访问控制列表-基于IP

【总结】

　　在交换机1上划分vlan然后把fa0/1接口设置为trunk周围几个接口都设置为access。在RA上划分四个逻辑口(就是小数点的那些接口)。然后RA和RB都做ospf就可以ping同。

　　最后就是访问控制列表的内容了。

　　其实访问控制列表就是在需要设置不允许或允许的目标的旁边机器设置：

　　Router(config)#access-list 10 permit 172.16.1.0 0.0.0.255

　　然后设置一下应用访问的接口。

交换机1：

Switch>
Switch>en
Switch#configure t
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#vlan 10
Switch(config-vlan)#vlan 20
Switch(config-vlan)#vlan 30
Switch(config-vlan)#vlan 40
Switch(config-vlan)#exit
Switch(config)#interface fa0/1
Switch(config-if)#switchport mode trunk
Switch(config-if)#interface fa0/5
vlan Set VLAN when interface is in access mode
Switch(config-if)#switchport access vlan 10
Switch(config-if)#interface fa0/6
Switch(config-if)#switchport access vlan 20
Switch(config-if)#interface fa0/7
Switch(config-if)#switchport access vlan 30
Switch(config-if)#interface fa0/8
Switch(config-if)#switchport access vlan 40
Switch(config-if)#interface fa0/1
Switch(config-if)#no shutdown
Switch(config-if)#
Switch(config-if)#
%LINK-5-CHANGED: Interface FastEthernet0/1, changed state to up

%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up

ospf部分

Router(config)#router ospf 1
Router(config-router)#ne
Router(config-router)#network 172.16.1.0 0.0.0.255 area 0
Router(config-router)#network 172.16.2.0 0.0.0.255 area 0
Router(config-router)#network 172.16.3.0 0.0.0.255 area 0
Router(config-router)#network 172.16.4.0 0.0.0.255 area 0
Router(config-router)#network 10.1.1.0 0.0.0.255 area 0
Router(config-router)#exit

RA：

Router>en
Router#conf
Router#configure t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#interface fa0/1
Router(config-if)#no shutdown

Router(config-if)#
%LINK-5-CHANGED: Interface FastEthernet0/1, changed state to up

%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up

Router(config-if)#interface se0/2/0
Router(config-if)#ip address 10.1.1.1 255.255.255.0
Router(config-if)#no shutdown

%LINK-5-CHANGED: Interface Serial0/2/0, changed state to down
Router(config-if)#interface fa0/1.1
Router(config-subif)#
%LINK-5-CHANGED: Interface FastEthernet0/1.1, changed state to up

%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1.1, changed state to up

Router(config-subif)#encapsulation dot1Q 10
Router(config-subif)#ip address 172.16.1.1 255.255.255.0
Router(config-subif)#interface fa0/1.2
Router(config-subif)#
%LINK-5-CHANGED: Interface FastEthernet0/1.2, changed state to up

%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1.2, changed state to up

Router(config-subif)#encapsulation dot1Q 20
Router(config-subif)#ip address 172.16.2.1 255.255.255.0
Router(config-subif)#interface fa0/1.3
Router(config-subif)#
%LINK-5-CHANGED: Interface FastEthernet0/1.3, changed state to up

%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1.3, changed state to up
Router(config-subif)#encapsulation dot1Q 30
Router(config-subif)#ip address 172.16.3.1 255.255.255.0
Router(config-subif)#interface fa0/1.4
Router(config-subif)#
%LINK-5-CHANGED: Interface FastEthernet0/1.4, changed state to up

%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1.4, changed state to up

Router(config-subif)#encapsulation dot1Q 40
Router(config-subif)#ip address 172.16.4.1 255.255.255.0
Router(config-subif)#

RB也要做ospf。这里就不讲解了。

现在已经pc机器可以ping同服务器了。

我们要做的就是使用访问控制列表不允许生产部、销售部进行访问192.168.1.100这台服务器。

我们在RB上做以下操作：

Router(config)#access-list 10 permit 172.16.1.0 0.0.0.255
Router(config)#access-list 10 permit 172.16.2.0 0.0.0.255
Router(config)#access-list 10 deny 172.16.3.0 0.0.0.255
Router(config)#access-list 10 deny 172.16.4.0 0.0.0.255

#permit英译为允许、deny英译为拒绝。

然后接口应用访问控制列表。

Router(config)#interface fa0/1
Router(config-if)#ip access-group 10 out

#在入站数据包
#出站数据包