求解啊…关于CCNA中ACL的问题

小木子

三台PC(划分VLAN后分别属于V1.V2.V3)通过交换机连在一台路由器上，使用独臂路由实现了VLAN间通信，现在要求V1可以访问V3，V2不可以访问V3，请问怎么实现？求详解

a9812856

可以针对不同vlan的不同网段 ，在各自不同子接口的出方向上设置扩展ACL

yangguangjijie

创建标准acl（deny掉vlan2的地址)，在vlan3的出接口应用；ok！

xyfblog

参见：http://sjss128.blog.51cto.com/136827/163426/

jiazl88

小木子

yangguangjijie 发表于 2012-7-27 00:04
创建标准acl（deny掉vlan2的地址)，在vlan3的出接口应用；ok！

可以给我写下

小木子

yangguangjijie 发表于 2012-7-27 00:04
创建标准acl（deny掉vlan2的地址)，在vlan3的出接口应用；ok！

可以给我写下具体操作步骤吗，最好带命令，我是新手，谢了！

yangguangjijie

小木子 发表于 2012-7-27 09:45
可以给我写下具体操作步骤吗，最好带命令，我是新手，谢了！

int f0/0.1
encapsulation dot1Q 1
ip add 192.168.1.1 255.255.255.0
int f0/0.2
encapsulation dot1Q 2
ip add 192.168.2.1 255.255.255.0
int f0/0.3
encapsulation dot1Q 3
ip add 192.168.3.1 255.255.255.0
ip access-list standard 1
deny 192.168.2.0 0.0.0.255
int f0/0.3
ip access-group 1 out
个人愚见。。

aleser

yangguangjijie 发表于 2012-7-27 10:49
int f0/0.1
encapsulation dot1Q 1
ip add 192.168.1.1 255.255.255.0

ip access-list standard 1
deny 192.168.2.0 0.0.0.255
加上ip access-list 1 permit any

yg4638

Router#show run
Building configuration...

Current configuration : 818 bytes
!
version 12.4
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Router
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface FastEthernet0/0
no ip address
duplex auto
speed auto
!
interface FastEthernet0/0.10
encapsulation dot1Q 10
ip address 192.168.10.254 255.255.255.0
!
interface FastEthernet0/0.20
encapsulation dot1Q 20
ip address 192.168.20.254 255.255.255.0
!
interface FastEthernet0/0.30
encapsulation dot1Q 30
ip address 192.168.30.254 255.255.255.0
ip access-group 1 out
!
interface FastEthernet0/1
no ip address
duplex auto
speed auto
shutdown
!
interface Vlan1
no ip address
shutdown
!
ip classless
!
!
access-list 1 deny 192.168.20.0 0.0.0.255
access-list 1 permit any
!
!
!
!
!
line con 0
line vty 0 4
login
!
!
!
end


Router#



Switch#show run
Building configuration...

Current configuration : 1157 bytes
!
version 12.1
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Switch
!
!
!
interface FastEthernet0/1
switchport access vlan 10
switchport mode access
!
interface FastEthernet0/2
switchport access vlan 20
switchport mode access
!
interface FastEthernet0/3
switchport access vlan 30
switchport mode access
!
interface FastEthernet0/4
!
interface FastEthernet0/5
!
interface FastEthernet0/6
!
interface FastEthernet0/7
!
interface FastEthernet0/8
!
interface FastEthernet0/9
!
interface FastEthernet0/10
!
interface FastEthernet0/11
!
interface FastEthernet0/12
!
interface FastEthernet0/13
!
interface FastEthernet0/14
!
interface FastEthernet0/15
!
interface FastEthernet0/16
!
interface FastEthernet0/17
!
interface FastEthernet0/18
!
interface FastEthernet0/19
!
interface FastEthernet0/20
!
interface FastEthernet0/21
!
interface FastEthernet0/22
!
interface FastEthernet0/23
!
interface FastEthernet0/24
switchport mode trunk
!
interface Vlan1
no ip address
shutdown
!
interface Vlan20
no ip address
!
!
line con 0
!
line vty 0 4
login
line vty 5 15
login
!
!
end


Switch#

yangguangjijie

aleser 发表于 2012-7-27 14:28
ip access-list standard 1
deny 192.168.2.0 0.0.0.255
加上ip access-list 1 permit any

对，默认是deny所有的！！谢谢指正

我心如水

yg4638 发表于 2012-7-27 19:13
Router#show run
Building configuration...

不是应该用扩展的吗？
这样的话V1不是访不了V2了啊