多等级reflect acl配置实例

　　interface FastEthernet0/0

　　no ip address

　　duplex auto

　　speed auto

　　!

　　interface FastEthernet0/0.1

　　encapsulation isl 11

　　ip address 192.168.0.1 255.255.255.0

　　ip access-group v11 in

　　interface FastEthernet0/0.2

　　encapsulation isl 10

　　ip address 172.16.1.1 255.255.255.0

　　ip access-group v10 in

　　interface FastEthernet0/1

　　ip address 10.10.10.9 255.255.255.0

　　ip access-group v13 in

　　ip route 0.0.0.0 0.0.0.0 10.10.10.10

　　ip access-list extended v10

　　permit ip 172.16.1.0 0.0.0.255 172.18.0.0 0.0.255.255 reflect v133

　　permit tcp 172.16.1.0 0.0.0.255 172.18.0.0 0.0.255.255 reflect v133

　　permit udp 172.16.1.0 0.0.0.255 172.18.0.0 0.0.255.255 reflect v133

　　permit icmp 172.16.1.0 0.0.0.255 172.18.0.0 0.0.255.255 reflect v133

　　permit ip 172.16.1.0 0.0.0.255 192.168.0.0 0.0.0.255 reflect v111

　　permit tcp 172.16.1.0 0.0.0.255 192.168.0.0 0.0.0.255 reflect v111

　　permit udp 172.16.1.0 0.0.0.255 192.168.0.0 0.0.0.255 reflect v111

　　permit icmp 172.16.1.0 0.0.0.255 192.168.0.0 0.0.0.255 reflect v111

　　permit ip any any

　　ip access-list extended v11

　　evaluate v111

　　deny ip 192.168.0.0 0.0.0.255 172.16.1.0 0.0.0.255

　　deny icmp 192.168.0.0 0.0.0.255 172.16.1.0 0.0.0.255

　　deny udp 192.168.0.0 0.0.0.255 172.16.1.0 0.0.0.255

　　deny tcp 192.168.0.0 0.0.0.255 172.16.1.0 0.0.0.255

　　permit ip 192.168.0.0 0.0.0.255 172.18.0.0 0.0.255.255 reflect v133

　　permit udp 192.168.0.0 0.0.0.255 172.18.0.0 0.0.255.255 reflect v133

　　permit icmp 192.168.0.0 0.0.0.255 172.18.0.0 0.0.255.255 reflect v133

　　permit tcp 192.168.0.0 0.0.0.255 172.18.0.0 0.0.255.255 reflect v133

　　permit ip any any

　　ip access-list extended v13

　　evaluate v133

　　deny icmp 172.18.0.0 0.0.255.255 172.16.1.0 0.0.0.255

　　deny ip 172.18.0.0 0.0.255.255 172.16.1.0 0.0.0.255

　　deny udp 172.18.0.0 0.0.255.255 172.16.1.0 0.0.0.255

　　deny tcp 172.18.0.0 0.0.255.255 172.16.1.0 0.0.0.255

　　deny icmp 172.18.0.0 0.0.255.255 192.168.0.0 0.0.0.255

　　deny ip 172.18.0.0 0.0.255.255 192.168.0.0 0.0.0.255

　　deny tcp 172.18.0.0 0.0.255.255 192.168.0.0 0.0.0.255

　　deny udp 172.18.0.0 0.0.255.255 192.168.0.0 0.0.0.255

　　permit ip any any

　　ip access-list logging interval 100