Cisco组建中小型企业网络实例

1、Vlan信息

Vlan ID

网络地址

名 称

描 述 本地vlan 研发中心 质保部 制造部 设备部 采购部 销售部 财务部 管理部 总经办

1 192.168.10.0/24 无

2 192.168.20.0/24 yfzx 3 192.168.30.0/24 zbb 4 192.168.40.0/24 zzb 5 192.168.50.0/24 sbb 6 192.168.60.0/24 cgb 7 192.168.70.0/24 xsb 8 192.168.80.0/24 cwb 9 192.168.90.0/24 glb 100 192.168.100.0/24 zjb

1

2、VTP 信息

设备名称

Domain Prunning Password Mode benet Enable 123 Server

123 Client 123 Client 123 Client 123 Client

3550-S-1

2950-S-1 benet Enable 2950-S-2 benet Enable 2950-S-3 benet Enable 2950-S-4 benet Enable

3、设备IP 地址分配

设备名称

接口

IP地址

描述

2600-R-1 3550-S-1

F0/0 221.215.31.129/29 F0/1 192.168.1.1/24

WAN -

F0/1 192.168.1.2/24 3L-Switch

交换机、路由器详细配置

1． IP地址设置

2600-R-1（config）# int F0/0

2600-R-1 (config-if) #ip add 221.215.31.129 255.255.255.0 2600-R-1 (config-if) #no shutdown ---------------------------------- 2600-R-1（config-if）# int F0/1

2600-R-1 (config-if) #ip add 192.168.1.1 255.255.255.0 2600-R-1 (config-if) #no shutdown 3550-S-1 (config) # int F0/1

3550-S-1 (config-if) # no switchport……….路由端口

3550-S-1 (config-if) # ip add 192.168.1.2 255.255.255.0

3550-S-1 (config) # int vlan 1 ……………..管理vlan 3550-S-1 (config-if) # ip add 192.168.10.1 255.255.255.0 3550-S-1 (config-if) # int vlan 2……………研发中心

3550-S-1 (config-if) # ip add 192.168.20.1 255.255.255.0

2

3550-S-1 (config-if) # int vlan 3……………质保部

3550-S-1 (config-if) # ip add 192.168.30.1 255.255.255.0 3550-S-1 (config-if) # int vlan 4……………制造部

3550-S-1 (config-if) # ip add 192.168.40.1 255.255.255.0 3550-S-1 (config-if) # int vlan 5……………设备部

3550-S-1 (config-if) # ip add 192.168.50.1 255.255.255.0 3550-S-1 (config-if) # int vlan 6……………采购部

3550-S-1 (config-if) # ip add 192.168.60.1 255.255.255.0 3550-S-1 (config-if) # int vlan 7……………销售部

3550-S-1 (config-if) # ip add 192.168.70.1 255.255.255.0 3550-S-1 (config-if) # int vlan 8……………财务部

3550-S-1 (config-if) # ip add 192.168.80.1 255.255.255.0 3550-S-1 (config-if) # int vlan 9……………管理部

3550-S-1 (config-if) # ip add 192.168.90.1 255.255.255.0 3550-S-1 (config-if) # int vlan 100…………总经办

3550-S-1 (config-if) # ip add 192.168.100.1 255.255.255.0

2． VTP配置

3550-S-1（config）# vlan database 3550-S-1 (vlan) # vtp domain benet 3550-S-1 (vlan) # vtp server

3550-S-1 (vlan) # vtp password 123

3550-S-1 (vlan) # vtp pruning……………………………..修剪

3550-S-1 (vlan) # vlan 2 name yfzx………………………..研发中心 3550-S-1 (vlan) # vlan 3 name zbb………………………....质保部 3550-S-1 (vlan) # vlan 4 name zzb…………………………制造部 3550-S-1 (vlan) # vlan 5 name sbb…………………………设备部 3550-S-1 (vlan) # vlan 6 name cgb…………………………采购部 3550-S-1 (vlan) # vlan 7 name xsb……………………… …销售部 3550-S-1 (vlan) # vlan 8 name xsb……………………….....财务部 3550-S-1 (vlan) # vlan 9 name xsb……………………… …管理部 ----------------------------------------------------------- 2950-S-1 (vlan) #vtp domain benet

2950-S-1 (vlan) #vtp tran…………………透明模式(配置修改编号清零) 2950-S-1 (vlan) #vtp client 客户模式 2950-S-1 (vlan) #vtp password 123 2950-S-2 (vlan) #vtp domain benet

2950-S-2 (vlan) #vtp tran…………………透明模式(配置修改编号清零) 2950-S-2 (vlan) #vtp client 客户模式 2950-S-2 (vlan) #vtp password 123 2950-S-3 (vlan) #vtp domain benet

2950-S-3 (vlan) #vtp tran…………………透明模式(配置修改编号清零) 2950-S-3 (vlan) #vtp client 客户模式

3

2950-S-3 (vlan) #vtp password 123 2950-S-4 (vlan) #vtp domain benet

2950-S-4 (vlan) #vtp tran…………………透明模式(配置修改编号清零) 2950-S-4 (vlan) #vtp client 客户模式 2950-S-4 (vlan) #vtp password 123

3． 路由配置

2600-R-1（config）# ip route 0.0.0.0 0.0.0.0 f0/2……………...缺省路由 2600-R-1（config）# ip route 192.168.0.0 255.255.0.0 192.168.1.2 3550- R -1 (config) # ip route 0.0.0.0 0.0.0.0 192.168.1.1

4． NAT

2600-R-1（config）# access-list 101 permit ip 192.168.0.0

0.0.255.255 192.168.0.0

0.0.255.255……………………………...内部局部地址

2600-R-1（config）# ip nat pool WAN 221.215.31.131

221.215.31.134 prefix-len 29

………………………………定义合法IP地址池

2600-R-1（config）# ip nat inside sour list 101 pool WAN ……….实现

地址转换

2600-R-1（config）# int f0/1

2600-R-1（config-if）# ip nat inside………………………….定义NAT inside 2600-R-1（config）# int f0/0

2600-R-1（config-if）# ip nat outside………………………..定义NAT

outside端口

5． Vlan流量控制

󰁺󰂂󰂂󰂂󰂂󰂂󰂂󰂂 制造部、设备部vlan实现互访，禁止访问其它部门vlan

󰁺󰂂󰂂󰂂󰂂󰂂󰂂󰂂 制造部、设备部上班时间禁止访问internet(8:00-12:00 2:00-6:00) 󰁺󰂂󰂂󰂂󰂂󰂂󰂂󰂂 研发中心、质保部vlan实现互访，禁止访问其它部门vlan 󰁺󰂂󰂂󰂂󰂂󰂂󰂂󰂂 财务部vlan实现与采购部、销售部vlan的单向访问 󰁺󰂂󰂂󰂂󰂂󰂂󰂂󰂂 总经办vlan实现与财务部、管理部vlan的单向访问 󰁺󰂂󰂂󰂂󰂂󰂂󰂂󰂂 管理部vlan禁止访问其它部门vlan 󰁺󰂂󰂂󰂂󰂂󰂂󰂂󰂂 各部门vlan都能访问服务器区

3550-S-1(config) # time-range restrict

3550-S-1(config-time-range) # periodic daily start 12:00 to 2:00 ……….设置时间范围

3550-S-1 (config) # ip access-list extend yfzx ……….研发中心ACL 3550-S-1 (config-ext-nacl) # permit ip any 192.168.20.0 0.0.0.255

…...….访问质保部

4

3550-S-1 (config-ext-nacl) # permit ip any 192.168.100.0 0.0.0.255 ………访问服务器区

3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255 ……….禁止访问其它部门 3550-S-1 (config-ext-nacl) # permit ip any any

3550-S-1 (config) # ip access-list extend zbb……….质保部ACL 3550-S-1 (config-ext-nacl) # permit ip any 192.168.10.0 0.0.0.255

…...….访问研发中心

3550-S-1 (config-ext-nacl) # permit ip any 192.168.100.0 0.0.0.255 ………访问服务器区

3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255 ……….禁止访问其它部门 3550-S-1 (config-ext-nacl) # permit ip any any

-------------------------------------------------------------------------------------------

3550-S-1 (config) # ip access-list extend zzb……….制造部ACL 3550-S-1 (config-ext-nacl) # permit ip any 192.168.40.0 0.0.0.255

…...….访问设备部

3550-S-1 (config-ext-nacl) # permit ip any 192.168.100.0 0.0.0.255 ………访问服务器区

3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255 ……….禁止访问其它部门

3550-S-1 (config-ext-nacl) # permit ip any any time-range restrict ……….上班时间禁止上网

3550-S-1 (config) # ip access-list extend sbb……….设备部ACL

3550-S-1 (config-ext-nacl) # permit ip any 192.168.30.0 0.0.0.255 …...….访问制造部

3550-S-1 (config-ext-nacl) # permit ip any 192.168.100.0 0.0.0.255 ………访问服务器区

3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255 ……….禁止访问其它部门 3550-S-1 (config-ext-nacl) # permit ip any any

-----------------------------------------------------------------------------------------

3550-S-1 (config) # ip access-list extend cgb……….采购部ACL

3550-S-1 (config-ext-nacl) # evaluate cwb-cgb …..计算匹配自反ACL 3550-S-1 (config-ext-nacl) # permit ip any 192.168.100.0 0.0.0.255 ………访问服务器区

3550-S-1 (config-ext-nacl) #deny ip any 192.168.0.0 0.0.255.255

5

3550-S-1 (config-ext-nacl) #permit ip any any

----------------------------------------------------------------------------

3550-S-1 (config) # ip access-list extend xsb……….销售部ACL

3550-S-1 (config-ext-nacl) # evaluate cwb-xsb …..计算匹配自反ACL 3550-S-1 (config-ext-nacl) # permit ip any 192.168.100.0 0.0.0.255 ………访问服务器区

3550-S-1 (config-ext-nacl) #deny ip any 192.168.0.0 0.0.255.255 3550-S-1 (config-ext-nacl) #permit ip any any

---------------------------------------------------------------------------------------

3550-S-1 (config) # ip access-list extend cwb……….财务部ACL

3550-S-1 (config-ext-nacl) # permint ip any 192.168.60.0

0.0.0.255 reflect cwb-cgb ………...创建自反ACL cwb-cgb

3550-S-1 (config-ext-nacl) # permint ip any 192.168.70.0

0.0.0.255 reflect cwb-xsb ………...创建自反ACL cwb-xsb

3550-S-1 (config-ext-nacl) # evaluate zjb-cwb …..计算匹配自反ACL 3550-S-1 (config-ext-nacl) # permit ip any 192.168.100.0 0.0.0.255 ………访问服务器区

3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255 ……….禁止访问其它部门 3550-S-1 (config-ext-nacl) # permit ip any any

--------------------------------------------------------------------------------------------------

3550-S-1 (config) # ip access-list extend cwb……….管理部ACL

3550-S-1 (config-ext-nacl) # evaluate zjb-glb …..计算匹配自反ACL 3550-S-1 (config-ext-nacl) # permit ip any 192.168.100.0 0.0.0.255 ………访问服务器区

3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255 ……….禁止访问其它部门 3550-S-1 (config-ext-nacl) # permit ip any any

----------------------------------------------------------------------------------------------------

3550-S-1 (config) # ip access-list extend zjb……….总经办ACL

3550-S-1 (config-ext-nacl) # permint ip any 192.168.80.0

0.0.0.255 reflect zjb-cwb ………...创建自反ACL zjb-cwb

3550-S-1 (config-ext-nacl) # permint ip any 192.168.90.0

0.0.0.255 reflect zjb-glb ………...创建自反ACL zjb-glb

3550-S-1 (config-ext-nacl) # permit ip any 192.168.100.0 0.0.0.255

6

………访问服务器区

3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255 ……….禁止访问其它部门 3550-S-1 (config-ext-nacl) # permit ip any any

ACL应用：

3550-S-1 (config) # int vlan 2 …………..研发中心 3550-S-1 (config-if) #ip access-group yfzx in

3550-S-1 (config) # int vlan 3 …………..质保部 3550-S-1 (config-if) #ip access-group zbb in

3550-S-1 (config) # int vlan 4 ……………制造部 3550-S-1 (config-if) #ip access-group zzb in

…(略)

附：关键字established的ACL应用(单向访问)

3550-S-1 (config) # ip access-list extend cgb……….采购部ACL 3550-S-1 (config-ext-nacl) # permit ip any 192.168.80.0 0.0.0.0.255 estab

3550-S-1 (config-ext-nacl) # permit ip any 192.168.100.0 0.0.0.255 ………访问服务器区

3550-S-1 (config-ext-nacl) #deny ip any 192.168.0.0 0.0.255.255 3550-S-1 (config-ext-nacl) #permit ip any any

3550-S-1 (config) # ip access-list extend xsb……….销售部ACL

3550-S-1 (config-ext-nacl) # permit ip any 192.168.80.0 0.0.0.0.255 estab

3550-S-1 (config-ext-nacl) # permit ip any 192.168.100.0 0.0.0.255 ………访问服务器区

3550-S-1 (config-ext-nacl) #deny ip any 192.168.0.0 0.0.255.255 3550-S-1 (config-ext-nacl) #permit ip any any

1、Vlan信息

Vlan ID

网络地址 名 称 描 述 本地vlan 研发中心

1 192.168.10.0/24 无

2 192.168.20.0/24 yfzx

7

3 192.168.30.0/24 zbb 4 192.168.40.0/24 zzb 5 192.168.50.0/24 sbb 6 192.168.60.0/24 cgb 7 192.168.70.0/24 xsb 8 192.168.80.0/24 cwb 9 192.168.90.0/24 glb 100 192.168.100.0/24 zjb

质保部 制造部 设备部 采购部 销售部 财务部 管理部 总经办

2、VTP 信息

设备名称

Domain Prunning Password Mode benet Enable 123 Server

123 Client 123 Client 123 Client 123 Client

3550-S-1

2950-S-1 benet Enable 2950-S-2 benet Enable 2950-S-3 benet Enable 2950-S-4 benet Enable

3、设备IP 地址分配

设备名称

接口

IP地址

描述

2600-R-1 3550-S-1

F0/0 221.215.31.129/29 F0/1 192.168.1.1/24

WAN -

F0/1 192.168.1.2/24 3L-Switch

交换机、路由器详细配置

1． IP地址设置

2600-R-1（config）# int F0/0

2600-R-1 (config-if) #ip add 221.215.31.129 255.255.255.0

8

2600-R-1 (config-if) #no shutdown ---------------------------------- 2600-R-1（config-if）# int F0/1

2600-R-1 (config-if) #ip add 192.168.1.1 255.255.255.0 2600-R-1 (config-if) #no shutdown 3550-S-1 (config) # int F0/1

3550-S-1 (config-if) # no switchport……….路由端口

3550-S-1 (config-if) # ip add 192.168.1.2 255.255.255.0

3550-S-1 (config) # int vlan 1 ……………..管理vlan 3550-S-1 (config-if) # ip add 192.168.10.1 255.255.255.0 3550-S-1 (config-if) # int vlan 2……………研发中心

3550-S-1 (config-if) # ip add 192.168.20.1 255.255.255.0 3550-S-1 (config-if) # int vlan 3……………质保部

3550-S-1 (config-if) # ip add 192.168.30.1 255.255.255.0 3550-S-1 (config-if) # int vlan 4……………制造部

3550-S-1 (config-if) # ip add 192.168.40.1 255.255.255.0 3550-S-1 (config-if) # int vlan 5……………设备部

3550-S-1 (config-if) # ip add 192.168.50.1 255.255.255.0 3550-S-1 (config-if) # int vlan 6……………采购部

3550-S-1 (config-if) # ip add 192.168.60.1 255.255.255.0 3550-S-1 (config-if) # int vlan 7……………销售部

3550-S-1 (config-if) # ip add 192.168.70.1 255.255.255.0 3550-S-1 (config-if) # int vlan 8……………财务部

3550-S-1 (config-if) # ip add 192.168.80.1 255.255.255.0 3550-S-1 (config-if) # int vlan 9……………管理部

3550-S-1 (config-if) # ip add 192.168.90.1 255.255.255.0 3550-S-1 (config-if) # int vlan 100…………总经办

3550-S-1 (config-if) # ip add 192.168.100.1 255.255.255.0

2． VTP配置

3550-S-1（config）# vlan database 3550-S-1 (vlan) # vtp domain benet 3550-S-1 (vlan) # vtp server

3550-S-1 (vlan) # vtp password 123

3550-S-1 (vlan) # vtp pruning……………………………..修剪

3550-S-1 (vlan) # vlan 2 name yfzx………………………..研发中心 3550-S-1 (vlan) # vlan 3 name zbb………………………....质保部 3550-S-1 (vlan) # vlan 4 name zzb…………………………制造部 3550-S-1 (vlan) # vlan 5 name sbb…………………………设备部 3550-S-1 (vlan) # vlan 6 name cgb…………………………采购部 3550-S-1 (vlan) # vlan 7 name xsb……………………… …销售部 3550-S-1 (vlan) # vlan 8 name xsb……………………….....财务部 3550-S-1 (vlan) # vlan 9 name xsb……………………… …管理部

9

----------------------------------------------------------- 2950-S-1 (vlan) #vtp domain benet

2950-S-1 (vlan) #vtp tran…………………透明模式(配置修改编号清零) 2950-S-1 (vlan) #vtp client 客户模式 2950-S-1 (vlan) #vtp password 123 2950-S-2 (vlan) #vtp domain benet

2950-S-2 (vlan) #vtp tran…………………透明模式(配置修改编号清零) 2950-S-2 (vlan) #vtp client 客户模式 2950-S-2 (vlan) #vtp password 123 2950-S-3 (vlan) #vtp domain benet

2950-S-3 (vlan) #vtp tran…………………透明模式(配置修改编号清零) 2950-S-3 (vlan) #vtp client 客户模式 2950-S-3 (vlan) #vtp password 123 2950-S-4 (vlan) #vtp domain benet

2950-S-4 (vlan) #vtp tran…………………透明模式(配置修改编号清零) 2950-S-4 (vlan) #vtp client 客户模式 2950-S-4 (vlan) #vtp password 123

3． 路由配置

2600-R-1（config）# ip route 0.0.0.0 0.0.0.0 f0/2……………...缺省路由 2600-R-1（config）# ip route 192.168.0.0 255.255.0.0 192.168.1.2 3550- R -1 (config) # ip route 0.0.0.0 0.0.0.0 192.168.1.1

4． NAT

2600-R-1（config）# access-list 101 permit ip 192.168.0.0

0.0.255.255 192.168.0.0

0.0.255.255……………………………...内部局部地址

2600-R-1（config）# ip nat pool WAN 221.215.31.131

221.215.31.134 prefix-len 29

………………………………定义合法IP地址池

2600-R-1（config）# ip nat inside sour list 101 pool WAN ……….实现

地址转换

2600-R-1（config）# int f0/1

2600-R-1（config-if）# ip nat inside………………………….定义NAT inside 2600-R-1（config）# int f0/0

2600-R-1（config-if）# ip nat outside………………………..定义NAT

outside端口

5． Vlan流量控制

󰁺󰂂󰂂󰂂󰂂󰂂󰂂󰂂 制造部、设备部vlan实现互访，禁止访问其它部门vlan

󰁺󰂂󰂂󰂂󰂂󰂂󰂂󰂂 制造部、设备部上班时间禁止访问internet(8:00-12:00 2:00-6:00) 󰁺󰂂󰂂󰂂󰂂󰂂󰂂󰂂 研发中心、质保部vlan实现互访，禁止访问其它部门vlan 󰁺󰂂󰂂󰂂󰂂󰂂󰂂󰂂 财务部vlan实现与采购部、销售部vlan的单向访问

10

󰁺󰂂󰂂󰂂󰂂󰂂󰂂󰂂 总经办vlan实现与财务部、管理部vlan的单向访问 󰁺󰂂󰂂󰂂󰂂󰂂󰂂󰂂 管理部vlan禁止访问其它部门vlan 󰁺󰂂󰂂󰂂󰂂󰂂󰂂󰂂 各部门vlan都能访问服务器区

3550-S-1(config) # time-range restrict

3550-S-1(config-time-range) # periodic daily start 12:00 to 2:00 ……….设置时间范围

3550-S-1 (config) # ip access-list extend yfzx ……….研发中心ACL 3550-S-1 (config-ext-nacl) # permit ip any 192.168.20.0 0.0.0.255

…...….访问质保部

3550-S-1 (config-ext-nacl) # permit ip any 192.168.100.0 0.0.0.255 ………访问服务器区

3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255 ……….禁止访问其它部门 3550-S-1 (config-ext-nacl) # permit ip any any

3550-S-1 (config) # ip access-list extend zbb……….质保部ACL 3550-S-1 (config-ext-nacl) # permit ip any 192.168.10.0 0.0.0.255

…...….访问研发中心

3550-S-1 (config-ext-nacl) # permit ip any 192.168.100.0 0.0.0.255 ………访问服务器区

3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255 ……….禁止访问其它部门 3550-S-1 (config-ext-nacl) # permit ip any any

-------------------------------------------------------------------------------------------

3550-S-1 (config) # ip access-list extend zzb……….制造部ACL 3550-S-1 (config-ext-nacl) # permit ip any 192.168.40.0 0.0.0.255

…...….访问设备部

3550-S-1 (config-ext-nacl) # permit ip any 192.168.100.0 0.0.0.255 ………访问服务器区

3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255 ……….禁止访问其它部门

3550-S-1 (config-ext-nacl) # permit ip any any time-range restrict ……….上班时间禁止上网

3550-S-1 (config) # ip access-list extend sbb……….设备部ACL

3550-S-1 (config-ext-nacl) # permit ip any 192.168.30.0 0.0.0.255 …...….访问制造部

3550-S-1 (config-ext-nacl) # permit ip any 192.168.100.0 0.0.0.255 ………访问服务器区

11

3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255 ……….禁止访问其它部门 3550-S-1 (config-ext-nacl) # permit ip any any

-----------------------------------------------------------------------------------------

3550-S-1 (config) # ip access-list extend cgb……….采购部ACL

3550-S-1 (config-ext-nacl) # evaluate cwb-cgb …..计算匹配自反ACL 3550-S-1 (config-ext-nacl) # permit ip any 192.168.100.0 0.0.0.255 ………访问服务器区

3550-S-1 (config-ext-nacl) #deny ip any 192.168.0.0 0.0.255.255 3550-S-1 (config-ext-nacl) #permit ip any any

----------------------------------------------------------------------------

3550-S-1 (config) # ip access-list extend xsb……….销售部ACL

3550-S-1 (config-ext-nacl) # evaluate cwb-xsb …..计算匹配自反ACL 3550-S-1 (config-ext-nacl) # permit ip any 192.168.100.0 0.0.0.255 ………访问服务器区

3550-S-1 (config-ext-nacl) #deny ip any 192.168.0.0 0.0.255.255 3550-S-1 (config-ext-nacl) #permit ip any any

---------------------------------------------------------------------------------------

3550-S-1 (config) # ip access-list extend cwb……….财务部ACL

3550-S-1 (config-ext-nacl) # permint ip any 192.168.60.0

0.0.0.255 reflect cwb-cgb ………...创建自反ACL cwb-cgb

3550-S-1 (config-ext-nacl) # permint ip any 192.168.70.0

0.0.0.255 reflect cwb-xsb ………...创建自反ACL cwb-xsb

3550-S-1 (config-ext-nacl) # evaluate zjb-cwb …..计算匹配自反ACL 3550-S-1 (config-ext-nacl) # permit ip any 192.168.100.0 0.0.0.255 ………访问服务器区

3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255 ……….禁止访问其它部门 3550-S-1 (config-ext-nacl) # permit ip any any

--------------------------------------------------------------------------------------------------

3550-S-1 (config) # ip access-list extend cwb……….管理部ACL

3550-S-1 (config-ext-nacl) # evaluate zjb-glb …..计算匹配自反ACL 3550-S-1 (config-ext-nacl) # permit ip any 192.168.100.0 0.0.0.255 ………访问服务器区

3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255 ……….禁止访问其它部门 3550-S-1 (config-ext-nacl) # permit ip any any

12

----------------------------------------------------------------------------------------------------

3550-S-1 (config) # ip access-list extend zjb……….总经办ACL

3550-S-1 (config-ext-nacl) # permint ip any 192.168.80.0

0.0.0.255 reflect zjb-cwb ………...创建自反ACL zjb-cwb

3550-S-1 (config-ext-nacl) # permint ip any 192.168.90.0

0.0.0.255 reflect zjb-glb ………...创建自反ACL zjb-glb

3550-S-1 (config-ext-nacl) # permit ip any 192.168.100.0 0.0.0.255 ………访问服务器区

3550-S-1 (config-ext-nacl) # deny ip any 192.168.0.0 0.0.255.255 ……….禁止访问其它部门 3550-S-1 (config-ext-nacl) # permit ip any any

ACL应用：

3550-S-1 (config) # int vlan 2 …………..研发中心 3550-S-1 (config-if) #ip access-group yfzx in

3550-S-1 (config) # int vlan 3 …………..质保部 3550-S-1 (config-if) #ip access-group zbb in

3550-S-1 (config) # int vlan 4 ……………制造部 3550-S-1 (config-if) #ip access-group zzb in

…(略)

附：关键字established的ACL应用(单向访问)

3550-S-1 (config) # ip access-list extend cgb……….采购部ACL 3550-S-1 (config-ext-nacl) # permit ip any 192.168.80.0 0.0.0.0.255 estab

3550-S-1 (config-ext-nacl) # permit ip any 192.168.100.0 0.0.0.255 ………访问服务器区

3550-S-1 (config-ext-nacl) #deny ip any 192.168.0.0 0.0.255.255 3550-S-1 (config-ext-nacl) #permit ip any any

3550-S-1 (config) # ip access-list extend xsb……….销售部ACL

3550-S-1 (config-ext-nacl) # permit ip any 192.168.80.0 0.0.0.0.255 estab

3550-S-1 (config-ext-nacl) # permit ip any 192.168.100.0 0.0.0.255 ………访问服务器区

3550-S-1 (config-ext-nacl) #deny ip any 192.168.0.0 0.0.255.255 3550-S-1 (config-ext-nacl) #permit ip any any

13