三层交换机Vlan间ACL配置之我见

terryyw

小第不才,偶有原创,如需转载,请保留名号!

三层交换机配置三个vlan :
vlan 1:10.1.1.0 255.255.255.0
vlan 2:10.1.2.0 255.255.255.0
vlan 3:10.1.3.0 255.255.255.0

现要求:vlan 1不能访问vlan2,vlan3
acl 如下:
access-list 1 deny 10.1.2.0 0.0.0.255
access-list 1 deny 10.1.3.0 0.0.0.255
access-list 1 permit any

在vlan 1接口:
ip access-group 1 out


照上配置是:阻止源地址(即阻止来自vlan 2 vlan 3的流量访问vlan 1,从而达到vlan 1不能访问vlan2,vlan3)


如果要设置:vlan 2 valn 3可访问vlan 1 www服务,其他流量阻止.

如下:
access-list 108 permit tcp 10.1.2.0 0.0.0.255 any eq 80
access-list 108 permit tcp 10.1.3.0 0.0.0.255 any eq 80
access-list 108 deny ip 10.1.2.0 0.0.0.255 any
access-list 108 deny ip 10.1.3.0 0.0.0.255 any




但是如果在vlan 2 vlan 3的接口加入如下语句,
access-list 2 deny 10.1.1.0 0.0.0.255
access-list 2 permit any



access-list 3 deny 10.1.1.0 0.0.0.255
access-list 3 permit any


vlan 2 valn 3将不可再访问vlan 1 www服务.


.............................................................................................................................................................................
还是要求:vlan 1不能访问vlan2,vlan3

access-list 109 deny ip any 10.1.2.0 0.0.0.255
access-list 109 deny ip  any 10.1.3.0 0.0.0.255
access-list 109 permit  ip any any


加在vlan 1接口:
ip access-group 109 in


还没有验证过这个设置

.............................................................................................................
总结:在要求vlan间隔离时,就不要再搞什么容许你访问我的www,我访问你的ftp了,最好是新建一个vlan,将应用服务器放入其中,该vlan丝毫不掺入隔离.








本文来自ChinaUnix博客，如果查看原文请点：http://blog.chinaunix.net/u3/109345/showart_2141492.html