第八章 用访问列表初步管理 IP流量.pptVIP

第八章用访问列表初步管理 IP流量 为什么要使用访问列表 访问列表的应用 如何识别访问列表号 通配符：如何检查相应的地址位 通配符掩码指明特定的主机 通配符掩码指明所有主机 出端口方向上的访问列表 访问列表的测试：允许和拒绝 标准IP访问列表的配置 标准访问列表举例 1 标准访问列表举例 2 标准访问列表举例 3 如何控制vty访问 虚拟通道访问举例 扩展访问列表应用举例 1 扩展访问列表应用举例 2 标准访问列表和扩展访问列表比较 访问列表配置准则 访问列表中限制语句的位置是至关重要的 将限制条件严格的语句放在访问列表的最上面 使用 no access-list number 命令删除完整的访问列表 例外: 名称访问列表可以删除单独的语句 隐含声明 deny all 在设置的访问列表中要有一句 permit any 访问列表的放置原则 查看访问列表 查看访问列表的语句 Slide 2 of 3 Purpose: Emphasize: Layer 2—Adds the IP extended access lists and the number ranges for these types of access lists. These are the most commonly used form of access list. This layer also adds the method for identifying IP access lists using an alphanumeric name rather than a number. An IP named access list can refer to either a standard or an extended IP access list. Slide 3 of 3 Purpose: Emphasize: Only host 3 is blocked from going out on E0 to subnet .  Ask the students what will happen if the access-list is placed as an input access-list on E1 instead - Host 3 will be blocked from going out to the Non cloud as well as to subnet . Note: The red arrows represent the access-list is applied as an outbound access-list. Slide 2 of 2 Purpose: Emphasize: All hosts on subnet is blocked from going out on E0 to subnet . Note: The red arrows represent the access-list is applied as an outbound access-list. Slide 3 of 3 Purpose: Emphasize: Slide 1 of 1 Purpose: Emphasize: Slide 1 of 1 Purpose: This figure illustrates common uses for IP access lists. Emphasize: While this chapter focuses on IP access lists, the concept of access lists as mechanisms to control traffic in a network applies to all protocols. Note: An improved security solution is the lock-and-key access feature, which is available only with IP extended access lists. Lock-and-key access allows you to set up dynamic access lists that grant access per user to a specific source/destination host through a user authentication process. You can allow user access through a firewall