扩展ACL.doc

扩展ACL(Extended ACL)步骤一：配置各路由器的IP地址，并使用ping命令确认直连接口相互可以ping通。步骤二：在各台路由器上启用OSPF协议。步骤三：网络配置要求：1 禁止R1 telnet r42 禁止R2 ping r43 其它访问均允许步骤四：配置ACL 注意：扩展的访问控制列表，应放置离源最近的接口access-list 100 deny tcp host 192.168.1.1 host 172.16.1.2 eq 23access-list 100 deny tcp host 192.168.1.1 10.0.0.0 0.255.255.255 eq telnetaccess-list 100 deny tcp host 12.1.1.1 host 172.16.1.2 eq telnetaccess-list 100 deny tcp host 12.1.1.1 10.0.0.0 0.255.255.255 eq telnetaccess-list 100 deny icmp host 192.168.1.2 host 172.16.1.2access-list 100 deny icmp host 192.168.1.2 10.0.0.0 0.255.255.255access-list 100 deny icmp host 131.16.24.1 host 172.16.1.2access-list 100 deny icmp host 131.16.24.1 10.0.0.0 0.255.255.255access-list 100 permit ip any any步骤五：将ACL应用到接口R3(config)#interface fastethernet 0/0R3(config-if)#ip access-group 100 inR3(config-if)#exit步骤六：测试R1ping 172.16.1.2Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 172.16.1.2, timeout is 2 seconds:!Success rate is 100 percent (5/5), round-trip min/avg/max = 120/163/204 msR1R1ping 10.1.1.1Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:!Success rate is 100 percent (5/5), round-trip min/avg/max = 172/188/220 msR1R1ping 10.2.2.1Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 10.2.2.1, timeout is 2 seconds:!Success rate is 100 percent (5/5), round-trip min/avg/max = 68/176/252 msR1R1telnet 172.16.1.2Trying 172.16.1.2 . % Destination unreachable; gateway or host downR1telnet 10.1.1.1Trying 10.1.1.1 . % Destination unreachable; gateway or host downR1telnet 10.2.2.1Trying 10.2.2.1 . % Destination unreachable; gateway or host downR2#ping 172.16.1.2Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 172.16.1.2, timeout is 2 seconds:U.U.USuccess rate is 0 percent (0/5)R2#ping 10.1.1.1Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:U.U.USuccess rate is 0 percent (0/5)R2#ping 10.2.2.1Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 10.2.2.1, timeout is 2 seconds:U.U.USuccess rate is 0 percent (0/5)R2#R2#telnet 172.16.1.2Trying 172.16.1.2 . OpenUser Access VerificationPassword: R4R2#telnet 10.1.1.1Trying 10.1.1.1 . O