ﾚｽ
前ﾚｽ元ﾄﾋﾟ次ﾚｽ
ﾀｲﾄﾙ
Re: 今更ですが...
ﾌｫｰﾗﾑ
最強WEB問題集CCNP SWITCH
投稿ﾕｰｻﾞ(投稿日)
(2016/4/20)
本文
rokubusyuu さんの質問は例えば､

･PC1(192.168.0.1) と PC2(192.168.0.2) がL3SWに接続､各ﾎﾟｰﾄは同一VLAN
･L3SWにVLANｲﾝﾀﾌｪｰｽを作成､このVLANｲﾝﾀﾌｪｰｽのIPｱﾄﾞﾚｽ(192.168.0.254)はPC1とPC2のﾃﾞﾌｫﾙﾄGW
･ACLをVLANｲﾝﾀﾌｪｰｽにINで適用

この時にPC1とPC2が通信するのにACLにpermit ｴﾝﾄﾘが必要かと
言う意味かと思ったのですが､違いますでしょうか?

私の理解が正しければ､PC1とPC2の通信であれば､ACLにpermitは不要です｡
各PCがVLANｲﾝﾀﾌｪｰｽ(ﾃﾞﾌｫﾙﾄGW)や､他VLANに通信するのであれば
arashi1977 さんの回答どおり､permitが必要です｡

こんな感じです｡
[code]
Switch#sh ip int b | inc up
Vlan10 192.168.0.254 YES manual up up
FastEthernet1/0/1 unassigned YES unset up up
FastEthernet1/0/2 unassigned YES unset up up
Switch#
Switch#sh vlan b

VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Fa1/0/3, Fa1/0/4, Fa1/0/5
Fa1/0/6, Fa1/0/7, Fa1/0/8
Fa1/0/9, Fa1/0/10, Fa1/0/11
Fa1/0/12, Fa1/0/13, Fa1/0/14
Fa1/0/15, Fa1/0/16, Fa1/0/17
Fa1/0/18, Fa1/0/19, Fa1/0/20
Fa1/0/21, Fa1/0/22, Fa1/0/23
Fa1/0/24, Gi1/0/1, Gi1/0/2
10 VLAN0010 active Fa1/0/1, Fa1/0/2
1002 fddi-default act/unsup
1003 token-ring-default act/unsup
1004 fddinet-default act/unsup
1005 trnet-default act/unsup
Switch#
Switch#sh access-list 1
Standard IP access list 1
10 deny any
Switch#
Switch#sh access-list 1
Standard IP access list 1
10 deny any (5 matches)
Switch#
[/code]
[code]
PC1#ping 192.168.0.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.0.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/9 ms
PC1#ping 192.168.0.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.0.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/9 ms
PC1#ping 192.168.0.254

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.0.254, timeout is 2 seconds:
U.U.U
Success rate is 0 percent (0/5)
PC1#
[/code]

ﾚｽ一覧

前ﾚｽ元ﾄﾋﾟ次ﾚｽ

Ping-tﾓﾊﾞｲﾙTOP

Copyright (c) 2010
Ping-t All rights reserved.