Cisco訪問控制列表
PC1配置
PC1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
PC1(config)#int e0/1
PC1(config-if)#ip add
PC1(config-if)#ip address 10.10.1.10 255.255.255.0
PC1(config-if)#no sh
PC1(config-if)#exit
PC1(config)#ip route 0.0.0.0 0.0.0.0 10.10.1.1
PC1(config)#do sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 10.10.1.1 to network 0.0.0.0
10.0.0.0/24 is subnetted, 1 subnets
C 10.10.1.0 is directly connected, Ethernet0/1
S* 0.0.0.0/0 [1/0] via 10.10.1.1
PC2配置
PC2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
PC2(config)#int e0/0
PC2(config-if)#ip add
PC2(config-if)#ip address 10.10.2.10 255.255.255.0
PC2(config-if)#no sh
PC2(config-if)#exit
PC2(config)#ip route 0.0.0.0 0.0.0.0 10.10.2.1
PC2(config)#do sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 10.10.2.1 to network 0.0.0.0
10.0.0.0/24 is subnetted, 1 subnets
C 10.10.2.0 is directly connected, Ethernet0/0
S* 0.0.0.0/0 [1/0] via 10.10.2.1
公共外部路由器配置
gonggongwaibu>en
gonggongwaibu#conf t
Enter configuration commands, one per line. End with CNTL/Z.
gonggongwaibu(config)#int e0/0
gonggongwaibu(config-if)#ip add 192.168.1.10 255.255.255.0
gonggongwaibu(config-if)#no sh
gonggongwaibu(config-if)#int e0/1
gonggongwaibu(config-if)#ip add 10.10.1.1 255.255.255.0
gonggongwaibu(config-if)#no sh
gonggongwaibu(config-if)#int e0/2
gonggongwaibu(config-if)#ip add 10.10.2.1 255.255.255.0
gonggongwaibu(config-if)#no sh
gonggongwaibu(config)#ip route 172.16.1.0 255.255.255.0 192.168.1.1
gonggongwaibu(config)#do sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
172.16.0.0/24 is subnetted, 1 subnets
S 172.16.1.0 [1/0] via 192.168.1.1
10.0.0.0/24 is subnetted, 2 subnets
C 10.10.1.0 is directly connected, Ethernet0/1
C 10.10.2.0 is directly connected, Ethernet0/2
C 192.168.1.0/24 is directly connected, Ethernet0/0
gonggongwaibu(config)#do sh ip int br
Interface IP-Address OK? Method Status Protocol
Ethernet0/0 192.168.1.10 YES manual up up
Ethernet0/1 10.10.1.1 YES manual up up
Ethernet0/2 10.10.2.1 YES manual up up
Ethernet0/3 unassigned YES unset administratively down down
實驗路由器配置
shiyan#conf t
Enter configuration commands, one per line. End with CNTL/Z.
shiyan(config)#int e0/0
shiyan(config-if)#ip add 192.168.1.1 255.255.255.0
shiyan(config-if)#no sh
shiyan(config-if)#int e0/1
shiyan(config-if)#ip add 172.16.1.1 255.255.255.0
shiyan(config-if)#no sh
shiyan(config-if)#exit
shiyan(config)#ip route 10.10.1.0 255.255.255.0 192.168.1.10
shiyan(config)#ip route 10.10.2.0 255.255.255.0 192.168.1.10
shiyan(config)#do sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
172.16.0.0/24 is subnetted, 1 subnets
C 172.16.1.0 is directly connected, Ethernet0/1
10.0.0.0/24 is subnetted, 2 subnets
S 10.10.1.0 [1/0] via 192.168.1.10
S 10.10.2.0 [1/0] via 192.168.1.10
C 192.168.1.0/24 is directly connected, Ethernet0/0
測試路由器配置
ceshi>en
ceshi#conf t
Enter configuration commands, one per line. End with CNTL/Z.
ceshi(config)#int e0/0
ceshi(config-if)#ip address 172.16.1.10 255.255.255.0
ceshi(config-if)#no sh
ceshi(config-if)#exit
ceshi(config)#ip route 0.0.0.0 0.0.0.0 172.16.1.1
ceshi(config)#do sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 172.16.1.1 to network 0.0.0.0
172.16.0.0/24 is subnetted, 1 subnets
C 172.16.1.0 is directly connected, Ethernet0/0
S* 0.0.0.0/0 [1/0] via 172.16.1.1
標準ACL:
允許10.10.1.0子網內的主機訪問測試服務器
拒絕10.10.2.0子網內的主機訪問測試服務器
在實驗路由器上加命令
access-list 1 permit 10.10.1.10 0.0.0.255
interface f0/0
ip access-group 1 in
2.擴展ACL
允許網段一及網段二ping通測試服務器
允許網段一但不允許網段二訪問內部網絡的TELNET服務
在實驗路由器上加命令
access-list 101 permit icmp any any echo
access-list 101 permit icmp any any echo-reply
access-list 101 permit tcp 10.10.1.0 0.0.0.255 172.16.1.0 0.0.0.255 eq 23
interface f0/0
ip access-group 101 in
在測試服務器上
enable password 123
line vty 0 4
password 123
login
在PC1和PC2上ping測試服務器，再telnet
查看ACL
show access-list
show ip route
本文出自 “DY” 博客，請務必保留此出處http://guochenyong.blog.51cto.com/11367898/1973194
Cisco訪問控制列表