实验
实验要求
全网互通
配置acl使得vlan10和vlan20不通
配置acl使得R1不能访问server
1.配置各个主机及server的IP子网和网关
2.配置交换机SW
<Huawei>sys
[Huawei]sys SW
[SW]vlan batch 10 20
[SW]int e0/0/1
[SW-Ethernet0/0/1]p l a
[SW-Ethernet0/0/1]p d v 10
[SW-Ethernet0/0/1]int e0/0/2
[SW-Ethernet0/0/2]p l a
[SW-Ethernet0/0/2]p d v 20
[SW-Ethernet0/0/2]int e0/0/3
[SW-Ethernet0/0/3]p l a
[SW-Ethernet0/0/3]p d v 10
[SW-Ethernet0/0/3]int e0/0/4
[SW-Ethernet0/0/4]p l a
[SW-Ethernet0/0/4]p d v 20
[SW-Ethernet0/0/4]int e0/0/5
[SW-Ethernet0/0/5]p l t
[SW-Ethernet0/0/5]p t a v a
[SW-Ethernet0/0/5]
3.配置路由器R3
Huawei>sys
[Huawei]sys R3
[R3]vlan batch 10 20
[R3]
[R3]int g0/0/1
[R3-GigabitEthernet0/0/1]ip add 10.0.0.1 24
[R3-GigabitEthernet0/0/1]int g0/0/0.1
[R3-GigabitEthernet0/0/0.1]ip add 192.168.1.254 24
[R3-GigabitEthernet0/0/0.1]d t v 10
[R3-GigabitEthernet0/0/0.1]a b e
[R3-GigabitEthernet0/0/0.1]int g0/0/0.2
[R3-GigabitEthernet0/0/0.2]ip add 192.168.2.254 24
[R3-GigabitEthernet0/0/0.2]d t v 20
[R3-GigabitEthernet0/0/0.2]a b e
[R3]acl 3000
[R3-acl-adv-3000]rule deny ip source 192.168.1.0 0.0.0.255 destination 192.168.2
.0 0.0.0.255
[R3]int g0/0/0.2
[R3-GigabitEthernet0/0/0.2]traffic-filter outbound acl 3000
[R3]acl 3001
[R3-acl-adv-3001]rule deny tcp source any destination 20.0.0.1 0 destination-por
t eq 80
[R3-acl-adv-3001]int g0/0/1
[R3-GigabitEthernet0/0/1]traffic-filter outbound acl 3001
[R3-GigabitEthernet0/0/1]
4.配置路由器R4
<Huawei>sys
[Huawei]sys R4
[R4]int g0/0/1
[R4-GigabitEthernet0/0/1]ip add 10.0.0.2 24
[R4-GigabitEthernet0/0/1]int g0/0/1
[R4-GigabitEthernet0/0/1]ip add 20.0.0.254 24
[R4-GigabitEthernet0/0/1]q
[R4]ip route-static 192.168.1.0 24 10.0.0.1
[R4]ip route-static 192.168.2.0 24 10.0.0.1
[R4]
5.测试
ACL配置前
ACL配置后