求助，acl配置的问题

草原土狼

拓扑要求是：不允许pc3、pc4访问pc2
目前的问题是：在0/13口上加ac l：jinzhi-pc2 的in方向，ac l不起作用。pc3、pc4仍可以ping通pc2.
请问如何解决？

核心交换配置如下：

ESW2#show run
Building configuration...

Current configuration : 2660 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
no service dhcp
!
hostname ESW2
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
no ip icmp rate-limit unreachable
!
!
ip cef
no ip domain lookup

!
!
!
!
vtp file nvram:vlan.dat

!
!
ip tcp synwait-time 5
!
!
!
!         
!
interface FastEthernet0/0
description *** Unused for Layer2 EtherSwitch ***
shutdown
!
interface FastEthernet0/1
description *** Unused for Layer2 EtherSwitch ***
switchport mode trunk
!
interface FastEthernet0/2
switchport mode trunk
!
interface FastEthernet0/3
switchport mode trunk
!
interface FastEthernet0/4
!
interface FastEthernet0/5
!
interface FastEthernet0/6
!
interface FastEthernet0/7
!         
interface FastEthernet0/8
!
interface FastEthernet0/9
!
interface FastEthernet0/10
!
interface FastEthernet0/11
!
interface FastEthernet0/12
switchport mode trunk
!
interface FastEthernet0/13
switchport mode trunk
ip access-group jinzhi-pc2 in
!
interface FastEthernet0/14
switchport mode trunk
!
interface FastEthernet0/15
switchport mode trunk
!
interface Vlan1
ip address 192.168.1.100 255.255.255.0
!         
interface Vlan2
ip address 192.168.2.100 255.255.255.0
!
interface Vlan3
ip address 192.168.3.100 255.255.255.0
!
interface Vlan4
ip address 192.168.4.1 255.255.255.0
!
router rip
version 2
network 192.168.1.0
network 192.168.2.0
network 192.168.3.0
network 192.168.4.0
no auto-summary
!
no ip http server
no ip http secure-server
!


ip access-list extended jinzhi-pc2
deny   ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
deny   ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255
permit ip any any
ip access-list extended jinzhi-pc3
deny   ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
deny   ip 192.168.3.0 0.0.0.255 192.168.2.0 0.0.0.255
permit ip any any
no cdp log mismatch duplex
!

long_q_jiao

应用的方向是不是搞错了。

草原土狼

long_q_jiao 发表于 2020-6-6 23:04
应用的方向是不是搞错了。

应该怎么配置，命令是？

六号种子选手

1111111

草原土狼

加载svi 1的out方向就对了

wu210064

学习了

a01541681680

你的來源目的打反了,另外這種情況不該用out

用in會比較恰當且簡單
在你的core上面打
ip access-list extented 101
  10 deny icmp  host 192.168.1.2 host 192.168.2.2 icmp-reply
  20 deny icmp  host 192.168.1.2 host 192.168.3.2 icmp-reply
  30 permit ip any any
最後套用在vlan1上
ip access-group 101 in

或是你要用wild card寫一筆都隨便你

yykxia

扩展ACL不需要添加ICMP协议端口吗？