ACL配置问题

richard_kuo

大家好，我在做ACL应用时，遇到一些问题，希望大家帮我检查一下，看看出了什么问题。
实验目的如下：

-         Network 10.10.30.0 cannot access the web-server in 10.10.10.0network

-         Network 10.10.20.0 can access the web-server in 10.10.10.0 network

-         Network 10.10.10.0 can access the webserver in 10.10.20.0 network

-         Network 10.10.10.0 can ping to the outside

-         The outside networks cannot ping 10.10.10.0 network

路由器配置如下：
interface GigabitEthernet0/0
description the link to pc0
ip address 10.10.10.1 255.255.255.0
ip access-group server1permission in
duplex auto
speed auto
!
interface GigabitEthernet0/1
ip address 10.10.20.1 255.255.255.0
ip access-group server0permission in
duplex auto
speed auto
!
interface GigabitEthernet0/2
ip address 10.10.30.1 255.255.255.0
duplex auto
speed auto
!
interface Serial0/0/0
no ip address
clock rate 2000000
shutdown
!
interface Serial0/0/1
no ip address
clock rate 2000000
shutdown
!
interface Vlan1
no ip address
shutdown
!
ip classless
!
ip flow-export version 9
!
!
ip access-list extended server1permission
permit tcp 10.10.20.0 0.0.0.3 host 10.10.10.100 eq www
ip access-list extended server0permission
permit icmp 10.10.10.0 0.0.0.3 10.10.20.0 0.0.0.3
permit tcp 10.10.10.0 0.0.0.3 host 10.10.20.100 eq www
permit udp 10.10.10.0 0.0.0.3 host 10.10.20.100
!
!
!
!
!
!
line con 0
!
line aux 0
!
line vty 0 4
login
!
!
!
end

拓扑图已经上传附件了，请大家看看，先谢谢啦！

richard_kuo

请高手指正下，非常感谢！

yuypei

来学习学习

a01541681680

interface vlan 10
ip access-group 101 in
        10 permit tcp 10.10.10.0 0.0.0.255 10.10.20.0 0.0.0.255 eq www
        20 permit tcp 10.10.10.0 0.0.0.255 eq www 10.10.20.0 0.0.0.255
        30 permit icmp 10.10.10.0 0.0.0.255 10.10.40.0 0.0.0.255 echo
        40 deny tcp 10.10.10.0 0.0.0.255 eq www 10.10.30.0 0.0.0.255
        50 deny icmp 10.10.10.0 0.0.0.255 10.10.40.0 0.0.0.255 echo-reply
        60 permit ip any any


-         Network 10.10.10.0 can access the webserver in 10.10.20.0 network
-         Network 10.10.20.0 can access the web-server in 10.10.10.0 network
-         Network 10.10.10.0 can ping to the outside
-         Network 10.10.30.0 cannot access the web-server in 10.10.10.0network
-         The outside networks cannot ping 10.10.10.0 network



你的outside我不知道你指哪邊 拓樸沒看到
我就假設 ouside 是10.10.40.0