ACL的扩展列表的配置及应用

ACL的扩展列表的配置及应用

首先，确定搭建及配置要求

 第一步：搭建拓扑建构，及其配置IP地址

 配IP地址

[PC1]interface GigabitEthernet 0/0/0
[PC1-GigabitEthernet0/0/0]ip add 192.168.2.2 24

[PC2]interface GigabitEthernet 0/0/0
[PC2-GigabitEthernet0/0/0]ip add 192.168.2.3 24

[AR1]interface GigabitEthernet 0/0/0
[AR1-GigabitEthernet0/0/0]ip add 192.168.2.1 24
[AR1-GigabitEthernet0/0/0]q
[AR1]interface GigabitEthernet 0/0/1
[AR1-GigabitEthernet0/0/1]ip add 192.168.1.1 24

[AR2]interface GigabitEthernet 0/0/0
[AR2-GigabitEthernet0/0/0]ip add 192.168.1.2 24

第二步：给PC1和PC2配置缺省路由

[PC1]ip route-static 0.0.0.0 0 192.168.2.1

[PC2]ip route-static 0.0.0.0 0 192.168.2.1

第三步：在给AR2添加路由表

[AR2]ip route-static 192.168.2.0 24 192.168.1.1

此时，PC1和PC2可以ping通AR1和AR2

第四步：创建ACL列表（扩展列表），并进行配置

[AR1]acl 3000	      创建acl列表，3000-3999为扩展列表；
[AR1-acl-adv-3000]rule deny icmp source 192.168.2.2 0 destination 192.168.2.1 0
[AR1-acl-adv-3000]rule deny icmp source 192.168.2.2 0 destination 192.168.1.1 0
[AR1-acl-adv-3000]rule deny icmp source 192.168.2.3 0 destination 192.168.1.2 0
[AR1-acl-adv-3000]rule deny tcp source 192.168.2.2 0 destination 192.168.1.2 0 d
estination-port eq 23	
[AR1-acl-adv-3000]rule deny tcp source 192.168.2.3 0 destination 192.168.1.1 0 d
estination-port eq 23
[AR1-acl-adv-3000]rule deny tcp source 192.168.2.3 0 destination 192.168.2.1 0 d
estination-port eq 23

第五步：在路由器上开启远程控制，并基于TCP目标端口号23工作

[AR1]aaa
[AR1-aaa]local-user shuaige privilege level 15 password cipher 666666
Info: Add a new user.
[AR1-aaa]local-user shuaige service-type telnet
[AR1-aaa]q
[AR1]user-interface vty 0 4
[AR1-ui-vty0-4]authentication-mode aaa

[AR2]aaa
[AR2-aaa]local-user shuaige privilege level 15 password cipher 666666
Info: Add a new user.
[AR2-aaa]local-user shuaige service-type telnet
[AR2-aaa]q
[AR2]user-interface vty 0 4
[AR2-ui-vty0-4]authentication-mode aaa

第五步：测试一下，是否符合要求
 

 

 此时，达到实验要求