扩展ACL


扩展ACL_第1张图片
要求:
1.禁止r1 telnet r4
2.禁止r2 ping r4
3.其它访问均允许
1.按照拓扑配置好各个路由器的接口IP地址;
2.在每台路由器上配置OSPF路由协议(有不会的清看上一次的标准ACL的有关OSPF的基本配置)
3.3.设置ACL(注:标准ACL应该在距离目标近的地方设置,扩展ACL应该在距离源较近的地方设置)
r3(config)#access-list 100 deny tcp host 192.168.1.1 any eq telnet
r3(config)#access-list 100 deny icmp host 192.168.1.2 any
r3(config)#access-list 100 deny icmp host 131.16.24.1 any
r3(config)#access-list 100 permit ip any any
r3(config)#int s1/2
r3(config-if)#ip access-group 100 out
OK,设置完了扩展ACL。
验证:
r1#ping 172.16.1.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 120/132/160 ms
r1#telnet 172.16.1.2
Trying 172.16.1.2 ...
% Destination unreachable; gateway or host down
r1可以ping通,但是无法telnet
r2#ping 172.16.1.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.2, timeout is 2 seconds:
U.U.U
Success rate is 0 percent (0/5)
r2#ping
Protocol [ip]:
Target IP address: 172.16.1.2
Repeat count [5]:
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface: 131.16.24.1
Type of service [0]:
Set DF bit in IP header? [no]:
Validate reply data? [no]:
Data pattern [0xABCD]:
Loose, Strict, Record, Timestamp, Verbose[none]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.2, timeout is 2 seconds:
Packet sent with a source address of 131.16.24.1
U.U.U
Success rate is 0 percent (0/5)
r2#telnet 172.16.1.2
Trying 172.16.1.2 ... Open


User Access Verification

Password:
% Password:  timeout expired!
Password:
r2无法ping通,但是可以telnet上。
r3#ping 172.16.1.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 40/63/80 ms
OK,实验完。
出自 [url]http://loveme23.51cto.com/blog/7891/29239[/url]

你可能感兴趣的:(职场,休闲,路由器 扩展ACL)