eNSP----ACL 实验

 1、实验需求

1、PC1可以telnet登录R1，不能ping通R1
2、PC1可以ping通R2，但不能登录R2
3、PC2不可以telnet登录R1，能ping通R1

4、PC2不可以ping通R2，但能登录R2

2、实验思路

首先使用ACL的拓展配置，靠近源头的接口为R1的0/0/1接口，所有在此接口上写ACL，只写一张表，分析如下：

写出所有不允许通过的IP剩下的默认全部可以通过

PC1：192.168.1.2  icmp 192.168.1.1 192.168.2.1 

           192.168.1.2 telnet 192.168.2.2 tcp 23 

PC2：192.168.1.3 telnet 192.168.1.1 192.168.2.1

           192.168.1.3 icmp 192.168.2.2 

3、基本配置

PC1

<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]sys PC1
[PC1]int g 0/0/0
[PC1-GigabitEthernet0/0/0]ip add	
[PC1-GigabitEthernet0/0/0]ip address 192.168.1.2 24
[PC1-GigabitEthernet0/0/0]q
[PC1]ip r	
[PC1]ip route
[PC1]ip route-static 0.0.0.0 0 192.168.1.1
[PC1]

PC2

<Huawei>sys	
<Huawei>system-view 
Enter system view, return user view with Ctrl+Z.
[Huawei]sys pc2
[pc2]int g 	
[pc2]int GigabitEthernet 0/0/0
[pc2-GigabitEthernet0/0/0]ip add	
[pc2-GigabitEthernet0/0/0]ip address 192.168.1.3 24
[pc2-GigabitEthernet0/0/0]q
[pc2]ip route-static 0.0.0.0 0 192.168.1.1
[pc2]

R1

<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]sys R1
[R1]int g 0/0/1 	
[R1-GigabitEthernet0/0/1]ip add	
[R1-GigabitEthernet0/0/1]ip address 192.168.1.1 24
[R1-GigabitEthernet0/0/1]int g 0/0/0
[R1-GigabitEthernet0/0/0]ip add	
[R1-GigabitEthernet0/0/0]ip address 192.168.2.1 24
[R1-GigabitEthernet0/0/0]

R2

<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]sys R2
[R2]int g 0/0/0
[R2-GigabitEthernet0/0/0]ip add	
[R2-GigabitEthernet0/0/0]ip address 192.168.2.2 24
[R2-GigabitEthernet0/0/0]
//写静态路由，使得全网通
[R2]ip route
[R2]ip route-static 192.168.1.0 24 192.168.2.1
[R2]q

示例：

 

R1

[R1]aaa	
[R1-aaa]local-user xing privilege level 15 password cipher 123456
[R1-aaa]local-user xing service-type telnet
[R1-aaa]q
[R1]u	
[R1]user-interface vty 0 4
[R1-ui-vty0-4]au	
[R1-ui-vty0-4]authentication-mode aaa
[R1-ui-vty0-4]q
[R1]ac	
[R1]acl 3000
[R1-acl-adv-3000]rule deny icmp source 192.168.1.2 0 destination 192.168.1.1 0
[R1-acl-adv-3000]rule deny icmp source 192.168.1.2 0 destination 192.168.2.1 0
[R1-acl-adv-3000]rule deny tcp source 192.168.1.2 0 destination 192.168.2.2 0 de
stination-port eq 23
[R1-acl-adv-3000]rule deny tcp source 192.168.1.3 0 destination 192.168.1.1 0 de
stination-port eq 23
[R1-acl-adv-3000]rule deny tcp source 192.168.1.3 0 destination 192.168.2.1 0 de
stination-port eq 23
[R1-acl-adv-3000]rule deny icmp source 192.168.1.3 0 destination 192.168.2.2 0
//接口调用
[R1]int g 0/0/1
[R1-GigabitEthernet0/0/1]traffic-filter inbound acl 3000

R2 

[R2]aaa
[R2-aaa]local-user xing privilege level 15 password cipher 654321
[R2-aaa]local-user xing service-type telnet
[R2-aaa]q	
[R2]user-interface vty 0 4
[R2-ui-vty0-4]authentication-mode aaa 
[R2-ui-vty0-4]q
[R2]

4、测试：

1、PC1可以telnet登录R1，不能ping通R1
2、PC1可以ping通R2，但不能登录R2

3、PC2不可以telnet登录R1，能ping通R1

4、PC2不可以ping通R2，但能登录R2