1. 程式人生 > >通過acl限制vlan間通訊

通過acl限制vlan間通訊

拓撲:
這裡寫圖片描述

目標:
1、pc1和pc2互信通訊
2、pc2和pc3互信通訊
3、pc1和pc3無法通訊

建立acl

acl 3000
rule 1 deny ip source 172.16.10.0 0.0.0.255 destination 172.16.30.0 0.0.0.255 

應用acl


[Huawei]interface  GigabitEthernet 0/0/3

[Huawei-GigabitEthernet0/0/3] undo traffic-filter outbound acl 3000

附錄:
交換機配置

[Huawei]display  current-configuration 
#
sysname Huawei # vlan batch 10 20 30 # cluster enable ntdp enable ndp enable # drop illegal-mac alarm # diffserv domain default # acl number 3000 rule 1 deny ip source 172.16.10.0 0.0.0.255 destination 172.16.30.0 0.0.0.255 # drop-profile default # aaa authentication-scheme default authorization-scheme default accounting-scheme default
domain default domain default_admin local-user admin password simple admin local-user admin service-type http # interface Vlanif1 # interface Vlanif10 ip address 172.16.10.1 255.255.255.0 # interface Vlanif20 ip address 172.16.20.1 255.255.255.0 # interface Vlanif30 ip address 172.16.30.1 255.255.255
.0 # interface MEth0/0/1 # interface GigabitEthernet0/0/1 port link-type access port default vlan 10 # interface GigabitEthernet0/0/2 port link-type access port default vlan 20 # interface GigabitEthernet0/0/3 port link-type access port default vlan 30 traffic-filter outbound acl 3000 # interface GigabitEthernet0/0/4 # interface GigabitEthernet0/0/5 # interface GigabitEthernet0/0/6 # interface GigabitEthernet0/0/7 # interface GigabitEthernet0/0/8 # interface GigabitEthernet0/0/9 # interface GigabitEthernet0/0/10 # interface GigabitEthernet0/0/11 # interface GigabitEthernet0/0/12 # interface GigabitEthernet0/0/13 # interface GigabitEthernet0/0/14 # interface GigabitEthernet0/0/15 # interface GigabitEthernet0/0/16 # interface GigabitEthernet0/0/17 # interface GigabitEthernet0/0/18 # interface GigabitEthernet0/0/19 # interface GigabitEthernet0/0/20 # interface GigabitEthernet0/0/21 # interface GigabitEthernet0/0/22 # interface GigabitEthernet0/0/23 # interface GigabitEthernet0/0/24 # interface NULL0 # user-interface con 0 user-interface vty 0 4 # return