ACL扩展试验
ACL扩展试验：
考虑网络实际情况：
配置：
计算机IP如上，
路由1的配置如下：
Router>enable
Router#config t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#hostname R1
R1(config)#int fa0/0
R1(config-if)#ip add 192.168.1.1 255.255.255.0
R1(config-if)#no shut
%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up
R1(config-if)#int fa0/1
R1(config-if)#ip add 192.168.2.1 255.255.255.0
R1(config-if)#no shut
%LINK-5-CHANGED: Interface FastEthernet0/1, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up
R1(config-if)#int s0/1/1/0
^
% Invalid input detected at '^' marker.
R1(config-if)#int s0/1/0
R1(config-if)#ip add 192.168.3.1 255.255.255.0
R1(config-if)#clock rate 56000
R1(config-if)#no shut
%LINK-5-CHANGED: Interface Serial0/1/0, changed state to down
R1(config-if)#exit
R1(config)#router rip
R1(config-router)#network 192.168.1.0
R1(config-router)#network 192.168.2.0
R1(config-router)#network 192.168.3.0
R1(config-router)#end
%SYS-5-CONFIG_I: Configured from console by console
R1#
路由2的配置如下：
Router>enable
Router#config t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#hostname R2
R2(config)#int fa0/0
R2(config-if)#ip add 192.168.4.1 255.255.255.0
R2(config-if)#no shut
%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up
R2(config-if)#int s0/1/1
R2(config-if)#ip add 192.168.3.2 255.255.255.0
R2(config-if)#no shut
%LINK-5-CHANGED: Interface Serial0/1/1, changed state to up
R2(config-if)#int s0/1/
%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/1/1, changed state to up0
R2(config-if)#int s0/1/0
R2(config-if)#ip add 192.168.5.1 255.255.255.0
R2(config-if)#clock rate 56000
R2(config-if)#no shut
%LINK-5-CHANGED: Interface Serial0/1/0, changed state to down
R2(config-if)#exit
R2(config)#router rip
R2(config-router)#network 192.168.3.0
R2(config-router)#network 192.168.4.0
R2(config-router)#network 192.168.5.0
R2(config-router)#end
%SYS-5-CONFIG_I: Configured from console by console
R2#
在R3上：
Router>enable
Router#config t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#hostname R3
R3(config)#int s0/1/1
R3(config-if)#ip add 192.168.5.2 255.255.255.0
R3(config-if)#no shut
%LINK-5-CHANGED: Interface Serial0/1/1, changed state to up
R3(config-if)#int fa
%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/1/1, changed state to up0/
^
% Invalid input detected at '^' marker.
R3(config-if)#int fa0/0
R3(config-if)#ip add 192.168.6.1 255.255.255.0
R3(config-if)#no shut
%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up
R3(config-if)#int fa0/1
R3(config-if)#ip add 192.168.7.1 255.255.255.0
R3(config-if)#no shut
%LINK-5-CHANGED: Interface FastEthernet0/1, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up
R3(config-if)#
R3(config-if)#exit
R3(config)#router rip
R3(config-router)#network 192.168.5.0
R3(config-router)#network 192.168.6.0
R3(config-router)#network 192.168.7.0
R3(config-router)#end
%SYS-5-CONFIG_I: Configured from console by console
R3#
开始测试：
在黑客计算机上测试：
互联网络基本搭建完成.
504网络中心发现经常有来自192.168.1.2 网络攻击：攻击对象是504的服务器
在该504研究所的接入路由器配置ACL:
R3>enable
R3#config t
Enter configuration commands, one per line. End with CNTL/Z.
R3(config)#access-list 1 deny 192.168.1.2 0.0.0.0
R3(config)#access-list 1 permit any
R3(config)#
R3(config)#access-list 1 permit any
R3(config)#int s0/1/1
R3(config-if)#ip access-group 1 in
R3(config-if)#
作用是禁止黑客，允许其它用户访问504服务器
黑客发现自己无法联系到504服务器，
PC>ping 192.168.6.2
Pinging 192.168.6.2 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Ping statistics for 192.168.6.2:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
说明，网络有问题，经过测试发先自己的被屏蔽。
黑客修改IP 192.168.1.6 继续访问504服务器。（攻击）
504网络中心通过一段的监控，发现该网段经常攻击504的服务器，肯能是有目的的攻击行为。504网络中心决定屏蔽该网段。
1. 断网
2. 去原有的ACL
3. 重新加载ACL
如果网络实施性较高，不允许断网，编写代码，直接加载 ACL 。就是直接编写脚本的方式
R3(config-if)#exit
R3(config)#
R3(config)#access-list 68 deny 192.168.1.0 0.0.0.255
R3(config)#
R3(config)#access-list 68 permit any
R3(config)#
R3(config)#int s0/1/1
R3(config-if)#
R3(config-if)#ip access-group 68 in
R3(config-if)#
黑客突然发现该网段都无法访问504服务器。
504网络中心ACL基本防护完成。