第十一章 访问控制列表.pptVIP

Chapter 11 Access Control list 11.1 Introduction to ACLs 11.1 介绍ACL 通过建立ACL，可以控制任何IP地址对网络的访问，并能有效的实现对一些敏感设备的访问。 How ACLs Work? Creating ACLs 2.2 Standard ACLs 2.2 标准ACL example Verifying ACLs Examples 1 允许来自网络的流量 Router#configure terminal Router(config)#access-list 1 permit 55 Examples 2 禁止来自网络的流量 Router#configure terminal Router(config)#access-list 2 deny 55 Router(config)#access-list 2 permit any Router(config)#int s0 Router(config-if)#ip access-group 2 out Example 3 拒绝特定主机，允许其它主机访问 Router#configure terminal Router(config)#access-list 1 deny host Router(config)#access-list 1 permit any Example 4 标准ACL来过滤到路由器的telnet流量的简单实例 Router(config)# access-list 99 permit 55 Router(config)# line vty 0 4 Router(config-line)# access-class 99 in 2.3 Extended ACLs 2.3 扩展ACL Router(config)# access-list 100-199|2000-2699 permit|deny IP_protocol source_address source_wildcard_mask [protocol_information] destination_address destination_wildcard_mask [protocol_information] TCP and UDP Router(config)# access-list 100-199|2000-2699 permit|deny tcp|udp source_address source_wildcard_mask [operator source_port_#] destination_address destination_wildcard_mask [operator destination_port_#] [established] Operators established For the TCP protocol only: Indicates an established connection. A match occurs if the TCP datagram has the ACK, FIN, PSH, RST, SYN, or URG control bits set. ICMP Router(config)#access-list 100-100|2000-2699 permit|deny icmp source_address source_wildcard_mask destination_address destination_wildcard_mask [icmp_message] Example Router(config)# access-list 100 permit tcp any 55 established log Router(config)# access-list 100 permit udp any host eq dns log Router(config)# access-list 100 permit tcp 55 host eq telnet log Router(config)# access-list 100 permit icmp any 55 echo-reply log Router(config)# access-list 100 deny ip any any log Router(config)# interface ethernet 0 Router(config-if)# ip access-group 100 in 2.4 Named AC