ACL练习

题目

步骤1：配置IP地址

如图为配置信息：

基础信息配置

R1配置

< Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]sys r1
[r1]int g0/0/1
[r1-GigabitEthernet0/0/1]ip add 192.168.2.1 24
Jul 24 2023 21:26:18-08:00 r1 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP
on the interface GigabitEthernet0/0/1 has entered the UP state.
[r1-GigabitEthernet0/0/1]int g0/0/0
[r1-GigabitEthernet0/0/0]ip add 192.168.1.1 24
Jul 24 2023 21:26:27-08:00 r1 %%01IFNET/4/LINK_STATE(l)[1]:The line protocol IP
on the interface GigabitEthernet0/0/0 has entered the UP state.
[r1-GigabitEthernet0/0/0]

R2配置

< Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]sys r2
[r2]int g0/0/0
[r2-GigabitEthernet0/0/0]ip add 192.168.1.2 24
Jul 24 2023 21:26:47-08:00 r2 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP
on the interface GigabitEthernet0/0/0 has entered the UP state.
[r2-GigabitEthernet0/0/0]
[r2-GigabitEthernet0/0/0]q
[r2]ip rou
[r2]ip route
[r2]ip route-static 192.168.2.0 24 192.168.1.1

PC1配置

< Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]sys pc1
[pc1]ip rout
[pc1]ip route
[pc1]ip route-static 0.0.0.0 0.0.0.0 192.168.2.1

PC2配置

< Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]sys pc2
[pc2]ip route-static 0.0.0.0 0.0.0.0 192.168.2.1

步骤二：解题

先在R1和R2上配置，设置预设登录的账号及密码
R1

[r1]aaa
[r1-aaa]local-user chs privilege level 15 password cipher 123456
Info: Add a new user.
[r1-aaa]local-user chs service-type telnet
[r1-aaa]q
[r1]user-int
[r1]user-interface vty 0 4
[r1-ui-vty0-4]aut
[r1-ui-vty0-4]authentication-mode aaa
[r1-ui-vty0-4]q

R2

[r2]aaa
[r2-aaa]local-user chs privilege level 15 password cipher 123456
Info: Add a new user.
[r2-aaa]local-user chs service-type telnet
[r2-aaa]q
[r2]user-int
[r2]user-interface vty 0 4
[r2-ui-vty0-4]aut
[r2-ui-vty0-4]authentication-mode aaa
[r2-ui-vty0-4]q
[r2]

题一：PC1能telnet登录R1，但是不能ping

在R1上配置代码

[r1]acl 3000
[r1-acl-adv-3000]rule deny icmp source 192.168.2.2 0.0.0.0 destination 192.168.2
.1 0.0.0.0

题二：PC1能pingR2，但是不能telnet

在R1上接着配置代码

[r1]acl 3000
[r1-acl-adv-3000]rule deny tcp source 192.168.2.2 0.0.0.0 destination 192.168.1.
2 0.0.0.0 destination-port eq 23

运行配置

[r1]int g0/0/0
[r1-GigabitEthernet0/0/0]int g0/0/1
[r1-GigabitEthernet0/0/1]tra
[r1-GigabitEthernet0/0/1]traff
[r1-GigabitEthernet0/0/1]traffic-fil
[r1-GigabitEthernet0/0/1]traffic-filter inbo
[r1-GigabitEthernet0/0/1]traffic-filter inbound acl 3000

验证

ping不通R1，但是能登录

ping得通R2，但是不能登录

题三：PC2与PC1相反

同样在R1中配置

[r1]acl 3000
[r1-acl-adv-3000]rule deny tcp source 192.168.2.3 0.0.0.0 destination 192.168.2.1 0.0.0.0 destination-port eq 23
[r1-acl-adv-3000]rule deny icmp source 192.168.2.3 0.0.0.0 destination 192.168.1.2 0.0.0.0
[r1-acl-adv-3000]

运行配置

[r1]int g0/0/0
[r1-GigabitEthernet0/0/0]int g0/0/1
[r1-GigabitEthernet0/0/1]tra
[r1-GigabitEthernet0/0/1]traff
[r1-GigabitEthernet0/0/1]traffic-fil
[r1-GigabitEthernet0/0/1]traffic-filter inbo
[r1-GigabitEthernet0/0/1]traffic-filter inbound acl 3000

验证

ping得通R1，但是不能登录

ping不通R2，但是能登录

实验完成。