使用三层交换机的ACL实现不同vlan间的隔离

使用三层交换机的ACL实现不同vlan间的隔离

 

建立三个vlan vlan10 vlan20 vlan30    www.2cto.com  

PC1 PC3属于vlan10 PC2 PC4属于vlan20   PC5属于vlan30

Vlan10 vlan20 vlan30不能互访 但是能上外网

Pc1 :172.16.10.2    pc2: 172.16.20.2 pc3:172.16.10.3    pc4:172.16.20.3 pc5: 172.16.30.2

 

 

配置R1

Int f0/0

Ip add 192.168.1.2 255.255.255.0 配置f0/0

No sh

Int lo0

Ip add 1.1.1.1 255.255.255.0      配置环回地址 以测试各vlan与外网的连通性

No sh

配置静态路由 到三层交换机各vlan的路由

# ip route 172.16.10.0 255.255.255.0 192.168.1.1 

# ip route 172.16.20.0 255.255.255.0 192.168.1.1

# ip route 172.16.30.0 255.255.255.0 192.168.1.1

 

配置 SW1

#conf t

#ip routing                     启用三层路由功能

#int f0/0

#no switch

#ip add 192.168.1.1 255.255.255.0

#no sh

#

#ip route 0.0.0.0 0.0.0.0 192.168.1.2 添加到外部网络的默认路由

#

#vlan data

#vlan 10 name caiwu             建立vlan

#vlan 20 name it

#vlan 30 name manager

#vtp server                     建立vtp server模式

#vtp domain cisco

#

#int range f0/1 – 2              封装trunk接口

#sw mode trunk

#sw trunk en dot1q

#

#int f0/3                     添加接口到vlan 30

#sw mode access

#sw access vlan 30

#

#int vlan10                        给各vlan设置地址 也是各个子网段的网关

ip address 172.16.10.1 255.255.255.0

# interface Vlan20

 ip address 172.16.20.1 255.255.255.0

# interface Vlan30

 ip address 172.16.30.1 255.255.255.0

#

# access-list 100 deny   ip 172.16.10.0 0.0.0.255 172.16.20.0 0.0.0.255   建立100 101列表

access-list 100 deny   ip 172.16.10.0 0.0.0.255 172.16.30.0 0.0.0.255

access-list 100 permit ip any any

access-list 101 deny   ip 172.16.20.0 0.0.0.255 172.16.10.0 0.0.0.255

access-list 101 deny   ip 172.16.20.0 0.0.0.255 172.16.30.0 0.0.0.255

access-list 101 permit ip any any

access-list 102 deny ip 172.16.30.0 0.0.0.255 172.16.10.0 0.0.0.255

access-list 102 deny ip 172.16.30.0 0.0.0.255 172.16.30.0 0.0.0.255

access-list 102 permit ip any any

 

 注：在vlan间的acl中当源地址段为应用 vlan接口的ip段时，就是用in方向；当目的地址段为应用vlan接口的ip段时，就是用out方向          举例说明

Host 1.1.1.1     vlan10（1.1.1.2）SW vlan20（2.2.2.2）     host 2.2.2.1

禁止host 1.1.1.1访问2.2.2.1

方法 一

Access-list 100 deny ip host 1.1.1.1 host 2.2.2.1

Access-list 100 permit ip any any

Int vlan 10

Ip access-list 100 in

方法 二

Access-list 100 deny ip host 1.1.1.1 host 2.2.2.1

Access-list 100 permit ip any any

Int vlan 20

Ip access-list 100 out

 

 

#int vlan 10                将访问控制列表加载到各个vlan

#ip access-group 100 in

#int vlan 20

#ip access-group 101 in

#int vlan 30

Ip access-group 102 in 

配置 SW2

#int f0/0

#sw m trunk

#sw t en dot1q

#

#vlan data

#vtp client

#vtp domain cisco

#

#int f0/1

#sw m acce

#sw access vlan 10

#int f0/2

#sw m acce

#sw access vlan 20

#

 

SW3 同上