该案例中，左边的SW1、SW2和SW3配置MSTP服务；SW1和SW2配置VRRP服务；SW3和R6配置DHCP服务；R1、R2、R3配置BGP服务；R1和R3配置NAPT、IPSec服务；SW4配置PVLAN服务。
NAPT的作用在于将内网地址转换为公网地址，IPSec VPN的作用在于将内网可以直接访问内网，达到左右两边的PC互相通信的作用。
R1、R2、R3分别充当公网，除该三个路由器外，其余设备都是内网设备。在公网里不注入内网路由，模拟真实环境，即内网地址无论怎么设置，都不影响到公网地址。
SW1(config)#vlan 10
SW1(config-vlan)#vlan 20
SW1(config)#inter range e0/1-2
SW1(config-if-range)#sw tr enc dot
SW1(config-if-range)#sw mo tr
SW1(config)#spanning-tree mode mst
SW1(config)#spanning-tree mst configuration
SW1(config-mst)#revision 1
SW1(config-mst)#name a1
SW1(config-mst)#instance 1 vlan 10
SW1(config-mst)#instance 2 vlan 20
SW1(config)#spanning-tree mst 1 priority 4096
SW1(config)#spanning-tree mst 2 priority 8192
---
SW2(config)#vlan 10
SW2(config-vlan)#vlan 20
SW2(config)#inter range e0/1-2
SW2(config-if-range)#sw tr enc dot
SW2(config-if-range)#sw mo tr
SW2(config)#spanning-tree mode mst
SW2(config)#spanning-tree mst configuration
SW2(config-mst)#revision 1
SW2(config-mst)#name a1
SW2(config-mst)#instance 1 vlan 10
SW2(config-mst)#instance 2 vlan 20
SW2(config)#spanning-tree mst 1 priority 8192
SW2(config)#spanning-tree mst 2 priority 4096
---
SW3(config)#vlan 10
SW3(config-vlan)#vlan 20
SW3(config)#inter range e0/0-1
SW3(config-if-range)#sw tr enc dot
SW3(config-if-range)#sw mo tr
SW3(config)#spanning-tree mode mst
SW3(config)#spanning-tree mst configuration
SW3(config-mst)#revision 1
SW3(config-mst)#name a1
SW3(config-mst)#instance 1 vlan 10
SW3(config-mst)#instance 2 vlan 20
SW1(config)#inter vlan 10
SW1(config-if)#vrrp 10 ip 192.34.1.254
SW1(config-if)#vrrp 10 priority 120
SW1(config)#inter vlan 20
SW1(config-if)#vrrp 20 ip 192.34.2.254
---
SW2(config)#inter vlan 10
SW2(config-if)#vrrp 10 ip 192.34.1.254
SW2(config)#inter vlan 20
SW2(config-if)#vrrp 20 ip 192.34.2.254
SW2(config-if)#vrrp 20 priority 120
SW3(config)#service dhcp
SW3(config)#inter vlan 10
SW3(config-if)#no shut
SW3(config-if)#ip add 192.34.1.100 255.255.255.0
SW3(config-if)#ip helper-address 200.34.4.2
SW3(config)#inter vlan 20
SW3(config-if)#no shut
SW3(config-if)#ip add 192.34.2.100 255.255.255.0
SW3(config-if)#ip helper-address 200.34.4.2
SW3(config)#inter e1/0
SW3(config-if)#no sw
SW3(config-if)#ip add 200.34.4.1 255.255.255.0
SW3(config)#ip route 0.0.0.0 0.0.0.0 200.34.4.2
---
R6(config)#service dhcp
R6(config)#ip dhcp pool vlan10
R6(dhcp-config)#network 192.34.1.0 255.255.255.0
R6(dhcp-config)#default-router 192.34.1.254
R6(config)#ip dhcp pool vlan20
R6(dhcp-config)#network 192.34.2.0 255.255.255.0
R6(dhcp-config)#default-router 192.34.2.254
R6(config)#ip dhcp excluded-address 192.34.1.1 192.34.1.9
R6(config)#ip dhcp excluded-address 192.34.2.1 192.34.2.9
R6(config)#ip route 192.34.1.0 255.255.255.0 200.34.4.1
R6(config)#ip route 192.34.2.0 255.255.255.0 200.34.4.1
SW4(config)#vtp mode transparent
SW4(config)#vlan 10
SW4(config-vlan)#private-vlan primary
SW4(config)#vlan 20
SW4(config-vlan)#private-vlan community
SW4(config)#vlan 30
SW4(config-vlan)#private-vlan isolated
SW4(config)#vlan 10
SW4(config-vlan)#private-vlan association 20,30
SW4(config)#inter range e0/0-1
SW4(config-if-range)#sw mode private-vlan host
SW4(config-if-range)#sw private-vlan host-association 10 20
SW4(config)#inter range e0/2-3
SW4(config-if-range)#sw mode private-vlan host
SW4(config-if-range)#sw private-vlan host-association 10 30
SW4(config)#inter e1/0
SW4(config-if)#sw mode private-vlan promiscuous
SW4(config)#inter e1/0
SW4(config-if)#sw private-vlan mapping 10 add 20,30
R4(config)#router rip
R4(config-router)#version 2
R4(config-router)#network 200.34.1.0
R4(config-router)#network 200.34.2.0
R4(config-router)#network 200.34.3.0
R4(config-router)#no auto-summary
---
R5(config)#router rip
R5(config-router)#version 2
R5(config-router)#network 192.34.3.0
R5(config-router)#network 192.34.4.0
R5(config-router)#no auto-summary
R1(config)#router bgp 1
R1(config-router)#neighbor 1.1.1.2 remote-as 2
---
R2(config)#router bgp 2
R2(config-router)#neighbor 1.1.1.1 remote-as 1
R2(config-router)#neighbor 2.2.2.2 remote-as 3
---
R3(config)#router bgp 3
R3(config-router)#neighbor 2.2.2.1 remote-as 2
R1(config)#crypto isakmp policy 1
R1(config-isakmp)#encryption 3des
R1(config-isakmp)#authentication pre-share
R1(config-isakmp)#hash sha
R1(config-isakmp)#group 2
R1(config)#crypto isakmp key 0 abc123 address 2.2.2.2
R1(config)#crypto ipsec transform-set 3des_sha esp-3des esp-sha-hmac
R1(cfg-crypto-trans)#mode transport
R1(config)#ip access-list extended VPN
R1(config-ext-nacl)#permit ip 192.34.1.0 0.0.0.255 192.34.4.0 0.0.0.255
R1(config-ext-nacl)#permit ip 192.34.2.0 0.0.0.255 192.34.4.0 0.0.0.255
R1(config)#crypto map to_r3 1 ipsec-isakmp
R1(config-crypto-map)#match address VPN
R1(config-crypto-map)#set transform-set 3des_sha
R1(config-crypto-map)#set peer 2.2.2.2
R1(config)#inter s1/0
R1(config-if)#crypto map to_r3
---
R3(config)#crypto isakmp policy 1
R3(config-isakmp)#encryption 3des
R3(config-isakmp)#authentication pre-share
R3(config-isakmp)#hash sha
R3(config-isakmp)#group 2
R3(config)#crypto isakmp key 0 abc123 address 1.1.1.1
R3(config)#crypto ipsec transform-set 3des_sha esp-3des esp-sha-hmac
R3(cfg-crypto-trans)#mode transport
R3(config)#ip access-list extended VPN
R3(config-ext-nacl)#permit ip 192.34.4.0 0.0.0.255 192.34.1.0 0.0.0.255
R3(config-ext-nacl)#permit ip 192.34.4.0 0.0.0.255 192.34.2.0 0.0.0.255
R3(config)#crypto map to_r1 1 ipsec-isakmp
R3(config-crypto-map)#match address VPN
R3(config-crypto-map)#set transform-set 3des_sha
R3(config-crypto-map)#set peer 1.1.1.1
R3(config)#inter s1/1
R3(config-if)#crypto map to_r1
R1(config)#ip access-list extended NAT
R1(config-ext-nacl)#deny ip 192.34.1.0 0.0.0.255 192.34.4.0 0.0.0.255
R1(config-ext-nacl)#deny ip 192.34.2.0 0.0.0.255 192.34.4.0 0.0.0.255
R1(config-ext-nacl)#permit ip any any
R1(config)#ip nat inside source list NAT inter s1/0
R1(config)#inter f0/0
R1(config-if)#ip nat inside
R1(config)#inter s1/0
R1(config-if)#ip nat outside
R1(config)#ip route 0.0.0.0 0.0.0.0 1.1.1.2
R1(config)#router rip
R1(config-router)#version 2
R1(config-router)#network 200.34.1.0
R1(config-router)#default-information originate
R1(config-router)#no auto-summary
---
R3(config)#ip access-list extended NAT
R3(config-ext-nacl)#deny ip 192.34.4.0 0.0.0.255 192.34.1.0 0.0.0.255
R3(config-ext-nacl)#deny ip 192.34.4.0 0.0.0.255 192.34.2.0 0.0.0.255
R3(config-ext-nacl)#permit ip any any
R3(config)#ip nat inside source list NAT inter s1/1
R3(config)#inter f0/0
R3(config-if)#ip nat inside
R3(config)#inter s1/1
R3(config-if)#ip nat outside
R3(config)#ip route 0.0.0.0 0.0.0.0 2.2.2.1
R3(config)#router rip
R3(config-router)#version 2
R3(config-router)#network 192.34.3.0
R3(config-router)#default-information originate
R3(config-router)#no auto-summary
▼实验配置完成，查看结果▼
1、查看DHCP服务。
PC1> ip dhcp
DDORA IP 192.34.1.10/24 GW 192.34.1.254
---
PC2> ip dhcp
DDORA IP 192.34.2.10/24 GW 192.34.1.254
2、查看MSTP服务。
SW3#show spanning-tree mst 1
##### MST1 vlans mapped: 10
Bridge address aabb.cc00.0300 priority 32769 (32768 sysid 1)
Root address aabb.cc00.0100 priority 4097 (4096 sysid 1)
port Et0/0 cost 2000000 rem hops 19
Interface Role Sts Cost Prio.Nbr Type
---
Et0/0 Root FWD 2000000 128.1 P2p
Et0/1 Altn BLK 2000000 128.2 P2p
Et0/2 Desg FWD 2000000 128.3 P2p
=============================================================================
SW3#show spanning-tree mst 2
##### MST2 vlans mapped: 20
Bridge address aabb.cc00.0300 priority 32770 (32768 sysid 2)
Root address aabb.cc00.0200 priority 4098 (4096 sysid 2)
port Et0/1 cost 2000000 rem hops 19
Interface Role Sts Cost Prio.Nbr Type
---
Et0/0 Altn BLK 2000000 128.1 P2p
Et0/1 Root FWD 2000000 128.2 P2p
Et0/3 Desg FWD 2000000 128.4 P2p
3、查看VRRP服务。
SW1#show vrrp brief
Interface Grp Pri Time Own Pre State Master addr Group addr
Vl10 10 120 3531 Y Master 192.34.1.1 192.34.1.254
Vl20 20 100 3609 Y Backup 192.34.2.2 192.34.2.254
---
SW2#show vrrp brief
Interface Grp Pri Time Own Pre State Master addr Group addr
Vl10 10 100 3609 Y Backup 192.34.1.1 192.34.1.254
Vl20 20 120 3531 Y Master 192.34.2.2 192.34.2.254
4、查看PVLAN服务。
PC3> ping 192.34.4.2 <----团体VLAN
84 bytes from 192.34.4.2 icmp_seq=1 ttl=64 time=0.202 ms
84 bytes from 192.34.4.2 icmp_seq=2 ttl=64 time=0.508 ms
^C
PC3> ping 192.34.4.3 <----隔离VLAN
host (192.34.4.3) not reachable
---
PC5> ping 192.34.4.4 <----隔离VLAN
host (192.34.4.4) not reachable
PC5> ping 192.34.4.1 <----团体VLAN
host (192.34.4.1) not reachable
5、查看NAT服务。
PC1或其它PC与外界通信（需通过R1或R3），然后到R1或R3上查看。
R1#show ip nat tr
Pro Inside global Inside local Outside local Outside global
tcp 1.1.1.1:4 1.1.1.1:179 1.1.1.2:56577 1.1.1.2:56577
tcp 1.1.1.1:1111 1.1.1.1:1110 1.1.1.2:179 1.1.1.2:179
tcp 1.1.1.1:1113 1.1.1.1:1112 1.1.1.2:179 1.1.1.2:179
tcp 1.1.1.1:1115 1.1.1.1:1114 1.1.1.2:179 1.1.1.2:179
tcp 1.1.1.1:1112 1.1.1.1:18315 1.1.1.2:179 1.1.1.2:179
tcp 1.1.1.1:1110 1.1.1.1:37984 1.1.1.2:179 1.1.1.2:179
tcp 1.1.1.1:1114 1.1.1.1:51548 1.1.1.2:179 1.1.1.2:179
udp 1.1.1.1:520 200.34.1.1:520 224.0.0.9:520 224.0.0.9:520
R1#
6、查看IPSec服务。
在R1或R3上查看，QM状态即生效，MM状态为未生效(第二层级状态)。
R1#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id slot status
2\.2.2.2 1.1.1.1 QM_IDLE 1001 0 ACTIVE
IPv6 Crypto ISAKMP SA
R1#
7、PC-1与外部任一台PC通信。
PC1> ping 192.34.2.10
84 bytes from 192.34.2.10 icmp_seq=1 ttl=63 time=0.576 ms
84 bytes from 192.34.2.10 icmp_seq=2 ttl=63 time=0.565 ms
^C
PC1> ping 192.34.4.1
84 bytes from 192.34.4.1 icmp_seq=1 ttl=59 time=73.188 ms
84 bytes from 192.34.4.1 icmp_seq=2 ttl=59 time=67.311 ms
^C
PC1> ping 192.34.4.2
192\.34.4.2 icmp_seq=1 timeout
84 bytes from 192.34.4.2 icmp_seq=2 ttl=59 time=68.508 ms
84 bytes from 192.34.4.2 icmp_seq=3 ttl=59 time=66.327 ms
^C
PC1> ping 192.34.4.3
192\.34.4.3 icmp_seq=1 timeout
84 bytes from 192.34.4.3 icmp_seq=2 ttl=59 time=183.248 ms
^C
PC1> ping 192.34.4.4
192\.34.4.4 icmp_seq=1 timeout
84 bytes from 192.34.4.4 icmp_seq=2 ttl=59 time=165.533 ms
^C
PC1>
实验已经全部完成，内外网转换正常，内网通信正常，PVLAN隔离正常。
