interface FastEthernet0/0
no ip address
duplex auto
speed auto
!
interface FastEthernet0/0.1
encapsulation isl 11
ip address 192.168.0.1 255.255.255.0
ip access-group v11 in
interface FastEthernet0/0.2
encapsulation isl 10
ip address 172.16.1.1 255.255.255.0
ip access-group v10 in
interface FastEthernet0/1
ip address 10.10.10.9 255.255.255.0
ip access-group v13 in
ip route 0.0.0.0 0.0.0.0 10.10.10.10
ip access-list extended v10
permit ip 172.16.1.0 0.0.0.255 172.18.0.0 0.0.255.255 reflect v133
permit tcp 172.16.1.0 0.0.0.255 172.18.0.0 0.0.255.255 reflect v133
permit udp 172.16.1.0 0.0.0.255 172.18.0.0 0.0.255.255 reflect v133
permit icmp 172.16.1.0 0.0.0.255 172.18.0.0 0.0.255.255 reflect v133
permit ip 172.16.1.0 0.0.0.255 192.168.0.0 0.0.0.255 reflect v111
permit tcp 172.16.1.0 0.0.0.255 192.168.0.0 0.0.0.255 reflect v111
permit udp 172.16.1.0 0.0.0.255 192.168.0.0 0.0.0.255 reflect v111
permit icmp 172.16.1.0 0.0.0.255 192.168.0.0 0.0.0.255 reflect v111
permit ip any any
ip access-list extended v11
evaluate v111
deny ip 192.168.0.0 0.0.0.255 172.16.1.0 0.0.0.255
deny icmp 192.168.0.0 0.0.0.255 172.16.1.0 0.0.0.255
deny udp 192.168.0.0 0.0.0.255 172.16.1.0 0.0.0.255
deny tcp 192.168.0.0 0.0.0.255 172.16.1.0 0.0.0.255
permit ip 192.168.0.0 0.0.0.255 172.18.0.0 0.0.255.255 reflect v133
permit udp 192.168.0.0 0.0.0.255 172.18.0.0 0.0.255.255 reflect v133
permit icmp 192.168.0.0 0.0.0.255 172.18.0.0 0.0.255.255 reflect v133
permit tcp 192.168.0.0 0.0.0.255 172.18.0.0 0.0.255.255 reflect v133
permit ip any any
ip access-list extended v13
evaluate v133
deny icmp 172.18.0.0 0.0.255.255 172.16.1.0 0.0.0.255
deny ip 172.18.0.0 0.0.255.255 172.16.1.0 0.0.0.255
deny udp 172.18.0.0 0.0.255.255 172.16.1.0 0.0.0.255
deny tcp 172.18.0.0 0.0.255.255 172.16.1.0 0.0.0.255
deny icmp 172.18.0.0 0.0.255.255 192.168.0.0 0.0.0.255
deny ip 172.18.0.0 0.0.255.255 192.168.0.0 0.0.0.255
deny tcp 172.18.0.0 0.0.255.255 192.168.0.0 0.0.0.255
deny udp 172.18.0.0 0.0.255.255 192.168.0.0 0.0.0.255
permit ip any any
ip access-list logging interval 100
The above configurations enable three levels of network segment access, which is used for the three network segments of the enterprise's general manager, finance, and employees.
Test method:
After the configuration is completed, use the ping command to open two windows in different network segments, and ping the other two network segments respectively.
At this time, use sh ip access-l on the router to see if the acl you need has generated. If not, check which acl is effective (based on the number of entries behind acl, the ping process will gradually increase the entries of an acl)