三層交換機上做端口隔離

1、三層交換機上做端口隔離  2011-10-28 11:15:01|  分類： 默認分類 |  標簽： |字號大中小 訂閱 在不支持端口保護（switchport protect）的三層交換機上，要想達到端口隔離的效果。  問題及要求如圖。 解決思路是利用vlan。問題是在三層交換機上，vlan之間是可以通過三層轉(zhuǎn)發(fā)的。所以要設(shè)置ACL進行控制。每個端口劃分一個vlan，分別是Vlan101、Vlan102、Vlan103.Vlan124A1接到三層交換的F0/1，劃分vlan101，A2接到三層

2、交換的F0/2，劃分vlan102.在每個vlan啟用虛擬接口，分配相應地址，并增加access-group。如：interface Vlan101 ip access-group 101 in相應的access-list為：access-list 101 permit ip host 192.168.1.3 host 192.168.19.1                    &#

3、160;   ；允許訪問RCM1access-list 101 permit ip host 192.168.1.3 host 192.168.24.200                    ；允許訪問Serveraccess-list 101 deny ip host 192.168.1.3 any       

4、                                          ；拒絕訪問其它這樣，接在這個端口的主機A1，便不能與其它主機通訊。達到了端口隔離的目的。注意：1.沒有實測

5、過是否影響影響交換性能。          2.端口F0/1如果級聯(lián)下層交換機，對性能方面會有什么影響？ 附：完整running-config  Switch#sh runBuilding configuration.Current configuration : 4581 bytes!version 12.2no service timestamps log datetime msecno service timestamps debug datetime msecno s

6、ervice password-encryption!hostname Switch!interface FastEthernet0/1 switchport access vlan 101!interface FastEthernet0/2 switchport access vlan 102!interface FastEthernet0/3 switchport access vlan 103!interface FastEthernet0/4 switchport access vlan 104!interface FastEthernet0/5

7、 switchport access vlan 105!interface FastEthernet0/6 switchport access vlan 106!interface FastEthernet0/7 switchport access vlan 107!interface FastEthernet0/8 switchport access vlan 108!interface FastEthernet0/9 switchport access vlan 109!interface FastEthernet0/10 swi

8、tchport access vlan 110!interface FastEthernet0/11 switchport access vlan 111!interface FastEthernet0/12 switchport access vlan 112!interface FastEthernet0/13 switchport access vlan 113!interface FastEthernet0/14 switchport access vlan 114!interface FastEthernet0/15 switchpo

9、rt access vlan 115!interface FastEthernet0/16 switchport access vlan 116!interface FastEthernet0/17 switchport access vlan 117!interface FastEthernet0/18 switchport access vlan 118!interface FastEthernet0/19 switchport access vlan 119!interface FastEthernet0/20 switchport ac

10、cess vlan 120!interface FastEthernet0/21 switchport access vlan 121!interface FastEthernet0/22 switchport access vlan 122!interface FastEthernet0/23 switchport access vlan 123!interface FastEthernet0/24 switchport access vlan 124!interface GigabitEthernet0/1!interface GigabitEthe

11、rnet0/2!interface Vlan1 no ip address shutdown!interface Vlan101 ip access-group 101 in!interface Vlan102 ip access-group 102 in!interface Vlan103 ip access-group 103 in!interface Vlan104 ip access-group 104 in!interface Vlan105 ip access-group 105 in!interface Vla

12、n106 ip access-group 106 in!interface Vlan107!interface Vlan108!interface Vlan109!interface Vlan110!interface Vlan111!interface Vlan112!interface Vlan113!interface Vlan114!interface Vlan115!interface Vlan116!interface Vlan117!interface Vlan118!interface Vlan119!interface Vlan120!interface Vlan121!interface Vlan122!interface Vlan123!interface Vlan124!router rip!ip classlessip route 192.168.100.0 255.255.255.0 192.168.19.1 !access-list 101 deny ip host 192.168.1.3 anyaccess-list 102 deny ip host 192.168.2.3 anyaccess-list 103 den