实验需求
1. PC1可以telnet R1,但不能ping R1;PC1可以ping R2,但是不能telnetR2;
2. PC2和PC1相反:
PC2可以ping R1,但不能telnet R1,PC2可以telnet R2,但不能ping R2
四、实验步骤
1、配置IP地址
[r1-GigabitEthernet0/0/0]ip address 192.168.1.1 24
[r1-GigabitEthernet0/0/1]ip address 192.168.2.1 24
[r2-GigabitEthernet0/0/0]ip address 192.168.2.2 24
[pc1-GigabitEthernet0/0/0]ip address 192.168.1.10 24
[pc2-GigabitEthernet0/0/0]ip address 192.168.1.11 24
2.配置静态路由
[r2]ip route-static 192.168.1.0 24 192.168.2.1
[pc1]ip route-static 192.168.2.0 24 192.168.1.1
[pc2]ip route-static 192.168.2.0 24 192.168.1.1
3配置Telnet
1. 配置R1的telnet:
[r1]aaa
[r1-aaa]local-user admin1 password cipher 123456
[r1-aaa]local-user admin1 privilege level 15
[r1-aaa]local-user admin1 service-type telnet
[r1]user-interface vty 0 4
[r1-ui-vty0-4]authentication-mode aaa
2. 配置R2的telnet
[r2-aaa]
[r2-aaa]local-user hcia password cipher 123456
Info: Add a new user.
[r2-aaa]local-user hcia privilege level 15
[r2-aaa]local-user hcia service-type telnet
[r2]user-interface vty 0 4
[r2-ui-vty0-4]authentication-mode aaa
4.配置ACL
[r1]acl 3000
[r1-acl-adv-3000]rule deny icmp source 192.168.1.10 0.0.0.0 destination 192.168.1.1 0.0.0.0
[r1-acl-adv-3000]rule deicmp source 192.168.1.10 0.0.0.0 destination 192.168.2.1 0.0.0.0
[r1-acl-adv-3000]rule deny tcp source 192.168.1.11 0.0.0.0 destination 192.168.1.1 0.0.0.0
[r1-acl-adv-3000]rule deny tcp source 192.168.1.11 0.0.0.0 destination 192.168.2.1 0.0.0.0
[r1-acl-adv-3000]rule deny tcp source 192.168.1.10 0.0.0.0 destination 192.168.2.2 0.0.0.0
[r1-acl-adv-3000]rule deny icmp source 192.168.1.11 0.0.0.0 destination 192.168.2.2 0.0.0.0
[r1-acl-adv-3000]display acl 3001
[r1-GigabitEthernet0/0/0]traffic-filter inbound acl 3000
5.测试