配置标准的ACL
配置标准的
ACL
Acl
在
router 0
的
serial 0/0 out
方向上
<1,
允许主机
10.1.1
.100 pc1
访问
router 1>
<2,
拒绝主机
pc1
以外的
10.1.1
.0
网络访问
router 1>
<3,
允许其他流量访问
router 1>
Router 0
的配置：
Router>en
Router#conf
Configuring from terminal, memory, or network [terminal]?
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#interface fastEthernet 0/0
Router(config-if)#ip address 10.1.1 .1 255.255.255.0
Router(config-if)#no shutdown
%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up
Router(config-if)#exit
Router(config)#interface fastEthernet 0/1
Router(config-if)#ip address 172.16.1.1 255.255.255.0
Router(config-if)#no shutdown
%LINK-5-CHANGED: Interface FastEthernet0/1, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up
Router(config-if)#exit
Router(config)#interface serial 0/0
Router(config-if)#ip add
Router(config-if)#ip address 12.12.12 .1 255.255.255.0
Router(config-if)#clock rate 64000
Router(config-if)#no shutdown
%LINK-5-CHANGED: Interface Serial0/0, changed state to down
Router(config-if)#
%LINK-5-CHANGED: Interface Serial0/0, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0, changed state to up
Router(config-if)#EXIT
Router(config)#router rip
Router(config-router)#network 172.16.1.0
Router(config-router)#network 10.1.1 .0
Router(config-router)#network 12.12.12 .0
Router(config-router)#end
%SYS-5-CONFIG_I: Configured from console by console
Router#show ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route
Gateway of last resort is not set
10.0.0 .0/24 is subnetted, 1 subnets
C 10.1.1 .0 is directly connected, FastEthernet0/0
12.0.0 .0/24 is subnetted, 1 subnets
C 12.12.12 .0 is directly connected, Serial0/0
172.16.0.0/24 is subnetted, 1 subnets
C 172.16.1.0 is directly connected, FastEthernet0/1
R 192.168.1.0/24 [120/1] vi a 12.12.12 .2, 00:00:04, Serial0/0
Router#
ping 192.168.1.100
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.100, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 31/53/63 ms
Router#configure
Configuring from terminal, memory, or network [terminal]?
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#access-list ?
<1-99> IP standard access list
<100-199> IP extended access list
Router(config)#access-list 1 ?
deny Specify packets to reject
permit Specify packets to forward
remark Access list entry comment
Router(config)#access-list 1 permit host 10.1.1 .100
Router(config)#access-list 1 deny 10.1.1 .0 0.0.0.255
Router(config)#access-list 1 permit any
Router(config)#interface fastEthernet 0/0
Router(config-if)#exit
Router(config)#interface serial 0/0
Router(config-if)#ip access-group 1 out
Router(config-if)#
Router(config-if)#no shutdown
Router(config-if)#end
%SYS-5-CONFIG_I: Configured from console by console
Router#show access-lists
Standard IP access list 1
permit host 10.1.1 .100
deny 10.1.1 .0 0.0.0.255
permit any (84 match(es))
Router#
Router 1
的配置：
Router>enable
Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#interface fastEthernet 0/0
Router(config-if)#ip address 192.168.1.1 255.255.255.0
Router(config-if)#no shutdown
%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up
Router(config-if)#exit
Router(config)#interface serial 0/0
Router(config-if)#ip address 12.12.12 .2 255.255.255.0
Router(config-if)#no shutdown
%LINK-5-CHANGED: Interface Serial0/0, changed state to up
Router(config-if)#
%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0, changed state to up
Router(config-if)#
Router(config-if)#exit
Router(config)#router rip
Router(config-router)#network 12.12.12 .0
Router(config-router)#network 192.168.1.0
Router(config-router)#end
%SYS-5-CONFIG_I: Configured from console by console
Router#show ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route
Gateway of last resort is not set
R 10.0.0 .0/8 [120/1] vi a 12.12.12 .1, 00:00:11, Serial0/0
12.0.0 .0/24 is subnetted, 1 subnets
C 12.12.12 .0 is directly connected, Serial0/0
R 172.16.0.0/16 [120/1] vi a 12.12.12 .1, 00:00:11, Serial0/0
C 192.168.1.0/24 is directly connected, FastEthernet0/0
Router#ping 172.16.1.100
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.100, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 46/58/62 ms
Router#ping 10.1.1 .100
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1 .100, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 78/87/94 ms
Router#ping 10.1.1 .2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1 .2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 62/78/94 ms
Router#
Pc 0
上
ping server.
Packet Tracer PC Command Line 1.0
PC>ping 192.168.1.2
Pinging 192.168.1.2 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Ping statistics for 192.168.1.2:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
PC>
Pc 1
上
ping server.
Packet Tracer PC Command Line 1.0
PC>ping 192.168.1.100
Pinging 192.168.1.100 with 32 bytes of data:
Reply from 192.168.1.100: bytes=32 time=125ms TTL=126
Reply from 192.168.1.100: bytes=32 time=125ms TTL=126
Reply from 192.168.1.100: bytes=32 time=123ms TTL=126
Reply from 192.168.1.100: bytes=32 time=125ms TTL=126
Ping statistics for 192.168.1.100:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 123ms, Maximum = 125ms, Average = 124ms
PC>tracert 192.168.1.100
Tracing route to 192.168.1.100 over a maximum of 30 hops:
1 33 ms 47 ms 63 ms 10.1.1 .1
2 94 ms 94 ms 93 ms 12.12.12 .2
3 109 ms 125 ms 125 ms 192.168.1.100
Trace complete.
PC>
本文出自 “子逸” 博客，转载请与作者联系！