配置禁止指定主机访问网络示例
配置思路
- 配置各接口,实现用户能通过Switch访问外部网络。
- 配置时间范围,用于在ACL中引用。
- 配置ACL,在工作时间段禁止报文通过。
- 在接口GE1/0/1的入方向配置报文过滤。
操作步骤
- 创建VLAN并配置各接口
# 在Switch上创建VLAN10。
<HUAWEI> system-view [HUAWEI] sysname Switch [Switch] vlan 10 [Switch-vlan10] quit
# 配置Switch上接口GE1/0/1和GE2/0/1为Trunk类型接口,并加入VLAN10。
[Switch] interface gigabitethernet 1/0/1 [Switch-GigabitEthernet1/0/1] port link-type trunk [Switch-GigabitEthernet1/0/1] port trunk allow-pass vlan 10 [Switch-GigabitEthernet1/0/1] quit [Switch] interface gigabitethernet 2/0/1 [Switch-GigabitEthernet2/0/1] port link-type trunk [Switch-GigabitEthernet2/0/1] port trunk allow-pass vlan 10 [Switch-GigabitEthernet2/0/1] quit
请配置LSW与Switch对接的接口为Trunk类型,并加入VLAN10。
# 创建VLANIF10,并为VLANIF10配置IP地址192.168.1.1/24。
[Switch] interface vlanif 10 [Switch-Vlanif10] ip address 192.168.1.1 24 [Switch-Vlanif10] quit
请配置Router与Switch对接的接口IP地址为192.168.1.2/24。
- 创建周期时间段working_time,时间范围为每天的8:30~18:00。
[Switch] time-range working_time 08:30 to 18:00 working-day
- 配置ACL 3001,配置三条规则,分别为禁止源IP地址为192.168.1.10、192.168.1.11、192.168.1.12的报文在工作时间通过。
[Switch] acl number 3001 [Switch-acl-adv-3001] rule deny ip source 192.168.1.10 0 time-range working_time [Switch-acl-adv-3001] rule deny ip source 192.168.1.11 0 time-range working_time [Switch-acl-adv-3001] rule deny ip source 192.168.1.12 0 time-range working_time [Switch-acl-adv-3001] quit
- 在接口GE1/0/1的入方向配置报文过滤。
[Switch] interface gigabitethernet 1/0/1 [Switch-GigabitEthernet1/0/1] traffic-filter inbound acl 3001 [Switch-GigabitEthernet1/0/1] quit
- 验证配置结果
# 看设备接口入方向上应用的ACL规则和流动作信息。
[Switch] display traffic-applied interface gigabitethernet 1/0/1 inbound ----------------------------------------------------------- ACL applied inbound interface GigabitEthernet1/0/1 ACL 3001 rule 5 deny ip source 192.168.1.10 0 time-range working_time (match-counter 0) ACTIONS: filter ----------------------------------------------------------- ACL 3001 rule 10 deny ip source 192.168.1.11 0 time-range working_time (match-counter 0) ACTIONS: filter ----------------------------------------------------------- ACL 3001 rule 15 deny ip source 192.168.1.12 0 time-range working_time (match-counter 0) ACTIONS: filter -----------------------------------------------------------
配置文件
Switch的配置文件
# sysname Switch # vlan batch 10 # time-range working_time 08:30 to 18:00 working-day # acl number 3001 rule 5 deny ip source 192.168.1.10 0 time-range working_time rule 10 deny ip source 192.168.1.11 0 time-range working_time rule 15 deny ip source 192.168.1.12 0 time-range working_time # interface Vlanif10 ip address 192.168.1.1 255.255.255.0 # interface GigabitEthernet1/0/1 port link-type trunk port trunk allow-pass vlan 10 traffic-filter inbound acl 3001 # interface GigabitEthernet2/0/1 port link-type trunk port trunk allow-pass vlan 10 # return