Question

H3C 5120交换机访问控制列表问题

交换机下有vlan1及vlan4等vlan，vlan互通。需要设置一规则：要求 除vlan1 ip：172.16.0.251可访问vlan4 IP：172.16.4.250 and 172.16.4.253 and 172.16.4.254，其他ip不允许访问这三个IP。求命令

Answer 1

命令如下
acl num 3000 定义允许访问的acl

rule per ip sou 172.16.4.250 0 de 172.16.0.251 0
rule per ip sou 172.16.4.253 0 de 172.16.0.251 0
rule per ip sou 172.16.4.254 0 de 172.16.0.251 0
acl num 3001 定义禁止其他ip访问的acl
rule deny ip sou 172.16.4.250 0 de 172.16.0.0 0.0.255.255
rule deny ip sou 172.16.4.253 0 de 172.16.0.0 0.0.255.255
rule deny ip sou 172.16.4.254 0 de 172.16.0.0 0.0.255.255
traffic class permit 定义类 并引入acl
if-match 3000
traffic class deny
if-match 3001
traffic beha permit 定义行为 并定义动作

filter permit
traffic beha deny

filter deny
qos policy qos 创建qos策略 并绑定类和行为
clas permit be permit
clas deny be deny

qos vlan-policy qos vlan xx inbound 下发qos策略。注意xx为172.16.4.0这个网段的vlan id号