acl 3010
 rule 5 deny ip source 192.168.2.0 0.0.0.255 destination 192.168.3.0 0.0.0.255


  接口下调用，支持policy和filter两种，一般调用入方向，或者数据出方向
----------------------------------------
interface GigabitEthernet0/0/2           
 port link-type access
 port default vlan 2
 traffic-filter inbound acl 3010             数据源靠近哪边就在哪边做，
 traffic-filter inbound acl 3333

------------------------------------
interface GigabitEthernet0/0/3           
 port link-type access
 port default vlan 2
 traffic-policy deny inbound                 数据源靠近哪边就在哪边做，
 traffic-filter inbound acl 3333

系统视图调用policy方式
------------------------------------------
acl 3010
 rule 5 deny ip source 192.168.2.0 0.0.0.255 destination 192.168.3.0 0.0.0.255
#
traffic-policy deny global inbound      进出都生效
traffic-policy deny global outbound   进出都生效
#
acl 3010
 rule 5 deny ip source 192.168.2.0 0.0.0.255 destination 192.168.3.0 0.0.0.255
#
traffic-filter inbound acl 3010             进出都生效
traffic-filter outbound acl 3010          进出都生效

系统视图下filter+vlan方式调用，只支持filter
-----------------------------------
traffic-filter vlan 2 outbound acl 3010      不生效
-------------------------------------
traffic-filter vlan 2 inbound acl 3010         生效
---------------------------------------
traffic-filter vlan 3 inbound acl 3010         不生效
---------------------------------------
traffic-filter vlan 3 outbound acl 3010      生效


vlanif下调用，只支持policy
-----------------------------------------------
acl number 3010
 rule 5 deny ip source 192.168.2.0 0.0.0.255 destination 192.168.3.0 0.0.0.255
#
traffic classifier deny
 if-match acl 3010
#
traffic behavior deny
 permit
#
traffic policy deny
 classifier deny behavior deny
#
interface Vlanif2
 ip address 192.168.2.1 255.255.255.0
 traffic-policy deny inbound                 数据源靠近哪边就在哪边做，只能做in方向，
#
interface Vlanif3
 ip address 192.168.3.1 255.255.255.0
 traffic-policy deny inbound                调在这里不起作用，只能做in方向



vlan下调用，只支持policy
------------------------------------------
#
vlan 2
 traffic-policy deny inbound          在vlan里面调in方向，数据源靠近，起作用
 traffic-policy deny outbound        不起作用
----------------
vlan 3
 traffic-policy deny outbound        起作用
 traffic-policy deny inbound          不起作用


----------------------------------------------------------------------------------------------------------------------------------------------------------------------

想要把拒绝某个vlan不被其它vlan访问
-------------
例如绝所有vlan访问vlan3 
acl number 3010
 rule 5 deny ip destination 192.168.3.0 0.0.0.255
#
traffic classifier deny
 if-match acl 3010
#
traffic behavior deny
 permit
#
traffic policy deny
 classifier deny behavior deny
#
vlan 3                                                  目标vlan
 traffic-policy deny outbound               有效，在vlan3 里出方向调用vlan
  traffic-policy deny inbound                该命令无效，不起作用
------------------------------------------

或者进业务vlan网段，从入方向调用
vlan 2                                                 起源vlan
 traffic-policy deny inbound                有效，在vlan2 里in方向调用vlan ，导致2无法访问3，其它vlan不受影响
 traffic-policy deny outbound             该命令无效，不起作用


其他案例
-----------------------------------------------------------------------------------
想要把拒绝某个vlan不被其它vlan访问
例如绝所有vlan访问vlan3 
acl number 3010
 rule 5 deny ip source 192.168.2.0 0.0.0.255 
#
vlan 3
 traffic-policy deny outbound             有效，但太宽泛

文档已经 整理至表格，此处仅供查阅

出方向做，则要做在目标vlan及接口，out方向，需要明确原始网段，（先匹配允许白名单，再匹配默认拒绝）
入方向做，则要做在起源vlan及接口，in方向，需要明确起源网段，（先匹配允许白名单，再匹配默认拒绝）



---------------------------------------------------------------------------------------
禁止内网ACL
先deny内网网段
再permit所有