5120

举例：不让1.1.1.1和1.1.2.1以及 1.1.3.1网段互访

[H3C]acl number 2000

[H3C-acl-basic-2000]rule 0 deny source 1.1.1.1 0.0.0.255

[H3C-acl-basic-2000]rule 5 deny source 1.1.2.1 0.0.0.255

[H3C-acl-basic-2000]rule 10 permit

[H3C]int Vlan-interface 3

[H3C-Vlan-interface3]packet-filter 2000 outbound

[H3C]acl number 2002

[H3C-acl-basic-2000]rule 0 deny source 1.1.1.1 0.0.0.255

[H3C-acl-basic-2000]rule 5 deny source 1.1.3.1 0.0.0.255

[H3C-acl-basic-2000]rule 10 permit

[H3C]int Vlan-interface 2

[H3C-Vlan-interface2]packet-filter 2000 outbound

[H3C]acl number 2001

[H3C-acl-basic-2000]rule 0 deny source 1.1.3.1 0.0.0.255

[H3C-acl-basic-2000]rule 5 deny source 1.1.2.1 0.0.0.255

[H3C-acl-basic-2000]rule 10 permit

[H3C]int Vlan-interface 1

[H3C-Vlan-interface1]packet-filter 2002 outbound

您好，请知：
根据您提出的需求，有如下的配置过程，请参考：
1、创建VLAN：
vlan 2
quit
vlan 3
quit

2、将VLAN划分到接口：
int range gi 1/0/1 to gi 1/0/4
port link-type access
port access vlan 1
quit

int range gi 1/0/5 to gi 1/0/12
port link-type access
port access vlan 2
quit

int range gi 1/0/13 to gi 1/0/23
port link-type access
port access vlan 3
quit

3、给VLAN设置IP地址：
int vlan 1
ip address 192.168.88.1 24
undo shutdown
quit

int vlan 2
ip address 192.168.89.1 24
undo shutdown
quit

int vlan 3
ip address 192.168.90.1 24
undo shutdown
quit

4、配置5120与路由器的互联及路由指向：
int gi 1/0/24
port link-mode route
ip address 192.168.254.253 24
quit

ip route-static 0.0.0.0 0.0.0.0 192.169.254.254 //由于不明确路由器的接口地址，因此临时使用192.168.254.254

5、配置ACL，实现不能互访：
acl number 3000
rule 0 deny ip source 192.168.88.0 0.0.0.255 destination 192.168.90.0 0.0.0.255
rule 1 deny ip source 192.168.89.0 0.0.0.255 destination 192.168.90.0 0.0.0.255
rule 2 permit ip source any destination any
quit

int vlan 2
packet-filter 3000 inbound
quit

int vlan 3
packet-filter 3000 inbound
quit

以上为配置过程，仅供参考，实际配置请以现场情况为准，请悉知！