流量控制ACL实验

实验1&＃xff1a;

目的&＃xff1a;拒绝1.0网段访问
PC1&＃xff1a;192.168.1.1/24 网关&＃xff1a;192.168.1.254
PC2&＃xff1a;192.168.2.1/24 网关&＃xff1a;192.168.2.254
步骤&＃xff1a;
AR6
Huawei]sysname AR6
[AR6]inter gi0/0/0
[AR6-GigabitEthernet0/0/0]ip add 192.168.1.254 24
[AR6-GigabitEthernet0/0/0]q
[AR6]inter gi0/0/1
[AR6-GigabitEthernet0/0/1]ip add 192.168.12.1 24
[AR6-GigabitEthernet0/0/1]q
[AR6]rip
[AR6-rip-1]version 2
[AR6-rip-1]network 192.168.1.0
[AR6-rip-1]network 192.168.12.0
AR7
sys
[Huawei]sysname AR7
[AR7]inter gi0/0/0
[AR7-GigabitEthernet0/0/0]ip add 192.168.12.2 24
[AR7-GigabitEthernet0/0/0]q
[AR7-GigabitEthernet0/0/1]ip add 192.168.23.1 24
[AR7-GigabitEthernet0/0/1]q
[AR7]rip
[AR7-rip-1]version 2
[AR7-rip-1]network 192.168.12.0
[AR7-rip-1]network 192.168.23.0
[AR7]display ip routing-table
AR11
sys
Huawei]sysname AR11
[AR11]inter gi0/0/0
[AR11-GigabitEthernet0/0/0]ip add 192.168.23.2 24
[AR11-GigabitEthernet0/0/0]q
[AR11]inter gi0/0/1
[AR11-GigabitEthernet0/0/1]ip add 192.168.34.1 24
[AR11-GigabitEthernet0/0/1]q
[AR11]rip
[AR11-rip-1]version 2
[AR11-rip-1]network 192.168.23.0
[AR11-rip-1]network 192.168.34.0
AR10
sys
[Huawei]sysname AR10
[AR10]inter gi0/0/0
[AR10-GigabitEthernet0/0/0]ip add 192.168.34.2 24
[AR10-GigabitEthernet0/0/0]q
[AR10]inter gi0/0/1
[AR10-GigabitEthernet0/0/1]ip add 192.168.2.254 24
[AR10-GigabitEthernet0/0/1]q
[AR10]rip
[AR10-rip-1]version 2
[AR10-rip-1]network 192.168.34.0
[AR10-rip-1]network 192.168.2.0
验证是否可以通

AR6
[AR6]acl 2000 设置基本acl
[AR6-acl-basic-2000]rule 10 deny source 192.168.1.0 0.0.0.255 规则10 拒绝源ip1.0网段所有 通配符
[AR6-acl-basic-2000]q
[AR6]interface gi0/0/0
[AR6-GigabitEthernet0/0/0]traffic-filter inbound acl 2000 端口调用命令2000
验证&＃xff1a;

实验二&＃xff1a;

连接交换机&＃xff08;交换机可以连接多台电脑&＃xff0c;路由器只能连接一台电脑&＃xff09; 加三台主机
要求&＃xff1a;只允许PC1与PC2拼通
环境&＃xff1a;
PC3&＃xff1a;192.168.1.3/24 网关192.168.1.254
PC4&＃xff1a;192.168.1.4/24
PC5&＃xff1a;192.168.1.5/24
思路&＃xff1a;1.仅仅允许PC1&＃xff0c;拒绝所有
2.明确拒绝其他三台&＃xff0c;允许所有
在实验一的基础上开始实验二&＃xff0c;那应先撤销对AR6入端口的acl设置
[AR6]inter gi 0/0/0
[AR6-GigabitEthernet0/0/0]undo traffic-filter inbound 端口的调用命令要删掉&＃xff0c;以免日后启用这个端口报错
[AR6]undo acl 2000 删掉acl

[AR6]acl 2000 配置基本acl
[AR6-acl-basic-2000]rule 10 permit source 192.168.1.1 0.0.0.0 规则为10 只允许1.1
[AR6-acl-basic-2000]rule 20 deny source 192.168.1.0 0.0.0.255 规则为20 拒绝1.0所有
[AR6-acl-basic-2000]q
[AR6]interface gi0/0/0
[AR6-GigabitEthernet0/0/0]traffic-filter inbound acl 2000 端口调用acl2000
[AR6-GigabitEthernet0/0/0]q
[AR6]display acl all 查看已配置的acl
Total quantity of nonempty ACL number is 1
Basic ACL 2000, 2 rules
Acl&＃39;s step is 5
rule 10 permit source 192.168.1.1 0
rule 20 deny source 192.168.1.0 0.0.0.255
验证PC1与PC2可拼通
PC1与PC2不可拼通

实验三
要求&＃xff1a;基于实验1的基础 PC1不可拼通AR11 但可远程
[AR11]acl 3000 配置高级acl
[AR11-acl-adv-3000]rule 5 deny icmp source 192.168.1.1 0.0.0.0 规则5&＃xff08;随便配置编号&＃xff09;拒绝1.1网络的PIN命令
[AR11]interface gi0/0/0
[AR11-GigabitEthernet0/0/0]traffic-filter inbound acl 3000 调用acl3000
[AR11-GigabitEthernet0/0/0]q
[AR11]user-interface vty 0 4 因为要验证远程因此给被远程的机器配置密码以供验证
[AR11-ui-vty0-4]authentication-mode password
Please configure the login password (maximum length 16):123
LSW1&＃xff1a;
[Huawei]interface vlanif 1 给交换机2配置ip地址&＃xff08;模拟器中的pc机没有远程的功能&＃xff0c;因此我们用交换机来代替&＃xff09;
[Huawei-Vlanif1]ip add 192.168.1.5 24
[Huawei-Vlanif1]q
[Huawei]ip route-static 0.0.0.0 0.0.0.0 192.168.1.254 给交换机&＃xff08;有路由功能&＃xff0c;安排一条出去的路径&＃xff09;
验证&＃xff1a;

实验四&＃xff1a;
要求&＃xff1a;允许1.0网段远程AR11&＃xff0c;其他网段都不可以
第一步&＃xff1a;基于实验3&＃xff0c;删掉AR11的acl3000&＃xff0c;进入端口删掉traffic
[AR11]acl 2001 设置基本acl
[AR11-acl-basic-2001]rule 5 permit source 192.168.1.0 0.0.0.255 允许1.0网段访问
[AR11-acl-basic-2001]q
[AR11]user-interface vty 0 4
[AR11-ui-vty0-4]authentication-mode password
Please configure the login password (maximum length 16):1234
[AR11-ui-vty0-4]acl 2001 inbound 在虚拟接口上用这条调用命令后&＃xff0c;其他默认是拒绝
验证&＃xff1a;分别LW1远程11 AR7远程11

实验五&＃xff1a;
要求&＃xff1a;1.1&＃xff0c;1.3&＃xff0c;1.5&＃xff0c;1.7拒绝访问pc2 其他可以
基于实验四&＃xff0c;[AR11]undo acl 2001
思路&＃xff1a;1.找公共部分&＃xff0c;相同位直接写&＃xff0c;不同位变成0
1 0000 0001
3 0000 0011
5 0000 0101
7 0000 0111
可变量只有最后一部分的两个字节
公共部分192.168.1.00000001&＃61;192.168.1.1
2.确认通配符&＃xff1a;通配符与公共ip地址是一一对应的&＃xff1b;在通配符中&＃xff0c;与公共ip地址中不变的位对应的位置写0&＃xff0c;
反之写1
0.0.0.00000110&＃61;&＃61;>0.0.0.6
配置&＃xff1a;
[AR6]acl 3001
[AR6-acl-adv-3001]rule 10 deny icmp source 192.168.1.1 0.0.0.6 destination 192.168.2.1 0.0.0.0 拒绝从公共部分为192.168.1.1&＃xff08;推演过程如上&＃xff09;的客户端拼到192.168.2.1的服务器
验证&＃xff1a;