实验三十： 基于二层acl的包过滤(在三层交换机上)

《实验三十： 基于二层acl的包过滤(在三层交换机上)》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

1、实验三十：基于二层ACL的包过滤（在三层交换机上）一、理论基础Quidway交换机不但支持基于三层的ACL包过滤（如IP地址）还支持基于二层的相关信息（如MAC地址）进行策略的设置，把数据按照管理员的需求进行过滤。二、实验案例二层ACL的包过滤配置1、实验拓扑结构图：2、配置说明：实现在星期六8：00--到20：00时间段内对源MAC为000D-608B-0C95，目标的MAC地址为0011-0949-41BD的报文进行过滤源:PC1的IP地址:192.168.1.2接交换机S3552的E0/4接

2、口目标:PC2的IP地址:192.168.2.2接交换机S3552的E0/8接口3、具体配置：[Quidway]aclnamedjwlink[Quidway-acl-link-djw]rule1denyingress000D-608B-0C950-0-0egress0011-0949-41BD0-0-0time-rangesunke[Quidway-acl-link-djw]inte0/4[Quidway-Ethernet0/4]packet-filterinboundlink-groupdjw[

3、Quidway]time-rangesunke8:00to20:00saturdayclockdatetime17:00:002006/01/7[Quidway]discursysnameQuidwayradiusschemesystemserver-typehuaweiprimaryauthentication127.0.0.11645primaryaccounting127.0.0.11646user-name-formatwithout-domaindomainsystem

4、radius-schemesystemaccess-limitdisablestateactiveidle-cutdisableself-service-urldisablemessengertimedisabledomaindefaultenablesystemlocal-servernas-ip127.0.0.1keyhuaweitemperature-limit02080time-rangesunke08:00to20:00saturdayaclnamedjwlinkrule1denying

5、ress000d-608b-0c950000-0000-0000egress0011-0949-41bd0000-0000-0000time-rangesunkevlan1vlan2vlan3interfaceVlan-interface2ipaddress192.168.1.1255.255.255.0interfaceVlan-interface3ipaddress192.168.2.1255.255.255.0interfaceAux0/0interfaceEthernet0/1portac

6、cessvlan2interfaceEthernet0/2portaccessvlan2interfaceEthernet0/3portaccessvlan2interfaceEthernet0/4portaccessvlan2packet-filterinboundlink-groupdjwrule1interfaceEthernet0/5portaccessvlan2interfaceEthernet0/6portaccessvlan3interfaceEthernet0/7portacces

7、svlan3interfaceEthernet0/8portaccessvlan3interfaceEthernet0/9portaccessvlan3interfaceEthernet0/10portaccessvlan3interfaceEthernet0/11interfaceEthernet0/12interfaceEthernet0/13interfaceEthernet0/14interfaceEthernet0/15interfaceEthernet0/16interfaceEthe

8、rnet0/17interfaceEthernet0/18interfaceEthernet0/19interfaceEthernet0/20interfaceEthernet0/21interfaceEthernet0/22interfaceEthernet0/23interfaceEthernet0/24interfaceGigabitEthernet1/1interfaceGigabitEthernet1/2interfaceGigabitEthernet1/3interfa