Packet Tracer 5.0建构CCNA实验攻略(15)——ACL简单的配置 2008-10-08 22:43
Packet Tracer 5.0是一款非常不错的Cisco(思科)网络设备模拟器，对于想考思科初级认证（如CCNA）的朋Tracer 5.0是非常不错的选择。通常我们周围并没有那么多思科的设备供我们学习调试，参加培训费用很贵，上机限的，利用Packet Tracer 5.0练习思科IOS操作命令很不错的。近日，在网上下载了思科CCNA640-802指导用书与诸位网友共同分享Packet Tracer 5.0的使用方法与技巧，也借此抛砖引玉。
ACL(Access Control List，访问控制列表)，简单说就是包过滤，根据数据包的报头中的ip地址、协议端口利用ACL可以实现安全控制。编号：1-99 or 1300-1999(standard IP)，100-199 or 2000-2699(Extended IP)。实际应用中的，要想恰当地应用ACL，必需要制定合理的策略。
一、实验配置拓扑图
图一
图二 网络中的DNS服务器:192.168.1.2
图三 网络中的WWW服务器:192.168.1.3
二、三个路由器的基本配置 LuoShan#sh startup-config Using 699 bytes !
version 12.4
no service password-encryption !
hostname LuoShan ! !
enable password cisco ! ! !
!
username senya password 0 cisco !
ip ssh version 1 no ip domain-lookup ! !
interface FastEthernet0/0 no ip address duplex auto speed auto shutdown !
interface FastEthernet0/1
ip address 192.168.3.1 255.255.255.0 duplex auto speed auto !
interface Serial0/3/0
ip address 172.17.1.1 255.255.255.0 clock rate 56000 !
interface Serial0/3/1
ip address 172.18.1.2 255.255.255.0 !
interface Vlan1 no ip address shutdown !
router eigrp 100 network 192.168.3.0 network 172.17.0.0 network 172.18.0.0 auto-summary !
ip classless ! ! ! ! !
line con 0 line vty 0 4 password cisco
HuangChuang#show access-list ACL1 Extended IP access list ACL1
deny udp host 192.168.2.3 192.168.1.0 0.0.0.255 eq domain (15 match(es)) deny tcp host 192.168.2.2 192.168.1.0 0.0.0.255 eq www (60 match(es)) permit ip any any (34 match(es)) HuangChuang#show access-list 1 Standard IP access list 1
permit host 192.168.2.2 (4 match(es)) 四、配置ACL的路由器配置内容 HuangChuang#sh startup-config Using 914 bytes !
version 12.4
no service password-encryption !
hostname HuangChuang ! !
enable password cisco ! ! ! !
ip ssh version 1 no ip domain-lookup ! !
interface FastEthernet0/0 no ip address duplex auto speed auto shutdown !
interface FastEthernet0/1
ip address 192.168.2.1 255.255.255.0 ip access-group ACL1 in duplex auto speed auto !
interface Serial0/3/0
ip address 172.17.1.2 255.255.255.0 !
interface Serial0/3/1
ip address 172.16.1.1 255.255.255.0 clock rate 56000 !
interface Vlan1 no ip address shutdown !
router eigrp 100 network 192.168.2.0 network 172.17.0.0 network 172.16.0.0 auto-summary !
ip classless ! !
access-list 1 permit host 192.168.2.2 ip access-list extended ACL1
deny udp host 192.168.2.3 192.168.1.0 0.0.0.255 eq domain deny tcp host 192.168.2.2 192.168.1.0 0.0.0.255 eq www permit ip any any ! ! !
line con 0 line vty 0 4
access-class 1 in password cisco login ! ! end
LuoShan#sh startup-config Using 756 bytes !
version 12.4
no service password-encryption !
hostname LuoShan ! !
enable password cisco
! ! ! !
username senya password 0 cisco !
ip ssh version 1 no ip domain-lookup ! !
interface FastEthernet0/0 no ip address duplex auto speed auto shutdown !
interface FastEthernet0/1
ip address 192.168.3.1 255.255.255.0 duplex auto speed auto !
interface Serial0/3/0
ip address 172.17.1.1 255.255.255.0 clock rate 56000 !
interface Serial0/3/1
ip address 172.18.1.2 255.255.255.0 !
interface Vlan1 no ip address shutdown !
router eigrp 100 network 192.168.3.0 network 172.17.0.0 network 172.18.0.0 auto-summary !
ip classless ! !
access-list 2 permit host 192.168.3.2 ! !
!
line con 0 line vty 0 4
access-class 2 in password cisco login ! ! end
xixian#show startup-config Using 808 bytes !
version 12.4
service password-encryption !
hostname xixian ! !
enable password 7 0822455D0A16 ! ! ! !
ip ssh version 1 no ip domain-lookup ! !
interface FastEthernet0/0 no ip address duplex auto speed auto shutdown !
interface FastEthernet0/1
ip address 192.168.1.1 255.255.255.0 ip access-group 101 out duplex auto speed auto !
interface Serial0/3/0
ip address 172.18.1.1 255.255.255.0 clock rate 56000 !
interface Serial0/3/1
ip address 172.16.1.2 255.255.255.0 !
interface Vlan1 no ip address shutdown !
router eigrp 100 network 192.168.1.0 network 172.18.0.0 network 172.16.0.0 auto-summary !
ip classless ! !
access-list 101 deny icmp 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255 access-list 101 permit ip any any ! ! !
line con 0 line vty 0 4
password 7 0822455D0A16 login ! ! end