15_使用访问列表管理IP流量概览.ppt

案例分析 案例分析 访问控制列表的作用 访问控制列表的作用 访问控制列表的作用 访问控制列表应用的位置 访问控制列表配置指南 访问控制列表配置方法 访问控制列表练习 检验访问控制列表 查看访问控制列表 使用命名的IP访问控制列表 Emphasize: To filter incoming and outgoing Telnet sessions to and from the router’s vty ports, the standard access list is used. If this is to block incoming Telnet sessions into a router’s vty port, the standard access list is used to match the source address of the host trying to Telnet into the router’s vty port. If this is to block outgoing Telnet sessions from the router’s vty ports to a host, the standard access list is used to match the destination address of the host the router is trying to Telnet into from its vty ports. Emphasize: Use the access-class command to apply the standard access list to the vty port. The next slide shows a configuration example. Purpose: This example shows how to restrict incoming Telnet sessions to the router’s vty ports. Emphasize: The access class is applied as an input filter. Note: Ask the student about the effect of changing the direction of the access class to outbound instead of inbound. Now the router can accept incoming Telnet sessions to its vty ports from all hosts, but will block outgoing Telnet sessions from its vty ports to all hosts except hosts in network . Once a user is Telneted into a router’s vty port, the outbound access-class filter will prevent the user from Telneting to other hosts as specified by the standard access list. Remember, when an access list is applied to an interface, it only blocks or permits traffic going through the router, it does not block or permit traffic initiated from the router itself. Purpose: This slide shows how to verify an access list. Emphasize: Lists IP interface information. Indicates whether the outgoing access list is set. Review the output of the show ip interface command. The highlighted text shows details about access list settings in the show command output. Purpose: This slide introduces the show access-lists command used to verify acc