实验111

一、实验拓扑

二、实验步骤

1、配ip地址，实现全网通

[R1]int g0/0/1

[R1-GigabitEthernet0/0/1]ip add 100.1.1.1 24

[R2]int g0/0/0

[R2-GigabitEthernet0/0/0]ip add 100.1.1.2 24

[SW1]vlan 10

[SW1-vlan10]vlan 20

[SW1]int g0/0/1

[SW1-GigabitEthernet0/0/1]port link-type access 

[SW1-GigabitEthernet0/0/1]port default vlan 10

[SW1]int g0/0/2

[SW1-GigabitEthernet0/0/2]port link-type access

[SW1-GigabitEthernet0/0/2]port default vlan 20

[SW1]int g0/0/3

[SW1-GigabitEthernet0/0/3]port link-type trunk 

[SW1-GigabitEthernet0/0/3]port trunk allow-pass vlan 10 20

[R1]int g0/0/0.10

[R1-GigabitEthernet0/0/0.10]ip add 192.168.1.254 24

[R1-GigabitEthernet0/0/0.10]dot1q termination vid 10

[R1-GigabitEthernet0/0/0.10]arp broadcast enable

[R1]int g0/0/0.20

[R1-GigabitEthernet0/0/0.20]ip add 192.168.2.254 24

[R1-GigabitEthernet0/0/0.20]dot1q termination vid 20

[R1-GigabitEthernet0/0/0.20]arp broadcast enable

[R2]int g0/0/1

[R2-GigabitEthernet0/0/1]ip add 192.168.3.254 24

[R2-GigabitEthernet0/0/1]int g0/0/2

[R2-GigabitEthernet0/0/2]ip add 192.168.4.254 24

配置静态路由

[R1]ip route-static 0.0.0.0 0 100.1.1.2 

[R2]ip route-static 0.0.0.0 0 100.1.1.1

用PC2pingPC1的地址、网关地址、服务器地址和FTP客户端地址：

2、客户端不能通过FTP访问服务器

先在本地新建一个名为ftp的文件夹并在里面随便放一个文件

3、设置ACL规则：PC1可以ping通PC2，但是不能ping通服务器，客户端可以ping通服务器，不能ping通PC2，客户端不能通过FTP访问服务器

[R1]acl 3000  
[R1-acl-adv-3000]rule deny icmp source 192.168.1.1 0.0.0.0 destination 192.168.4
.1 0.0.0.0

[R1-acl-adv-3000]rule deny icmp source 192.168.2.1 0.0.0.0 destination 192.168.3
.1 0.0.0.0

[R1-acl-adv-3000]rule deny tcp source 192.168.2.1 0.0.0.0 destination-port eq 23

[R1]int g0/0/0

[R1-GigabitEthernet0/0/0]traffic-filter inbound acl 3000

[R1-GigabitEthernet0/0/0]int g0/0/1

[R1-GigabitEthernet0/0/1]traffic-filter inbound acl 3000