实验环境
实验一
R2无法ping通R3
R3命令行
R3(config)#access-list 10 deny host 2.2.2.2
R3(config)#access-list 10 permit any
R3(config)#int e 0/0
R3(config-if)#ip access-group 10 in
R3(config-if)#
R2命令行
R2#ping 3.3.3.3 source 2.2.2.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:
Packet sent with a source address of 2.2.2.2
U.U.U
Success rate is 0 percent (0/5)
R1命令行
Router#ping 3.3.3.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
R1的ping行为不受ACL影响
实验二
2.2.2.2不能ping通3.3.3.3
同时
2.2.2.2可以telnet 3.3.3.3
R3命令行
R3(config)#username admin privilege 15 password admin
R3(config)#LINE VTY 0 4
R3(config-line)#LOG
R3(config-line)#log
R3(config-line)#login
R3(config-line)#login l
R3(config-line)#login local
R3(config-line)#trans
R3(config-line)#transport inp
R3(config-line)#transport input all
R3(config-line)#exit
R3(config)#ip access-list extended NCR3
R3(config-ext-nacl)#10 d
R3(config-ext-nacl)#10 de
R3(config-ext-nacl)#10 deny icmp host 2.2.2.2 ho
R3(config-ext-nacl)#10 deny icmp host 2.2.2.2 host 3.3.3.3
R3(config-ext-nacl)#10 deny icmp host 2.2.2.2 host 3.3.3.3 echo
R3(config-ext-nacl)#20 p
R3(config-ext-nacl)#20 permit tcp host 2.2.2.2 host 3.3.3.3 eq 23
R3(config-ext-nacl)#exit
R3(config)#int e 0/0
R3(config-if)#ip acces
R3(config-if)#ip access-group M
R3(config-if)#ip access-group N
R3(config-if)#ip access-group NCR3 in
R3(config-if)#
*Jul 15 16:13:20.861: %OSPF-5-ADJCHG: Process 110, Nbr 1.1.1.1 on Ethernet0/0 from FULL to DOWN, Neighbor Down: Dead timer expired
R3(config-if)#
R2命令行
R2#ping 3.3.3.3 source 2.2.2.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:
Packet sent with a source address of 2.2.2.2
U.U.U
Success rate is 0 percent (0/5)
R2#telnet 3.3.3.3 /so
R2#telnet 3.3.3.3 /source-interface loo
R2#telnet 3.3.3.3 /source-interface loopback 0
Trying 3.3.3.3 ... Open
User Access Verification
Username: admin
Password:
R3#
实验三
对VTY虚拟接口部署ACL,效果为:只有特定ip才能Telnet
R3命令行
R3(config)#ip access-list standard P12T
R3(config-std-nacl)#10 Permit host 12.1.1.2
R3(config-std-nacl)#exit
R3(config)#line vty 0 4
R3(config-line)#acces
R3(config-line)#access-class P12T in
R2命令行
R2#
R2#telnet 3.3.3.3 /source-interface loopback 0
Trying 3.3.3.3 ...
% Connection refused by remote host
R2#telnet 3.3.3.3 /source-interface ethernet 0/0
Trying 3.3.3.3 ... Open
User Access Verification
Username: admin
Password:
R3#