一、实验拓扑
二、实验步骤
1、配ip地址,实现全网通
[R1]int g0/0/1
[R1-GigabitEthernet0/0/1]ip add 100.1.1.1 24
[R2]int g0/0/0
[R2-GigabitEthernet0/0/0]ip add 100.1.1.2 24
[SW1]vlan 10
[SW1-vlan10]vlan 20
[SW1]int g0/0/1
[SW1-GigabitEthernet0/0/1]port link-type access
[SW1-GigabitEthernet0/0/1]port default vlan 10
[SW1]int g0/0/2
[SW1-GigabitEthernet0/0/2]port link-type access
[SW1-GigabitEthernet0/0/2]port default vlan 20
[SW1]int g0/0/3
[SW1-GigabitEthernet0/0/3]port link-type trunk
[SW1-GigabitEthernet0/0/3]port trunk allow-pass vlan 10 20
[R1]int g0/0/0.10
[R1-GigabitEthernet0/0/0.10]ip add 192.168.1.254 24
[R1-GigabitEthernet0/0/0.10]dot1q termination vid 10
[R1-GigabitEthernet0/0/0.10]arp broadcast enable
[R1]int g0/0/0.20
[R1-GigabitEthernet0/0/0.20]ip add 192.168.2.254 24
[R1-GigabitEthernet0/0/0.20]dot1q termination vid 20
[R1-GigabitEthernet0/0/0.20]arp broadcast enable
[R2]int g0/0/1
[R2-GigabitEthernet0/0/1]ip add 192.168.3.254 24
[R2-GigabitEthernet0/0/1]int g0/0/2
[R2-GigabitEthernet0/0/2]ip add 192.168.4.254 24
配置静态路由
[R1]ip route-static 0.0.0.0 0 100.1.1.2
[R2]ip route-static 0.0.0.0 0 100.1.1.1
用PC2pingPC1的地址、网关地址、服务器地址和FTP客户端地址:
2、客户端不能通过FTP访问服务器
先在本地新建一个名为ftp的文件夹并在里面随便放一个文件
3、设置ACL规则:PC1可以ping通PC2,但是不能ping通服务器,客户端可以ping通服务器,不能ping通PC2,客户端不能通过FTP访问服务器
[R1]acl 3000
[R1-acl-adv-3000]rule deny icmp source 192.168.1.1 0.0.0.0 destination 192.168.4
.1 0.0.0.0
[R1-acl-adv-3000]rule deny icmp source 192.168.2.1 0.0.0.0 destination 192.168.3
.1 0.0.0.0
[R1-acl-adv-3000]rule deny tcp source 192.168.2.1 0.0.0.0 destination-port eq 23
[R1]int g0/0/0
[R1-GigabitEthernet0/0/0]traffic-filter inbound acl 3000
[R1-GigabitEthernet0/0/0]int g0/0/1
[R1-GigabitEthernet0/0/1]traffic-filter inbound acl 3000