vlan间不能访问

设备管理使用vlan1，办公使用vlan2，配置好vlan后vlan2不能访问vlan1

[core_5120]disp cu

#

 version 5.20, Release 1513P62

#

 sysname core_5120

#

 irf mac-address persistent timer

 irf auto-update enable

 undo irf link-delay

#

 domain default enable system

#

 telnet server enable

#

 mirroring-group 1 local

 mirroring-group 2 local

#

 password-recovery enable

#

acl number 3000

 rule 0 permit ip

 rule 1 deny ip source 192.168.30.0 0.0.0.255 destination 192.168.60.0 0.0.0.255

 rule 2 deny ip source 192.168.30.0 0.0.0.255 destination 192.168.20.0 0.0.0.255

 rule 4 permit ip source 192.168.30.0 0.0.0.255 destination 192.168.60.10 0

#               

vlan 1

#

vlan 2 to 5

#

vlan 20

#

vlan 30

#

vlan 60

#

domain system

 access-limit disable

 state active

 idle-cut disable

 self-service-url disable

#

dhcp server ip-pool 1

 network 10.52.2.0 mask 255.255.255.0

 gateway-list 10.52.2.1

 dns-list 202.106.0.20 202.106.46.151

#

dhcp server ip-pool 3

 network 10.52.3.0 mask 255.255.255.0

 gateway-list 10.52.3.1

 dns-list 202.106.0.20 202.106.46.151

#

user-group system

#

local-user admin

 password cipher $c$3$yhlE0DRHDQHQotD2BiFCtbDsY7+wrlHP9zsEkJE=

 authorization-attribute level 3

 service-type telnet

 service-type web

#

interface NULL0

#

interface Vlan-interface1

 ip address 10.10.10.2 255.255.255.0

#

interface Vlan-interface2

 ip address 10.52.2.1 255.255.255.0

#

interface Vlan-interface3

 ip address 10.52.3.1 255.255.255.0

#

interface Vlan-interface4

 ip address 10.52.11.1 255.255.255.0

#

interface Vlan-interface5

 ip address 10.255.52.10 255.255.255.252

#

interface Vlan-interface20

 ip address 192.168.20.1 255.255.255.0

#

interface Vlan-interface30

 ip address 192.168.30.1 255.255.255.0

#

interface Vlan-interface60

 ip address 192.168.60.1 255.255.255.0

#

interface GigabitEthernet1/0/1

 mirroring-group 1 mirroring-port both

#

interface GigabitEthernet1/0/2

 port link-type trunk

 port trunk permit vlan all

 mirroring-group 1 mirroring-port both

#

interface GigabitEthernet1/0/3

 port access vlan 5

 mirroring-group 1 mirroring-port both

#

interface GigabitEthernet1/0/4

 port access vlan 2

 mirroring-group 1 mirroring-port both

#

interface GigabitEthernet1/0/5

 port access vlan 2

 mirroring-group 1 mirroring-port both

#

interface GigabitEthernet1/0/6

 port access vlan 2

 undo lldp enable

 mirroring-group 1 mirroring-port both

#

interface GigabitEthernet1/0/7

 port access vlan 2

 mirroring-group 1 mirroring-port both

#

interface GigabitEthernet1/0/8

 port access vlan 2

 mirroring-group 1 mirroring-port both

#

interface GigabitEthernet1/0/9

 port access vlan 30

 packet-filter 3000 inbound

#

interface GigabitEthernet1/0/10

 description toLogServerEth1

 mirroring-group 1 mirroring-port both

#

interface GigabitEthernet1/0/11

 description toXingWeiGuanLiEth1

 mirroring-group 1 mirroring-port both

#

interface GigabitEthernet1/0/12

 port access vlan 3

 mirroring-group 1 mirroring-port both

#

interface GigabitEthernet1/0/13

 port access vlan 3

 mirroring-group 1 mirroring-port both

#

interface GigabitEthernet1/0/14

 port access vlan 3

 mirroring-group 1 mirroring-port both

#

interface GigabitEthernet1/0/15

 port access vlan 3

 mirroring-group 1 mirroring-port both

#

interface GigabitEthernet1/0/16

 port access vlan 60

 mirroring-group 1 mirroring-port both

#

interface GigabitEthernet1/0/17

 port access vlan 60

 mirroring-group 1 mirroring-port both

#

interface GigabitEthernet1/0/18

 port access vlan 60

 mirroring-group 1 mirroring-port both

#

interface GigabitEthernet1/0/19

 port access vlan 60

 mirroring-group 1 mirroring-port both

#

interface GigabitEthernet1/0/20

 port access vlan 60

 mirroring-group 1 mirroring-port both

#

interface GigabitEthernet1/0/21

 port access vlan 60

 mirroring-group 1 mirroring-port both

#

interface GigabitEthernet1/0/22

 port access vlan 60

 mirroring-group 1 mirroring-port both

#

interface GigabitEthernet1/0/23

 port access vlan 2

 mirroring-group 1 mirroring-port both

#

interface GigabitEthernet1/0/24

 description toXingWeiGuanLiEth13

 port link-type trunk

 port trunk permit vlan all

 mirroring-group 1 monitor-port

#

interface GigabitEthernet1/0/25

 port link-type trunk

 port trunk permit vlan all

 mirroring-group 1 mirroring-port both

#

interface GigabitEthernet1/0/26

 port link-type trunk

 port trunk permit vlan all

 mirroring-group 1 mirroring-port both

#

interface GigabitEthernet1/0/27

 port link-type trunk

 port trunk permit vlan all

 mirroring-group 1 mirroring-port both

#

interface GigabitEthernet1/0/28

 port link-type trunk

 port trunk permit vlan all

 mirroring-group 1 mirroring-port both

#

 ip route-static 0.0.0.0 0.0.0.0 10.10.10.1

 ip route-static 10.1.0.0 255.255.0.0 10.255.52.9

 ip route-static 10.1.11.0 255.255.255.0 10.255.52.9

#

 dhcp server forbidden-ip 10.52.2.1 10.52.2.120

#

 dhcp enable

#

 load tr069-configuration

#

user-interface aux 0

user-interface vty 0 15

 authentication-mode scheme

#

return