Packet Tracer 5.3建構(gòu)CCNA實(shí)驗(yàn)攻略ACL簡單的配置.doc

Packet Tracer 5.3建構(gòu)CCNA實(shí)驗(yàn)攻略ACl的配置三、配置簡單的ACL、配置ACL限制遠(yuǎn)程登錄到路由器的主機(jī)HuangChuang#conf tEnter configuration commands, one per line. End with CNTL/Z.HuangChuang(config)#access-list 1 permit host 路由器HuangChuang只允許遠(yuǎn)程登錄(telnet)HuangChuang(config)#line vty 0 4HuangChuang(config-line)#access-class 1 in其它兩個(gè)路由器配置相似。、配置ACL禁止/24網(wǎng)段的icmp協(xié)議數(shù)據(jù)包通向與/24網(wǎng)段xixian(config)#access-list 101 deny icmp 55 55xixian(config)#access-list 101 permit ip any anyxixian(config)#int fa0/1xixian(config-if)#ip access-group 101 out、配置ACL禁止特點(diǎn)的協(xié)議端口通訊HuangChuang#conf tHuangChuang(config)#ip access-list extended ACL1創(chuàng)建基于名稱的擴(kuò)展ACLHuangChuang(config-ext-nacl)#deny tcp host 55 eq 80HuangChuang(config-ext-nacl)#deny udp host 55 eq 53HuangChuang(config-ext-nacl)#permit ip any anyHuangChuang(config-ext-nacl)#exitHuangChuang(config)#int fa0/1HuangChuang(config-if)#ip access-group ACL1 inPacket Tracer 5.0建構(gòu)CCNA實(shí)驗(yàn)攻略(17)終結(jié)篇一、端口映射由于IP地址緊缺，或者小企業(yè)（單位）由于資金投入的原因，只能有一個(gè)公網(wǎng)的IP地址，使用NAT(網(wǎng)絡(luò)地址轉(zhuǎn)換）上網(wǎng)。如果此時(shí)還想對(duì)外提供服務(wù)，那就得進(jìn)行端口映射。、配置NAT（Router Company）Router(config)#access-list 1 permit 55Router(config)#ip nat inside source list 1 interface serial0/3/0 overloadRouter(config)#int serial0/3/0Router(config-if)#ip nat outsideRouter(config-if)#int fa0/1Router(config-if)#ip nat insideRouter(config-if)#exitRouter(config)#ip route Router(config)#router eigrp 100Router(config-router)#network Router(config-router)#exit、配置端口映像Router(config)#ip nat inside source static tcp 80 80上面的命令意思是：把內(nèi)網(wǎng)ip為的80端口與的80端口映射，當(dāng)從互聯(lián)網(wǎng)上訪問時(shí)，其實(shí)就是訪問，假設(shè)的域?yàn)?，從pc2訪問：圖二路由器Company的配置：Company#sh running-configBuilding configuration.Current configuration : 734 bytes!version 12.4no service password-encryption!hostname Company!ip ssh version 1!interface FastEthernet0/0no ip addressduplex autospeed autoshutdown!interface FastEthernet0/1ip address ip nat insideduplex autospeed auto!interface Serial0/3/0ip address ip nat outside!interface Vlan1no ip addressshutdown!router eigrp 100network auto-summary!ip nat inside source list 1 interface Serial0/3/0 overloadip nat inside source static tcp 80 80 ip classlessip route !access-list 1 permit 55!no cdp run!line con 0line vty 0 4login!end三、捕獲PDU