ACL的一个小问题

a86914689

用ACL禁止VLAN 3访问172.1.1.2。
其它配置都只配置了地址，ISP只配置了个RIP。主要的配置都在三层这。
三层配置：
Switch#show run
Building configuration...

Current configuration : 2583 bytes
!
version 12.2
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Switch
!
!
!
!
!
ip dhcp pool vlan2
network 192.168.1.0 255.255.255.0
default-router 192.168.1.254
ip dhcp pool vlan3
network 192.168.2.0 255.255.255.0
default-router 192.168.2.254
ip routing
!
interface FastEthernet0/1
no switchport
ip address 10.1.1.2 255.255.255.0
ip access-group 110 out
ip nat outside
duplex auto
speed auto
！
interface FastEthernet0/10
switchport access vlan 2
switchport mode access
!
interface FastEthernet0/11
switchport access vlan 2
switchport mode access
!
interface FastEthernet0/12
switchport access vlan 2
switchport mode access
!
interface FastEthernet0/13
switchport access vlan 2
switchport mode access
!
interface FastEthernet0/14
switchport access vlan 2
switchport mode access
!
interface FastEthernet0/15
switchport access vlan 2
switchport mode access
!
interface FastEthernet0/16
switchport access vlan 2
switchport mode access
!
interface FastEthernet0/17
switchport access vlan 2
switchport mode access
!
interface FastEthernet0/18
switchport access vlan 2
switchport mode access
!
interface FastEthernet0/19
switchport access vlan 2
switchport mode access
!
interface FastEthernet0/20
switchport access vlan 3
switchport mode access
!
interface FastEthernet0/21
switchport access vlan 3
switchport mode access
!
interface FastEthernet0/22
switchport access vlan 3
switchport mode access
!
interface FastEthernet0/23
switchport access vlan 3
switchport mode access
!
interface FastEthernet0/24
no switchport
ip address 192.168.3.1 255.255.255.0
ip access-group 100 out
duplex auto
speed auto
!
interface GigabitEthernet0/1
!
interface GigabitEthernet0/2
!
interface Vlan1
no ip address
shutdown
!
interface Vlan2
ip address 192.168.1.254 255.255.255.0
!
interface Vlan3
ip address 192.168.2.254 255.255.255.0
!
router rip
version 2
network 10.0.0.0
network 192.168.1.0
network 192.168.2.0
no auto-summary
!
ip classless
!
!
access-list 100 deny ip 192.168.1.0 0.0.0.255 host 192.168.3.2      这是我限制VLAN 3不能访问192.168.3.2
access-list 100 permit ip 192.168.2.0 0.0.0.255 host 192.168.3.2   
access-list 110 permit ip any any                                                       试了好多个命令，就是禁不了VLAN3访问172.1.1.2
access-list 110 deny ip 192.168.2.0 0.0.0.255 host 172.1.1.2
!
line con 0
line vty 0 4
login
!
!
!
end

a86914689

NA区里面没人回答，只能在NP区里看看了。

千寻蕊质

大哥，ACL是根据顺序从上往下匹配的啊，你要禁VLAN3访问的是第四条deny对吧，可是VLAN3的网段地址访问172那个地址时，先跟第三条permit any匹配了，那当然就通了，它就不会往下匹配了，所以你把三、四条顺序互换就OK了

千寻蕊质

你还做了NAT？

ming035

access-list 110 deny ip 192.168.2.0 0.0.0.255 host 172.1.1.2
access-list 110 permit ip any any   

int vlan 3
ip access-group 110 in
不知为什么,照你配置在pt不能做,主要是rip传不了路由, 在gns3做成功

a86914689

ming035 发表于 2013-6-13 00:45
access-list 110 deny ip 192.168.2.0 0.0.0.255 host 172.1.1.2
access-list 110 permit ip any any   
...

谢谢阿，我
no acc 110
int vlan 2
acc 110 in
之后就实现了我要的功能。

a86914689

千寻蕊质 发表于 2013-6-12 22:41
你还做了NAT？

是我指向有问题，我发现我没做。
int vlan 2 in
之后我no acc 110 竟然也是可以实现。。。

a86914689

千寻蕊质 发表于 2013-6-12 22:41
你还做了NAT？

NAT我没做的，刚开始有做的，之后发现没什么用，就NO掉了。

庄歪