标准ACL(Standard ACL)
版权声明:原创作品,允许转载,转载时请务必以超链接形式标明文章 原始出处 、作者信息和本声明。否则将追究法律责任。http://loveme23.blog.51cto.com/7891/29181 |
实验来源:工大瑞普Cisco网络技术论坛 ![]() 要求: 1.允许192.168.1.1的主机对R4访问 2.允许192.168.1.3的主机对R4访问 3.允许131.16.24.0的网段主机对R4访问 4.不允许192.168.1.2的主机对R4访问 1.按照拓扑配置好各个路由器的接口IP地址; 2.在每台路由器上配置OSPF路由协议: r1(config)#router ospf 100 r1(config-router)#net r1(config-router)#net 192.168.1.0 0.0.0.255 area 0 r2(config)#router ospf 100 r2(config-router)#net r2(config-router)#network 131.16.24.0 0.0.0.255 area 0 r2(config-router)#net 192.168.1.0 0.0.0.255 area 0 r3(config)#router ospf 100 r3(config-router)#network 192.168.1.0 0.0.0.255 area 0 r3(config-router)#network 172.16.1.0 0.0.0.255 area 0 r4(config)#router ospf 100 r4(config-router)#network 172.16.1.0 0.0.0.255 area 0 r4(config-router)#network 10.1.1.0 0.0.0.255 area 0 r4(config-router)#network 10.2.2.0 0.0.0.255 area 0 r3#show ip route Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route Gateway of last resort is not set 172.16.0.0/24 is subnetted, 1 subnets C 172.16.1.0 is directly connected, Serial1/2 10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks O 10.2.2.0/24 [110/65] via 172.16.1.2, 00:00:03, Serial1/2 O 10.1.1.1/32 [110/65] via 172.16.1.2, 00:00:03, Serial1/2 C 192.168.1.0/24 is directly connected, FastEthernet0/0 3.设置ACL(注:标准ACL应该在距离目标近的地方设置,扩展ACL应该在距离源较近的地方设置) 方法1: r4(config)#access-list 10 permit host 192.168.1.1 //编辑阿ACL 10允许主机192.168.1.1访问 r4(config)#access-list 10 permit host 192.168.1.3 r4(config)#access-list 10 permit 131.16.24.0 0.0.0.255 r4(config)#access-list 10 permit host 172.16.1.1 r4(config)#int s1/2 r4(config-if)#ip access-group 10 in //在接口进入的方向应用ACL 10 r4(config)#access-list 10 deny host 192.168.1.2 r4(config)#access-list 10 permit any any r4(config)#int s1/2 r4(config-if)#ip access-group 10 in r4#show ip access-lists Standard IP access list 10 10 permit 192.168.1.1 (45 matches) 20 permit 192.168.1.3 (15 matches) 40 permit 172.16.1.1 (63 matches) 30 permit 131.16.24.0, wildcard bits 0.0.0.255 (45 matches) r4#show ip int s1/2 Serial1/2 is up, line protocol is up Internet address is 172.16.1.2/24 Broadcast address is 255.255.255.255 Address determined by setup command MTU is 1500 bytes Helper address is not set Directed broadcast forwarding is disabled Multicast reserved groups joined: 224.0.0.5 Outgoing access list is not set Inbound access list is 10 Proxy ARP is enabled Local Proxy ARP is disabled Security level is default Split horizon is enabled ICMP redirects are always sent ICMP unreachables are always sent ICMP mask replies are never sent IP fast switching is enabled IP fast switching on the same interface is enabled IP Flow switching is disabled IP CEF switching is enabled IP CEF Feature Fast switching turbo vector IP multicast fast switching is enabled IP multicast distributed fast switching is disabled IP route-cache flags are Fast, CEF Router Discovery is disabled IP output packet accounting is disabled IP access violation accounting is disabled TCP/IP header compression is disabled RTP/IP header compression is disabled Policy routing is disabled Network address translation is disabled BGP Policy Mapping is disabled WCCP Redirect outbound is disabled WCCP Redirect inbound is disabled WCCP Redirect exclude is disabled 测试: r1#ping 172.16.1.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.16.1.2, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 120/140/164 ms r2#ping 172.16.1.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.16.1.2, timeout is 2 seconds: U.U.U. Success rate is 0 percent (0/5) r2#ping Protocol [ip]: Target IP address: 172.16.1.2 Repeat count [5]: Datagram size [100]: Timeout in seconds [2]: Extended commands [n]: y Source address or interface: 131.16.24.1 Type of service [0]: Set DF bit in IP header? [no]: Validate reply data? [no]: Data pattern [0xABCD]: Loose, Strict, Record, Timestamp, Verbose[none]: Sweep range of sizes [n]: Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.16.1.2, timeout is 2 seconds: Packet sent with a source address of 131.16.24.1 !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 100/124/140 ms r3#ping OK,实验完。Protocol [ip]: Target IP address: 172.16.1.2 Repeat count [5]: Datagram size [100]: Timeout in seconds [2]: Extended commands [n]: y Source address or interface: 192.168.1.3 Type of service [0]: Set DF bit in IP header? [no]: Validate reply data? [no]: Data pattern [0xABCD]: Loose, Strict, Record, Timestamp, Verbose[none]: Sweep range of sizes [n]: Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.16.1.2, timeout is 2 seconds: Packet sent with a source address of 192.168.1.3 !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 40/56/80 ms 本文出自 “★Beckham~23” 博客,请务必保留此出处http://loveme23.blog.51cto.com/7891/29181 本文出自 51CTO.COM技术博客 |




loveme23
博客统计信息
热门文章
最新评论
友情链接