题目:
1、配置IP,这里将路由器当作PC端,由于路由器没有网关,我们给它手动添加一条缺省路由
ip route-static 0.0.0.0 0.0.0.0 192.168.1.1
2、在R1和R2上预设登录的账号及密码
[r1]aaa
[r1-aaa]local-user huang privilege level 7 password ci
[r1-aaa]local-user huang privilege level 7 password cipher 2002
[r2]aaa
[r2-aaa]local-user meng privilege level 7 password ci
[r2-aaa]local-user meng privilege level 7 password cipher 1009
//虚拟登录接口调用:
[r1]user
[r1]user-interface vty 0 4
[r1-ui-vty0-4]aut
[r1-ui-vty0-4]authentication-mode aaa
[r2]user
[r2]user-interface vty 0 4
[r2-ui-vty0-4]aut
[r2-ui-vty0-4]authentication-mode aaa
3、 常见扩展ACL:由于扩展ACL精确匹配流量源、目地址,故调用时尽量靠近源头,避免资源浪费;(在R1的g0/0/0进行创建)
- PC1 可以telnet登录R1,不能ping 通R1;
[r1]acl 3000 [r1-acl-adv-3000]rule deny icmp source 192.168.1.2 0.0.0.0 destination 192.168.1 .1 0.0.0.0 [r1-acl-adv-3000]rule deny icmp source 192.168.1.2 0.0.0.0 destination 192.168. 2.10.0.0.0 //接口调用ACL [r1]int g0/0/0 [r1-GigabitEthernet0/0/0]traffic-filter inbound acl 3000
- PC1 可以ping 通R2,但不能登录R2
[r1]acl 3001 [r1-acl-adv-3001]rule deny tcp source 192.168.1.2 0.0.0.0 destination 192.168.2. 2 0.0.0.0 destination-port eq 23 [r1-acl-adv-3001]int g0/0/0 [r1-GigabitEthernet0/0/0]traffic-filter inbound acl 3001 //需要删掉之前调用的ACL
- pc2 不可以telnet登录R1,但能ping 通R1;
[r1]acl 3002 [r1-acl-adv-3002]rule deny tcp source 192.168.1.3 0.0.0.0 destination 192.168.1. 1 0.0.0.0 destination-port eq 23 [r1-acl-adv-3002]int g0/0/0 [r1-GigabitEthernet0/0/0]traffic-filter inbound acl 3002//需要删掉之前调用的ACL
- pc2 不可以ping 通R2,但能登录R2
[r1]acl 3003 [r1-acl-adv-3003]rule deny icmp source 192.168.1.3 0.0.0.0 destination 192.168.2 .2 0.0.0.0 [r1-acl-adv-3003]int g0/0/0 [r1-GigabitEthernet0/0/0]traffic-filter inbound acl 3003//需要删掉之前调用的ACL