《路由器R6 ACL扩展访问控制列表参考配置》由会员分享，可在线阅读，更多相关《路由器R6 ACL扩展访问控制列表参考配置（9页珍藏版）》请在金锄头文库上搜索。
1、实验6扩展IP访问控制列表配置110263010153实验目标理解扩展ip访问控制列表的原理及功能；掌握编号的扩展ip访问控制列表的配置方法；实验背景某公司的经理部、财务部和销售部等三个部门，还有公司内部的服务器.为了安全原因，员 工在外只能以WWW方式访问服务器,但不能PING服务器.PC0代表公司外的主机、SERVER0代表公司内的服务器。实验设备PC 1 台；Server-PT 1 台；Router-2811 3 台；交叉线；DCE 串口线实验拓扑(见附图R06.JPG)实验要求 先按照图R06创建Packet Tracer拓扑图，后进行以下操作：注意:公司出口路由器R2与外路由器R1之
2、间通过V.35电缆串口连接，DCE端连接在R1上，配置 其时钟频率64000；主机与路由器通过交叉线连接。(R1R2添加NM-8A/S)(1)配置PC机、服务器及路由器接口 IP地址。(2)在各路由器上配置静态路由协议，让设备间能相互通，因为只有在互通的前提下才涉及到访 问控制列表。(R0和R2配置静态默认路由,R1配置一般静态路由)RO(config)#ip rou te 0.0.0.0 0.0.0.0 172.16.2.2/静态默认路由R2(config)#ip rou te 0.0.0.0 0.0.0.0 172.16.3.1/静态默认路由R1(config)#ip route 172.
3、16.1.0 255.255.255.0 172.16.2.1/一般静态路由R1(config)#ip rou te 172.16.4.0 255.255.255.0 172.16.3.2/一般静态路由(4)在R1上配置编号的IP扩展访问控制列表：允许PC0通过TCP协议访问服务器172.16.4.2的www服务,但防止PC0通过ICMP协议先ping 172.16.4.2截图ping的结果？是否通？R1(config)#access-list 100 deny icmp host 172.16.1.2 host 172.16.4.2R1(config)#access-list 100 per
4、mit tcp host 172.16.1.2 host 172.16.4.2 eq www (5)将扩展IP访问列表应用到R1接口 S1/0上。R1(config)#inte rface Serial1/0R1(config-if)# ip address 172.16.3.1 255.255.255.0R1(config-if)# ip access-group 100 outR1(config-if)# clock rate 64000R1(config-if)#no shutdown(6)验证的互通性：PCO Web 浏览器：http:/172.1642 (success),ping
5、172.16.4.2 (Reply from 172.16.2.2: Destination host unreachable)墨PCOCZI旦Physiical ConfigDesktopSoftware/Servi 匚阴IWeb BrowserV URL http：/172. 16. 4. 2/index. htmlGoStopCisco Packet Tracer*Welrome t 口 Cisco Facket Tracer. Opening duore t u new upportuni t i 已 . Mi ml Wi de Open.Qui ck Links:A Em：dll p
6、aseC upT-T i 迂ht Imase pImage卜 卜 PCOCZI回PhysicalConfigDesktopSoftware/ServicesRO#show running-configBuilding configuration.Current configuration : 531 bytes!version 12.4no service timestamps log datetime msec no service timestamps debug datetime msec no service password-encryptionhostname R0spanning
7、-tree mode pvstinterface FastEthernetO/Oip address 172.16.1.1 255.255.255.0 duplex autospeed auto!interface FastEthernet0/1ip address 172.16.2.1 255.255.255.0duplex autospeed auto!interface Vlan1no ip addressshutdown!ip classlessip route 0.0.0.0 0.0.0.0 172.16.2.2line con 0line vty 0 4loginendR0#R0#
8、R0#R0#Rl#show running-configBuilding configuration.Current configuration : 1269 bytes!version 12.4no service timestamps log datetime msecno service timestamps debug datetime msec no service password-encryption!hostname R1spanning-tree mode pvstinterface FastEthernetO/Ono ip addressduplex autospeed a
9、utoshutdown!interface FastEthernet0/1ip address 172.16.2.2 255.255.255.0duplex autospeed auto!interface Serial1/0ip address 172.16.3.1 255.255.255.0ip access-group 100 outclock rate 64000interface Seriall/1no ip addressclock rate 2000000shutdown!interface Serial1/2no ip addressclock rate 2000000shut
10、down!interface Serial1/3no ip addressclock rate 2000000shutdown!interface Serial1/4no ip addressclock rate 2000000shutdown!interface Serial1/5no ip addressclock rate 2000000shutdown!interface Serial1/6no ip addressclock rate 2000000shutdown!interface Serial1/7no ip addressclock rate 2000000shutdown!
11、interface Vlan1no ip addressshutdown!ip classlessip route 172.16.1.0 255.255.255.0 172.16.2.1ip route 172.16.4.0 255.255.255.0 172.16.3.2 access-list 100 deny icmp host 172.16.1.2 host 172.16.4.2 access-list 100 permit tcp host 172.16.1.2 host 172.16.4.2 eq wwwline con 0line vty 0 4loginendR1#R1#R2#
12、show rBuilding configuration.Current configuration : 1047 bytes!version 12.4no service timestamps log datetime msec no service timestamps debug datetime msec no service password-encryptionhostname R2spanning-tree mode pvstinterface FastEthernetO/Oip address 172.16.4.1 255.255.255.0 duplex autospeed
13、auto!interface FastEthernet0/1no ip addressduplex autospeed autoshutdown!interface Serial1/0ip address 172.16.3.2 255.255.255.0 !interface Serial1/1no ip addressclock rate 2000000shutdown!interface Serial1/2no ip addressclock rate 2000000shutdown!interface Serial1/3no ip addressclock rate 2000000shu
14、tdown!interface Serial1/4no ip addressclock rate 2000000shutdown!interface Serial1/5no ip addressclock rate 2000000shutdown!interface Seriall/6no ip addressclock rate 2000000shutdown!interface Serial1/7no ip addressclock rate 2000000shutdown!interface Vlan1no ip addressshutdown!ip classlessip route 0.0.0.0 0.0.0.0 172.16.3.1line con 0line vty 0 4loginendR2#
