配置acl策略，3000設置允許，3001設置拒絕所有：
acl 3001
rule deny ip source 192.168.10.0 0.0.0.255 destination 192.168.20.0 0.0.0.255
rule deny ip source 192.168.10.0 0.0.0.255 destination 192.168.30.0 0.0.0.255
rule deny ip source 192.168.10.0 0.0.0.255 destination 192.168.40.0 0.0.0.255
rule deny ip source 192.168.20.0 0.0.0.255 destination 192.168.30.0 0.0.0.255
rule deny ip source 192.168.20.0 0.0.0.255 destination 192.168.40.0 0.0.0.255
rule deny ip source 192.168.30.0 0.0.0.255 destination 192.168.40.0 0.0.0.255
acl 3000
rule permit ip source 192.168.10.11 0
rule permit ip source 192.168.20.222 0 destination 192.168.10.111 0配置策略流應用到全局：
traffic classifier 3000 operator and
if-match acl 3000
q
traffic behavior 3000
traffic classifier 3001 operator and
if-match acl 3001
q
traffic behavior 3001以上2臺核心交換機配置一樣
sw1：
traffic policy yunxu
classifier 3000 behavior 3000
classifier 3001 behavior 3001
traffic-policy yunxu global inbound
backup：
traffic policy yunxu-backup
classifier 3000 behavior 3000
classifier 3001 behavior 3001
traffic-policy yunxu-backup global inbound設置端口組：
port-group g1-24
port-group group-member g0/0/1 to g0/0/24
port link-type trunk
port trunk allow-pass vlan all配置端口聚合，將2臺核心交換機通過線路捆綁：
interface Eth-Trunk 1
trunkport GigabitEthernet 0/0/10 to 0/0/12
port link-type trunk
port trunk allow-pass vlan 2 to 4094以上2臺核心交換機配置一樣
配置vrrp，防止核心交換單點故障：
[sw1] 主走vlan10 vlan20，備走vlan30 vlan40
int vlan 10
vrrp vrid 10 virtual-ip 192.168.10.100
vrrp vrid 10 priority 150
vrrp vrid 10 track interface g0/0/24 reduced 100
int vlan 20
vrrp vrid 20 virtual-ip 192.168.20.100
vrrp vrid 20 priority 150
vrrp vrid 20 track interface g0/0/24 reduced 100
int vlan 30
vrrp vrid 30 virtual-ip 192.168.30.100
int vlan 40
vrrp vrid 40 virtual-ip 192.168.40.100[backup] 主走vlan30 vlan40，備走vlan10 vlan 20
int vlan 10
vrrp vrid 10 virtual-ip 192.168.10.100
int vlan 20
vrrp vrid 20 virtual-ip 192.168.20.100
int vlan 30
vrrp vrid 30 virtual-ip 192.168.30.100
vrrp vrid 30 priority 150
vrrp vrid 30 track interface g0/0/24 reduced 100
int vlan 40
vrrp vrid 40 virtual-ip 192.168.40.100
vrrp vrid 40 priority 150
vrrp vrid 40 track interface g0/0/24 reduced 100注：各vlan下設備網關配置爲各自的虛擬ip。如果配置vlan ip的話當主出現故障將無法訪問外網；配置虛擬ip就算主出現故障，數據會通過備出去，不影響上網。