ACL访问控制列表实验

实验目的

192.168.1.0和192.168.2.0之间无法访问，但均能访问10.10.10.1服务器

实验拓扑

实验过程

1. 配置全网互通
PC1

PC2

Server1服务器配置

R1配置接口地址
此配置是实验配置前提：全网互通

<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]un in en #关闭系统提示
Info: Information center is disabled.
[Huawei]sysname R1
[R1]interface GigabitEthernet 0/0/0
[R1-GigabitEthernet0/0/0]ip addr 192.168.1.254 24
[R1-GigabitEthernet0/0/0]quit
[R1]interface GigabitEthernet 0/0/1
[R1-GigabitEthernet0/0/1]ip add	
[R1-GigabitEthernet0/0/1]ip address 192.168.2.254 24
[R1-GigabitEthernet0/0/1]quit
[R1]int g0/0/2
[R1-GigabitEthernet0/0/2]ip address 10.10.10.254 24

PC测试
PC1能ping通PC2和Server1

R1配置ACL

[R1]acl 3000
[R1-acl-adv-3000]rule 5 deny ip source 192.168.1.0 0.0.0.255 destination 192.168
.2.0 0.0.0.255
[R1-acl-adv-3000]quit
[R1]int g0/0/0
[R1-GigabitEthernet0/0/0]traffic-filter inbound acl 3000
[R1-GigabitEthernet0/0/0]q
[R1]acl 3001
[R1-acl-adv-3001]rule 5 deny ip source 192.168.2.0 0.0.0.255 destination 192.16
8.1.0 0.0.0.255
[R1-acl-adv-3001]quit
[R1]int g0/0/1
[R1-GigabitEthernet0/0/1]traffic-filter inbound acl 3001

PC测试
PC1和PC2无法互通
pc1能访问Server1
pc2能访问Server1