华为二层交换机与路由器对接上网配置案例

知孤云出岫

发布于 2026-02-27 12:16:34

1080

华为二层交换机与路由器对接上网配置案例

一、组网图

图1 二层交换机与路由器对接上网组网图

二、二层交换机简介

二层交换机是指 仅支持二层转发功能 的交换机，不能进行三层路由转发。特点：

只支持 VLAN、MAC 地址学习、二层转发等功能
不支持三层路由
一般部署在 接入层
不能作为用户网关

三、配置注意事项

本示例交换机配置适用于 华为 S 系列交换机所有版本
路由器配置示例型号：AR3600 V200R007C00SPCc00
其他型号路由器请参考对应产品文档

四、组网需求

某公司有多个部门，位于不同网段，均需访问 Internet。

要求：

通过 二层交换机 + 路由器 上网
路由器作为各网段的网关
支持多 VLAN 跨网段通信
支持 DHCP 自动分配 IP
支持 NAT 上网

五、配置思路

交换机
- 基于接口划分 VLAN
- 实现二层转发
路由器
- 作为用户网关
- 子接口 / VLANIF 实现三层转发
- DHCP 分配 IP
- NAT 实现外网访问

六、操作步骤

1. 交换机配置

1.1 下行用户接口

<HUAWEI> system-view
[HUAWEI] sysname Switch
[Switch] vlan batch 2 3

[Switch] interface gigabitethernet 0/0/2
[Switch-GigabitEthernet0/0/2] port link-type access
[Switch-GigabitEthernet0/0/2] port default vlan 2
[Switch-GigabitEthernet0/0/2] quit

[Switch] interface gigabitethernet 0/0/3
[Switch-GigabitEthernet0/0/3] port link-type access
[Switch-GigabitEthernet0/0/3] port default vlan 3
[Switch-GigabitEthernet0/0/3] quit

1.2 上行连接路由器接口

[Switch] interface gigabitethernet 0/0/1
[Switch-GigabitEthernet0/0/1] port link-type trunk
[Switch-GigabitEthernet0/0/1] port trunk allow-pass vlan 2 3
[Switch-GigabitEthernet0/0/1] quit

2. 路由器配置方式一：子接口终结 VLAN

2.1 子接口配置

<Huawei> system-view
[Huawei] sysname Router
[Router] vlan batch 2 3

[Router] interface gigabitethernet 0/0/1.1
[Router-GigabitEthernet0/0/1.1] dot1q termination vid 2
[Router-GigabitEthernet0/0/1.1] ip address 192.168.1.1 24
[Router-GigabitEthernet0/0/1.1] arp broadcast enable
[Router-GigabitEthernet0/0/1.1] quit

[Router] interface gigabitethernet 0/0/1.2
[Router-GigabitEthernet0/0/1.2] dot1q termination vid 3
[Router-GigabitEthernet0/0/1.2] ip address 192.168.2.1 24
[Router-GigabitEthernet0/0/1.2] arp broadcast enable
[Router-GigabitEthernet0/0/1.2] quit

2.2 DHCP 配置

[Router] dhcp enable

[Router] interface gigabitethernet 0/0/1.1
[Router-GigabitEthernet0/0/1.1] dhcp select interface
[Router-GigabitEthernet0/0/1.1] dhcp server dns-list 114.114.114.114 223.5.5.5
[Router-GigabitEthernet0/0/1.1] quit

[Router] interface gigabitethernet 0/0/1.2
[Router-GigabitEthernet0/0/1.2] dhcp select interface
[Router-GigabitEthernet0/0/1.2] dhcp server dns-list 114.114.114.114 223.5.5.5
[Router-GigabitEthernet0/0/1.2] quit

2.3 公网接口与静态路由

[Router] interface gigabitethernet 0/0/2
[Router-GigabitEthernet0/0/2] ip address 203.0.113.2 255.255.255.0
[Router-GigabitEthernet0/0/2] quit

[Router] ip route-static 0.0.0.0 0.0.0.0 203.0.113.1

2.4 NAT 配置

[Router] acl number 2001
[Router-acl-basic-2001] rule 5 permit source 192.168.0.0 0.0.255.255
[Router-acl-basic-2001] quit

[Router] interface gigabitethernet 0/0/2
[Router-GigabitEthernet0/0/2] nat outbound 2001
[Router-GigabitEthernet0/0/2] quit

3. 路由器配置方式二：VLANIF 三层转发

3.1 VLANIF 接口

<Huawei> system-view
[Huawei] sysname Router
[Router] vlan batch 2 3

[Router] interface gigabitethernet 0/0/1
[Router-GigabitEthernet0/0/1] portswitch
[Router-GigabitEthernet0/0/1] port link-type trunk
[Router-GigabitEthernet0/0/1] port trunk allow-pass vlan 2 3
[Router-GigabitEthernet0/0/1] quit

[Router] interface vlanif 2
[Router-vlanif2] ip address 192.168.1.1 24
[Router-vlanif2] quit

[Router] interface vlanif 3
[Router-vlanif3] ip address 192.168.2.1 24
[Router-vlanif3] quit

3.2 DHCP 配置

[Router] dhcp enable

[Router] interface vlanif 2
[Router-Vlanif2] dhcp select interface
[Router-Vlanif2] dhcp server dns-list 114.114.114.114 223.5.5.5
[Router-Vlanif2] quit

[Router] interface vlanif 3
[Router-Vlanif3] dhcp select interface
[Router-Vlanif3] dhcp server dns-list 114.114.114.114 223.5.5.5
[Router-Vlanif3] quit

3.3 公网与 NAT

[Router] interface gigabitethernet 0/0/2
[Router-GigabitEthernet0/0/2] ip address 203.0.113.2 255.255.255.0
[Router-GigabitEthernet0/0/2] nat outbound 2001
[Router-GigabitEthernet0/0/2] quit

[Router] ip route-static 0.0.0.0 0.0.0.0 203.0.113.1

七、检查配置结果

设备	IP	网关
PC1	192.168.1.2/24	192.168.1.1
PC2	192.168.2.2/24	192.168.2.1
外网PC	203.0.113.1/24	203.0.113.2

验证：

PC1 / PC2 可 Ping 外网
可访问 Internet

八、交换机配置文件

sysname Switch
vlan batch 2 to 3

interface GigabitEthernet0/0/1
 port link-type trunk
 port trunk allow-pass vlan 2 to 3

interface GigabitEthernet0/0/2
 port link-type access
 port default vlan 2

interface GigabitEthernet0/0/3
 port link-type access
 port default vlan 3

九、路由器配置文件（子接口）

sysname Router
vlan batch 2 to 3
dhcp enable

acl number 2001
 rule 5 permit source 192.168.0.0 0.0.255.255

interface GigabitEthernet0/0/1.1
 dot1q termination vid 2
 ip address 192.168.1.1 255.255.255.0
 dhcp select interface

interface GigabitEthernet0/0/1.2
 dot1q termination vid 3
 ip address 192.168.2.1 255.255.255.0
 dhcp select interface

interface GigabitEthernet0/0/2
 ip address 203.0.113.2 255.255.255.0
 nat outbound 2001

ip route-static 0.0.0.0 0.0.0.0 203.0.113.1

十、路由器配置文件（VLANIF）

sysname Router
vlan batch 2 to 3
dhcp enable

interface Vlanif2
 ip address 192.168.1.1 255.255.255.0

interface Vlanif3
 ip address 192.168.2.1 255.255.255.0

interface GigabitEthernet0/0/1
 portswitch
 port link-type trunk
 port trunk allow-pass vlan 2 to 3

interface GigabitEthernet0/0/2
 ip address 203.0.113.2 255.255.255.0
 nat outbound 2001

ip route-static 0.0.0.0 0.0.0.0 203.0.113.1

本文参与腾讯云自媒体同步曝光计划，分享自微信公众号。

原始发表：2026-01-29，如有侵权请联系 cloudcommunity@tencent.com 删除

配置