實(shí)驗(yàn)八ACL包過濾

1、實(shí)驗(yàn)八 ACL包過濾一、實(shí)驗(yàn)?zāi)康牧私庠L問控制列表的簡(jiǎn)單工作原理掌握基本ACL的配置掌握高級(jí)ACL的配置二、實(shí)驗(yàn)描述及組網(wǎng)圖用串口線將兩臺(tái)路由器相連，配置ACL，以實(shí)現(xiàn)jiance1上不能Ping通jiance2。 圖1-1三、實(shí)驗(yàn)過程實(shí)驗(yàn)任務(wù)一：用基本ACL實(shí)現(xiàn)步驟一：搭建環(huán)境按圖1-1建立物理連接，配置IP地址。步驟二：測(cè)試連通性在jiance1上Ping jiance2，顯示如下：jiance1ping 10.1.1.2PING 10.1.1.2: 56 data bytes, press CTRL_C to breakReply from 10.1.1.2: bytes=56 Seque

2、nce=1 ttl=255 time=1 msReply from 10.1.1.2: bytes=56 Sequence=2 ttl=255 time=1 msReply from 10.1.1.2: bytes=56 Sequence=3 ttl=255 time=1 msReply from 10.1.1.2: bytes=56 Sequence=4 ttl=255 time=1 msReply from 10.1.1.2: bytes=56 Sequence=5 ttl=255 time=1 ms- 10.1.1.2 ping statistics -5 packet(s) trans

3、mitted 5 packet(s) received 0.00% packet lossround-trip min/avg/max = 1/1/1 ms在jiance2 上開啟telnet server，配置見實(shí)驗(yàn)手冊(cè)telnet部分。<jiance1>telnet 10.1.1.2 23Trying 10.1.1.2 .Press CTRL+K to abortConnected to 10.1.1.2 .* Copyright (c) 2004-2009 Hangzhou H3C Tech. Co., Ltd. All rights reserved. * Without

4、the owner's prior written consent, * no decompiling or reverse-engineering shall be allowed. *Welcome!Login authenticationUsername:h3cPassword:<jiance2>步驟三：創(chuàng)建基本ACLjiance2acl number 2000jiance2-acl-basic-2000rule 0 deny source 10.1.1.1 0.0.0.0步驟四：應(yīng)用ACL基本ACL應(yīng)部署在靠近目的的地方。因此，部署在jiance2的E0/0.。ji

5、ance2firewall enablejiance2firewall default permit jiance2interface Ethernet 0/0jiance2-Ethernet0/0firewall packet-filter ? INTEGER<2000-2999> Apply basic acl INTEGER<3000-3999> Apply advanced acl INTEGER<4000-4999> Apply ethernet frame header acl ipv6 ACL IPv6 name Specify a named

6、 acljiance2-Ethernet0/0firewall packet-filter 2000 ? inbound Apply the acl to filter in-bound packets outbound Apply the acl to filter out-bound packetsjiance2-Ethernet0/0firewall packet-filter 2000 inbound ? <cr> jiance2-Ethernet0/0firewall packet-filter 2000 inbound 步驟五：驗(yàn)證用在jiance1上Ping路由器ji

7、ance2：jiance1ping 10.1.1.2 PING 10.1.1.2: 56 data bytes, press CTRL_C to break Request time out Request time out Request time out Request time out Request time out - 10.1.1.2 ping statistics - 5 packet(s) transmitted 0 packet(s) received 100.00% packet loss遠(yuǎn)程登錄jiance2, 如下：<jiance1>telnet 10.1.

8、1.2 23Trying 10.1.1.2 .Press CTRL+K to abortCan't connect to the remote host!分析：應(yīng)用基本ACL后，jiance1所有訪問jiance2的數(shù)據(jù)流都被禁止了。實(shí)驗(yàn)任務(wù)二：用高級(jí)ACL實(shí)現(xiàn)步驟一：搭建環(huán)境按圖1-1建立物理連接，配置IP地址。步驟二：測(cè)試連通性在jiance1上Ping jiance2，顯示如下：jiance1ping 10.1.1.2 PING 10.1.1.2: 56 data bytes, press CTRL_C to break Reply from 10.1.1.2: bytes=56

9、 Sequence=1 ttl=255 time=1 ms Reply from 10.1.1.2: bytes=56 Sequence=2 ttl=255 time=1 ms Reply from 10.1.1.2: bytes=56 Sequence=3 ttl=255 time=1 ms Reply from 10.1.1.2: bytes=56 Sequence=4 ttl=255 time=1 ms Reply from 10.1.1.2: bytes=56 Sequence=5 ttl=255 time=1 ms - 10.1.1.2 ping statistics - 5 pac

10、ket(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 1/1/1 ms步驟三：創(chuàng)建高級(jí)ACLjiance1acl number 3000jiance1-acl-adv-3000rule 0 deny icmp source 10.1.1.1 0.0.0.0 destination 10.1.1.2 0.0.0.0步驟四：部署ACL高級(jí)ACL應(yīng)部署在靠近源的的地方。因此，部署在jiance1的E0/0.。jiance1firewall enable jiance1firewall de

11、fault permit jiance1interface Ethernet 0/0jiance1-Ethernet0/0firewall packet-filter 3000 outbound 步驟五：驗(yàn)證jiance1ping 10.1.1.2 PING 10.1.1.2: 56 data bytes, press CTRL_C to break Request time out Request time out Request time out Request time out Request time out - 10.1.1.2 ping statistics - 5 packet(

12、s) transmitted 0 packet(s) received100.00% packet loss顯示配置的ACLjiance1display acl 3000Advanced ACL 3000, named -none-, 1 rule,ACL's step is 5 rule 0 deny icmp source 10.1.1.1 0 destination 10.1.1.2 0 (5 times matched)查看防火墻的統(tǒng)計(jì)信息jiance1display firewall-statistics all Firewall is enable, default fil

13、tering method is 'permit'. Interface: Ethernet0/0 Out-bound Policy: acl 3000 Fragments matched normally From 2010-04-03 9:57:39 to 2010-04-03 10:06:10 0 packets, 0 bytes, 0% permitted, 5 packets, 420 bytes, 100% denied, 0 packets, 0 bytes, 0% permitted default, 0 packets, 0 bytes, 0% denied default, Totally 0 packets, 0 bytes, 0% permitted, Totally 5 packets, 420 bytes, 100% denied. 遠(yuǎn)程登錄測(cè)試：<jiance1>telnet 10.1.1.2 23Trying 10.1.1.2 .Press CTRL+K to abortConnected to 10.1.1.2 .* Copyright (c) 2004-200