acl number 2000 配置允许进行NAT转换的内网地址段192.168.0.0/24
rule 5 permit source 192.168.0.0 0.0.0.255
#
interface Ethernet0/0/1
ip address 192.168.0.1 255.255.255.0 配置内网网关地址
#
interface GigabitEthernet0/0/1
ip address 200.100.1.2 255.255.255.0
nat outbound 2000 在出接口GE0/0/1上做Easy IP 方式的NAT
#
ip route-static 0.0.0.0 0.0.0.0 200.100.1.1 配置默认路由，保证出接口到对端路由可达
#
现在需要禁止IP地址为192.168.0.16～192.168.0.31的PC访问211.1.1.6，配置如下
[Router] acl 3000
[Router-classifier-c1] if-match acl 3000
[Router-classifier-c1] quit
[Router] traffic behavior b1
[Router-behavior-b1] deny
[Router-behavior-b1] quit
[Router] traffic policy p1
[Router-trafficpolicy-p1] classifier c1 behavior b1
[Router-trafficpolicy-p1] quit
[Router] interface ethernet 0/0/1
[Router-Ethernet0/0/1] traffic-policy p1 inbound
rule 5 permit source 192.168.0.0 0.0.0.255
#
interface Ethernet0/0/1
ip address 192.168.0.1 255.255.255.0 配置内网网关地址
#
interface GigabitEthernet0/0/1
ip address 200.100.1.2 255.255.255.0
nat outbound 2000 在出接口GE0/0/1上做Easy IP 方式的NAT
#
ip route-static 0.0.0.0 0.0.0.0 200.100.1.1 配置默认路由，保证出接口到对端路由可达
#
现在需要禁止IP地址为192.168.0.16～192.168.0.31的PC访问211.1.1.6，配置如下
[Router] acl 3000
[Router-acl-adv-3000] rule deny ip destination 211.1.1.6 0.0.0.0
source 192.168.0.16 0.0.0.15
[Router-acl-adv-3000] quit
[Router-classifier-c1] if-match acl 3000
[Router-classifier-c1] quit
[Router] traffic behavior b1
[Router-behavior-b1] deny
[Router-behavior-b1] quit
[Router] traffic policy p1
[Router-trafficpolicy-p1] classifier c1 behavior b1
[Router-trafficpolicy-p1] quit
[Router] interface ethernet 0/0/1
[Router-Ethernet0/0/1] traffic-policy p1 inbound
文章转载自DevOps架构实战，如果涉嫌侵权，请发送邮件至：contact@modb.pro进行举报，并提供相关证据，一经查实，墨天轮将立刻删除相关内容。
