CCNA课程实验-11-ACL

实验条件

网络拓朴

需求

1. 使用名字为ACL_A的标准ACL配置及应用：在R1上配置ACL实现仅192.168.20.0/24网段能访问到PC1；
2. 使用名字为ACL_B的标准ACL实现Telnet登陆控制：在R3上配置只允许PC1远程管理R3；
3. 使用名字为ACL_C的扩展ACL配置及应用：在R3配置ACL实现PC2只允许被ping通,其他访问都不能进行；

配置实现

基础配置 R1 & R2 & R3 & PC1 & PC2

PC1

PC1(config)#no ip routing
PC1(config)#ip default-gateway 192.168.10.254
PC1(config)#int e0/0
PC1(config-if)#ip address 192.168.10.1 255.255.255.0
PC1(config-if)#no shutdown

PC2

PC2(config)#no ip routing
PC2(config)#ip default-gateway 192.168.20.254
PC2(config)#int e0/1
PC2(config-if)#ip address 192.168.20.1 255.255.255.0
PC2(config-if)#no shutdown

R1

R1(config)#int e0/0
R1(config-if)#ip address 192.168.10.254 255.255.255.0
R1(config-if)#no shutdown
R1(config-if)#int e0/1
R1(config-if)#ip address 12.1.1.1 255.255.255.0
R1(config-if)#no shutdown
R1(config-if)#router ospf 90
R1(config-router)#router-id 1.1.1.1
R1(config-router)#network 192.168.10.254 0.0.0.0 area 0
R1(config-router)#network 12.1.1.1 0.0.0.0 area 0
R1(config-router)#

R2

R2(config)#int e0/1
R2(config-if)#ip address 12.1.1.2 255.255.255.0
R2(config-if)#no shutdown 
R2(config-if)#int e0/0
R2(config-if)#ip address 23.1.1.2 255.255.255.0
R2(config-if)#no shutdown
R2(config-if)#router ospf 90
R2(config-router)#router-id 2.2.2.2
R2(config-router)#network 12.1.1.2 0.0.0.0 area 0 
R2(config-router)#network 23.1.1.2 0.0.0.0 area 0
R2(config-router)#

R3

R3(config)#int e0/0   
R3(config-if)#ip address 23.1.1.3 255.255.255.0
R3(config-if)#no shutdown
R3(config-if)#int e0/1
R3(config-if)#ip address 192.168.20.254 255.255.255.0
R3(config-if)#no shutdown
R3(config-if)#router ospf 90
R3(config-router)#router-id 3.3.3.3
R3(config-router)#network 23.1.1.3 0.0.0.0 area 0
R3(config-router)#network 192.168.20.254 0.0.0.0 area 0

配置ACL_A

使用名字为ACL_A的标准ACL配置及应用：在R1上配置ACL实现仅192.168.20.0/24网段能访问到PC1

R1(config)#ip access-list standard ACL_A 
R1(config-std-nacl)#permit 192.168.20.0 0.0.0.255 
R1(config-std-nacl)#exit
R1(config)#int e0/0		//去到PC1的端口
R1(config-if)#ip access-group ACL_A out	//从这个接口出去的包,都要用ACL_A来控制

测试结果

R3#ping 192.168.10.1			// 默认以23.1.1.3接口去ping
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.10.1, timeout is 2 seconds:
U.U.U
Success rate is 0 percent (0/5)
R3#ping 192.168.10.1 source 192.168.20.254  // 以192.168.20.0/24的网段去ping
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.10.1, timeout is 2 seconds:
Packet sent with a source address of 192.168.20.254 
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/2 ms
R3#

Ping PC1到中间各个节点
除了R1节点和192.168.20.0/24网段的设备可以ping通, 其它几个ip都ping不同,是因为其它几个IP的回包被 ACL_A的策略给阻止了.

PC1#ping 23.1.1.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 23.1.1.3, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
PC1#ping 192.168.10.254
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.10.254, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
PC1#ping 12.1.1.1         
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 12.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
PC1#ping 12.1.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 12.1.1.2, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
PC1#ping 23.1.1.2 
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 23.1.1.2, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
PC1#ping 192.168.20.254
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.20.254, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/2 ms
PC1#ping 192.168.20.1  
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.20.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 2/2/2 ms
PC1#

配置ACL_B

使用名字为ACL_B的标准ACL实现Telnet登陆控制：在R3上配置只允许PC1远程管理R3

R3(config)#ip access-list standard  ACL_B
R3(config-std-nacl)#permit host 192.168.10.1 
R3(config-std-nacl)#line vty 0 4
R3(config-line)#password passwd
R3(config-line)#login
R3(config-line)#transport input telnet
R3(config-line)#access-class ACL_B in
R3(config-line)#exit
R3(config)#enable password passwd

测试结果

PC1#telnet 192.168.20.254
Trying 192.168.20.254 ... Open


User Access Verification

Password: 
R3>enable
Password: 
R3#

配置ACL_C

使用名字为ACL_C的扩展ACL配置及应用：在R3配置ACL实现PC2只允许被ping通,其他访问都不能进行
配置PC2的telnet服务

PC2(config)#enable secret passwd
PC2(config)#line vty 0 4
PC2(config-line)#password passwd
PC2(config-line)#transport input telnet
PC2(config-line)#login
PC2(config-line)#exit

测试PC1访问PC2

PC1#ping 192.168.20.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.20.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/2 ms
PC1#telnet 192.168.20.1
Trying 192.168.20.1 ... Open


User Access Verification

Password: 
PC2>

现在配置R3

R3(config)#ip access-list extended ACL_C
R3(config-ext-nacl)#permit icmp any host 192.168.20.1 
R3(config-ext-nacl)#int e0/1
R3(config-if)#ip access-group ACL_B out

再次测试PC1访问PC2

PC1#ping 192.168.20.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.20.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/2 ms
PC1#telnet 192.168.20.1
Trying 192.168.20.1 ... 
% Connection timed out; remote host not responding

PC1#

达到实验目标