《计算机网络》实验指导书：扩展访问控制列表.doc

海量资料 超值下载扩展访问控制列表一、实验目的1.掌握扩展访问列表的配置2.理解扩展访问列表的过滤条件二、实验描述1.可以针对目标IP地址进行控制2.针对某些服务进行控制3.可以针对某些协议进行控制本实验中禁PC1 telnet 到PC2,但能PING.三、实验拓扑四、所需设备1.R2801 2台2.PC 2台3.网线 2根4.串口线 1根五、实验步骤第1步：对路器进行基本配置，并加路由保证网络是连通的，此配置请参照标准访问控制列表。验证连通：R1(config)#line vty 0 4R1(config-line)#password 1234配telnet密码R1(config-line)#loginR1(config-line)#exitR2(config)#line vty 0 4R2(config-line)#password 1234配telnet密码5R2(config-line)#loginR2(config-line)#exit验证：R1#telnet 192.168.3.1R2#telnet 192.168.1.1第2步：在R2上设置扩展访问控制列表R2(config)#access-list 100 deny tcp 192.168.1.0 0.0.0.255 192.168.3.1 0.0.0.0 eq 23定义扩展访问控制列表100，拒绝telnetR2(config)#access-list 100 permit ip any any允许pingR2(config)#int s1/0R2(config-if)#ip access-group 100 in绑定访问控制列表在IN的方向R2(config-if)#exit第3步：查看访问列表R2#sh access-lists Extended IP access list 100 deny tcp 192.168.1.0 0.0.0.255 host 192.168.3.2 eq telnetpermit ip any any 第4步：验证R1#telnet 192.168.3.1R1#ping 192.168.3.1R2#telnet 192.168.1.1R2#ping 192.168.1.1六、注意事项1. 扩展访问控制列表通常放在离源比较近的地方2. 扩展访问控制列表可以基于源、目标IP、协议、端口等条件过滤七、参考配置R1#sh runBuilding configuration.Current configuration : 633 bytes!version 12.4no service password-encryption!hostname R1!ip ssh version 1!interface FastEthernet0/0 ip address 192.168.1.1 255.255.255.0 duplex auto speed auto!interface FastEthernet0/1 no ip address duplex auto speed auto shutdown!interface Serial1/0 ip address 192.168.2.1 255.255.255.0 clock rate 64000!interface Serial1/1 no ip address shutdown!interface Serial1/2 no ip address shutdown!interface Serial1/3 no ip address shutdown!interface Vlan1 no ip address shutdown!ip classlessip route 192.168.3.0 255.255.255.0 192.168.2.2 !line con 0line vty 0 4 login!EndR2#sh runBuilding configuration.Current configuration : 747 bytes!version 12.4no service password-encryption!hostname R2!ip ssh version 1!interface FastEthernet0/0 ip address 192.168.3.1 255.255.255.0 duplex auto speed auto!interface FastEthernet0/1 no ip address duplex auto speed auto shutdown!interface Serial1/0 ip address 192.168.2.2 255.255.255.0 ip access-group 100 in!interface Serial1/1 no ip address shutdown!interface Serial1/2 no ip address shutdown!interface Serial1/3 no ip address shutdown!interface Vlan1 no ip address shutdown!ip classlessip route 192.168.1.0 255.255.255.0 192.168.2.1 !access-list 100 deny