路由与交换——ACL访问控制列表

ACL访问控制列表

访问控制列表(ACL)是一种基于包过滤的访问控制技术，它可以根据设定的条件对接口上的数据包进行过滤，允许其通过或丢弃。
标准访问控制列表命令：
acl [match-order config|auto]
rule [normal|special]{permit|deny} [source source-address source-wildcard|any]
拓展命令：
配置TCP/IP协议的访问控制列表：
rule {normal|special}{permit|deny}{tcp|udp}source {|any}destination |any}
[operate]
配置ICMP协议的扩展访问列表：
rule {normal|special}{permit|deny}icmp source {|any]destination {|any]
[icmp-code] [logging]
扩展访问控制列表操作符的含义
equal portnumber //等于
greater-than portnumber //大于
less-than portnumber //小于
not-equal portnumber //不等
range portnumber1 portnumber2 //区间

实验环境：华为ENSP

实验拓扑

详细配置

AR1

将AR1设置为DHCP服务器，设置两个地址池分别给PC2与PC1,；

<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]int g0/0/0
[Huawei-GigabitEthernet0/0/0]ip address 192.168.11.254 24 
[Huawei-GigabitEthernet0/0/0]q
[Huawei]int g0/0/1
[Huawei-GigabitEthernet0/0/1]ip add 192.168.10.254 24
[Huawei-GigabitEthernet0/0/1]q
[Huawei]int g0/0/2
[Huawei-GigabitEthernet0/0/2]ip add 192.168.20.254 24
[Huawei-GigabitEthernet0/0/2]q
//设置地址池for-net1
[Huawei]ip pool for-net1
Info: It's successful to create an IP address pool.
[Huawei-ip-pool-for-net1]net	
[Huawei-ip-pool-for-net1]network 192.168.10.0 mask 255.255.255.0
[Huawei-ip-pool-for-net1]gateway-list 192.168.10.254
[Huawei-ip-pool-for-net1]q
//设置地址池for-net2
[Huawei]ip pool for-net2
Info: It's successful to create an IP address pool.
[Huawei-ip-pool-for-net2]network 192.168.20.0 mask 255.255.255.0
[Huawei-ip-pool-for-net2]gateway-list 192.168.20.254
[Huawei-ip-pool-for-net2]q
[Huawei]dhcp enable 
Info: The operation may take a few seconds. Please wait for a moment.done.
//采用DHCP全局模式
[Huawei]int g0/0/1
[Huawei-GigabitEthernet0/0/1]dhcp select global 
[Huawei-GigabitEthernet0/0/1]q
//采用DHCP全局模式
[Huawei]int g0/0/2
[Huawei-GigabitEthernet0/0/2]dhcp select global
[Huawei-GigabitEthernet0/0/2]q
//设置ACL访问控制列表，接受来自192.168.10.0 网络的数据包，拒绝来自192.168.20.0 网络的数据包。
[Huawei]acl 2000
[Huawei-acl-basic-2000]rule 10 deny source 192.168.20.0 0.0.0.255
[Huawei-acl-basic-2000]rule 20 permit source 192.168.10.0 0.0.0.255
[Huawei-acl-basic-2000]q
//将此规则设置在GE0/0/0口上。
[Huawei]int g0/0/0
[Huawei-GigabitEthernet0/0/0]traffic-filter outbound acl 2000
[Huawei-GigabitEthernet0/0/0]q
[Huawei]

server1

实验结果

PC1可以访问server1，PC2无法访问server1。