我现在是在3324SRI上分了5个VLAN,现在把192.168.21.0/24,192.168.22.0/24,192.168.24.0/24,192.168.25.0/24这四个网段可以和192.168.3.0/24网段的机器互相通讯而不允许和192.168.23.0/24网段的机器互相访问.
config vlan default delete 1-12
create vlan vlan1 tag 10
create vlan vlan2 tag 20
create vlan vlan3 tag 30
create vlan vlan4 tag 40
create vlan vlan5 tag 50
create vlan vlan6 tag 60
config vlan vlan1 add untagged 1-2
config vlan vlan2 add untagged 3-4
config vlan vlan3 add untagged 5
config vlan vlan4 add untagged 7-8
config vlan vlan5 add untagged 9-10
config vlan vlan6 add untagged 11-12
create ipif if_vlan1 192.168.21.253/24 vlan1 state enable
create ipif if_vlan2 192.168.22.253/24 vlan2 state enable
create ipif if_vlan3 192.168.23.253/24 vlan3 state enable
create ipif if_vlan4 192.168.24.253/24 vlan4 state enable
create ipif if_vlan5 192.168.25.253/24 vlan5 state enable
create ipif if_vlan6 192.168.3.253/24 vlan6 state enable
create access_profile ip source_ip_mask 255.255.255.0 destination_ip_mask 255.255.255.0 profile_id 10
config access_profile profile_id 10 add access_id 10 ip source_ip 192.168.23.253 destination_ip 192.168.21.253 port 1- 5 deny
config access_profile profile_id 10 add access_id 20 ip source_ip 192.168.23.253 destination_ip 192.168.22.253 port 1- 5 deny
后面以此类推
转载于:https://blog.51cto.com/justsoso/440732