We have such a demand in the existing network. We need to restrict certain network segments of the intranet to prohibit access to the external network during designated working hours.
implements this requirement through simple configuration of acl plus stream filtering.
topology description AR1 simulated egress router SW1 simulated core switch pc1 simulated intranet PC
basic configuration pc 192.168.1.1 /24
Ar 1 192.168.1.254
AR1 configuration
sysname AR1
interface GigabitEthernet0/0/0
ip address 192.168.1.254 255.255.255.0
interface LoopBack0
ip address 1.1.1.1 255.255.255.255
//Simulate the configuration on the external network
SW1
sysname SW1
time-range work 08:00 to 18:00 working-day
//Specify the working time period
acl number 3000
rule 5 deny ip source 192.168.1.0 0.0.0.255 time-range work
//Block 192.168.1.0/24 network segment data flow
interface GigabitEthernet0/0/1
traffic-filter inbound acl 3000
// The incoming direction of the interface of the switch is filtered.
After the configuration is completed, you can see that when flow restrictions are not implemented on the switch, the PC can access the external network normally. After adding restrictions, it cannot access the external network.
ht Summary of the configuration ideas of ml0
:
uses a traffic policy that includes prohibited actions to implement packet filtering. The specific configuration ideas are as follows:
configures each interface so that users can access the external network through Switch.
configures the time range for reference in the ACL. Configure ACL on
to prevent packets from passing through during working hours.
configures packet filtering in the inbound direction of interface GE0/0/1.
This method is simple and easy.
