4第四课 配置访问控制列表ppt课件

.,2005CiscoSystems,Inc.Allrightsreserved.,SNPAv4.05-1,第四课配置访问控制列表,.,学习目标,在前面所掌握的ACL原理和配置基础上，这节课我们来拓展一下知识点，来学习关于时间的访问列表，扩展学生知识。,.,课程内容,1、通过所掌握的协议和端口号来实施流量控制2、理解接口优先级别与访问列表配置规则3、配置基于时间的访问列表4、ActiveX过滤5、URL过滤,.,基于时间的访问列表,Defineatimewhencertainresourcescanbeaccessed.ApplydefinedtimerangetotheACL.,,,WebServer,Internet,DMZ,Inside,.2,.1,.9,EnableAccess8a.mto5p.m.1Augto30Aug,TempWorker,,fw1(config)#time-rangetemp-workerfw1(config-time-range)#,firewall(config)#,time-rangename,.,Time-Range子命令,定义一个认证时间当资源可以访问时:定义一个绝对开始时间和日期定义一个周期时间,fw1(config)#time-rangetemp-workerfw1(config-time-range)#absolutestart00:001August2004end00:0030August2004fw1(config-time-range)#periodicweekdays8:00to17:00,firewall(config)#,,,WebServer,Internet,DMZ,Inside,.2,.1,.9,TempWorker,,EnableAccess8a.mto5p.m.1Augto30Aug,.,Time-basedACL,应用时间范围到一个列表上,fw1(config)#static(dmz,outside)fw1(config)#access-listaclinpermittcphosthosteqwwwtime-rangetemp-worker,,,WebServer,Internet,DMZ,Inside,.2,.1,.9,TempWorker,,firewall(config)#,EnableAccess8a.mto5p.m.1Augto30Aug,.,Time-basedACL例子,fw1(config)#static(dmz,outside)fw1(config)#access-listaclinpermittcphosthosteqwwwtime-rangetemp-workerfw1#showruntime-rangetime-rangetemp-workerabsolutestart00:001August2004end00:0030August2004periodicweekdays8:00to17:00fw1(config)#showclock13:48:33.226UTCFriJul302004fw1(config)#showaccess-listaccess-listcachedACLlogflows:total0,denied0(deny-flow-max4096)alert-interval300access-listaclin;1elementsaccess-listaclinline1extendedpermittcpanyanyeqwwwtime-rangetemp-worker(hitcnt=0)(inactive),,,WebServer,Internet,DMZ,Inside,.2,.1,.9,TempWorker,,EnableAccess8a.mto5p.m.1Augto30Aug,.,ActiveX过滤,fw1(config)#filteractivex80,SpecifiesthattheActiveXblockingappliestowebtrafficonport80fromanylocalhostandtoanyforeignhost,Engineering,,,,Executive,Marketing,DMZ,BlockActiveX,.,HTTPURLFiltering,URL-filteringServer,RequestAccessto,DenyAccess,WebServer,X,.,firewall(config)#,定义一个URL服务器,fw1(config)#url-server(dmz)vendorn2h2hostprotocolTCP,firewall(config)#,url-server(if_name)vendorn2h2hostlocal_ipportnumbertimeoutsecondsprotocolTCP|UDPconnectionsnum_conns,DesignatesaserverthatrunsanN2H2URL-filteringapplication,URL-filteringServer,,TCP,X,.,X,开启HTTPURL过滤,firewall(config)#,fw1(config)#filterurlhttp0000allow,filterurlport-port|exceptlocal_iplocal_maskforeign_ipforeign_maskallowcgi-truncatelongurl-truncate|longurl-denyproxy-block,URL-filteringServer,FilterHTTP:AllHosts,.,URL-filtering配置举例,DesignateURLserverEnablefiltering,fw1(config)#url-server(dmz)vendorwebsens