Record a switch configuration ACL records, the demand is to configure a Vlan to restrict access to other Vlan, as well as restricted Vlan can only access its > other VLAN specified IP after all, this is usually very little to configure a configuration of all kinds of look for documentation, is very inconvenient, after all, just a few The commands are just a few! Not much to say, directly into the main topic.

Create ACLs and add rules

Terminal window
Switch>enable
Switch#
Switch#configure terminal
Switch(config)#ip access-list extended deny55    # Create ACL extension deny55 group
Switch(config-ext-nacl)#1 permit ip 10.30.55.0 0.0.0.255 host 10.30.51.35      # Allow 10.30.51.35 to access 10.30.55.0 network segment
Switch(config-ext-nacl)#10 deny ip 10.30.55.0 0.0.0.255 10.30.51.0 0.0.0.255   # Deny access to 10.30.51.0 on the 10.30.55.0 network segment
Switch(config-ext-nacl)#20 deny ip 10.30.55.0 0.0.0.255 10.30.52.0 0.0.0.255   # Deny access to 10.30.52.0 on the 10.30.55.0 network segment
Switch(config-ext-nacl)#100 permit ip any any               # Other IPs are allowed access by default
Switch(config-ext-nacl)#show this                 # To view the current ACL deny55 group rule, configure the attention sequence number
Building configuration...
!
 1 permit ip 10.30.55.0 0.0.0.255 host 10.30.51.19
 10 deny ip 10.30.55.0 0.0.0.255 10.30.51.0 0.0.0.255
 20 deny ip 10.30.55.0 0.0.0.255 10.30.52.0 0.0.0.255
 100 permit ip any any
！
end
Switch(config-ext-nacl)#exit

The created ACL is referenced to the specified Vlan (it can also be applied to the device interface).

Terminal window
Switch>enable
Switch#
Switch#configure terminal
Switch(config)#interface vlaN 15                 # Enter VLAN 15 configuration
Switch(config-if-VLAN 15)#ip access-group deny55 in       # Apply deny55 to vlan 15.
Switch(config-if-VLAN 15)#show this
Building configuration...
!
 ip access-group deny55 in
 ip address 10.30.55.254 255.255.255.0
!
end
Switch(config-if-VLAN 15)#end

See if the ACL rule is correct and save

Terminal window
Switch#show access-lists
ip access-list extended deny55                   # view the rules that have been added to an ACL
 1 permit ip 10.30.55.0 0.0.0.255 host 10.30.51.35
 10 deny ip 10.30.55.0 0.0.0.255 10.30.51.0 0.0.0.255
 20 deny ip 10.30.55.0 0.0.0.255 10.30.52.0 0.0.0.255
 30 deny ip 10.30.55.0 0.0.0.255 10.30.53.0 0.0.0.255
 40 deny ip 10.30.55.0 0.0.0.255 10.30.54.0 0.0.0.255
 50 deny ip 10.30.55.0 0.0.0.255 10.30.56.0 0.0.0.255
 60 deny ip 10.30.55.0 0.0.0.255 10.30.58.0 0.0.0.255
 70 permit ip any any
 (2 packets filtered)
Switch#write                               # Saving the Current Configuration

end here

Switch Configuration ACL Access Control
https://huoshen.pages.dev/p/c014c0bb/
Author
Koevn
Published at
License
CC BY-NC-SA 4.0