步驟1、交換機的其它配置，包括vlan配置，省略
步驟2、配置雙靜態(tài)路由，注意優(yōu)先級
ip route 0.0.0.0 0.0.0.0 172.16.1.2?網(wǎng)關(guān)1
ip route 0.0.0.0 0.0.0.0 10.10.10.1 50?網(wǎng)關(guān)2
步驟3、配置ACL，即允許哪些源網(wǎng)段的下一跳出口為第二臺防火墻
ip access-list extended Second_Gateway
10 deny? ip 172.16.0.0 0.0.255.255 172.16.0.0 0.0.255.255
15 deny? ip 172.16.50.0 0.0.0.255 any
20 deny? ip 172.16.51.0 0.0.0.255 any
25 permit ip 172.16.0.0 0.0.255.255 any
步驟4、配置策略路由
route-map Second_Route permit 10
match ip address Second_Gateway
set ip next-hop 10.10.10.1
正常情況下172.16.0.0/16?所有的網(wǎng)段下一跳出口都是指向172.16.1.2 ，即數(shù)據(jù)從網(wǎng)關(guān)1轉(zhuǎn)發(fā)
但是有部分網(wǎng)段需要數(shù)據(jù)從網(wǎng)關(guān)2轉(zhuǎn)發(fā)，例如 vlan18?和 vlan19
int vlan 18
ip address 172.16.18.1 255.255.255.0
ip policy route-map?Second_Route
vint vlan 19
ip address 172.16.19.1 255.255.255.0
ip policy route-map?Second_Route
這樣 vlan18和vlan19訪問外網(wǎng)數(shù)據(jù)會走網(wǎng)關(guān)2
