实验名称: 华为ACL综合实验

拓扑图如下:

准备条件如下：
4台路由器
三台客户机
一台服务器
======================================================
192.168.10.1/24       WG网关的IP地址
192.168.20.1/24       YF客户机IP地址
192.168.30.1/24       CW客户机IP地址
192.168.1.1/24       server服务器的IP地址
=======================================================
网管部门:
<Huawei>system-view       //进系统视图
[Huawei]sysname WG       //修改主机名为WG
[WG]INT G0/0/0           //进入g0/0/0接口
[WG-GigabitEthernet0/0/0]ip address 192.168.10.1 24           //配置IP地址和子网掩码
[WG]ip route-static 0.0.0.0 0.0.0.0 192.168.10.254           //写静态路由下一条地址为192.168.10.254
==========================================================
AR-2:
<Huawei>system-view       //进系统视图
[Huawei]sysname AR-2   //修改主机名为AR-2
[AR-2]int g0/0/1       //进入g0/0/1接口
[AR-2-GigabitEthernet0/0/1]ip address 192.168.10.254 24       //配置IP地址和子网掩码
[AR-2-GigabitEthernet0/0/1]int g0/0/2           //切换接口
[AR-2-GigabitEthernet0/0/2]ip address 192.168.20.254 24       //配置IP地址和子网掩码
[AR-2-GigabitEthernet0/0/2]int g0/0/0           //切换接口
[AR-2-GigabitEthernet0/0/0]ip address 192.168.12.2 30       //配置IP地址和子网掩码
[AR-2]ip route-static 0.0.0.0 0.0.0.0 192.168.12.1       //写静态路由下一条地址为192.168.12.1
[AR-2]acl 3000       //创建高级acl 3000
[AR-2-acl-adv-3000]rule 10 permit ip source 192.168.20.1 0 destination 192.168.10.1 0   //允许192.168.20.1和 192.168.10.1 之间的流量通过
[AR-2-acl-adv-3000]rule 20 permit ip source 192.168.20.1 0 destination 1.1.1.1 0       /// 允许 192.168.20.1 和 1.1.1.1 之间的流量通过
[AR-2-acl-adv-3000]rule 30 permit tcp source 192.168.20.1 0 destination 192.168.1.1 0 destination-port eq 80   //允许 192.168.20.1 只能访问 192.168.1.1的web 服务
[AR-2-acl-adv-3000]rule 40 deny ip source 192.168.20.1 0 destination any       //拒绝其他流量通过
[AR-2-acl-adv-3000]q   //退到上一层
[AR-2]int g0/0/2       //进入g0/0/2接口
[AR-2-GigabitEthernet0/0/2]traffic-filter inbound acl 3000       //入方向调用高级ACL 3000
==========================================================
AR-3：
<Huawei>system-view    //进系统视图
[Huawei]sysname AR-3   //修改主机名为AR-3
[AR-3]int g0/0/1       //进入g0/0/1接口
[AR-3-GigabitEthernet0/0/1]ip address 192.168.30.254 24       //配置IP地址和子网掩码
[AR-3-GigabitEthernet0/0/1]int g0/0/2           //切换接口
[AR-3-GigabitEthernet0/0/2]ip address 192.168.1.254 24       //配置IP地址和子网掩码
[AR-3-GigabitEthernet0/0/2]int g0/0/0           //切换接口
[AR-3-GigabitEthernet0/0/0]ip address 192.168.13.2 30       //配置IP地址和子网掩码
[AR-3]ip route-static 0.0.0.0 0.0.0.0 192.168.13.1       //写静态路由下一条地址为192.168.13.1
[AR-3]acl 3000       //创建高级acl 3000
[AR-3-acl-adv-3000]rule 10 permit ip source 192.168.30.1 0 destination 192.168.10.1 0   //允许 192.168.30.1 和 192.168.10.1 之间的流量通过
[AR-3-acl-adv-3000]rule 20 permit tcp source 192.168.30.1 0 destination 192.168.1.1 0 destination-port eq 80   //允许 192.168.30.1 能访问 192.168.1.1 之间的 web 流量
[AR-3-acl-adv-3000]rule 30 deny ip source 192.168.30.1 0 destination any       //拒绝其他流量通过
[AR-3-acl-adv-3000]q   //退到上一层
[AR-3]int g0/0/1   //进入g0/0/1接口
[AR-3-GigabitEthernet0/0/1]traffic-filter inbound acl 3000       //在接口上调用高级acl 3000
============================================================
AR-1:
<Huawei>system-view    //进系统视图
[Huawei]sysname AR-1   //修改主机名为AR-1
[AR-1]int g0/0/1       //进入g0/0/1接口
[AR-1-GigabitEthernet0/0/1]ip address 192.168.12.1 30       //配置IP地址和子网掩码
[AR-1-GigabitEthernet0/0/1]int g0/0/2       //切换接口
[AR-1-GigabitEthernet0/0/2]ip address 192.168.13.1 30       //配置IP地址和子网掩码
[AR-1-GigabitEthernet0/0/2]int g0/0/0       //切换接口
[AR-1-GigabitEthernet0/0/0]ip address 1.1.1.254 24           //配置IP地址和子网掩码
[AR-1]ip route-static 192.168.10.0 24 192.168.12.2           //写默认路由从192.168.10.0网段去往192.168.12.2
[AR-1]ip route-static 192.168.20.0 24 192.168.12.2           //写默认路由从192.168.20.0网段去往192.168.12.2
[AR-1]ip route-static 192.168.30.0 24 192.168.13.2           //写默认路由从192.168.30.0网段去往192.168.13.2
[AR-1]ip route-static 192.168.1.0 24 192.168.13.2           //写默认路由从192.168.1.0网段去往192.168.13.2
[AR-1]acl 2000           //创建基础acl 2000
[AR-1-acl-basic-2000]rule 5 permit source 192.168.10.1 0   //允许192.168.10.1流量
[AR-1-acl-basic-2000]q       //退到上一层
[AR-1]aaa       //进入aaa
[AR-1-aaa]local-user admin password cipher root       //创建用户名admin 设置密码root
[AR-1-aaa]local-user admin service-type telnet       //给admin开启telnet远程权限
[AR-1-aaa]q       //退到上一层
[AR-1]user-interface vty 0 4   //进入vty 0 4
[AR-1-ui-vty0-4]authentication-mode aaa           //认证AAA认证
[AR-1-ui-vty0-4]acl 2000 inbound        //在vty模式进行入方向操作
============================================================
验证并测试:
研发部ping网管路由可以ping通如下图