GUEST ACL Huawei

Ограничение гостевого сети Vlan на Huawei, в частности CloudEngine двумя способами GUEST ACL.

Способ 1

acl name guest advance
 rule 10 deny ip destination 10.0.0.0 0.255.255.255
 rule 15 deny ip destination 172.16.0.0 0.15.255.255
 rule 20 deny ip destination 192.168.0.0 0.0.255.255
 rule 30 permit ip destination 0.0.0.0 0
#
interface Vlanif100
 description guest
 ip address 10.0.0.1 255.255.255.0
 traffic-filter acl guest inbound
#
 

Способ 2

acl name GUEST number 3001
 rule 10 deny ip destination 10.0.0.0 0.255.255.255
 rule 15 deny ip destination 172.16.0.0 0.15.255.255
 rule 20 deny ip destination 192.168.0.0 0.0.255.255
 rule 30 permit ip destination 0.0.0.0 0
#
traffic classifier tc_GUEST type or
 if-match acl 3001
#
traffic behavior tb_GUEST
 deny
 statistics enable
#
traffic policy tp_GUEST
 classifier tc_GUEST behavior tb_GUEST precedence 5
#


interface Vlanif100
 description guest
 ip address 10.0.0.1 255.255.255.0
 traffic-policy tp_GUEST inbound
#
 

#Работает глобально на forward
traffic-filter acl GUEST global inbound
#
traffic-filter acl GUEST global outbound