实验五、访问列表与telnet访问控制

环境：两台路由器由串口相连。
要求：只允许R1的loop 1能ping 通R2的loop 0；并且在R2上做telnet访问控制，只允许R1的loop 0能够远程登录，不能使用deny语句。

步骤一、连通性配置

r1的配置：
r1(config)#interface loopback 0
r1(config-if)#ip address 10.1.1.1 255.255.255.0
r1(config-if)#interface loopback 1
r1(config-if)#ip adress 10.1.2.1 255.255.255.0
r1(config-if)#interface s0
r1(config-if)#ip address 30.1.1.1 255.255.255.0
r1(config-if)#no shutdown
r1(config)#ip route 0.0.0.0 0.0.0.0 30.1.1.2 配置缺省路由

r2的配置：
r2(config)#interface loopback 0
r2(config-if)#ip address 20.1.1.1 255.255.255.0
r2(config-if)#interface s1
r2(config-if)#ip address 30.1.1.2 255.255.255.0
r2(config-if)#clock rate 64000
r2(config-if)#no shutdown
r2(config)#ip route 0.0.0.0 0.0.0.0 30.1.1.1 配置缺省路由

做ping测试:
r1#ping
Protocol [ip]:
Target IP address:20.1.1.1
Extended commands [n]: y
Source address or interface: 10.1.1.1
!!!!!

步骤二、配置VTY
r2(config)#line vty 0 4
r2(config-line)#password cisco 配置登录密码
r2(config-line)#login

测试：
r1#telnet 30.1.1.2 /source-interface loopback 0 使用回环接口做为源
Trying 30.1.1.2 ... Open

User Access Verification

Password:
r2>

r1#telnet 30.1.1.2 /source-interface loopback 1 以LOOP 1做为源地址
Trying 30.1.1.2 ... Open

User Access Verification

Password: 输入密码，登录r2
r2>

步骤三、配置访问列表

r2(config)#access-list 102 permit icmp host 10.1.2.1 host 20.1.1.1
r2(config)#access-list 102 permit tcp any any eq telnet 创建扩展访问列表102
r2(config)#interface s1
r2(config-if)#ip access-group 102 in 将列表加载到接口
r2(config-if)#

ping测试:
r1#ping
Protocol [ip]:
Target IP address:20.1.1.1
Extended commands [n]: y
Source address or interface: 10.1.2.1
!!!!!

r1#ping
Protocol [ip]:
Target IP address:20.1.1.1
Extended commands [n]: y
Source address or interface: 10.1.1.1
…..

步骤四、创建telnet访问列表

r2(config)#access-list 10 permit host 10.1.1.1 创建标准访问列表10
r2(config)#line vty 0 4
r2(config-line)#access-class 10 in 加载列表10
r2(config-line)#exit
r2(config)#

测试:
r1#telnet 30.1.1.2
Trying 30.1.1.2 ...
% Connection refused by remote host

r1#telnet 30.1.1.2 /source-interface loopback 0
Trying 30.1.1.2 ... Open

User Access Verification

Password:
r2>

步骤五、显示配置结果

访问列表配置：
r2#show access-lists 显示访问列表
Standard IP access list 10
permit 10.1.1.1 (2 matches)
Extended IP access list 102
Permit icmp host 10.1.2.1 host 20.1.1.1 (163 matches)
permit tcp any any eq telnet (162 matches)

r1当前配置：
r1#show running-config
hostname r1
no ip domain-lookup
!
interface Loopback0
ip address 10.1.1.1 255.255.255.0
!
interface Loopback1
ip address 10.1.2.1 255.255.255.0
!
interface Serial0
ip address 30.1.1.1 255.255.255.0
clockrate 64000
!
ip route 0.0.0.0 0.0.0.0 30.1.1.2
!
end

r2的当前配置：
r2#show running-config
!
hostname r2
!
no ip domain-lookup
!
interface Loopback0
ip address 20.1.1.1 255.255.255.0
!
interface Serial1
ip address 30.1.1.2 255.255.255.0
ip access-group 102 in
!
ip route 0.0.0.0 0.0.0.0 30.1.1.1
!
access-list 10 permit 10.1.1.1
access-list 102 permit icmp host 10.1.2.1 host 20.1.1.1
access-list 102 permit tcp any any eq telnet
!
line vty 0 4
access-class 10 in
password cisco
login
!
end

转载于:https://blog.51cto.com/baby521/224856