ACL小实验

ss

以上为实验内容和实验拓扑图

    由于PC不可以进行远程登陆，所以此实验用下面两个路由器来代替两个PC（PC1,PC2）

 一、建立好拓扑并备好IP地址

 

     配置好IP地址之后，由于下面两台代替PC的路由器不能直接ping到192.168.2.0/24网段，所以对他俩进行缺省路由的配置。

  PC1  

[Huawei]ip route-static 0.0.0.0 0.0.0.0 192.168.1.3

  PC2

[Huawei]ip route-static 0.0.0.0 0.0.0.0 192.168.1.3

AR8

[Huawei]ip route-static 192.168.1.3 24 192.168.2.1

    配置完之后就可以全网可达

二、之后实现对 AR7（R1） AR8（R2）的telnet登录

R1

[R1]aaa
[R1-aaa]local-user xiaoming privilege level 15 password  cipher 123456
###创建用户名，设置权限和用户名密码
[R1-aaa]local-user xiaoming service-type telnet
###服务类型
[R1]user-interface vty 0 4
###虚拟登录接口调用
[R1-ui-vty0-4]authentication-mode aaa
###调用aaa模式

R2

[R2]aaa
[R2-aaa]local-user xiaohong privilege level 15 password  cipher 123456
[R2-aaa]local-user xiaohong service-type telnet 
[R2]user-interface vty 0 3
[R2-ui-vty0-3]authentication-mode aaa

   之后PC1和PC2就可以实现对两台路由器的远程登录

​
<pc1>tel	
<pc1>telnet 192.168.2.2
  Press CTRL_] to quit telnet mode
  Trying 192.168.2.2 ...
  Connected to 192.168.2.2 ...

Login authentication


Username:xiaohong
Password:
<R2>q


​

三、完成条件

     3.1  PC1不能telnet登录R2

[R1]acl 3000
[R1-acl-adv-3000]rule deny tcp source 192.168.1.1 0.0.0.0 destination 192.168.2.
2 0.0.0.0 destination-port eq 23

以上规则拒绝了192.168.1.2对192.168.2.2 的tcp下目标端口23访问-- 拒绝telnet以上规则拒绝了192.168.1.2 对192.168.2.2 的tcp下目标端口23访问-- 拒绝telnet、

[R1-GigabitEthernet0/0/0]traffic-filter inbound  acl 3000

    去接口调用

 之后发现PC1不能telnet登录R2

<pc1>telnet 192.168.2.2
  Press CTRL_] to quit telnet mode
  Trying 192.168.2.2 ...
  Error: Can't connect to the remote host
<pc1>

  Please check whether system data has been changed, and save data in time

  Configuration console time out, please press any key to log on

 

   3.2  PC2不能ping通R2

拒绝192.168.1.2 对192.168.2.2的ICMP访问--拒绝ping

[R1]acl 3009
[R1-acl-adv-3009]rule  deny icmp source 192.168.1.2 0.0.0.0 destination 192.168.
2.2 0.0.0.0

调用接口

[R1-GigabitEthernet0/0/0]traffic-filter inbound acl 3009

[pc2]ping 192.168.2.2
  PING 192.168.2.2: 56  data bytes, press CTRL_C to break
    Request time out
    Request time out
    Request time out
    Request time out
    Request time out

  --- 192.168.2.2 ping statistics ---
    5 packet(s) transmitted
    0 packet(s) received
    100.00% packet loss

       PC1不能ping通R1如上完成即可

    3.3  PC2不能不能telnet登录R1

[R1]acl 3008
[R1-acl-adv-3008]rule deny tcp source 192.168.1.2 0.0.0.0 destination 192.168.1.
3 0.0.0.0 destination-port eq 23
[R1-GigabitEthernet0/0/0]traffic-filter inbound acl 3008

<pc2>telnet 192.168.1.3
  Press CTRL_] to quit telnet mode
  Trying 192.168.1.3 ...
  Error: Can't connect to the remote host

实验完成