交换机配置ACL访问控制

1
Switch>enable
2
Switch#
3
Switch#configure terminal
4
Switch(config)#ip access-list extended deny55    创建ACL扩展名为deny55组
5
Switch(config-ext-nacl)#1 permit ip 10.30.55.0 0.0.0.255 host 10.30.51.35      允许10.30.51.35访问10.30.55.0网段
6
Switch(config-ext-nacl)#10 deny ip 10.30.55.0 0.0.0.255 10.30.51.0 0.0.0.255   拒绝10.30.55.0网段访问10.30.51.0网段
7
Switch(config-ext-nacl)#20 deny ip 10.30.55.0 0.0.0.255 10.30.52.0 0.0.0.255   拒绝10.30.55.0网段访问10.30.52.0网段
8
Switch(config-ext-nacl)#100 permit ip any any               其他IP默认允许访问
9
Switch(config-ext-nacl)#show this                 查看当前ACL deny55组规则，配置注意序号
10
Building configuration...
11
!
12
 1 permit ip 10.30.55.0 0.0.0.255 host 10.30.51.19
13
 10 deny ip 10.30.55.0 0.0.0.255 10.30.51.0 0.0.0.255
14
 20 deny ip 10.30.55.0 0.0.0.255 10.30.52.0 0.0.0.255
15
 100 permit ip any any
16
！
17
end
18
Switch(config-ext-nacl)#exit

1
Switch>enable
2
Switch#
3
Switch#configure terminal
4
Switch(config)#interface vlaN 15                 进入VLAN 15配置
5
Switch(config-if-VLAN 15)#ip access-group deny55 in             把deny55应用到vlan 15
6
Switch(config-if-VLAN 15)#show this
7
Building configuration...
8
!
9
 ip access-group deny55 in
10
 ip address 10.30.55.254 255.255.255.0
11
!
12
end
13
Switch(config-if-VLAN 15)#end

1
Switch#show access-lists
2
ip access-list extended deny55                   查看ACL已添加的规则
3
 1 permit ip 10.30.55.0 0.0.0.255 host 10.30.51.35
4
 10 deny ip 10.30.55.0 0.0.0.255 10.30.51.0 0.0.0.255
5
 20 deny ip 10.30.55.0 0.0.0.255 10.30.52.0 0.0.0.255
6
 30 deny ip 10.30.55.0 0.0.0.255 10.30.53.0 0.0.0.255
7
 40 deny ip 10.30.55.0 0.0.0.255 10.30.54.0 0.0.0.255
8
 50 deny ip 10.30.55.0 0.0.0.255 10.30.56.0 0.0.0.255
9
 60 deny ip 10.30.55.0 0.0.0.255 10.30.58.0 0.0.0.255
10
 70 permit ip any any
11
 (2 packets filtered)
12
Switch#write                       保存当前配置