求助单向访问问题

zdzhsx

3560交换机 其中两个VLAN
VLAN30:172.21.30.1/24和VLAN39:172.21.39.1/24
要求VLAN39可以访问VLAN30 VLAN30不能访问VLAN39
配置如下

interface vlan30
ip address 172.21.30.1 255.255.255.0
ip access-group vlan30_in in

interface vlan39
ip address 172.21.39.1 255.255.255.0
ip access-group vlan39_in in

ip access-list extended vlan30_in
evaluate test
deny ip any 172.21.39.0 0.0.0.255
pemit ip any any

ip access-list extended vlan39_in
permit ip 172.21.39.0 0.0.0.255 172.21.30.0 0.0.0.255 reflect test
permit icmp 172.21.39.0 0.0.0.255 172.21.30.0 0.0.0.255 reflect test
permit ip any any

结果没有实现要求 有人能帮我看看有什么错误么？ 我在2600上测试都正常的 不知道为什么到了3560上就不行了求助

3650上的结果是 39网段的可以ping通172.21.30.1 但是ping不到30网段其他地址

hyster_dct

ip access-list extended vlan30_in
evaluate test
deny ip 172.21.30.0 0.0.0.255 172.21.39.0 0.0.0.255
pemit ip any any

hyster_dct

ip access-list extended vlan30_in
evaluate test
deny ip 172.21.30.0 0.0.0.255 172.21.39.0 0.0.0.255
pemit ip any any

zdzhsx

你的意思是要把源地址写明么？
试过了 结果一样了。。。

cnriver

in 换成 out 试试。

puding

The switch does not support these Cisco IOS router ACL-related features:

Non-IP protocol ACLs (see Table 27-1) or bridge-group ACLs
IP accounting
Inbound and outbound rate limiting (except with QoS ACLs)
Reflexive ACLs or dynamic ACLs (except for some specialized dynamic ACLs used by the switch clustering feature)
ACL logging for port ACLs and VLAN maps