ACL综合实验

给R1,R2,PC1,PC2接口配地址

[R1]int g 0/0/0
[R1-GigabitEthernet0/0/0]ip add 192.168.2.1 24
[R1-GigabitEthernet0/0/0]int g 0/0/1
[R1-GigabitEthernet0/0/1]ip add 192.168.1.1 24

 

[R2]int g 0/0/0
[R2-GigabitEthernet0/0/0]ip add 192.168.2.2 24

 [PC1]int g 0/0/0
[PC1-GigabitEthernet0/0/0]ip add 192.168.1.10 24

 [PC2]int g 0/0/0
[PC2-GigabitEthernet0/0/0]ip add 192.168.1.11 24

将路由器变为PC，写缺省（静态）

 [PC1]ip route-static 0.0.0.0 0 192.168.1.1

[PC2]ip route-static 0.0.0.0 0 192.168.1.1

在R2上将192.168.1.0的网段加入

[R2]ip route-static 192.168.1.0 24 192.168.2.1

      在R1,R2上开启远程登陆

[R1]aaa
[R1-aaa]local-user aa privilege level 15 password cipher 123456

[R2]aaa
[R2-aaa]local-user bb privilege level 15 password cipher 123456

      选择telnet服务

[R1-aaa]local-user aa service-type telnet

[R2-aaa]local-user bb service-type telnet

      开启端口

[R1]user-interface vty 0 4

[R2]user-interface vty 0 4

      aaa认证

[R1-ui-vty0-4]authentication-mode aaa
[R2-ui-vty0-4]authentication-mode aaa

       PC1,PC2用户模式下telnet

 

 写策略

[R1]acl 3000
[R1-acl-adv-3000]rule deny icmp source 192.168.1.10 0.0.0.0 destination 192.168.
1.1 0.0.0.0
[R1-acl-adv-3000]rule deny icmp source 192.168.1.10 0.0.0.0 destination 192.168.
2.1 0.0.0.0  
[R1-acl-adv-3000]rule deny tcp source 192.168.1.10 0.0.0.0 destination 192.168.2
.2 0.0.0.0
[R1-acl-adv-3000]rule deny tcp source 192.168.1.10 0.0.0.0 destination 192.168.2
.2 0.0.0.0 destination-port eq 23  
[R1-acl-adv-3000]rule deny tcp source 192.168.1.11 0.0.0.0 destination 192.168.1
.1 0.0.0.0 destination-port eq 23
[R1-acl-adv-3000]rule deny tcp source 192.168.1.11 0.0.0.0 destination 192.168.2
.1 0.0.0.0 destination-port eq 23
[R1-acl-adv-3000]rule deny icmp source 192.168.1.11 0.0.0.0 destination 192.168.
2.2 0.0.0.0

[R1-acl-adv-3000]rule permit ip source any destination any

调用

[R1]int g 0/0/1
[R1-GigabitEthernet0/0/1]traffic-filter inbound acl 3000