用户需求如下：
vlan10和vlan11不能互访，但能访问vlan12服务器
vlan10只能通过RT5上网，vlan11只能通过RT6上网
vlan12不能上网
配置思路步骤：
1.基本信息配置（SW1、RT5、RT6）
2.边界网络对界（RT5静态路由）
3.SW1策略路由，RT6静态路由
4.边界设备INTERNET对界（缺省路由）
5.业务访问控制（VLAN10和VLAN11不能互访）
6.全网测试及排错
基本配置：
SW1>en
SW1#vlan data
SW1(vlan)#vtp tran
SW1(vlan)#vlan 10
SW1(vlan)#vlan 11
SW1(vlan)#vlan 12 //在VLAN数据库中添加VLAN
SW1(vlan)#exit
SW1#config t
SW1(config)#int vlan 10
SW1(config-if)#ip add 192.168.10.1 255.255.255.0
SW1(config-if)#no shut
SW1(config-if)#int vlan 11
SW1(config-if)#ip add 192.168.11.1 255.255.255.0
SW1(config-if)#no shut
SW1(config-if)#int vlan 12
SW1(config-if)#ip add 192.168.12.1 255.255.255.0
SW1(config-if)#no shut
SW1(config-if)#int f1/10
SW1(config-if)#switchport mode access
SW1(config-if)#switchport access vlan 10
SW1(config-if)#int f1/11
SW1(config-if)#switchport mode access
SW1(config-if)#switchport access vlan 11
SW1(config-if)#int f1/12
SW1(config-if)#switchport mode access
SW1(config-if)#switchport access vlan 12
SW1(config-if)#int f1/12
SW1(config-if)#switchport mode access
SW1(config-if)#switchport access vlan 12
SW1(config-if)#int f1/1
SW1(config-if)#no switchport
SW1(config-if)#ip add 192.168.1.1 255.255.255.252
SW1(config-if)#no shut
SW1(config-if)#int f1/2
SW1(config-if)#no switchport
SW1(config-if)#ip add 192.168.1.5 255.255.255.252
SW1(config-if)#no shut
SW1(config-if)#exit
SW1(config)#ip routing
SW1(config)#ip route 192.168.0.0 255.255.0.0 null 0 //添加黑洞路由
SW1(config)#access-list 101 deny ip 192.168.10.0 0.0.0.255 192.168.0.0 0.0.255.255 //防止VLAN10访问内网的流量被策略路由
SW1(config)#access-list 101 permit ip 192.168.10.0 0.0.0.255 any
//区分VLAN11的流量
SW1(config)#access-list 102 deny ip 192.168.11.0 0.0.0.255 192.168.0.0 0.0.255.255 //防止VLAN11访问内网的流量被策略路由
SW1(config)#access-list 102 permit ip 192.168.11.0 0.0.0.255 any
//区分VLAN11的流量
SW1(config)#access-list 103 deny ip 192.168.10.0 0.0.0.255 192.168.11.0 0.0.0.255 //VLAN10和VLAN11不能互访
SW1(config)#access-list 103 permit ip any any //允许VLAN10访问其它
SW1(config)#int vlan 10
SW1(config-if)#exit
SW1(config)#route-map RT5 permit 10 //建立通过RT5访问INTERNET的ROUTE-MAP
SW1(config-route-map)#match ip address 101 //匹配IP地址
SW1(config-route-map)#set ip next-hop 192.168.1.2//为匹配流量设置下一跳
SW1(config-route-map)#exit
SW1(config)#route-map RT6 permit 10//建立通过RT6访问INTERNET的ROUTER-MAP
SW1(config-route-map)#match ip address 102//匹配IP地址
SW1(config-route-map)#set ip next-hop 192.168.1.6//为匹配流量设置下一跳
SW1(config-route-map)#exit
SW1(config)#int vlan 10
SW1(config-if)#ip policy route-map RT5 //在VLAN10中绑定ROUTE-MAP
SW1(config-if)#ip access-group 103 in //在IN方向启用访问控制列表
SW1(config-if)#int vlan 11
SW1(config-if)#ip policy route-map RT6//在VLAN11中绑定ROUTE-MAP
RT5(config)#int f2/0
RT5(config-if)#ip add 192.168.1.2 255.255.255.252
RT5(config-if)#no shut
RT5(config-if)#int f1/0
RT5(config-if)#ip add 202.202.1.2 255.255.255.252
RT5(config-if)#no shut
RT5(config-if)#exit
RT5(config)#ip route 0.0.0.0 0.0.0.0 202.202.1.1//去往公网的路由
RT5(config)#ip route 192.168.0.0 255.255.0.0 192.168.1.1//去往内部的路由
RT5(config)#access-list 10 permit 192.168.10.0 0.0.0.255//定义需NAT的流量
RT5(config)#int f1/0
RT5(config-if)#ip nat inside//定义NAT的内部接口
RT5(config-if)#int f2/0
RT5(config-if)#ip nat outside//定义NAT的外部接口
RT5(config)#ip nat inside source list 10 int f1/0 overload//启用NAT转换
RT6(config)#int f2/0
RT6(config-if)#ip add 192.168.1.6 255.255.255.252
RT6(config-if)#no shut
RT6(config-if)#int f1/0
RT6(config-if)#ip add 202.202.2.2 255.255.255.252
RT6(config-if)#no shut
RT6(config-if)#exit
RT6(config)#ip route 0.0.0.0 0.0.0.0 202.202.2.1
RT6(config)#ip route 192.168.0.0 255.255.0.0 192.168.1.5
RT6(config)#access-list 10 permit 192.168.11.0 0.0.0.255//定义需NAT的流量
RT6(config)#int f1/0
RT6(config-if)#ip nat inside
RT6(config-if)#int f2/0
RT6(config-if)#ip nat outsid
RT6(config)#ip nat inside source list 10 int f1/0 overload
测试过程：
VPCS 1 >ping 202.202.1.2
202.202.1.2 icmp_seq=1 time=130.000 ms
202.202.1.2 icmp_seq=2 time=46.000 ms
202.202.1.2 icmp_seq=3 time=67.000 ms
202.202.1.2 icmp_seq=4 time=63.000 ms
202.202.1.2 icmp_seq=5 time=105.000 ms
*Mar 1 00:44:57.915: IP: tableid=0, s=192.168.10.100 (Vlan10), d=202.202.1.2 (FastEthernet1/1), routed via FIB
*Mar 1 00:44:57.919: IP: s=192.168.10.100 (Vlan10), d=202.202.1.2, len 84, policy match
*Mar 1 00:44:57.923: IP: route map RT5, item 10, permit
*Mar 1 00:44:57.923: IP: s=192.168.10.100 (Vlan10), d=202.202.1.2 (FastEthernet1/1), len 84, policy routed
*Mar 1 00:44:57.927: IP: Vlan10 to FastEthernet1/1 192.168.1.2
*Mar 1 00:44:57.931: IP: s=192.168.10.100 (Vlan10), d=202.202.1.2 (FastEthernet1/1), g=192.168.1.2, len84, forward
*Mar 1 00:44:58.027: IP: tableid=0, s=202.202.1.2 (FastEthernet1/1), d=192.168.10.100 (Vlan10), routed via FIB
*Mar 1 00:44:58.031: IP: s=202.202.1.2 (FastEthernet1/1), d=192.168.10.100 (Vlan10), g=192.168.10.100, len 84, forward
VPCS 2 >ping 202.202.2.2
202.202.2.2 icmp_seq=1 time=61.000 ms
202.202.2.2 icmp_seq=2 time=77.000 ms
202.202.2.2 icmp_seq=3 time=84.000 ms
202.202.2.2 icmp_seq=4 time=103.000 ms
202.202.2.2 icmp_seq=5 time=37.000 ms
*Mar 1 00:45:56.839: IP: tableid=0, s=192.168.11.100 (Vlan11), d=202.202.2.2 (FastEthernet1/1), routed via FIB
*Mar 1 00:45:56.839: IP: s=192.168.11.100 (Vlan11), d=202.202.2.2 (FastEthernet1/2), g=192.168.1.6, len 84, forward
*Mar 1 00:45:57.819: IP: tableid=0, s=192.168.11.100 (Vlan11), d=202.202.2.2 (FastEthernet1/1), routed via FIB
*Mar 1 00:45:57.823: IP: s=192.168.11.100 (Vlan11), d=202.202.2.2 (FastEthernet1/2), g=192.168.1.6, len 84, forward
*Mar 1 00:45:58.807: IP: tableid=0, s=192.168.11.100 (Vlan11), d=202.202.2.2 (FastEthernet1/1), routed via FIB
*Mar 1 00:45:58.811: IP: s=192.168.11.100 (Vlan11), d=202.202.2.2 (FastEthernet1/2), g=192.168.1.6, len 84,
*Mar 1 00:45:59.847: IP: tableid=0, s=192.168.11.100 (Vlan11), d=202.202.2.2 (FastEthernet1/1), routed via FIB
*Mar 1 00:45:59.851: IP: s=192.168.11.100 (Vlan11), d=202.202.2.2 (FastEthernet1/2), g=192.168.1.6, len 84, forward
*Mar 1 00:46:00.827: IP: tableid=0, s=192.168.11.100 (Vlan11), d=202.202.2.2 (FastEthernet1/1), routed via FIB
*Mar 1 00:46:00.831: IP: s=192.168.11.100 (Vlan11), d=202.202.2.2 (FastEthernet1/2), g=192.168.1.6, len 84, forward
：
202.202.1.2 icmp_seq=1 time=130.000 ms
202.202.1.2 icmp_seq=2 time=46.000 ms
202.202.1.2 icmp_seq=3 time=67.000 ms
202.202.1.2 icmp_seq=4 time=63.000 ms
202.202.1.2 icmp_seq=5 time=105.000 ms
*Mar 1 00:44:57.915: IP: tableid=0, s=192.168.10.100 (Vlan10), d=202.202.1.2 (FastEthernet1/1), routed via FIB
*Mar 1 00:44:57.919: IP: s=192.168.10.100 (Vlan10), d=202.202.1.2, len 84, policy match
*Mar 1 00:44:57.923: IP: route map RT5, item 10, permit
*Mar 1 00:44:57.923: IP: s=192.168.10.100 (Vlan10), d=202.202.1.2 (FastEthernet1/1), len 84, policy routed
*Mar 1 00:44:57.927: IP: Vlan10 to FastEthernet1/1 192.168.1.2
*Mar 1 00:44:57.931: IP: s=192.168.10.100 (Vlan10), d=202.202.1.2 (FastEthernet1/1), g=192.168.1.2, len84, forward
*Mar 1 00:44:58.027: IP: tableid=0, s=202.202.1.2 (FastEthernet1/1), d=192.168.10.100 (Vlan10), routed via FIB
*Mar 1 00:44:58.031: IP: s=202.202.1.2 (FastEthernet1/1), d=192.168.10.100 (Vlan10), g=192.168.10.100, len 84, forward
VPCS 2 >ping 202.202.2.2
202.202.2.2 icmp_seq=1 time=61.000 ms
202.202.2.2 icmp_seq=2 time=77.000 ms
202.202.2.2 icmp_seq=3 time=84.000 ms
202.202.2.2 icmp_seq=4 time=103.000 ms
202.202.2.2 icmp_seq=5 time=37.000 ms
*Mar 1 00:45:56.839: IP: tableid=0, s=192.168.11.100 (Vlan11), d=202.202.2.2 (FastEthernet1/1), routed via FIB
*Mar 1 00:45:56.839: IP: s=192.168.11.100 (Vlan11), d=202.202.2.2 (FastEthernet1/2), g=192.168.1.6, len 84, forward
*Mar 1 00:45:57.819: IP: tableid=0, s=192.168.11.100 (Vlan11), d=202.202.2.2 (FastEthernet1/1), routed via FIB
*Mar 1 00:45:57.823: IP: s=192.168.11.100 (Vlan11), d=202.202.2.2 (FastEthernet1/2), g=192.168.1.6, len 84, forward
*Mar 1 00:45:58.807: IP: tableid=0, s=192.168.11.100 (Vlan11), d=202.202.2.2 (FastEthernet1/1), routed via FIB
*Mar 1 00:45:58.811: IP: s=192.168.11.100 (Vlan11), d=202.202.2.2 (FastEthernet1/2), g=192.168.1.6, len 84,
*Mar 1 00:45:59.847: IP: tableid=0, s=192.168.11.100 (Vlan11), d=202.202.2.2 (FastEthernet1/1), routed via FIB
*Mar 1 00:45:59.851: IP: s=192.168.11.100 (Vlan11), d=202.202.2.2 (FastEthernet1/2), g=192.168.1.6, len 84, forward
*Mar 1 00:46:00.827: IP: tableid=0, s=192.168.11.100 (Vlan11), d=202.202.2.2 (FastEthernet1/1), routed via FIB
*Mar 1 00:46:00.831: IP: s=192.168.11.100 (Vlan11), d=202.202.2.2 (FastEthernet1/2), g=192.168.1.6, len 84, forward
：
实验总结：
192．168．10．100访问INTERNET分析：
192．168．10．100将数据交给SW1的SVI接口192.168.10.1,因为在VLAN10的SVI接口上做了策略路由，设置下一跳为192 .168.1.2，从VLAN10过来的数据将匹配策略路由，将数据发往192.168.1.2。在RT1上做NAT将192.168.10.0/24的数据转换成F1/0的IP 202.202.1.2，同时将转换的地址记录到NAT的转换表中，将数据发往INTERNET，回应的数据通过F1/0的NAT入处理，查找NAT转换表，找到对应的内网IP地址，通过查找路由，将数据从F2/0转发，最后数据交付给目的主机。
本文转自 tangfangxiao 51CTO博客，原文链接:
http://blog.51cto.com/tangfangxiao/631310