模拟场景
服务器：192.168.3.100
销售部：192.168.1.1
开发部：192.168.2.1
模拟互联网：1.1.1.1
要求1：销售部不允许访问服务器
要求2：开发部可以访问服务器
要求3：互联网不可以访问服务器
拓扑图
路由器配置
进入系统视图
更改路由器设备名称router
为各个部门指定网关
<Huawei> system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]
[Huawei]
[Huawei]sysname router
[router]interface gigabitethernet 0/0/0
[router-GigabitEthernet0/0/0]ip address 192.168.1.254 24
[router-GigabitEthernet0/0/0]interface gigabitethernet 0/0/1
[router-GigabitEthernet0/0/1]ip address 192.168.2.254 24
[router-GigabitEthernet0/0/1]interface gigabitethernet 0/0/2
[router-GigabitEthernet0/0/2]ip address 1.1.1.254 24
[router-GigabitEthernet0/0/2]interface ethernet 0/0/0
[router-Ethernet0/0/0]ip address 192.168.3.254 24
[router-Ethernet0/0/0
模拟互联网路由器配置
进入系统视图
进入端口g0/0/0
设置网关
添加一条默认静态路由，让流量可以传给1.1.1.254，这个时候所有设备可以访问互联网。
<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]interface gigabitethernet 0/0/0
[Huawei-GigabitEthernet0/0/0]ip address 1.1.1.1 24
[Huawei-GigabitEthernet0/0/0]q
[Huawei]ip route-static 0 0 1.1.1.254
^
Error: Wrong parameter found at '^' position.
[Huawei]ip route-static 0.0.0.0 0 1.1.1.254
[Huawei]
ACL配置
创建3条acl规则
1.拒绝销售访问192.168.3.100
2.允许开发访问192.168.3.100
3.拒绝互联网访问192.168.3.100
最后在路由器的e0/0/0 接口上应用alc3000。
<router>
<router>sys
Enter system view, return user view with Ctrl+Z.
[router]acl 3000
[router-acl-adv-3000]rule 1 deny ip source 192.168.1.0 0.0.0.255 destination 192
.168.3.100 0.0.0.0
[router-acl-adv-3000]rule 2 permit ip source 192.168.2.0 0.0.0.255 destination 1
92.168.3.100 0.0.0.0
[router-acl-adv-3000]rule 3 deny ip souce any destination 192.168.3.100 0.0.0.0
^
Error:Too many parameters found at '^' position.
[router-acl-adv-3000]rule 3 deny ip source any destination 192.168.3.100 0.0.0.0
[router-acl-adv-3000]q
[router]interface ethernet 0/0/0
[router-Ethernet0/0/0]traffic-filter outbound acl 3000
