H3C设备之基本ACL应用
配置基本ACL过滤，使PCA无法访问PCB:
[RTA]int G0/0
[RTA-G0/0]ip add 192.168.0.1 255.255.255.0
[RTA-G0/0]undo shutdown
[RTA-G0/0]int S6/0
[RTA-S6/0]ip add 192.168.1.1 24
[RTA-S6/0]undo shutdown
[RTA]rip
[RTA-rip-1]ver 2
[RTA-rip-1]undo summary
[RTA-rip-1]network 192.168.0.0
[RTA-rip-1]network 192.168.1.0
[RTB]int G0/0
[RTB-G0/0]ip add 192.168.2.1 255.255.255.0
[RTB-G0/0]undo shutdown
[RTB-G0/0]int S6/0
[RTB-S6/0]ip add 192.168.1.2 24
[RTB-S6/0]undo shutdown
[RTB]rip
[RTB-rip-1]ver 2
[RTB-rip-1]undo summary
[RTB-rip-1]network 192.168.1.0
[RTB-rip-1]network 192.168.2.0
PCA:192.168.0.2 255.255.255.0 GT:192.168.0.1
PCB:192.168.2.2 255.255.255.0 GT:192.168.2.1
此时网络已经互通：
C:\Documents and Settings\xiaofei>ping 192.168.2.2
Pinging 192.168.2.2 with 32 bytes of data:
Reply from 192.168.2.2: bytes=32 time=16ms TTL=254
Reply from 192.168.2.2: bytes=32 time=1ms TTL=254
Reply from 192.168.2.2: bytes=32 time=2ms TTL=254
Reply from 192.168.2.2: bytes=32 time=1ms TTL=254
Ping statistics for 192.168.2.2:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 1ms, Maximum = 16ms, Average = 5ms
在RTA上配置基本ACL包过滤实现PCA无法访问PCB:
[RTA]firewall enabl 开启防火墙功能
[RTA]firewall default permit 设置防火墙的默认规则
[RTA]acl number 2000 创建基本ACL 2000
[RTA-acl-basic-2000]rule 0 deny source 192.168.0.2 0.0.0.0 设置不不允许的主机，0.0.0.0匹配的是主机，不是网段
[RTA-acl-basic-2000]quit
[RTA]int e0/1/0
[RTA-G0/0]firewall packet-filter 2000 inbound 进入接口绑定规则
此时PCA已经无法访问PCB以及外部网络：
C:\Documents and Settings\xiaofei>ping 192.168.2.2
Pinging 192.168.2.2 with 32 bytes of data:
Request timed out.
Request timed out.
Ping statistics for 192.168.2.2:
Packets: Sent = 2, Received = 0, Lost = 2 (100% loss),
C:\Documents and Settings\xiaofei>ping 192.168.1.1
Pinging 192.168.1.1 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Ping statistics for 192.168.1.1:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),