问答看到的，随便敲了敲，希望各路大佬不吝赐教~
话说现在的问答全是ai，乌烟瘴气的
- 首先配置全互通，ip vlan 端口隔离 ospf啥的
SWA
#
vlan batch 10 20 30 99
#
interface Vlanif1
ip address 10.1.1.2 255.255.255.0
#
interface Vlanif10
ip address 172.16.1.1 255.255.255.0
#
interface Vlanif20
ip address 172.16.2.1 255.255.255.0
#
interface Vlanif30
ip address 172.16.3.1 255.255.255.0
#
interface Vlanif99
ip address 172.16.99.1 255.255.255.0
#
interface GigabitEthernet0/0/1
port link-type access
#
interface GigabitEthernet0/0/2
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#
interface GigabitEthernet0/0/3
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#
ospf 1
default-route-advertise always
area 0.0.0.0
network 0.0.0.0 255.255.255.255
#
SWB
#
vlan batch 10 20 99
#
interface Vlanif99
ip address 172.16.99.2 255.255.255.0
#
interface Ethernet0/0/1
port link-type access
port default vlan 10
#
interface Ethernet0/0/2
port link-type access
port default vlan 20
#
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#
ospf 1
area 0.0.0.0
network 0.0.0.0 255.255.255.255
#
SWC
#
vlan batch 30 99
#
interface Vlanif99
ip address 172.16.99.3 255.255.255.0
#
interface Ethernet0/0/1
port link-type access
port default vlan 30
port-security enable
port-security protect-action shutdown
port-security mac-address sticky
#
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#
ospf 1
area 0.0.0.0
network 0.0.0.0 255.255.255.255
#
AR1
#
interface GigabitEthernet0/0/0
ip address 10.1.1.1 255.255.255.0
ospf enable 1 area 0.0.0.0
#
- 配置telnet只允许pc1登录。pc没法用telnet，测试的时候终端可以先随便搞个sw的地址，没问题了再换成pc1的地址
SWA~C，AR1
#
acl number 2000
rule 5 permit source 172.16.1.1 0
#
[SW A]telnet server enable
[SW A]user-interface vty 0 4
[SW A-ui-vty0-4]au aaa
[SW A-ui-vty0-4]protocol inbound telnet
[SW A-ui-vty0-4]acl 2000 inbound
[SW A]aaa
[SW A-aaa]local-user admin password cipher admin@123
[SW A-aaa]local-user admin service-type telnet
[SW A-aaa]local-user admin privilege level 15
- 配置traffic-filter不允许vlan10和vlan20互通
SWB
#
acl number 2002
rule 5 deny source 172.16.2.0 0.0.0.255
#
acl number 2003
rule 5 deny source 172.16.1.0 0.0.0.255
#
[SW B-Ethernet0/0/1]traffic-filter outbound acl 2002
[SW B-Ethernet0/0/2]traffic-filter outbound acl 2003
- 配置traffic-filter只允许PC1访问
SWC
#
acl number 2002
rule 5 permit source 172.16.1.10 0
rule 10 deny
#
[SW C-Ethernet0/0/1]traffic-filter outbound acl 2002
