ACL

目录

一.ACL概念

1.作用

2.访问控制列表的调用的方向

3.入接口调用和出接口调用的区别

4.访问控制列表的处理原则

5.访问控制列表类型

二.拓扑图

1.标准访问控制列表

2.扩展访问控制列表

 总结

---

一.ACL概念

ACL——访问控制列表

1.作用

读取三层，四层的头部信息，根据预先定义好的规则对流量进行筛选，过滤

三层头部信息：源IP，目的IP

四层头部信息：源端口号，目的端口号

2.访问控制列表的调用的方向

接口的出接口：流量将要进入本地路由器，将被本地路由器处理

接口的入接口：已经被本地路由器处理过了，流量将离开本地路由器

接口的出和入的方向和流量的走向有关

3.入接口调用和出接口调用的区别

入接口的调用：是对本地路由器生效

出接口的调用：对本地路由器不生效，流量将在数据转发过程中的下一台路由器生效

4.访问控制列表的处理原则

• 路由条目只会被匹配一次
• 路由条目在ACL访问列表中匹配的顺序是从上往下匹配
• ACL访问控制列表隐含一个拒绝所有
• ACL访问控制列表至少要放行一条路由条目

 5.访问控制列表类型

1.标准访问控制列表

只能基于源IP地址进行过滤

标准访问控制列表的列表号是2000--2999

调用原则：靠近目标

2.扩展访问控制列表

可以根据源IP，目的IP，TCP/UDP协议，源端口号目的端口号进行过滤

相比较标准访问控制列表，流量控制的更加准确

调用原则：靠近源

二.拓扑图

1.标准访问控制列表

路由器
<Huawei>u t m
Info: Current terminal monitor is off.
<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]sysname r1
[r1]user-interface co	
[r1]user-interface console 0
[r1-ui-console0]idle-timeout 0 0
[r1-ui-console0]q
[r1]int g0/0/0
[r1-GigabitEthernet0/0/0]undo shutdown 
Info: Interface GigabitEthernet0/0/0 is not shutdown.
[r1-GigabitEthernet0/0/0]int g0/0/0.1
[r1-GigabitEthernet0/0/0.1]dot1q termination vid 10
[r1-GigabitEthernet0/0/0.1]ip add 192.168.10.1 24
[r1-GigabitEthernet0/0/0.1]arp broadcast enable 
[r1-GigabitEthernet0/0/0.1]int g0/0/0.2
[r1-GigabitEthernet0/0/0.2]dot1q termination vid 20
[r1-GigabitEthernet0/0/0.2]ip add 192.168.20.1 24
[r1-GigabitEthernet0/0/0.2]arp broadcast enable 
[r1-GigabitEthernet0/0/0.2]acl 2000
[r1-acl-basic-2000]rule deny source 192.168.10.0 0.0.0.255	
[r1-acl-basic-2000]rule permit source any 
[r1-acl-basic-2000]q
[r1]int g0/0/0.2
[r1-GigabitEthernet0/0/0.2]traffic-filter outbound acl 2000

2.扩展访问控制列表

路由器R1
<Huawei>u t m
Info: Current terminal monitor is off.
<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]sysname r1
[r1]user-interface co	
[r1]user-interface console 0
[r1-ui-console0]idle-timeout 0 0
[r1-ui-console0]q
[r1]int g0/0/0
[r1-GigabitEthernet0/0/0]undo shutdown 
Info: Interface GigabitEthernet0/0/0 is not shutdown.
[r1-GigabitEthernet0/0/0]int g0/0/0.1
[r1-GigabitEthernet0/0/0.1]dot1q termination vid 10
[r1-GigabitEthernet0/0/0.1]ip add 192.168.10.1 24
[r1-GigabitEthernet0/0/0.1]arp broadcast enable 
[r1-GigabitEthernet0/0/0.1]int g0/0/0.2
[r1-GigabitEthernet0/0/0.2]dot1q termination vid 20
[r1-GigabitEthernet0/0/0.2]ip add 192.168.20.1 24
[r1-GigabitEthernet0/0/0.2]arp broadcast enable 
[r1-GigabitEthernet0/0/0.2]acl 2000
[r1-acl-basic-2000]rule deny source 192.168.10.0 0.0.0.255	
[r1-acl-basic-2000]rule permit source any 
[r1-acl-basic-2000]q
[r1]int g0/0/0.2
[r1-GigabitEthernet0/0/0.2]traffic-filter outbound acl 2000
[r1]int g0/0/1
[r1-GigabitEthernet0/0/1]ip add 12.1.1.1 24	
[r1-GigabitEthernet0/0/1]undo shutdown 
Info: Interface GigabitEthernet0/0/1 is not shutdown.
[r1]ip route-static 0.0.0.0 0 12.1.1.2
[r1]acl 3000	
[r1-acl-adv-3000]rule deny tcp source 192.168.10.10 0.0.0.0 destination 202.10.1
00.100 0.0.0.0 destination-port eq 21
[r1-acl-adv-3000]rule permit tcp destination-port eq ftp
[r1-acl-adv-3000]rule permit ip source any destination any 
[r1-acl-adv-3000]q
[r1]int g0/0/0.1	
[r1-GigabitEthernet0/0/0.1]traffic-filter inbound acl 3000

路由器R2
<Huawei>u t m
Info: Current terminal monitor is off.
<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]sysname R2
[R2]user-interface console 0	
[R2-ui-console0]idle-timeout 0 0
[R2-ui-console0]q
[R2]int g0/0/0
[R2-GigabitEthernet0/0/0]ip add 12.1.1.2 24
[R2-GigabitEthernet0/0/0]undo shutdown 
Info: Interface GigabitEthernet0/0/0 is not shutdown.
[R2-GigabitEthernet0/0/0]int g0/0/1
[R2-GigabitEthernet0/0/1]ip add 202.10.100.2 24	
[R2-GigabitEthernet0/0/1]undo shutdown 
Info: Interface GigabitEthernet0/0/1 is not shutdown.
[R2-GigabitEthernet0/0/1]q
[R2]ip route-static 0.0.0.0 0 12.1.1.1

 总结

要注意出接口和入接口的区别，在调用的时候区分是出接口还是入接口