关于acl策略的隔离与互通的一个简单例子

下面的例子是vlan10 vlan20 vlan30 三个vlan在三层交换机通过做策略不能互通，但是又能够通过做策略让每个vlan里面的10这个ip能够互通。拓扑截图：


#
sysname Huawei
#
vlan batch 10 20 30
#
cluster enable
ntdp enable
ndp enable
#
drop illegal-mac alarm
#
diffserv domain default
#
acl number 3001
rule 10 deny ip source 192.168.10.0 0.0.0.255 destination 192.168.20.0 0.0.0.25
5
rule 15 deny ip source 192.168.10.0 0.0.0.255 destination 192.168.30.0 0.0.0.25
5
acl number 3002
rule 10 deny ip source 192.168.20.0 0.0.0.255 destination 192.168.10.0 0.0.0.25
5
rule 15 deny ip source 192.168.20.0 0.0.0.255 destination 192.168.30.0 0.0.0.25
acl number 3003
rule 10 deny ip source 192.168.30.0 0.0.0.255 destination 192.168.10.0 0.0.0.25
5
rule 15 deny ip source 192.168.30.0 0.0.0.255 destination 192.168.20.0 0.0.0.25
5
acl number 3004
rule 5 permit ip source 192.168.10.10 0 destination 192.168.30.10 0
rule 10 permit ip source 192.168.10.10 0 destination 192.168.20.10 0
acl number 3005
rule 5 permit ip source 192.168.20.10 0 destination 192.168.30.10 0
rule 10 permit ip source 192.168.20.10 0 destination 192.168.10.10 0
acl number 3006
rule 5 permit ip source 192.168.30.10 0 destination 192.168.10.10 0
rule 10 permit ip source 192.168.30.10 0 destination 192.168.20.10 0
#
drop-profile default
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password simple admin
local-user admin service-type http
#
interface Vlanif1
#
interface Vlanif10
ip address 192.168.10.1 255.255.255.0
#
interface Vlanif20
ip address 192.168.20.1 255.255.255.0
#
interface Vlanif30
ip address 192.168.30.1 255.255.255.0
#
interface MEth0/0/1
#
interface GigabitEthernet0/0/1
port hybrid pvid vlan 10
port hybrid untagged vlan 10
traffic-filter inbound acl 3004
traffic-filter inbound acl 3001
#
interface GigabitEthernet0/0/2
port hybrid pvid vlan 20
port hybrid untagged vlan 20
traffic-filter inbound acl 3005
traffic-filter inbound acl 3002
#
interface GigabitEthernet0/0/3
port hybrid pvid vlan 30
port hybrid untagged vlan 30
traffic-filter inbound acl 3006
traffic-filter inbound acl 3003
#
interface GigabitEthernet0/0/4
#
interface GigabitEthernet0/0/5
#
interface GigabitEthernet0/0/6
#
interface GigabitEthernet0/0/7
#
interface GigabitEthernet0/0/8
#