Multi-level reflect ACL Configuration instance

Interface fastethernet0/0
No IP Address
Duplex auto
Speed auto
!
Interface fastethernet0/0.1
Encapsulation isl 11
IP address 192.168.0.1 255.255.255.0
IP Access-group V11 in
Interface fastethernet0/0.2
Encapsulation isl 10
IP address 172.16.1.1 255.255.255.0
IP Access-group V10 in
Interface fastethernet0/1
IP address 10.10.10.9 255.255.255.0
IP Access-group v13 in

IP Route 0.0.0.0 0.0.0.0 10.10.10.10

IP Access-list extended V10
Permit IP 172.16.1.0 0.0.0.255 172.18.0.0 0.0.255.255 reflect v8.0
Permit TCP 172.16.1.0 0.0.0.255 172.18.0.0 0.0.255.255 reflect v8.0
Permit UDP 172.16.1.0 0.0.0.255 172.18.0.0 0.0.255.255 reflect v8.0
Permit ICMP 172.16.1.0 0.0.0.255 172.18.0.0 0.0.255.255 reflect v8.0
Permit IP 172.16.1.0 0.0.0.255 192.168.0.0 0.0.255 reflect v111
Permit TCP 172.16.1.0 0.0.0.255 192.168.0.0 0.0.255 reflect v111
Permit UDP 172.16.1.0 0.0.0.255 192.168.0.0 0.0.255 reflect v111
Permit ICMP 172.16.1.0 0.0.0.255 192.168.0.0 0.0.255 reflect v111
Permit IP any
IP Access-list extended V11
Evaluate v111
Deny IP 192.168.0.0 0.0.255 172.16.1.0 0.0.0.255
Deny ICMP 192.168.0.0 0.0.255 172.16.1.0 0.0.0.255
Deny UDP 192.168.0.0 0.0.255 172.16.1.0 0.0.0.255
Deny TCP 192.168.0.0 0.0.255 172.16.1.0 0.0.0.255
Permit IP 192.168.0.0 0.0.255 172.18.0.0 0.0.255.255 reflect v8.0
Permit UDP 192.168.0.0 0.0.255 172.18.0.0 0.0.255.255 reflect v8.0
Permit ICMP 192.168.0.0 0.0.255 172.18.0.0 0.0.255.255 reflect v8.0
Permit TCP 192.168.0.0 0.0.255 172.18.0.0 0.0.255.255 reflect v8.0
Permit IP any
IP Access-list extended v13
Evaluate vswitches
Deny ICMP 172.18.0.0 0.0.255.255 172.16.1.0 0.0.255
Deny IP 172.18.0.0 0.0.255.255 172.16.1.0 0.0.255
Deny UDP 172.18.0.0 0.0.255.255 172.16.1.0 0.0.255
Deny TCP 172.18.0.0 0.0.255.255 172.16.1.0 0.0.255
Deny ICMP 172.18.0.0 0.0.255.255 192.168.0.0 0.0.255
Deny IP 172.18.0.0 0.0.255.255 192.168.0.0 0.0.255
Deny TCP 172.18.0.0 0.0.255.255 192.168.0.0 0.0.255
Deny UDP 172.18.0.0 0.0.255.255 192.168.0.0 0.0.255
Permit IP any
IP Access-list logging interval 100

The preceding configurations enable three levels of CIDR blocks for the enterprise's general manager, finance, and employees.

Test method:
After the configuration is complete, use the ping command in different CIDR blocks to open two windows, respectively, ping the other two CIDR blocks.
In this case, use SH ip access-L on the router to check whether the required ACL is generated. If not, check which ACL is valid (according to the number of entries after the ACL, an ACL entry is gradually added during ping)

ArticleInput: CSH responsible editor: CSH