEthernet1/0/10] port access vlan 1
[H3C-GigabitEthernet1/0/10] undo shutdown
[H3C-GigabitEthernet1/0/10] quit
# VLAN2用户口
[H3C] interface GigabitEthernet 1/0/20
[H3C-GigabitEthernet1/0/20] port link-mode bridge
[H3C-GigabitEthernet1/0/20] port access vlan 2
[H3C-GigabitEthernet1/0/20] undo shutdown
[H3C-GigabitEthernet1/0/20] quit
步骤 4:配置 VLANIF 接口(三层网关)
# VLAN1用户网关
[H3C] interface Vlan-interface1
[H3C-Vlan-interface1] ip address 192.168.0.1 255.255.255.0
[H3C-Vlan-interface1] undo shutdown
[H3C-Vlan-interface1] quit
# VLAN2用户网关
[H3C] interface Vlan-interface2
[H3C-Vlan-interface2] ip address 192.168.1.1 255.255.255.0
[H3C-Vlan-interface2] undo shutdown
[H3C-Vlan-interface2] quit
# 与路由器A互联的VLANIF
[H3C] interface Vlan-interface18
[H3C-Vlan-interface18] ip address 192.168.18.2 255.255.255.0
[H3C-Vlan-interface18] undo shutdown
[H3C-Vlan-interface18] quit
# 与路由器B互联的VLANIF
[H3C] interface Vlan-interface28
[H3C-Vlan-interface28] ip address 192.168.28.2 255.255.255.0
[H3C-Vlan-interface28] undo shutdown
[H3C-Vlan-interface28] quit
步骤 5:配置策略路由(核心:按源 VLAN 分流)
普通静态路由仅按 “目的网段” 选路,而外网目的都是0.0.0.0/0,需通过策略路由按 “源 IP(VLAN 网段)” 指定下一跳。
(1)定义 ACL 匹配源 IP(VLAN1/VLAN2 网段)
# 匹配VLAN1用户网段(192.168.0.0/24)
[H3C] acl number 2001
[H3C-acl-basic-2001] rule permit source 192.168.0.0 0.0.0.255
[H3C-acl-basic-2001] quit
# 匹配VLAN2用户网段(192.168.1.0/24)
[H3C] acl number 2002
[H3C-acl-basic-2002] rule permit source 192.168.1.0 0.0.0.255
[H3C-acl-basic-2002] quit
(2)创建策略路由模板
# 模板1:VLAN1流量走路由器A(192.168.18.1)
[H3C] policy-based-route VLAN1_TO_A permit node 10
[H3C-pbr-VLAN1_TO_A-10] if-match acl 2001
[H3C-pbr-VLAN1_TO_A-10] apply ip next-hop 192.168.18.1
[H3C-pbr-VLAN1_TO_A-10] quit
# 模板2:VLAN2流量走路由器B(192.168.28.1)
[H3C] policy-based-route VLAN2_TO_B permit node 10
[H3C-pbr-VLAN2_TO_B-10] if-match acl 2002
[H3C-pbr-VLAN2_TO_B-10] apply ip next-hop 192.168.28.1
[H3C-pbr-VLAN2_TO_B-10] quit
(3)在用户 VLANIF 上应用策略路由
# VLAN1接口应用策略
[H3C] interface Vlan-interface1
[H3C-Vlan-interface1] ip policy-based-route VLAN1_TO_A
[H3C-Vlan-interface1] quit
# VLAN2接口应用策略
[H3C] interface Vlan-interface2
[H3C-Vlan-interface2] ip policy-based-route VLAN2_TO_B
[H3C-Vlan-interface2] quit
步骤 6:配置默认静态路由(兜底,可选)
若策略路由未匹配到流量,可配置兜底路由(按需选择其中一个路由器,或不配置):
[H3C] ip route-static 0.0.0.0 0.0.0.0 192.168.18.1 # 兜底走路由器A
# 或
[H3C] ip route-static 0.0.0.0 0.0.0.0 192.168.28.1 # 兜底走路由器B
三、路由器侧配置(关键:回指路由)
路由器 A/B 需配置静态路由,指向交换机的互联地址,否则外网返回流量无法到达用户:
(1)路由器 A 配置(以 H3C 路由器为例)
<RouterA> system-view
[RouterA] ip route-static 192.168.0.0 255.255.255.0 192.168.18.2 # 指向交换机VLAN18地址
(2)路由器 B 配置(以 H3C 路由器为例)
<RouterB> system-view
[RouterB] ip route-static 192.168.1.0 255.255.255.0 192.168.28.2 # 指向交换机VLAN28地址
暂无评论
亲~登录后才可以操作哦!
确定你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
抄袭了我的内容
×
原文链接或出处
诽谤我
×
对根叔社区有害的内容
×
不规范转载
×
举报说明
暂无评论