02/07/2024
ของฝากศิษย์ครับ
Lab ACL
ของฝากศิษย์ครับ
Lab ACL
EX.1) Standard ACL (1-99)
(config) # access-list (1-99) (permit,deny) (Source-IP)(Wildcard-Mask)
1)
ISP(config) # access-list 1 deny 192.168.1. 102 0.0.0. 0
ISP(config) # access-list 1 deny host 10.10.10. 5
ISP(config) # access-list 1 deny 192.168.2. 100 0.0.0. 3
ISP(config) # access-list 1 permit any
ISP(config) # access-list 1 deny any (ปิดท้ายเสมอ ไม่ต้องพิมพ์ )
(implicit deny all - not visible in the list)
(access-list 1 deny 0.0.0. 0 255.255.255.255)
2)
ISP(config) # interface g0/0
ISP(config-if) # ip access-group 1 in
ISP(config-if) # end
HQ 8.8.8. 8
UUUUU
HQ 1.1.1. 1
UUUUU
B1 8.8.8. 8
UUUUU
B1 1.1.1. 1
UUUUU
B2 1.1.1. 1
!!!!!
B2 8.8.8. 8
!!!!!
PC1> ping 8.8.8. 8
*10.10.10.6 icmp_seq=1 ttl=253 time=20.935 ms (ICMP type:3, code:13, Communication administratively p rohibited)
*10.10.10.6 icmp_seq=2 ttl=253 time=11.788 ms (ICMP type:3, code:13, Communication administratively p rohibited)
*10.10.10.6 icmp_seq=3 ttl=253 time=15.981 ms (ICMP type:3, code:13, Communication administratively prohibited)
*10.10.10.6 icmp_seq=4 ttl=253 time=20.346 ms (ICMP type:3, code:13, Communication administratively prohibited)
*10.10.10.6 icmp_seq=5 ttl=253 time=16.720 ms (ICMP type:3, code:13, Communication administratively prohibited)
PC1> ip 192.168.2. 105/24 192.168.2. 254
Checking for duplicate address...
PC1 : 192.168.2. 105 255.255.255. 0 gateway 192.168.2. 254
PC1> ping 8.8.8. 8
84 bytes from 8.8.8. 8 icmp_seq=2 ttl=253 time=11.509 ms
84 bytes from 8.8.8. 8 icmp_seq=3 ttl=253 time=20.099 ms
84 bytes from 8.8.8. 8 icmp_seq=4 ttl=253 time=21.549 ms
84 bytes from 8.8.8. 8 icmp_seq=5 ttl=253 time=14.222 ms
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
ISP(config) # interface g0/0
ISP(config-if) # no ip access-group 1 in
ISP(config-if) # exit
ISP(config) #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
Ex.2) Name ACL Standard
1)
ISP(config) # ip access-list standard Block-Remote
ISP(config-std-nacl) # permit host 192.168.1. 103
ISP(config-std-nacl) # exit
2)
ISP(config) # line vty 0 4
ISP(config-line) # access-class Block-Remote in
ISP(config-line) # end
B1 1.1.1. 1
!!!!!
B1 1.1.1. 1
Trying 1.1.1. 1 ...
% Connection refused by remote host
B1 -l admin 1.1.1. 1
% Connection refused by remote host
B2 -l admin 8.8.8. 8
Password: cisco
ISP>enable
Password: cisco
ISP
[Connection to 8.8.8. 8 closed by foreign host]
B2 #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
ISP(config) # line vty 0 4
ISP(config-line) # no access-class Block-Remote in
ISP(config-line) # end
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # Extended ACL (100-199) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
(config) # access-list (100-199) (permit,deny) (Protocol-ip,icmp,tcp,udp)
(Source-IP)(Wildcard-Mask)(Destination-IP)(Wildcard-Mask)eq(Port-Number)
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
Ex.3)
1)
HQ(config) # access-list 100 permit tcp host 192.168.1. 102 host 8.8.8. 8 eq 23
HQ(config) # access-list 100 deny tcp any any eq 23
HQ(config) # access-list 100 permit icmp 192.168.1. 100 0.0.0. 3 any echo
HQ(config) # access-list 100 deny icmp any any
HQ(config) # access-list 100 permit ip any any
2)
HQ(config) # interface g0/0
HQ(config-if) # ip access-group 100 out
HQ ip access-lists 100
Extended IP access list 100
10 permit tcp host 192.168.1. 102 host 8.8.8. 8 eq telnet
20 deny tcp any any eq telnet
30 permit icmp 192.168.1. 100 0.0.0. 3 any echo
40 deny icmp any any
50 permit ip any any
Ex.4)
HQ(config) # ip access-list extended 100
HQ(config-ext-nacl) # no 30
HQ(config-ext-nacl) #30 permit icmp 192.168.2. 100 0.0.0. 3 any echo
HQ(config-ext-nacl) #39 permit icmp host 192.168.1. 103 any echo
HQ(config-ext-nacl) # no 50
HQ(config-ext-nacl) # permit tcp 192.168.2. 128 0.0.0. 127 any eq 25
HQ(config-ext-nacl) # permit tcp 192.168.2. 128 0.0.0. 127 any eq 110
HQ(config-ext-nacl) # deny tcp any any eq 25
HQ(config-ext-nacl) # deny tcp any any eq 110
HQ(config-ext-nacl) # permit ip any any
HQ(config-ext-nacl) # end
HQ ip access-lists 100
Extended IP access list 100
10 permit tcp host 192.168.1. 102 host 8.8.8 .8 eq telnet (25 matches)
20 deny tcp any any eq telnet (1 match)
30 permit icmp 192.168.2. 100 0.0.0. 3 any echo (5 matches)
39 permit icmp host 192.168.1. 103 any echo
40 deny icmp any any (5 matches)
50 permit tcp 192.168.2. 128 0.0.0. 127 any eq smtp
60 permit tcp 192.168.2. 128 0.0.0. 127 any eq pop3
70 deny tcp any any eq smtp
80 deny tcp any any eq pop3
90 permit ip any any (33 matches)
หวังว่าคงเป็นประโยชน์กับศิษย์โจดอยและเพื่อนๆนะครับ
