ACL访问控制列表案例（7.15）

最新推荐文章于 2024-05-29 21:52:19 发布

未知百分百

最新推荐文章于 2024-05-29 21:52:19 发布

阅读量1.3k

点赞数 5

文章标签：大数据网络网络协议网络安全 tcp/ip

本文链接：https://blog.csdn.net/qq_68163788/article/details/125807836

版权

该博客详细描述了如何在华为路由器上配置接口IP，设置AAA认证，创建VTY线，并使用ACL策略阻止PC1 Telnet r1，同时允许PC2 ping但禁止其Telnet。通过实例展示了如何应用流量过滤器和测试网络连接。

摘要由CSDN通过智能技术生成

1、首先配置r1/r2/pc1/pc2各个接口的ip

r1：

[r1]interface GigabitEthernet 0/0/0
[r1-GigabitEthernet0/0/0]ip address 192.168.1.1 24
[r1-GigabitEthernet0/0/0]q
[r1]interface GigabitEthernet 0/0/1
[r1-GigabitEthernet0/0/1]ip address 192.168.2.1 24

r2：

[r2]interface GigabitEthernet 0/0/0
[r2-GigabitEthernet0/0/0]ip address 192.168.2.2 24

pc1：

[pc1]interface GigabitEthernet 0/0/0
[pc1-GigabitEthernet0/0/0]ip address 192.168.1.2 24
【pc1】ip route-static 0.0.0.0 0 192.168.1.1

pc2：

[pc2]interface GigabitEthernet 0/0/0
[pc2-GigabitEthernet0/0/0]ip address 192.168.1.3 24
【pc2】ip route-static 0.0.0.0 0 192.168.1.1

2、现在到r1、r2上分别创建一个Telnet

r1：

[r1]aaa  	
[r1-aaa]local-user yps privilege level 15 password cipher 123456
[r1-aaa]local-user yps service-type telnet
[r1-aaa]q
[r1]user-interface vty 0 4
[r1-ui-vty0-4]authentication-mode aaa

r2：

[r2]aaa// 
[r2-aaa]local-user yps privilege level 15 password cipher 123456// 用户名 访问等级 密码
Info: Add a new user.
[r2-aaa]Q
[r2]user-interface vty 0 4 
[r2-ui-vty0-4]authentication-mode aaa//在vty线上开启认证

3、实现要求（这里可以不用写可以的，因为华为模拟器默认就是可以的，只需要写禁止即可）

r1：pc1可以Telnet不能ping

pc2可以ping不能Telnet

[r1-acl-adv-3333]rule deny icmp source 192.168.1.2 0 destination 192.168.1.1 0
[r1-acl-adv-3333]rule deny icmp source 192.168.1.2 0 destination 192.168.2.1 0
[r1-acl-adv-3333]rule deny icmp source 192.168.1.3 0 destination 192.168.2.2 0
[r1-acl-adv-3333]rule deny tcp source 192.168.1.3 0 destination 192.168.1.1 0 de
stination-port eq 23
[r1-acl-adv-3333]rule deny tcp source 192.168.1.3 0 destination 192.168.2.1 0 de
stination-port eq 23
[r1-acl-adv-3333]rule deny tcp source 192.168.1.2 0destination 192.168.2.2 0 des
tination-port eq 23

r2：pc2可以Telnet不能ping

pc1可以ping不能Telnet

4、调用

[r1-GigabitEthernet0/0/0]traffic-filter outbound acl 3333

5、测试

pc1ping r1、r2、登录r1、r2

<pc1>ping 192.168.1.1
  PING 192.168.1.1: 56  data bytes, press CTRL_C to break
    Request time out
    Request time out
    Request time out
    Request time out
    Request time out

  --- 192.168.1.1 ping statistics ---
    5 packet(s) transmitted
    0 packet(s) received
    100.00% packet loss

<pc1>
<pc1>
<pc1>
<pc1>ping 192.168.1.1
  PING 192.168.1.1: 56  data bytes, press CTRL_C to break
    Request time out
    Request time out
    Request time out
    Request time out
    Request time out

  --- 192.168.1.1 ping statistics ---
    5 packet(s) transmitted
    0 packet(s) received
    100.00% packet loss

<pc1>ping 192.168.2.2
  PING 192.168.2.2: 56  data bytes, press CTRL_C to break
    Reply from 192.168.2.2: bytes=56 Sequence=1 ttl=254 time=40 ms
    Reply from 192.168.2.2: bytes=56 Sequence=2 ttl=254 time=40 ms
    Reply from 192.168.2.2: bytes=56 Sequence=3 ttl=254 time=50 ms
    Reply from 192.168.2.2: bytes=56 Sequence=4 ttl=254 time=50 ms
    Reply from 192.168.2.2: bytes=56 Sequence=5 ttl=254 time=50 ms

  --- 192.168.2.2 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 40/46/50 ms

<pc1>te	
<pc1>telnet 192.168.1.1
  Press CTRL_] to quit telnet mode
  Trying 192.168.1.1 ...
  Connected to 192.168.1.1 ...

Login authentication


Username:yps
Password:
  ----------------------------------------------------------------------------- 
    
  User last login information:     
  -----------------------------------------------------------------------------
  Access Type: Telnet      
  IP-Address : 192.168.1.3     
  Time       : 2022-07-15 17:24:02-08:00     
  -----------------------------------------------------------------------------
<r1>te	
<r1>telnet 192.168.2.2
  Press CTRL_] to quit telnet mode
  Trying 192.168.2.2 ...
  Connected to 192.168.2.2 ...

Login authentication

pc2ping r1、r2、登录r1、r2

<pc2>ping 192.168.1.1
  PING 192.168.1.1: 56  data bytes, press CTRL_C to break
    Reply from 192.168.1.1: bytes=56 Sequence=1 ttl=255 time=40 ms
    Reply from 192.168.1.1: bytes=56 Sequence=2 ttl=255 time=40 ms
    Reply from 192.168.1.1: bytes=56 Sequence=3 ttl=255 time=50 ms
    Reply from 192.168.1.1: bytes=56 Sequence=4 ttl=255 time=40 ms
    Reply from 192.168.1.1: bytes=56 Sequence=5 ttl=255 time=40 ms

  --- 192.168.1.1 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 40/42/50 ms

<pc2>

  Please check whether system data has been changed, and save data in time

  Configuration console time out, please press any key to log on

<pc2>ping 192.168.1.1
  PING 192.168.1.1: 56  data bytes, press CTRL_C to break
    Reply from 192.168.1.1: bytes=56 Sequence=1 ttl=255 time=50 ms
    Reply from 192.168.1.1: bytes=56 Sequence=2 ttl=255 time=40 ms
    Reply from 192.168.1.1: bytes=56 Sequence=3 ttl=255 time=40 ms
    Reply from 192.168.1.1: bytes=56 Sequence=4 ttl=255 time=40 ms
    Reply from 192.168.1.1: bytes=56 Sequence=5 ttl=255 time=40 ms

  --- 192.168.1.1 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 40/42/50 ms

<pc2>ping 192.168.2.2
  PING 192.168.2.2: 56  data bytes, press CTRL_C to break
    Request time out
    Request time out
    Request time out
    Request time out
    Request time out

  --- 192.168.2.2 ping statistics ---
    5 packet(s) transmitted
    0 packet(s) received
    100.00% packet loss
<pc2>telnet 192.168.1.1
  Press CTRL_] to quit telnet mode
  Trying 192.168.1.1 ...
  Error: Can't connect to the remote host
<pc2>telnet 192.168.2.2
  Press CTRL_] to quit telnet mode
  Trying 192.168.2.2 ...
  Connected to 192.168.2.2 ...

Login authentication


Username:yps
Password:
  ----------------------------------------------------------------------------- 
    
  User last login information:     
  -----------------------------------------------------------------------------
  Access Type: Telnet      
  IP-Address : 192.168.2.1     
  Time       : 2022-07-15 18:09:30-08:00     
  -----------------------------------------------------------------------------
<r2>

未知百分百

关注

5
点赞
踩
6

收藏

觉得还不错? 一键收藏
打赏
2
评论
ACL访问控制列表案例（7.15）

3、实现要求（这里可以不用写可以的，因为华为模拟器默认就是可以的，1、首先配置r1/r2/pc1/pc2各个接口的ip。2、现在到r1、r2上分别创建一个Telnet。pc1pingr1、r2、登录r1、r2。pc2pingr1、r2、登录r1、r2。r1pc1可以Telnet。r2pc2可以Telnet。...
复制链接

扫一扫