HCIA - ACL实验

一、实验要求 

二、总体规划

 

 三、实验配置

1、配置IP

PC1：

[PC1]interface g0/0/0
[PC1-GigabitEthernet0/0/0]ip address 192.168.1.2 24

PC2：

[PC2]interface g0/0/0
[PC2-GigabitEthernet0/0/0]ip address 192.168.1.3 24

 R1：

[R1]interface g0/0/0
[R1-GigabitEthernet0/0/0]ip address 192.168.1.1 24
[R1-GigabitEthernet0/0/0]interface g0/0/1
[R1-GigabitEthernet0/0/1]ip address 192.168.2.1 24

R2：

[R2]interface g0/0/0
[R2-GigabitEthernet0/0/0]ip address 192.168.2.2 24

2、配置路由

PC1（缺省）：

[PC1]ip route-static 0.0.0.0 0 192.168.1.1

PC2（缺省）：

[PC2]ip route-static 0.0.0.0 0 192.168.1.1

AR2：

[R2]ip route-static 192.168.1.0 24 192.168.2.1

3、打开Telete（远程登录）配置

AR1：

[R1]aaa
[R1-aaa]local-user bthl privilege level 15 password cipher 123456
[R1-aaa]local-user bthl service-type telnet
[R1-aaa]q
[R1]user-interface vty 0
[R1-ui-vty0]authentication-mode aaa

 AR2：

[R2]aaa
[R2-aaa]local-user bthl privilege level 15 password cipher 654321
[R2-aaa]local-user bthl service-type telnet 
[R2-aaa]q
[R2]user-interface vty 0
[R2-ui-vty0]authentication-mode aaa

4、测试 

PC1：

<PC1>telnet 192.168.1.1
  Press CTRL_] to quit telnet mode
  Trying 192.168.1.1 ...
  Connected to 192.168.1.1 ...

Login authentication


Username:bthl
Password:
<R1>

<R1>tlen	
<R1>tel	
<R1>telnet 192.168.2.2
  Press CTRL_] to quit telnet mode
  Trying 192.168.2.2 ...
  Connected to 192.168.2.2 ...

Login authentication


Username:bthl
Password:
<R2>

5、配置ACL策略

AR1：

[R1]acl 3000
[R1-acl-adv-3000]rule deny icmp source 192.168.1.2 0 destination 192.168.1.1 0
[R1-acl-adv-3000]rule deny icmp source 192.168.1.2 0 destination 192.168.2.1 0
[R1-acl-adv-3000]rule deny tcp source 192.168.1.2 0 destination 192.168.2.2 0 destination-port eq 23
[R1-acl-adv-3000]rule deny tcp source 192.168.1.3 0 destination 192.168.1.1 0 destination-port eq 23
[R1-acl-adv-3000]rule deny tcp source 192.168.1.3 0 destination 192.168.2.1 0 destination-port eq 23
[R1-acl-adv-3000]rule deny icmp source 192.168.1.3 0 destination 192.168.2.2 0

6、调用到接口

AR1：

[R1]interface g0/0/0
[R1-GigabitEthernet0/0/0]traffic-filter inbound acl 3000

要求满足，实验结束！