扩展访问控制列表技术.docx

1、扩展访问控制列表技术扩展访问控制列表技术一 网络拓扑图二 实验要求1. 根据网络拓扑图正确配置IP地址2. 全网采用OSPF技术互联3. 使用扩展访问控制列表技术控制PC1不能访问S1的WEB服务，PC0可以正常访问WEB服务三 配置过程1. R1： RouterenaRouter#conf tEnter configuration commands, one per line. End with CNTL/Z.Router(config)#hos R1R1(config)#int f 0/0R1(config-if)#ip address 192.168.1.254 255.255.255.

2、0R1(config-if)#no shutdown R1(config-if)#exiR1(config)#int f 1/0R1(config-if)#ip address 192.168.2.254 255.255.255.0R1(config-if)#no shutdown R1(config-if)#exiR1(config)#int s 2/0R1(config-if)#ip address 10.1.1.1 255.255.255.0R1(config-if)#clo ra 64000R1(config-if)#no shutdown R1(config-if)#exiR1(co

3、nfig)#router ospf 1R1(config-router)#network 10.1.1.0 0.0.0.255 ar 0R1(config-router)#network 192.168.1.0 0.0.0.255 ar 0R1(config-router)#network 192.168.2.0 0.0.0.255 ar 0R1(config-router)#exiR1(config)#access-list 100 deny tcp 192.168.2.0 0.0.0.255 172.16.1.0 0.0.0.255 eq www /创建扩展访问控制列表100，禁止192.

4、168.2.0/24网段不能访问172.16.1.0/24网段的WWW服务R1(config)#access-list 100 permit ip any any /允许所有数据包通过R1(config)#int s 2/0R1(config-if)#ip access-group 100 out /将访问控制列表100应用到S 2/0的出方向R1(config-if)#exiR1(config)#do wrBuilding configuration.OK2. R2： RouterenaRouter#conf tEnter configuration commands, one per li

5、ne. End with CNTL/Z.Router(config)#hos R2R2(config)#int f 0/0R2(config-if)#ip address 172.16.1.254 255.255.255.0R2(config-if)#no shutdown R2(config-if)#exiR2(config)#int s 2/0R2(config-if)#ip address 10.1.1.2 255.255.255.0R2(config-if)#no shutdown R2(config-if)#exiR2(config)#roR2(config)#router ospf

6、 1R2(config-router)#network 172.16.1.0 0.0.0.255 ar 0R2(config-router)#network 10.1.1.0 0.0.0.255 ar 0R2(config-router)#exiR2(config)#do wrBuilding configuration.OKR2(config)#四 配置文件1. R1： R1(config)#do sh runBuilding configuration.Current configuration : 965 bytes!version 12.2no service timestamps l

7、og datetime msecno service timestamps debug datetime msecno service password-encryption!hostname R1!interface FastEthernet0/0 ip address 192.168.1.254 255.255.255.0 duplex auto speed auto!interface FastEthernet1/0 ip address 192.168.2.254 255.255.255.0 duplex auto speed auto!interface Serial2/0 ip a

8、ddress 10.1.1.1 255.255.255.0 ip access-group 100 out clock rate 64000!interface Serial3/0 no ip address clock rate 2000000 shutdown!interface FastEthernet4/0 no ip address shutdown!interface FastEthernet5/0 no ip address shutdown!router ospf 1 log-adjacency-changes network 10.1.1.0 0.0.0.255 area 0

9、 network 192.168.1.0 0.0.0.255 area 0 network 192.168.2.0 0.0.0.255 area 0!ip classless!access-list 100 deny tcp 192.168.2.0 0.0.0.255 172.16.1.0 0.0.0.255 eq wwwaccess-list 100 permit ip any any!line con 0line vty 0 4 login!End2. R2： R2(config)#do sh runBuilding configuration.Current configuration

10、: 758 bytes!version 12.2no service timestamps log datetime msecno service timestamps debug datetime msecno service password-encryption!hostname R2!interface FastEthernet0/0 ip address 172.16.1.254 255.255.255.0 duplex auto speed auto!interface FastEthernet1/0 no ip address duplex auto speed auto shu

11、tdown!interface Serial2/0 ip address 10.1.1.2 255.255.255.0!interface Serial3/0 no ip address clock rate 2000000 shutdown!interface FastEthernet4/0 no ip address shutdown!interface FastEthernet5/0 no ip address shutdown!router ospf 1 log-adjacency-changes network 172.16.1.0 0.0.0.255 area 0 network 10.1.1.0 0.0.0.255 area 0!ip classless!line con 0line vty 0 4 login!End五 测试结果1. PC0 能 PING 通 S1，能访问WWW服务2. PC1不能访问WWW服务，但能PING 通 S1