ENSP 高级ACL

高级的ACL范围在3000-3999 看五元组（源IP地址、目标IP地址、源端口号、目标端口号、协议类型）

标准的ACL范围在2000-2999

deny为禁止 permit为允许

        LSW2配置

<Huawei>sy
[Huawei]undo in en
[Huawei]vlan batch 10 20
[Huawei]int g0/0/1
[Huawei-GigabitEthernet0/0/1]port link-type access
[Huawei-GigabitEthernet0/0/1]port default vlan 10
[Huawei-GigabitEthernet0/0/1]int g0/0/3 
[Huawei-GigabitEthernet0/0/3]port link-type access   
[Huawei-GigabitEthernet0/0/3]port default vlan 20
[Huawei-GigabitEthernet0/0/3]int g0/0/2
[Huawei-GigabitEthernet0/0/2]port link-type trunk 
[Huawei-GigabitEthernet0/0/2]port trunk allow-pass vlan all

LSW2-1配置 

<Huawei>sy
[Huawei]vlan batch 10 20
[Huawei]int g0/0/1
[Huawei-GigabitEthernet0/0/1]port link-type access
[Huawei-GigabitEthernet0/0/1]port defula    
[Huawei-GigabitEthernet0/0/1]port def    
[Huawei-GigabitEthernet0/0/1]port default vlan 10
[Huawei-GigabitEthernet0/0/1]int g0/0/3
[Huawei-GigabitEthernet0/0/3]port link-type access
[Huawei-GigabitEthernet0/0/3]port default vlan 20
[Huawei-GigabitEthernet0/0/3]int g0/0/2
[Huawei-GigabitEthernet0/0/2]port link-type access
[Huawei-GigabitEthernet0/0/2]port link-type trunk
[Huawei-GigabitEthernet0/0/2]p

LSW4配置

<Huawei>sy
[Huawei]undo in en
[Huawei]vlan batch 10 20
[Huawei]int g0/0/1

[Huawei-GigabitEthernet0/0/1]port link-type trunk
[Huawei-GigabitEthernet0/0/1]port trunk allow-pass vlan all
[Huawei-GigabitEthernet0/0/1]int g0/0/2
[Huawei-GigabitEthernet0/0/2]port link-type trunk
[Huawei-GigabitEthernet0/0/2]port trunk allow-pass vlan all
[Huawei-GigabitEthernet0/0/2]q
[Huawei]int vlan 10
[Huawei-Vlanif10]ip add 192.168.10.254 24       

         //配置IP地址是为了不同网段和不同VLAN间通信
[Huawei-Vlanif10]int vlan 20
[Huawei-Vlanif20]ip add 192.168.20.254 24 

配置在LSW2上配置ACL规则

[Huawei]acl 3000        //创建一个高级ACL
[Huawei-acl-adv-3000]rule deny ip source 192.168.10.1 0.0.0.0 destination 192.16
8.20.2 0.0.0.0        //禁止源地址为192.168.10.1 目的地址为192.168.20.2
[Huawei-acl-adv-3000]q
[Huawei]int g0/0/1 
[Huawei-GigabitEthernet0/0/1]traffic-filter inbound acl 3000        //引入acl 3000规则

 //source为源地址 destination为目标地址

//inbound为向内 outbound为向外

测试结果

PC4 ping PC6

PC4 ping PC4-1

PC4 ping PC6-1

实验成功