说明:只允许教师访问 web服务器的主页,四个网段处于四个不同vlan,都能互相ping通,网关分别是pc0:192.168.10.1 ,pc1:192.168.20.1 ,DNS都是192.168.30.2 DNS服务器中添加记录www.cisco.com(192.168.40.2 ).实验结果:只有教师能访问web服务器,但四台主机都可相互ping通
三层交换机具体配置 :
Switch>
Switch>en
Switch#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#vlan 10
Switch(config-vlan)#vlan 20
Switch(config-vlan)#vlan 30
Switch(config-vlan)#vlan 40
Switch(config-vlan)#exit
Switch(config)#int f0/1
Switch(config-if)#switchport mode access
Switch(config-if)#switchport access vlan 10
Switch(config-if)#int f0/2
Switch(config-if)#switchport mode access
Switch(config-if)#switchport access vlan 20
Switch(config-if)#int f0/3
Switch(config-if)#switchport mode access
Switch(config-if)#switchport access vlan 30
Switch(config-if)#int f0/4
Switch(config-if)#switchport mode access
Switch(config-if)#switchport access vlan 40
Switch(config-if)#exit
Switch(config)#int vlan 10
%LINK-5-CHANGED: Interface Vlan10, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan10, changed state to upSwitch(config-if)#ip add 192.168.10.1 255.255.255.0
Switch(config-if)#no sh
Switch(config-if)#int vlan 20
%LINK-5-CHANGED: Interface Vlan20, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan20, changed state to upSwitch(config-if)#ip add 192.168.20.1 255.255.255.0
Switch(config-if)#int vl
Switch(config-if)#int vlan 30
%LINK-5-CHANGED: Interface Vlan30, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan30, changed state to upSwitch(config-if)#ip add 192.168.30.1 255.255.255.0
Switch(config-if)#int vlan 40
%LINK-5-CHANGED: Interface Vlan40, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan40, changed state to upSwitch(config-if)#ip add 192.168.40.1 255.255.255.0
Switch(config-if)#exit
Switch(config)#ip access-list extended denystudentwww
Switch(config-ext-nacl)#deny tcp 192.168.10.0 0.0.0.255 192.168.40.0 0.0.0.255 eq www
Switch(config-ext-nacl)#permit ip any any
Switch(config-ext-nacl)#exit
Switch(config)#int vlan 10
Switch(config-if)#ip access-group denystudentwww in
Switch(config-if)#end
%SYS-5-CONFIG_I: Configured from console by console
Switch#sh ac
Switch#sh access-lists denystudentwww
Extended IP access list denystudentwww
deny tcp 192.168.10.0 0.0.0.255 192.168.40.0 0.0.0.255 eq www (12 match(es))
permit ip any any (1 match(es))
Switch#
Cisco CCIE Security 2009 IOS防火墙合集
Cisco CCIE Security 2009最新整套视频合集
dada147 2009 ccnp新版交换视频集合
Juniper视频如何购买
CCSP视频下载
Juniper 视频购买
Cisco CCNP+TSHOOT+642-832+中文 高清扫描版
新版 CCNP 学习用书 CCNP SWITCH 642-813
新版 CCNP 学习用书 CCNP ROUTE 642-902
新版 CCNP 学习用书 CCNP TSHOOT 642-832
西安威克诺张sirCCIE视频TIEC阶段交换部分3信达 郑sir ccnp 视频分享 路由 第一集 TCP/IP
信达 郑sir ccnp 视频分享 路由 第二集 路由基础
Cisco PIX 分解实验 三 virtual_telnet_介绍 第十九集
博锐教育 CCNA课堂实验全集