各位大侠,我的网络中有 VLAN1 :10.100.1.0 VLAN2 :10.100.2.0 VLAN3:10.100.3.0 VLAN10:10.100.10.0 VLAN11:10.100.11.0 VLAN12:10.100.12.0 VLAN13:10.100.13.0 VLAN100:192.168.1.0 VLAN200:10.100.200.0
要求是1、 VLAN1只能和VLAN100通信 ,其他禁止通信 2、VLAN2和所有VLAN通信 3、VLAN3只和VLAN2和VLAN100通信,其他禁止通信,4、VLAN10只和VLAN2 VLAN100通信其他禁止通信 5、VLAN11只和VLAN2 VLAN100通信其他禁止通信 6、VLAN12只和VLAN2 VLAN100通信其他禁止通信 7、VLAN13只和VLAN2 VLAN100通信其他禁止通信 8、VLAN100禁止和VLAN200通信通信,其他都允许互相访问 9、VLAN200只和VLAN2通信 其他都禁止通信
这样我做了ACL流控制,问题是以上基本实现,VLAN间的用户按要求不能访问别的VLAN的用户,但是每个网段的用户都可以平通任何VLAN的网关,也就是10.100.1.1 10.100.3.1 10.100.10.1 10.100.11.1 10.100.12.1 10.100.13.1 10.100.200.1
不知道问题出在哪里,请好心人帮忙,另外配置贴在下面
!Software Version V200R010C00SPC600
#
sysname S9306
#
vlan batch 2 to 3 10 to 13 100 200
#
authentication-profile name default_authen_profile
authentication-profile name dot1x_authen_profile
authentication-profile name mac_authen_profile
authentication-profile name portal_authen_profile
authentication-profile name dot1xmac_authen_profile
authentication-profile name multi_authen_profile
#
telnet server enable
#
clock timezone UTC add 00:00:00
#
dhcp enable
#
diffserv domain default
#
radius-server template default
#
acl number 3000
rule 5 deny ip source 10.100.1.0 0.0.0.255 destination 10.100.3.0 0.0.0.255
rule 10 deny ip source 10.100.1.0 0.0.0.255 destination 10.100.10.0 0.0.0.255
rule 15 deny ip source 10.100.1.0 0.0.0.255 destination 10.100.11.0 0.0.0.255
rule 20 deny ip source 10.100.1.0 0.0.0.255 destination 10.100.12.0 0.0.0.255
rule 25 deny ip source 10.100.1.0 0.0.0.255 destination 10.100.13.0 0.0.0.255
rule 30 deny ip source 10.100.1.0 0.0.0.255 destination 10.100.200.0 0.0.0.255
acl number 3003
rule 5 deny ip source 10.100.3.0 0.0.0.255 destination 10.100.1.0 0.0.0.255
rule 10 deny ip source 10.100.3.0 0.0.0.255 destination 10.100.10.0 0.0.0.255
rule 15 deny ip source 10.100.3.0 0.0.0.255 destination 10.100.11.0 0.0.0.255
rule 20 deny ip source 10.100.3.0 0.0.0.255 destination 10.100.12.0 0.0.0.255
rule 25 deny ip source 10.100.3.0 0.0.0.255 destination 10.100.13.0 0.0.0.255
rule 30 deny ip source 10.100.3.0 0.0.0.255 destination 10.100.200.0 0.0.0.255
acl number 3010
rule 5 deny ip source 10.100.10.0 0.0.0.255 destination 10.100.1.0 0.0.0.255
rule 10 deny ip source 10.100.10.0 0.0.0.255 destination 10.100.3.0 0.0.0.255
rule 15 deny ip source 10.100.10.0 0.0.0.255 destination 10.100.11.0 0.0.0.255
rule 20 deny ip source 10.100.10.0 0.0.0.255 destination 10.100.12.0 0.0.0.255
rule 25 deny ip source 10.100.10.0 0.0.0.255 destination 10.100.13.0 0.0.0.255
rule 30 deny ip source 10.100.10.0