配置高階ACL過濾，使PCA無法訪問192.168.2.0網路上的FTP服務:

[RTA]intG0/0

[RTA-G0/0]ipadd192.168.0.1255.255.255.0

[RTA-G0/0]undoshutdown

[RTA-G0/0]intS6/0

[RTA-S6/0]ipadd192.168.1.124

[RTA-S6/0]undoshutdown

[RTA]rip

[RTA-rip-1]ver2

[RTA-rip-1]undosummary

[RTA-rip-1]network192.168.0.0

[RTA-rip-1]network192.168.1.0

[RTB]intG0/0

[RTB-G0/0]ipadd192.168.2.1255.255.255.0

[RTB-G0/0]undoshutdown

[RTB-G0/0]intS6/0

[RTB-S6/0]ipadd192.168.1.224

[RTB-S6/0]undoshutdown

[RTB]rip

[RTB-rip-1]ver2

[RTB-rip-1]undosummary

[RTB-rip-1]network192.168.1.0

[RTB-rip-1]network192.168.2.0

PCA:192.168.0.2255.255.255.0GT:192.168.0.1

PCB:192.168.2.2255.255.255.0GT:192.168.2.1

[RTB]ftpserverenable

[RTB]local-userftp1

[RTB-luser-ftp1]passwordcipherftp123456789

[RTB-luser-ftp1]level3

[RTB-luser-ftp1]service-typeftp

此時網路已經互通，可以訪問FTP服務：

C:\DocumentsandSettings\xiaofei>ping192.168.2.1

Pinging192.168.2.2with32bytesofdata:

Replyfrom192.168.2.1:bytes=32time=16msTTL=254

Replyfrom192.168.2.1:bytes=32time=1msTTL=254

Replyfrom192.168.2.1:bytes=32time=2msTTL=254

Replyfrom192.168.2.1:bytes=32time=1msTTL=254

Pingstatisticsfor192.168.2.1:

Packets:Sent=4,Received=4,Lost=0(0%loss),

Approximateroundtriptimesinmilli-seconds:

Minimum=1ms,Maximum=16ms,Average=5ms

C:\DocumentsandSettings\xiaofei>ftp192.168.2.1

Connectedto192.168.2.1

220FTPserviceready.

User(192.168.2.1:(none)):ftp1

331Passwordrequiredforftp1.

Password:

230Userloggedin.

ftp>dir

200Portcommandokay.

150OpeningASCIImodedataconnectionfor/*.

drwxrwxrwx1noonenogroup0Aug1115:34logfile

226Transfercomplete.

ftp:收到64位元組，用時0.00Seconds64000.00Kbytes/sec.

ftp>

定義高階ACL禁止PCA訪問FTP服務，但可以正常通訊：

[RTA]firewallenable開啟防火牆功能

[RTA]firewalldefaultpermit設定防火牆預設規則

[RTA]aclnumber3000定義高階ACL序號

[RTA-acl-adv-3000]rule0denytcpsource192.168.0.20.0.0.0destination192.168.2.00.0.0.255destination-porteqftp設定規則禁止訪問FTP服務，0.0.0.0表示匹配主機。

[RTA-acl-adv-3000]rule1permitipsource192.168.0.20.0.0.0destination192.168.2.00.0.0.255設定規則，執行正常通訊

[RTA-acl-adv-3000]quit

[RTA-Ethernet0/1/0]firewallpacket-filter3000inbound在介面應用高階ACL。

[RTA]dispaclall

AdvancedACL3000,named-none-,2rules,

ACL'sstepis5

rule0denytcpsource192.168.0.20destination192.168.2.00.0.0.255destination-porteqftp(14timesmatched)

rule1permitipsource192.168.0.20destination192.168.2.00.0.0.255(2timesmatched)

此時PCA可以和192.168.2.0網路正常通訊，但是無法訪問FTP服務：

C:\DocumentsandSettings\xiaofei>ping192.168.2.2

Pinging192.168.2.2with32bytesofdata:

Replyfrom192.168.2.2:bytes=32time=1msTTL=254

Replyfrom192.168.2.2:bytes=32time=1msTTL=254

Replyfrom192.168.2.2:bytes=32time=1msTTL=254

Replyfrom192.168.2.2:bytes=32time<1msTTL=254

Pingstatisticsfor192.168.2.2:

Packets:Sent=4,Received=4,Lost=0(0%loss),

Approximateroundtriptimesinmilli-seconds:

Minimum=0ms,Maximum=1ms,Average=0ms

C:\DocumentsandSettings\xiaofei>ftp192.168.2.2

>ftp:connect:未知錯誤號

轉載於:https://blog.51cto.com/xiaoliufei/962517