第12讲 Acl

本章目标 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

[object Object],为什么要使用访问列表

[object Object],[object Object],为什么要使用访问列表 172.16.0.0 172.17.0.0 Internet

访问列表的应用 ,[object Object],[object Object],[object Object],虚拟会话 (IP) 端口上的数据传输

访问列表的其它应用 Queue List 优先级判断基于数据包检测的特殊数据通讯应用

访问列表的其它应用 Queue List 优先级判断按需拨号基于数据包检测的特殊数据通讯应用

访问列表的其它应用路由表过滤 Routing Table Queue List 优先级判断按需拨号基于数据包检测的特殊数据通讯应用

什么是访问列表 -- 标准 ,[object Object],[object Object],[object Object],Outgoing Packet E0 S0 Incoming Packet Access List Processes Permit? Source

什么是访问列表 -- 扩展 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Outgoing Packet E0 S0 Incoming Packet Access List Processes Permit? Protocol Source and Destination

什么是访问列表 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Outgoing Packet E0 S0 Incoming Packet Access List Processes Permit? Protocol Source and Destination

如何识别访问列表号编号范围访问列表类型 IP 1-99 Standard ,[object Object]

如何识别访问列表号编号范围访问列表类型 IP 1-99 100-199 Standard Extended ,[object Object],[object Object]

如何识别访问列表号 ,[object Object],[object Object],[object Object],编号范围 1-99 1300-1999 Name (Cisco IOS 11.2 and later) 100-199 2000-2699 Name (Cisco IOS 11.2 and later) Standard Named 访问列表类型 Extend Named

用标准访问列表测试数据 Source Address Segment (for example, TCP header) Data Packet (IP header) Frame Header (for example, HDLC) Deny Permit Use access list statements 1-99

[object Object],用扩展访问列表测试数据 Destination Address Source Address Protocol Port Number Segment (for example, TCP header) Data Packet (IP header) Frame Header (for example, HDLC) Use access list statements 1-99 or 100-199 to test the packet Deny Permit

出端口方向上的访问列表 Inbound Interface Packets N Y Packet Discard Bucket Choose Interface N Access List ? Routing Table Entry ? Y Outbound Interfaces Packet S0

出端口方向上的访问列表 Outbound Interfaces Packet N Y Packet Discard Bucket Choose Interface Routing Table Entry ? N Packet Test Access List Statements Permit ? Y Access List ? Y S0 E0 Inbound Interface Packets

出端口方向上的访问列表 Notify Sender If no access list statement matches then discard the packet N Y Packet Discard Bucket Choose Interface Routing Table Entry ? N Y Test Access List Statements Permit ? Y Access List ? Discard Packet N Outbound Interfaces Packet Packet S0 E0 Inbound Interface Packets

访问列表的测试：允许和拒绝 Packets to interfaces in the access group Packet Discard Bucket Y Interface(s) Destination Deny Deny Y Match First Test ? Permit

访问列表的测试：允许和拒绝 Packets to Interface(s) in the Access Group Packet Discard Bucket Y Interface(s) Destination Deny Deny Y Match First Test ? Permit N Deny Permit Match Next Test(s) ? Y Y

访问列表的测试：允许和拒绝 Packets to Interface(s) in the Access Group Packet Discard Bucket Y Interface(s) Destination Deny Deny Y Match First Test ? Permit N Deny Permit Match Next Test(s) ? Deny Match Last Test ? Y Y N Y Y Permit

访问列表的测试：允许和拒绝 Packets to Interface(s) in the Access Group Packet Discard Bucket Y Interface(s) Destination Deny Y Match First Test ? Permit N Deny Permit Match Next Test(s) ? Deny Match Last Test ? Y Y N Y Y Permit Implicit Deny If no match deny all Deny N

[object Object],[object Object],通配符：如何检查相应的地址位 do not check address (ignore bits in octet) = 0 0 0 0 0 0 0 0 Octet bit position and address value for bit ignore last 6 address bits check all address bits (match all) ignore last 4 address bits check last 2 address bits Examples = 0 0 1 1 1 1 1 1 128 64 32 16 8 4 2 1 = 0 0 0 0 1 1 1 1 = 1 1 1 1 1 1 0 0 = 1 1 1 1 1 1 1 1

[object Object],[object Object],通配符掩码指明特定的主机 Test conditions: Check all the address bits (match all) 172.30.16.29 0.0.0.0 (checks all bits) An IP host address, for example: Wildcard mask:

[object Object],[object Object],通配符掩码指明所有主机 Test conditions: Ignore all the address bits (match any) 0.0.0.0 255.255.255.255 (ignore all) Any IP address Wildcard mask:

[object Object],[object Object],通配符掩码和 IP 子网的对应 Check for IP subnets 172.30. 16 .0/24 to 172.30. 31 .0/24 Network .host 172.30.16 .0 Wildcard mask: 0 0 0 0 1 1 1 1 |<---- match ---->|<----- don’t care ----->| 0 0 0 1 0 0 0 0 = 16 0 0 0 1 0 0 0 1 = 17 0 0 0 1 0 0 1 0 = 18 : : 0 0 0 1 1 1 1 1 = 31 0 0 0 1 0 0 0 0

配置标准的 IP 访问列表 www.cisco.com

访问列表配置指南 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

标准 IP 访问列表的配置 access-list access-list-number {permit|deny} source [ mask ] Router(config)# ,[object Object],[object Object],[object Object],[object Object]

[object Object],[object Object],[object Object],[object Object],标准 IP 访问列表的配置 access-list access-list-number {permit|deny} source [ mask ] Router(config)# Router(config-if)# ip access-group access-list-number { in | out } ,[object Object],[object Object],[object Object],[object Object]

标准访问列表举例 1 172.16.3.0 172.16.4.0 172.16.4.13 E0 S0 E1 Non- 172.16.0.0 access-list 1 permit 172.16.0.0 0.0.255.255 (implicit deny all - not visible in the list) (access-list 1 deny 0.0.0.0 255.255.255.255)

标准访问列表举例 1 ,[object Object],access-list 1 permit 172.16.0.0 0.0.255.255 (implicit deny all - not visible in the list) (access-list 1 deny 0.0.0.0 255.255.255.255) interface ethernet 0 ip access-group 1 out interface ethernet 1 ip access-group 1 out 172.16.3.0 172.16.4.0 172.16.4.13 E0 S0 E1 Non- 172.16.0.0

[object Object],标准访问列表举例 2 172.16.3.0 172.16.4.0 172.16.4.13 E0 S0 E1 Non- 172.16.0.0 access-list 1 deny 172.16.4.13 0.0.0.0

标准访问列表举例 2 172.16.3.0 172.16.4.0 172.16.4.13 E0 S0 E1 Non- 172.16.0.0 ,[object Object],access-list 1 deny 172.16.4.13 0.0.0.0 access-list 1 permit 0.0.0.0 255.255.255.255 (implicit deny all) (access-list 1 deny 0.0.0.0 255.255.255.255)

标准访问列表举例 2 access-list 1 deny 172.16.4.13 0.0.0.0 access-list 1 permit 0.0.0.0 255.255.255.255 (implicit deny all) (access-list 1 deny 0.0.0.0 255.255.255.255) interface ethernet 0 ip access-group 1 out 172.16.3.0 172.16.4.0 172.16.4.13 E0 S0 E1 Non- 172.16.0.0 ,[object Object]

[object Object],标准访问列表举例 3 172.16.3.0 172.16.4.0 172.16.4.13 E0 S0 E1 Non- 172.16.0.0 access-list 1 deny 172.16.4.0 0.0.0.255 access-list 1 permit any (implicit deny all) (access-list 1 deny 0.0.0.0 255.255.255.255)

标准访问列表举例 3 access-list 1 deny 172.16.4.0 0.0.0.255 access-list 1 permit any (implicit deny all) (access-list 1 deny 0.0.0.0 255.255.255.255) interface ethernet 0 ip access-group 1 out 172.16.3.0 172.16.4.0 172.16.4.13 E0 S0 E1 Non- 172.16.0.0 ,[object Object]

用访问列表控制 vty 访问 www.cisco.com

在路由器上过滤 vty ,[object Object],[object Object],[object Object],0 1 2 3 4 Virtual ports (vty 0 through 4) Physical port e0 (Telnet) Console port (direct connect) console e0

如何控制 vty 访问 0 1 2 3 4 Virtual ports (vty 0 through 4) Physical port (e0) (Telnet) ,[object Object],[object Object],[object Object],Router# e0

虚拟通道的配置 ,[object Object],[object Object],access-class access-list-number {in|out} line vty# {vty# | vty-range } Router(config)# Router(config-line)#

虚拟通道访问举例 ,[object Object],access-list 12 permit 192.89.55.0 0.0.0.255 ! line vty 0 4 access-class 12 in Controlling Inbound Access

扩展 IP 访问列表的配置 www.cisco.com

扩展 IP 访问列表的配置 Router(config)# ,[object Object],access-list access-list-number { permit | deny } protocol source source-wildcard [operator port] destination destination-wildcard [ operator port ] [ established ] [log]

扩展 IP 访问列表的配置 Router(config-if)# ip access-group access-list-number { in | out } ,[object Object],Router(config)# ,[object Object],access-list access-list-number { permit | deny } protocol source source-wildcard [operator port] destination destination-wildcard [ operator port ] [ established ] [log]

[object Object],[object Object],扩展访问列表应用举例 1 172.16.3.0 172.16.4.0 172.16.4.13 E0 S0 E1 Non- 172.16.0.0 access-list 101 deny tcp 172.16.4.0 0.0.0.255 172.16.3.0 0.0.0.255 eq 21 access-list 101 deny tcp 172.16.4.0 0.0.0.255 172.16.3.0 0.0.0.255 eq 20

[object Object],[object Object],扩展访问列表应用举例 1 172.16.3.0 172.16.4.0 172.16.4.13 E0 S0 E1 Non- 172.16.0.0 access-list 101 deny tcp 172.16.4.0 0.0.0.255 172.16.3.0 0.0.0.255 eq 21 access-list 101 deny tcp 172.16.4.0 0.0.0.255 172.16.3.0 0.0.0.255 eq 20 access-list 101 permit ip any any (implicit deny all) (access-list 101 deny ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255)

[object Object],[object Object],扩展访问列表应用举例 1 access-list 101 deny tcp 172.16.4.0 0.0.0.255 172.16.3.0 0.0.0.255 eq 21 access-list 101 deny tcp 172.16.4.0 0.0.0.255 172.16.3.0 0.0.0.255 eq 20 access-list 101 permit ip any any (implicit deny all) (access-list 101 deny ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255) interface ethernet 0 ip access-group 101 out 172.16.3.0 172.16.4.0 172.16.4.13 E0 S0 E1 Non- 172.16.0.0

[object Object],[object Object],扩展访问列表应用举例 2 172.16.3.0 172.16.4.0 172.16.4.13 E0 S0 E1 Non- 172.16.0.0 access-list 101 deny tcp 172.16.4.0 0.0.0.255 any eq 23

[object Object],[object Object],扩展访问列表应用举例 2 172.16.3.0 172.16.4.0 172.16.4.13 E0 S0 E1 Non- 172.16.0.0 access-list 101 deny tcp 172.16.4.0 0.0.0.255 any eq 23 access-list 101 permit ip any any (implicit deny all)

[object Object],[object Object],扩展访问列表应用举例 2 access-list 101 deny tcp 172.16.4.0 0.0.0.255 any eq 23 access-list 101 permit ip any any (implicit deny all) interface ethernet 0 ip access-group 101 out 172.16.3.0 172.16.4.0 172.16.4.13 E0 S0 E1 Non- 172.16.0.0

标准访问列表和扩展访问列表比较标准扩展基于源地址基于源地址和目标地址允许和拒绝完整的 TCP/IP 协议指定 TCP/IP 的特定协议和端口号编号范围 100-199 和 2000-2699 编号范围 1-99 和 1300-1999

使用名称访问列表 Router(config)# ip access-list { standard | extended } name ,[object Object],[object Object]

使用名称访问列表 Router(config)# ip access-list { standard | extended } name { permit | deny } { ip access list test conditions } { permit | deny } { ip access list test conditions } no { permit | deny } { ip access list test conditions } Router(config {std- | ext-}nacl)# ,[object Object],[object Object],[object Object],[object Object]

使用名称访问列表 ,[object Object],[object Object],[object Object],[object Object],[object Object],Router(config)# ip access-list { standard | extended } name Router(config {std- | ext-}nacl)# { permit | deny } { ip access list test conditions } { permit | deny } { ip access list test conditions } no { permit | deny } { ip access list test conditions } Router(config-if)# ip access-group name { in | out }

访问列表配置准则 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

[object Object],[object Object],访问列表的放置原则 E0 E0 E1 S0 To0 S1 S0 S1 E0 E0 B A C 推荐： D

查看访问列表 wg_ro_a#show ip int e0 Ethernet0 is up, line protocol is up Internet address is 10.1.1.11/24 Broadcast address is 255.255.255.255 Address determined by setup command MTU is 1500 bytes Helper address is not set Directed broadcast forwarding is disabled Outgoing access list is not set Inbound access list is 1 Proxy ARP is enabled Security level is default Split horizon is enabled ICMP redirects are always sent ICMP unreachables are always sent ICMP mask replies are never sent IP fast switching is enabled IP fast switching on the same interface is disabled IP Feature Fast switching turbo vector IP multicast fast switching is enabled IP multicast distributed fast switching is disabled <text ommitted>

查看访问列表的语句 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

本章总结 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

问题回顾 ,[object Object],[object Object],[object Object]

第12讲 Acl

Recommended

Recommended

More Related Content

Viewers also liked

Viewers also liked (9)

Similar to 第12讲 Acl

Similar to 第12讲 Acl (13)

More from F.l. Yu

More from F.l. Yu (17)

第12讲 Acl