ACL访问控制列表之实验一

实验要求：全网互通 配置ACL使得VLAN10和VLAN20不通 配置ACL是R1不能访问webserver

配置交换机SW1

[SW1]vlan batch 10 20
[SW1]int e0/0/1
[SW1-Ethernet0/0/1]p l a
[SW1-Ethernet0/0/1]p d v 10
[SW1-Ethernet0/0/1]int e0/0/2
[SW1-Ethernet0/0/2]p l a
[SW1-Ethernet0/0/2]p d v 20
[SW1-Ethernet0/0/2]int e0/0/3
[SW1-Ethernet0/0/3]p l a
[SW1-Ethernet0/0/3]p d v 10
[SW1-Ethernet0/0/3]int e0/0/4
[SW1-Ethernet0/0/4]p l a
[SW1-Ethernet0/0/4]p d v 20
[SW1-Ethernet0/0/4]int e0/0/5
[SW1-Ethernet0/0/5]p l t 
[SW1-Ethernet0/0/5]p t a v a

路由器R1的配置

[R1]vlan batch 10 20
[R1]int g0/0/0.1
[R1-GigabitEthernet0/0/0.1]ip address 192.168.1.254 24
[R1-GigabitEthernet0/0/0.1]d t v 10
[R1-GigabitEthernet0/0/0.1]a b e
[R1-GigabitEthernet0/0/0.1]int g0/0/0.2
[R1-GigabitEthernet0/0/0.2]ip add	
[R1-GigabitEthernet0/0/0.2]ip address 192.168.2.254 24
[R1-GigabitEthernet0/0/0.2]d t v 20
[R1-GigabitEthernet0/0/0.2]a b e
[R1-GigabitEthernet0/0/0.2]int g0/0/1
[R1-GigabitEthernet0/0/1]ip add	
[R1-GigabitEthernet0/0/1]ip address 192.168.4.1 24
[R1]ip route-static 192.168.3.0 24 192.168.4.2
[R1]acl 3000
[R1-acl-adv-3000]rule deny ip source 192.168.1.0 0.0.0.255 destination 192.168.2
.0 0.0.0.255
[R1-acl-adv-3000]int g0/0/0
[R1-GigabitEthernet0/0/0]traffic-filter outbound acl 3000

R2的配置

[R2]acl 3000
[R2-acl-adv-3000]rule deny icmp source 192.168.4.0 0.0.0.255 destination 192.168
.3.0 0.0.0.255
[R2-acl-adv-3000]int g0/0/1
[R2-GigabitEthernet0/0/1]traffic-filter outbound acl 3000

实验结果