-.z.擴(kuò)展訪問控制列表CISCO之CA篇之七〔3〕2021-06-2815:48:09標(biāo)簽：訪問列表CA休閑CISCO聲明：原創(chuàng)作品，謝絕！否則將追究法律責(zé)任。在訪問控制列表〔ACL〕簡介CISCO之CA篇之七〔1〕這篇文章中我們已經(jīng)提到了標(biāo)準(zhǔn)的訪問列表，下面就用兩個(gè)實(shí)例來詳細(xì)介紹下具體的應(yīng)用。擴(kuò)展訪問控制列表語法：

Lab(config)#access-list[100-199][permit/deny]協(xié)議源IP源IP反碼目標(biāo)IP目標(biāo)IP反碼條件[eq][具體協(xié)議/端口號(hào)]舉個(gè)語法實(shí)例，便于大家理解：Lab(config)#access-list101denytcp192.168.1.100.0.0.0172.16.1.20.0.0.0eqtelnet

或Lab(config)#access-list101denytcphost192.168.1.10host172.16.1.2eq23

注意：只禁用*個(gè)效勞〔或*個(gè)端口〕需要把其他設(shè)置翻開

Lab(config)#access-list101permitipanyany

Lab(config)#intfa0/0

(綁定到接口上)

Lab(config-if)#ipclass-group101in

注：eq等于；gt大于；lt小于；neq不等于。擴(kuò)展ACL實(shí)驗(yàn)一：只禁用PC0對(duì)外網(wǎng)效勞器〔Server0〕的訪問

具體是實(shí)驗(yàn)拓?fù)鋱D如下列圖Server0充當(dāng)外網(wǎng)效勞器，它需要的配置如下，為其開啟DNS效勞，添加域名.itet.然后再為其開啟效勞，隨便輸入一些粗糙的網(wǎng)頁內(nèi)容，見下列圖標(biāo)注處，路由器R1需要的配置〔根本的IP配置見上圖〕r1>

r1>en

r1#shrun

Buildingconfiguration...Currentconfiguration:460bytes

!version12.2

noservicepassword-encryption

!

hostnamer1

！ipsshversion1

!interfaceFastEthernet0/0ipaddress192.168.1.1255.255.255.0ipaccess-group101in

duple*auto

speedauto

!interfaceFastEthernet0/1ipaddress202.106.1.1255.255.255.0

duple*auto

speedauto

!ipclassless

!access-list101denytcphost192.168.1.2host202.106.1.2eq

access-list101permitipanyany!linecon0

linevty04

login

!end

實(shí)驗(yàn)結(jié)果，先來看下面的圖，翻開"WEB瀏覽器〞，先在PC0上進(jìn)展域名訪問，連接不上，然后再在PC1上進(jìn)展域名訪問，成功進(jìn)入我們自己設(shè)置的網(wǎng)頁界面，通過這個(gè)測試，我們成功的禁用了PC0對(duì)外網(wǎng)效勞器〔Server0〕的訪問，下面我們?cè)倥e一例，介紹擴(kuò)展ACL的應(yīng)用。擴(kuò)展ACL實(shí)驗(yàn)二：只禁用PC1對(duì)R2的PING操作

具體的實(shí)驗(yàn)拓?fù)鋱D如下：路由器R1的配置如下：r1>

r1>en

r1#shrun

Buildingconfiguration...Currentconfiguration:639bytes

!version12.2

noservicepassword-encryption

!hostnamer1

!ipsshversion1

!interfaceFastEthernet0/0ipaddress192.168.1.1255.255.255.0ipaccess-group101induple*auto

speedauto

!interfaceFastEthernet0/1

noipaddress

duple*auto

speedauto

shutdown

!interfaceSerial0/0ipaddress172.16.1.1255.255.255.0

clockrate64000

!interfaceSerial0/1

noipaddress

shutdown

!ipclassless

!

!access-list101denyicmphost192.168.1.2host172.16.1.2echo

access-list101denyicmphost192.168.1.2host172.16.1.2echo-reply

access-list101permitipanyany!linecon0

linevty04

login

!

end路由器R2的配置如下：

r2>

r2>en

r2#shrun

Buildingconfiguration...Currentconfiguration:463bytes

!version12.2

noservicepassword-encryption

!hostnamer2

!ipsshversion1

!interfaceFastEthernet0/0

noipaddress

duple*auto

speedauto

shutdown

!interfaceFastEthernet0/1

noipaddress

duple*auto

speedauto

shutdown

!interfaceSerial0/0ipaddress172.16.1.2255.255.255.0

!interfaceSerial0/1

noipaddress

shutdown!ipclasslessip

!linecon0

linevty04

login

!end

實(shí)驗(yàn)結(jié)果：還是先來看下面的圖，PC1在PING路由