ACL訪問控制列表案例
Router(config)#$ access-list 100 permit ip 192.168.1.0 0.0.0.255 host 192.168.100.10
Router(config)#$ access-list 100 deny tcp 192.168.0.0 0.0.255.255 host 192.168.100.10 eq telnet
Router(config)#$ access-list 100 deny tcp 192.168.0.0 0.0.255.255 host 192.168.100.10 eq 22
Router(config)#$ access-list 100 deny tcp 192.168.0.0 0.0.255.255 host 192.168.100.10 eq 21
Router(config)#$ access-list 100 deny tcp 192.168.0.0 0.0.255.255 host 192.168.100.10 eq 3389
Router(config)#int f1/1
Router(config-if)#ip access-group 100 out
##只允許192.168.1.0的網段通過ssh,telnet,運程桌面的方式連線到伺服器，應用於f1/1埠上。
Router(config)#$ access-list 101 permit ip 192.168.0.0 0.0.255.255 host 192.168.100.10 eq 80
Router(config-if)#int f1/2
Router(config-if)#ip access-group 101 in
##允許內網所有主機訪問192.168.100.10的80埠，應用於f1/2埠上
Router(config)#$ access-list 101 permit tcp any host 192.168.100.10 eq 80
Router(config-if)#int f1/3
Router(config-if)#ip access-group 101 in
##允許外網所有主機訪問192.168.100.10的80埠，應用於f1/3埠上.
通過命令檢視訪問控制列表。
Router#sh access-list
Extended IP access list 100
10 permit ip 192.168.1.0 0.0.0.255 host 192.168.100.10
20 deny tcp 192.168.0.0 0.0.255.255 host 192.168.100.10 eq telnet
30 deny tcp 192.168.0.0 0.0.255.255 host 192.168.100.10 eq 22
40 deny tcp 192.168.0.0 0.0.255.255 host 192.168.100.10 eq ftp
50 deny tcp 192.168.0.0 0.0.255.255 host 192.168.100.10 eq 3389
Extended IP access list 101
10 permit ip 192.168.0.0 0.0.255.255 host 192.168.100.10
Extended IP access list 102
10 permit tcp any host 192.168.100.10 eq www
轉載於:https://blog.51cto.com/dragon123/1564841