扩展ACL(Extended ACL)-白红宇

实验来源：工大瑞普Cisco网络技术论坛

要求：

1．禁止r1 telnet r4

2．禁止r2 ping r4

3．其它访问均允许

1.按照拓扑配置好各个路由器的接口IP地址；

2.在每台路由器上配置OSPF路由协议（有不会的清看上一次的标准ACL的有关OSPF的基本配置）

3.3.设置ACL（注：标准ACL应该在距离目标近的地方设置，扩展ACL应该在距离源较近的地方设置）

r3(config)#access-list 100 deny tcp host 192.168.1.1 any eq telnet

r3(config)#access-list 100 deny icmp host 192.168.1.2 any

r3(config)#access-list 100 deny icmp host 131.16.24.1 any

r3(config)#access-list 100 permit ip any any

r3(config)#int s1/2

r3(config-if)#ip access-group 100 out

OK,设置完了扩展ACL。

验证：

r1#ping 172.16.1.2

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.16.1.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 120/132/160 ms

r1#telnet 172.16.1.2

Trying 172.16.1.2 ...

% Destination unreachable; gateway or host down

r1可以ping通，但是无法telnet

r2#ping 172.16.1.2

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.16.1.2, timeout is 2 seconds:

U.U.U

Success rate is 0 percent (0/5)

r2#ping

Protocol [ip]:

Target IP address: 172.16.1.2

Repeat count [5]:

Datagram size [100]:

Timeout in seconds [2]:

Extended commands [n]: y

Source address or interface: 131.16.24.1

Type of service [0]:

Set DF bit in IP header? [no]:

Validate reply data? [no]:

Data pattern [0xABCD]:

Loose, Strict, Record, Timestamp, Verbose[none]:

Sweep range of sizes [n]:

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.16.1.2, timeout is 2 seconds:

Packet sent with a source address of 131.16.24.1

U.U.U

Success rate is 0 percent (0/5)

r2#telnet 172.16.1.2

Trying 172.16.1.2 ... Open

User Access Verification

Password:

% Password: timeout expired!

Password:

r2无法ping通，但是可以telnet上。

r3#ping 172.16.1.2

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.16.1.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 40/63/80 ms

OK,实验完。

本文转自loveme2351CTO博客，原文链接： http://blog.51cto.com/loveme23/29239，如需转载请自行联系原作者