PacketTracer5.2實驗(十二)標(biāo)準(zhǔn)IP訪問控制列表配置解讀

1、課題：標(biāo)準(zhǔn)IP訪問控制列表配置教學(xué)目標(biāo)理解標(biāo)準(zhǔn)IP訪問控制列表的原理及功能；掌握編號的標(biāo)準(zhǔn)IP訪問控制列表的配置方法；教學(xué)重點：理解標(biāo)準(zhǔn)IP訪問控制列表的原理及功能教學(xué)難點：掌握編號的標(biāo)準(zhǔn)IP訪問控制列表的配置方法教具、教學(xué)素材準(zhǔn)備：網(wǎng)絡(luò)環(huán)境教學(xué)方法：講授，演示，實作教學(xué)時數(shù)：2公司的經(jīng)理部、財務(wù)部和銷售部分別屬于不同的3個網(wǎng)段，三部門之間用路由器進(jìn)行信息傳遞，為了安全起見，公司領(lǐng)導(dǎo)要求銷售部不能對財務(wù)部進(jìn)行訪問，但經(jīng)理部可以對財務(wù)部進(jìn)行訪問?；驹鞟CLs的全稱為接入控制列表(AccessControlLists)，也稱為訪問列表(AccessList)，俗稱為防火墻，在有的文檔中還稱之為

2、包過濾。ACLs通過定義一些規(guī)則對網(wǎng)絡(luò)設(shè)備接口上的數(shù)據(jù)報文進(jìn)行控制：允許通過或丟棄，從而提高網(wǎng)絡(luò)可管理性和安全性；IPACL分為兩種：標(biāo)準(zhǔn)IP訪問列表和擴(kuò)展IP訪問列表，編號范圍分別為199、13001999,100199、20002699；標(biāo)準(zhǔn)IP訪問列表可以根據(jù)數(shù)據(jù)包的源IP地址定義規(guī)則，進(jìn)行數(shù)據(jù)包的過濾；擴(kuò)展IP訪問列表可以根據(jù)數(shù)據(jù)包的源IP、目的IP、源端口、目的端口、協(xié)議來定義規(guī)則，進(jìn)行數(shù)據(jù)包的過濾；IPACL基于接口進(jìn)行規(guī)則的應(yīng)用，分為：入棧應(yīng)用和出棧應(yīng)用；教學(xué)過程實驗拓?fù)鋋FC1192.168.1：4W3.!FaJO/O*丿財勞FG3192.168.42419i168.4.119

3、2.1681.1經(jīng)理-/FC2-192:168.2.24曲168:?.1誚售1、路由器之間通過V.35電纜串口連接，DCE端連接在R1上，配置其時間頻率為64000；主機(jī)與路由器通過交叉線連接；2、配置路由器接口IP地址；3、在路由器上配置OSPF路由協(xié)議，讓三臺PC能相互ping通，因為只有在互通的前提下才能涉及到訪問控制列表；4、在R1上配置編號的IP標(biāo)準(zhǔn)訪問控制列表；5、將標(biāo)準(zhǔn)IP訪問列表應(yīng)用到接口上；6、驗證主機(jī)之間的互通性；R1:RouterenRouter#conftEnterconfigurationcommands,oneperline.EndwithCNTL/Z.Router

4、(config)#hostnameR1Rl(config)#interfacefal/0R1(config-if)#ipaddressR1(config-if)#noshut%LINK-5-CHANGED:InterfaceFastEthernet1/0,changedstatetoup%LINEPR0T0-5-UPD0WN:LineprotocolonInterfaceFastEthernet1/0,changedstatetoupRl(config-if)#exitRl(config)#intfaO/OR1(config-if)#ipadd1

5、R1(config-if)#noshut%LINK-5-CHANGED:InterfaceFastEthernet0/0,changedstatetoup%LINEPR0T0-5-UPD0WN:LineprotocolonInterfaceFastEthernet0/0,changedstatetoupR1(config-if)#exitR1(config)#intse2/0R1(config-if)#clockrate64000R1(config-if)#ipaddR1(config-if)#nos

6、hut%LINK-5-CHANGED:InterfaceSerial2/0,changedstatetodownR1(config-if)#exitR1(config)#R1(config)#routerospf1R1(config-router)#network55area0R1(config-router)#network55area0R1(config-router)#network55area0R1(config-router)#endR1#%SYS5C0NFIG_I:Confi

7、guredfromconsolebyconsoleR1#showiprouteCodes:C-connected,S-static,I-IGRP,R-RIP,M-mobile,B-BGPD-EIGRP,EX-EIGRPexternal,O-OSPF,IA-OSPFinterareaN1-OSPFNSSAexternaltype1,N2-OSPFNSSAexternaltype2E1-OSPFexternaltype1,E2-OSPFexternaltype2,E-EGPi-IS-IS,L1-IS-ISlevel-1,L2-IS-ISlevel-2,ia-IS-ISinterarea*candi

8、datedefault,Uper-userstaticroute,oODRPperiodicdownloadedstaticrouteGatewayoflastresortisnotsetC/24isdirectlyconnected.FastEthernet1/0C/24isdirectlyconnected.FastEthernet0/0R1#R1#R1#showiproute/兩臺路由器配置好后的路由信息Codes:C-connected,S-static,I-IGRP,R-RIP,M-mobile,B-BGPD-EIGRP,EX-EIGRPe

9、xternal,O-OSPF,IA-OSPFinter2N1-OSPFNSSAexternaltype1,N2-OSPFNSSAexternaltypeE1-OSPFexternaltype1,E2-OSPFexternaltype2,E-EGPi-IS-IS,L1-IS-ISlevel-1,L2-IS-ISlevel-2,ia-IS-ISinterarea*-candidatedefault,U-per-userstaticroute,o-ODRP-periodicdownloadedstaticrouteareaoflastresortGatewayisnotsetCCCOR1#R1#co

10、nf/24/24/24/24isisisdirectlydirectlydirectlyconnected,FastEthernet1/0connected.FastEthernet0/0connected,Serial2/0110/782via,00:00:15,Serial2/0EnterconfigurationR1(config)#ip?access-listdefault-networkdhcpparametersdomaindomain-lookuptranslationd

11、omain-nameforward-protocolbroadcastshostname-servernatroutetcpR1(config)#ipR1(config)#ipextendedstandardR1(config)#ipR1(config)#ipacaccessTist?ExtendedAccessStandardAccessaccess-liststaaccess-liststandard?ListListcommands,oneperline.EndwithCNTL/Z.Namedaccess-listFlagsnetworksascandidatesfordefaultro

12、utesConfigureDHCPserverandrelayIPDNSResolverEnableIPDomainNameSystemhostnameDefinethedefaultdomainnameControlsforwardingofphysicalanddirectedIPAddanentrytotheiphostnametableSpecifyaddressofnameservertouseNATconfigurationcommandsEstablishstaticroutesGlobalTCPparametersStandardIPaccess-listnumberWORDA

13、ccess-listnameR1(config)#ipaccess-liststandarddavid?R1(config)#ipaccess-liststandarddavid配置名為david的IP標(biāo)準(zhǔn)訪問控制列表R1(config-std-nacl)#?defaultdenyexitnopermitremarkSetacommandtoitsdefaultsSpecifypacketstorejectExitfromaccess-listconfigurationmodeNegateacommandorsetitsdefaultsSpecifypacketstoforwardAccess

14、listentrycommentR1(config-std-nacl)#permitA.B.C.DWildcardbitsR1(config-std-nacl)#permitR1(config-std-nacl)#permit允許網(wǎng)段通過R1(config-std-nacl)#deny?A.B.C.Danyhost?55?55AddresstomatchAnysourcehostAsinglehostaddressR1(config-std-nacl)#deny192.168.2

15、.0?A.B.C.DWildcardbitsR1(config-std-nacl)#deny55?R1(config-std-nacl)#deny55禁止網(wǎng)段通過R1(config-std-nacl)#exitR1(config)#interR1(config)#interfaceR1(config-if)#?bandwidthcdpclockcryptocustom-queue-listdelaydescriptionencapsulationexitmodefair-queueframe-rela

16、yse2/0/SetbandwidthinformationalparameterCDPinterfacesubcommandsConfigureserialinterfaceclockEncryption/DecryptioncommandsAssignacustomqueuelisttoaninterfaceSpecifyinterfacethroughputdelayInterfacespecificdescriptionSetencapsulationtypeforaninterfaceExitfrominterfaceconfigurationEnableFairQueuingona

17、nInterfaceSetframerelayparametersholdqueueipconfigcommandskeepalivemtuSetholdqueuedepthInterfaceInternetProtocolEnablekeepaliveSettheinterfaceMaximumTransmissionUnit(MTU)nodefaultsNegateacommandorsetitspppprioritygroupservicepolicyshutdowntxringlimitzonememberPointtoPointProtocolAssignaprioritygroup

18、toaninterfaceConfigureQoSServicePolicyShutdowntheselectedinterfaceConfigurePAleveltransmitringlimitApplyzonenameRl(configif)#ipaccessgroupaddresshellointervalhelperaddressbroadcastsinspectipsmtunatospfsplithorizonsummaryaddressSpecifyaccesscontrolforpacketsSettheIPaddressofaninterfaceConfiguresIPEIG

19、RPhellointervalSpecifyadestinationaddressforUDPApplyinspectnameCreateIPSruleSetIPMaximumTransmissionUnitNATinterfacecommandsOSPFinterfacecommandsPerformsplithorizonPerformaddresssummarizationvirtualreassemblyVirtualReassemblyR1(configif)#ipacR1(config-if)#ipaccessgroup?IPaccesslist(standardorextende

20、d)WORDAccesslistnameR1(configif)#ipaccessgroupdavid?ininboundpacketsoutoutboundpacketsR1(configif)#ipaccessgroupdavidout?R1(configif)#ipaccessgroupdavidout/將名為david的IP標(biāo)準(zhǔn)訪問控制列表應(yīng)用到se2/0端口R1(configif)#endR1#%SYS5CONFIG_I:ConfiguredfromconsolebyconsoleR1#showrunningconfigBuildingconfiguration.Currentcon

21、figuration:928bytes!version12.2noservicetimestampslogdatetimemsecnoservicetimestampsdebugdatetimemsecnoservicepassword-encryption!hostnameR1interfaceFastEthernet0/0ipaddressduplexautospeedauto!interfaceFastEthernet1/0ipaddressduplexautospeedauto!interf

22、aceSerial2/0ipaddressipaccess-groupdavidoutclockrate64000!interfaceSerial3/0noipaddressshutdown!interfaceFastEthernet4/0noipaddressshutdown!interfaceFastEthernet5/0noipaddressshutdown!routerospf1log-adjacency-changesnetwork55area0network55a

23、rea0network55area0ipclassless!ipaccessliststandarddavidpermit55deny55linecon0linevty04loginendR1#R2:RouterenRouter#conftEnterconfigurationcommands,oneperline.EndwithCNTL/Z.Router(config)#hostnameR2R2(config)#intfa0/0R2(config-if)#ipadd

24、R2(config-if)#noshut%LINK-5-CHANGED:InterfaceFastEthernet0/0,changedstatetoup%LINEPR0T0-5-UPD0WN:LineprotocolonInterfaceFastEthernet0/0,changedstatetoupR2(config-if)#exitR2(config)#intse2/0R2(config-if)#ipaddR2(config-if)#noshut%LINK-5-CHANGED:InterfaceSerial2/0,

25、changedstatetoupR2(config-if)#exitR2(config)#routerospf1R2(config-router)#%LINEPR0T0-5-UPD0WN:LineprotocolonInterfaceSerial2/0,changedstatetoupR2(config-router)#network55area0R2(config-router)#network55area000:11:23:%0SPF-5-ADJCHG:Process1,NbronSerial2/

26、0fromLOADINGtoFULL,LoadingDoR2(config-router)#endR2#%SYS5C0NFIG_I:ConfiguredfromconsolebyconsoleR2#showiprouteCodes:C-connected,S-static,I-IGRP,R-RIP,M-mobile,B-BGPD-EIGRP,EX-EIGRPexternal,O-OSPF,IA-OSPFinterareaN1-OSPFNSSAexternaltype1,N2-OSPFNSSAexternaltype2E1-OSPFexternaltype1,E2-OSPFexternaltyp

27、e2,E-EGPi-IS-IS,L1-IS-ISlevel-1,L2-IS-ISlevel-2,ia-IS-ISinterarea*candidatedefault,Uper-userstaticroute,oODRPperiodicdownloadedstaticrouteGatewayoflastresortisnotsetO/24110/782via,00:00:09,Serial2/0O/24110/782via,00:00:09,Serial2/0C/24isdirectly

28、connected,Serial2/0C/24isdirectlyconnected.FastEthernet0/0R2#五、測試PC1:PacketTracerPCCommandLine1.0PCipconfigIPAddress:SubnetMask:DefaultGateway:PCping/ACL前Pingingwith32bytesofdata:Requesttimedout.Replyfrom:bytes=32time=15m

29、sTTL=126Replyfrom:bytes=32time=9msTTL=126Replyfrom:bytes=32time=15msTTL=126Pingstatisticsfor:Packets:Sent二4,Received=3,Lost二1(25%loss),Approximateroundtriptimesinmilli-seconds:Minimum=9ms,Maximum=15ms,Average=13msPCping/ACL后Pingingwith32bytesofdata:Replyfrom:bytes=32time=10msTTL=126Replyfrom:bytes=32time=9msTTL=126Replyfrom:bytes=32time=16msTTL=126Replyfrom:bytes=3