ACL实验

拓扑图

需求分析

1、R2开启telnet服务
2、PC1可以ping通R2,但是不能telnet R2
3、PC2可以telnet R2,但是不能ping通R2

具体配置

配置IP

[r1]int g0/0/0
[r1-GigabitEthernet0/0/0]ip ad 192.168.1.1 24
[r1-GigabitEthernet0/0/0]int g0/0/1
[r1-GigabitEthernet0/0/1]ip ad 192.168.2.1 24

[r2]int g0/0/1
[r2-GigabitEthernet0/0/1]ip ad 192.168.2.2 24

[pc1]int g0/0/0
[pc1-GigabitEthernet0/0/0]ip ad 192.168.1.2 24

[pc2]int g0/0/0
[pc2-GigabitEthernet0/0/0]ip ad 192.168.1.3 24

配置路由

[pc1]ip route-static 0.0.0.0 0 192.168.1.1
[pc2]ip route-static 0.0.0.0 0 192.168.1.1
[r2]ip route-static 192.168.1.0 24 192.168.2.1

telnet

[r1]aaa
[r1-aaa]local-user yzyss password cipher 123456
[r1-aaa]local-user yzyss service-type telnet
[r1-aaa]local-user yzyss privilege level 15
[r1-aaa]q
[r1]user-interface vty 0 4
[r1-ui-vty0-4]authentication-mode aaa
[r2]aaa
[r2-aaa]local-user yzyss password cipher 123456
[r2-aaa]local-user yzyss service-type telnet
[r2-aaa]local-user yzyss privilege level 15
[r2-aaa]q
[r2]user-interface vty 0 4
[r2-ui-vty0-4]authentication-mode aaa

ACL

[r1]acl 3000
[r1-acl-adv-3000]rule deny icmp source 192.168.1.2 0 destination 192.168.1.1 0 
[r1-acl-adv-3000]rule deny icmp source 192.168.1.2 0 destination 192.168.2.1 0 
[r1-acl-adv-3000]rule deny tcp source 192.168.1.2 0 destination 192.168.2.2 0 destination-port eq 23
[r1-acl-adv-3000]rule deny tcp source 192.168.1.3 0 destination 192.168.1.1 0 destination-port eq 2 
r1-acl-adv-3000]rule deny tcp source 192.168.1.3 0 destination 192.168.2.1 0 destination-port eq 23 
[r1-acl-adv-3000]rule deny icmp source 192.168.1.3 0 destination
192.168.2.2 0 
[r1]int g0/0/0
[r1-GigabitEthernet0/0/0]traffic-filter inbound acl 3000 

测试结果