ACL运用----企业设备配置流量

1.实验要求：

1）R1只允许WG登录，WG能ping通Sever1和Client1
2)研发(YF)和财务（CW）不能互通，但是可以与网关（WG）互通
3）研发（YF）可以访问Client1
4)财务 (CW)不能访问Client1
5）研发（YF）和财务（CW）只能访问Sever1的www服务
6）只有网管（WG）可以访问Sever1的所有服务

2.实验拓扑

3.配置命令

1.配置终端设备
YF：
192.168.20.1
255.255.255.0
192.168.20.254
CW：
192.168.30.1
255.255.255.0
192.168.30.254
Server1:
192.168.1.1
255.255.255.0
192.168.1.254
2.配置网络设备
WG
[Huawei]int g0/0/0
[Huawei-GigabitEthernet0/0/0]ip address 192.168.10.1 24
[Huawei]ip route-static 0.0.0.0 0.0.0.0 192.168.10.254

AR10
[Huawei]int g0/0/1
[Huawei-GigabitEthernet0/0/1]ip address 192.168.10.254 24
[Huawei-GigabitEthernet0/0/1]int g0/0/2
[Huawei-GigabitEthernet0/0/2]ip address 192.168.20.254 24
[Huawei-GigabitEthernet0/0/2]int g0/0/0
[Huawei-GigabitEthernet0/0/0]ip address 192.168.12.2 30
[Huawei-GigabitEthernet0/0/0]q
[Huawei]ip route-static 0.0.0.0 0.0.0.0 192.168.12.1
[Huawei]acl 3000
[Huawei-acl-adv-3000]rule 5 permit ip source 192.168.20.1 0 destination 192.168.10.1 0
[Huawei-acl-adv-3000]rule 10 permit ip source 192.168.20.1 0 destination 1.1.1.1 0
[Huawei-acl-adv-3000]rule 15 permit tcp source 192.168.20.1 0 destination 192.168.1.1 0 destination-port eq 80
[Huawei-acl-adv-3000]rule 20 deny ip source any
[Huawei-acl-adv-3000]q
[Huawei]int g0/0/2
[Huawei-GigabitEthernet0/0/2]traffic-filter inbound acl 3000

AR11
[Huawei]int g0/0/2
[Huawei-GigabitEthernet0/0/2]ip address 192.168.1.254 24
[Huawei-GigabitEthernet0/0/2]int g0/0/1
[Huawei-GigabitEthernet0/0/1]ip address 192.168.30.254 24
[Huawei-GigabitEthernet0/0/1]int g0/0/0
[Huawei-GigabitEthernet0/0/0]ip address 192.168.13.2 30
[Huawei-GigabitEthernet0/0/0]q
[Huawei]ip route-static 0.0.0.0 0.0.0.0 192.168.13.1
[Huawei]acl 3000
[Huawei-acl-adv-3000]rule 5 permit ip source 192.168.30.1 0 destination 192.168.10.1 0
[Huawei-acl-adv-3000]rule 10 permit tcp source 192.168.30.1 0 destination 192.168.1.1 0 destination-port eq 80
[Huawei-acl-adv-3000]rule 15 deny ip source any
[Huawei-acl-adv-3000]int g0/0/1
[Huawei-GigabitEthernet0/0/1]traffic-filter inbound acl 3000

AR9
[Huawei]int g0/0/1
[Huawei-GigabitEthernet0/0/1]ip address 192.168.12.1 30
[Huawei-GigabitEthernet0/0/1]int g0/0/2
[Huawei-GigabitEthernet0/0/2]ip address 192.168.13.1 30
[Huawei-GigabitEthernet0/0/2]int g0/0/0
[Huawei-GigabitEthernet0/0/0]ip address 1.1.1.254 24
[Huawei-GigabitEthernet0/0/0]q
[Huawei]ip route-static 192.168.10.0 24 192.168.12.2
[Huawei]ip route-static 192.168.20.0 24 192.168.12.2
[Huawei]ip route-static 192.168.30.0 24 192.168.13.2
[Huawei]ip route-static 192.168.1.0 24 192.168.13.2
[Huawei]acl 2000
[Huawei-acl-basic-2000]rule 5 permit source 192.168.10.1 0
[Huawei-acl-basic-2000]q
[Huawei]user-interface vty 0 4
[Huawei-ui-vty0-4]acl 2000 inbound
[Huawei-ui-vty0-4]authentication-mode aaa
[Huawei-ui-vty0-4]aaa
[Huawei-aaa]local-user te password cipher 123
[Huawei-aaa]local-user tr service-type telnet

4.实验测试：