思科三层交换机配置ACL（访问控制列表）的步骤讲解

article/2025/9/16 2:20:08

ACL访问控制列表是构建安全规范的网络不可缺少的，但在三层交换机上配置ACL却不为一些刚进企业的初级网络管理维护人员所知。下面介绍一下在三层交换机上配置ACL的试验过程。

在这里插入图片描述
三层交换机上配置本地Vlan 实现下层接入层交换机不同Vlan互通。

PC1 192.168.20.10 VLAN 192.168.20.1

PC2 192.168.30.20 VLAN 192.168.30.1

PC3 192.168.40.30 VLAN 192.168.40.1

PC4 192.168.50.40 VLAN 192.168.50.1

F0/1 192.168.70.2 （开启路由功能）

路由器上配置

F0/0 192.168.60.1 PC5 192.168.60.50

F0/1 192.168.70.1

实验步骤：

1、在二层交换机上把相应的PC加入VLAN

# 查看交换机Switch0Switch0(config)#show runinterface FastEthernet0/1switchport access vlan 2interface FastEthernet0/2switchport access vlan 3# 查看交换机Switch1Switch1#show runinterface FastEthernet0/3switchport access vlan 4interface FastEthernet0/4switchport access vlan 5

2、在三层交换机上配置相应的本地VALN

Switch(config)#inter vl 2Switch(config-if)#ip add 192.168.20.1 255.255.255.0Switch(config-if)#no shutSwitch(config)#inter vl 3Switch(config-if)#ip add 192.168.30.1 255.255.255.0Switch(config-if)#no shutSwitch(config)#inter vl 4Switch(config-if)#ip add 192.168.40.1 255.255.255.0Switch(config-if)#no shutSwitch(config)#inter vl 5Switch(config-if)#ip add 192.168.50.1 255.255.255.0Switch(config-if)#no shutSwitch(config-if)#exi# 在接口itnerface f0/1上开启路由接口Switch(config)#inter f0/1Switch(config-if)#no switchport

3、在二层交换机和三层交换机之间开启中继链路

4、在路由器和三层交换机上配置动态路由协议RIP

Router（config）#router  ripRouter（config）#network 192.168.60.0Router（config）# network 192.168.70.0# 三层交换机上配置Switch(config)#router ripSwitch(config-router)#neSwitch(config-router)#network 192.168.70.0Switch(config-router)#network 192.168.20.0Switch(config-router)#network 192.168.30.0Switch(config-router)#network 192.168.40.0Switch(config-router)#network 192.168.50.0Switch(config-router)#

5、验证各PC互通

PC>ping 192.168.30.20Pinging 192.168.30.20 with 32 bytes of data:Request timed out.Reply from 192.168.30.20: bytes=32 time=110ms TTL=126Reply from 192.168.30.20: bytes=32 time=110ms TTL=126Reply from 192.168.30.20: bytes=32 time=125ms TTL=126Ping statistics for 192.168.30.20:Packets: Sent = 4, Received = 3, Lost = 1 (25% loss),Approximate round trip times in milli-seconds:Minimum = 110ms, Maximum = 125ms, Average = 115msPC>ping 192.168.40.30Pinging 192.168.40.30 with 32 bytes of data:Reply from 192.168.40.30: bytes=32 time=94ms TTL=126Reply from 192.168.40.30: bytes=32 time=125ms TTL=126Reply from 192.168.40.30: bytes=32 time=125ms TTL=126Reply from 192.168.40.30: bytes=32 time=109ms TTL=126Ping statistics for 192.168.40.30:Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),Approximate round trip times in milli-seconds:Minimum = 94ms, Maximum = 125ms, Average = 113ms

6、在三层交换机上配置ACL

#注意如果设置不同VALN的PC之间不能互通，则应用的接口应为VLAN对应的本地Llan接口。

# 设置PC1不能ping通PC3和PC4Switch(config)#access-list 10 deny host 192.168.20.10# 应用于接口Switch(config)#inter vl 4Switch(config-if)#ip access-group 10 outSwitch(config-if)#exiSwitch(config)#inter vl 5Switch(config-if)#ip access-group 10 outSwitch(config-if)## 或者是Switch(config)#inter vl 2Switch(config-if)#ip access-group 10 inSwitch(config-if)#

注意：此处ACL应用于接口，从PC1到PC3 和PC4，数据流走向是经过三层交换机上配置的本地Vlan2接口进入，再从三层交换机上配置的本地Vlan4出去到达PC3，从本地Vlan5出去到达PC4。所以在配置ACL时应注意访问控制列表应用于哪个接口。

7、验证：

# PC1不能ping通PC3和PC4PC>ping 192.168.50.40Pinging 192.168.50.40 with 32 bytes of data:Request timed out.Request timed out.Ping statistics for 192.168.50.40:Packets: Sent = 3, Received = 0, Lost = 3 (100% loss),Control-C^CPC>ping 192.168.40.30Pinging 192.168.40.30 with 32 bytes of data:Request timed out.Request timed out.Request timed out.Request timed out.