第四课 配置访问控制列表.ppt

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—5-1 第四课 配置访问控制列表 学习目标 在前面所掌握的ACL原理和配置基础上，这节课我们来拓展一下知识点，来学习关于时间的访问列表，扩展学生知识。 课程内容 1、通过所掌握的协议和端口号来实施流量控制 2、理解接口优先级别与访问列表配置规则 3、配置基于时间的访问列表 4、 ActiveX 过滤 5、URL 过滤 基于时间的访问列表 Define a time when certain resources can be accessed. Apply defined time range to the ACL. Web Server Internet DMZ Inside .2 .1 .9 Enable Access 8 a.m to 5 p.m. 1 Aug to 30 Aug Temp Worker fw1(config)# time-range temp-worker fw1(config-time-range)# firewall(config)# time-range name Time-Range 子命令 定义一个认证时间当资源可以访问时: 定义一个绝对开始时间和日期 定义一个周期时间 fw1(config)# time-range temp-worker fw1(config-time-range)# absolute start 00:00 1 August 2004 end 00:00 30 August 2004 fw1(config-time-range)# periodic weekdays 8:00 to 17:00 firewall(config)# Web Server Internet DMZ Inside .2 .1 .9 Temp Worker Enable Access 8 a.m to 5 p.m. 1 Aug to 30 Aug Time-based ACL 应用时间范围到一个列表上 fw1(config)# static (dmz,outside) fw1(config)# access-list aclin permit tcp host host eq www time-range temp-worker Web Server Internet DMZ Inside .2 .1 .9 Temp Worker firewall(config)# Enable Access 8 a.m to 5 p.m. 1 Aug to 30 Aug Time-based ACL 例子 fw1(config)# static (dmz,outside) fw1(config)# access-list aclin permit tcp host host eq www time-range temp-worker fw1# show run time-range time-range temp-worker absolute start 00:00 1 August 2004 end 00:00 30 August 2004 periodic weekdays 8:00 to 17:00 fw1(config)# show clock 13:48:33.226 UTC Fri Jul 30 2004 fw1(config)# show access-list access-list cached ACL log flows: total 0, denied 0 (deny-flow-max 4096) alert-interval 300 access-list aclin; 1 elements access-list aclin line 1 extended permit tcp any any eq www time-range temp-worker (hitcnt=0) (inactive) Web Server Internet DMZ Inside .2 .1 .9 Temp Worker Enable Access 8 a.m to 5 p.m. 1 Aug to 30 Aug ActiveX 过滤 fw1(config)# filter activex 80 Specifies that the ActiveX blocking applies to web traffic on port 80 from any local host and to any foreign host Engin