基于ACL的访问控制及安全策略的设计实验报告

实验报告
课程名称
思科路由器开放实验
实验名称
基于ACL的访问控制及安全策略的设计实验
实验时间
2012
年
6
月
2-3
日
实 验 报 告
实验名称
基于ACL的访问控制及安全策略的设计实验
实验类型
开放实验
实验学时
16
实验时间
一、实验目的和要求
访问控制列表（Access Control List，ACL）是路由器和交换机接口的指令列表，用来控制端口进出的数据包。验要求学生掌握访问控制列表的配置，理解ACL的执行过程；能够根据ACL设计安全的网络。
Teacher机：
% Connection timed out; remote host not responding
% Connection timed out; remote host not responding
R3>en
% Connection timed out; remote host not responding
Standard IP access list 2
R2#sh run
interface Serial0/0/1
ip access-group1 in
!
line vty 0 4
access-class2 in
password 501
login
!
删除ACL：
R2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R2(config-router)#
R2(config-router)#exit
R2(config)#exit
R2#
%SYS-5-CONFIG_I: Configured from console by console
R2#copy run start
Destination filename [startup-config]?
Destination filename [startup-config]?
Building configuration...
[OK]
Router>en
Router#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#host R2
0.0.0.255
R2(config)#access-list 1 permit any
R2(config)#int s0/0/1
R2(config-if)#ip access-group1 in
R2(config-if)#exit
R2(config)#line vty 0 4
R2(config-line)#password 501
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up
R2(config)#router eigrp 100
R2(config-router)#
0.0.0.255
R2(config-router)#no auto
R2(config)#ints0/0/1
R2(config-if)#no ip access-group1in
R2(config-if)#exit
R2(config)#no access-list 1
R2(config)#line vty 0 4
R2(config-line)#no access-class2 in
R1(config)#router eigrp 100
0.0.0.255
R1(config-router)#no auto
R1(config-router)#end
R1#
%SYS-5-CONFIG_I: Configured from console by console
R1#copy run start
User Access Verification
Password:501
R2>en
% No password set.
R2>
但只允许teacher机telnet R2，在R3上telnet R2不成功。
% Connection refused by remote host
% Connection refused by remote host
% Connection refused by remote host
在student机上telnet R2不成功。
% Connection timed out; remote host not responding
% Connection timed out; remote host not responding
实验配置如下：
Router>en
Router#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#host R1
R1(config)#int f0/0
R1(config-if)#no shut
% Connection refused by remote host
% Connection reБайду номын сангаасused by remote host
% Connection refused by remote host
% Connection timed out; remote host not responding
% Connection timed out; remote host not responding
在R1上telnet R2不成功。
% Connection refused by remote host
% Connection refused by remote host
% Connection refused by remote host
%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up
R1(config-if)#exit
R2(config-line)#login
R2(config-line)#access-class2 in
R2(config-line)#end
R2#
%SYS-5-CONFIG_I: Configured from console by console
R2#copy run start
Destination filename [startup-config]?
R3(config-if)#exit
R3(config)#router eigrp 100
0.0.0.255
R3(config-router)#no auto
R3(config-router)#
R3(config-router)#end
R3#
%SYS-5-CONFIG_I: Configured from console by console
R3#copy run start
Destination filename [startup-config]?
Building configuration...
[OK]
R2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
[OK]
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
配ACL之后，teacher机可以telnet R2，效果如下。
R2(config)#int s0/0/1
R2(config-if)#no shut
%LINK-5-CHANGED: Interface Serial0/0/1, changed state to up
R2(config-if)#
%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0/1, changed state to up
R1(config)#int s0/0/0
R1(config-if)#clock rate 64000
R1(config-if)#no shut
%LINK-5-CHANGED: Interface Serial0/0/0, changed state to down
R1(config-if)#exit
R3(config-if)#
%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up
Building configuration...
Request timed out.