[系统运维]单臂路由&ACL

单臂路由

配置好ip与网关

划分vlan

LSW1

sys
vlan batch 10 20
int e0/0/1
p l a
p d v 10
int e0/0/2
p l a
p d v 10
int e0/0/3
p l a
p d v 20
int e0/0/4
p l a
p d v 20
int e0/0/5
p l t
p t a v 10 20

设置arp

AR1

sys
int g0/0/0.1
dotlq termination vid 10
ip address 192.168.1.254 24
arp broadcast enable
int g0/0/0.2
dotlq termination vid 20
ip address 192.168.2.254 24
arp broadcast enable

结果

ACL

配置ip地址与网关

LSW1

sys
vlan batch 10 20 30
int vlanif 10
ip address 192.168.1.254 24
int vlanif 20
ip address 192.168.2.254 24
int vlanif 30
ip address 172.16.1.1 24

LSW2

sys
vlan batch 40 50
int Vlanif 40
ip address 172.16.1.2 24
int Vlanif 50
ip address 172.16.2.1 24

AR1

sys
int g0/0/0
ip address 172.16.2.2 24
int g0/0/1
ip address 192.168.3.1 24
int g0/0/2
ip address 192.168.4.1 24

设置vlan间通信

LSW1

int e0/0/1
p l a
p d v 10
int e0/0/2
p l a
p d v 20
int e0/0/3
p l a
p d v 30

LSW2

int e0/0/1
p l a
p d v 40
int e0/0/2
p l a
p d v 50

设置路由

LSW2

ip route-static 192.168.1.0 24 172.16.1.1
ip route-static 192.168.2.0 24 172.16.1.1

AR1

ip route-static 192.168.1.0 24 172.16.2.1
ip route-static 192.168.2.0 24 172.16.2.1

?LSW1

ip route-static 0.0.0.0 0 172.16.1.2

LSW2

ip route-static 0.0.0.0 0 172.16.2.2

?设置限制

acl number 3000
rule 5 permit tcp source 192.168.1.0 0.0.0.255 destination 192.168.4.2 0 destination-port eq www
rule 10 deny tcp source 192.168.1.0 0.0.0.255 destination 192.168.3.2 0 destination-port eq ftp
rule 15 permit tcp source 192.168.2.0 0.0.0.255 destination 192.168.3.2 0 destination-port eq ftp
rule 20 deny tcp source 192.168.2.0 0.0.0.255 destination 192.168.4.2 0 destination-port eq www

配置服务器

?server2同上

结果

连接ftp服务器

?连接http服务