ENSP ACL配置实验

1.首先配置IP地址

PC1配置

[pc1]int gig0/0/0
[pc1-GigabitEthernet0/0/0]ip add    
[pc1-GigabitEthernet0/0/0]ip address 192.168.2.2 24

PC2 配置

 [pc2]int g0/0/0
[pc2-GigabitEthernet0/0/0]ip ad    
[pc2-GigabitEthernet0/0/0]ip address 192.168.2.3 24

 R1配置

[r1]int gig0/0/0
[r1-GigabitEthernet0/0/0]ip add    
[r1-GigabitEthernet0/0/0]ip address 192.168.2.1 24

[r1]int gig0/0/1
[r1-GigabitEthernet0/0/1]ip add    
[r1-GigabitEthernet0/0/1]ip address 192.168.1.1 24
 

R2配置

[r2]int g0/0/0
[r2-GigabitEthernet0/0/0]ip address 192.168.1.2 24
 

2.配置静态路由

[r2]ip route-static 192.168.1.0 24 192.168.1.1

[pc1]ip route-static 192.168.2.0 24 192.168.2.1

[pc2]ip route-static 192.168.2.0 24 192.168.2.1

配置好后检查下能否ping通

3.配置Telnet

R1

[r1]aaa  
[r1-aaa]local-user  huachenwen1 password cipher 123456
Info: Add a new user. 
[r1-aaa]local-user  huachenwen1 privilege  level 15 
[r1-aaa]local-user  huachenwen1 service-type telnet 
[r1-aaa]q
[r1]user-interface  vty  0 4   
[r1-ui-vty0-4]authentication-mode  aaa 

 

R2

[r2]aaa
[r2-aaa]local-user huachenwen2 password cipher 123456
Info: Add a new user.
[r2-aaa]local-user huachenwen2 privilege  level 15
[r2-aaa]local-user huachenwen2 service-type telnet 
[r2-aaa]q
[r2]user-interface  vty 0 4
[r2-ui-vty0-4]authentication-mode  aaa

 

4.配置acl 
PC1 可以telnet登录R1，不能ping 通R1

pc1可以ping 通R2，但不能登录R2

PC2的所有规则与pc1相反

1. 创建ACL列表：

[r1]acl 3000

2. 在ACL列表中添加规则：

PC1不能ping R1：
[r1-acl-adv-3000]rule deny icmp source 192.168.2.10 0.0.0.0 destination 192.168.2.1 0.0.0.0
[r1-acl-adv-3000]rule deicmp source 192.168.2.10 0.0.0.0 destination 192.168.1.1 0.0.0.0

PC2不能telnetR1：
[r1-acl-adv-3000]rule deny tcp source 192.168.2.11 0.0.0.0 destination 192.168.2.1 0.0.0.0
[r1-acl-adv-3000]rule deny tcp source 192.168.2.11 0.0.0.0 destination 192.168.1.1 0.0.0.0

PC1不能telnetR2：

[r1-acl-adv-3000]rule deny tcp source 192.168.2.10 0.0.0.0 destination 192.168.1.2 0.0.0.0

PC2不能ping R2：

[r1-acl-adv-3000]rule deny icmp source 192.168.2.11 0.0.0.0 destination 192.168.1.2 0.0.0.0

[r1-acl-adv-3000]display acl 3001

3. 在接口上调用ACL列表

[r1-GigabitEthernet0/0/0]traffic-filter inbound acl 3000