192.168.1.0/2.0/3.0/4.0/5.0都可以上外网,但是这五个网段之间要相互隔离,用ACL实现

Question

192.168.1.0/2.0/3.0/4.0/5.0都可以上外网,但是这五个网段之间要相互隔离,用ACL实现,要求最多不超过12条ACL语句.
这个可以不？
access-list 101 deny ip any 192.168.1.0 0.0.0.255
access-list 101 deny ip any 192.168.2.0 0.0.0.255
access-list 101 deny ip any 192.168.3.0 0.0.0.255
access-list 101 deny ip any 192.168.4.0 0.0.0.255
access-list 101 deny ip any 192.168.5.0 0.0.0.255
access-list 101 permit ip any any
下连1.0口 ip access-group 101 in
下连2.0口 ip access-group 101 in

下连3.0口 ip access-group 101 in

下连4.0口 ip access-group 101 in

下连5.0口 ip access-group 101 in

Answer 1

如果你路由器的F0/0是接Internet，F0/1是接内网端口
access-list 101 deny ip 192.168.1.0 0.0.0.255 any
access-list 101 deny ip 192.168.2.0 0.0.0.255 any
access-list 101 deny ip 192.168.3.0 0.0.0.255 any
access-list 101 deny ip 192.168.4.0 0.0.0.255 any
access-list 101 deny ip 192.168.5.0 0.0.0.255 any
access-list 101 permit ip any any

interface fastethernet 0/1
ip access-group 101 in

追问

我是不让这5个网段互相访问，不是阻止访问外网，你这写的1-5网段都不能访问外网了

追答

不好意思，是我写错了！
access-list 101 deny ip 192.168.1.0 0.0.0.255 192.168.0.0 0.0.255.255
access-list 101 deny ip 192.168.2.0 0.0.0.255 192.168.0.0 0.0.255.255
access-list 101 deny ip 192.168.3.0 0.0.0.255 192.168.0.0 0.0.255.255
access-list 101 deny ip 192.168.4.0 0.0.0.255 192.168.0.0 0.0.255.255
access-list 101 deny ip 192.168.5.0 0.0.0.255 192.168.0.0 0.0.255.255
access-list 101 permit ip any any
下连1.0口 ip access-group 101 in
下连2.0口 ip access-group 101 in
下连3.0口 ip access-group 101 in
下连4.0口 ip access-group 101 in
下连5.0口 ip access-group 101 in

这样你可以试下，应该是没问题的，我做实验测试过的