ACL(Access Control Lists)标准IP访问控制列表配置

一、实验目标

• 理解标准IP访问控制列表的原理及功能；
• 掌握编号的标准IP访问控制列表的配置方法；

二、实验背景

公司的经理部、财务部和销售部分别属于不同的3个网段，三部门之间用路由器进行信息传递，为了安全起见，公司领导要求销售部不能对财务部进行访问，但经理部可以对财务部进行访问。

三、技术原理

ACLs的全称为接入控制列表（Access Control Lists），也称为访问列表（Access List），俗称为防火墙，在有的文档中还称之为包过滤。ACLs通过定义一些规则对网络设备接口上的数据报文进行控制：允许通过或丢弃，从而提高网络可管理性和安全性；

IP ACL分为两种：标准IP访问列表和扩展IP访问列表，编号范围分别为1~99、1300~1999，100~199、2000~2699；

标准IP访问列表可以根据数据包的源IP地址定义规则，进行数据包的过滤；

扩展IP访问列表可以根据数据包的源IP、目的IP、源端口、目的端口、协议来定义规则，进行数据包的过滤；

IP ACL基于接口进行规则的应用，分为：入栈应用和出栈应用；

四、实验步骤

实验拓扑

1、路由器之间通过V.35电缆串口连接，DCE端连接在R1上，配置其时间频率为64000；主机与路由器通过交叉线连接；

2、配置路由器接口IP地址；

3、在路由器上配置OSPF路由协议，让三台PC 能相互ping通，因为只有在互通的前提下才能涉及到访问控制列表；

4、在R1上配置编号的IP标准访问控制列表；

5、将标准IP访问列表应用到接口上；

6、验证主机之间的互通性；

R1:

 

Router>en
Router#conf t
Router(config)#hostname R1
R1(config)#interface fa1/0
R1(config-if)#ip address 192.168.1.1 255.255.255.0
R1(config-if)#no shut

R1(config-if)#exit
R1(config)#int fa0/0
R1(config-if)#ip add 192.168.2.1 255.255.255.0
R1(config-if)#no shut

R1(config-if)#exit
R1(config)#int se2/0
R1(config-if)#clock rate 64000
R1(config-if)#ip add 192.168.3.1 255.255.255.0
R1(config-if)#no shut

R1(config-if)#exit
R1(config)#
R1(config)#router ospf 1
R1(config-router)#network 192.168.1.0 0.0.0.255 area 0
R1(config-router)#network 192.168.2.0 0.0.0.255 area 0
R1(config-router)#network 192.168.3.0 0.0.0.255 area 0
R1(config-router)#end
R1#
R1#show ip route 

C    192.168.1.0/24 is directly connected, FastEthernet1/0
C    192.168.2.0/24 is directly connected, FastEthernet0/0

R1#show ip route                        //两台路由器配置好后的路由信息


C    192.168.1.0/24 is directly connected, FastEthernet1/0
C    192.168.2.0/24 is directly connected, FastEthernet0/0
C    192.168.3.0/24 is directly connected, Serial2/0
O    192.168.4.0/24 [110/782] via 192.168.3.2, 00:00:15, Serial2/0
R1#
R1#conf t
R1(config)#ip ?
  access-list       Named access-list
  default-network   Flags networks as candidates for default routes
  dhcp              Configure DHCP server and relay parameters
  domain            IP DNS Resolver
  domain-lookup     Enable IP Domain Name System hostname translation
  domain-name       Define the default domain name
  forward-protocol  Controls forwarding of physical and directed IP broadcasts
  host              Add an entry to the ip hostname table
  name-server       Specify address of name server to use
  nat               NAT configuration commands
  route             Establish static routes
  tcp               Global TCP parameters
R1(config)#ip ac
R1(config)#ip access-list ?                            //添加控制列表
  extended  Extended Access List
  standard  Standard Access List
R1(config)#ip access-list sta
R1(config)#ip access-list standard ?
  <1-99>  Standard IP access-list number
  WORD    Access-list name
R1(config)#ip access-list standard david ?
  <cr>
R1(config)#ip access-list standard david                           //配置名为david的IP标准访问控制列表
R1(config-std-nacl)#?
  default  Set a command to its defaults
  deny     Specify packets to reject
  exit     Exit from access-list configuration mode
  no       Negate a command or set its defaults
  permit   Specify packets to forward
  remark   Access list entry comment
R1(config-std-nacl)#permit 192.168.1.0 ?
  A.B.C.D  Wildcard bits
  <cr>
R1(config-std-nacl)#permit 192.168.1.0 0.0.0.255 ?
  <cr>
R1(config-std-nacl)#permit 192.168.1.0 0.0.0.255                   //允许192.168.1.0网段通过
R1(config-std-nacl)#deny ?
  A.B.C.D  Address to match
  any      Any source host
  host     A single host address
R1(config-std-nacl)#deny 192.168.2.0 ?
  A.B.C.D  Wildcard bits
  <cr>
R1(config-std-nacl)#deny 192.168.2.0 0.0.0.255 ?
  <cr>
R1(config-std-nacl)#deny 192.168.2.0 0.0.0.255                     //禁止192.168.2.0网段通过
R1(config-std-nacl)#exit
R1(config)#inter
R1(config)#interface se2/0
R1(config-if)#?
  bandwidth          Set bandwidth informational parameter
  cdp                CDP interface subcommands
  clock              Configure serial interface clock
  crypto             Encryption/Decryption commands
  custom-queue-list  Assign a custom queue list to an interface
  delay              Specify interface throughput delay
  description        Interface specific description
  encapsulation      Set encapsulation type for an interface
  exit               Exit from interface configuration mode
  fair-queue         Enable Fair Queuing on an Interface
  frame-relay        Set frame relay parameters
  hold-queue         Set hold queue depth
  ip                 Interface Internet Protocol config commands
  keepalive          Enable keepalive
  mtu                Set the interface Maximum Transmission Unit (MTU)
  no                 Negate a command or set its defaults
  ppp                Point-to-Point Protocol
  priority-group     Assign a priority group to an interface
  service-policy     Configure QoS Service Policy
  shutdown           Shutdown the selected interface
  tx-ring-limit      Configure PA level transmit ring limit
  zone-member        Apply zone name
R1(config-if)#ip ?
  access-group        Specify access control for packets
  address             Set the IP address of an interface
  hello-interval      Configures IP-EIGRP hello interval
  helper-address      Specify a destination address for UDP broadcasts
  inspect             Apply inspect name
  ips                 Create IPS rule
  mtu                 Set IP Maximum Transmission Unit
  nat                 NAT interface commands
  ospf                OSPF interface commands
  split-horizon       Perform split horizon
  summary-address     Perform address summarization
  virtual-reassembly  Virtual Reassembly
R1(config-if)#ip ac
R1(config-if)#ip access-group ?
  <1-199>  IP access list (standard or extended)
  WORD     Access-list name
R1(config-if)#ip access-group david ?
  in   inbound packets
  out  outbound packets
R1(config-if)#ip access-group david out ?
  <cr>
R1(config-if)#ip access-group david out                       //将名为david的IP标准访问控制列表应用到se2/0端口
R1(config-if)#end
R1#

R2:

Router>en
Router#conf t
Router(config)#hostname R2
R2(config)#int fa0/0
R2(config-if)#ip add 192.168.4.1 255.255.255.0
R2(config-if)#no shut
R2(config-if)#exit
R2(config)#int se2/0
R2(config-if)#ip add 192.168.3.2 255.255.255.0
R2(config-if)#no shut
R2(config-if)#exit
R2(config)#router ospf 1
R2(config-router)#
R2(config-router)#network 192.168.3.0 0.0.0.255 area 0
R2(config-router)#network 192.168.4.0 0.0.0.255 area 0
R2(config-router)#end
R2#
R2#show ip route

O    192.168.1.0/24 [110/782] via 192.168.3.1, 00:00:09, Serial2/0
O    192.168.2.0/24 [110/782] via 192.168.3.1, 00:00:09, Serial2/0
C    192.168.3.0/24 is directly connected, Serial2/0
C    192.168.4.0/24 is directly connected, FastEthernet0/0
R2#

五、测试

PC1:经理部ping财务部，加ACL前后都可以通

Packet Tracer PC Command Line 1.0
PC1>ipconfig

IP Address......................: 192.168.1.2
Subnet Mask.....................: 255.255.255.0
Default Gateway.................: 192.168.1.1

PC1>ping 192.168.4.2                   //ACL前

Pinging 192.168.4.2 with 32 bytes of data:

Request timed out.
Reply from 192.168.4.2: bytes=32 time=15ms TTL=126
Reply from 192.168.4.2: bytes=32 time=9ms TTL=126
Reply from 192.168.4.2: bytes=32 time=15ms TTL=126

PC>ping 192.168.4.2                  //ACL后

Pinging 192.168.4.2 with 32 bytes of data:

Reply from 192.168.4.2: bytes=32 time=10ms TTL=126
Reply from 192.168.4.2: bytes=32 time=9ms TTL=126
Reply from 192.168.4.2: bytes=32 time=16ms TTL=126
Reply from 192.168.4.2: bytes=32 time=13ms TTL=126

PC>

PC2::销售部ping财务部，加ACL前可以ping通，加了后ping不通

Packet Tracer PC Command Line 1.0
PC>ipconfig

IP Address......................: 192.168.2.2
Subnet Mask.....................: 255.255.255.0
Default Gateway.................: 192.168.2.1

PC2>ping 192.168.4.2                //ACL前

Pinging 192.168.4.2 with 32 bytes of data:

Reply from 192.168.4.2: bytes=32 time=17ms TTL=126
Reply from 192.168.4.2: bytes=32 time=10ms TTL=126
Reply from 192.168.4.2: bytes=32 time=11ms TTL=126
Reply from 192.168.4.2: bytes=32 time=9ms TTL=126
PC2>ping 192.168.4.2                                      //ACL后

Pinging 192.168.4.2 with 32 bytes of data:

Reply from 192.168.2.1: Destination host unreachable.
Reply from 192.168.2.1: Destination host unreachable.
Reply from 192.168.2.1: Destination host unreachable.
Reply from 192.168.2.1: Destination host unreachable.
PC>

https://www.cnblogs.com/mchina/archive/2012/07/20/2601773.html