Layer-3 Switch ACLs are used to isolate different VLANs.

Layer-3 Switch ACLs are used to isolate different VLANs. Create three VLANs: vlan10 vlan20 vlan30 www.2cto.com PC1 PC3 vlan10 PC2 PC4 vlan20 PC5 vlan30Vlan10 vlan20 vlan30 cannot communicate with each other but can access the Internet Pc1: 172.16.10.2 pc2: 172.16.20.2 pc3: 172.16.10.3 pc4: 172.16.20.3 pc5: 172.16.30.2 configure R1Int f0/0Ip add 192.168.1.2 255.255.255.0 configure f0/0No shInt lo0Ip add 1.1.1.1 255.255.255.0 configure the loopback IP address to test the connectivity between VLANs and the Internet. route # ip route 172.16.10.0 255.255.255.0 192.168.1.1 # ip route 172.16.20.0 255.255.255.0 192.168.1.1 # ip route 172.16.30.0 255.255.255.0 192.168.1.1 configure SW1 # conf t # ip routing enable L3 routing # int f0/0 # no switch # ip add 192.168.1.1 255.255.255.0 # no sh # ip route 0.0.0.0 0.0.0.0 192.168.1.2 the default route added to the external network # vlan data # vlan 10 name caiwu vlan # vlan 20 name it # vlan 30 name manager # vtp server mode # vtp domain cisco # int range f0/1-2 encapsulation trunk interface # sw mode trunk # sw trunk en dot1q # int f0/3 add an interface to vlan 30 # sw mode access # sw access vlan 30 # int vlan10 configure ip addresses for each vlan as the gateway ip address of each subnet segment 172.16.10.1 255.255.255.0 # interface Vlan20 ip address 172.16.20.1 255.255.255.0 # interface Vlan30 ip address 172.16.30.1 255.255.255.0 # access-list 100 deny ip 172.16.10.0 255.172.16.20.0 creating 100 list access-list 101 deny ip 172.16.10.0 255.172.16.30.0 region-list 100 permit ip any access -list 101 deny ip 172.16.20.0 255.172.16.10.0 255.- list 101 deny ip 172.16.20.0 255.255.255.255.-list 101 permit ip any anyaccess-list 102 deny ip 172.16.30.0 255.172.16.10.0 255.- list 102 deny ip 172.16.30 0.0.0.255 172.16.30.0 0.0.0.255access-list 102 permit ip any note: in an acl between VLANs, when the source CIDR block is the ip segment of the application vlan interface, the in direction is used. When the destination CIDR block is the ip segment of the application vlan interface, host 1.1.1.1 vlan10 (1.1.1.2) SW vlan20 (2.2.2.2) host 2.2.2.1 disable host 1.1.1.1 Access 2.2.2.1 method 1 access-list 100 deny ip host 1.1.1.1 host 2.2.2.1Access-list 100 permit ip any anyInt vlan 10Ip Access-list 100 in method 2 Access-list 100 deny ip host 1.1.1.1 host 2.2.2.1Access-list 100 permit ip any anyInt vlan 20Ip access-list 100 out # int vlan 10 load the access control list to each vlan # ip access-group 100 in # int vlan 20 # ip access-group 101 in # int vlan 30Ip access-group 102 in SW2 # int f0/0 # sw m trunk # sw t en dot1q # vlan data # vtp client # vtp domain cisco # int f0/1 # sw m acce # sw access vlan 10 # int f0/2 # sw m acce # sw access vlan 20 # SW3 same as above