ACL技术的实现

• 实验拓扑图：
  • 实验要求：要求：1—PC1可以telent R1，但不能pingR1，Pc1可以ping R2但不能telent R2                           2—Pc2和Pc1相反 
  • 实验步骤：

    1、配置IP地址

    [r1-GigabitEthernet0/0/0]ip address 192.168.1.1 24

    [r1-GigabitEthernet0/0/1]ip address 192.168.2.1 24

    [r2-GigabitEthernet0/0/0]ip address 192.168.2.2 24

    [pc1-GigabitEthernet0/0/0]ip address 192.168.1.10 24

    [pc2-GigabitEthernet0/0/0]ip address 192.168.1.11 24

    2.配置静态路由

    [r2]ip route-static 192.168.1.0 24 192.168.2.1

    [pc1]ip route-static 192.168.2.0 24 192.168.1.1

    [pc2]ip route-static 192.168.2.0 24 192.168.1.1

 配置R1的telnet：

[r1]aaa

[r1-aaa]local-user admin1 password cipher 123456

[r1-aaa]local-user admin1 privilege level 15

[r1-aaa]local-user admin1 service-type telnet

[r1]user-interface vty 0 4

[r1-ui-vty0-4]authentication-mode aaa

 配置R2的telnet

[r2-aaa]

[r2-aaa]local-user hcia password cipher 123456

Info: Add a new user.

[r2-aaa]local-user hcia privilege level 15

[r2-aaa]local-user hcia service-type telnet

[r2]user-interface vty 0 4

[r2-ui-vty0-4]authentication-mode aaa

4.配置ACL

[r1]acl 3000

[r1-acl-adv-3000]rule deny icmp source 192.168.1.10 0.0.0.0 destination 192.168.1.1 0.0.0.0

[r1-acl-adv-3000]rule deicmp source 192.168.1.10 0.0.0.0 destination 192.168.2.1 0.0.0.0

[r1-acl-adv-3000]rule deny tcp source 192.168.1.11 0.0.0.0 destination 192.168.1.1 0.0.0.0

[r1-acl-adv-3000]rule deny tcp source 192.168.1.11 0.0.0.0 destination 192.168.2.1 0.0.0.0

[r1-acl-adv-3000]rule deny tcp source 192.168.1.10 0.0.0.0 destination 192.168.2.2 0.0.0.0

[r1-acl-adv-3000]rule deny icmp source 192.168.1.11 0.0.0.0 destination 192.168.2.2 0.0.0.0

[r1-acl-adv-3000]display acl 3001

[r1-GigabitEthernet0/0/0]traffic-filter inbound acl 3000