二层交换机的两个vlan互相访问.docx

假如A交换机vlan100,vlan200,B交换机vlan300,vlan400,怎样配置可以让vlan300不能访问vlan100?vlan200可以访问vlan400?

有多种方法可以实现：比如PVLAN，ACL等。按照你的拓扑，我用PT模拟了一种做法：单臂路由+ACL，可以参考一下，有图，有配置：

交换机A:

interfaceFastEthernet0/2switchportaccessvlan100switchportmodeaccess

!

interfaceFastEthernet0/3switchportaccessvlan100switchportmodeaccess

!

interfaceFastEthernet0/11switchportaccessvlan200switchportmodeaccess

!

interfaceFastEthernet0/12switchportaccessvlan200switchportmodeaccess

!

interfaceFastEthernet0/1

switchporttrunkallowedvlan100,200switchportmodetrunk

交换机B:

interfaceFastEthernet0/2switchportaccessvlan300switchportmodeaccess

!

interfaceFastEthernet0/3switchportaccessvlan300switchportmodeaccess

!

interfaceFastEthernet0/11switchportaccessvlan400switchportmodeaccess

!

interfaceFastEthernet0/12switchportaccessvlan400switchportmodeaccess

!

interfaceFastEthernet0/1

switchporttrunkallowedvlan300,400switchportmodetrunk

Router:

interfaceFastEthernet0/0.1encapsulationdot1Q100

ipaddress192.168.1.1255.255.255.0

!

interfaceFastEthernet0/0.2encapsulationdot1Q200

ipaddress192.168.2.1255.255.255.0

!

interfaceFastEthernet0/1.1encapsulationdot1Q400

ipaddress192.168.4.1255.255.255.0

ipaddress192.168.4.1255.255.255.0

!

interfaceFastEthernet0/1.2encapsulationdot1Q300

ipaddress192.168.3.1255.255.255.0

ipaccess-group1out

!

access-list1deny192.168.1.00.0.0.255access-list1permitany

60BootLoader(C2960-HBOOT-M)Version12.2(25r)FX,RELEASESOFTWARE(fc4)

CiscoWS-C2960-24TT(RC32300)processor(revisionC0)with21039Kbytesofmemory.2960-24TTstarting...

BaseethernetMACAddress:0001.42AD.CAACXmodemfilesystemisavailable.

InitializingFlash...

flashfs[0]:1files,0directories

flashfs[0]:0orphanedfiles,0orphaneddirectoriesflashfs[0]:Totalbytes:flashfs[0]:Bytesused:4414921flashfs[0]:Bytesavailable:flashfs[0]:flashfsfscktook1seconds.

...doneInitializ