思科网络基础---ACL配置

小灰灰 2023-06-25 08:14 76阅读 0赞

记得这是多年前的一道作业题，如今再接触网络，感触颇深。

先提下配置要求吧，说实话，这拓扑图是真的简单，配置要不复杂，当然，这只是基本的训练题。

用RIP路由协议配置，实现网络连通。

1、终端PC-5的WEB浏览器上输入http://40.4.4.200，是否可以打开页面？

2、若要拒绝该网段访问Server-2的网站，该如何实现？

3、PC-6能否ping通R-1所连接主机？如果想拒绝所有针对R-1的ping操作，如何实现？

拓扑图如下，该图我已经配置完成了。

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0ODg5NjA3_size_16_color_FFFFFF_t_70][]

1、首先把server1、server2、pc3、pc4、pc5、pc6的ip、掩码、网关都配置好，这些都可以直接图形化配置，在这里就不截图了

配置完成之后，如下图这两个区域是能够互相访问的

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0ODg5NjA3_size_16_color_FFFFFF_t_70 1][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0ODg5NjA3_size_16_color_FFFFFF_t_70 2][]

2、接下来对三个路由器进行最基本的配置，设置端口ip、开启端口

![20191227140531337.png][]

Router1：

R-1#show running-config 
    Building configuration...
    
    Current configuration : 800 bytes
    !
    version 12.2
    no service timestamps log datetime msec
    no service timestamps debug datetime msec
    no service password-encryption
    !
    hostname R-1
    !
    !
    !
    !
    !
    !
    !
    !
    no ip cef
    no ipv6 cef
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    no ip domain-lookup
    !
    !
    !
    !
    !
    !
    !
    !
    interface FastEthernet0/0
     ip address 10.1.1.1 255.255.255.0
     duplex auto
     speed auto
    !
    interface FastEthernet0/1
     no ip address
     duplex auto
     speed auto
     shutdown
    !
    interface FastEthernet1/0
     ip address 30.3.3.1 255.255.255.0
     duplex auto
     speed auto
    !
    interface FastEthernet1/1
     ip address 40.4.4.1 255.255.255.0
     duplex auto
     speed auto
    !
    router rip
     version 2
     network 10.0.0.0
     network 30.0.0.0
     network 40.0.0.0
     no auto-summary
    !
    ip classless
    !
    ip flow-export version 9
    !
    !
    !
    no cdp run
    !
    !
    !
    !
    !
    !
    line con 0
    !
    line aux 0
    !
    line vty 0 4
     login
    !
    !
    !
    end
    
    
    R-1#

Router2：

R-2#show running-config 
    Building configuration...
    
    Current configuration : 759 bytes
    !
    version 12.2
    no service timestamps log datetime msec
    no service timestamps debug datetime msec
    no service password-encryption
    !
    hostname R-2
    !
    !
    !
    !
    !
    !
    !
    !
    no ip cef
    no ipv6 cef
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    no ip domain-lookup
    !
    !
    !
    !
    !
    !
    !
    !
    interface FastEthernet0/0
     ip address 10.1.1.2 255.255.255.0
     duplex auto
     speed auto
    !
    interface FastEthernet0/1
     ip address 20.2.2.1 255.255.255.0
     duplex auto
     speed auto
    !
    interface FastEthernet1/0
     no ip address
     duplex auto
     speed auto
     shutdown
    !
    interface FastEthernet1/1
     no ip address
     duplex auto
     speed auto
     shutdown
    !
    router rip
     version 2
     network 10.0.0.0
     network 20.0.0.0
     no auto-summary
    !
    ip classless
    !
    ip flow-export version 9
    !
    !
    !
    !
    !
    !
    !
    !
    line con 0
    !
    line aux 0
    !
    line vty 0 4
     login
    !
    !
    !
    end
    
    
    R-2#

Router3：

R-3#show running-config 
    Building configuration...
    
    Current configuration : 800 bytes
    !
    version 12.2
    no service timestamps log datetime msec
    no service timestamps debug datetime msec
    no service password-encryption
    !
    hostname R-3
    !
    !
    !
    !
    !
    !
    !
    !
    no ip cef
    no ipv6 cef
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    no ip domain-lookup
    !
    !
    !
    !
    !
    !
    !
    !
    interface FastEthernet0/0
     no ip address
     duplex auto
     speed auto
     shutdown
    !
    interface FastEthernet0/1
     ip address 20.2.2.2 255.255.255.0
     duplex auto
     speed auto
    !
    interface FastEthernet1/0
     ip address 50.5.5.1 255.255.255.0
     duplex auto
     speed auto
    !
    interface FastEthernet1/1
     ip address 60.6.6.1 255.255.255.0
     duplex auto
     speed auto
    !
    router rip
     version 2
     network 20.0.0.0
     network 50.0.0.0
     network 60.0.0.0
     no auto-summary
    !
    ip classless
    !
    ip flow-export version 9
    !
    !
    !
    no cdp run
    !
    !
    !
    !
    !
    !
    line con 0
    !
    line aux 0
    !
    line vty 0 4
     login
    !
    !
    !
    end
    
    
    R-3#

3、然后配置RIP，好吧，其实上面贴的内容里面已经包含有RIP了，这里就略过了

4、先测试一下 ”终端PC-5的WEB浏览器上输入http://40.4.4.200，是否可以打开页面？“

因为待会要配置pc5无法访问server2页面，所以这里先做个测试

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0ODg5NjA3_size_16_color_FFFFFF_t_70 3][]

在配置acl访问控制列表之前，pc5是能够访问server2页面的，其实在配置完RIP动态路由后，所有的网段都是互通的，在工作环境中，这样做存在一定的安全隐患。

5、 配置ACL访问控制列表，拒绝pc5所在网段访问Server-2的网站

R-3>enable 
    R-3#configure terminal 
    R-3(config)#access-list 110 deny tcp 50.5.5.0 0.0.0.255 40.4.4.0 0.0.0.255 eq www
    R-3(config)#access-list 110 permit ip any any
    R-3(config)#interface f1/0
    R-3(config-if)#ip access-group 110 in
    R-3(config-if)#end
    R-3#

6、再次验证pc5能否访问server2页面

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0ODg5NjA3_size_16_color_FFFFFF_t_70 4][]

7、配置ACL访问控制列表，拒绝所有针对R-1的ping操作

首先，测试一下PC-6能否ping通R-1所连接主机

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0ODg5NjA3_size_16_color_FFFFFF_t_70 5][]

下面开始配置ACL

R-1>enable 
    R-1#configure terminal 
    R-1(config)#access-list 119 deny icmp any any
    R-1(config)#interface f0/0
    R-1(config-if)#ip access-group 119 in
    R-1(config-if)#end
    R-1#

最后再次验证能否ping通

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0ODg5NjA3_size_16_color_FFFFFF_t_70 6][]

ps:

因为之前并没有想要整理一份博文，因此前面配置没有及时copy出来，还好show run出来的也详细。

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0ODg5NjA3_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20191227134447518.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0ODg5NjA3,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0ODg5NjA3_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/20191227140121466.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0ODg5NjA3,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0ODg5NjA3_size_16_color_FFFFFF_t_70 2]: https://img-blog.csdnimg.cn/20191227140151805.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0ODg5NjA3,size_16,color_FFFFFF,t_70
[20191227140531337.png]: https://img-blog.csdnimg.cn/20191227140531337.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0ODg5NjA3_size_16_color_FFFFFF_t_70 3]: https://img-blog.csdnimg.cn/201912271426552.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0ODg5NjA3,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0ODg5NjA3_size_16_color_FFFFFF_t_70 4]: https://img-blog.csdnimg.cn/20191227144420609.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0ODg5NjA3,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0ODg5NjA3_size_16_color_FFFFFF_t_70 5]: https://img-blog.csdnimg.cn/2019122714395285.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0ODg5NjA3,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0ODg5NjA3_size_16_color_FFFFFF_t_70 6]: https://img-blog.csdnimg.cn/20191227145015503.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM0ODg5NjA3,size_16,color_FFFFFF,t_70