ACL访问控制列表之命名篇(实践)

实践环境部署

拓扑结构图及需求

注意点:SW设备与SW-3设备需要事先添加容量及业务单板

实践步骤

第一步:配置SW交换机

conf t                //进入全局模式,设定vlan10 和20vlan 10,20exdo show vlan-sw b      //查看vlan信息VLAN Name                             Status    10   VLAN0010                         active    20   VLAN0020                         active    int range fa1/1 -2          //进入端口fa1/1和1/2 接口,将端口划入vlan10sw mo accsw acc vlan 10exdo show vlan-sw b       //查看vlan信息VLAN Name                             Status    Ports10   VLAN0010                         active    Fa1/1, Fa1/220   VLAN0020                         active    int f1/3                //进入端口f1/3,将端口划入vlan20 sw mo accsw acc vlan 20exdo show vlan-sw bVLAN Name                             Status    Ports10   VLAN0010                         active    Fa1/1, Fa1/220   VLAN0020                         active    Fa1/3int f1/0          //进入端口f1/0,配置trunk链路sw mo tsw t en dot1qexno ip routing          //关闭路由功能

第二步:配置SW-3三层交换机

conf tno switchport                //关闭交换功能int f1/1ip add 192.168.100.1 255.255.255.0no shutexvlan 10,20exint vlan 10ip add 192.168.10.1 255.255.255.0no shutexint vlan 20ip add 192.168.20.1 255.255.255.0no shutexdo show ip int b        //查看vlan信息FastEthernet1/1            192.168.100.1   YES manual up                    up Vlan10                     192.168.10.1    YES manual up                    down    Vlan20                     192.168.20.1    YES manual up                    downint f1/0                   //进入端口f1/0配置trunk链路sw mo tsw t en dot1qdo show ip route        //查看路由表C    192.168.10.0/24 is directly connected, Vlan10C    192.168.20.0/24 is directly connected, Vlan20C    192.168.100.0/24 is directly connected, FastEthernet1/1

第三步:配置客户机IP地址,并测试全网互通性

1.配置客户机IP地址

PC1> ip 192.168.100.100 192.168.100.1Checking for duplicate address...PC1 : 192.168.100.100 255.255.255.0 gateway 192.168.100.1PC2> ip 192.168.10.10 192.168.10.1 Checking for duplicate address...PC1 : 192.168.10.10 255.255.255.0 gateway 192.168.10.1PC3> ip 192.168.10.20 192.168.10.1Checking for duplicate address...PC1 : 192.168.10.20 255.255.255.0 gateway 192.168.10.1PC4> ip 192.168.20.20 192.168.20.1Checking for duplicate address...PC1 : 192.168.20.20 255.255.255.0 gateway 192.168.20.1

2.测试全网互通性

PC2> ping 192.168.100.100192.168.100.100 icmp_seq=1 timeout84 bytes from 192.168.100.100 icmp_seq=2 ttl=63 time=18.946 ms84 bytes from 192.168.100.100 icmp_seq=3 ttl=63 time=19.942 ms84 bytes from 192.168.100.100 icmp_seq=4 ttl=63 time=11.937 ms84 bytes from 192.168.100.100 icmp_seq=5 ttl=63 time=17.674 msPC2> ping 192.168.10.20  84 bytes from 192.168.10.20 icmp_seq=1 ttl=64 time=0.000 ms84 bytes from 192.168.10.20 icmp_seq=2 ttl=64 time=0.000 ms84 bytes from 192.168.10.20 icmp_seq=3 ttl=64 time=0.000 ms84 bytes from 192.168.10.20 icmp_seq=4 ttl=64 time=0.000 ms84 bytes from 192.168.10.20 icmp_seq=5 ttl=64 time=0.000 msPC2> ping 192.168.20.20192.168.20.20 icmp_seq=1 timeout84 bytes from 192.168.20.20 icmp_seq=2 ttl=63 time=18.230 ms84 bytes from 192.168.20.20 icmp_seq=3 ttl=63 time=21.964 ms84 bytes from 192.168.20.20 icmp_seq=4 ttl=63 time=19.229 ms84 bytes from 192.168.20.20 icmp_seq=5 ttl=63 time=11.992 ms

第四步:配置命名ACL策略

在SW-3交换机上进行配置,全局模式下

ip access-list standard yun          //设定模式以及命名名称,standard为标准命名ACL,extended为扩展命名ACLpermit host 192.168.10.10            //设定允许访问主机ip的条目deny 192.168.10.0 0.0.0.255        //设定拒绝的网段条目permit any                                    //设顶允许其他所有主机访问exdo show access-list                   //查看访问列表清单Standard IP access list yun    10 permit 192.168.10.10    20 deny   192.168.10.0, wildcard bits 0.0.0.255    30 permit anyint f1/1                                       //进入端口f1/1,将ACL应用与此出方向ip access-group yun out

第五步:测试ACL效果

1.测试vlan10 中的主机2与主机1的互通性

PC2> ping 192.168.100.100192.168.100.100 icmp_seq=1 timeout192.168.100.100 icmp_seq=2 timeout84 bytes from 192.168.100.100 icmp_seq=3 ttl=63 time=15.953 ms84 bytes from 192.168.100.100 icmp_seq=4 ttl=63 time=19.232 ms84 bytes from 192.168.100.100 icmp_seq=5 ttl=63 time=19.049 ms

2.测试主机4与主机1的互通性

PC4> ping 192.168.100.10084 bytes from 192.168.100.100 icmp_seq=1 ttl=63 time=20.226 ms84 bytes from 192.168.100.100 icmp_seq=2 ttl=63 time=18.953 ms84 bytes from 192.168.100.100 icmp_seq=3 ttl=63 time=18.208 ms84 bytes from 192.168.100.100 icmp_seq=4 ttl=63 time=17.023 ms84 bytes from 192.168.100.100 icmp_seq=5 ttl=63 time=12.985 ms

3.测试vlan10 中的其他主机与主机1的互通性

PC3> ping 192.168.100.100*192.168.10.1 icmp_seq=1 ttl=255 time=8.907 ms (ICMP type:3, code:13, Communication administratively prohibited)*192.168.10.1 icmp_seq=2 ttl=255 time=3.775 ms (ICMP type:3, code:13, Communication administratively prohibited)*192.168.10.1 icmp_seq=3 ttl=255 time=7.979 ms (ICMP type:3, code:13, Communication administratively prohibited)*192.168.10.1 icmp_seq=4 ttl=255 time=5.965 ms (ICMP type:3, code:13, Communication administratively prohibited)*192.168.10.1 icmp_seq=5 ttl=255 time=1.992 ms (ICMP type:3, code:13, Communication administratively prohibited)

注:命名访问控制列表可灵活的调整策略,前提是在标准访问列表以及扩展访问列表的基础上,可以使用no+ACL号删除策略.也可以使用ACL号+permit+ip追加ACL策略