ACL实验
实验要求:
1.R2开启telnet服务
2.PC1可以ping通R2,但是不能telnet R2
3.PC2可以telnet R2,但是不能ping通R2
实验步骤:
1.配置IP
[R1]int g 0/0/0
[R1-GigabitEthernet0/0/0]ip add 192.168.1.1 24
[R1-GigabitEthernet0/0/1]ip add 192.168.2.1 24
[R2]int g 0/0/0
[R2-GigabitEthernet0/0/0]ip add 192.168.2.2 24
[PC1-GigabitEthernet0/0/0]ip add 192.168.1.2 24
[PC2-GigabitEthernet0/0/0]ip add 192.168.1.3 24
2.写缺省路由
[PC1]ip route-static 0.0.0.0 0 192.168.1.1
[PC2]ip route-static 0.0.0.0 0 192.168.1.1
[R2]ip route-static 192.168.1.0 24 192.168.2.1
4.开启R1和R2telnet
[R1]aaa
[R1-aaa]local-user Lxx password cipher 123456
[R1-aaa]local-user Lxx service-type telnet
[R1-aaa]local-user Lxx privilege level 15
[R1-aaa]q
[R1]user-interface vty 0 4
[R1-ui-vty0-4]authentication-mode aaa
[R2]aaa
[R2-aaa]local-user Lxx password cipher 123456
Info: Add a new user.
[R2-aaa]local-user Lxx service-type telnet
[R2-aaa]local-user Lxx privilege level 15
[R2-aaa]q
[R2]user-interface vty 0 4
[R2-ui-vty0-4]authentication-mode aaa
5.写ACL表
[R1]acl 3000
[R1-acl-adv-3000]rule deny icmp source 192.168.1.2 0 destination 192.168.1.1 0
[R1-acl-adv-3000]rule deny icmp source 192.168.1.2 0 destination 192.168.2.1 0
[R1-acl-adv-3000]rule deny tcp source 192.168.1.2 0 destination 192.168.2.2 0 de
stination-port eq 23
[R1-acl-adv-3000]rule deny tcp source 192.168.1.3 0 destination 192.168.1.1 0 de
stination-port eq 2
[R1-acl-adv-3000]rule deny tcp source 192.168.1.3 0 destination 192.168.2.1 0 de
stination-port eq 23
[R1-acl-adv-3000]rule deny icmp source 192.168.1.3 0 destination 192.168.2.2 0
[R1-acl-adv-3000]q
- 接口调用
[R1]int g 0/0/0
[R1-GigabitEthernet0/0/0]traffic-filter inbound acl 3000
6.测试