CCNA课程实验-11-ACL
目录
- 实验条件
-
- 网络拓朴
- 需求
- 配置实现
-
- 基础配置 `R1 & R2 & R3 & PC1 & PC2`
- 配置`ACL_A`
- 配置`ACL_B`
- 配置`ACL_C`
实验条件
网络拓朴
需求
- 使用名字为ACL_A的标准ACL配置及应用：在R1上配置ACL实现仅192.168.20.0/24网段能访问到PC1；
- 使用名字为ACL_B的标准ACL实现Telnet登陆控制：在R3上配置只允许PC1远程管理R3；
- 使用名字为ACL_C的扩展ACL配置及应用：在R3配置ACL实现PC2只允许被ping通,其他访问都不能进行；
配置实现
基础配置 R1 & R2 & R3 & PC1 & PC2
PC1
PC1(config)#no ip routing
PC1(config)#ip default-gateway 192.168.10.254
PC1(config)#int e0/0
PC1(config-if)#ip address 192.168.10.1 255.255.255.0
PC1(config-if)#no shutdown
PC2
PC2(config)#no ip routing
PC2(config)#ip default-gateway 192.168.20.254
PC2(config)#int e0/1
PC2(config-if)#ip address 192.168.20.1 255.255.255.0
PC2(config-if)#no shutdown
R1
R1(config)#int e0/0
R1(config-if)#ip address 192.168.10.254 255.255.255.0
R1(config-if)#no shutdown
R1(config-if)#int e0/1
R1(config-if)#ip address 12.1.1.1 255.255.255.0
R1(config-if)#no shutdown
R1(config-if)#router ospf 90
R1(config-router)#router-id 1.1.1.1
R1(config-router)#network 192.168.10.254 0.0.0.0 area 0
R1(config-router)#network 12.1.1.1 0.0.0.0 area 0
R1(config-router)#
R2
R2(config)#int e0/1
R2(config-if)#ip address 12.1.1.2 255.255.255.0
R2(config-if)#no shutdown
R2(config-if)#int e0/0
R2(config-if)#ip address 23.1.1.2 255.255.255.0
R2(config-if)#no shutdown
R2(config-if)#router ospf 90
R2(config-router)#router-id 2.2.2.2
R2(config-router)#network 12.1.1.2 0.0.0.0 area 0
R2(config-router)#network 23.1.1.2 0.0.0.0 area 0
R2(config-router)#
R3
R3(config)#int e0/0
R3(config-if)#ip address 23.1.1.3 255.255.255.0
R3(config-if)#no shutdown
R3(config-if)#int e0/1
R3(config-if)#ip address 192.168.20.254 255.255.255.0
R3(config-if)#no shutdown
R3(config-if)#router ospf 90
R3(config-router)#router-id 3.3.3.3
R3(config-router)#network 23.1.1.3 0.0.0.0 area 0
R3(config-router)#network 192.168.20.254 0.0.0.0 area 0
配置ACL_A
使用名字为ACL_A的标准ACL配置及应用：在R1上配置ACL实现仅192.168.20.0/24网段能访问到PC1
R1(config)#ip access-list standard ACL_A
R1(config-std-nacl)#permit 192.168.20.0 0.0.0.255
R1(config-std-nacl)#exit
R1(config)#int e0/0 //去到PC1的端口
R1(config-if)#ip access-group ACL_A out //从这个接口出去的包,都要用ACL_A来控制
测试结果
R3#ping 192.168.10.1 // 默认以23.1.1.3接口去ping
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.10.1, timeout is 2 seconds:
U.U.U
Success rate is 0 percent (0/5)
R3#ping 192.168.10.1 source 192.168.20.254 // 以192.168.20.0/24的网段去ping
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.10.1, timeout is 2 seconds:
Packet sent with a source address of 192.168.20.254
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/2 ms
R3#
Ping PC1到中间各个节点
除了R1节点和192.168.20.0/24网段的设备可以ping通, 其它几个ip都ping不同,是因为其它几个IP的回包被 ACL_A的策略给阻止了.
PC1#ping 23.1.1.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 23.1.1.3, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
PC1#ping 192.168.10.254
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.10.254, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
PC1#ping 12.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 12.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
PC1#ping 12.1.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 12.1.1.2, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
PC1#ping 23.1.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 23.1.1.2, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
PC1#ping 192.168.20.254
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.20.254, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/2 ms
PC1#ping 192.168.20.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.20.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 2/2/2 ms
PC1#
配置ACL_B
使用名字为ACL_B的标准ACL实现Telnet登陆控制：在R3上配置只允许PC1远程管理R3
R3(config)#ip access-list standard ACL_B
R3(config-std-nacl)#permit host 192.168.10.1
R3(config-std-nacl)#line vty 0 4
R3(config-line)#password passwd
R3(config-line)#login
R3(config-line)#transport input telnet
R3(config-line)#access-class ACL_B in
R3(config-line)#exit
R3(config)#enable password passwd
测试结果
PC1#telnet 192.168.20.254
Trying 192.168.20.254 ... Open
User Access Verification
Password:
R3>enable
Password:
R3#
配置ACL_C
使用名字为ACL_C的扩展ACL配置及应用：在R3配置ACL实现PC2只允许被ping通,其他访问都不能进行
配置PC2的telnet服务
PC2(config)#enable secret passwd
PC2(config)#line vty 0 4
PC2(config-line)#password passwd
PC2(config-line)#transport input telnet
PC2(config-line)#login
PC2(config-line)#exit
测试PC1访问PC2
PC1#ping 192.168.20.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.20.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/2 ms
PC1#telnet 192.168.20.1
Trying 192.168.20.1 ... Open
User Access Verification
Password:
PC2>
现在配置R3
R3(config)#ip access-list extended ACL_C
R3(config-ext-nacl)#permit icmp any host 192.168.20.1
R3(config-ext-nacl)#int e0/1
R3(config-if)#ip access-group ACL_B out
再次测试PC1访问PC2
PC1#ping 192.168.20.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.20.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/2 ms
PC1#telnet 192.168.20.1
Trying 192.168.20.1 ...
% Connection timed out; remote host not responding
PC1#
达到实验目标