acl实验

实验要求

1.设备端口ip配置

[R1-GigabitEthernet0/0/0]ip add 192.168.1.1 24

[R1-GigabitEthernet0/0/1]ip add 192.168.2.1 24

[R2-GigabitEthernet0/0/0]ip add 192.168.2.2 24

[PC1-GigabitEthernet0/0/0]ip add 192.168.1.10 24

[PC1]ip route-static 0.0.0.0 0 192.168.1.1

[PC2-GigabitEthernet0/0/0]ip add 192.168.1.11 24

[PC2]ip route-static 0.0.0.0 0 192.168.1.1

2.配置远程登录

[R1]telnet server enable 

[R1]aaa

[R1-aaa]local-user wanggou password cipher wd12345 privilege level 15

[R1-aaa]local-user wanggou service-type telnet

[R1]user-interface vty 0 4

[R1-ui-vty0-4]authentication-mode aaa

[R2]telnet server enable 

[R2]aaa

[R2-aaa]local-user taogou password cipher rgt12345 privilege level 15

[R2-aaa]local-user ruangou service-type telnet

[R2]user-interface vty 0 4

[R2-ui-vty0-4]authentication-mode aaa

3.配置pc1不能ping r1

[R1]acl 3000

[R1-acl-adv-3000]rule deny icmp source 192.168.1.10 0.0.0.0 destination 192.168.
1.1 0.0.0.0
[R1-acl-adv-3000]rule deny icmp source 192.168.1.10 0.0.0.0 destination 192.168.
2.1 0.0.0.0
4.配置pc1不能访问telnet R2

[R1-acl-adv-3000]rule deny tcp source 192.168.1.10 0.0.0.0 destination 192.168.2
.2 0.0.0.0 destination-port eq 23
5.配置pc2不能访问 telnet r1

[R1-acl-adv-3000]rule deny tcp source 192.168.1.11 0.0.0.0 destination 192.168.1
.1 0.0.0.0 destination-port eq 23
[R1-acl-adv-3000]rule deny tcp source 192.168.1.11 0.0.0.0 destination 192.168.2
.1 0.0.0.0 destination-port eq 23

6.配置pc2不能ping r2

[R1-acl-adv-3000]rule deny icmp source 192.168.1.11 0.0.0.0 destination 192.168.
2.2 0.0.0.0

7.策略下方在r1 0/0/0口

[R1]int g0/0/0
[R1-GigabitEthernet0/0/0]traf    
[R1-GigabitEthernet0/0/0]traffic-filter in    
[R1-GigabitEthernet0/0/0]traffic-filter inbound acl 3000

8.测试

1.pc1可以访问telnet R1，但不能ping r1

2.pc1不能访问telnet R2 但可以ping r2

3.pc2不可以访问telnet R1 ，但能ping r1

4.pc2能访问telnet r2,但不能ping r2