vlan隔离分类

1：同一设备同一用户 实现方式：端口隔离
2：部分VLAN间互通，VLAN间隔离，vlan间内用户隔离 实现方式：mux vlan
3：vlan间三层通信，需要禁止部分用户互访 实现方式：流策略

1端口隔离范例：

配置命令：
vlan 10
#
interface GigabitEthernet0/0/1
port link-type access
port default vlan 10
port-isolate enable group 1
#
interface GigabitEthernet0/0/2
port link-type access
port default vlan 10
port-isolate enable group 1

2MUX VLAN

配置案例

配置命令：
vlan batch 2 3 4
#
vlan 2
mux-vlan 指定vlan2 为principal vlan
subordinate separate 4 指定vlan4 为separate vlan
subordinate group 3 指定vlan3 为group vlan
#
interface GigabitEthernet0/0/1
port link-type access
port default vlan 2
port mux-vlan enable
其他接口以此类推 不在复述

基于流策略的vlan隔离

acl number 3000
rule 5 deny ip destination 10.1.2.0 0.0.0.255
rule 10 deny ip destination 10.1.3.0 0.0.0.255
#
acl number 3001
rule 5 permit ip source 10.1.2.2 0 destination 10.1.3.0 0.0.0.255
rule 10 permit tcp destination 10.1.3.2 0 destination-port eq ftp
rule 15 deny ip destination 10.1.3.0 0.0.0.255
#
traffic classifier 1_q operator and
if-match acl 3000
traffic classifier 2_q operator and
if-match acl 3001
#
traffic behavior b1
permit
#
traffic policy 1_2_q
classifier 2_q behavior b1
traffic policy b_1_Q
classifier 1_q behavior b1
#
vlan 10
traffic-policy 1_2_q inbound
#
vlan 20
traffic-policy b_1_Q inbound

VLAN 隔离

原文：http://blog.51cto.com/11477309/2176691