ACL访问策略

 

 

R01是inside，lo0 为PC Client：11.11.11.1/24

R03是outside，lo0为internet server：22.22.22.1/24

R07是DMZ，lo0为DMZ区的server：33.33.33.1/24

R02模拟防火墙：

e0/0口为inside：1.1.1.1/30

e0/1为outside：2.2.2.1/30

s2/0为DMZ：3.3.3.1/30

实验目的：

1、R01可以telnet 访问DMZ区域的22.22.22.1；
2、R03不能telnet访问R07；
3、R07不能主动访问R01、R03；
4、R07开启ICMP。

R2-FW#    show run
Building configuration...

Current configuration : 2012 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R2-FW
!
boot-start-marker
boot-end-marker
!
security passwords min-length 1
!
no aaa new-model
clock timezone CST 8
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
ip source-route
!
!        
!
!
ip cef
no ip domain lookup
no ipv6 traffic interface-statistics
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
redundancy
!
!
!
!
!        
!
!
!
!
interface Ethernet0/0
 ip address 1.1.1.1 255.255.255.0
!
interface Ethernet0/1
 ip address 3.3.3.1 255.255.255.248
!
interface Ethernet0/2
 no ip address
 shutdown
!
interface Ethernet0/3
 no ip address
 shutdown
!
interface Ethernet1/0
 no ip address
 shutdown
!
interface Ethernet1/1
 no ip address
 shutdown
!
interface Ethernet1/2
 no ip address
 shutdown
!
interface Ethernet1/3
 no ip address
 shutdown
!
interface Serial2/0
 ip address 2.2.2.1 255.255.255.0
 ip access-group test out
 serial restart-delay 0
!
interface Serial2/1
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial2/2
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial2/3
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial3/0
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial3/1
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial3/2
 no ip address
 shutdown
 serial restart-delay 0
!        
interface Serial3/3
 no ip address
 shutdown
 serial restart-delay 0
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
ip route 11.11.11.0 255.255.255.0 1.1.1.2
ip route 22.22.22.0 255.255.255.0 2.2.2.2
ip route 33.33.33.0 255.255.255.0 3.3.3.2
!

**************************************************************************
ip access-list extended test
 permit tcp host 1.1.1.2 host 22.22.22.1 eq telnet 

permit icmp any host 22.22.22.1

//这里的1.1.1.2为R01的接口地址，实际操作中，可以更换为Client的IP地址，或者为对端提供的转换的公网地址。

**************************************************************************
!
!
!
!
!
!
!        
control-plane
!
!
line con 0
 exec-timeout 0 0
 password 222
 logging synchronous
 login
line aux 0
line vty 0
 password 111
 login
line vty 1 4
 login
!
exception data-corruption buffer truncate
end

R2-FW#