求助单向访问问题

zdzhsx

3560交换机 其中两个VLAN \r\nVLAN30:172.21.30.1/24和VLAN39:172.21.39.1/24\r\n要求VLAN39可以访问VLAN30 VLAN30不能访问VLAN39\r\n配置如下\r\n\r\ninterface vlan30\r\nip address 172.21.30.1 255.255.255.0\r\nip access-group vlan30_in in\r\n\r\ninterface vlan39\r\nip address 172.21.39.1 255.255.255.0\r\nip access-group vlan39_in in\r\n\r\nip access-list extended vlan30_in\r\nevaluate test\r\ndeny ip any 172.21.39.0 0.0.0.255\r\npemit ip any any\r\n\r\nip access-list extended vlan39_in\r\npermit ip 172.21.39.0 0.0.0.255 172.21.30.0 0.0.0.255 reflect test\r\npermit icmp 172.21.39.0 0.0.0.255 172.21.30.0 0.0.0.255 reflect test\r\npermit ip any any\r\n\r\n结果没有实现要求 有人能帮我看看有什么错误么？ 我在2600上测试都正常的 不知道为什么到了3560上就不行了求助\r\n\r\n3650上的结果是 39网段的可以ping通172.21.30.1 但是ping不到30网段其他地址

hyster_dct

ip access-list extended vlan30_in\r\nevaluate test\r\ndeny ip 172.21.30.0 0.0.0.255 172.21.39.0 0.0.0.255\r\npemit ip any any

hyster_dct

ip access-list extended vlan30_in\r\nevaluate test\r\ndeny ip 172.21.30.0 0.0.0.255 172.21.39.0 0.0.0.255\r\npemit ip any any

zdzhsx

你的意思是要把源地址写明么？\r\n试过了 结果一样了。。。

puding

The switch does not support these Cisco IOS router ACL-related features:\r\n\r\nNon-IP protocol ACLs (see Table 27-1) or bridge-group ACLs \r\nIP accounting \r\nInbound and outbound rate limiting (except with QoS ACLs) \r\nReflexive ACLs or dynamic ACLs (except for some specialized dynamic ACLs used by the switch clustering feature) \r\nACL logging for port ACLs and VLAN maps