实验三十七 扩展访问列表的配置

1、一、 实验目的1.2.二、 应用环境1.2.3. IPE 三、 实验设备.5. DCR-1751 PC CR-V35MT CR-V35FC 5 55四、 实验拓扑五、 实验要求ROUTER-A ROUTER-BS1/1 (DCE) /24 S1/0 (DTE) /24 F0/0 /24 F0/0 /24PC-A PC-BIP /24 /24 5% G rP,/U!6/24 Telne

2、tPC-B 6Ping六、 实验步骤Router-A#ping PING (): 56 data bytes!- ping statistics -5 packets transmitted, 5 packets received, 0% packet lossround-trip min/avg/max = 20/28/30 ms1 !9rPG!5BM- CRouter-A#sh ip routeCodes: C - connected, S - static, R - RIP, B - BGP, B

3、C - BGP connectedD - DEIGRP, DEX - external DEIGRP, O - OSPF, OIA - OSPF inter area ON1 - OSPF NSSA external type 1, ON2 - OSPF NSSA external type 2 OE1 - OSPF external type 1, OE2 - OSPF external type 2DHCP - DHCP typeVRF ID: 0C /24 is directly connected, FastEthernet0/0C /24

4、is directly connected, Serial1/1S /24 1,0 via Router-B#sh ip routeCodes: C - connected, S - static, R - RIP, B - BGP, BC - BGP connectedD - DEIGRP, DEX - external DEIGRP, O - OSPF, OIA - OSPF inter area ON1 - OSPF NSSA external type 1, ON2 - OSPF NSSA external type 2 OE1 - OSPF

5、 external type 1, OE2 - OSPF external type 2DHCP - DHCP typeVRF ID: 0S /24 1,0 via C /24 is directly connected, Serial1/0C /24 is directly connected, FastEthernet0/01 !9PC-A6PC-BEA1 !9 ROUTER-AA5BA“KRouter-A#confRouter-A_config#ip access-list extended 192

6、nARouter-A_config_ext_nacl#deny tcp 55 eq 23 A5B A4TelnetRouter-A_config_ext_nacl#permit icmp any any APingRouter-A_config_ext_nacl#exitRouter-A_config#int f0/0 E9/dEE,yRouter-A_config_f0/0#ip access-group 192 in 4nA“IN,X1 h9,ARouter-A#sh ip access-

7、listExtended IP access list 192deny tcp eq telnetpermit icmp any any1 A9PA七、 注意事项和排错1.2. IP #A015E3.4. DENY八、 配置序列Router-A#sh runBuilding configuration.Current configuration:!version 1.3.2Eservice timestamps log dateservice timestamps debug dateno

8、service password-encryption!hostname Router-A!interface FastEthernet0/0ip address no ip directed-broadcastip access-group 192 in!interface Serial1/0no ip addressno ip directed-broadcastphysical-layer speed 64000!interface Serial1/1ip address no ip

9、directed-broadcastphysical-layer speed 64000!interface Async0/0no ip addressno ip directed-broadcast!ip route !ip access-list extended 192deny tcp eq telnetpermit icmp any any!九、 共同思考1.2.3.十、 课后练习PC-A,XHTTPu十一、

10、 相关命令详解1. denydeny!tIPA“KG!5B S!8 G!5B/U!6?Uno!4deny source source-mask logno deny source source-mask logdeny protocol source source-mask destination destination-maskprecedence tos tos logno deny protocol source source-mask destination destination-maskprecedence tos tos logbf6(5% y#A(ICMP)precedence

11、 tos tos logbInternet 41u)#A(IGMP)S:deny igmp source source-mask destination destination-mask igmp-type precedence precedence tos tos logbTCP S:deny tcp source source-mask operator port destination destination-mask operator port established precedence precedence tos tos logbDBy#A(UDP)S:deny udp sour

12、ce source-mask operator port destination destination-mask operator 3S: deny icmp source source-mask destination destination-mask icmp-type precedence precedence precedence IPA“K8port precedence precedence tos tos logDprotocolsourcesource-maskdestinationdestination-maskprecedenceprecedencetos tosicmp

13、-typeigmp-typeoperatorport #AIP#AGK icmp igmp igrp ip ospftcpudp 3IP#A,X0255,X HDG! )Internet#A(ICMP TCPUDP) SGK ip o#AAE!9LnVE d5%4/nd32!EDh,X ED/SGK any0 ,X$dd-4m d5%4-SGK any0 ,Xdd-4m ,5%4/n Sh,X ED/,X32!ED SGK any0 ,X,-,X4m ,5%4-SGK any0 ,X

14、,-4m ( E)4E07,X Dn ( E) DBSuESD0 15n( E)ICMPICMPy2O _E2O _D0255 ( E)IGMPIGMPy2O _yE 2O _015,X D ( E)!Ed,00lt( b) gt(b)eq(1 b)neq(1 b)Vp00sourcesource-maskFw NO G!E-d0Vp00destinationdestination-maskFw NO G!,0 ( E)TCPUDP0,X ED/0065535,X DTCP0SFTCPS/3SAFESestablishedlog SA!0G)=),X04CCE,X YG!0AK)4,X#tY,

15、X F/b60,X,X G5Eo#A,h,X03EEK90,X 9Rbgp ftp ftp-data login pop2 pop3 smtp telnet www /b60,X,X G5Eo#A,h,X03EEK90,X 9Rdomain snmp syslog tftpUDP0,!,X G! TCP0,!,X G! ( E)IPA“KG!5BSAKy,X Eg .404CAK( E)DByTCP#A/0,XEyVpACKE A) TCP0EUDPTCP0/TCP SUDP0UDP0TCPRST!A5B )G! M2 G!,X TCPDBy6EyCE,X YG! 0!6 =),XA“K!IP

16、A“Ky=),XA“KbAK.4TCPd0u,X2O _,X ( 640K9IP5) 5B RFCREo#ARFCREo#A6/ /U!6E-5%!ip access-list standard filterdeny IP,GA“Kd,X deny43ip access-groupip access-listpermitshow ip access-list2. ip access-groupAy,SA“K4,Sno ip access-groupyG!5B 8E-n,Xip access-group access-lis

17、t-namein | out no ip access-group access-list-namein | out Daccess-list-nameinoutSAyG!5B A“Ky39yb,X 9AKA“KEKS EySAK ySAK 200,X 0yAK,X$db=),XA“KAC3,VpA“KAAFw EC 44)AVpA“KAAAEC Eb,X AK,yCEC yAK,X$db=),XA“KCEy0VpA“KAAEC EEVpA“KAAEC EEEyVpn,XA“K,X AEE/ _5yinterface ethernet 0ip access-group filter out,G

18、:ip access-list 0,X hfilter: ICMPICMPEyshow ip access-list3. ip access-listS8E9,XSexitEG!5B( no!48IPA“Kip access-list standard | extended nameno ip access-list standard | extended nameDstandardextendedname5 ,uSA/ _,5B Aip access-list standard filterdeny permit any,G:denyip a

19、ccess-grouppermitshow ip access-list4. permitIPA“KG!5B S!8 G!5B AUno!4permit source source-mask logno permit source source-mask logpermit protocol source source-mask destination destination-maskprecedence tos tos logno permit protocol source source-mask destination destination-maskprecedence tos tos

20、 log precedence precedence IPA“K8permit!tdenynAK n=)A“K A“KEKSIPA“Kn G!5B S!8 E9permit9G!5BA“K IPA“KG!5B IPA“KG!5B 20,X 0 IPA“KG!5B E(rt8A“K(ICMP)precedence tos tos logbInternet 41u)#A(IGMP)3S:permit icmp source source-mask destination destination-mask icmp-type precedenceS:permit igmp source source

21、-mask destination destination-mask igmp-type precedence precedence tos tos logbTCP S:permit tcp source source-mask operator port destination destination-mask operator port established precedence precedence tos tos logbDBy#A(UDP)S:permit udp source source-mask operator port port destination destinati

22、on-mask operator port precedence precedence tos tos logD protocol#Aip ospftcp,X HDG! )sourceUDP) SGK E d5%4/nd32h,X ED/SGK ,X$dd-4msource-mask destinationany0 ,Xd5%4-SGK dd-4m ,5%4/n Sh,X ED/,XSGK 4mdestination-mask ,5%4-SGK ,X,-4mprecedence precedencetos tos icmp-type(

23、E)DBSuESDICMPy2O _E2O _D0 15n0( E)ICMP255 ( E)4E07,X Dn any0 any032!ED ,X,-,X!EDany0IP#AGK udp 3ip o#AAE!9LnVicmp igmp igrp IP#A,XInternet#A(0255ICMP TCPigmp-typeoperator( E)IGMP0( E)!Ed,00IGMPy2O _yElt( bVp00destination-maskFw ) gt(2O _b)15,X Dneq(1 b)destinationsourceeq

24、(1 b)00NO G!,0portE/3SAFESestablishedlog SA!,X2O _,X0AK)4,X#tY,X F/b60,X,X G5Eo#A,h,X03EEK90,X 9Rbgp ftp ftp-data login pop2 pop3 smtp( E)IPA“KG!5B( E)DBy( E)TCP0source-maskFw NO G!E-d0VpUDP0,X ED/0TCP0SFTCP0/TCPUDP SUDP0TCPUDP0TCPS65535,X DTCP0ETCP#A/0,XEyVpACKE A)RST!A5B )G! M2 G!,X TCPDBy6EySAKy,X Eg .404CAKIP5!0G)=),XI