关于ACL的一个问题

如图 

 第一步：划分ip

[PC1]interface g0/0/0
[PC1-GigabitEthernet0/0/0]ip add 192.168.1.2 24

[PC2]interface g0/0/0
[PC2-GigabitEthernet0/0/0]ip add 192.168.1.3 24
[AR1]interface g0/0/0
[AR1-GigabitEthernet0/0/0]ip add 192.168.1.1 24
[AR1]interface g0/0/1
[AR1-GigabitEthernet0/0/1]ip add 192.168.2.1 24
[AR2]interface g0/0/0
[AR2-GigabitEthernet0/0/0]ip add 192.168.2.2 24
第二步：全网可达

[PC1]ip route-static 192.168.2.0 24 192.168.1.1
[PC2]ip route-static 192.168.2.0 24 192.168.1.1
[AR2]ip route-static 192.168.1.0 24 192.168.2.1

 

第三步：开启远程登录功能

[AR1]aaa
[AR1-aaa]local-user wxm privilege level 15 password cipher 12345
[AR1-aaa]local-user wxm service-type telnet
[AR1]user-interface vty 0 4
[AR1-ui-vty0-4]authentication-mode aaa

 

AR1上开启成功

第四步：实现功能

[AR1]acl 3000
[AR1-acl-adv-3000]rule deny ip source 192.168.1.2 0 destination 192.168.1.1 0

[AR1-acl-adv-3000]rule deny ip source 192.168.1.2 0 destination 192.168.2.1 0
[AR1-acl-adv-3000]rule deny tcp source 192.168.1.2 0 destination 192.168.2.2 0 destination-port eq 23    
[AR1-acl-adv-3000]rule deny ip source 192.168.1.3 0 destination 192.168.2.2 0
[AR1-acl-adv-3003]rule deny tcp source 192.168.1.3 0 destination 192.168.2.1 0 destination-port eq 23
[AR1-acl-adv-3003]q
[AR1]int g0/0/0
[AR1-GigabitEthernet0/0/0]traffic-filter inbound acl 3003

 

PC1不能ping通AR1 

PC1不能登录AR2 

PC2不能ping通AR2 

 

PC2不能登录AR1