华为设备基本ACL和高级ACL综合配置 | 易学教程

实验需求：
0、做之前确保全网互通
1、-交换机用路由器代替，WG主机用路由器模拟
2、-AR1只能允许WG登陆
3、-YF和CW之间不能互通，但可以和WG互通
4、-WG和YF可以访问Client1
5、-CW不能访问Client1
6、-YF和WG只能访问Server1的WWW服务
7、-只有WG才能访问Server1的所有服务

实验拓扑：

实验配置：

---------------------------------------------------------------------------------
[WG]int g0/0/0
[WG-GigabitEthernet0/0/0]ip add 192.168.10.1 24
[WG-GigabitEthernet0/0/0]un shutdown
[WG]rip
[WG-rip-1]version 2
[WG-rip-1]network 192.168.10.0
----------------------------
[AR2]int g0/0/1
[AR2-GigabitEthernet0/0/1]ip add 192.168.10.2 24
[AR2-GigabitEthernet0/0/1]un shutdown

[AR2]int g0/0/0
[AR2-GigabitEthernet0/0/0]ip add 192.168.12.1 24
[AR2-GigabitEthernet0/0/0]un shutdown

[AR2]int g0/0/2
[AR2-GigabitEthernet0/0/2]ip add 192.168.20.254 24
[AR2-GigabitEthernet0/0/2]un shutdown

[AR2]rip
[AR2-rip-1]version 2
[AR2-rip-1]network 192.168.10.0
[AR2-rip-1]network 192.168.12.0
[AR2-rip-1]network 192.168.20.0
--------------------------------------
[AR1]int g0/0/1
[AR1-GigabitEthernet0/0/1]ip add 192.168.12.2 24
[AR1-GigabitEthernet0/0/1]un shutdown

[AR1]int g0/0/0
[AR1-GigabitEthernet0/0/0]ip add 1.1.1.254 24
[AR1-GigabitEthernet0/0/0]un shutdown

[AR1]int g0/0/2
[AR1-GigabitEthernet0/0/2]ip add 192.168.13.2 24
[AR1-GigabitEthernet0/0/2]un shutdown

[AR1]rip
[AR1-rip-1]version 2
[AR1-rip-1]network 192.168.12.0
[AR1-rip-1]network 1.0.0.0
[AR1-rip-1]network 192.168.13.0
---------------------------------------------
[AR3]int g0/0/0
[AR3-GigabitEthernet0/0/0]ip add 192.168.13.1 24
[AR3-GigabitEthernet0/0/0]un shutdown

[AR3]int g0/0/1
[AR3-GigabitEthernet0/0/1]ip add 192.168.30.254 24
[AR3-GigabitEthernet0/0/1]un shutdown

[AR3]int g0/0/2
[AR3-GigabitEthernet0/0/2]ip add 192.168.1.254 24
[AR3-GigabitEthernet0/0/2]un shutdown

[AR3]rip
[AR3-rip-1]version 2
[AR3-rip-1]network 192.168.13.0
[AR3-rip-1]network 192.168.30.0
[AR3-rip-1]network 192.168.1.0

===================================================================================
关键配置：1
设备访问控制
-AR1只能允许WG登陆
[AR1]acl 2000
[AR1-acl-basic-2000]rule 5 permit source 192.168.10.1 0
[AR1-acl-basic-2000]rule 10 deny source any

[AR1]user-interface vty 0 4
[AR1-ui-vty0-4]acl 2000 inbound
[AR1-ui-vty0-4]authentication-mode aaa
[AR1-ui-vty0-4]aaa
[AR1-aaa]local-user 77 password cipher 77
[AR1-aaa]local-user 77 service-type telnet

-------------------------------------------------------------------------------------
关键配置：2
YF主机访问控制
-YF和CW之间不能互通，
YF可以和WG、Client1互通
YF只能访问Server1的WWW服务
[AR2]acl 3000
[AR2-acl-adv-3000]rule 5 permit ip source 192.168.20.1 0 destination 192.168.10.1 0
[AR2-acl-adv-3000]rule 10 permit ip source 192.168.20.1 0 destination 1.1.1.1 0
[AR2-acl-adv-3000]rule 15 permit tcp source 192.168.20.1 0 destination 192.168.1
.1 0 destination-port eq 80

[AR2-acl-adv-3000]rule 20 deny ip source any
[AR2]int g0/0/2
[AR2-GigabitEthernet0/0/2]traffic-filter inbound acl 3000

------------------------------------------------------------------------------------
关键配置：3
CW主机访问控制
CW和YF、Client1之间不能互通
CW可以和WG通
CW只能访问Server1的WWW服务

[AR3]acl 3000
[AR3-acl-adv-3000]rule 5 permit ip source 192.168.30.1 0 destination 192.168.10.1 0
[AR3-acl-adv-3000]rule 10 permit tcp source 192.168.30.1 0 destination 192.168.1
.1 0 destination-port eq 80
[AR3-acl-adv-3000]rule 15 deny ip source any
[AR3]int g0/0/1
[AR3-GigabitEthernet0/0/1]traffic-filter inbound acl 3000

-------------------------------------------------------------------------
查看命令：
<AR3>display acl 3000
<AR2>display acl 3000
<AR1>display acl 2000

------------------------------------------------------------------------------------

来源：CSDN

作者：_闫露坤

链接：https://blog.csdn.net/qq_43640414/article/details/86763045

标签

易学教程内所有资源均来自网络或用户发布的内容，如有违反法律规定的内容欢迎反馈！
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!