1. Reference experimental background
A company has a management department, a sales department and a financial department, and the departments communicate through routers. Now it is required that the manager department can access the finance department, but the sales department cannot access the finance department. Please fulfill this requirement of the customer.
The network topology is shown in Figure 9-10.
Figure 9-10 ACLConfiguring network topology
2. Reference experimental steps
1. Connect the devices according to the network topology requirements
2. Configure the IP address and clock frequency of each router port and activate it
A(config)#interface serial 0
A(config-if)#ip address 172.16.1.2 255.255.255.0
A(config-if)#no shutdown
A(config)#interface fastethernet 0
A(config-if)#ip address 172.16.4.1 255.255.255.0
A(config-if)#no shutdown
A(config)#interface fastethernet 1
A(config-if)#ip address 172.16.3.1 255.255.255.0
A(config-if)#no shutdown
B(config)#interface serial 0
B(config-if)#ip address 172.16.1.1 255.255.255.0
B(config-if)#no shutdown
B(config-if)clock rate 64000 (assuming DCE is connected to router B)
B(config)#interface fastethernet 0
B(config-if)#ip address 172.16.2.1 255.255.255.0
B(config-if)#no shutdown
3. Configure static routing or enable dynamic routing protocols
A(config)#ip route 172.16.2.0 255.255.255.0 172.16.1.1
B(config)#ip route 172.16.3.0 255.255.255.0 172.16.1.2
B(config)#ip route 172.16.4.0 255.255.255.0 172.16.1.2
4. Test 1
PC1, PC2 and PC3 can ping each other.
5. Configure access control list
B(config)#access-list 1 deny 172.16.4.0 0.0.0.255
Deny traffic from the 172.16.4.0 network segment
B(config)#access-list 1 permit any Allow other traffic to pass
B(config)#interface fastethernet 0
B(config-if)#ip access-group 1 out Access control list pop-up traffic call under the interface
6. Test 2
PC2 cannot ping PC1, but PC3 and PC1 can ping each other.
3. Experimental thinking questions
1. In this experiment, can PC1 and PC2 ping each other? What is the difference between the prompt information when PC1 host pings PC2 and PC2 host pings PC1? Why?
2. Is there any practical significance in setting the DENY rule at the end of the ACL? Why?