《网络规划与设计补充内容ipv6natdhcpacl》由会员分享，可在线阅读，更多相关《网络规划与设计补充内容ipv6natdhcpacl（58页珍藏版）》请在金锄头文库上搜索。
1、下一代的网际协议IPv6IPv6新特性：1、更大的地址空间2、简化了首部格式3、灵活的协议4、允许对资源预分配5、允许协议继续演变（1）版本(version)（2）通信量类(trafficclass)（3）流标号(flowlabel)（4）有效载荷长度(payloadlength)（5）下一个首部(nextheader)（6）跳数限制(hoplimit)（7）源地址（8）目的地址六种扩展首部： 逐跳选项逐跳选项 路由选择路由选择 分片分片 鉴别鉴别 封装安全有效载荷封装安全有效载荷 目的站选项目的站选项扩展首部IPv6保留了IPv4分片的大部分特征，其分片扩展首部共有以下几个字段：（1）下一个
2、首部下一个首部(8bit)（2）保留保留(10bit)（3）片偏移片偏移(13bit)（4）MM(1bit)（5）标识符标识符(32bit)私有地址私有地址1.静态NAT内部主机地址被一对一映射到外部主机地址Pc1:10.1.1.1-200.200.200.1Pc2:10.1.1.2-200.200.200.2Pc3:10.1.1.3-Pc4:10.1.1.4-200.200.200.2?XNAT分类NAT分类2.动态NAT内部主机使用地址池中的公网地址来映射Pc1:10.1.1.1-200.200.200.1Pc2:10.1.1.2-200.200.200.23.端口复用(PAT)端口复用的
3、特征是内部多个私有地址通过不同的端口被映射到一个公网地址，Overloading,orPort理想状况下，一个单一的IP地址可以使用的端口数为4000个。NAT分类配置NAT静态NAT配置实例静态NAT配置实例r1(config)#ipnatinsidesourcestatic10.1.1.2200.200.200.3r1(config)#ipnatinsidesourcestatic10.1.1.3200.200.200.4r1(config)#interfacef0/0r1(config-if)#ipnatinsider1(config)#ints0/0r1(config-if)#ipna
4、toutside静态NAT配置实例r1#debugipnatIPNATdebuggingison00:11:09:NAT:s=10.1.1.2-200.200.200.3,d=2.2.2.24093600:11:09:NAT*:s=2.2.2.2,d=200.200.200.3-10.1.1.240936r1#shipnattranslationsProInsideglobalInsidelocalOutsidelocalOutsideglobal-200.200.200.310.1.1.2-动态NAT配置实例动态NAT配置实例r1(config)#ipnatpoolNAT200.200.20
5、0.3200.200.200.50netmask255.255.255.0r1(config)#access-list1permit10.1.1.00.0.0.255r1(config)#ipnatinsidesourcelist1poolNATr1(config)#interfacef0/0r1(config-if)#ipnatinsider1(config)#ints0/0r1(config-if)#ipnatoutside动态NAT配置实例r1#debugipnat00:45:40:NAT:s=10.1.1.2-200.200.200.3,d=2.2.2.23893000:45:40:N
6、AT*:s=2.2.2.2,d=200.200.200.3-10.1.1.23893000:46:03:NAT:s=10.1.1.3-200.200.200.4,d=2.2.2.23896100:46:03:NAT*:s=2.2.2.2,d=200.200.200.4-10.1.1.33896100:46:27:NAT:s=10.1.1.4-200.200.200.5,d=2.2.2.238993动态NAT配置实例r1#shipnattranslationsProInsideglobalInsidelocalOutsidelocalOutsideglobal-200.200.200.310.1
7、.1.2-200.200.200.410.1.1.3-200.200.200.510.1.1.4-r1#clearipnattranslation*r1#shipnattranslationsPAT配置实例PAT配置实例r1(config)#ipnatpoolNAT200.200.200.3200.200.200.50netmask255.255.255.0r1(config)#access-list1permit10.1.1.00.0.0.255r1(config)#ipnatinsidesourcelist1poolNAToverloadr1(config)#interfacef0/0r1
8、(config-if)#ipnatinsider1(config)#ints0/0r1(config-if)#ipnatoutsider1(config)#iproute0.0.0.00.0.0.0200.200.200.2PAT配置实例(PATExample)r1#shipnattranslationsProInsideglobalInsidelocalOutsidelocalOutsideglobalicmp200.200.200.3:179210.1.1.4:17922.2.2.2:17922.2.2.2:1792icmp200.200.200.3:102410.1.1.2:17922.
9、2.2.2:17922.2.2.2:1024NAT排错路由器DHCP服务ipdhcppoolglobal/global是poolnamenetwork10.1.0.0255.255.0.0/动态分配的地址段ipdhcpexcluded-address10.1.1.110.1.1.19/不用于分配的地址ipdhcpexcluded-address10.1.1.24010.1.1.254domain- 标准ACL标准ACL（StandardACL）检查源地址（ChecksSourceaddress）允许或拒绝整个协议族（Generallypermitsordeniesentireprotocols
10、uite）OutgoingPacketfa0/0S0/0IncomingPacketAccess List ProcessesPermit?Source 扩展ACL（ExtendedACL）检查源和目的地址（ChecksSourceandDestinationaddress）通常允许或拒绝特定的协议（Generallypermitsordeniesspecificprotocols）OutgoingPacketFa0/0s0/0IncomingPacketAccess List ProcessesPermit?Sourceand DestinationProtocol扩展ACL用扩展ACL检查
11、数据包常见端口号端口号(Port Number)20文件传输协议（FTP）数据21文件传输协议（FTP）程序23远程登录（Telnet）25简单邮件传输协议（SMTP）69普通文件传送协议（TFTP）80超文本传输协议(HTTP)53域名服务系统（DNS）ACL表号协议（Protocol）ACL表号的取值范围（ACL Range）IP（Internet协议）1-99Extended IP(扩展Internet协议)100-199AppleTalk600-699IPX（互联网数据包交换）800-899Extended IPX(扩展互联网数据包交换)900-999IPX service Adver
12、tising Protocol(IPX服务通告协议)1000-1099通配符掩码（WildcardMask）1.是一个32比特位的数字字符串2.0表示“检查相应的位”,1表示“不检查（忽略）相应的位”特殊的通配符掩码1.Any0.0.0.0255.255.255.2552.Host172.30.16.290.0.0.0Host172.30.16.29AccessList命令Step 1:定义访问控制列表（定义访问控制列表（Define the ACL）access-list access-list-number permit | deny test conditions Router(conf
13、ig)#Router(config)#access-list 1 permit 10.0.0.0 0.255.255.255Step 2:将访问控制列表应用到某一接口上将访问控制列表应用到某一接口上（Apply ACL to a Interface） protocol access-group access-list-number in | out Router(config-if)#AccessList命令Router(config-if)#ipaccess-group1out仅允许我的网络（Permitmynetworkonly）access-list 1 permit 172.16.0.
14、0 0.0.255.255(implicit deny all - not visible in the list)(access-list 1 deny 0.0.0.0 255.255.255.255)interface ethernet 0ip access-group 1 outinterface ethernet 1ip access-group 1 out标准标准IPACLIPACL实例实例1 1172.16.3.0172.16.4.0172.16.4.13E0S0E1Non-172.16.0.0access-list 1 deny 172.16.4.13 0.0.0.0 acces
15、s-list 1 permit 0.0.0.0 255.255.255.255(implicit deny all)(access-list 1 deny 0.0.0.0 255.255.255.255)interface ethernet 0ip access-group 1 out标准IPACL实例2172.16.3.0172.16.4.0172.16.4.13E0S0E1Non-172.16.0.0拒绝特定的主机（Denyaspecifichost）access-list 1 deny 172.16.4.0 0.0.0.255access-list 1 permit any(implic
16、it deny all)(access-list 1 deny 0.0.0.0 255.255.255.255)interface ethernet 0ip access-group 1 out标准IPACL实例3172.16.3.0172.16.4.0172.16.4.13E0S0E1Non-172.16.0.0拒绝特定的子网（Denyaspecificsubnet）扩展ACL配置Router(config)# access-listaccess-list access-list-numberaccess-list-number permit | denypermit | deny prot
17、ocol source source-wildcard operator protocol source source-wildcard operator portport destination destination-wildcard destination destination-wildcard operator portoperator port established established loglog参数参数参数描述参数描述access-list-number访问控制列表表号控制列表表号permit|deny如果如果满足条件，允足条件，允许或拒或拒绝后面指定特定地址的通信流量后
18、面指定特定地址的通信流量protocol用来指定用来指定协议类型，如型，如IPIP、TCPTCP、UDPUDP、ICMPICMP等等source and destination分分别用来用来标识源地址和目的地址源地址和目的地址source-mask通配符掩通配符掩码，跟源地址相，跟源地址相对应destination-mask通配符掩通配符掩码，跟目的地址相，跟目的地址相对应operator lt,gt,eq,neqlt,gt,eq,neq( (小于，大于，等于，不等于小于，大于，等于，不等于) ) operand一个端口号一个端口号established如果数据包使用一个已建立如果数据包使用一
19、个已建立连接，便可允接，便可允许TCPTCP信息通信息通过access-list 101 deny tcp 172.16.4.0 0.0.0.255 172.16.3.0 0.0.0.255 eq 21access-list 101 deny tcp 172.16.4.0 0.0.0.255 172.16.3.0 0.0.0.255 eq 20access-list 101 permit ip any any(implicit deny all)(access-list 101 deny ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255)in
20、terface ethernet 0ip access-group 101 out拒绝从172.16.3.0到172.16.3.0的经过E0出方向的FTP流量DenyFTPfromsubnet172.16.4.0tosubnet172.16.3.0outofE0允许其他所有的流量Permitallothertraffic扩展ACL实例1172.16.3.0172.16.4.0172.16.4.13E0S0E1Non-172.16.0.0access-list 101 deny tcp 172.16.4.0 0.0.0.255 any eq 23access-list 101 permit ip
21、 any any(implicit deny all)interface ethernet 0ip access-group 101 out仅拒绝子网172.16.4.0在E0出方向的流量DenyonlyTelnetfromsubnet172.1172.16.4.06.4.0outofE0允许其他流量（Permitallothertraffic）实例2172.16.3.0172.16.4.0172.16.4.13E0S0E1Non-172.16.0.0标准ACL与扩展ACL比较标准（标准（Standard）扩展（扩展（Extended）过滤基于源过滤基于源（Filters Based onSo
22、urce.）过滤基于源和目的（过滤基于源和目的（ Filters Based on Source and destination.）允许或拒绝整个协议族（允许或拒绝整个协议族（Permit or deny entire TCP/IP protocol suite.）允许或拒绝特定的允许或拒绝特定的IP协议或端口协议或端口（Specifies a specific IP protocol and port number.）范围（范围（100-199）Range is 100 through 199.范围（范围（1-99）Range is 1 through 99命名IPACLRouter(con
23、fig)#ip access-list standard | extended nameIOS11.2 以后支持的特征以后支持的特征Feature for Cisco IOS Release 11.2 or later名字字符串要唯一名字字符串要唯一 Name string must be unique使用命名IPACL permit | deny ip access list test conditions permit | deny ip access list test conditions no permit | deny ip access list test conditions
24、Router(config std- | ext-nacl)#允许或拒绝陈述条件前没有表号允许或拒绝陈述条件前没有表号Permit or deny statements have no prepended number 可以用可以用“NO”命令移去特定的陈述命令移去特定的陈述no removes the specific test from the named access list创建一个扩展的命名访问控制表，拒绝172.16.4.0子网络的telnet的数据通过F0端口转发到172.16.3.0网络。Ipaccess-listextendedACL1Denytcp172.16.4.00.0
25、.0.255172.16.3.00.0.0.255eq23PermitipanyanyInterfaceFastethernet0/0Ipaccess-groupACL1out扩展ACL靠近源Placeextendedaccesslistsclosetothesource标准ACL靠近目的PlacestandardaccesslistsclosetothedestinationE0E0E1S0To0S1S0S1E0E0B BA AC C放置ACLD Dwg_ro_a#show ip int e0Ethernet0 is up, line protocol is up Internet addr
26、ess is 10.1.1.11/24 Broadcast address is 255.255.255.255 Address determined by setup command MTU is 1500 bytes Helper address is not set Directed broadcast forwarding is disabled Outgoing access list is not set Inbound access list is 1 Proxy ARP is enabled Security level is default Split horizon is
27、enabled ICMP redirects are always sent ICMP unreachables are always sent ICMP mask replies are never sent IP fast switching is enabled IP fast switching on the same interface is disabled IP Feature Fast switching turbo vector IP multicast fast switching is enabled IP multicast distributed fast switc
28、hing is disabled 验证ACL监视ACL陈述条件wg_ro_a#show access-lists Standard IP access list 1 permit 10.2.2.1 permit 10.3.3.1 permit 10.4.4.1 permit 10.5.5.1Extended IP access list 101 permit tcp host 10.22.22.1 any eq telnet permit tcp host 10.33.33.1 any eq ftp permit tcp host 10.44.44.1 any eq ftp-datawg_ro_a#show protocol access-list access-list number wg_ro_a#show access-lists access-list number
