ACL实验

一、问题

---

二、问题解析

1.数广播域，配IP

模拟PC

例：

[Huawei]sys pc2
[pc2]int g 0/0/0
[pc2-GigabitEthernet0/0/0]ip add 192.168.1.11 24
Jun  6 2024 09:09:20-08:00 pc2 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP
 on the interface GigabitEthernet0/0/0 has entered the UP state. 
[pc2-GigabitEthernet0/0/0]q
[pc2]ip route-static 0.0.0.0 0 192.168.1.1

2.开启R1,R2的telnet服务

例：在aaa里创建一个用户

[r1]aaa
[r1-aaa]local-user wy privilege level 15 password cipher 123456
Info: Add a new user.
定义服务类型

[r1-aaa]local-user wy service-type telnet

开启虚拟端口：

[r1]user-interface vty 0 

认证类型

[r1-ui-vty0]authentication-mode aaa

测试

3.在R1配置

创建acl，完成需求1

[r1]acl 3000
[r1-acl-adv-3000]rule deny icmp source 192.168.1.10 0.0.0.0 destination 192.168.
1.1 0.0.0.0
[r1-acl-adv-3000]rule deny icmp source 192.168.1.10 0.0.0.0 destination 192.168.
2.1 0.0.0.0
[r1-acl-adv-3000]

[r1-acl-adv-3000]rule deny tcp source 192.168.1.10 0.0.0.0 destination 192.168.
2.2 0.0.0.0 destination-port eq 23

调用：

[r1]interface GigabitEthernet 0/0/0
[r1-GigabitEthernet0/0/0]traffic-filter inbound acl 3000
测试

需求2

[r1]acl 3000
[r1-acl-adv-3000]rule deny tcp source 192.168.1.1 0.0.0.0 destination 192.168.1.
1 0.0.0.0 destination-port eq 23
[r1-acl-adv-3000]rule deny tcp source 192.168.1.1 0.0.0.0 destination 192.168.2.
1 0.0.0.0 destination-port eq 23
[r1-acl-adv-3000]rule deny icmp source 192.168.1.11 0.0.0.0 destination 192.168.
2.2 0.0.0.0
测试