Cấu hình VLAN và định tuyến cho các VLAN dùng SVI trên switch
Lưu ý: Thay IOS cho Switch L2 bằng
Bước 1: Cấu hình IP cho Router
int F0/0
no shut
ip add dhcp
exit
int F0/1
no sh
ip add 192.168.1.254 255.255.255.0
exit
Bước 2: Cấu hình DHCP Server trên Router, tạo ra 2 pools, mỗi pool cấp cho 1 VLAN
ip dhcp pool VLAN10
network 192.168.10.0 255.255.255.0
default-router 192.168.10.254
dns 8.8.8.8
exit
ip dhcp excluded-address 192.168.10.1 192.168.10.100
ip dhcp pool VLAN20
network 192.168.20.0 255.255.255.0
default-router 192.168.20.254
dns 8.8.8.8
exit
ip dhcp excluded-address 192.168.20.1 192.168.20.100
ip dhcp pool VLAN1
network 192.168.1.0 255.255.255.0
default-router 192.168.1.254
dns 8.8.8.8
exit
ip dhcp excluded-address 192.168.1.1 192.168.1.100
Bước 3: Cấu hình NAT trên Router
//Tạo access-list
Gateway(config)#access-list 1 permit 192.168.1.0 0.0.0.255
Gateway(config)#access-list 1 permit 192.168.10.0 0.0.0.255
Gateway(config)#access-list 1 permit 192.168.20.0 0.0.0.255
Gateway(config)#ip nat inside source list 1 interface f0/0 overload
Gateway(config)#int f0/0
Gateway(config-if)#ip nat outside
Gateway(config-if)# exit
//Nhớ cấu hình Nat Inside
Gateway(config)#int f0/1
Gateway(config-if)#ip nat inside
Gateway(config-if)#ex
//Lưu ý: Tắt tính năng CEF trên Router
Gateway(config)# no ip cef
Bước 4: Cấu hình VLAN trên Switch và gán ports vào các VLAN tương ứng
Switch(config)#vlan 10
Switch(config-vlan)#name TaiChinh
Switch(config-vlan)#exit
Switch(config)#vlan 20
Switch(config-vlan)#name KeToan
Switch(config-vlan)#exit
Switch(config)#
//Cấu hình IP cho interface VLAN 1
Switch(config)#int vlan 1
Switch(config-if)#no shut
Switch(config-if)#ip add 192.168.1.253 255.255.255.0
Switch(config-if)#exit
Switch(config)#
//Cấu hình IP cho interface VLAN 10
Switch(config)#int vlan 10
Switch(config-if)#no shut
Switch(config-if)#ip add 192.168.10.254 255.255.255.0
Switch(config-if)#exit
Switch(config)#
//Cấu hình IP cho interface VLAN 20
Switch(config)#int vlan 20
Switch(config-if)#no shut
Switch(config-if)#ip add 192.168.20.254 255.255.255.0
Switch(config-if)#exit
Switch(config)#
//Cấu hình Trunking cho cổng E0/0
Switch(config)#int e0/0
Switch(config-if)#switchport trunk encapsulation dot1q
Switch(config-if)#switchport mode trunk
Switch(config-if)#exit
Switch(config)#
//Lưu ý: Bật routing trên Switch
Switch(config)#ip routing
//Cấu hình DHCP Relay Agent trên các interface VLAN
Switch(config)#int vlan 1
Switch(config-if)#ip helper-address 192.168.1.254
Switch(config-if)#exit
Switch(config)#int vlan 10
Switch(config-if)#ip helper-address 192.168.1.254
Switch(config-if)#exit
Switch(config)#int vlan 20
Switch(config-if)#ip helper-address 192.168.1.254
Switch(config-if)#exit
//Định tuyến mặc định cho Switch trỏ về Gateway 192.168.1.254
Switch(config)#ip route 0.0.0.0 0.0.0.0 192.168.1.254
//Định tuyến tĩnh từ Router ngược về các VLAN 10 & 20
Gateway(config)#ip route 192.168.10.0 255.255.255.0 F0/1
Gateway(config)#ip route 192.168.20.0 255.255.255.0 F0/1
//Gán port cho các VLAN tương ứng
Switch(config)#int e0/1
Switch(config-if)#switchport mode access
Switch(config-if)#switchport access vlan 10
Switch(config-if)#exit
Switch(config)#int e0/2
Switch(config-if)#switchport mode access
Switch(config-if)#switchport access vlan 20
Switch(config-if)#exit
Bước 5: Qua các PC-VLAN xin IP & test thông mạng
VPCS> set pcname VLAN10
VLAN10> ip dhcp
DDORA IP 192.168.10.101/24 GW 192.168.10.254
VLAN10> show ip
NAME : VLAN10[1]
IP/MASK : 192.168.10.101/24
GATEWAY : 192.168.10.254
DNS : 8.8.8.8
DHCP SERVER : 192.168.10.254
DHCP LEASE : 86397, 86400/43200/75600
MAC : 00:50:79:66:68:03
LPORT : 20000
RHOST:PORT : 127.0.0.1:30000
MTU : 1500
VLAN10>
Trên PCVLAN20:
Một số câu lệnh kiểm tra thông tin cấu hình:
show running-config
show ip interface brief
show vlan //trên switch
show interfaces trunk //trên switch
show ip nat translations
show ip //trên VPCS
Switch#show running-config
Building configuration...
Current configuration : 1341 bytes
!
! Last configuration change at 15:38:45 EET Thu Sep 11 2025
!
version 15.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service compress-config
!
hostname Switch
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
clock timezone EET 2 0
!
!
!
!
!
!
!
!
no ip cef
no ipv6 cef
!
!
!
spanning-tree mode rapid-pvst
spanning-tree extend system-id
!
no cdp run
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Ethernet0/0
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface Ethernet0/1
switchport access vlan 10
switchport mode access
!
interface Ethernet0/2
switchport access vlan 20
switchport mode access
!
interface Ethernet0/3
!
interface Vlan1
ip address 192.168.1.253 255.255.255.0
ip helper-address 192.168.1.254
!
interface Vlan10
ip address 192.168.10.254 255.255.255.0
ip helper-address 192.168.1.254
!
interface Vlan20
ip address 192.168.20.254 255.255.255.0
ip helper-address 192.168.1.254
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip route 0.0.0.0 0.0.0.0 192.168.1.254
ip ssh server algorithm encryption aes128-ctr aes192-ctr aes256-ctr
ip ssh client algorithm encryption aes128-ctr aes192-ctr aes256-ctr
!
!
!
!
!
control-plane
!
!
line con 0
logging synchronous
line aux 0
line vty 0 4
login
!
!
!
end
Switch#
Gateway#sh running-config
Building configuration...
Current configuration : 1617 bytes
!
version 12.4
service config
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Gateway
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
no ip cef
!
!
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.10.1 192.168.10.100
ip dhcp excluded-address 192.168.20.1 192.168.20.100
ip dhcp excluded-address 192.168.1.1 192.168.1.100
!
ip dhcp pool VLAN10
network 192.168.10.0 255.255.255.0
default-router 192.168.10.254
dns-server 8.8.8.8
!
ip dhcp pool VLAN20
network 192.168.20.0 255.255.255.0
default-router 192.168.20.254
dns-server 8.8.8.8
!
ip dhcp pool VLAN1
network 192.168.1.0 255.255.255.0
default-router 192.168.1.254
dns-server 8.8.8.8
!
!
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
archive
log config
hidekeys
!
!
!
!
!
!
!
!
interface FastEthernet0/0
ip address dhcp
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
!
interface FastEthernet0/1
ip address 192.168.1.254 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
ip forward-protocol nd
ip route 192.168.10.0 255.255.255.0 FastEthernet0/1
ip route 192.168.20.0 255.255.255.0 FastEthernet0/1
!
!
ip http server
no ip http secure-server
ip nat inside source list 1 interface FastEthernet0/0 overload
!
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 1 permit 192.168.10.0 0.0.0.255
access-list 1 permit 192.168.20.0 0.0.0.255
!
!
!
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
!
line con 0
line aux 0
line vty 0 4
login
!
!
end
Gateway#