使用三層
交換機的ACL實現不同vlan間的隔離
建立三個vlan vlan10 vlan20 vlan30 www.2cto.com
PC1 PC3屬於vlan10 PC2 PC4屬於vlan20 PC5屬於vlan30
Vlan10 vlan20 vlan30不能互訪 但是能上外網
Pc1 :172.16.10.2 pc2: 172.16.20.2 pc3:172.16.10.3 pc4:172.16.20.3 pc5: 172.16.30.2
配置R1
Int f0/0
Ip add 192.168.1.2 255.255.255.0 配置f0/0
No sh
Int lo0
Ip add 1.1.1.1 255.255.255.0 配置環回地址 以測試各vlan與外網的連通性
No sh
配置靜態路由 到三層交換機各vlan的路由
# ip route 172.16.10.0 255.255.255.0 192.168.1.1
# ip route 172.16.20.0 255.255.255.0 192.168.1.1
# ip route 172.16.30.0 255.255.255.0 192.168.1.1
配置 SW1
#conf t
#ip routing 啟用三層路由功能
#int f0/0
#no switch
#ip add 192.168.1.1 255.255.255.0
#no sh
#
#ip route 0.0.0.0 0.0.0.0 192.168.1.2 添加到外部
網絡的默認路由
#
#vlan data
#vlan 10 name caiwu 建立vlan
#vlan 20 name it
#vlan 30 name manager
#vtp server 建立vtp server模式
#vtp domain cisco
#
#int range f0/1 – 2 封裝trunk接口
#sw mode trunk
#sw trunk en dot1q
#
#int f0/3 添加接口到vlan 30
#sw mode access
#sw access vlan 30
#
#int vlan10 給各vlan設置地址 也是各個子網段的網關
ip address 172.16.10.1 255.255.255.0
# interface Vlan20
ip address 172.16.20.1 255.255.255.0
# interface Vlan30
ip address 172.16.30.1 255.255.255.0
#
# access-list 100 deny ip 172.16.10.0 0.0.0.255 172.16.20.0 0.0.0.255 建立100 101列表
access-list 100 deny ip 172.16.10.0 0.0.0.255 172.16.30.0 0.0.0.255
access-list 100 permit ip any any
access-list 101 deny ip 172.16.20.0 0.0.0.255 172.16.10.0 0.0.0.255
access-list 101 deny ip 172.16.20.0 0.0.0.255 172.16.30.0 0.0.0.255
access-list 101 permit ip any any
access-list 102 deny ip 172.16.30.0 0.0.0.255 172.16.10.0 0.0.0.255
access-list 102 deny ip 172.16.30.0 0.0.0.255 172.16.30.0 0.0.0.255
access-list 102 permit ip any any
注：在vlan間的acl中當源地址段為應用 vlan接口的ip段時，就是用in方向；當目的地址段為應用vlan接口的ip段時，就是用out方向 舉例說明
Host 1.1.1.1 vlan10（1.1.1.2）SW vlan20（2.2.2.2） host 2.2.2.1
禁止host 1.1.1.1訪問2.2.2.1
方法 一
Access-list 100 deny ip host 1.1.1.1 host 2.2.2.1
Access-list 100 permit ip any any
Int vlan 10
Ip access-list 100 in
方法 二
Access-list 100 deny ip host 1.1.1.1 host 2.2.2.1
Access-list 100 permit ip any any
Int vlan 20
Ip access-list 100 out
#int vlan 10 將訪問控制列表加載到各個vlan
#ip access-group 100 in
#int vlan 20
#ip access-group 101 in
#int vlan 30
Ip access-group 102 in
配置 SW2
#int f0/0
#sw m trunk
#sw t en dot1q
#
#vlan data
#vtp client
#vtp domain cisco
#
#int f0/1
#sw m acce
#sw access vlan 10
#int f0/2
#sw m acce
#sw access vlan 20
#
SW3 同上