09 Pro_ACL

1 实验说明

搭建三层交换机，利用 ACL 实现 vlan 10 与 vlan 30 不能通信，但是 vlan 20 与 vlan 10、vlan 30 可以通信。

2 实验

命令设置：

# LSW1
<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]vlan 10
[Huawei-vlan10]q
[Huawei]vlan 20
[Huawei-vlan20]q
[Huawei]vlan 30
[Huawei-vlan30]q
[Huawei]interface Vlanif 10
[Huawei-Vlanif10]ip address 192.168.1.254 255.255.255.0
[Huawei-Vlanif10]q
[Huawei]interface Vlanif 20
[Huawei-Vlanif20]ip address 192.168.2.254 255.255.255.0
[Huawei-Vlanif20]q
[Huawei]interface Vlanif 30
[Huawei-Vlanif30]ip address 192.168.3.254 255.255.255.0
[Huawei-Vlanif30]q
[Huawei]int g 0/0/1
[Huawei-GigabitEthernet0/0/1]port link-type trunk 
[Huawei-GigabitEthernet0/0/1]port trunk allow-pass 
[Huawei-GigabitEthernet0/0/1]q
[Huawei]acl name test ?
  INTEGER<2000-2999>  Basic access-list(add to current using rules)
  INTEGER<3000-3999>  Advanced access-list(add to current using rules)
  INTEGER<4000-4999>  Specify a L2 acl group
  INTEGER<5000-5999>  User defined access-list
  advance             Advanced ACL
  basic               Basic ACL
  link                Link ACL
  user                User ACL
  <cr>                

[Huawei]acl name test 
[Huawei-acl-adv-test]rule deny ip source 192.168.1.0 0.0.0.255 destination 192.1
68.3.0 0.0.0.255
[Huawei-acl-adv-test]rule permit ip source any destination any 
[Huawei-acl-adv-test]q
[Huawei]int g 0/0/1
[Huawei-GigabitEthernet0/0/1]traffic-filter inbound acl name test
 Total nonempty ACL number is 1 

Advanced ACL test 3999, 2 rules
Acl's step is 5
 rule 5 deny ip source 192.168.1.0 0.0.0.255 destination 192.168.3.0 0.0.0.255 
 rule 10 permit ip 

[Huawei] User interface con0 is available

# LSW2
<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]vlan 10
[Huawei-vlan10]q
[Huawei]vlan 20
[Huawei-vlan20]q
[Huawei]vlan 30
[Huawei-vlan30]q
[Huawei]int g 0/0/1
[Huawei-GigabitEthernet0/0/1]port link-type access 
[Huawei-GigabitEthernet0/0/1]port default vlan 10
[Huawei-GigabitEthernet0/0/1]q
[Huawei]int g 0/0/2
[Huawei-GigabitEthernet0/0/2]port link-type access 
[Huawei-GigabitEthernet0/0/2]port default vlan 20
[Huawei-GigabitEthernet0/0/2]q
[Huawei]int g 0/0/3
[Huawei-GigabitEthernet0/0/3]port link-type access 
[Huawei-GigabitEthernet0/0/3]port default vlan 30
[Huawei-GigabitEthernet0/0/3]q                     
[Huawei]int g 0/0/4
[Huawei-GigabitEthernet0/0/4]port link-type trunk 
[Huawei-GigabitEthernet0/0/4]port trunk allow-pass vlan all
[Huawei-GigabitEthernet0/0/4]q

3 测试