ACL访问控制列表案例（7.15）

 1、首先配置r1/r2/pc1/pc2各个接口的ip

r1：

[r1]interface GigabitEthernet 0/0/0
[r1-GigabitEthernet0/0/0]ip address 192.168.1.1 24
[r1-GigabitEthernet0/0/0]q
[r1]interface GigabitEthernet 0/0/1
[r1-GigabitEthernet0/0/1]ip address 192.168.2.1 24

r2：

[r2]interface GigabitEthernet 0/0/0
[r2-GigabitEthernet0/0/0]ip address 192.168.2.2 24

pc1：

[pc1]interface GigabitEthernet 0/0/0
[pc1-GigabitEthernet0/0/0]ip address 192.168.1.2 24
【pc1】ip route-static 0.0.0.0 0 192.168.1.1

pc2：

[pc2]interface GigabitEthernet 0/0/0
[pc2-GigabitEthernet0/0/0]ip address 192.168.1.3 24
【pc2】ip route-static 0.0.0.0 0 192.168.1.1

2、 现在到r1、r2上分别创建一个Telnet

r1：

[r1]aaa  	
[r1-aaa]local-user yps privilege level 15 password cipher 123456
[r1-aaa]local-user yps service-type telnet
[r1-aaa]q
[r1]user-interface vty 0 4
[r1-ui-vty0-4]authentication-mode aaa 

r2：

[r2]aaa// 
[r2-aaa]local-user yps privilege level 15 password cipher 123456// 用户名 访问等级 密码
Info: Add a new user.
[r2-aaa]Q
[r2]user-interface vty 0 4 
[r2-ui-vty0-4]authentication-mode aaa//在vty线上开启认证

3、实现要求（这里可以不用写可以的，因为华为模拟器默认就是可以的，只需要写禁止即可）

r1：pc1可以Telnet不能ping

        pc2可以ping不能Telnet

[r1-acl-adv-3333]rule deny icmp source 192.168.1.2 0 destination 192.168.1.1 0
[r1-acl-adv-3333]rule deny icmp source 192.168.1.2 0 destination 192.168.2.1 0
[r1-acl-adv-3333]rule deny icmp source 192.168.1.3 0 destination 192.168.2.2 0
[r1-acl-adv-3333]rule deny tcp source 192.168.1.3 0 destination 192.168.1.1 0 de
stination-port eq 23
[r1-acl-adv-3333]rule deny tcp source 192.168.1.3 0 destination 192.168.2.1 0 de
stination-port eq 23
[r1-acl-adv-3333]rule deny tcp source 192.168.1.2 0destination 192.168.2.2 0 des
tination-port eq 23

r2：pc2可以Telnet不能ping

        pc1可以ping不能Telnet

4、调用

[r1-GigabitEthernet0/0/0]traffic-filter outbound acl 3333

5、测试

pc1ping r1、r2、登录r1、r2

ping 192.168.1.1
  PING 192.168.1.1: 56  data bytes, press CTRL_C to break
    Request time out
    Request time out
    Request time out
    Request time out
    Request time out

  --- 192.168.1.1 ping statistics ---
    5 packet(s) transmitted
    0 packet(s) received
    100.00% packet loss




ping 192.168.1.1
  PING 192.168.1.1: 56  data bytes, press CTRL_C to break
    Request time out
    Request time out
    Request time out
    Request time out
    Request time out

  --- 192.168.1.1 ping statistics ---
    5 packet(s) transmitted
    0 packet(s) received
    100.00% packet loss

ping 192.168.2.2
  PING 192.168.2.2: 56  data bytes, press CTRL_C to break
    Reply from 192.168.2.2: bytes=56 Sequence=1 ttl=254 time=40 ms
    Reply from 192.168.2.2: bytes=56 Sequence=2 ttl=254 time=40 ms
    Reply from 192.168.2.2: bytes=56 Sequence=3 ttl=254 time=50 ms
    Reply from 192.168.2.2: bytes=56 Sequence=4 ttl=254 time=50 ms
    Reply from 192.168.2.2: bytes=56 Sequence=5 ttl=254 time=50 ms

  --- 192.168.2.2 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 40/46/50 ms

te	
telnet 192.168.1.1
  Press CTRL_] to quit telnet mode
  Trying 192.168.1.1 ...
  Connected to 192.168.1.1 ...

Login authentication


Username:yps
Password:
  ----------------------------------------------------------------------------- 
    
  User last login information:     
  -----------------------------------------------------------------------------
  Access Type: Telnet      
  IP-Address : 192.168.1.3     
  Time       : 2022-07-15 17:24:02-08:00     
  -----------------------------------------------------------------------------
te	
telnet 192.168.2.2
  Press CTRL_] to quit telnet mode
  Trying 192.168.2.2 ...
  Connected to 192.168.2.2 ...

Login authentication

pc2ping r1、r2、登录r1、r2

ping 192.168.1.1
  PING 192.168.1.1: 56  data bytes, press CTRL_C to break
    Reply from 192.168.1.1: bytes=56 Sequence=1 ttl=255 time=40 ms
    Reply from 192.168.1.1: bytes=56 Sequence=2 ttl=255 time=40 ms
    Reply from 192.168.1.1: bytes=56 Sequence=3 ttl=255 time=50 ms
    Reply from 192.168.1.1: bytes=56 Sequence=4 ttl=255 time=40 ms
    Reply from 192.168.1.1: bytes=56 Sequence=5 ttl=255 time=40 ms

  --- 192.168.1.1 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 40/42/50 ms



  Please check whether system data has been changed, and save data in time

  Configuration console time out, please press any key to log on

ping 192.168.1.1
  PING 192.168.1.1: 56  data bytes, press CTRL_C to break
    Reply from 192.168.1.1: bytes=56 Sequence=1 ttl=255 time=50 ms
    Reply from 192.168.1.1: bytes=56 Sequence=2 ttl=255 time=40 ms
    Reply from 192.168.1.1: bytes=56 Sequence=3 ttl=255 time=40 ms
    Reply from 192.168.1.1: bytes=56 Sequence=4 ttl=255 time=40 ms
    Reply from 192.168.1.1: bytes=56 Sequence=5 ttl=255 time=40 ms

  --- 192.168.1.1 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 40/42/50 ms

ping 192.168.2.2
  PING 192.168.2.2: 56  data bytes, press CTRL_C to break
    Request time out
    Request time out
    Request time out
    Request time out
    Request time out

  --- 192.168.2.2 ping statistics ---
    5 packet(s) transmitted
    0 packet(s) received
    100.00% packet loss
telnet 192.168.1.1
  Press CTRL_] to quit telnet mode
  Trying 192.168.1.1 ...
  Error: Can't connect to the remote host
telnet 192.168.2.2
  Press CTRL_] to quit telnet mode
  Trying 192.168.2.2 ...
  Connected to 192.168.2.2 ...

Login authentication


Username:yps
Password:
  ----------------------------------------------------------------------------- 
    
  User last login information:     
  -----------------------------------------------------------------------------
  Access Type: Telnet      
  IP-Address : 192.168.2.1     
  Time       : 2022-07-15 18:09:30-08:00     
  -----------------------------------------------------------------------------