PacketTracer52实验十二标准IP访问控制列表配置解读.docx
- 文档编号:27999948
- 上传时间:2023-07-07
- 格式:DOCX
- 页数:12
- 大小:39.42KB
PacketTracer52实验十二标准IP访问控制列表配置解读.docx
《PacketTracer52实验十二标准IP访问控制列表配置解读.docx》由会员分享,可在线阅读,更多相关《PacketTracer52实验十二标准IP访问控制列表配置解读.docx(12页珍藏版)》请在冰豆网上搜索。
PacketTracer52实验十二标准IP访问控制列表配置解读
课题:
标准IP访问控制列表配置
教学目标
∙理解标准IP访问控制列表的原理及功能;
∙掌握编号的标准IP访问控制列表的配置方法;
教学重点:
理解标准IP访问控制列表的原理及功能
教学难点:
掌握编号的标准IP访问控制列表的配置方法
教具、教学素材准备:
网络环境
教学方法:
讲授,演示,实作
教学时数:
2
公司的经理部、财务部和销售部分别属于不同的3个网段,三部门之间用路由器进行信息传递,为了安全起见,公司领导要求销售部不能对财务部进行访问,但经理部可以对财务部进行访问。
基本原理
ACLs的全称为接入控制列表(AccessControlLists),也称为访问列表(AccessList),俗称为防火墙,在有的文档中还称之为包过滤。
ACLs通过定义一些规则对网络设备接口上的数据报文进行控制:
允许通过或丢弃,从而提高网络可管理性和安全性;
IPACL分为两种:
标准IP访问列表和扩展IP访问列表,编号范围分别为1~99、1300~1999,100~199、2000~2699;
标准IP访问列表可以根据数据包的源IP地址定义规则,进行数据包的过滤;
扩展IP访问列表可以根据数据包的源IP、目的IP、源端口、目的端口、协议来定义规则,进行数据包的过滤;
IPACL基于接口进行规则的应用,分为:
入栈应用和出栈应用;
教学过程
实验拓扑
1、路由器之间通过V.35电缆串口连接,DCE端连接在R1上,配置其时间频率为64000;主机与路由器通过交叉线连接;
2、配置路由器接口IP地址;
3、在路由器上配置OSPF路由协议,让三台PC能相互ping通,因为只有在互通的前提下才能涉及到访问控制列表;
4、在R1上配置编号的IP标准访问控制列表;
5、将标准IP访问列表应用到接口上;
6、验证主机之间的互通性;
R1:
Router>en
Router#conft
Enterconfigurationcommands,oneperline.EndwithCNTL/Z.
Router(config)#hostnameR1
R1(config)#interfacefa1/0
R1(config-if)#ipaddress192.168.1.1255.255.255.0
R1(config-if)#noshut
%LINK-5-CHANGED:
InterfaceFastEthernet1/0,changedstatetoup
%LINEPROTO-5-UPDOWN:
LineprotocolonInterfaceFastEthernet1/0,changedstatetoup
R1(config-if)#exit
R1(config)#intfa0/0
R1(config-if)#ipadd192.168.2.1255.255.255.0
R1(config-if)#noshut
%LINK-5-CHANGED:
InterfaceFastEthernet0/0,changedstatetoup
%LINEPROTO-5-UPDOWN:
LineprotocolonInterfaceFastEthernet0/0,changedstatetoup
R1(config-if)#exit
R1(config)#intse2/0
R1(config-if)#clockrate64000
R1(config-if)#ipadd192.168.3.1255.255.255.0
R1(config-if)#noshut
%LINK-5-CHANGED:
InterfaceSerial2/0,changedstatetodown
R1(config-if)#exit
R1(config)#
R1(config)#routerospf1
R1(config-router)#network192.168.1.00.0.0.255area0
R1(config-router)#network192.168.2.00.0.0.255area0
R1(config-router)#network192.168.3.00.0.0.255area0
R1(config-router)#end
R1#
%SYS-5-CONFIG_I:
Configuredfromconsolebyconsole
R1#showiproute
Codes:
C-connected,S-static,I-IGRP,R-RIP,M-mobile,B-BGP
D-EIGRP,EX-EIGRPexternal,O-OSPF,IA-OSPFinterarea
N1-OSPFNSSAexternaltype1,N2-OSPFNSSAexternaltype2
E1-OSPFexternaltype1,E2-OSPFexternaltype2,E-EGP
i-IS-IS,L1-IS-ISlevel-1,L2-IS-ISlevel-2,ia-IS-ISinterarea
*-candidatedefault,U-per-userstaticroute,o-ODR
P-periodicdownloadedstaticroute
Gatewayoflastresortisnotset
C192.168.1.0/24isdirectlyconnected,FastEthernet1/0
C192.168.2.0/24isdirectlyconnected,FastEthernet0/0
R1#
R1#
R1#showiproute//两台路由器配置好后的路由信息
Codes:
C-connected,S-static,I-IGRP,R-RIP,M-mobile,B-BGP
D-EIGRP,EX-EIGRPexternal,O-OSPF,IA-OSPFinterarea
N1-OSPFNSSAexternaltype1,N2-OSPFNSSAexternaltype2
E1-OSPFexternaltype1,E2-OSPFexternaltype2,E-EGP
i-IS-IS,L1-IS-ISlevel-1,L2-IS-ISlevel-2,ia-IS-ISinterarea
*-candidatedefault,U-per-userstaticroute,o-ODR
P-periodicdownloadedstaticroute
Gatewayoflastresortisnotset
C 192.168.1.0/24isdirectlyconnected,FastEthernet1/0
C 192.168.2.0/24isdirectlyconnected,FastEthernet0/0
C 192.168.3.0/24isdirectlyconnected,Serial2/0
O 192.168.4.0/24[110/782]via192.168.3.2,00:
00:
15,Serial2/0
R1#
R1#conft
Enterconfigurationcommands,oneperline. EndwithCNTL/Z.
R1(config)#ip?
access-list Namedaccess-list
default-network Flagsnetworksascandidatesfordefaultroutes
dhcp ConfigureDHCPserverandrelayparameters
domain IPDNSResolver
domain-lookup EnableIPDomainNameSystemhostnametranslation
domain-name Definethedefaultdomainname
forward-protocol ControlsforwardingofphysicalanddirectedIPbroadcasts
host Addanentrytotheiphostnametable
name-server Specifyaddressofnameservertouse
nat NATconfigurationcommands
route Establishstaticroutes
tcp GlobalTCPparameters
R1(config)#ipac
R1(config)#ipaccess-list?
extended ExtendedAccessList
standard StandardAccessList
R1(config)#ipaccess-liststa
R1(config)#ipaccess-liststandard?
<1-99> StandardIPaccess-listnumber
WORD Access-listname
R1(config)#ipaccess-liststandarddavid?
R1(config)#ipaccess-liststandarddavid//配置名为david的IP标准访问控制列表
R1(config-std-nacl)#?
default Setacommandtoitsdefaults
deny Specifypacketstoreject
exit Exitfromaccess-listconfigurationmode
no Negateacommandorsetitsdefaults
permit Specifypacketstoforward
remark Accesslistentrycomment
R1(config-std-nacl)#permit192.168.1.0?
A.B.C.D Wildcardbits
R1(config-std-nacl)#permit192.168.1.00.0.0.255?
R1(config-std-nacl)#permit192.168.1.00.0.0.255//允许192.168.1.0网段通过
R1(config-std-nacl)#deny?
A.B.C.D Addresstomatch
any Anysourcehost
host Asinglehostaddress
R1(config-std-nacl)#deny192.168.2.0?
A.B.C.D Wildcardbits
R1(config-std-nacl)#deny192.168.2.00.0.0.255?
R1(config-std-nacl)#deny192.168.2.00.0.0.255//禁止192.168.2.0网段通过
R1(config-std-nacl)#exit
R1(config)#inter
R1(config)#interfacese2/0
R1(config-if)#?
bandwidth Setbandwidthinformationalparameter
cdp CDPinterfacesubcommands
clock Configureserialinterfaceclock
crypto Encryption/Decryptioncommands
custom-queue-list Assignacustomqueuelisttoaninterface
delay Specifyinterfacethroughputdelay
description Interfacespecificdescription
encapsulation Setencapsulationtypeforaninterface
exit Exitfrominterfaceconfigurationmode
fair-queue EnableFairQueuingonanInterface
frame-relay Setframerelayparameters
hold-queue Setholdqueuedepth
ip InterfaceInternetProtocolconfigcommands
keepalive Enablekeepalive
mtu SettheinterfaceMaximumTransmissionUnit(MTU)
no Negateacommandorsetitsdefaults
ppp Point-to-PointProtocol
priority-group Assignaprioritygrouptoaninterface
service-policy ConfigureQoSServicePolicy
shutdown Shutdowntheselectedinterface
tx-ring-limit ConfigurePAleveltransmitringlimit
zone-member Applyzonename
R1(config-if)#ip?
access-group Specifyaccesscontrolforpackets
address SettheIPaddressofaninterface
hello-interval ConfiguresIP-EIGRPhellointerval
helper-address SpecifyadestinationaddressforUDPbroadcasts
inspect Applyinspectname
ips CreateIPSrule
mtu SetIPMaximumTransmissionUnit
nat NATinterfacecommands
ospf OSPFinterfacecommands
split-horizon Performsplithorizon
summary-address Performaddresssummarization
virtual-reassembly VirtualReassembly
R1(config-if)#ipac
R1(config-if)#ipaccess-group?
<1-199> IPaccesslist(standardorextended)
WORD Access-listname
R1(config-if)#ipaccess-groupdavid?
in inboundpackets
out outboundpackets
R1(config-if)#ipaccess-groupdavidout?
R1(config-if)#ipaccess-groupdavidout//将名为david的IP标准访问控制列表应用到se2/0端口
R1(config-if)#end
R1#
%SYS-5-CONFIG_I:
Configuredfromconsolebyconsole
R1#showrunning-config
Buildingconfiguration...
Currentconfiguration:
928bytes
!
version12.2
noservicetimestampslogdatetimemsec
noservicetimestampsdebugdatetimemsec
noservicepassword-encryption
!
hostnameR1
!
...
!
interfaceFastEthernet0/0
ipaddress192.168.2.1255.255.255.0
duplexauto
speedauto
!
interfaceFastEthernet1/0
ipaddress192.168.1.1255.255.255.0
duplexauto
speedauto
!
interfaceSerial2/0
ipaddress192.168.3.1255.255.255.0
ipaccess-groupdavidout
clockrate64000
!
interfaceSerial3/0
noipaddress
shutdown
!
interfaceFastEthernet4/0
noipaddress
shutdown
!
interfaceFastEthernet5/0
noipaddress
shutdown
!
routerospf1
log-adjacency-changes
network192.168.1.00.0.0.255area0
network192.168.2.00.0.0.255area0
network192.168.3.00.0.0.255area0
!
ipclassless
!
!
ipaccess-liststandarddavid
permit192.168.1.00.0.0.255
deny192.168.2.00.0.0.255
!
...
!
linecon0
linevty04
login
!
!
!
end
R1#
R2:
Router>en
Router#conft
Enterconfigurationcommands,oneperline.EndwithCNTL/Z.
Router(config)#hostnameR2
R2(config)#intfa0/0
R2(config-if)#ipadd192.168.4.1255.255.255.0
R2(config-if)#noshut
%LINK-5-CHANGED:
InterfaceFastEthernet0/0,changedstatetoup
%LINEPROTO-5-UPDOWN:
LineprotocolonInterfaceFastEthernet0/0,changedstatetoup
R2(config-if)#exit
R2(config)#intse2/0
R2(config-if)#ipadd192.168.3.2255.255.255.0
R2(config-if)#noshut
%LINK-5-CHANGED:
InterfaceSerial2/0,changedstatetoup
R2(config-if)#exit
R2(config)#routerospf1
R2(config-router)#
%LINEPROTO-5-UPDOWN:
LineprotocolonInterfaceSerial2/0,changedstatetoup
R2(config-router)#network192.168.3.00.0.0.255area0
R2(config-router)#network192.168.4.00.0.0.255area0
00:
11:
23:
%OSPF-5-ADJCHG:
Process1,Nbr192.168.3.1onSerial2/0fromLOADINGtoFULL,LoadingDo
R2(config-router)#end
R2#
%SYS-5-CONFIG_I:
Configuredfromconsolebyconsole
R2#showiproute
Codes:
C-connected,S-static,I-IGRP,R-RIP,M-mobile,B-BGP
D-EIGRP,EX-EIGRPexternal,O-OSPF,IA-OSPFinterarea
N1-OSPFNSSAexternaltype1,N2-OSPFNSSAexternaltype2
E1-OSPFexternaltype1,E2-OSPFexternaltype2,
- 配套讲稿:
如PPT文件的首页显示word图标,表示该PPT已包含配套word讲稿。双击word图标可打开word文档。
- 特殊限制:
部分文档作品中含有的国旗、国徽等图片,仅作为作品整体效果示例展示,禁止商用。设计者仅对作品中独创性部分享有著作权。
- 关 键 词:
- PacketTracer52 实验 十二 标准 IP 访问 控制 列表 配置 解读