网络管理：VLAN间访问控制

　　VAN10,VLAN20,VLAN30
　　要求 VLAN20,30都能访问VLAN10,但20,30之间不能相互访问.

　　1.用策略路由控制,让去往VLAN10的被路由到正确接口,其他的都被送到丢弃口

　　access-list 100 permit ip any 192.168.10.0 0.0.0.255

　　route-map tovlan1 permit 10

　　match address 100

　　set default interface f 0/0.10

　　route-map tovlan1 permit 20

　　set defaultinterface null0

　　interface f0/0.20

　　ip policy route-map tovlan1

　　interface f0/0.30

　　ip policy route-map tovlan1

　　上面配置由于存在显式路由(直连的) 用缺省借口的方法不行

　　(PBR中:

　　set ip next-hop 不检查是否存在显式路由,只检查下一跳是否可达

　　set interface 检查是否存在显式路由,必须存在才能正常

　　set ip default next-hp 检查是否存在显式路由,必须不存在才正常

　　set default interface 检查是否存在显式路由,必须不存在才正常

　　)

　　*Mar 1 02:25:10.443: IP: s=192.168.20.1 (FastEthernet0/0.20), d=192.168.10.1, len 100, FIB policy match

　　*Mar 1 02:25:10.443: IP: s=192.168.20.1 (FastEthernet0/0.20), d=192.168.10.1, len 100, FIB policy rejected(explicit route)- normal forwarding

　　*Mar 1 02:25:10.459: IP: s=192.168.20.1 (FastEthernet0/0.20), d=192.168.10.1, len 100, FIB policy match

　　*Mar 1 02:25:10.459: IP: s=192.168.20.1 (FastEthernet0/0.20), d=192.168.10.1

　　R1#, len 100, FIB policy rejected(explicit route) - normal forwarding

　　*Mar 1 02:25:10.475: IP: s=192.168.20.1 (FastEthernet0/0.20), d=192.168.10.1, len 100, FIB policy match

　　*Mar 1 02:25:10.475: IP: s=192.168.20.1 (FastEthernet0/0.20), d=192.168.10.1, len 100, FIB policy rejected(explicit route) - normal forwarding

　　*Mar 1 02:25:10.551: IP: s=192.168.20.1 (FastEthernet0/0.20), d=192.168.10.1, len 100, FIB policy match

　　*Mar 1 02:25:10.551: IP: s=192.168.20.1 (FastEthernet0/0.20), d=192.168.10.1, len 100, FIB policy rejected(explicit route) - normal forwarding

　　改成:

　　route-map govlan1 permit 10

　　match address 100

　　set interface f 0/0.10

　　route-map govlan1 permit 20

　　set interface null0

　　后正常

　　*Mar 1 02:35:31.059: IP: s=192.168.20.1 (FastEthernet0/0.20), d=192.168.10.1, len 100, FIB policy match

　　*Mar 1 02:35:31.063: IP: s=192.168.20.1 (FastEthernet0/0.20), d=192.168.10.1 (FastEthernet0/0.10), len 100, FIB policy routed

　　*Mar 1 02:35:31.111: IP: s=192.168.20.1 (FastEthernet0/0.20), d=192.168.10.1, len 100, FIB policy match

　　*Mar 1 02:35:31.111: IP: s=192.168.20.1 (FastEthernet0/0.20), d=192.168.10.1 (FastEthernet0/0.10), len 100, FIB policy routed

　　*Mar 1 02:35:31.139: IP: s=192.168.20.1 (FastEthernet0/0.20), d=192.168.10.1, len 100, FIB policy match

　　*Mar 1 02:35:31.139: IP: s=192.168.20.1 (FastEthernet0/0.20), d=192.168.10.1 (FastEthernet0/0.10)

　　R1#, len 100, FIB policy routed

　　*Mar 1 02:35:31.159: IP: s=192.168.20.1 (FastEthernet0/0.20), d=192.168.10.1, len 100, FIB policy match

　　*Mar 1 02:35:31.159: IP: s=192.168.20.1 (FastEthernet0/0.20), d=192.168.10.1 (FastEthernet0/0.10), len 100, FIB policy routed

　　*Mar 1 02:35:31.187: IP: s=192.168.20.1 (FastEthernet0/0.20), d=192.168.10.1, len 100, FIB policy match

　　*Mar 1 02:35:31.187: IP: s=192.168.20.1 (FastEthernet0/0.20), d=192.168.10.1 (FastEthernet0/0.10), len 100, FIB policy routed

　　R1#

　　*Mar 1 02:35:35.135: IP: s=192.168.20.1 (FastEthernet0/0.20), d=192.168.30.1, len 100, FIB policy match

　　*Mar 1 02:35:35.139: IP: s=192.168.20.1 (FastEthernet0/0.20), d=192.168.30.1 (Null0), len 100, FIB policy routed(drop)

　　R1#

　　*Mar 1 02:35:37.171: IP: s=192.168.20.1 (FastEthernet0/0.20), d=192.168.30.1, len 100, FIB policy match

　　*Mar 1 02:35:37.175: IP: s=192.168.20.1 (FastEthernet0/0.20), d=192.168.30.1 (Null0), len 100, FIB policy routed(drop)

　　R1#

　　*Mar 1 02:35:39.183: IP: s=192.168.20.1 (FastEthernet0/0.20), d=192.168.30.1, len 100, FIB policy match

　　*Mar 1 02:35:39.187: IP: s=192.168.20.1 (FastEthernet0/0.20), d=192.168.30.1 (Null0), len 100, FIB policy routed(drop)

　　R1#

　　*Mar 1 02:35:41.179: IP: s=192.168.20.1 (FastEthernet0/0.20), d=192.168.30.1, len 100, FIB policy match

　　*Mar 1 02:35:41.183: IP: s=192.168.20.1 (FastEthernet0/0.20), d=192.168.30.1 (Null0), len 100, FIB policy routed(drop)

　　R1#

　　*Mar 1 02:35:43.187: IP: s=192.168.20.1 (FastEthernet0/0.20), d=192.168.30.1, len 100, FIB policy match

　　*Mar 1 02:35:43.191: IP: s=192.168.20.1 (FastEthernet0/0.20), d=192.168.30.1 (Null0), len 100, FIB policy routed(drop)