要求:
1,PC1,PC2,PC3互通
2,配置ACL限制PC2不能訪問PC3

1,首先規(guī)劃好IP,配置如上圖

SW2配置
#
vlan batch 10 20
#
interface Vlanif10
ip address 10.1.1.1 255.255.255.0
#
interface Vlanif20
ip address 20.1.1.1 255.255.255.0
#
interface GigabitEthernet0/0/1
port link-type access
port default vlan 10
#
interface GigabitEthernet0/0/2
port link-type access
port default vlan 10
#
interface GigabitEthernet0/0/3
port link-type trunk
port trunk pvid vlan 20//修改PVID為20(不修改ping不通路由器!!!)
port trunk allow-pass vlan 10 20
#
ip route-static 30.1.1.0 255.255.255.0 20.1.1.2
AR1配置
#
interface GigabitEthernet0/0/0
ip address 20.1.1.2 255.255.255.0
#
interface GigabitEthernet0/0/1
ip address 30.1.1.1 255.255.255.0
#
ip route-static 0.0.0.0 0.0.0.0 20.1.1.1
驗(yàn)證:

2,配置ACL限制訪問流量
AR1配置
#
acl number 2000//建立ACL2000
rul 5 deny source 10.1.1.3 0.0.0.0//規(guī)則5拒絕源IP10.1.1.3
rule 10 permit//規(guī)則10允許所有
#
interface GigabitEthernet0/0/0
traffic-filter inbound acl 2000//接口下入方向調(diào)用ACL2000
配置完成
驗(yàn)證:PC1可以ping通30.1.1.2,PC2無法ping通30.1.1.2

========================================
作者:暖巷尋故人

浙公網(wǎng)安備 33010602011771號(hào)