ACL访问控制问题

 version 7.1.070, Release 6326
#
sysname H3C
#
telnet server enable
#
irf mac-address persistent timer
irf auto-update enable
undo irf link-delay
irf member 1 priority 1
#
dhcp enable
#
lldp global enable
#
password-recovery enable
#
vlan 1
#
vlan 1501 to 1509
#
stp global enable
#
dhcp server ip-pool 1505
gateway-list 10.10.6.1
network 10.10.6.0 mask 255.255.255.0
dns-list 10.10.4.200
#
interface Bridge-Aggregation1
port link-type trunk
port trunk permit vlan 1 1501 to 1509
#
interface Bridge-Aggregation2
port access vlan 1501
#
interface Bridge-Aggregation3
port access vlan 1501
#
interface Bridge-Aggregation4
#
interface NULL0
#
interface Vlan-interface1
ip address 10.10.1.2 255.255.255.0
#
interface Vlan-interface1501
description YY-gongzuozu
ip address 10.10.2.1 255.255.255.0
packet-filter 3000 inbound
packet-filter 3000 outbound
#
interface Vlan-interface1502
description YY-zhipian
ip address 10.10.3.1 255.255.255.0
packet-filter 3000 inbound
packet-filter 3000 outbound
#
interface Vlan-interface1503
description YY-caiwu
ip address 10.10.4.1 255.255.255.0
packet-filter 3000 inbound
packet-filter 3000 outbound
#
interface Vlan-interface1504
description YY-huiyisi
ip address 10.10.5.1 255.255.255.0
packet-filter 3000 inbound
packet-filter 3000 outbound
#
interface Vlan-interface1505
description YY-uebumen
ip address 10.10.6.1 255.255.255.0
packet-filter 3000 inbound
packet-filter 3000 outbound
dhcp server apply ip-pool 1505
#
interface Vlan-interface1506
description YY-neiwang-CGTwaiwang
ip address 10.10.7.1 255.255.255.0
#
interface Vlan-interface1507
description neiwang
ip address 10.10.8.1 255.255.255.0
#
interface Vlan-interface1508
description wangluobu
ip address 10.10.9.1 255.255.255.0
packet-filter 3000 inbound
packet-filter 3000 outbound
#
interface Vlan-interface1509
description yy-beiyongvlan
ip address 10.10.10.1 255.255.255.0
#
interface FortyGigE1/0/25
port link-mode bridge
port access vlan 1501
port link-aggregation group 2
#
interface FortyGigE1/0/26
port link-mode bridge
port access vlan 1501
port link-aggregation group 2
#
interface M-GigabitEthernet0/0/0
#
interface Ten-GigabitEthernet1/0/1
port link-mode bridge
#
interface Ten-GigabitEthernet1/0/2
port link-mode bridge
#
interface Ten-GigabitEthernet1/0/3
port link-mode bridge
#
interface Ten-GigabitEthernet1/0/4
port link-mode bridge
#
interface Ten-GigabitEthernet1/0/5
port link-mode bridge
#
interface Ten-GigabitEthernet1/0/6
port link-mode bridge
#
interface Ten-GigabitEthernet1/0/7
port link-mode bridge
#
interface Ten-GigabitEthernet1/0/8
port link-mode bridge
#
interface Ten-GigabitEthernet1/0/9
port link-mode bridge
#
interface Ten-GigabitEthernet1/0/10
port link-mode bridge
#
interface Ten-GigabitEthernet1/0/11
port link-mode bridge
#
interface Ten-GigabitEthernet1/0/12
port link-mode bridge
#
interface Ten-GigabitEthernet1/0/13
port link-mode bridge
port access vlan 1503
#
interface Ten-GigabitEthernet1/0/14
port link-mode bridge
port access vlan 1501
#
interface Ten-GigabitEthernet1/0/15
port link-mode bridge
port access vlan 1501
#
interface Ten-GigabitEthernet1/0/16
port link-mode bridge
#
interface Ten-GigabitEthernet1/0/17
port link-mode bridge
port access vlan 1501
#
interface Ten-GigabitEthernet1/0/18
port link-mode bridge
port link-type trunk
port trunk permit vlan 1 1506
#
interface Ten-GigabitEthernet1/0/19
port link-mode bridge
port link-aggregation group 4
#
interface Ten-GigabitEthernet1/0/20
port link-mode bridge
port link-aggregation group 4
#
interface Ten-GigabitEthernet1/0/21
port link-mode bridge
port link-type trunk
port trunk permit vlan 1 1501 to 1509
port link-aggregation group 1
#
interface Ten-GigabitEthernet1/0/22
port link-mode bridge
port link-type trunk
port trunk permit vlan 1 1501 to 1509
port link-aggregation group 1
#
interface Ten-GigabitEthernet1/0/23
port link-mode bridge
port link-type trunk
port trunk permit vlan 1 1501 to 1509
port link-aggregation group 1
#
interface Ten-GigabitEthernet1/0/24
port link-mode bridge
port link-type trunk
port trunk permit vlan 1 1501 to 1509
port link-aggregation group 1
#
interface Vsi-interface1503
#
scheduler logfile size 16
#
line class aux
user-role network-admin
#
line class usb
user-role network-admin
#
line class vty
user-role network-operator
#
line aux 0
user-role network-admin
#
line vty 0
authentication-mode scheme
user-role level-15
user-role network-admin
protocol inbound telnet
idle-timeout 6 0
screen-length 30
#
line vty 1 63
user-role level-15
user-role network-operator
#
ip route-static 0.0.0.0 0 10.10.1.1
#
acl number 3000
rule 0 permit ip source 10.10.3.0 0.0.0.255 destination 10.10.2.183 0
rule 5 permit ip source 10.10.2.183 0 destination 10.10.3.0 0.0.0.255
rule 10 permit ip source 10.10.4.200 0 destination 10.10.3.0 0.0.0.255
rule 15 permit ip source 10.10.2.11 0 destination 10.10.3.0 0.0.0.255
rule 20 permit ip source 10.10.7.5 0 destination 10.10.3.0 0.0.0.255
rule 25 permit ip source 10.10.2.234 0 destination 10.10.3.0 0.0.0.255
rule 30 permit ip source 10.10.2.183 0 destination 10.10.6.0 0.0.0.255
rule 35 permit ip source 10.10.4.197 0 destination 10.10.6.0 0.0.0.255
rule 40 permit ip source 10.10.2.11 0 destination 10.10.6.0 0.0.0.255
rule 45 permit ip source 10.10.2.234 0 destination 10.10.6.0 0.0.0.255
rule 50 permit ip source 10.10.3.0 0.0.0.255 destination 10.10.2.11 0
rule 55 permit ip source 10.10.4.226 0 destination 10.10.2.234 0
rule 60 permit ip source 10.10.4.227 0 destination 10.10.2.234 0
rule 65 permit ip source 10.10.4.228 0 destination 10.10.2.234 0
rule 70 permit ip source 10.10.4.229 0 destination 10.10.2.234 0
rule 75 permit ip source 10.10.3.0 0.0.0.255 destination 10.10.7.5 0
rule 80 permit ip source 10.10.4.197 0 destination 10.10.3.0 0.0.0.255
rule 85 permit ip source 10.10.3.0 0.0.0.255 destination 10.10.4.197 0
rule 90 permit ip source 10.10.4.0 0.0.0.255 destination 10.10.2.234 0
rule 95 permit ip source 10.10.3.0 0.0.0.255 destination 10.10.2.234 0
rule 100 permit ip source 10.10.2.234 0 destination 10.10.4.226 0
rule 105 permit ip source 10.10.2.234 0 destination 10.10.4.227 0
rule 110 permit ip source 10.10.2.234 0 destination 10.10.4.228 0
rule 115 permit ip source 10.10.2.234 0 destination 10.10.4.230 0
rule 120 permit ip source 10.10.4.230 0 destination 10.10.2.234 0
rule 125 permit ip source 10.10.4.231 0 destination 10.10.2.234 0
rule 130 permit ip source 10.10.4.232 0 destination 10.10.2.234 0
rule 135 permit ip source 10.10.4.233 0 destination 10.10.2.234 0
rule 140 permit ip source 10.10.2.234 0 destination 10.10.4.231 0
rule 145 permit ip source 10.10.2.183 0 destination 10.10.8.0 0.0.0.255
rule 150 permit ip source 10.10.7.5 0 destination 10.10.8.0 0.0.0.255
rule 155 permit ip source 10.10.2.234 0 destination 10.10.4.232 0
rule 160 permit ip source 10.10.2.234 0 destination 10.10.4.233 0
rule 165 permit ip source 10.10.2.234 0 destination 10.10.4.229 0
rule 170 permit ip source 10.10.6.0 0.0.0.255 destination 10.10.2.11 0
rule 175 permit ip source 10.10.6.0 0.0.0.255 destination 10.10.2.183 0
rule 180 permit ip source 10.10.7.0 0.0.0.255 destination 10.10.2.11 0
rule 185 permit ip source 10.10.8.0 0.0.0.255 destination 10.10.2.183 0
rule 190 permit ip source 10.10.2.0 0.0.0.255 destination 10.10.4.200 0
rule 191 permit ip source 10.10.9.0 0.0.0.255 destination 10.10.9.1 0
rule 192 permit ip source 10.10.9.0 0.0.0.255 destination 10.10.4.197 0
rule 195 deny ip source 10.10.2.0 0.0.0.255 destination 10.10.0.0 0.0.255.255
rule 200 deny ip source 10.10.3.0 0.0.0.255 destination 10.10.0.0 0.0.255.255
rule 205 deny ip source 10.10.4.0 0.0.0.255 destination 10.10.0.0 0.0.255.255
rule 210 deny ip source 10.10.5.0 0.0.0.255 destination 10.10.0.0 0.0.255.255
rule 215 deny ip source 10.10.6.0 0.0.0.255 destination 10.10.0.0 0.0.255.255
rule 220 deny ip source 10.10.7.0 0.0.0.255 destination 10.10.0.0 0.0.255.255
rule 225 deny ip source 10.10.9.0 0.0.0.255 destination 10.10.0.0 0.0.255.255

这是全部配置 

在deny前边加个你想访问的网段测试下