拓扑图如下:
条件如下:
三台路由器
client 1 IP地址如下
192.168.1.1/24
191.168.1.254
Server 1 服务器IP地址
192.168.3.1/24
192.168.3.254
PC1 IP地址如下
192.168.2.1/24
192.168.2.254
================================
AR-1:
<Huawei>system-view //进系统视图
[Huawei]sysname AR-1 //修改主机名为AR-1
[AR-1]int g0/0/2 //进入g0/0/2接口
[AR-1-GigabitEthernet0/0/2]ip address 192.168.1.254 24 //配置IP地址和子网掩码
[AR-1-GigabitEthernet0/0/2]int g0/0/0 //切换接口
[AR-1-GigabitEthernet0/0/0]ip address 192.168.12.1 24 //配置IP地址和子网掩码
[AR-1]ip route-static 0.0.0.0 0.0.0.0 192.168.12.2 //配置静态路由下一跳IP地址192.168.12.2
[AR-1]acl 3000 //创建高级acl 3000
[AR-1-acl-adv-3000]rule 5 permit tcp source 192.168.1.1 0 destination 192.168.3.1 0 destination-port eq 80 //允许Client到Server的web 流量
[AR-1-acl-adv-3000]rule 10 permit ip source 192.168.1.1 0 destination 192.168.2.0 0.0.0.255 //允许Client到PC1网段内所有流量
[AR-1-acl-adv-3000]rule 15 deny ip source 192.168.1.1 0 destination any //拒绝其他流量
[AR-1-acl-adv-3000]q //退到上一层
[AR-1]int g0/0/2 //进入g0/0/2接口
[AR-1-GigabitEthernet0/0/2]traffic-filter inbound acl 3000 //在接口上配置，调用高级ACL 3000
====================================================================================
AR-2:
<Huawei>system-view //进系统视图
[Huawei]sysname AR-2 //修改主机名为AR-2
[AR-2]int g0/0/1 //进入g0/0/1接口
[AR-2-GigabitEthernet0/0/1]ip address 192.168.12.2 24 //配置IP地址和子网掩码
[AR-2-GigabitEthernet0/0/1]int g0/0/2 //切换接口
[AR-2-GigabitEthernet0/0/2]ip address 192.168.2.254 24 //配置IP地址和子网掩码
[AR-2-GigabitEthernet0/0/2]int g0/0/0 //切换接口
[AR-2-GigabitEthernet0/0/0]ip address 192.168.23.2 24 //配置IP地址和子网掩码
[AR-2]ip route-static 192.168.1.0 24 192.168.12.1 //配置默认路由地址192.168.12.1
[AR-2]ip route-static 192.168.3.0 24 192.168.23.3 //配置默认路由地址192.168.23.3
====================================================================================
AR-3:
<Huawei>system-view //进系统视图
[Huawei]sysname AR-3 //修改主机名为AR-3
[AR-3]int g0/0/1 //进入g0/0/1接口
[AR-3-GigabitEthernet0/0/1]ip address 192.168.23.3 24 //配置IP地址和子网掩码
[AR-3]ip route-static 0.0.0.0 0.0.0.0 192.168.23.2 //配置静态路由下一跳IP地址192.168.23.2
=====================================================================================
将Server1开启web服务功能
测试如下:
Client1可以访问Server1的Web服务
client1 可以ping通192.168.2.1
Client 不能访问192.168.3.1 以及其他网段
