1 实验说明
搭建三层交换机,利用 ACL 实现 vlan 10 与 vlan 30 不能通信,但是 vlan 20 与 vlan 10、vlan 30 可以通信。
2 实验
命令设置:
# LSW1
<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]vlan 10
[Huawei-vlan10]q
[Huawei]vlan 20
[Huawei-vlan20]q
[Huawei]vlan 30
[Huawei-vlan30]q
[Huawei]interface Vlanif 10
[Huawei-Vlanif10]ip address 192.168.1.254 255.255.255.0
[Huawei-Vlanif10]q
[Huawei]interface Vlanif 20
[Huawei-Vlanif20]ip address 192.168.2.254 255.255.255.0
[Huawei-Vlanif20]q
[Huawei]interface Vlanif 30
[Huawei-Vlanif30]ip address 192.168.3.254 255.255.255.0
[Huawei-Vlanif30]q
[Huawei]int g 0/0/1
[Huawei-GigabitEthernet0/0/1]port link-type trunk
[Huawei-GigabitEthernet0/0/1]port trunk allow-pass
[Huawei-GigabitEthernet0/0/1]q
[Huawei]acl name test ?
INTEGER<2000-2999> Basic access-list(add to current using rules)
INTEGER<3000-3999> Advanced access-list(add to current using rules)
INTEGER<4000-4999> Specify a L2 acl group
INTEGER<5000-5999> User defined access-list
advance Advanced ACL
basic Basic ACL
link Link ACL
user User ACL
<cr>
[Huawei]acl name test
[Huawei-acl-adv-test]rule deny ip source 192.168.1.0 0.0.0.255 destination 192.1
68.3.0 0.0.0.255
[Huawei-acl-adv-test]rule permit ip source any destination any
[Huawei-acl-adv-test]q
[Huawei]int g 0/0/1
[Huawei-GigabitEthernet0/0/1]traffic-filter inbound acl name test
Total nonempty ACL number is 1
Advanced ACL test 3999, 2 rules
Acl's step is 5
rule 5 deny ip source 192.168.1.0 0.0.0.255 destination 192.168.3.0 0.0.0.255
rule 10 permit ip
[Huawei] User interface con0 is available
# LSW2
<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]vlan 10
[Huawei-vlan10]q
[Huawei]vlan 20
[Huawei-vlan20]q
[Huawei]vlan 30
[Huawei-vlan30]q
[Huawei]int g 0/0/1
[Huawei-GigabitEthernet0/0/1]port link-type access
[Huawei-GigabitEthernet0/0/1]port default vlan 10
[Huawei-GigabitEthernet0/0/1]q
[Huawei]int g 0/0/2
[Huawei-GigabitEthernet0/0/2]port link-type access
[Huawei-GigabitEthernet0/0/2]port default vlan 20
[Huawei-GigabitEthernet0/0/2]q
[Huawei]int g 0/0/3
[Huawei-GigabitEthernet0/0/3]port link-type access
[Huawei-GigabitEthernet0/0/3]port default vlan 30
[Huawei-GigabitEthernet0/0/3]q
[Huawei]int g 0/0/4
[Huawei-GigabitEthernet0/0/4]port link-type trunk
[Huawei-GigabitEthernet0/0/4]port trunk allow-pass vlan all
[Huawei-GigabitEthernet0/0/4]q
3 测试