|
建立三個vlan vlan10 vlan20 vlan30 PC1 PC3屬于vlan10 PC2 PC4屬于vlan20 PC5屬于vlan30 Vlan10 vlan20 vlan30不能互訪 但是能上外網(wǎng) Pc1 :172.16.10.2 pc2: 172.16.20.2 pc3:172.16.10.3 pc4:172.16.20.3 pc5: 172.16.30.2  配置R1 Int f0/0 Ip add 192.168.1.2 255.255.255.0 配置f0/0 No sh Int lo0 Ip add 1.1.1.1 255.255.255.0 配置環(huán)回地址 以測試各vlan與外網(wǎng)的連通性 No sh 配置靜態(tài)路由 到三層交換機(jī)各vlan的路由 # ip route 172.16.10.0 255.255.255.0 192.168.1.1 # ip route 172.16.20.0 255.255.255.0 192.168.1.1 # ip route 172.16.30.0 255.255.255.0 192.168.1.1 配置 SW1 #conf t #ip routing 啟用三層路由功能 #int f0/0 #no switch #ip add 192.168.1.1 255.255.255.0 #no sh # #ip route 0.0.0.0 0.0.0.0 192.168.1.2 添加到外部網(wǎng)絡(luò)的默認(rèn)路由 # #vlan data #vlan 10 name caiwu 建立vlan #vlan 20 name it #vlan 30 name manager #vtp server 建立vtp server模式 #vtp domain cisco # #int range f0/1 – 2 封裝trunk接口 #sw mode trunk #sw trunk en dot1q # #int f0/3 添加接口到vlan 30 #sw mode access #sw access vlan 30 # #int vlan10 給各vlan設(shè)置地址 也是各個子網(wǎng)段的網(wǎng)關(guān) ip address 172.16.10.1 255.255.255.0 # interface Vlan20 ip address 172.16.20.1 255.255.255.0 # interface Vlan30 ip address 172.16.30.1 255.255.255.0 # # access-list 100 deny ip 172.16.10.0 0.0.0.255 172.16.20.0 0.0.0.255 建立100 101列表 access-list 100 deny ip 172.16.10.0 0.0.0.255 172.16.30.0 0.0.0.255 access-list 100 permit ip any any access-list 101 deny ip 172.16.20.0 0.0.0.255 172.16.10.0 0.0.0.255 access-list 101 deny ip 172.16.20.0 0.0.0.255 172.16.30.0 0.0.0.255 access-list 101 permit ip any any access-list 102 deny ip 172.16.30.0 0.0.0.255 172.16.10.0 0.0.0.255 access-list 102 deny ip 172.16.30.0 0.0.0.255 172.16.30.0 0.0.0.255 access-list 102 permit ip any any 注：在vlan間的acl中當(dāng)源地址段為應(yīng)用 vlan接口的ip段時，就是用in方向；當(dāng)目的地址段為應(yīng)用vlan接口的ip段時，就是用out方向 舉例說明 Host 1.1.1.1 vlan10（1.1.1.2）SW vlan20（2.2.2.2） host 2.2.2.1 禁止host 1.1.1.1訪問2.2.2.1 方法 一 Access-list 100 deny ip host 1.1.1.1 host 2.2.2.1 Access-list 100 permit ip any any Int vlan 10 Ip access-list 100 in 方法 二 Access-list 100 deny ip host 1.1.1.1 host 2.2.2.1 Access-list 100 permit ip any any Int vlan 20 Ip access-list 100 out #int vlan 10 將訪問控制列表加載到各個vlan #ip access-group 100 in #int vlan 20 #ip access-group 101 in #int vlan 30 Ip access-group 102 in 配置 SW2 #int f0/0 #sw m trunk #sw t en dot1q # #vlan data #vtp client #vtp domain cisco # #int f0/1 #sw m acce #sw access vlan 10 #int f0/2 #sw m acce #sw access vlan 20 # SW3 同上
|
|
|
來自： 昵稱11935121 > 《未命名》
