ACL决策练习

 

 需求分析：

ping：PC1不能ping通R1，但是可以ping通R2；PC2可以ping通R1，但是不能ping通R2

telnet：PC1不能telnet成功R2，但是可以telnetR1；PC2可以telnetR2，但是不能telnetR1

解：

此时分析需要进行的ACL决策为高级ACL，因为已经给定了源ip和目标ip

对于给出的三个接口，此时需要选择R1的g0/0/0口，因为此时为了不浪费资源，所以选择R1的g0/0/0口的inband

思考：R1有两个接口G0/0/0和G0/0/1两个接口，此时如果去设置ACL策略需要两个接口都要去设置，所以总共需要设置的ACL决策为2+2+1+1=6（每个端口都要把关）

配置：

首先是R1和R2的基础配置：

//R2的配置
[R2]interface   G0/0/0
[R2-GigabitEthernet0/0/0]ip a	
[R2-GigabitEthernet0/0/0]ip accounting
[R2-GigabitEthernet0/0/0]ip address   192.168.2.2  24
Nov 16 2021 20:08:12-08:00 R2 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP 
on the interface GigabitEthernet0/0/0 has entered the UP state. 
//R1的配置
[R1]interface   G0/0/0
[R1-GigabitEthernet0/0/0]ip a	
[R1-GigabitEthernet0/0/0]ip accounting
[R1-GigabitEthernet0/0/0]ip address   192.168.1.1  24
Nov 16 2021 20:08:12-08:00 R2 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP 
on the interface GigabitEthernet0/0/0 has entered the UP state. 
[R1]interface   G0/0/1
[R1-GigabitEthernet0/0/1]ip a	
[R1-GigabitEthernet0/0/1]ip accounting
[R1-GigabitEthernet0/0/1]ip address   192.168.1.2  24
Nov 16 2021 20:08:12-08:00 R2 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP 
on the interface GigabitEthernet0/0/0 has entered the UP state. 

然后开始去配置telnet接口配置

//设置R2的telnet，权限为15，密码为654321（密文），账号为xlb
[R2]aaa
[R2-aaa]loca	
[R2-aaa]local-user   xlb pr	
[R2-aaa]local-user   xlb privilege   	
[R2-aaa]local-user   xlb privilege   l	
[R2-aaa]local-user   xlb privilege   level   15  p	
[R2-aaa]local-user   xlb privilege   level   15  password   c	
[R2-aaa]local-user   xlb privilege   level   15  password   cipher   654321
Info: Add a new user.
//选择为xlb设置telnet
[R2-aaa]loca	
[R2-aaa]local-user   xlb  s	
[R2-aaa]local-user   xlb  service-type  t	
[R2-aaa]local-user   xlb  service-type  terminal
[R2-aaa]local-user   xlb  service-type  telnet  
[R2-aaa]q
//分配端口
[R2]us	
[R2]user-group
[R2]user-interface   vty	
[R2]user-interface   vty  0 4
//配置模式
[R2-ui-vty0-4]au	
[R2-ui-vty0-4]authentication-mode   aaa
[R2-ui-vty0-4]q

//
//设置R1的telnet，权限为15，密码为123456（密文），账号为lxb
[R1]aaa
[R1-aaa]loca	
[R1-aaa]local-user   lxb pr	
[R1-aaa]local-user   lxb privilege   	
[R1-aaa]local-user   lxb privilege   l	
[R1-aaa]local-user   lxb privilege   level   15  p	
[R1-aaa]local-user   lxb privilege   level   15  password   c	
[R1-aaa]local-user   lxb privilege   level   15  password   cipher   123456
Info: Add a new user.
//选择为lbb设置telnet
[R1-aaa]loca	
[R1-aaa]local-user   lxb  s	
[R1-aaa]local-user   lxb  service-type  t	
[R1-aaa]local-user   lxb  service-type  terminal
[R1-aaa]local-user   lxb  service-type  telnet  
[R1-aaa]q
//分配端口
[R1]us	
[R1]user-group
[R1]user-interface   vty	
[R1]user-interface   vty  0 4
//配置模式
[R1-ui-vty0-4]au	
[R1-ui-vty0-4]authentication-mode   aaa
[R1-ui-vty0-4]q

此时开始配置ACL策略，在R1的g0/0/0口：

//截取部分，总计需要2+2+1+1，即6个指令
[R1-acl-adv-3000]rule 10  deny  icmp  source   192.168.1.11  0.0.0.0  destinatio
n  192.168.2.2   0.0.0.0  
[R1-acl-adv-3000]di	
[R1-acl-adv-3000]dialer 	
[R1-acl-adv-3000]display  acl  3000
Advanced ACL 3000, 6 rules
Acl's step is 5
 rule 5 deny tcp source 192.168.1.11 0 destination 192.168.1.1 0 destination-por
t eq telnet 
 rule 6 deny tcp source 192.168.1.11 0 destination 192.168.2.1 0 destination-por
t eq telnet 
 rule 7 deny icmp source 192.168.1.10 0 destination 192.168.1.1 0 
 rule 8 deny icmp source 192.168.1.10 0 destination 192.168.2.1 0 
 rule 9 deny tcp source 192.168.1.10 0 destination 192.168.2.2 0 destination-por
t eq telnet 
 rule 10 deny icmp source 192.168.1.11 0 destination 192.168.2.2 0 
//然后开始配置R1的G0/0/0的进接口，设置ACL 3000
[R1]inter	
[R1]interface   g0/0/0
[R1-GigabitEthernet0/0/0]ta	
[R1-GigabitEthernet0/0/0]tr	
[R1-GigabitEthernet0/0/0]tracert
[R1-GigabitEthernet0/0/0]traffic-filter  in	
[R1-GigabitEthernet0/0/0]traffic-filter  inbound   acl 3000
[R1-GigabitEthernet0/0/0]q

开始进行ACL调试，先测试PC1功能

//PC1分别尝试ping     R2的G0/0/0  和   R1的G0/0/0与G0/0/1
[PC 1]ping  192.168.2.2
  PING 192.168.2.2: 56  data bytes, press CTRL_C to break
    Reply from 192.168.2.2: bytes=56 Sequence=1 ttl=254 time=40 ms
    Reply from 192.168.2.2: bytes=56 Sequence=2 ttl=254 time=50 ms
    Reply from 192.168.2.2: bytes=56 Sequence=3 ttl=254 time=50 ms
    Reply from 192.168.2.2: bytes=56 Sequence=4 ttl=254 time=40 ms
    Reply from 192.168.2.2: bytes=56 Sequence=5 ttl=254 time=40 ms

  --- 192.168.2.2 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 40/44/50 ms

[PC 1]ping 192.168.1.1
  PING 192.168.1.1: 56  data bytes, press CTRL_C to break
    Request time out
    Request time out
    Request time out
    Request time out
    Request time out

  --- 192.168.1.1 ping statistics ---
    5 packet(s) transmitted
    0 packet(s) received
    100.00% packet loss

[PC 1]ping 192.168.2.1
  PING 192.168.2.1: 56  data bytes, press CTRL_C to break
    Request time out
    Request time out
    Request time out
    Request time out
    Request time out

  --- 192.168.2.1 ping statistics ---
    5 packet(s) transmitted
    0 packet(s) received
    100.00% packet loss

//PC1去telentR1和R2
//telnetR1的192.168.1.1    用户名为lxb  ，密码为123456（密文）
<PC 1>telnet 192.168.1.1
  Press CTRL_] to quit telnet mode
  Trying 192.168.1.1 ...
  Connected to 192.168.1.1 ...

Login authentication


Username:lxb
Password:
<R1>q

  Configuration console exit, please retry to log on

  The connection was closed by the remote host
//telnet  R1 的192.168.2.1   用户名为lxb   ，密码为123456（密文）
<PC 1>telnet 192.168.2.1
  Press CTRL_] to quit telnet mode
  Trying 192.168.2.1 ...
  Connected to 192.168.2.1 ...

Login authentication


Username:lxb
Password:
  ----------------------------------------------------------------------------- 
    
  User last login information:     
  -----------------------------------------------------------------------------
  Access Type: Telnet      
  IP-Address : 192.168.1.10     
  Time       : 2021-11-16 20:57:49-08:00     
  -----------------------------------------------------------------------------
<R1>q

  Configuration console exit, please retry to log on

  The connection was closed by the remote host
//telnetR2的192.168.2.2  失败
<PC 1>telnet 192.168.2.2
  Press CTRL_] to quit telnet mode
  Trying 192.168.2.2 ...

然后开始测试PC2的功能

//R2开始进行ping操作
<PC 2>ping 192.168.1.1
  PING 192.168.1.1: 56  data bytes, press CTRL_C to break
    Reply from 192.168.1.1: bytes=56 Sequence=1 ttl=255 time=30 ms
    Reply from 192.168.1.1: bytes=56 Sequence=2 ttl=255 time=50 ms
    Reply from 192.168.1.1: bytes=56 Sequence=3 ttl=255 time=40 ms
    Reply from 192.168.1.1: bytes=56 Sequence=4 ttl=255 time=50 ms
    Reply from 192.168.1.1: bytes=56 Sequence=5 ttl=255 time=50 ms

  --- 192.168.1.1 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 30/44/50 ms

<PC 2>ping 192.168.2.1
  PING 192.168.2.1: 56  data bytes, press CTRL_C to break
    Reply from 192.168.2.1: bytes=56 Sequence=1 ttl=255 time=60 ms
    Reply from 192.168.2.1: bytes=56 Sequence=2 ttl=255 time=50 ms
    Reply from 192.168.2.1: bytes=56 Sequence=3 ttl=255 time=40 ms
    Reply from 192.168.2.1: bytes=56 Sequence=4 ttl=255 time=60 ms
    Reply from 192.168.2.1: bytes=56 Sequence=5 ttl=255 time=50 ms

  --- 192.168.2.1 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 40/52/60 ms

<PC 2>ping 192.168.2.2
  PING 192.168.2.2: 56  data bytes, press CTRL_C to break
    Request time out
    Request time out
    Request time out
    Request time out
    Request time out

  --- 192.168.2.2 ping statistics ---
    5 packet(s) transmitted
    0 packet(s) received
    100.00% packet loss

//R2开始telnet操作
<PC 2>telnet  192.168.2.2
  Press CTRL_] to quit telnet mode
  Trying 192.168.2.2 ...
  Connected to 192.168.2.2 ...

Login authentication


Username:xlb
Password:
<R2>q
//此时R2的telnet设置为xlb  ，密码为654321（密文）
  Configuration console exit, please retry to log on

  The connection was closed by the remote host
<PC 2>telnet 192.168.1.1
  Press CTRL_] to quit telnet mode
  Trying 192.168.1.1 ...
  Error: Can't connect to the remote host
//无法telnetR1的g0/0/0口
<PC 2>telnet 192.168.2.1
  Press CTRL_] to quit telnet mode
  Trying 192.168.2.1 ...
//无法telnetR1的g0/0/1口

完成！