H3C 交换机设置VLAN 10 ＩＰ为１０．４．０．０VLAN 20ＩＰ为１０．5．０．０VLAN 30ＩＰ为１０．6．０．０VLAN 40ＩＰ为１０．7．０．０。其中VLAN 10 可以被其它VLAN访问VLAN 203040 之间不能相互访问所有VLAN内的客户端自动获取IP。路由器的IP为10301同时所有的VLAN都能访问外网

以下是H3C交换机的配置命令：

//配置VLAN
vlan 10
  description VLAN10
vlan 20
  description VLAN20
vlan 30
  description VLAN30
vlan 40
  description VLAN40

//配置VLAN接口IP地址
interface Vlan-interface10
  ip address 10.4.0.1 255.255.0.0
  description VLAN10_Interface
interface Vlan-interface20
  ip address 10.5.0.1 255.255.0.0
  description VLAN20_Interface
interface Vlan-interface30
  ip address 10.6.0.1 255.255.0.0
  description VLAN30_Interface
interface Vlan-interface40
  ip address 10.7.0.1 255.255.0.0
  description VLAN40_Interface

//配置VLAN间的访问控制
vlan access-map VLAN20_DENY 10
  match ip address 101
  action drop
vlan access-map VLAN20_DENY 20
  action forward
vlan access-map VLAN30_DENY 10
  match ip address 102
  action drop
vlan access-map VLAN30_DENY 20
  action forward
vlan access-map VLAN40_DENY 10
  match ip address 103
  action drop
vlan access-map VLAN40_DENY 20
  action forward

//配置ACL，用于VLAN间访问控制
ip access-list extended VLAN20_DENY_ACL
  deny ip any 10.6.0.0 0.0.255.255
  deny ip any 10.7.0.0 0.0.255.255
  permit ip any any
ip access-list extended VLAN30_DENY_ACL
  deny ip any 10.5.0.0 0.0.255.255
  deny ip any 10.7.0.0 0.0.255.255
  permit ip any any
ip access-list extended VLAN40_DENY_ACL
  deny ip any 10.5.0.0 0.0.255.255
  deny ip any 10.6.0.0 0.0.255.255
  permit ip any any

//将ACL应用到VLAN access-map中
vlan filter VLAN20_DENY vlan-list 20
  vlan filter VLAN30_DENY vlan-list 30
  vlan filter VLAN40_DENY vlan-list 40

//配置DHCP服务器
dhcp enable
interface Vlan-interface10
  dhcp select relay
  dhcp relay server-select 10.3.0.1
interface Vlan-interface20
  dhcp server option 3 ip 10.5.0.1
  dhcp enable
interface Vlan-interface30
  dhcp server option 3 ip 10.6.0.1
  dhcp enable
interface Vlan-interface40
  dhcp server option 3 ip 10.7.0.1
  dhcp enable

//配置默认路由
ip route-static 0.0.0.0 0.0.0.0 10.3.0.1

//配置NAT
nat enable
interface GigabitEthernet1/0/1
  nat outbound

//配置ACL，允许所有VLAN访问外网
ip access-list extended ALLOW_ALL
  permit ip any any

//将ACL应用到接口
interface GigabitEthernet1/0/1
  ip address 10.3.0.2 255.255.255.0
  description Router_Interface
  service-policy input ALLOW_ALL
``