环境:两台路由器由串口相连。
要求:只允许R1的loop 1能ping 通R2的loop 0;并且在R2上做telnet访问控制,只允许R1的loop 0能够远程登录,不能使用deny语句。
要求:只允许R1的loop 1能ping 通R2的loop 0;并且在R2上做telnet访问控制,只允许R1的loop 0能够远程登录,不能使用deny语句。
![%E8%AE%BF%E9%97%AE%E5%88%97%E8%A1%A8.jpg](https://i-blog.csdnimg.cn/blog_migrate/76445d6aa21903416437619fedc53e71.png)
步骤一、连通性配置
r1的配置:
r1(config)#interface loopback 0
r1(config-if)#ip address 10.1.1.1 255.255.255.0
r1(config-if)#interface loopback 1
r1(config-if)#ip adress 10.1.2.1 255.255.255.0
r1(config-if)#interface s0
r1(config-if)#ip address 30.1.1.1 255.255.255.0
r1(config-if)#no shutdown
r1(config)#ip route 0.0.0.0 0.0.0.0 30.1.1.2 配置缺省路由
r1(config)#interface loopback 0
r1(config-if)#ip address 10.1.1.1 255.255.255.0
r1(config-if)#interface loopback 1
r1(config-if)#ip adress 10.1.2.1 255.255.255.0
r1(config-if)#interface s0
r1(config-if)#ip address 30.1.1.1 255.255.255.0
r1(config-if)#no shutdown
r1(config)#ip route 0.0.0.0 0.0.0.0 30.1.1.2 配置缺省路由
r2的配置:
r2(config)#interface loopback 0
r2(config-if)#ip address 20.1.1.1 255.255.255.0
r2(config-if)#interface s1
r2(config-if)#ip address 30.1.1.2 255.255.255.0
r2(config-if)#clock rate 64000
r2(config-if)#no shutdown
r2(config)#ip route 0.0.0.0 0.0.0.0 30.1.1.1 配置缺省路由
r2(config)#interface loopback 0
r2(config-if)#ip address 20.1.1.1 255.255.255.0
r2(config-if)#interface s1
r2(config-if)#ip address 30.1.1.2 255.255.255.0
r2(config-if)#clock rate 64000
r2(config-if)#no shutdown
r2(config)#ip route 0.0.0.0 0.0.0.0 30.1.1.1 配置缺省路由
做ping测试:
r1#ping
Protocol [ip]:
Target IP address:20.1.1.1
Extended commands [n]: y
Source address or interface: 10.1.1.1
!!!!!
r1#ping
Protocol [ip]:
Target IP address:20.1.1.1
Extended commands [n]: y
Source address or interface: 10.1.1.1
!!!!!
步骤二、配置VTY
r2(config)#line vty 0 4
r2(config-line)#password cisco 配置登录密码
r2(config-line)#login
r2(config)#line vty 0 4
r2(config-line)#password cisco 配置登录密码
r2(config-line)#login
测试:
r1#telnet 30.1.1.2 /source-interface loopback 0 使用回环接口做为源
Trying 30.1.1.2 ... Open
r1#telnet 30.1.1.2 /source-interface loopback 0 使用回环接口做为源
Trying 30.1.1.2 ... Open
User Access Verification
Password:
r2>
r2>
r1#telnet 30.1.1.2 /source-interface loopback 1 以LOOP 1做为源地址
Trying 30.1.1.2 ... Open
Trying 30.1.1.2 ... Open
User Access Verification
Password: 输入密码,登录r2
r2>
r2>
步骤三、配置访问列表
r2(config)#access-list 102 permit icmp host 10.1.2.1 host 20.1.1.1
r2(config)#access-list 102 permit tcp any any eq telnet 创建扩展访问列表102
r2(config)#interface s1
r2(config-if)#ip access-group 102 in 将列表加载到接口
r2(config-if)#
r2(config)#access-list 102 permit tcp any any eq telnet 创建扩展访问列表102
r2(config)#interface s1
r2(config-if)#ip access-group 102 in 将列表加载到接口
r2(config-if)#
ping测试:
r1#ping
Protocol [ip]:
Target IP address:20.1.1.1
Extended commands [n]: y
Source address or interface: 10.1.2.1
!!!!!
r1#ping
Protocol [ip]:
Target IP address:20.1.1.1
Extended commands [n]: y
Source address or interface: 10.1.1.1
…..
Protocol [ip]:
Target IP address:20.1.1.1
Extended commands [n]: y
Source address or interface: 10.1.1.1
…..
步骤四、创建telnet访问列表
r2(config)#access-list 10 permit host 10.1.1.1 创建标准访问列表10
r2(config)#line vty 0 4
r2(config-line)#access-class 10 in 加载列表10
r2(config-line)#exit
r2(config)#
r2(config)#line vty 0 4
r2(config-line)#access-class 10 in 加载列表10
r2(config-line)#exit
r2(config)#
测试:
r1#telnet 30.1.1.2
Trying 30.1.1.2 ...
% Connection refused by remote host
r1#telnet 30.1.1.2
Trying 30.1.1.2 ...
% Connection refused by remote host
r1#telnet 30.1.1.2 /source-interface loopback 0
Trying 30.1.1.2 ... Open
Trying 30.1.1.2 ... Open
User Access Verification
Password:
r2>
r2>
步骤五、显示配置结果
访问列表配置:
r2#show access-lists 显示访问列表
Standard IP access list 10
permit 10.1.1.1 (2 matches)
Extended IP access list 102
Permit icmp host 10.1.2.1 host 20.1.1.1 (163 matches)
permit tcp any any eq telnet (162 matches)
r2#show access-lists 显示访问列表
Standard IP access list 10
permit 10.1.1.1 (2 matches)
Extended IP access list 102
Permit icmp host 10.1.2.1 host 20.1.1.1 (163 matches)
permit tcp any any eq telnet (162 matches)
r1当前配置:
r1#show running-config
hostname r1
no ip domain-lookup
!
interface Loopback0
ip address 10.1.1.1 255.255.255.0
!
interface Loopback1
ip address 10.1.2.1 255.255.255.0
!
interface Serial0
ip address 30.1.1.1 255.255.255.0
clockrate 64000
!
ip route 0.0.0.0 0.0.0.0 30.1.1.2
!
end
r1#show running-config
hostname r1
no ip domain-lookup
!
interface Loopback0
ip address 10.1.1.1 255.255.255.0
!
interface Loopback1
ip address 10.1.2.1 255.255.255.0
!
interface Serial0
ip address 30.1.1.1 255.255.255.0
clockrate 64000
!
ip route 0.0.0.0 0.0.0.0 30.1.1.2
!
end
r2的当前配置:
r2#show running-config
!
hostname r2
!
no ip domain-lookup
!
interface Loopback0
ip address 20.1.1.1 255.255.255.0
!
interface Serial1
ip address 30.1.1.2 255.255.255.0
ip access-group 102 in
!
ip route 0.0.0.0 0.0.0.0 30.1.1.1
!
access-list 10 permit 10.1.1.1
access-list 102 permit icmp host 10.1.2.1 host 20.1.1.1
access-list 102 permit tcp any any eq telnet
!
line vty 0 4
access-class 10 in
password cisco
login
!
end
r2#show running-config
!
hostname r2
!
no ip domain-lookup
!
interface Loopback0
ip address 20.1.1.1 255.255.255.0
!
interface Serial1
ip address 30.1.1.2 255.255.255.0
ip access-group 102 in
!
ip route 0.0.0.0 0.0.0.0 30.1.1.1
!
access-list 10 permit 10.1.1.1
access-list 102 permit icmp host 10.1.2.1 host 20.1.1.1
access-list 102 permit tcp any any eq telnet
!
line vty 0 4
access-class 10 in
password cisco
login
!
end
转载于:https://blog.51cto.com/baby521/224856