ACL訪問控制列表配置實例(二)
命名訪問控制列表
- 需求
- 容許vlan10中PC2主機能夠訪問PC1
- 拒絕vlan10中其餘主機訪問PC1
- 容許其餘網段中的主機訪問PC1
一、在GNS 3中構建拓撲實驗，並在拓撲區域標出主機接口、IP地址、需求、網關等信息，如圖所示：ide
二、開啓所有設備，並先在交換設中配置vlan信息測試
sw#conf t //進入接口模式
Enter configuration commands, one per line. End with CNTL/Z.
sw(config)#vlan 10,20 //添加vlan
sw(config-vlan)#ex //退出vlan接口
sw(config)#do show vlan-sw b //查看vlan
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Fa1/0, Fa1/1, Fa1/2, Fa1/3
Fa1/4, Fa1/5, Fa1/6, Fa1/7
Fa1/8, Fa1/9, Fa1/10, Fa1/11
Fa1/12, Fa1/13, Fa1/14, Fa1/15
10 VLAN0010 active
20 VLAN0020 active
1002 fddi-default act/unsup
1003 token-ring-default act/unsup
1004 fddinet-default act/unsup
1005 trnet-default act/unsup
sw(config)#int range fa1/1 -2 //進入f1/一、f1/2接口模式
sw(config-if-range)#sw mo acc
sw(config-if-range)#sw access vlan 10 //將接口添加到vlan10中
sw(config-if-range)#ex
sw(config)#do show vlan-sw b //查看接口是否加入vlan
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Fa1/0, Fa1/3, Fa1/4, Fa1/5
Fa1/6, Fa1/7, Fa1/8, Fa1/9
Fa1/10, Fa1/11, Fa1/12, Fa1/13
Fa1/14, Fa1/15
10 VLAN0010 active Fa1/1, Fa1/2 //成功添加
20 VLAN0020 active
1002 fddi-default act/unsup
1003 token-ring-default act/unsup
1004 fddinet-default act/unsup
1005 trnet-default act/unsup
sw(config)#int f1/3 //進入f1/3接口
sw(config-if)#sw mo acc
sw(config-if)#sw acc vlan 20 //將接口加入vlan20
sw(config-if)#ex
sw(config)#do show vlan-sw b //查看
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Fa1/0, Fa1/4, Fa1/5, Fa1/6
Fa1/7, Fa1/8, Fa1/9, Fa1/10
Fa1/11, Fa1/12, Fa1/13, Fa1/14
Fa1/15
10 VLAN0010 active Fa1/1, Fa1/2
20 VLAN0020 active Fa1/3 //成功添加
1002 fddi-default act/unsup
1003 token-ring-default act/unsup
1004 fddinet-default act/unsup
1005 trnet-default act/unsup
sw(config)#int f1/0 //進入f1/0接口
sw(config-if)#sw mo t //作trunk鏈路
sw(config-if)#
*Mar 1 00:06:52.483: %DTP-5-TRUNKPORTON: Port Fa1/0 has become dot1q trunk
sw(config-if)#sw t encapsulation dot1q //封裝trunk協議
sw(config-if)#ex
sw(config)#no ip routing //關閉路由功能
三、進入三層交換設備，添加接口IP地址，code
sw-3#conf t //進入全局模式
Enter configuration commands, one per line. End with CNTL/Z.
sw-3(config)#int f1/1 //進入f1/1接口
sw-3(config-if)#no switchport //關閉交換功能
*Mar 1 00:11:19.435: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/1, changed state to up
sw-3(config-if)#ip add 192.168.100.1 255.255.255.0 //添加IP網關地址
sw-3(config-if)#no shut //開啓接口
sw-3(config-if)#do show ip int b //查看
Interface IP-Address OK? Method Status Protocol
FastEthernet0/0 unassigned YES unset administratively down down
FastEthernet0/1 unassigned YES unset administratively down down
FastEthernet1/0 unassigned YES unset up up
FastEthernet1/1 192.168.100.1 YES manual up up //成功添加IP網關地址
FastEthernet1/2 unassigned YES unset up down
FastEthernet1/3 unassigned YES unset up down
FastEthernet1/4 unassigned YES unset up down
FastEthernet1/5 unassigned YES unset up down
FastEthernet1/6 unassigned YES unset up down
FastEthernet1/7 unassigned YES unset up down
FastEthernet1/8 unassigned YES unset up down
sw-3(config-if)#ex
sw-3(config)#vlan 10,20 //添加vlan
sw-3(config-vlan)#int vlan 10 //進入vlan 10
sw-3(config-if)#ip add 192.168.10.1 255.255.255.0 //添加IP地址
sw-3(config-if)#no shut //開啓接口
sw-3(config-if)#ex
sw-3(config)#int vlan 20 //進入vlan 20
sw-3(config-if)#ip add 192.168.20.1 255.255.255.0 //添加IP地址
sw-3(config-if)#no shut //開啓接口
sw-3(config-if)#ex
sw-3(config)#do show ip int b //查看
Interface IP-Address OK? Method Status Protocol
FastEthernet0/0 unassigned YES unset administratively down down
FastEthernet0/1 unassigned YES unset administratively down down
FastEthernet1/0 unassigned YES unset up up
FastEthernet1/1 192.168.100.1 YES manual up up //成功添加IP網關地址
FastEthernet1/2 unassigned YES unset up down
FastEthernet1/3 unassigned YES unset up down
FastEthernet1/4 unassigned YES unset up down
FastEthernet1/5 unassigned YES unset up down
FastEthernet1/6 unassigned YES unset up down
FastEthernet1/7 unassigned YES unset up down
FastEthernet1/8 unassigned YES unset up down
FastEthernet1/9 unassigned YES unset up down
FastEthernet1/10 unassigned YES unset up down
FastEthernet1/11 unassigned YES unset up down
FastEthernet1/12 unassigned YES unset up down
FastEthernet1/13 unassigned YES unset up down
FastEthernet1/14 unassigned YES unset up down
FastEthernet1/15 unassigned YES unset up down
Vlan1 unassigned YES unset up up
Vlan10 192.168.10.1 YES manual up down //網關添加成功
Vlan20 192.168.20.1 YES manual up down
sw-3(config)#int f1/0 //進入f1/0接口
sw-3(config-if)#sw mo t //製做trunk鏈路
*Mar 1 00:16:07.979: %DTP-5-TRUNKPORTON: Port Fa1/0 has become dot1q trunk
*Mar 1 00:16:08.483: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan10, changed state to up
*Mar 1 00:16:08.483: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan20, changed state to up
sw-3(config-if)#sw t encapsulation dot1q //封裝trunk協議
sw-3(config-if)#do show ip rout //查看路由表
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
C 192.168.10.0/24 is directly connected, Vlan10
C 192.168.20.0/24 is directly connected, Vlan20 //成功添加路由表
C 192.168.100.0/24 is directly connected, FastEthernet1/1
四、在PC機上分別配置IP地址，並測試四臺PC機的互通性blog
PC1> ip 192.168.100.100 192.168.100.1 Checking for duplicate address... PC1 : 192.168.100.100 255.255.255.0 gateway 192.168.100.1
PC2> ip 192.168.10.10 192.168.10.1 Checking for duplicate address... PC1 : 192.168.10.10 255.255.255.0 gateway 192.168.10.1
PC3> ip 192.168.10.20 192.168.10.1 Checking for duplicate address... PC1 : 192.168.10.20 255.255.255.0 gateway 192.168.10.1
PC4> ip 192.168.20.20 192.168.20.1 Checking for duplicate address... PC1 : 192.168.20.20 255.255.255.0 gateway 192.168.20.1
PC2> ping 192.168.100.100 192.168.100.100 icmp_seq=1 timeout 192.168.100.100 icmp_seq=2 timeout 84 bytes from 192.168.100.100 icmp_seq=3 ttl=63 time=21.556 ms 84 bytes from 192.168.100.100 icmp_seq=4 ttl=63 time=15.601 ms 84 bytes from 192.168.100.100 icmp_seq=5 ttl=63 time=22.945 ms PC2> ping 192.168.10.20 84 bytes from 192.168.10.20 icmp_seq=1 ttl=64 time=0.000 ms 84 bytes from 192.168.10.20 icmp_seq=2 ttl=64 time=0.000 ms 84 bytes from 192.168.10.20 icmp_seq=3 ttl=64 time=0.000 ms 84 bytes from 192.168.10.20 icmp_seq=4 ttl=64 time=0.000 ms 84 bytes from 192.168.10.20 icmp_seq=5 ttl=64 time=0.000 ms PC2> ping 192.168.20.20 84 bytes from 192.168.20.20 icmp_seq=1 ttl=63 time=16.954 ms 84 bytes from 192.168.20.20 icmp_seq=2 ttl=63 time=20.944 ms 84 bytes from 192.168.20.20 icmp_seq=3 ttl=63 time=23.487 ms 84 bytes from 192.168.20.20 icmp_seq=4 ttl=63 time=13.997 ms 84 bytes from 192.168.20.20 icmp_seq=5 ttl=63 time=18.998 ms
五、在三層交換設備中配置命令訪問控制列表token
sw-3(config-if)#ex
sw-3(config)#ip access-list standard kgc //配置命名訪問控制列表
sw-3(config-std-nacl)#permit host 192.168.10.10 //容許PC2主機訪問
sw-3(config-std-nacl)#deny 192.168.10.0 0.0.0.255 //拒接10.0網段訪問
sw-3(config-std-nacl)#permit any //容許全部網段訪問
sw-3(config)#do show access-lists //查看列表
Standard IP access list kgc
10 permit 192.168.10.10
20 deny 192.168.10.0, wildcard bits 0.0.0.255 //成功添加
30 permit any
sw-3(config)#int f1/1 //進入f1/1接口
sw-3(config-if)#ip access-group kgc out //在出口位置應用列表
六、測試配置的命名訪問控制列表是否生效接口
PC2> ping 192.168.100.100 //使用PC2測試與PC1通訊，正常通訊 192.168.100.100 icmp_seq=1 timeout 192.168.100.100 icmp_seq=2 timeout 84 bytes from 192.168.100.100 icmp_seq=3 ttl=63 time=15.957 ms 84 bytes from 192.168.100.100 icmp_seq=4 ttl=63 time=17.958 ms 84 bytes from 192.168.100.100 icmp_seq=5 ttl=63 time=18.953 ms
PC4> ping 192.168.100.100 //使用使用PC4測試與PC1通訊，正常通訊 84 bytes from 192.168.100.100 icmp_seq=1 ttl=63 time=19.021 ms 84 bytes from 192.168.100.100 icmp_seq=2 ttl=63 time=24.934 ms 84 bytes from 192.168.100.100 icmp_seq=3 ttl=63 time=15.957 ms 84 bytes from 192.168.100.100 icmp_seq=4 ttl=63 time=14.960 ms 84 bytes from 192.168.100.100 icmp_seq=5 ttl=63 time=18.023 ms
PC3> ping 192.168.100.100 //使用使用PC3測試與PC1通訊時顯示拒絕訪問，配置成功 *192.168.10.1 icmp_seq=1 ttl=255 time=8.033 ms (ICMP type:3, code:13, Communication administratively prohibited) *192.168.10.1 icmp_seq=2 ttl=255 time=12.965 ms (ICMP type:3, code:13, Communication administratively prohibited) *192.168.10.1 icmp_seq=3 ttl=255 time=11.004 ms (ICMP type:3, code:13, Communication administratively prohibited) *192.168.10.1 icmp_seq=4 ttl=255 time=10.998 ms (ICMP type:3, code:13, Communication administratively prohibited) *192.168.10.1 icmp_seq=5 ttl=255 time=12.966 ms (ICMP type:3, code:13, Communication administratively prohibited)
七、經過序列號添加列表條目，使PC3也能夠與PC1通訊ip
sw-3(config-if)#ex
sw-3(config)#ip access-list standard kgc //配置命名訪問控制列表
sw-3(config-std-nacl)#12 permit host 192.168.10.20 //添加條目號爲12的條目，容許PC3訪問
sw-3(config-std-nacl)#ex
sw-3(config)#do show access-lists //查看列表信息
Standard IP access list kgc
10 permit 192.168.10.10 (5 matches)
12 permit 192.168.10.20 //成添加
20 deny 192.168.10.0, wildcard bits 0.0.0.255 (10 matches)
30 permit any (5 matches)
八、測試是否配置成功路由
PC3> ping 192.168.100.100 //使用使用PC3測試與PC1通訊，正常通訊 192.168.100.100 icmp_seq=1 timeout 192.168.100.100 icmp_seq=2 timeout 84 bytes from 192.168.100.100 icmp_seq=3 ttl=63 time=22.997 ms 84 bytes from 192.168.100.100 icmp_seq=4 ttl=63 time=21.008 ms 84 bytes from 192.168.100.100 icmp_seq=5 ttl=63 time=15.957 ms
九、刪除添加的條目it
sw-3(config)#ip access-list standard kgc //配置命名訪問控制列表
sw-3(config-std-nacl)#no 12 //刪除列表中12的條目
sw-3(config-std-nacl)#ex
sw-3(config)#do show access-lists //查看列表
Standard IP access list kgc
10 permit 192.168.10.10 (5 matches)
20 deny 192.168.10.0, wildcard bits 0.0.0.255 (10 matches)
30 permit any (5 matches) //成功刪除
十、測試結果io
PC3> ping 192.168.100.100 *192.168.10.1 icmp_seq=1 ttl=255 time=8.973 ms (ICMP type:3, code:13, Communication administratively prohibited) *192.168.10.1 icmp_seq=2 ttl=255 time=4.981 ms (ICMP type:3, code:13, Communication administratively prohibited) *192.168.10.1 icmp_seq=3 ttl=255 time=10.971 ms (ICMP type:3, code:13, Communication administratively prohibited) *192.168.10.1 icmp_seq=4 ttl=255 time=8.552 ms (ICMP type:3, code:13, Communication administratively prohibited) *192.168.10.1 icmp_seq=5 ttl=255 time=2.993 ms (ICMP type:3, code:13, Communication administratively prohibited)
相關文章
- 1. ensp ACL訪問控制列表配置
- 2. ACL訪問控制列表配置實例 (一)
- 3. ACL訪問控制列表案例
- 4. 訪問控制列表ACL
- 5. 訪問控制列表（ACL）
- 6. ACL（訪問控制列表）
- 7. ACL 訪問控制列表
- 8. ACL訪問控制列表
- 9. ACL——訪問控制列表
- 10. 訪問控制列表——ACL
- 更多相關文章...
- • Swift 訪問控制 - Swift 教程
- • Eclipse Debug 配置 - Eclipse 教程
- • IntelliJ IDEA 代碼格式化配置和快捷鍵
- • IDEA下SpringBoot工程配置文件沒有提示
相關標籤/搜索
每日一句
-
每一个你不满意的现在，都有一个你没有努力的曾经。
最新文章
- 1. js中 charCodeAt
- 2. Android中通過ViewHelper.setTranslationY實現View移動控制（NineOldAndroids開源項目）
- 3. 【Android】日常記錄：BottomNavigationView自定義樣式，修改點擊後圖片
- 4. maya 文件檢查 ui和數據分離 （一）
- 5. eclipse 修改項目的jdk版本
- 6. Android InputMethod設置
- 7. Simulink中Bus Selector出現很多? ? ?
- 8. 【Openfire筆記】啓動Mac版Openfire時提示「系統偏好設置錯誤」
- 9. AutoPLP在偏好標籤中的生產與應用
- 10. 數據庫關閉的四種方式
歡迎關注本站公眾號,獲取更多信息
相關文章
- 1. ensp ACL訪問控制列表配置
- 2. ACL訪問控制列表配置實例 (一)
- 3. ACL訪問控制列表案例
- 4. 訪問控制列表ACL
- 5. 訪問控制列表（ACL）
- 6. ACL（訪問控制列表）
- 7. ACL 訪問控制列表
- 8. ACL訪問控制列表
- 9. ACL——訪問控制列表
- 10. 訪問控制列表——ACL