Packet Tracer 访问控制列表

今天我们再来做一做路由与路由，路由与主机之间的。
路由间的控制分为标准ip控制、扩展控制和命名访问控制三种。接下来，我们分别去一一体验。首先实验的配置图如下：

接下来我们就把所有的网都给弄通，让pc0能与每一个pc通信，这里必需去配置router，每个router的配置如下：
router0:
>en
Router#conf t
Router(config)#int fastEthernet 0/0
Router()#ip add 192.168.1.1 255.255.255.0
Router(config-if)#no shutdown
Router(config-if)#int s2/0
Router(config-if)#ip add 10.0.0.1 255.0.0.0
Router(config-if)#no shutdown
Router(config-if)#clock rate 64000

router1:
Router>en
Router#conf t
Router(config)#in fastEthernet 0/0
Router(config-if)#ip add 192.168.2.1 255.255.255.0
Router(config-if)#no shutdown
Router(config-if)#int s2/0
Router(config-if)#ip add 10.0.0.2 255.0.0.0
Router(config-if)#no shutdown
Router(config-if)#int s3/0
Router(config-if)#ip add 20.0.0.1 255.0.0.0
Router(config-if)#no shutdown
Router(config-if)#clock rate 64000

router2:
Router>en
Router#conf t
Router(config)#int fastEthernet 0/0
Router(config-if)#ip add 192.168.3.1 255.255.255.0
Router(config-if)#no shutdown
Router(config-if)#int s2/0
Router(config-if)#ip add 20.0.0.2 255.0.0.0
Router(config-if)#no shutdown
Router(config-if)#int s3/0
Router(config-if)#ip add 30.0.0.1 255.0.0.0
Router(config-if)#no shutdown
Router(config-if)#clock rate 64000

router3:

Router>en
Router#conf t
Router(config)#int fastEthernet 0/0
Router(config-if)#ip add 192.168.4.1 255.255.255.0
Router(config-if)#no shutdown
Router(config-if)#int s2/0
Router(config-if)#ip add 30.0.0.2 255.0.0.0
Router(config-if)#no shutdown

这样我们就把图中的要求都配置好了，接下来我们想要弄通整个网络，可以添加静态路由，也可以做ospf，这里我就用ospf做，具体配置每个路由器的命令如下：
router0:
Router(config)#router ospf 1
Router(config-router)#network 192.168.1.0 0.0.0.255 area 0
Router(config-router)#network 10.0.0.0 0.255.255.255 area 0

router1:
Router(config)#router ospf 2
Router(config-router)#network 192.168.2.0 0.0.0.255 area 0
Router(config-router)#network 10.0.0.0 0.255.255.255 area 0
Router(config-router)#network 20.0.0.0 0.255.255.255 area 0

router2:
Router(config)#router ospf 3
Router(config-router)#network 192.168.3.0 0.0.0.255 area 0
Router(config-router)#network 20.0.0.0 0.255.255.255 area 0
Router(config-router)#network 30.0.0.0 0.255.255.255 area 0

router3:
Router(config)#router ospf 4
Router(config-router)#network 192.168.4.0 0.0.0.255 area 0
Router(config-router)#network 30.0.0.0 0.255.255.255 area 0

接下来，我们就去分别查看路由表中的信息，每个路由器中信息如下：
router0:
Router#show ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - , IA - inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       * - candidate default, U - per-user static route, o - ODR
       P - periodic downloaded static route

Gateway of last resort is not set

C    10.0.0.0/8 is directly connected, Serial2/0
O    20.0.0.0/8 [110/1562] via 10.0.0.2, 00:11:13, Serial2/0
O    30.0.0.0/8 [110/2343] via 10.0.0.2, 00:09:23, Serial2/0
C    192.168.1.0/24 is directly connected, FastEthernet0/0
O    192.168.2.0/24 [110/782] via 10.0.0.2, 00:11:37, Serial2/0
O    192.168.3.0/24 [110/1563] via 10.0.0.2, 00:09:33, Serial2/0
O    192.168.4.0/24 [110/2344] via 10.0.0.2, 00:02:47, Serial2/0

router1:
Router#show ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       * - candidate default, U - per-user static route, o - ODR
       P - periodic downloaded static route

Gateway of last resort is not set

C    10.0.0.0/8 is directly connected, Serial2/0
C    20.0.0.0/8 is directly connected, Serial3/0
O    30.0.0.0/8 [110/1562] via 20.0.0.2, 00:10:35, Serial3/0
O    192.168.1.0/24 [110/782] via 10.0.0.1, 00:12:49, Serial2/0
C    192.168.2.0/24 is directly connected, FastEthernet0/0
O    192.168.3.0/24 [110/782] via 20.0.0.2, 00:10:55, Serial3/0
O    192.168.4.0/24 [110/1563] via 20.0.0.2, 00:03:59, Serial3/0

router2:
Router#show ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       * - candidate default, U - per-user static route, o - ODR
       P - periodic downloaded static route

Gateway of last resort is not set

O    10.0.0.0/8 [110/1562] via 20.0.0.1, 00:12:08, Serial2/0
C    20.0.0.0/8 is directly connected, Serial2/0
C    30.0.0.0/8 is directly connected, Serial3/0
O    192.168.1.0/24 [110/1563] via 20.0.0.1, 00:12:08, Serial2/0
O    192.168.2.0/24 [110/782] via 20.0.0.1, 00:12:08, Serial2/0
C    192.168.3.0/24 is directly connected, FastEthernet0/0
O    192.168.4.0/24 [110/782] via 30.0.0.2, 00:05:17, Serial3/0

router3:
Router#show ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       * - candidate default, U - per-user static route, o - ODR
       P - periodic downloaded static route

Gateway of last resort is not set

O    10.0.0.0/8 [110/2343] via 30.0.0.1, 00:05:45, Serial2/0
O    20.0.0.0/8 [110/1562] via 30.0.0.1, 00:05:45, Serial2/0
C    30.0.0.0/8 is directly connected, Serial2/0
O    192.168.1.0/24 [110/2344] via 30.0.0.1, 00:05:45, Serial2/0
O    192.168.2.0/24 [110/1563] via 30.0.0.1, 00:05:45, Serial2/0
O    192.168.3.0/24 [110/782] via 30.0.0.1, 00:05:45, Serial2/0
C    192.168.4.0/24 is directly connected, FastEthernet0/0
从路由表中，可以看出，我们所有的主机之间都能够进行通信了,经测试也是没有任何问题的。
接下来，我们就来进行控制，首先我们先来做一个标准的IP控制，目的让192.168.1.0子网，不能访问192.168.3.0这个网段，而其它的相 互之间进行访问都没有问题。在这里我们就去配置router2,具体router2上面的命令如下：
router2:
Router(config)#access-list 1 deny 192.168.1.0 0.0.0.255    //拒绝来自192.168.1.0网络的请求
Router(config)#access-list 1 permit any    //这里必须加上这一条允许所有，因为每个路由控制里面，默认有一个拒绝所有的。
Router(config)#int fastEthernet 0/0   //进入到所想指定的接口
Router(config-if)#ip access-group 1 out   //在此接口应用并设置为出口
经过上面的命令之后，测试得出结果，完全符合我们的实验要求。
接下来，我来再来做扩展的ip控制实验，这里我们就做一做拒绝192.168.1.2来远程router3中的192.168.4.1,而其它所有的pc 都能够进行远程192.168.4.1,这里应用到telnet，我们就把router3的密码给设置上，设置如下：

enable密码：123456
vty密码：yangang
console密码：yan123
router3:
Router(config)#enable password 123456
Router(config)#line vty 0 15
Router(config-line)#login
% Login disabled on line 66, until 'password' is set
% Login disabled on line 67, until 'password' is set
% Login disabled on line 68, until 'password' is set
% Login disabled on line 69, until 'password' is set
% Login disabled on line 70, until 'password' is set
% Login disabled on line 71, until 'password' is set
% Login disabled on line 72, until 'password' is set
% Login disabled on line 73, until 'password' is set
% Login disabled on line 74, until 'password' is set
% Login disabled on line 75, until 'password' is set
% Login disabled on line 76, until 'password' is set
% Login disabled on line 77, until 'password' is set
% Login disabled on line 78, until 'password' is set
% Login disabled on line 79, until 'password' is set
% Login disabled on line 80, until 'password' is set
% Login disabled on line 81, until 'password' is set
Router(config-line)#password yangang
Router(config-line)#exit
Router(config)#line console 0
Router(config-line)#password yan123
Router(config-line)#exit
Router(config)#access-list 101 deny tcp host 192.168.1.2 host 192.168.4.1 eq telnet
Router(config)#access-list 101 permit ip any any
Router(config)#int f0/0
Router(config-if)#ip access-group 101 out
综上之后我们的又一个实验也完成了，也达到了我们所想要的要求，但192.168.1.2telnet30.0.0.2也还是可以的，那要怎么样才能更完美，接下我们就去做一个命名控制，以完成我们实验中的不足。
其中命名也有标准ip控制与扩展ip控制两种，接下来我们做一做标准ip控制。
我们先去把router3上面的所有记录给清掉，再配置下面命令：
router3:
Router(config)#ip access-list standard ylinuxs
Router(config-std-nacl)#deny 192.168.1.2 0.0.0.0
Router(config-std-nacl)#permit any
Router(config-std-nacl)#exit
Router(config)#line vty 0 15
Router(config-line)#access-class ylinuxs in
接下来我们就用192.168.1.2去远程192.168.4.1及30.0.0.2都是连接失败的，而其它pc都没有任何问题。到这里我们所有的实验已全部做完，不知你是否体验到了本实验带给你的快乐呢。