基于ACL的访问控制及安全策略的设计实验报告

1、.：.；实 验 报 告课程称号思科路由器开放实验实验称号基于ACL的访问控制及平安战略的设计实验实验时间2021年6月2-3日 PAGE 28实 验 报 告实验称号基于ACL的访问控制及平安战略的设计实验实验类型开放实验实验学时16实验时间2021.6.1-2021.6.2实验目的和要求访问控制列表Access Control List，ACL 是HYPERLINK baike.baidu/view/0.htm路由器和HYPERLINK baike.baidu/view/1077.htm交换机接口的指令列表，用来HYPERLINK baike.baidu/view/798022.htm控制端口

2、进出的数据包。验要求学生掌握访问控制列表的配置，了解ACL的执行过程；可以根据ACL设计平安的网络。实验要求完成以下任务：规范ACL。实验目的：本实验回绝student所在网段访问路由器R2，同时只允许主机teacher访问路由器R2的telnet效力。扩展ACL实验：实验目的：学生不能访问ftp,但能访问www，教师不受限制。防止地址欺骗。外部网络的用户能够会伪装本人的ip地址，比如运用内部网的合法IP地址或者回环地址作为源地址，从而实现非法访问。处理方法：将能够伪装到的ip地址回绝掉。二、实验环境(实验设备)PC机，并安装Cisco Packet Tracer软件或者是真实的思科网络设备路

3、由器交换机。三、实验原理及内容一 根本ACL实验：1.规范ACL。实验目的：本实验回绝student所在网段访问路由器R2，同时只允许主机teacher访问路由器R2的telnet效力。实验拓补图如下：实验配置如下：RouterenRouter#conf tEnter configuration commands, one per line. End with CNTL/Z.Router(config)#host R1R1(config)#int f0/0R1(config-if)#ip add R1(config-if)#no shut%LINK-5-CHANGED: Interface F

4、astEthernet0/0, changed state to up%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to upR1(config-if)#exitR1(config)#int s0/0/0R1(config-if)#ip add R1(config-if)#clock rate 64000R1(config-if)#no shut%LINK-5-CHANGED: Interface Serial0/0/0, changed state to downR1(config

5、-if)#exitR1(config)#router eigrp 100R1(config-router)#network 55R1(config-router)#network R1(config-router)#no autoR1(config-router)#endR1#%SYS-5-CONFIG_I: Configured from console by consoleR1#copy run startDestination filename startup-config? Building configuration.OKRouterenRouter#conf tEnter conf

6、iguration commands, one per line. End with CNTL/Z.Router(config)#host R2R2(config)#int s0/0/1R2(config-if)#ip add R2(config-if)#no shut%LINK-5-CHANGED: Interface Serial0/0/1, changed state to upR2(config-if)#%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0/1, changed state to upR2(config-if

7、)#exitR2(config)#int s0/0/0R2(config-if)#ip add R2(config-if)#clock rate 64000R2(config-if)#no shut%LINK-5-CHANGED: Interface Serial0/0/0, changed state to downR2(config-if)#exitR2(config)#int f0/0R2(config-if)#ip add R2(config-if)#no shutR2(config-if)#%LINK-5-CHANGED: Interface FastEthernet0/0, cha

8、nged state to upR2(config-if)#exit%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to upR2(config)#router eigrp 100R2(config-router)#net R2(config-router)#%DUAL-5-NBRCHANGE: IP-EIGRP 100: Neighbor (Serial0/0/1) is up: new adjacencyR2(config-router)#net R2(config-router)

9、#net 55R2(config-router)#no autoR2(config-router)#%DUAL-5-NBRCHANGE: IP-EIGRP 100: Neighbor (Serial0/0/1) is up: new adjacencyR2(config-router)#exitR2(config)#exitR2#%SYS-5-CONFIG_I: Configured from console by consoleR2#copy run startDestination filename startup-config? Building configuration.OKRout

10、erenRouter#conf tEnter configuration commands, one per line. End with CNTL/Z.Router(config)#host R3R3(config)#int s0/0/1R3(config-if)#ip add R3(config-if)#no shutR3(config-if)#%LINK-5-CHANGED: Interface Serial0/0/1, changed state to upR3(config-if)#exitR3(config)#int f0/0R3(config-if)#ip add R3(conf

11、ig-if)#no shutR3(config-if)#%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to upR3(config-if)#exitR3(config)#router eigrp 100R3(config-router)#net 55R3(config-router)#net R3(config-router)#no autoR3(config

12、-router)#%DUAL-5-NBRCHANGE: IP-EIGRP 100: Neighbor (Serial0/0/1) is up: new adjacencyR3(config-router)#endR3#%SYS-5-CONFIG_I: Configured from console by consoleR3#copy run startDestination filename startup-config? Building configuration.OK配ACL之前，student去ping R2的三个接口的ip地址，也可以ping 效力器 ，应该ping得通。R2#con

13、f tEnter configuration commands, one per line. End with CNTL/Z.R2(config)#access-list 1 deny 55R2(config)#access-list 1 permit anyR2(config)#int s0/0/1R2(config-if)#ip access-group 1 inR2(config-if)#exitR2(config)#access-list 2 permit host 0R2(config)#line vty 0 4R2(config-line)#password 501R2(confi

14、g-line)#loginR2(config-line)#access-class 2 inR2(config-line)#endR2#%SYS-5-CONFIG_I: Configured from console by consoleR2#copy run startDestination filename startup-config? Building configuration.配ACL之后，student去ping R2的三个接口的ip地址，也可以ping 效力器 ，应该ping不通。PCping Pinging with 32 bytes of data:Request time

15、d out.Request timed out.Request timed out.Request timed out.Ping statistics for : Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),OKPCping Pinging with 32 bytes of data:Request timed out.Request timed out.Request timed out.Request timed out.Ping statistics for : Packets: Sent = 4, Received = 0

16、, Lost = 4 (100% loss),配ACL之后，teacher机可以telnet R2 ，效果如下。PCtelnet Trying .OpenUser Access VerificationPassword: 501R2en% No password set.R2但只允许teacher 机telnet R2，在R3上telnet R2 不胜利。R3#telnet Trying .% Connection refused by remote hostR3#telnet Trying .% Connection refused by remote hostR3#telnet Tryin

17、g .% Connection refused by remote host在student机上telnet R2 不胜利。PCtelnet Trying .% Connection timed out; remote host not respondingPCtelnet Trying .% Connection timed out; remote host not respondingPCtelnet Trying .% Connection timed out; remote host not responding在R1上telnet R2 不胜利。R1#telnet Trying .%

18、 Connection refused by remote hostR1#telnet Trying .% Connection refused by remote hostR1#telnet Trying .% Connection refused by remote hostTeacher机：PCtelnet Trying .OpenConnection to closed by foreign hostPCtelnet Trying .% Connection timed out; remote host not respondingPCtelnet 0Trying 0 .% Conne

19、ction timed out; remote host not respondingR1#telnet Trying .OpenConnection to closed by foreign hostR1#telnet Trying .OpenConnection to closed by foreign hostR3enR3#telnet Trying .OpenConnection to closed by foreign hostR3#telnet Trying .% Connection timed out; remote host not respondingSERVERtelne

20、t Trying .% Connection refused by remote hostSERVERtelnet Trying .% Connection refused by remote hostSERVERtelnet Trying .% Connection refused by remote hostSERVERtelnet Trying .OpenConnection to closed by foreign hostSERVERtelnet Trying .% Connection timed out; remote host not respondingSERVERtelne

21、t Trying .OpenConnection to closed by foreign hostSERVERtelnet Trying .OpenConnection to closed by foreign hostSERVERtelnet 0Trying 0 .% Connection refused by remote hostSERVER2扩展ACL实验：实验目的：学生不能访问ftp,但能访问www，教师不受限制。实验拓补图如下：实验配置如下：R2#sh access-listsStandard IP access list 1 deny 55 permit any (11 mat

22、ch(es)Standard IP access list 2 permit host 0R2#sh runinterface Serial0/0/1 ip address ip access-group 1 in!line vty 0 4 access-class 2 in password 501 login!删除ACL：R2#conf tEnter configuration commands, one per line. End with CNTL/Z.R2(config)#int s0/0/1R2(config-if)#no ip access-group 1 inR2(config

23、-if)#exitR2(config)#no access-list 1R2(config)#line vty 0 4R2(config-line)#no access-class 2 inR2(config-line)#no password R2(config-if)#exitR2(config)#no access-list 2可以用sh access-lists 和sh run查看。R2#sh access-listsR2#sh runR2#copy run startDestination filename startup-config? Building configuration

24、.OK配ACL之前测试：student的pc机测试结果如下：PCping Pinging with 32 bytes of data:Reply from : bytes=32 time=203ms TTL=126Reply from : bytes=32 time=141ms TTL=126Reply from : bytes=32 time=157ms TTL=126Reply from : bytes=32 time=143ms TTL=126Ping statistics for : Packets: Sent = 4, Received = 4, Lost = 0 (0% loss)

25、,Approximate round trip times in milli-seconds: Minimum = 141ms, Maximum = 203ms, Average = 161msstudent机上测试：PCftp Trying to connect.Connected to 220- Welcome to PT Ftp serverUsername:cisco331- Username ok, need passwordPassword:cisco230- Logged in(passive mode On)ftpftpctrl+cPacket Tracer PC Comman

26、d Line 1.0PC配dns之后，也就是指定了效力器的ip地址 和域名 HYPERLINK film film 的对应关系之后，也可以以域名的方式登录到ftp效力器。PCftp filmTrying to connect.filmConnected to film220- Welcome to PT Ftp serverUsername:cisco331- Username ok, need passwordPassword:cisco230- Logged in(passive mode On)ftpexit Invalid or non supported command.ftpctr

27、l+cPacket Tracer PC Command Line 1.0PCPCping 0Pinging 0 with 32 bytes of data:Reply from 0: bytes=32 time=188ms TTL=125Reply from 0: bytes=32 time=172ms TTL=125Reply from 0: bytes=32 time=187ms TTL=125Reply from 0: bytes=32 time=187ms TTL=125Ping statistics for 0: Packets: Sent = 4, Received = 4, Lo

28、st = 0 (0% loss),Approximate round trip times in milli-seconds: Minimum = 172ms, Maximum = 188ms, Average = 183ms配dns之前，ping teacher 的ip地址，但ping不了域名；配dns之后，ip地址和域名都可以ping通。Teacher的域名 HYPERLINK teacher teacher，效力器的域名 HYPERLINK film film，student的域名 HYPERLINK student student。PCping teacherPinging 0 wit

29、h 32 bytes of data:Reply from 0: bytes=32 time=156ms TTL=125Reply from 0: bytes=32 time=159ms TTL=125Reply from 0: bytes=32 time=172ms TTL=125Reply from 0: bytes=32 time=156ms TTL=125Ping statistics for 0: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),Approximate round trip times in milli-seco

30、nds: Minimum = 156ms, Maximum = 172ms, Average = 160msPCping filmPinging with 32 bytes of data:Reply from : bytes=32 time=157ms TTL=126Reply from : bytes=32 time=156ms TTL=126Reply from : bytes=32 time=141ms TTL=126Reply from : bytes=32 time=125ms TTL=126Ping statistics for : Packets: Sent = 4, Rece

31、ived = 4, Lost = 0 (0% loss),Approximate round trip times in milli-seconds: Minimum = 125ms, Maximum = 157ms, Average = 144ms在student上测试www效力。在student机的桌面，在WEB阅读器的地址栏里输入 HYPERLINK / /显示网页内容：Cisco Packet TracerWelcome to njupt film site. you can download films. Quick Links: A small page Copyrights Im

32、age page Image在student机的桌面，在WEB阅读器的地址栏里输入 HYPERLINK film/ film/，同样可以显示网页内容。teacher 的pc机测试结果如下：PCping Pinging with 32 bytes of data:Request timed out.Reply from : bytes=32 time=143ms TTL=126Reply from : bytes=32 time=140ms TTL=126Reply from : bytes=32 time=127ms TTL=126Ping statistics for : Packets:

33、Sent = 4, Received = 3, Lost = 1 (25% loss),Approximate round trip times in milli-seconds:Minimum = 127ms, Maximum = 143ms, Average = ms在R1上配ACL。R1(config)#access-list 101 deny tcp 55 host eq 21R1(config)#access-list 101 deny tcp 55 host eq 20R1(config)#access-list 101 permit ip 55 any R1(config)#in

34、t f0/0R1(config-if)#ip access-group 101 inR1#sh access-listsExtended IP access list 101 deny tcp 55 host eq ftp deny tcp 55 host eq 20 permit ip 55 any R1#sh runBuilding configuration.Current configuration : 2004 bytes!version 12.4no service timestamps log datetime msecno service timestamps debug da

35、tetime msecno service password-encryption!hostname R1!interface FastEthernet0/0 ip address ip access-group 101 in duplex auto speed autoStudent上配好acl后，再测Student能否访问效力器的ftp效力和www效力。PCftp filmTrying to connect.film%Error opening ftpfilm/ (Timed out).Packet Tracer PC Command Line 1.0PC(Disconnecting fr

36、om ftp server)PCftp Trying to connect.%Error opening ftp/ (Timed out).Packet Tracer PC Command Line 1.0PC(Disconnecting from ftp server)Packet Tracer PC Command Line 1.0阐明student机已不能访问效力器的ftp效力了。二 高级ACL扩展ACL的运用1.防止地址欺骗。R1是内网的边境路由器，R2是外网的边境路由器。外部网络的用户能够会伪装本人的ip地址，比如运用内部网的合法IP地址或者回环地址作为源地址，从而实现非法访问。处理

37、方法：将能够伪装到的ip地址回绝掉。Router(config)#host R1R1(config)#int s0/0/1R1(config-if)#ip add R1(config-if)#clock rate 64000R1(config-if)#no shutR1(config)#int f0/0R1(config-if)#ip add R1(config-if)#no shutR1(config)#router eigrp 100R1(config-router)#net *May 10 11:29:29.374: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 100:

38、 Neighbor (Serial0/0/1) is up: new adjacencyR1(config-router)#net R1(config-router)#no auto/*May 10 11:29:57.010: IP-EIGRP(Default-IP-Routing-Table:100): Neighbor not on common subnet for FastEthernet0/0R1(config-router)#*May 10 11:30:00.666: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 100: Neighbor

39、(Serial0/0/1) is resync: summary configuredR1(config-router)#*May 10 11:30:00.666: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 100: Neighbor (Serial0/0/1) is resync: summary configured*May 10 11:30:10.942: IP-EIGRP(Default-IP-Routing-Table:100): Neighbor not on common subnet for FastEthernet0/0*May 1

40、0 11:30:24.934: IP-EIGRP(Default-IP-Routing-Table:100): Neighbor not on common subnet for FastEthernet0/0*May 10 11:30:38.838: IP-EIGRP(Default-IP-Routing-Table:100): Neighbor not on common subnet for FastEthernet0/0*May 10 11:30:53.090: IP-EIGRP(Default-IP-Routing-Table:100)

41、: Neighbor not on common subnet for FastEthernet0/0*May 10 11:31:07.222: IP-EIGRP(Default-IP-Routing-Table:100): Neighbor not on common subnet for FastEthernet0/0/以上系统显示异常的缘由是网络有环路，这里产生环路的衔接是由于3560交换机和两台2950交换机分别用交叉线衔接，三台路由器两两衔接，三台路由器分别与三台交换机衔接。R1(config)#ip access-list exten

42、ded ingress-antspoofR1(config-ext-nacl)#deny ip 55 anyR1(config-ext-nacl)#deny ip 55 anyR1(config-ext-nacl)#deny ip 55 any /阻止源地址为私有地址的一切通讯流。/12，到55。R1(config-ext-nacl)#deny ip 55 any /阻止源地址为回环地址的一切通讯流。R1(config-ext-nacl)#deny ip 55 any /阻止源地址为多目的地址的一切通讯流。/4 R1(config-ext-nacl)#deny ip 55 any /链路本地地

43、址。无法正常获取地址时，会分配给他。例如：图书馆无线上网无法正常获取地址，会得到这样的地址。R1(config-ext-nacl)#deny ip host any /阻止没有列出源地址的通讯流。R1(config-ext-nacl)#permit ip any anyR1(config-ext-nacl)#exR1(config)#int s0/0/1R1(config-if)#ip access-group ingress-antspoof inRouter(config)#host R2Router(config)#int s0/0/1Router(config-if)#ip add R

44、outer(config-if)#no shutRouter(config-if)#exR2(config)#int f0/0R2(config-if)#ip add R2(config-if)#no shutR2(config-if)#exR2(config)#router eigrp 100R2(config-router)#net R2(config-router)#net R2(config-router)#no auto在R1上，配好acl，从pc2 ping pc1 ,显示：Rely from ：Destination host unreachableping pc1的网关，显示：

45、Request time outRely from ：Destination host unreachableRequest time outping Rely from ：Destination net unreachableping 能ping通。pc2 pc1 防止非法探测外部网络的非法访问者对内部网络发起 HYPERLINK hack.77169/List/List_45.html t _blank 攻击前，通常会用ping或其他命令探测网络，所以只需制止从外部用ping、traceroute等探测就可以防备。可运用如下的访问列表: access-list 102 deny icmp

46、any any echo 阻止用ping探测网络。 access-list 102 deny icmp any any time-exceeded 阻止用traceroute探测网络。防止病毒传播和黑客攻击针对操作系统的破绽，有些病毒程序和破绽扫描软件经过UDP端口、1434和TCP端口、445、4444、5554、9995、9996等进展病毒传播和攻击，可设置如下的访问控制列表阻止病毒传播和黑客攻击。有两个路由器组建的网络就可以完本钱实验。 access-list 101 deny udp any any eq access-list 101 deny udp any any eq acce

47、ss-list 101 deny udp any any eq access-list 101 deny udp any any eq 1434access-list 101 deny tcp any any eq access-list 101 deny tcp any any eq access-list 101 deny tcp any any eq access-list 101 deny tcp any any eq 445access-list 101 deny tcp any any eq 4444access-list 101 deny tcp any any eq 5554a

48、ccess-list 101 deny tcp any any eq 9995access-list 101 deny tcp any any eq 9996access-list 101 permit ip any any把ACL运用到路由器接口上：interface s0/0/1ip access-group 101 in高级ACL实验：控制上网时间，可以用基于时间的ACL来实现。 1定义时间范围的称号time-range time-range-name time-range： 用来定义时间范围的命令。time-range-name： 时间范围称号，用来标识时间范围，以便于在后面的访问列表

49、中援用。 2指定该时间范围何时生效定义一个时间周期periodic days-of-the-week hh:mm to days-of-the-week hh:mmperiodic主要是以星期为参数来定义时间范围的一个命令。它的参数主要有Monday、Tuesday、Wednesday、Thursday、Friday、Saturday、Sunday中的一个或者几个的组合，也可以是daily每天、weekday周一至周五，或者weekend周末。定义一个绝对时间absolute start hh:mm day month yearend hh:mm day month yearabsolute该

50、命令用来指定绝对时间范围。它后面紧跟着start和end两个关键字。在这两个关键字后面的时间要以24小时制hh:mm表示，日期要按照日/月/年来表示。假设省略start及其后面的时间，那么表示与之相联络的permit或deny语句立刻生效，并不断作用到end处的时间为止。假设省略end及其后面的时间，那么表示与之相联络的permit或deny语句在start处表示的时间开场生效，并且不断进展下去。一个时间范围只能有一个absolute语句，但是可以有几个periodic语句。例如假设我们需求在上图中的R5上配置基于时间的ACL，允许在星期一到星期五的8：00至17：00的时间内可以远程登录R2

51、，那么需求以下命令：R5(config)#time-range weekdaysR5(config-time-range)#periodic monday friday 8:00 to 17:00R5(config-time-range)# access-list 101 permit tcp 55 eq telnet time-range weekdays R5(config)#int s0/0R5(config-if)#ip access-group 101 inRouterenRouter#conf tEnter configuration commands, one per line.

52、 End with CNTL/Z.Router(config)#host R3R3(config)#int s0/0/0R3(config-if)#ip add R3(config-if)#clock rate 64000R3(config-if)#no shutR3(config-if)#*Apr 6 06:21:25.911: %LINK-3-UPDOWN: Interface Serial0/0/0, changed state to up*Apr 6 06:21:28.911: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial

53、0/0/0, changed state to upR3(config-if)#exitR3(config)#int f0/0R3(config-if)#ip add R3(config-if)#no shutR3(config-if)#*Apr 6 06:22:48.183: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up*Apr 6 06:22:49.183: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed stat

54、e to upRouterenRouter#conf tEnter configuration commands, one per line. End with CNTL/Z.Router(config)#ho R2R2(config)#int s0/0/0R2(config-if)#ip add R2(config-if)#no shutR2(config-if)#*Apr 6 06:24:01.563: %LINK-3-UPDOWN: Interface Serial0/0/0, changed state to up*Apr 6 06:24:04.563: %LINEPROTO-5-UP

55、DOWN: Line protocol on Interface Serial0/0/0, changed state to upR2(config-if)#exitR2(config)#int loop0R2(config-if)#ip add *Apr 6 06:24:24.559: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback0, changed state to up R2(config-if)#exitR2(config-if)#exitR2(config)#router eigrp 1R2(config-route

56、r)#net 55R2(config-router)#net R3(config)#router eigrp 1R3(config-router)#net *Apr 6 06:39:02.931: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor (Serial0/0/0) is up: new .R3(config-router)#net 55/R3(config)#int loop0R3(config-if)#ip add *Apr 6 06:41:58.639: %LINEPROTO-5-UPDOWN: Line protocol on Interfa

57、ce Loopback0, changed state to upR3(config-if)#exitR3(config)#router eigrp 1R3(config-router)#net 55 / 这一段可以不配，用不上。R3(config-router)#no autoR2(config)#router eigrp 1R2(config-router)#no autoR2(config-router)#*Apr 6 06:37:52.359: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor (Serial0/0/0) is resync: sum

58、mary configuredR3(config)#time-range timeR3(config-time-range)#periodic weekdays 8:00 to 18:00R3(config)#access-list 111 permit tcp host host eq telnet time-range timeR3(config)#access-list 111 permit tcp host host eq telnet time-range timeR3(config)#int f0/0R3(config-if)#ip access-group 111 inR3#cl

59、ock read-calendarR3#*Apr 6 07:02:16.000: %SYS-6-CLOCKUPDATE: System clock has been updated from 07:02:13 UTC Fri Apr 6 2021 to 07:02:16 UTC Fri Apr 6 2021, configured from console by console.R3#clock set 15:06:01 06 Apr 2021R3#*Apr 6 15:06:01.000: %SYS-6-CLOCKUPDATE: System clock has been updated fr

60、om 07:02:48 UTC Fri Apr 6 2021 to 15:06:01 UTC Fri Apr 6 2021, configured from console by console.在pc3,cmd,telnet R2的，显示Password required，but none set失去了跟主机的联络。R2(config)#line vty 0 4R2(config-line)#password 501R2(config-line)#loginR2(config-line)#endR2(config)#en password 501R2(config)#endR2#*Apr 6