NA-NP-IE系列实验35：标准ACL

最新推荐文章于 2024-08-12 14:02:31 发布
最新推荐文章于 2024-08-12 14:02:31 发布
阅读量147 收藏 1
点赞数
文章标签： 网络
原文链接：https://yq.aliyun.com/articles/447239
版权
实验35：标准ACL
1. 实验目的
通过本实验可以掌握：
（1）ACL 设计原则和工作过程
（2）定义标准ACL
（3）应用ACL
（4）标准ACL 调试
注：本实验拒绝PC0访问路由器R2,同时只允许主机PC1 访问路由器R1 的TELNET
服务。整个网络配置EIGRP 保证IP 的连通性
2. 拓扑结构
实验拓扑如图所示。
3. 实验步骤
注：（1）ACL 定义好，可以在很多地方应用，接口上应用只是其中之一，其它的常用应用
包括在route map 中的match 应用）和在vty 下用“access-class”命令调用，
来控制telnet 的访问；
（2）访问控制列表表项的检查按自上而下的顺序进行，并且从第一个表项开始，所以
必须考虑在访问控制列表中定义语句的次序；
（3）路由器不对自身产生的IP 数据包进行过滤；
（4）访问控制列表最后一条是隐含的拒绝所有；
（5）每一个路由器接口的每一个方向，每一种协议只能创建一个ACL；
（6）“access-class”命令只对标准ACL 有效。
 
 
 
 
r0(config)#int s1/0
r0(config-if)#ip add 172.16.2.1 255.255.255.0
r0(config-if)#no sh
 
%LINK-5-CHANGED: Interface Serial1/0, changed state to up
r0(config-if)#
r0(config-if)#exit
r0(config)#int f0/0
r0(config-if)#ip add 172.16.1.2 255.255.255.0
r0(config-if)#no sh
 
%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up
r0(config-if)#
r0(config-if)#do sh ip int b
Interface              IP-Address      OK? Method Status                Protocol
 
FastEthernet0/0        172.16.1.2      YES manual up                    up
 
FastEthernet0/1        unassigned      YES manual administratively down down
 
FastEthernet1/0        unassigned      YES manual administratively down down
 
Serial1/0              172.16.2.1      YES manual up                    down
r0(config-if)#exit
r0(config)#int s1/0
r0(config-if)#clo r 64000
r0(config-if)#no sh
r0(config-if)#
%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/0, changed state to up
r0(config-if)#do ping 172.16.1.1
 
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 16/27/31 ms
 
r0(config-if)#exit
r0(config)#router eigrp 1
r0(config-router)#no au
r0(config-router)#net 172.16.1.0
r0(config-router)#net 172.16.2.0
r0(config-router)#
%DUAL-5-NBRCHANGE: IP-EIGRP 1: Neighbor 172.16.2.2 (Serial1/0) is up: new adjacency
r0(config-router)#
 
 
r1(config)#int s1/1
r1(config-if)#clo r 64000
r1(config-if)#no sh
r1(config-if)#
%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/1, changed state to up
r1(config-if)#exit
r1(config)#router eigrp 1
r1(config-router)#no au
r1(config-router)#net 172.16.2.0
r1(config-router)#
%DUAL-5-NBRCHANGE: IP-EIGRP 1: Neighbor 172.16.2.1 (Serial1/0) is up: new adjacency
r1(config-router)#net 172.16.3.0
%DUAL-5-NBRCHANGE: IP-EIGRP 1: Neighbor 172.16.3.2 (Serial1/1) is up: new adjacency
r1(config-router)#exit
r1(config)#access-list 1 permit 172.16.4.1
r1(config)#line vty 0 4
r1(config-line)#access-class 1 in
 
r1(config-line)#pass cisco
r1(config-line)#login
r1(config-line)#do sh ip int b  定义ACL
 
Interface              IP-Address      OK? Method Status                Protocol
 
FastEthernet0/0        unassigned      YES manual administratively down down
 
FastEthernet0/1        unassigned      YES manual administratively down down
 
FastEthernet1/0        unassigned      YES manual administratively down down
 
Serial1/0              172.16.2.2      YES manual up                    up
 
Serial1/1              172.16.3.1      YES manual up                    up
 
r1(config-line)#do ping 172.16.1.1
 
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 47/56/62 ms
 
r1(config-line)#do ping 172.16.4.1
 
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.4.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 47/56/62 ms
 
r1(config-line)#do sh ip access-lists
Standard IP access list 1
    permit host 172.16.4.1
r1(config-line)#do sh ip int
FastEthernet0/0 is administratively down, line protocol is down (disabled)
  Internet protocol processing disabled
FastEthernet0/1 is administratively down, line protocol is down (disabled)
  Internet protocol processing disabled
FastEthernet1/0 is administratively down, line protocol is down (disabled)
  Internet protocol processing disabled
Serial1/0 is up, line protocol is up (connected)
  Internet address is 172.16.2.2/24
  Broadcast address is 255.255.255.255
  Address determined by setup command
  MTU is 1500
  Helper address is not set
  Directed broadcast forwarding is disabled
  Outgoing access list is not set
  Inbound  access list is not set
  Proxy ARP is enabled
  Security level is default
  Split horizon is enabled
  ICMP redirects are always sent
  ICMP unreachables are always sent
  ICMP mask replies are never sent
  IP fast switching is disabled
  IP fast switching on the same interface is disabled
  IP Flow switching is disabled
  IP Fast switching turbo vector
  IP multicast fast switching is disabled
  IP multicast distributed fast switching is disabled
  Router Discovery is disabled
  IP output packet accounting is disabled
  IP access violation accounting is disabled
  TCP/IP header compression is disabled
  RTP/IP header compression is disabled
  Probe proxy name replies are disabled
  Policy routing is disabled
  Network address translation is disabled
  WCCP Redirect outbound is disabled
  WCCP Redirect exclude is disabled
  BGP Policy Mapping is disabled
Serial1/1 is up, line protocol is up (connected)
  Internet address is 172.16.3.1/24
  Broadcast address is 255.255.255.255
  Address determined by setup command
  MTU is 1500
  Helper address is not set
  Directed broadcast forwarding is disabled
  Outgoing access list is not set
  Inbound  access list is not set
  Proxy ARP is enabled
  Security level is default
  Split horizon is enabled
  ICMP redirects are always sent
  ICMP unreachables are always sent
  ICMP mask replies are never sent
  IP fast switching is disabled
  IP fast switching on the same interface is disabled
  IP Flow switching is disabled
  IP Fast switching turbo vector
  IP multicast fast switching is disabled
  IP multicast distributed fast switching is disabled
  Router Discovery is disabled
  IP output packet accounting is disabled
  IP access violation accounting is disabled
  TCP/IP header compression is disabled
  RTP/IP header compression is disabled
  Probe proxy name replies are disabled
  Policy routing is disabled
  Network address translation is disabled
  WCCP Redirect outbound is disabled
  WCCP Redirect exclude is disabled
  BGP Policy Mapping is disabled
r1(config-line)#
 
 
 
r2(config)#int f0/0
r2(config-if)#ip add 172.16.4.2 255.255.255.0
r2(config-if)#no sh
 
%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up
r2(config-if)#
r2(config-if)#exit
r2(config)#int s1/0
r2(config-if)#ip add 172.16.3.2 255.255.255.0
r2(config-if)#no sh
 
%LINK-5-CHANGED: Interface Serial1/0, changed state to down
r2(config-if)#
%LINK-5-CHANGED: Interface Serial1/0, changed state to up
r2(config-if)#
%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/0, changed state to up
r2(config-if)#exit
r2(config)#router eigrp 1
r2(config-router)#no au
r2(config-router)#net 172.16.3.0
r2(config-router)#
%DUAL-5-NBRCHANGE: IP-EIGRP 1: Neighbor 172.16.3.1 (Serial1/0) is up: new adjacency
r2(config-router)#net 172.16.4.0
r2(config-router)#exit
r2(config)#access-list 1 deny 172.16.1.1 0.0.0.0
r2(config)#access-list 1 permit any
r2(config)#int f0/0
r2(config-if)#exit
r2(config)#int s1/0
r2(config-if)#ip access-group 1 in//在接口下应用ACL
 
r2(config-if)#exit
r2(config)#do ping 172.16.1.1
 
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
 
r2(config)#do sh ip access-lists
Standard IP access list 1
    deny host 172.16.1.1 (18 match(es))
    permit any (93 match(es))
r2(config)#do sh ip int
FastEthernet0/0 is up, line protocol is up (connected)
  Internet address is 172.16.4.2/24
  Broadcast address is 255.255.255.255
  Address determined by setup command
  MTU is 1500
  Helper address is not set
  Directed broadcast forwarding is disabled
  Outgoing access list is not set
  Inbound  access list is not set
  Proxy ARP is enabled
  Security level is default
  Split horizon is enabled
  ICMP redirects are always sent
  ICMP unreachables are always sent
  ICMP mask replies are never sent
  IP fast switching is disabled
  IP fast switching on the same interface is disabled
  IP Flow switching is disabled
  IP Fast switching turbo vector
  IP multicast fast switching is disabled
  IP multicast distributed fast switching is disabled
  Router Discovery is disabled
  IP output packet accounting is disabled
  IP access violation accounting is disabled
  TCP/IP header compression is disabled
  RTP/IP header compression is disabled
  Probe proxy name replies are disabled
  Policy routing is disabled
  Network address translation is disabled
  WCCP Redirect outbound is disabled
  WCCP Redirect exclude is disabled
  BGP Policy Mapping is disabled
FastEthernet0/1 is administratively down, line protocol is down (disabled)
  Internet protocol processing disabled
FastEthernet1/0 is administratively down, line protocol is down (disabled)
  Internet protocol processing disabled
Serial1/0 is up, line protocol is up (connected)
  Internet address is 172.16.3.2/24
  Broadcast address is 255.255.255.255
  Address determined by setup command
  MTU is 1500
  Helper address is not set
  Directed broadcast forwarding is disabled
  Outgoing access list is not set
  Inbound  access list is 1
  Proxy ARP is enabled
  Security level is default
  Split horizon is enabled
  ICMP redirects are always sent
  ICMP unreachables are always sent
  ICMP mask replies are never sent
  IP fast switching is disabled
  IP fast switching on the same interface is disabled
  IP Flow switching is disabled
  IP Fast switching turbo vector
  IP multicast fast switching is disabled
  IP multicast distributed fast switching is disabled
  Router Discovery is disabled
  IP output packet accounting is disabled
  IP access violation accounting is disabled
  TCP/IP header compression is disabled
  RTP/IP header compression is disabled
  Probe proxy name replies are disabled
  Policy routing is disabled
  Network address translation is disabled
  WCCP Redirect outbound is disabled
  WCCP Redirect exclude is disabled
  BGP Policy Mapping is disabled
r2(config)#
 
pc0:
 
 
pc1


本文转自gauyanm 51CTO博客，原文链接：http://blog.51cto.com/gauyanm/239127，如需转载请自行联系原作者
weixin_34413103
关注
  • 0
    点赞
  • 踩
  • 1
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
标准ACL配置
weixin_34405354的博客
12-10 206
标准ACL配置 1、 实验目的： 通过本次的实验，我们可以掌握如下技能 1) ACL的设计原则和工作过程。 2) 定义标准ACL。 3) 应用ACL。 4) 标准ACL的调试。 2、 实验拓扑图： 3、 实验步骤： （1） 配置各个路由器接口地址 Router(c...
扩展ACL
weixin_30275415的博客
05-29 2769
扩展ACL 实验拓扑以及地址规划 要求： 拒绝PC0 所在网段访问Server 172.84.3.100 的Web 服务 拒绝PC1 所在网段访问Server 172.84.3.100 的Ftp 服务 拒绝PC0 所在网段访问Server 172.84.3.100 的SQL 服务 拒绝PC0 所在网段访问路由器R3 的Telnet 服务 拒绝PC1 所在网段访问路由...
思科 计算机网络 第十一章测试考试答案
热门推荐
weixin_46498855的博客
05-15 3万+
测试 1.如果在 10 秒内 2 次登录失败，以下哪个命令将在 30 秒内阻止路由器 A 上的登录尝试？选择一项： A.RouterA(config)# login block-for 10 attempts 2 within 30 B.RouterA(config)# login block-for 30 attempts 2 within 10 C.RouterA(config)# login block-for 2 attempts 30 within 10 D.RouterA(config)# lo
访问控制列表--标准ACL
青红造了个大白之成长记
07-05 2万+
访问控制列表(Access Control List，简称ACL)是根据报文字段对报文进行过滤的一种安全技术。访问控制列表通过过滤报文达到流量控制、攻击防范以及用户接入控制等功能，在现实中应用广泛。ACL根据功能的不同分为标准ACL和扩展ACL。标准ACL只能过滤报文的源IP地址；扩展ACL可以过滤源IP、目的IP、协议类型、端口号等。ACL的配置主要分为两个步骤：（1）根据需求编写ACL；(2)...
NA-NP-IE实验
03-20
好资源，齐分享。是NA到NP到IE是实验的最佳选择，有实验才有效果
NA-NP-IE实验集合
10-01
关于ccna、ccnp、ccie的实验，很全，也有详细说明。
cisco NA-NP完全命令配置文档
11-16
由于给定的部分内容无法识别，我将专注于标题和描述中提到的“Cisco NA-NP完全命令配置文档”来生成相关的IT知识点。 ### Cisco NA-NP完全命令配置文档知识点 #### 1. **理解Cisco NA-NP** Cisco NA-NP（Network ...
测序数据标准品的家系关系-NA12878
10-16
测序数据标准品的家系关系-NA12878 测序数据标准品的家系关系是指通过高通量sequencing技术获得的测序数据，并将其与已知的参考基因组进行比对，以确定其家系关系。 NA12878是常用的测序数据标准品之一，它来自于...
KD101N9-40NA-B19 SPEC(20160222).pdf
05-03
根据提供的文档信息，我们可以得出这份文档是关于深圳市国显科技有限公司生产的液晶显示模块KD101N9-40NA-B19的技术规格书。以下是对该产品的一些关键知识点进行详细解析。 ### 1. 产品概述 - **制造商：** 深圳市...
SSH 和 Telnet 之间的区别
ITmoster的博客
08-08 376
SSH 和 Telnet是帮助用户与远程系统建立连接的两种通信协议，这些通信协议决定了数据如何在网络上的不同设备之间传输，这些设备通常需要通过各种物理和数字环境进行传输，网络协议的主要目标是通信、网络管理和安全。
深度解密CRLF注入与重定向漏洞：从原理到实践
2301_80064376的博客
08-08 895
重定向漏洞（Open Redirect）是一种安全漏洞，攻击者可以利用它将用户从受信任的网站重定向到恶意网站。这种漏洞通常出现在网站处理 URL 参数时，没有对用户输入进行适当验证。
开发android app用于移远模块读写IMEI 模组EC200DEULA-D08-SNNDA 支持socket连接读写IMEI
chenhao0568的专栏
08-07 385
发送{“function”: “write_imei”,“imei”: “860004050179648”}响应{“message”: “success”,“imei”: “860004050179648”}当结果正常时message为success,否则message给出英文具体原因,其它参数可能为空。发送{“function”: “read_imei”}响应{“message”: “success”}前面本地5902 转发到 后面设备为5902。PC与终端APP之间 json通信协议。
HAProxy基本配置及参数实操
Webston的博客
08-12 767
静态#动态#以下静态和动态取决于hash_type 是否consistentfirst #使用较少static-rr #做了session 共享的web集群leastconn #数据库source#基于客户端公网IP 的会话保持Uri--------------->http #缓存服务器，CDN服务商，蓝汛、百度、阿里云、腾讯url_param--------->http #可以实现session 保持hdr #基于客户端请求报文头部做下一步处理高。
OSPF小实验
sgdhshshhs的博客
08-07 404
【代码】OSPF小实验。
mpls vpn基础实验
wudongfang666的专栏
08-10 467
场景：异地两个站点通过mpls vpn骨干网络实现安全通讯虚拟路由转发 VRF ，相当于在设备内建立一条虚拟通道，一个vpn的实例（vrf）可以简单的理解为一台虚拟设备。拓扑图。
Netty原理及实战应用（下篇）
最新发布
program哲学
08-12 30
本文详细介绍了netty关于websocket集成、消息推送应用、网络连接编解码等方面的内容
48天笔试训练错题——day44
ミカミミミ博客
08-08 818
48天笔试训练错题——day44.
48天笔试训练错题——day43
ミカミミミ博客
08-07 885
48天笔试训练错题——day43.
CHIMEI INNOLUX EE070NA-01D LCD模块规格详细说明
"EE070NA-01D规格书是来自奇美光电（CHIMEI INNOLUX DISPLAY CORPORATION）的一份液晶显示模块（LCD Module）的技术规范文档，主要针对客户模型号为EE070NA-01D的产品。这份规格书最初发布于2011年2月14日，最终修订...
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值