1路由交换05访问控制列表ACL.pptx

信息安全产品配置与应用Configuration and Application of Information Security Products重庆电子工程职业学院| 路亚模块八、路由交换安全配置访问控制列表Access Control List教学目标（ Objectives ）1. 访问控制列表（Access Control List）2.配置标准访问控制列表（ Configure standard IP access lists ） 3. 配置扩展访问控制列表（ Configure extended IP access lists ）4.配置命名访问控制列表（ Configure named IP access lists ）5. 验证和监视ACL（ Verify and monitor IP access lists ）为什么使用ACL？（Why Use Access Control Lists?）Internet当网络访问增长时，管理IP通信Manage IP traffic as network access grows当数据包通过路由器时，起到过滤作用Filter packets as they pass through the routerACL作用（ Function of ACL ）1．限制网络流量、提高网络性能。 Limit network traffic and increase network performance. 2．提供对通信流量的控制手段。Provide traffic flow control. 3．提供网络访问的基本安全手段。Provide a basic level of security for network access. 4．在路由器接口处，决定哪种类型的通信流量被转发、哪种类型的通信流量被阻塞。 Decide which types of traffic are forwarded or blocked at the router interfaces. ACL如何工作（ACL How to work）ACL条件顺序（The order in which ACL statements are placed ）ACL条件顺序（The order in which ACL statements are placed ）Cisco IOS按照各描述语句在ACL中的顺序，根据各描述语句的判断条件，对数据包进行检查。一旦找到了某一匹配条件，就结束比较过程，不再检查以后的其他条件判断语句。The Cisco IOS software tests the packet against each condition statement in order from the top of the list to the bottom. Once a match is found in the list, the accept or reject action is performed and no other ACL statements are checked Source 什么是ACL？（What Are Access Lists?）Access List Processesfa0/0OutgoingPacketIncomingPacketPermit?S0/0标准 ACL （ Standard ACL ）检查源地址（Checks Source address ）允许或拒绝整个协议族（Generally permits or denies entire protocol suite）Sourceand Destination 什么是ACL？（What Are Access Lists?）Access List ProcessesFa0/0OutgoingPacketProtocolIncomingPacketPermit?s0/0扩展 ACL （ Extended ACL ）检查源和目的地址（ Checks Source and Destination address）通常允许或拒绝特定的协议 （Generally permits or denies specific protocols） 用扩展ACL检查数据包（Check Packets with Extended ACL）常见端口号（Known Port Number）端口号(Port Number)20文件传输协议（FTP）数据21文件传输协议（FTP）程序23远程登录（Telnet）25简单邮件传输协议（SMTP）69普通文件传送协议（TFTP）80超文本传输协议(HTTP)53域名服务系统（DNS）ACL表号（ACL Nu