简单的ACL配置

 

实验分析

1.首先需要做到全网可通

2.再其次需要掌握基础的ACL列表配置

3.掌握基础的AAA认证以及telnet

实验步骤

1. 在各个节点配置ip
2. 在R2以及PC1,PC2路由上配置静态路由实现全网可达，注意在PC1与PC2上直接配置缺省路由，终点写AR1的0/0/1节点IP
3. 分析要求

Pc1可以TelnetR1,但不能pingR1

pc1可以pingR2,但不能TelnetR2

PC2的所有规则与PC1相反

翻译

192.168.2.2 icmp 192.168.2.1

192.168.2.2 icmp 192.168.1.1

192.168.2.2 telent 192.168.1.2

192.168.2.3 telent 192.168.1.1

192.168.2.3 telent 192.168.2.1

192.168.2.3 icmp 192.168.1.2

配置命令

rule deny icmp source 192.168.2.2 0 destination 192.168.2.1 0

rule deny icmp source 192.168.2.2 0 destination 192.168.1.1 0

rule deny tcp source 192.168.2.2 0 destination 192.168.1.2 0 destination-port eq 23

rule deny tcp source 192.168.2.3 0 destination 192.168.1.1 0 destination-port eq 23

rule deny tcp source 192.168.2.3 0 destination 192.168.2.1 0 destination-port eq 23

rule deny icmp source 192.168.2.3 0 destination 192.168.1.2 0

<Huawei>SYS

Enter system view, return user view with Ctrl+Z.

[Huawei]sys r1

[r1]int g 0/0/0

[r1-GigabitEthernet0/0/0]ip add 192.168.1.1 24

Mar 12 2023 16:08:30-08:00 r1 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP

on the interface GigabitEthernet0/0/0 has entered the UP state.

[r1-GigabitEthernet0/0/0]int g 0/0/1

[r1-GigabitEthernet0/0/1]ip add 192.168.2.1 24

Mar 12 2023 16:08:41-08:00 r1 %%01IFNET/4/LINK_STATE(l)[1]:The line protocol IP

on the interface GigabitEthernet0/0/1 has entered the UP state.

[r1-GigabitEthernet0/0/1]

  Please check whether system data has been changed, and save data in time

  Configuration console time out, please press any key to log on

[r1]aaa

[r1-aaa]loc

[r1-aaa]local-user mfz privilege level 15 password cipher 123456

Info: Add a new user.

[r1-aaa]local-user mfz service-type telnet

[r1-aaa]q

[r1]user-interface vty 0 4

[r1-ui-vty0-4]authentication-mode aaa

[r1-ui-vty0-4]

  Please check whether system data has been changed, and save data in time

  Configuration console time out, please press any key to log on

<r1>

[r1]acl 3001

[r1-acl-adv-3001]                                                         

[r1-acl-adv-3001]rule deny icmp source 192.168.2.2 0 destination 192.168.2.1 0

[r1-acl-adv-3001]

[r1-acl-adv-3001]rule deny icmp source 192.168.2.2 0 destination 192.168.1.1 0

[r1-acl-adv-3001]rule deny icmp source 192.168.2.2 0 destination 192.168.1.1 0

[r1-acl-adv-3001]

[r1-acl-adv-3001]rule deny tcp source 192.168.2.2 0 destination 192.168.1.2 0 de

stination-port eq 23

[r1-acl-adv-3001]

[r1-acl-adv-3001]rule deny tcp source 192.168.2.3 0 destination 192.168.1.1 0 de

stination-port eq 23

[r1-acl-adv-3001]

[r1-acl-adv-3001]rule deny tcp source 192.168.2.3 0 destination 192.168.2.1 0 de

stination-port eq 23

[r1-acl-adv-3001]

[r1-acl-adv-3001]rule deny icmp source 192.168.2.3 0 destination 192.168.1.2 0

[r1-acl-adv-3001]dis this

[V200R003C00]

#

acl number 3001  

 rule 5 deny icmp source 192.168.2.2 0 destination 192.168.2.1 0

 rule 10 deny icmp source 192.168.2.2 0 destination 192.168.1.1 0

 rule 15 deny tcp source 192.168.2.2 0 destination 192.168.1.2 0 destination-por

t eq telnet

 rule 20 deny tcp source 192.168.2.3 0 destination 192.168.1.1 0 destination-por

t eq telnet

 rule 25 deny tcp source 192.168.2.3 0 destination 192.168.2.1 0 destination-por

t eq telnet

 rule 30 deny icmp source 192.168.2.3 0 destination 192.168.1.2 0

#

return

[r1-GigabitEthernet0/0/0]int g 0/0/1

[r1-GigabitEthernet0/0/1]traffic-filter inbound acl 3001