实验十八——————ACL配置2

实验内容


  • 完成各设备配置是的全网互通
  • 在R2上部部署标准访问控制列表,只允许192.168.12.0/24网段的用户穿越R2访问3.3.3.3,其他进入R2 S0/0接口的流量全部丢弃。
  • 在R2上部署ACL,只允许从1.1.1.1到3.3.3.3的ICMP流量以及R1到3.3.3.3的Telnet流量经过
  • 经过R2,其他从R2的S0/0接口进入的流量过滤掉

实验目的

掌握标准ACL的配置

理解标准ACL的接入控制中的应用

实验步骤

要求一:

绘制网络拓扑图如下所示:


IP基本地址信息为:

PC1 的IP地址:1.1.1.1  网关地址:1.1.1.254
PC2 的IP地址:3.3.3.3  网关地址:3.3.3.254
路由器地址信息为:

路由器其他配置信息

R1:


R2:


R3:

连通性测试

PC>ipconfig

FastEthernet0 Connection:(default port)

   Link-local IPv6 Address.........: FE80::204:9AFF:FEB1:913D
   IP Address......................: 1.1.1.1
   Subnet Mask.....................: 255.255.255.0
   Default Gateway.................: 1.1.1.254

PC>ping 1.1.1.254

Pinging 1.1.1.254 with 32 bytes of data:

Reply from 1.1.1.254: bytes=32 time=0ms TTL=255
Reply from 1.1.1.254: bytes=32 time=0ms TTL=255
Reply from 1.1.1.254: bytes=32 time=1ms TTL=255
Reply from 1.1.1.254: bytes=32 time=0ms TTL=255

Ping statistics for 1.1.1.254:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 1ms, Average = 0ms

PC>ping 192.168.12.1

Pinging 192.168.12.1 with 32 bytes of data:

Reply from 192.168.12.1: bytes=32 time=0ms TTL=255
Reply from 192.168.12.1: bytes=32 time=0ms TTL=255
Reply from 192.168.12.1: bytes=32 time=0ms TTL=255
Reply from 192.168.12.1: bytes=32 time=0ms TTL=255

Ping statistics for 192.168.12.1:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms

PC>ping 192.168.12.2

Pinging 192.168.12.2 with 32 bytes of data:

Reply from 192.168.12.2: bytes=32 time=1ms TTL=254
Reply from 192.168.12.2: bytes=32 time=5ms TTL=254
Reply from 192.168.12.2: bytes=32 time=4ms TTL=254
Reply from 192.168.12.2: bytes=32 time=5ms TTL=254

Ping statistics for 192.168.12.2:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 1ms, Maximum = 5ms, Average = 3ms

PC>ping 192.168.23.2

Pinging 192.168.23.2 with 32 bytes of data:

Reply from 192.168.23.2: bytes=32 time=1ms TTL=254
Reply from 192.168.23.2: bytes=32 time=1ms TTL=254
Reply from 192.168.23.2: bytes=32 time=2ms TTL=254
Reply from 192.168.23.2: bytes=32 time=5ms TTL=254

Ping statistics for 192.168.23.2:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 1ms, Maximum = 5ms, Average = 2ms

PC>ping 192.168.23.3

Pinging 192.168.23.3 with 32 bytes of data:

Reply from 192.168.23.3: bytes=32 time=12ms TTL=253
Reply from 192.168.23.3: bytes=32 time=2ms TTL=253
Reply from 192.168.23.3: bytes=32 time=2ms TTL=253
Reply from 192.168.23.3: bytes=32 time=14ms TTL=253

Ping statistics for 192.168.23.3:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 2ms, Maximum = 14ms, Average = 7ms

PC>ping 3.3.3.3.
PC>ping 3.3.3.3

Pinging 3.3.3.3 with 32 bytes of data:

Request timed out.
Reply from 3.3.3.3: bytes=32 time=7ms TTL=125
Reply from 3.3.3.3: bytes=32 time=2ms TTL=125
Reply from 3.3.3.3: bytes=32 time=3ms TTL=125

Ping statistics for 3.3.3.3:
    Packets: Sent = 4, Received = 3, Lost = 1 (25% loss),
Approximate round trip times in milli-seconds:
    Minimum = 2ms, Maximum = 7ms, Average = 4ms

PC>

基于以上验证,说明全网通!

要求二:

在R2上部署标准访问控制列表只允许192.168.12.0/24网段的用户穿越R2访问3.3.3.3,其他进入R2 s0/0/0接口的流量全部丢弃。

R2的配置如下:


用ip地址为192.168.12.1的R1测试的时候发现可以ping通


用PC1(ip地址为1.1.1.1),发现不可以ping通


结论:发现其他进入R2 s0/0/0接口的流量全部丢弃,无法到达3.3.3.3。

要求三:

在R2上部署ACL,只允许从1.1.1.1到3.3.3.3的ICMP流量以及R1到3.3.3.3的telnet流经过R2,其他从R2 s0/0/0接口进入的流量过滤掉。

R2的配置如下:


开启R3的Telnet:


测试:


由测试内容我们可以发现ICMP的流量可以到达3.3.3.3,同时可以Telnet到3.3.3.3


至此,该实验结束!

猜你喜欢

转载自blog.csdn.net/fly_hps/article/details/80500357