1-3z Allow the PCs of Organization 1 to access the external network through GigabitEthernet 1/0/1 onSwitch A. The port belongs to VLAN 1, and the IP address of VLAN-interface 1 is202.10.20.200/24.z Disable the PCs that are not of Organization 1 (PC 2 and PC 3) from accessing the externalnetwork through GigabitEthernet 1/0/1 of Switch A.Network diagramFigure 1-2 Network diagram for access management configurationSwitch ASwitch BGE1/0/1PC1_1 PC1_2 PC1_20 PC 2 PC 3Internet202.10.20.1/24～202.10.20.20/24Organization 1Vlan-int1202.10.20.200/24202.10.20.100/24 202.10.20.101/24Configuration procedurePerform the following configuration on Switch A.# Enable access management. system-view[Sysname] am enable# Set the IP address of VLAN-interface 1 to 202.10.20.200/24.[Sysname] interface Vlan-interface 1[Sysname-Vlan-interface1] ip address 202.10.20.200 24[Sysname-Vlan-interface1] quit# Configure the access management IP address pool on GigabitEthernet 1/0/1.[Sysname] interface GigabitEthernet 1/0/1[Sysname-GigabitEthernet1/0/1] am ip-pool 202.10.20.1 20Combining Access Management with Port IsolationNetwork requirementsClient PCs are connected to the external network through Switch A (an Ethernet switch). The IPaddresses of the PCs of Organization 1 are in the range 202.10.20.1/24 to 202.10.20.20/24, and thoseof the PCs in Organization 2 are in the range 202.10.20.25/24 to 202.10.20.50/24 and the range202.10.20.55 to 202.10.20.65/24.
