访问控制列表[1].pptVIP

? 2007 Cisco Systems, Inc. All rights reserved. ICND2 v1.0—2-* ? 2007 Cisco Systems, Inc. All rights reserved. ICND2 v1.0—2-* Introducing ACL Operation Access Control Lists Outline Overview ACL Overview ACL Applications Types of ACLs ACL Operations ACL Statement Processing Wildcard Masking Process Summary Why Use ACLs? Filtering过滤: Manage IP traffic by filtering packets passing through a router Classification分类: Identify traffic for special handling ACL Applications: Filtering Permit or deny packets moving through the router. Permit or deny vty access to or from the router. Without ACLs, all packets could be transmitted to all parts of your network. ACL Applications: Classification 定义被保护的流量 定义被过滤的路由选择更新 定义需要转换的地址 Special handling for traffic based on packet tests Types of ACLs Standard ACL标准列表: (1-99) 检查数据包的源地址 一旦应用会对所有的协议调用 Extended ACL扩展列表: (100-199) 检查数据包的源地址和目的地址 对特定的某些协议某些端口进行调用 Named ACL: standard and extended ACLs: Numbered ACLs use a number for identification Named ACLs use a descriptive name or number for identification How to Identify ACLs Numbered standard IPv4 lists (1–99) test conditions of all IP packets for source addresses. Expanded range (1300–1999). Numbered extended IPv4 lists (100–199) test conditions of source and destination addresses, specific TCP/IP protocols, and destination ports. Expanded range (2000–2699). Named ACLs identify IP standard and extended ACLs with an alphanumeric string (name). ? 标准ACL 的工作原理 出站访问列表的工作原理 Wildcard Bits: How to Check the Corresponding Address Bits 0 means to match the value of the corresponding address bit 1 means to ignore the value of the corresponding address bit Wildcard Bits to Match a Specific IP Host Address Wildcard Bits to Match Any IP Address Match for IP subnets 172.30.16.0/24 to 172.30.31.0/24. Wildcard Bits to Match IP Subnets Address and wildcard mask: 172.30.16.0 0.0.15.255 * * * Layer 2 of 2 Emphasize: An access list is a mechanism for identifying particular traffic. One application of