ACL实验

最新推荐文章于 2025-12-05 12:10:10 发布

原创最新推荐文章于 2025-12-05 12:10:10 发布 · 61 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#网络 #服务器 #运维

该配置过程涉及了路由器r1和r2以及两台PC的IP设置，允许特定设备通过Telnet访问，并使用ACL控制流量。r2启用了Telnet服务并设置了用户认证。然后创建了一个ACL3000，用于限制192.168.1.10和192.168.1.20到12.0.0.20的TCP流量。最后，配置了静态路由，使得PC1和PC2可以通过路由器到达对方网络。

ip配置

[r1]int g 0/0/1
[r1-GigabitEthernet0/0/1]ip address 192.168.1.10 24
[r1-GigabitEthernet0/0/1]int g 0/0/0
[r1-GigabitEthernet0/0/0]ip address 12.0.0.1 24

[r2]int g 0/0/0
[r2-GigabitEthernet0/0/0]ip ad 12.0.0.2 24

[pc1]int g 0/0/0
[pc1-GigabitEthernet0/0/0]ip add 192.168.1.1 24

[pc2]int g 0/0/0
[pc2-GigabitEthernet0/0/0]ip ad 192.168.1.2 24

开启telnet功能

[r2-GigabitEthernet0/0/0]user-int vty 0 4
[r2-ui-vty0-4]authentication-mode aaa
[r2-ui-vty0-4]q
[r2]aaa
[r2-aaa]local-user huawei password cipher 123456
Info: Add a new user.
[r2-aaa]local-user huawei privilege level 15
[r2-aaa]local-user huawei service-type telnet

创建ACL

[r1]acl 3000----创建基本ACL列表
[r1-acl-adv-3000]rule deny tcp source 192.168.1.1 0.0.0.0 destination 12.0.0.2 0.0.0.0 destination-port eq telnet---编写规则
[r1-acl-adv-3000]rule permit ip source 192.168.1.1 0.0.0.0 destination 12.0.0.2 0.0.0.0
[r1-acl-adv-3000]rule permit tcp source 192.168.1.2 0.0.0.0 destination 12.0.0.2 0.0.0.0 destination-port eq telnet
[r1-acl-adv-3000]rule deny ip source 192.168.1.2 0.0.0.0 destination 12.0.0.2 0.0.0.0
[r1-acl-adv-3000]q
[r1-GigabitEthernet0/0/0]int g 0/0/1
[r1-GigabitEthernet0/0/1]traffic-filter outbound acl 3000----调用策略
[r1-GigabitEthernet0/0/1]q
[r1]int g 0/0/0
[r1-GigabitEthernet0/0/0]traffic-filter outbound acl 3000
[r1-GigabitEthernet0/0/0]q
[r1]display acl 3000-----查看ACL列表
Advanced ACL 3000, 4 rules
Acl's step is 5
 rule 5  deny ip source 192.168.1.2 0 destination 12.0.0.2 0
 rule 10  permit tcp source 192.168.1.2 0 destination 12.0.0.2 0 destination-port eq telnet
 rule 15 permit ip source 192.168.1.1 0 destination 12.0.0.2 0 
 rule 20 deny tcp source 192.168.1.1 0 destination 12.0.0.2 0 destination-port eq telnet

设置静态路由

[r2]ip route-static 192.168.1.0 24 12.0.0.1

[pc1]ip route-static 12.0.0.0 24 192.168.1.10

[pc2]ip route-static 12.0.0.0 24 192.168.1.10

结果检测

pc1

pc2