交换机的VACL测试

一.测试拓扑：

R1------------SW1------------------(MAC:2.2.2)R2

|

R3

R1，R2，R3都在VLAN11中，R1连接SW1的接口手工指定mac地址为1.1.1,R2连接SW1的接口手工指定mac地址为2.2.2;

R1接口的IP地址为10.1.1.1;

R2接口的IP地址为10.1.1.2;

R3接口的IP地址为10.1.1.3.

二.交换机VACL第一种配置方式：

mac access-list extended R2

permit host 0002.0002.0002 any   （只能屏蔽非IP包，比如arp包）

access-list 100 permit ip host 10.1.1.3 any

vlan access-map test 10

match ip address 100

action drop

vlan access-map test 20

match mac address R2

action drop

vlan access-map test 30

action forward

!

vlan filter test vlan-list 11

因为SW1拒绝了R2发出的非IP包（arp回应包被拒绝了），R1和R3没有R2接口地址的ARP条目，导致R1无法ping和telnet R2，如果R1手工添加R2接口地址的ARP条目，R1则能pint和telnet R2，返回过来也可以。

A.R1 PING R3

R1#ping 10.1.1.3

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.1.1.3, timeout is 2 seconds:

.....

Success rate is 0 percent (0/5)

R3#

*Feb 12 11:19:41.002: ICMP: echo reply sent, src 10.1.1.3, dst 10.1.1.1

*Feb 12 11:19:43.002: ICMP: echo reply sent, src 10.1.1.3, dst 10.1.1.1

*Feb 12 11:19:45.002: ICMP: echo reply sent, src 10.1.1.3, dst 10.1.1.1

*Feb 12 11:19:47.002: ICMP: echo reply sent, src 10.1.1.3, dst 10.1.1.1

*Feb 12 11:19:49.002: ICMP: echo reply sent, src 10.1.1.3, dst 10.1.1.1

B.R3 PING R1

R3#ping 10.1.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:

.....

Success rate is 0 percent (0/5)

在R1上开启debug没有看到数据包到达R1