实验拓扑
- 实验需求
- 全网互通;
- PC1可以访问Telnet R1,不能ping R1
- PC1不能访问Telnet R2,但可以ping R2
- PC2和PC1相反
- 实验步骤
- 配置IP。
[Huawei]sys
[Huawei]sysname pc1
[pc1]int g0/0/0
[pc1-GigabitEthernet0/0/0]ip add 192.168.1.10 24
[pc1]ip rou
[pc1]ip route
[pc1]ip route-static 0.0.0.0 0 192.168.1.254
[Huawei]sys
[Huawei]sysname pc2
[pc2]int g0/0/0
[pc2-GigabitEthernet0/0/0]ip add 192.168.1.11 24
[pc2]ip rou
[pc2]ip route
[pc2]ip route-static 0.0.0.0 0 192.168.1.254
[Huawei]sys
[Huawei]sysname R1
[R1]int g0/0/0
[R1-GigabitEthernet0/0/0]ip add 192.168.1.1 24
[R1]int g0/0/1
[R1-GigabitEthernet0/0/1]ip add 192.168.2.1 24
[R2]int g0/0/0
[R2-GigabitEthernet0/0/0]ip add 192.168.2.2 24
[R2]ip rou
[R2]ip route
[R2]ip route-static 192.168.1.0 24 192.168.2.1
- 、配置Telnet
[R1]aaa
[R1-aaa]lo
[R1-aaa]local-user wangdaye pri
[R1-aaa]local-user wangdaye privilege l
[R1-aaa]local-user wangdaye privilege level 15 pa
[R1-aaa]local-user wangdaye privilege level 15 password ci
[R1-aaa]local-user wangdaye privilege level 15 password cipher wdy12345
Info: Add a new user.
[R1-aaa]lo
[R1-aaa]local-user wangdaye se
[R1-aaa]local-user wangdaye service-type te
[R1-aaa]local-user wangdaye service-type telnet
[R1-aaa]
[R1-aaa]
[R1-aaa]
[R1-aaa]quit
[R1]us
[R1]user-group
[R1]user-interface vty 0 4
[R1-ui-vty0-4]au
[R1-ui-vty0-4]authentication-mode aaa
[R1-ui-vty0-4]quit
[R2]aaa
[R2-aaa]lo
[R2-aaa]local-user zhangdaye pri
[R2-aaa]local-user zhangdaye privilege l
[R2-aaa]local-user zhangdaye privilege level 15 pa
[R2-aaa]local-user zhangdaye privilege level 15 password se
[R2-aaa]local-user zhangdaye privilege level 15 password ci
[R2-aaa]local-user zhangdaye privilege level 15 password cipher zdy12345
Info: Add a new user.
[R2-aaa]lo
[R2-aaa]local-user zhangdaye se
[R2-aaa]local-user zhangdaye service-type te
[R2-aaa]local-user zhangdaye service-type telnet
[R2-aaa]quit
[R2]us
[R2]user-group
[R2]user-interface vty 0 4
[R2-ui-vty0-4]au
[R2-ui-vty0-4]authentication-mode aaa
[R2-ui-vty0-4]quit
配置ACL
[R1]acl 3000
[R1-acl-adv-3000]
[R1-acl-adv-3000]
[R1-acl-adv-3000]rule deny?
deny Specify matched packet deny
[R1-acl-adv-3000]rule deny ?
<1-255> Protocol number
gre GRE tunneling(47)
icmp Internet Control Message Protocol(1)
igmp Internet Group Management Protocol(2)
ip Any IP protocol
ipinip IP in IP tunneling(4)
ospf OSPF routing protocol(89)
tcp Transmission Control Protocol (6)
udp User Datagram Protocol (17)
[R1-acl-adv-3000]rule deny icmp sou
[R1-acl-adv-3000]rule deny icmp source 192.168.1.10 0.0.0.0 dest
[R1-acl-adv-3000]rule deny icmp source 192.168.1.10 0.0.0.0 destination 192.168.
1.254 0.0.0.0
[R1-acl-adv-3000]rule deny icmp source 192.168.1.10 0.0.0.0 destination 192.168.
2.1 0.0.0.0
[R1-acl-adv-3000]rule deny ?
<1-255> Protocol number
gre GRE tunneling(47)
icmp Internet Control Message Protocol(1)
igmp Internet Group Management Protocol(2)
ip Any IP protocol
ipinip IP in IP tunneling(4)
ospf OSPF routing protocol(89)
tcp Transmission Control Protocol (6)
udp User Datagram Protocol (17)
[R1-acl-adv-3000]rule deny tcp so
[R1-acl-adv-3000]rule deny tcp source 192.168.1.10 0.0.0.0 desrt
[R1-acl-adv-3000]rule deny tcp source 192.168.1.10 0.0.0.0 dest
[R1-acl-adv-3000]rule deny tcp source 192.168.1.10 0.0.0.0 destination 192.168.2
.2 0.0.0.0 de
[R1-acl-adv-3000]rule deny tcp source 192.168.1.10 0.0.0.0 destination 192.168.2
.2 0.0.0.0 destination-port eq 23
[R1-acl-adv-3000]rule deny tcp so
[R1-acl-adv-3000]rule deny tcp source192.168.1.11 0.0.0.0 dest
[R1-acl-adv-3000]rule deny tcp source192.168.1.11 0.0.0.0 dest
[R1-acl-adv-3000]rule deny tcp source 192.168.1.11 0.0.0.0 dest
[R1-acl-adv-3000]rule deny tcp source 192.168.1.11 0.0.0.0 destination 192.168.1
.254 0.0.0.0 de
[R1-acl-adv-3000]rule deny tcp source 192.168.1.11 0.0.0.0 destination 192.168.1
.254 0.0.0.0 destination-port eq 23
[R1-acl-adv-3000]rule deny tcp source 192.168.1.11 0.0.0.0 destination 192.168.
2.1 0.0.0.0 destination-port eq 23
[R1-acl-adv-3000]rule deny icmp 192.168.1.11 0.0.0.0 dest
[R1-acl-adv-3000]rule deny icmp so
[R1-acl-adv-3000]rule deny icmp source 192.168.1.11 0.0.0.0 dest
[R1-acl-adv-3000]rule deny icmp source 192.168.1.11 0.0.0.0 destination 192.168.
2.2 0.0.0.0
配置入口
[R1-acl-adv-3000]
[R1-acl-adv-3000]quit
[R1]int g0/0/0
[R1-GigabitEthernet0/0/0]tr
[R1-GigabitEthernet0/0/0]tracert
[R1-GigabitEthernet0/0/0]traffic-filter in
[R1-GigabitEthernet0/0/0]traffic-filter inbound acl 3000
[R1-GigabitEthernet0/0/0]quit
检测