Using ACLs on layer three switches for isolation between different VLANs

Using ACLs on layer three switches for isolation between different VLANs   three VLAN vlan10 vlan20 vlan30    www.2cto.com  pc1 PC3 belongs to Vlan10 PC2 PC4 belong to Vlan20   pc5 belong to Vlan30vlan10 vlan20 Vlan30 can not exchange visits but Sisu net pc1:172.16.10.2    pc2:172.16.20.2 pc3:172.16.10.3    pc4:172.16.20.3 pc5:172.16.30.2   configuration r1int f0/0Ip Add 192.168.1.2 255.255.255.0 configuration f0/0no shint lo0ip Add 1.1.1.1 255.255.255.0       Configure loopback address to test the connectivity of each VLAN to the extranet no SH Configure routing for static routes to three-layer switch VLAN # IP route 172.16.10.0 255.255.255.0 192.168.1.1 # IP route 172.16.20.0 255.255.255.0 192.168 .1.1# IP route 172.16.30.0 255.255.255.0 192.168.1.1  configuration sw1#conf t#ip Routing                       enable the three-tier routing feature #int f0/0#no switch# IP add 192.168.1.1 255.255.255.0#no sh# #ip Route 0.0.0.0 0.0.0.0 192.168.1.2 Add default route to external network # #vlan Data#vlan name Caiwu &N Bsp;          &nbSP; establish Vlan#vlan name It#vlan name MANAGER#VTP Server                       set up VTP server mode #vtp domain cisco# #int range f0/1–2                Package Trunk Interface #sw mode trunk#sw trunk en dot1q## int F0/3                       add interface to VLAN 30#SW mode ACCESS#SW access VLAN 30# #int vlan10                          set addresses for each VLAN is also the gateway IP address of each subnet segment 172.16.10.1 255.255.255.0# interface VLAN20 IP address 172.16.20.1 255.255.255.0# interface Vlan30 ip address 172.16.30.1 255.255.255.0## access-list deny   ip 172.16.10.0 0.0.0.255 172.16.20.0 0.0.0.255    Build 100 101 list access-list   ip 172.16.10.0 0.0.0.255 172.16.30.0 0.0.0.255access-list permit IP any anyaccess-list 101 deny   ip 172.16.20.0 0.0 .0.255 172.16.10.0 0.0.0.255access-list 101 deny   ip 172.16.20.0 0.0.0.255 172.16.30.0 0.0.0.255access-list 101 Permit IP any anyaccess-list 102 deny IP 172.16.30.0 0.0.0.255 172.16.10.0 0.0.0.255access-list 102 deny IP 172.16.30. 0 0.0.0.255 172.16.30.0 0.0.0.255access-list 102 Permit IP any any   note: In an ACL between VLANs when the source address segment is an IP segment that applies a VLAN interface, the in direction When the destination address segment is an IP segment that applies a VLAN interface, it is using out direction           example to illustrate host 1.1.1.1      vlan10 (1.1.1.2) SW vlan20 (2.2.2.2)     host 2.2.2.1 prohibit host 1.1.1.1 access 2.2.2.1 method One access-list deny IP host 1.1.1.1 host 2.2.2.1access-list permit ip any anyint VLAN 10Ip access-list Two in method acc Ess-list deny IP host 1.1.1.1 host 2.2.2.1access-list permit ip any anyint VLAN 20Ip access-list p; #int VLAN                 Load the access control list to each VLAN#IP access-group in#int VLAN 20#IP Access-group 101 in#int VLAN 30Ip access-group 102 in  configuration Sw2#int f0/0#sw m trunk#sw t en dot1q# #vlan DATA#VTP client# VTP domain cisco# #int f0/1#sw m ACCE#SW access vlan 10#int F0/2#SW m ACCE#SW access VLAN 20# SW3 Ibid  

Using ACLs on layer three switches for isolation between different VLANs