ACL单向访问控制.docVIP

ACL单向访问控制 二． 需求: /24可以访问任意网段，/24不能访问/24，也就是/24对/24进行单向访问。 三． 配置及说明: 1． R1上的配置: R1#show run Building configuration... Current configuration : 1332 bytes ! version 12.3 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname R1 ! boot-start-marker boot-end-marker ! enable secret 5 $1$Yc6b$9QYnfAwbhUpaxYDj3RxUv0 ! no aaa new-model ip subnet-zero ! ! no ip domain lookup ! ip cef ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! interface FastEthernet0/0 no ip address shutdown duplex half ! interface Serial1/0 ip address ip access-group in-filte in ip access-group out-filte out serial restart-delay 0 ! interface Serial1/1 ip address serial restart-delay 0 ! interface Serial1/2 no ip address shutdown serial restart-delay 0 ! interface Serial1/3 no ip address shutdown serial restart-delay 0 ! router ospf 1 log-adjacency-changes network 55 area 0 ! ip classless no ip http server no ip http secure-server ! ! ! ip access-list extended in-filte evaluate single-access //调用out-filte的single-access,作用是检查外网进来的流量，如果是内网发起的连接，则允许进来 deny ip 55 55 //非内网发起的连接，则拒绝 permit ip any any ip access-list extended out-filte permit ip 55 55 reflect single-access //定义单向流量 permit ip any any ! ! ! ! ! ! ! gatekeeper shutdown ! ! line con 0 exec-timeout 0 0 logging synchronous stopbits 1 line aux 0 stopbits 1 line vty 0 4 password cisco login ! ! end 2． R3上的测试： R3#ping Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to , timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 28/48/96 ms R3#ping Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to , timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 36/75/120 ms R3#telnet Trying ... Open User Access Verification Password: R2exit [Connection to closed by foreign host] R3#telnet Trying ... Open User Access Verification Password: R2exit [Connection to closed by foreign host] R3# //R3可以访问R2的任意接