ACL Configuration between VLANs (ruijie)

Step 1: Create vlan10, vlan20, and vlan30S5750 # conf ---- enter global configuration mode S5750 (config) # VLAN 10 ---- create VLAN10S5750 (config-vlan) # exit ---- exit VLAN configuration mode S5750 (config) # vlan 20 ---- create VLAN20S5750 (config-vlan) # exit ---- exit VLAN configuration mode S5750 (config) # vlan 30 ---- create VLAN30S5750 (config-vlan) # exit ---- exit VLAN configuration mode www.2cto.com Step 2: Add ports to their respective vlanS5750 (config) # interface range gigabitEthernet 0/1-5 ---- enter port S5750 (config-if-range) of gigabitEthernet 0/1-5) # switchport access vlan 10 ---- Add the port to vlan10S5750 (config-if-range) # exit ---- exit port configuration mode S5750 (config) # interface range gigabitEthernet 0/6-10 ---- enter port S5750 (config-if-range) of port 0/6-10 of gigabitEthernet) # switchport access vlan 20 ---- Add the port to vlan20S5750 (config-if-range) # exit ---- exit port configuration mode S5750 (config) # interface range gigabitEthernet 0/11-15 ---- enter port S5750 (config-if-range) of port 0/11-15 of gigabitEthernet) # switchport access vlan 30 ---- Add the port to vlan30S5750 (config-if-range) # exit ---- exit the Port Configuration Mode Step 3: configure the gateway IP address S5750 (config) # interface vlan 10 for vlan10, vlan20, and vlan30 ---- create the SVI interface S5750 (config-if) for vlan10) # ip address 192.168.10.1 255.255.255.0 ---- configure the gateway S5750 (config-if) for VLAN10 # exit ---- exit port configuration mode S5750 (config) # interface vlan 20 ---- create SVI interface S5750 (config-if) of vlan10 # ip address 192.168.20.1 255.255.255.0 ---- configure the gateway S5750 (config-if) of VLAN10) # exit ---- exit port configuration mode S5750 (config) # interface vlan 30 ---- create the SVI interface S5750 (config-if) of vlan10) # ip address 192.168.30.1 255.255.255.0 ---- configure the VLAN10 gateway S5750 (config-if) # exit ---- exit port configuration mode www.2cto.com Step 4: Create an ACL so that vlan20 can access vlan10, vlan30 cannot access vlan10S5750 (config) # ip access-list extended deny30 ---- define the extension ACLS5750 (config-ext-nacl) # deny ip 192.168.30.0 0.0.0.255 192.168.10.0 0.0.0.255 ---- reject vlan30 users from accessing vlan10 resources S5750 (config-ext-nacl) # permit ip any ---- Allow vlan30 users to access any other resource S5750 (config-ext-nacl) # exit ---- exit the extended ACL Configuration Mode Step 5: apply the ACL to S5750 (config) # interface vlan 30 at the in direction of the SVI port of vlan30 ---- create the SVI interface S5750 (config-if) of vlan30) # ip access-group deny30 in ---- apply the extended ACL to the SVI interface of vlan30