华三实验大全之标准ACL篇

华三实验大全之标准ACL篇

实验名称：标准acl

实验要求：

不让1.1.1.1  ping通3.3.3.3

实验拓扑：

实验步骤：

网络之间开启RIP协议！

[R1]rip            

[R1-rip-1]ver 2

[R1-rip-1]undo summary

[R1-rip-1]net 192.168.1.0

[R1-rip-1]net 1.0.0.0

[R1-rip-1]q

[R2]rip

[R2-rip-1]ver 2

[R2-rip-1]undo summary

[R2-rip-1]net 192.168.1.0

[R2-rip-1]net 192.168.2.0

[R2-rip-1]q

[R3]rip

[R3-rip-1]ver 2

[R3-rip-1]net 192.168.2.0

[R3-rip-1]net 3.0.0.0

[R3-rip-1]q

配置好动态路由后，测试能R1ping通3.3.3.3

配置ACL访问控制列表

ACL查看命令

配置完事ping不通的

[R1]ping -a 1.1.1.1 3.3.3.3

 PING 3.3.3.3: 56  data bytes, press CTRL_C to break

   Request time out

   Request time out

   Request time out

   Request time out

   Request time out

 --- 3.3.3.3 ping statistics ---

   5 packet(s) transmitted

   0 packet(s) received

   100.00% packet loss

在1上配置出站ACL ，把方法一在R2上的配置去掉！

[R1]firewall enable

[R1-acl-basic-2000]rule 20 deny source 1.1.1.1 0

[R1-Serial0/2/0]firewall packet-filter 2000 outbound

[R1]int s0/2/0

[R1]ping -a 1.1.1.1 3.3.3.3

 PING 3.3.3.3: 56  data bytes, press CTRL_C to break

   Request time out

   Request time out

   Request time out

   Request time out

   Request time out

 --- 3.3.3.3 ping statistics ---

   5 packet(s) transmitted

   0 packet(s) received

100.00% packet loss

注意：标准的acl在应用的时候