在firewall f100 和 switch5100上做的

firewall：
disp cur
system-view

acl 1000
rule 1 permit source 192.168.1.1 255.255.255.0
rule 2 permit source 192.168.2.1 255.255.255.0
rule 3 deny ip source any

user-interface vty 0 4
authenmode password
set authen password simple test

int e1
ip add 222.111.1.1 255.255.255.248
nat outbound 1000

int e0
no ip addr
int e0.1
ip addr 192.168.1.1 255.255.255.0
vlan-type dot1q vid 10
int e0.2
ip addr 192.168.2.1 255.255.255.0
vlan-type dot1q vid 20

ip route-static 0.0.0.0 0.0.0.0 222.111.1.1

write (or save)

switch:
system-view
vlan 10
vlan 20

int f0/0
port link-type trunk
port trunk permit vlan all

int f0/1
port link-type access
port access vlan 10

int f0/2
port link-type access
port access vlan 20