Packet Tracer 5.3建构CCNA实验攻略ACL简单的配置.doc

Packet Tracer 5.3建构CCNA实验攻略ACl的配置三、配置简单的ACL、配置ACL限制远程登录到路由器的主机HuangChuang#conf tEnter configuration commands, one per line. End with CNTL/Z.HuangChuang(config)#access-list 1 permit host 路由器HuangChuang只允许远程登录(telnet)HuangChuang(config)#line vty 0 4HuangChuang(config-line)#access-class 1 in其它两个路由器配置相似。、配置ACL禁止/24网段的icmp协议数据包通向与/24网段xixian(config)#access-list 101 deny icmp 55 55xixian(config)#access-list 101 permit ip any anyxixian(config)#int fa0/1xixian(config-if)#ip access-group 101 out、配置ACL禁止特点的协议端口通讯HuangChuang#conf tHuangChuang(config)#ip access-list extended ACL1创建基于名称的扩展ACLHuangChuang(config-ext-nacl)#deny tcp host 55 eq 80HuangChuang(config-ext-nacl)#deny udp host 55 eq 53HuangChuang(config-ext-nacl)#permit ip any anyHuangChuang(config-ext-nacl)#exitHuangChuang(config)#int fa0/1HuangChuang(config-if)#ip access-group ACL1 inPacket Tracer 5.0建构CCNA实验攻略(17)终结篇一、端口映射由于IP地址紧缺，或者小企业（单位）由于资金投入的原因，只能有一个公网的IP地址，使用NAT(网络地址转换）上网。如果此时还想对外提供服务，那就得进行端口映射。、配置NAT（Router Company）Router(config)#access-list 1 permit 55Router(config)#ip nat inside source list 1 interface serial0/3/0 overloadRouter(config)#int serial0/3/0Router(config-if)#ip nat outsideRouter(config-if)#int fa0/1Router(config-if)#ip nat insideRouter(config-if)#exitRouter(config)#ip route Router(config)#router eigrp 100Router(config-router)#network Router(config-router)#exit、配置端口映像Router(config)#ip nat inside source static tcp 80 80上面的命令意思是：把内网ip为的80端口与的80端口映射，当从互联网上访问时，其实就是访问，假设的域为，从pc2访问：图二路由器Company的配置：Company#sh running-configBuilding configuration.Current configuration : 734 bytes!version 12.4no service password-encryption!hostname Company!ip ssh version 1!interface FastEthernet0/0no ip addressduplex autospeed autoshutdown!interface FastEthernet0/1ip address ip nat insideduplex autospeed auto!interface Serial0/3/0ip address ip nat outside!interface Vlan1no ip addressshutdown!router eigrp 100network auto-summary!ip nat inside source list 1 interface Serial0/3/0 overloadip nat inside source static tcp 80 80 ip classlessip route !access-list 1 permit 55!no cdp run!line con 0line vty 0 4login!end三、捕获PDU