适合人群零基础、入门级运维eNSP 可复现。 本文以一个培训机构 / 企业的真实需求为蓝本从需求分析到命令落地一条龙可直接对照敲。一、需求背景公司网络分两块办公区人事、财务、总经理室、网咨、新媒体、教研 两台文件服务器和机房教学区701~708 共 8 个机房。核心诉求 10 条优化后如下表格编号需求R1各部门 / 机房独立 VLAN用户网关统一.254R2人事、财务、教研、前台外网走 AR1文件服务器不设外网R3网咨部、总经理室外网主走 AR2、备 AR3R4新媒体部外网主走 AR3、备 AR2与 R3 构成互为主备R5单向禁止其他部门访问财务部R6财务、总经理室网段各预留.100给打印机R7前台公共打印机预留.100跨 VLAN 放行打印端口R8禁止机房访问办公网络例外教研部教学远程R9禁止机房访问公司文件服务器仅放行学员文件服务器R10AR4/AR5 机房双出口负载均衡 故障切换 限速教学可申请解除二、拓扑与地址规划结构两台核心办公核心 / 学员核心经 Eth-Trunk 三层互联办公区 3 台出口路由 AR1/AR2/AR3机房区 2 台出口路由 AR4/AR5。VLAN 与网段网关统一 .254表格区域VLAN用途网段关键地址办公10人事部 前台10.10.1.0/24前台打印机 .100办公20财务部10.10.2.0/24财务打印机 .100办公30总经理室10.10.3.0/24经理打印机 .100办公40网咨部10.10.4.0/24—办公50新媒体部10.10.5.0/24—办公60教研部10.10.6.0/24—办公100服务器区10.10.100.0/24公司文件服务器 .10 / 学员文件服务器 .20办公200设备管理10.10.200.0/24办公核心 .1 / 学员核心 .2办公1000双核心互联10.10.255.0/30办公核心 .1 / 学员核心 .2机房301~308701~708 机房10.20.1.0/24~10.20.8.0/24网关 .254接口规划端口号按拓扑推断上真机务必现场核对办公核心GE0/0/19/20/18 → AR1/AR2/AR3GE0/0/3~8 → 人事 / 财务 / 总经理 / 网咨 / 新媒体 / 教研GE0/0/1/2 → 两台服务器GE0/0/23-24 → Eth-Trunk 互联。学员核心GE0/0/19/20 → AR4/AR5GE0/0/1~8 → 701~708 机房GE0/0/23-24 → Eth-Trunk 互联。三、配置实战命令详解第一步办公核心 SW-CORE-Officesys sysname SW-CORE-Office undo inf e vlan batch 10 20 30 40 50 60 100 200 1000 # # 上联 AR1/AR2/AR3三层口配互连地址 interface GigabitEthernet0/0/19 undo portswitch # 接口转为三层口 ip address 10.10.10.2 255.255.255.252 interface GigabitEthernet0/0/20 undo portswitch ip address 10.10.20.2 255.255.255.252 interface GigabitEthernet0/0/18 undo portswitch ip address 10.10.30.2 255.255.255.252 # # 各部门接入Access 口划入对应 VLAN interface GigabitEthernet0/0/3 port link-type access port default vlan 10 # 人事部前台 interface GigabitEthernet0/0/4 port link-type access port default vlan 20 # 财务部 interface GigabitEthernet0/0/5 port link-type access port default vlan 30 # 总经理室 interface GigabitEthernet0/0/6 port link-type access port default vlan 40 # 网咨部 interface GigabitEthernet0/0/7 port link-type access port default vlan 50 # 新媒体部 interface GigabitEthernet0/0/8 port link-type access port default vlan 60 # 教研部 # # 两台文件服务器接入服务器区 VLAN100 interface GigabitEthernet0/0/1 port link-type access port default vlan 100 interface GigabitEthernet0/0/2 port link-type access port default vlan 100 # # 双核心互联两条链路聚合 Eth-TrunkTrunk 只放行互联 VLAN1000 interface Eth-Trunk1 port link-type trunk port trunk allow-pass vlan 1000 interface GigabitEthernet0/0/23 eth-trunk 1 interface GigabitEthernet0/0/24 eth-trunk 1 # # 网关全部 .254 interface Vlanif10 ip address 10.10.1.254 255.255.255.0 interface Vlanif20 ip address 10.10.2.254 255.255.255.0 interface Vlanif30 ip address 10.10.3.254 255.255.255.0 interface Vlanif40 ip address 10.10.4.254 255.255.255.0 interface Vlanif50 ip address 10.10.5.254 255.255.255.0 interface Vlanif60 ip address 10.10.6.254 255.255.255.0 interface Vlanif100 ip address 10.10.100.254 255.255.255.0 interface Vlanif200 ip address 10.10.200.1 255.255.255.0 interface Vlanif1000 ip address 10.10.255.1 255.255.255.252 # 双核心互联地址 # # 路由机房网段→学员核心其他部门默认→AR1 ip route-static 10.20.0.0 255.255.0.0 10.10.255.2 ip route-static 0.0.0.0 0.0.0.0 10.10.10.1 # # R3/R4策略路由 PBR按源网段分流到不同出口 # 网咨(40)总经理(30) → 主走 AR2 acl number 3003 rule 5 permit ip source 10.10.4.0 0.0.0.255 rule 10 permit ip source 10.10.3.0 0.0.0.255 traffic classifier C_GRP operator or if-match acl 3003 traffic behavior B_GRP redirect ip-nexthop 10.10.20.1 # 重定向到 AR2 traffic policy P_GRP classifier C_GRP behavior B_GRP # 新媒体(50) → 主走 AR3 acl number 3004 rule 5 permit ip source 10.10.5.0 0.0.0.255 traffic classifier C_NM operator or if-match acl 3004 traffic behavior B_NM redirect ip-nexthop 10.10.30.1 # 重定向到 AR3 traffic policy P_NM classifier C_NM behavior B_NM # 全局应用 PBR入方向按源匹配 traffic-policy P_GRP global inbound traffic-policy P_NM global inbound # # R5禁止其他部门访问财务部财务 VLANIF 出方向过滤 acl number 3005 rule 5 deny ip source 10.10.1.0 0.0.0.255 destination 10.10.2.0 0.0.0.255 rule 10 deny ip source 10.10.3.0 0.0.0.255 destination 10.10.2.0 0.0.0.255 rule 15 deny ip source 10.10.4.0 0.0.0.255 destination 10.10.2.0 0.0.0.255 rule 20 deny ip source 10.10.5.0 0.0.0.255 destination 10.10.2.0 0.0.0.255 rule 25 deny ip source 10.10.6.0 0.0.0.255 destination 10.10.2.0 0.0.0.255 rule 30 deny ip source 10.20.0.0 0.0.255.255 destination 10.10.2.0 0.0.0.255 rule 40 permit ip interface Vlanif20 traffic-filter outbound acl 3005 # # R8/R9机房→办公隔离 服务器访问控制 # 放在双核心互联入口Vlanif1000 入方向机房流量先过此 ACL acl number 3008 rule 5 permit ip source 10.20.0.0 0.0.255.255 destination 10.10.100.20 0.0.0.0 # 机房→学员文件服务器 rule 10 permit ip source 10.20.0.0 0.0.255.255 destination 10.10.6.0 0.0.0.255 # 机房→教研部教学远程 rule 15 deny ip source 10.20.0.0 0.0.255.255 destination 10.10.100.0 0.0.0.255 # 机房→服务器区含公司文件服务器 rule 20 deny ip source 10.20.0.0 0.0.255.255 # 机房→其余办公全拒 rule 25 permit ip interface Vlanif1000 traffic-filter inbound acl 3008解析PBR 用traffic classifier behavior redirect实现 按部门选出口比改路由优先级更直观也方便以后加部门。ACL 顺序很关键 —— 先放行例外学员服务器、教研部再拒绝最后permit ip兜底放行其他流量如办公内部的正常互通、返回流量。第二步学员核心 SW-CORE-Studentsysname SW-CORE-Student vlan batch 301 to 308 200 1000 to 1002 # # 上联 AR4/AR5 interface GigabitEthernet0/0/19 undo portswitch ip address 20.20.10.2 30 interface GigabitEthernet0/0/20 undo portswitch ip address 20.20.20.2 30 # # 8 个机房接入 interface GigabitEthernet0/0/1 port link-type access port default vlan 301 # 701 机房 interface GigabitEthernet0/0/2 port link-type access port default vlan 302 interface GigabitEthernet0/0/3 port link-type access port default vlan 303 interface GigabitEthernet0/0/4 port link-type access port default vlan 304 interface GigabitEthernet0/0/5 port link-type access port default vlan 305 interface GigabitEthernet0/0/6 port link-type access port default vlan 306 interface GigabitEthernet0/0/7 port link-type access port default vlan 307 interface GigabitEthernet0/0/8 port link-type access port default vlan 308 # # 双核心互联 interface Eth-Trunk1 port link-type trunk port trunk allow-pass vlan 1000 interface GigabitEthernet0/0/23 eth-trunk 1 interface GigabitEthernet0/0/24 eth-trunk 1 # # 机房网关.254 interface Vlanif301 ip address 172.16.1.254 24 interface Vlanif302 ip address 172.16.2.254 24 interface Vlanif303 ip address 172.16.3.254 24 interface Vlanif304 ip address 172.16.4.254 24 interface Vlanif305 ip address 172.16.5.254 24 interface Vlanif306 ip address 172.16.6.254 24 interface Vlanif307 ip address 172.16.7.254 24 interface Vlanif308 ip address 172.16.8.254 24 interface Vlanif200 ip address 10.10.200.2 24 # 管理地址与办公核心同网段不同 IP interface Vlanif1000 ip address 10.10.255.2 30 # # 办公网段回程 ip route-static 10.10.0.0 255.255.0.0 10.10.255.1 # # R10机房出口负载均衡 # 701~704 → AR4705~708 → AR5PBR 按源机房分流 acl number 3004 rule 5 permit ip source 10.20.1.0 0.0.0.255 rule 10 permit ip source 10.20.2.0 0.0.0.255 rule 15 permit ip source 10.20.3.0 0.0.0.255 rule 20 permit ip source 10.20.4.0 0.0.0.255 traffic classifier C_AR4 operator or if-match acl 3004 traffic behavior B_AR4 redirect ip-nexthop 20.20.10.1 traffic policy P_AR4 classifier C_AR4 behavior B_AR4 acl number 3005 rule 5 permit ip source 10.20.5.0 0.0.0.255 rule 10 permit ip source 10.20.6.0 0.0.0.255 rule 15 permit ip source 10.20.7.0 0.0.0.255 rule 20 permit ip source 10.20.8.0 0.0.0.255 traffic classifier C_AR5 operator or if-match acl 3005 traffic behavior B_AR5 redirect ip-nexthop 20.20.20.1 traffic policy P_AR5 classifier C_AR5 behavior B_AR5 traffic-policy P_AR4 global inbound traffic-policy P_AR5 global inbound # 兜底默认路由 ip route-static 0.0.0.0 0.0.0.0 20.20.10.1 preference 200第三步出口路由器 AR1~AR5AR1人事 / 财务 / 教研出口sysname AR1 interface GigabitEthernet0/0/1 ip address 10.10.10.1 255.255.255.252 interface GigabitEthernet0/0/0 # WAN 口公网地址以运营商为准示例占位 ip address 100.64.1.2 255.255.255.252 nat outbound 2001 # 出接口 NATeasy-ip 形式 acl number 2001 rule 5 permit source 10.10.1.0 0.0.0.255 # 人事前台 rule 10 permit source 10.10.2.0 0.0.0.255 # 财务 rule 15 permit source 10.10.6.0 0.0.0.255 # 教研 ip route-static 10.10.0.0 255.255.0.0 10.10.10.2 # 办公网段回程 ip route-static 0.0.0.0 0.0.0.0 100.64.1.1 # 默认路由→运营商AR2网咨 总经理主出口sysname AR2 interface GigabitEthernet0/0/1 ip address 10.10.20.1 255.255.255.252 interface GigabitEthernet0/0/0 ip address 100.65.1.2 255.255.255.252 nat outbound 2001 acl number 2001 rule 5 permit source 10.10.3.0 0.0.0.255 # 总经理室 rule 10 permit source 10.10.4.0 0.0.0.255 # 网咨部 ip route-static 10.10.0.0 255.255.0.0 10.10.20.2 ip route-static 0.0.0.0 0.0.0.0 100.65.1.1AR3新媒体主出口结构同上接口10.10.30.1/30ACL 只放10.10.5.0/24回程指向10.10.30.2WAN 示例100.66.1.2。AR4701~704 出口 限速sysname AR4 interface GigabitEthernet0/0/1 ip address 20.20.10.1 255.255.255.252 interface GigabitEthernet0/0/0 ip address 100.67.1.2 255.255.255.252 nat outbound 2001 acl number 2001 rule 5 permit source 10.20.1.0 0.0.0.255 rule 10 permit source 10.20.2.0 0.0.0.255 rule 15 permit source 10.20.3.0 0.0.0.255 rule 20 permit source 10.20.4.0 0.0.0.255 # # R10 机房限速默认 100M教学申请后可解除 acl number 3001 rule 5 permit ip source 10.20.1.0 0.0.0.255 rule 10 permit ip source 10.20.2.0 0.0.0.255 rule 15 permit ip source 10.20.3.0 0.0.0.255 rule 20 permit ip source 10.20.4.0 0.0.0.255 traffic classifier C_ROOM operator or if-match acl 3001 traffic behavior B_ROOM car cir 100000 pir 120000 # 承诺 100M / 峰值 120M traffic policy P_ROOM classifier C_ROOM behavior B_ROOM interface GigabitEthernet0/0/0 traffic-policy P_ROOM outbound # 对机房出网流量限速 ip route-static 10.20.0.0 255.255.0.0 20.20.10.2 ip route-static 0.0.0.0 0.0.0.0 100.67.1.1AR5705~708 出口 限速接口20.20.20.1/30ACL 源改10.20.5.0~10.20.8.0回程指向20.20.20.2。四、验收清单表格验证项方法预期VLAN / 接口display vlan、display port vlan各口 VLAN 正确网关ping 10.10.x.254全通R3/R4 分流网咨 PCtracert 8.8.8.8首跳 10.10.20.1AR2新媒体首跳 10.10.30.1AR3R2 出口人事 PCtracert首跳 10.10.10.1AR1R5 隔离人事 PCping 10.10.2.254不通财务 PC 访问外网正常R8 隔离机房 PCping 10.10.1.254不通ping 10.10.6.254教研通R9 服务器机房访问 10.10.100.10不通访问 10.10.100.20 通R10 均衡701 与 705 机房tracert分别走 20.20.10.1 / 20.20.20.1R10 限速机房内测速上行被限制在 100M 附近五、避坑提醒端口号务必现场核对—— 拓扑草图的接口编号与真机常有出入接错口是最常见的翻车点。PBR 主备是 主路径 设计出口故障自动切换需补NQA/BFD 联动eNSP 注意版本支持度生产环境建议加上。ACL 顺序先放行例外、再拒绝、最后permit ip兜底别把放行规则写在拒绝后面。WAN 地址是占位公网地址、运营商网关按实际分配替换NAT 用easy-ip即可。双核心互联建议Eth-Trunk聚合两条链路避免 STP 阻塞导致带宽浪费。总结这套方案用 2 台核心 5 台出口路由把 办公隔离、部门分流、机房管控、出口均衡 全部落地思路可复用到多数中小企业网络。有任何配置细节想深入评论区见。