内網能夠通路外網，外網不能通路内網！（ACL）

1.搭建的拓撲圖

<a href="http://5645432.blog.51cto.com/attachment/201208/7/5635432_1344346349ch8W.jpg"></a>

2.配置指令：

R7(config)#ip access-list extended ref_gjp

R7(config-ext-nacl)#permit ip 192.168.1.0 0.0.0.255 any reflect ref_gjp1

R7(config-ext-nacl)#exit

R7(config)#ip access-list extended ref_gjp2

R7(config-ext-nacl)#evaluate ref_gjp1

R7(config)#int f1/0

R7(config-if)#ip access-group ref_gjp out

R7(config-if)#ip access-group ref_gjp2 in

R7(config-if)#end

3. 配置截圖：

<a href="http://5645432.blog.51cto.com/attachment/201208/7/5635432_1344346361TLXa.jpg"></a>

<a href="http://5645432.blog.51cto.com/attachment/201208/7/5635432_134434636420Fd.jpg"></a>

<a href="http://5645432.blog.51cto.com/attachment/201208/7/5635432_13443463677jMx.jpg"></a>

<a href="http://5645432.blog.51cto.com/attachment/201208/7/5635432_1344346369klCC.jpg"></a>

<a href="http://5645432.blog.51cto.com/attachment/201208/7/5635432_1344346372NxxK.jpg"></a>

<a href="http://5645432.blog.51cto.com/attachment/201208/7/5635432_1344346374ijTD.jpg"></a>

測試:

<a href="http://5645432.blog.51cto.com/attachment/201208/7/5635432_1344346378pJw8.jpg"></a>

R7#show ip access-list

Extended IP access list ref_gjp

10 permit ip 192.168.1.0 0.0.0.255 any reflect ref_gjp1 (41 matches)

Reflexive IP access list ref_gjp1

permit icmp host 192.168.101.128 host 192.168.1.10 (14 matches) (time left 240)

Extended IP access list ref_gjp2

10 evaluate ref_gjp1

<a href="http://5645432.blog.51cto.com/attachment/201208/7/5635432_13443463836VY8.jpg"></a>

(如有誤，請多多指教！)

本文轉自 gjp0731 51CTO部落格，原文連結:http://blog.51cto.com/guojiping/957706