acl实验

一.更改设备名称

<Huawei>system-view 

[Huawei]sysname R2

[Huawei]sysname R1

[Huawei]sysname pc1

[Huawei]sysname pc2

二.配备接口

[pc1]int g0/0/0

[pc1-GigabitEthernet0/0/0]ip add 192.168.1.10

[pc2]int g0/0/0

[pc2-GigabitEthernet0/0/0]ip add 192.168.1.11 24

[R1]int g0/0/0

[R1-GigabitEthernet0/0/0]ip add 192.168.1.254 24

[R1]int g0/0/1

[R1-GigabitEthernet0/0/1]ip add 192.168.2.1 24

[R2]int g0/0/0

[R2-GigabitEthernet0/0/0]ip address 192.168.2.2 24

模拟网关

[pc1]ip route-static 0.0.0.0 0 192.168.1.254

[pc2]ip route-static 0.0.0.0 0 192.168.1.254

三.配备telent

[R1]aaa

[R1-aaa]local-user wangdaye privilege level 15 password cipher wdy12345

[R1-aaa]local-user wangdaye service-type telnet

[R1]user-interface vty 0 4

[R1-ui-vty0-4]authentication-mode aaa

[R2]aaa

[R2-aaa]local-user zhangdaye privilege level 15 password cipher zdy12345

[R2-aaa]local-user zhangdaye service-type telnet

[R2]user-interface vty 0 4

[R2-ui-vty0-4]authentication-mode aaa

四.配备acl

[R1]acl 3000

[R1-acl-adv-3000]rule deny icmp source 192.168.1.10 0.0.0.0 destination 192.168.
1.254 0.0.0.0

[R1-acl-adv-3000]rule deny icmp source 192.168.1.10 0.0.0.0 destination 192.168.
2.1 0.0.0.0

[R1-acl-adv-3000]rule deny tcp source 192.168.1.10 0.0.0.0 destination-port 192.
168.2.2 0.0.0.0
[R1-acl-adv-3000]rule deny tcp source 192.168.1.10 0.0.0.0 destination 192.169.2
.2 0.0.0.0 destination-port eq 23

[R1-acl-adv-3000]rule deny tcp source 192.168.1.11 0.0.0.0 destination 192.168.1
.254 0.0.0.0 destination-port eq 23

[R1-acl-adv-3000]rule deny tcp source 192.168.1.11 0.0.0.0 destination 192.168.2
.1 0.0.0.0 destination-port eq 23
[R1-acl-adv-3000]rule deny icmp source 192.168.1.11 0.0.0.0 destination 192.168.
2.2 0.0.0.0 

[R1-GigabitEthernet0/0/0]traffic-filter inbound acl 3000