https://www.opennet.ru/openforum/vsluhforumID6/23290.html Сеть поеделена на vlan, каждая сеть натится через свой пул внешних ip. Необходимо запретить трафик между vlan, и разрешить выходить в интернет. Вот конфиг<br><br>interface FastEthernet0/0<br>description INTERNET<br>ip address 193.*.*.17 255.255.255.224<br>ip nat outside<br>ip virtual-reassembly in<br>duplex auto<br>speed auto<br>!<br>interface FastEthernet0/1<br>description LAN<br>ip virtual-reassembly in<br>duplex auto<br>speed auto<br>!<br>interface FastEthernet0/1.2<br>encapsulation dot1Q 2<br>ip address 172.16.0.1 255.255.254.0<br>ip nat inside<br>ip virtual-reassembly in<br>!<br>interface FastEthernet0/1.3<br>encapsulation dot1Q 3<br>ip address 172.16.2.1 255.255.254.0<br>ip nat inside<br>ip virtual-reassembly in<br>!<br><br>!<br>ip nat pool first_ip 193.*.*.7 193.*.*.7 netmask 255.255.255.224<br>ip nat pool second_ip 193.*.*.21 193.*.*.21 netmask 255.255.255.224<br>ip nat inside source list 20 pool first_ip overload<br>ip nat inside source list 30 pool second_ip overload<br>ip route 0.0.0.0 0.0.0.0 193.*.*.1<br>!<br>logging esm config<br>access-list 20 permit 172.16.0.0 0.0.1 https://www.opennet.ru/openforum/vsluhforumID6/23290.html#2 Thu, 17 Nov 2011 17:48:23 GMT &gt;[оверквотинг удален]<br>&gt; ip address 172.16.0.1 255.255.254.0 <br>&gt; ip nat inside <br>&gt; ip virtual-reassembly in <br>&gt; ip access-group first_network in <br>&gt; interface FastEthernet0/1.3 <br>&gt; encapsulation dot1Q 3 <br>&gt; ip address 172.16.2.1 255.255.254.0 <br>&gt; ip nat inside <br>&gt; ip virtual-reassembly in <br>&gt; ip access-group first_network in <br><br>Решение конечно, но не очень удобно если у меня 20 vlan<br><br> https://www.opennet.ru/openforum/vsluhforumID6/23290.html#1 Thu, 17 Nov 2011 12:49:07 GMT <br>ip access-list extended first_network <br> deny ip 172.16.0.0 0.0.1.255 172.16.2.0 0.0.1.255<br> deny ip 172.16.2.0 0.0.1.255 172.16.0.0 0.0.1.255<br> permit ip any any<br><br>потом вешаем на внутренний интерфейс допустим<br><br>interface FastEthernet0/1.2 <br> encapsulation dot1Q 2 <br> ip address 172.16.0.1 255.255.254.0 <br> ip nat inside <br> ip virtual-reassembly in <br> ip access-group first_network in <br><br><br>interface FastEthernet0/1.3<br> encapsulation dot1Q 3<br> ip address 172.16.2.1 255.255.254.0<br> ip nat inside<br> ip virtual-reassembly in<br> ip access-group first_network in <br>