ACL技术

• 实验拓扑

• 实验需求

1、PC1可以访问Telnet R1，不能ping R1
2、PC1不能访问Telnet R2，但可以ping R2
3、PC2不可以访问Telnet R1，能ping R1
4、PC2能访问Telnet R2，但不可以ping R2

实验步骤

1、配置IP地址，实现全网可达

[R1]int g0/0/0

[R1-GigabitEthernet0/0/0]ip add 192.168.1.254 24

[R1-GigabitEthernet0/0/0]int g0/0/1

[R1-GigabitEthernet0/0/1]ip add 192.168.2.1 24

[R2]int g0/0/0

[R2-GigabitEthernet0/0/0]ip add 192.168.2.2 24

[R2]ip route-static 192.168.1.0 24 192.168.2.1

[PC1]int g0/0/0

[PC1-GigabitEthernet0/0/0]ip add 192.168.1.10 24

[PC1]ip route-static 0.0.0.0 0 192.168.1.254-------模拟网关

[PC2]int g0/0/0

[PC2-GigabitEthernet0/0/0]ip add 192.168.1.11 24

[PC2]ip route-static 0.0.0.0 0 192.168.1.254-------模拟网关

2、配置Telnet

[R1]aaa

[R1-aaa]local-user wangdaye privilege level 15 password cipher wdy12345 

//进入3a模式下，创建用于用户登录的用户名和密码

[R1-aaa]local-user wangdaye service-type telnet

//设置服务类型为talent

[PC1-aaa]quit

[R1]user-interface vty 0 4

//退出，进到用户虚拟通道，配置用于远程登录的用户数量

[R1-ui-vty0-4]authentication-mode aaa

[R2]aaa

[R2-aaa]local-user zhangdaye privilege level 15 password cipher zdy12345

[R2-aaa]local-user zhangdaye service-type telnet

[PC2-aaa]quit

[R2]user-interface vty 0 4

[R2-ui-vty0-4]authentication-mode aaa

1. 配置ACL

[R1]acl 3000

[R1-acl-adv-3000]rule deny icmp source 192.168.1.10 0.0.0.0 destination 192.168.2.1 0.0.0.0

[R1-acl-adv-3000]rule deny icmp source 192.168.1.10 0.0.0.0 destination 192.168.1.254 0.0.0.0

//拒绝PC1 ping R1 

[R1-acl-adv-3000]rule deny tcp source 192.168.1.10 0.0.0.0 destination 192.168.2.2 0.0.0.0 destination-port eq 23

//PC1不能访问Telnet R2

[R1-acl-adv-3000]rule deny tcp source 192.168.1.11 0.0.0.0 destination 192.168.2.1 0.0.0.0 destination-port eq 23

[R1-acl-adv-3000]rule deny tcp source 192.168.1.11 0.0.0.0 destinatio 192.168.1.254 0.0.0.0 destination-port eq 23

//PC2不可以访问Telnet R1

[R1-acl-adv-3000]rule deny icmp source 192.168.1.11 0.0.0.0 destination 192.168.2.2 0.0.0.0

//不可以ping R2

[R1]int g0/0/0

[R1-GigabitEthernet0/0/0]traffic-filter inbound acl 3000

//从g0/0/0下放

测试

1.PC1  telnet R1

2.ping R1

3.pc1 ping R2 telnet R2

4.PC2 telnet R1  , ping R1

5.PC2 telnet R2  ping R2