首先,确定搭建及配置要求
第一步:搭建拓扑建构,及其配置IP地址
配IP地址
[PC1]interface GigabitEthernet 0/0/0
[PC1-GigabitEthernet0/0/0]ip add 192.168.2.2 24
[PC2]interface GigabitEthernet 0/0/0
[PC2-GigabitEthernet0/0/0]ip add 192.168.2.3 24
[AR1]interface GigabitEthernet 0/0/0
[AR1-GigabitEthernet0/0/0]ip add 192.168.2.1 24
[AR1-GigabitEthernet0/0/0]q
[AR1]interface GigabitEthernet 0/0/1
[AR1-GigabitEthernet0/0/1]ip add 192.168.1.1 24
[AR2]interface GigabitEthernet 0/0/0
[AR2-GigabitEthernet0/0/0]ip add 192.168.1.2 24
第二步:给PC1和PC2配置缺省路由
[PC1]ip route-static 0.0.0.0 0 192.168.2.1
[PC2]ip route-static 0.0.0.0 0 192.168.2.1
第三步:在给AR2添加路由表
[AR2]ip route-static 192.168.2.0 24 192.168.1.1
此时,PC1和PC2可以ping通AR1和AR2
第四步:创建ACL列表(扩展列表),并进行配置
[AR1]acl 3000 创建acl列表,3000-3999为扩展列表;
[AR1-acl-adv-3000]rule deny icmp source 192.168.2.2 0 destination 192.168.2.1 0
[AR1-acl-adv-3000]rule deny icmp source 192.168.2.2 0 destination 192.168.1.1 0
[AR1-acl-adv-3000]rule deny icmp source 192.168.2.3 0 destination 192.168.1.2 0
[AR1-acl-adv-3000]rule deny tcp source 192.168.2.2 0 destination 192.168.1.2 0 d
estination-port eq 23
[AR1-acl-adv-3000]rule deny tcp source 192.168.2.3 0 destination 192.168.1.1 0 d
estination-port eq 23
[AR1-acl-adv-3000]rule deny tcp source 192.168.2.3 0 destination 192.168.2.1 0 d
estination-port eq 23
第五步:在路由器上开启远程控制,并基于TCP目标端口号23工作
[AR1]aaa
[AR1-aaa]local-user shuaige privilege level 15 password cipher 666666
Info: Add a new user.
[AR1-aaa]local-user shuaige service-type telnet
[AR1-aaa]q
[AR1]user-interface vty 0 4
[AR1-ui-vty0-4]authentication-mode aaa
[AR2]aaa
[AR2-aaa]local-user shuaige privilege level 15 password cipher 666666
Info: Add a new user.
[AR2-aaa]local-user shuaige service-type telnet
[AR2-aaa]q
[AR2]user-interface vty 0 4
[AR2-ui-vty0-4]authentication-mode aaa
第五步:测试一下,是否符合要求
此时,达到实验要求