用IP标准访问列表进行网络流量的控制

1、利用IP标准访问列表进行网络流量的控制【实验名称】编号的标准IP访问列表。【实验目的】掌握路由器上编号的标准IP 访问列表规则及配置。【背景描述】你是公司的一个网络管理员，公司的经理部，财务部门和销售部门分属不同的3个网段，三个部门之间用路由器进行信息传递，为了安全起见，公司领导要求销售部门不能对财务部门进行访问，但是经理部可以对财务部门进行访问。PC1代表经理部的主机，PC2代表销售部的主机，PC3代表财务部门的主机。【技术原理】IP ACL（IP访问控制列表或IP访问列表）是实现对流经路由器或交换机的数据包根据一定得规则进行过滤，从而提高网络可管理性和安全性。IP ACL分为两种：标准IP

2、 访问列表和扩展IP访问列表。标准IP访问控制列表可以根据数据包的源IP地址定义规则，进行数据包的过滤。扩展IP访问控制列表可以根据数据包的源IP，目的IP，源端口，目的端口，协议来定义规则，进行数据包的过滤。IP ACL基于接口进行规则的应用，分为：入栈应用和出栈应用。入栈应用是指由外部经该接口进行路由器的数据包进行过滤。出栈应用是指路由器从该接口向外转发数据时进行数据包的过率。IP ACL的配置有两种方式：按照编号的访问列表，按照命名的访问列表。标准IP访问列表编号的范围是1-99、1300-1999，扩展IP 访问列表编号范围是100-199、2000-2699。【实现功能】实现网段间互

3、相访问的安全控制。【实验设备】Cisco路由器（2条）、V3.5线缆（1条）、直连线或交叉线（3条）【实验拓扑】【实验步骤】步骤1.基本配置。路由器R1基本配置Router#configure terminalRouter(config)#hostname R1R1(config)#int se1/0R1(config-if)#ip addr 10.0.1.1 255.255.255.0R1(config-if)#clock rate 64000R1(config-if)#no shutR1(config-if)#exitR1(config)#int ethernet 0/1R1(config

4、-if)#ip addre 192.168.211.1 255.255.255.0R1(config-if)#no shutR1(config-if)#exitR1(config)#int e0/2R1(config-if)#ip address 192.168.212.1 255.255.255.0R1(config-if)#no shut测试命令：show ip interface briefR1# show ip interface brief ！查看接口状态Interface IP-Address OK? Method Status ProtocolEthernet0/0 unassi

5、gned YES NVRAM administratively down downEthernet0/1 192.168.211.1 YES NVRAM up upEthernet0/2 192.168.212.1 YES NVRAM up upEthernet0/3 unassigned YES NVRAM administratively down downSerial1/0 10.0.1.1 YES NVRAM up upSerial1/1 unassigned YES NVRAM administratively down down路由器R2基本配置RouterenableRouter

6、#config terminalRouter(config)#hostname R2R2(config)#int se1/0R2(config-if)#ip address 10.0.1.2 255.255.255.0R2(config-if)#no shutR2(config-if)#exitR2(config)#int f0/0R2(config-if)#ip addr 192.168.213.1 255.255.255.0R2(config-if)#no shut测试命令：show ip interface briefR1# show ip interface brief ！查看接口状态

7、Interface IP-Address OK? Method Status ProtocolEthernet0/0 unassigned YES NVRAM administratively down downEthernet0/1 192.168.211.1 YES NVRAM up upEthernet0/2 192.168.212.1 YES NVRAM up upEthernet0/3 unassigned YES NVRAM administratively down downSerial1/0 10.0.1.1 YES NVRAM up upSerial1/1 unassigne

8、d YES NVRAM administratively down down配置静态路由R1(config)#ip route 192.168.213.0 255.255.255.0 10.0.1.2R2(config)#ip route 192.168.211.0 255.255.255.0 10.0.1.1R2(config)#ip route 192.168.212.0 255.255.255.0 10.0.1.1测试命令：show ip routeR1#show ip routeCodes: C - connected, S - static, R - RIP, M - mobile,

9、 B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate defau

10、lt, U - per-user static route o - ODR, P - periodic downloaded static routeGateway of last resort is not setC 192.168.211.0/24 is directly connected, Ethernet0/1S 192.168.213.0/24 1/0 via 10.0.1.2C 192.168.212.0/24 is directly connected, Ethernet0/2 10.0.0.0/24 is subnetted, 1 subnetsC 10.0.1.0 is d

11、irectly connected, Serial1/0R2#show ip routeCodes: C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, su

12、- IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static routeGateway of last resort is not setS 192.168.211.0/24 1/0 via 10.0.1.1C 192.168.213.0/24 is directly connected, FastEthernet0/0S

13、192.168.212.0/24 1/0 via 10.0.1.1 10.0.0.0/24 is subnetted, 1 subnetsC 10.0.1.0 is directly connected, Serial1/0步骤2.配置标准IP访问控制列表R2(config)#access-list 1 deny 192.168.212.0 0.0.0.255!拒绝来自192.168.212.0网段的流量通过。R2(config)#access-list 1 permit 192.168.211.0 0.0.0.255!允许来自192.168.212.0网段的流量通过。验证测试：R2#show

14、 access-lists 1Standard IP access list 1 10 deny 192.168.212.0, wildcard bits 0.0.0.255 20 permit 192.168.211.0, wildcard bits 0.0.0.255步骤3.把访问控制列表在接口下应用。R2(config)#int se1/0R2(config-if)#ip access-group 1 in ！在接口下访问控制列表入栈流量调用验证测试：R2#show ip interface se1/0Serial1/0 is up, line protocol is up Intern

15、et address is 10.0.1.2/24 Broadcast address is 255.255.255.255 Address determined by non-volatile memory MTU is 1500 bytes Helper address is not set Directed broadcast forwarding is disabled Outgoing access list is not set Inbound access list is 1 Proxy ARP is enabled Local Proxy ARP is disabled Sec

16、urity level is default Split horizon is enabled ICMP redirects are always sent ICMP unreachables are always sent ICMP mask replies are never sent IP fast switching is enabled IP fast switching on the same interface is enabled IP Flow switching is disabled IP CEF switching is enabled IP CEF Feature F

17、ast switching turbo vector IP multicast fast switching is enabled IP multicast distributed fast switching is disabled IP route-cache flags are Fast, CEF Router Discovery is disabled IP output packet accounting is disabled IP access violation accounting is disabled TCP/IP header compression is disabled RTP/IP header compression is disabled Policy routing is disabled Network address translation is disabled BGP Policy Mappi