interface FastEthernet0/0
no ip address
duplex auto
speed auto
!
interface FastEthernet0/0.1
encapsulation isl 11
ip address 192.168.0.1 255.255.255.0
ip access-group v11 in
interface FastEthernet0/0.2
encapsulation isl 10
ip address 172.16.1.1 255.255.255.0
ip access-group v10 in
interface FastEthernet0/1
ip address 10.10.10.9 255.255.255.0
ip access-group v13 in

ip route 0.0.0.0 0.0.0.0 10.10.10.10

ip access-list extended v10
permit ip 172.16.1.0 0.0.0.255 172.18.0.0 0.0.255.255 reflect v133
permit tcp 172.16.1.0 0.0.0.255 172.18.0.0 0.0.255.255 reflect v133
permit udp 172.16.1.0 0.0.0.255 172.18.0.0 0.0.255.255 reflect v133
permit icmp 172.16.1.0 0.0.0.255 172.18.0.0 0.0.255.255 reflect v133
permit ip 172.16.1.0 0.0.0.255 192.168.0.0 0.0.0.255 reflect v111
permit tcp 172.16.1.0 0.0.0.255 192.168.0.0 0.0.0.255 reflect v111
permit udp 172.16.1.0 0.0.0.255 192.168.0.0 0.0.0.255 reflect v111
permit icmp 172.16.1.0 0.0.0.255 192.168.0.0 0.0.0.255 reflect v111
permit ip any any
ip access-list extended v11
evaluate v111
deny ip 192.168.0.0 0.0.0.255 172.16.1.0 0.0.0.255
deny icmp 192.168.0.0 0.0.0.255 172.16.1.0 0.0.0.255
deny udp 192.168.0.0 0.0.0.255 172.16.1.0 0.0.0.255
deny tcp 192.168.0.0 0.0.0.255 172.16.1.0 0.0.0.255
permit ip 192.168.0.0 0.0.0.255 172.18.0.0 0.0.255.255 reflect v133
permit udp 192.168.0.0 0.0.0.255 172.18.0.0 0.0.255.255 reflect v133
permit icmp 192.168.0.0 0.0.0.255 172.18.0.0 0.0.255.255 reflect v133
permit tcp 192.168.0.0 0.0.0.255 172.18.0.0 0.0.255.255 reflect v133
permit ip any any
ip access-list extended v13
evaluate v133
deny icmp 172.18.0.0 0.0.255.255 172.16.1.0 0.0.0.255
deny ip 172.18.0.0 0.0.255.255 172.16.1.0 0.0.0.255
deny udp 172.18.0.0 0.0.255.255 172.16.1.0 0.0.0.255
deny tcp 172.18.0.0 0.0.255.255 172.16.1.0 0.0.0.255
deny icmp 172.18.0.0 0.0.255.255 192.168.0.0 0.0.0.255
deny ip 172.18.0.0 0.0.255.255 192.168.0.0 0.0.0.255
deny tcp 172.18.0.0 0.0.255.255 192.168.0.0 0.0.0.255
deny udp 172.18.0.0 0.0.255.255 192.168.0.0 0.0.0.255
permit ip any any
ip access-list logging interval 100

以上配置實現(xiàn)三個等級的網(wǎng)段訪問，使用于企業(yè)的總經(jīng)理、財務(wù)、員工三個網(wǎng)段

測試方法：
配置完成之后，在不同網(wǎng)段使用ping命令開兩個窗口，分別ping其他兩個網(wǎng)段
這時在router 上用sh ip access-l 查看有沒有產(chǎn)生你所需要的acl，如果沒有，查看是哪一條acl起效（根據(jù)acl后面的條目數(shù)，ping的過程會有一個acl的條目逐漸增加）

文章錄入：csh    責(zé)任編輯：csh 

最新評論