【RSR】RSR如何配置标准ACL

发布时间: 2013-09-11 点击量:621 打印 字体:

功能介绍:

标准ACL只能匹配源ip地址。

应用场景:

企业进行安全策略设置时,若想控制来自某些IP或某网段的所有流量,如禁止一些IP地址不能访问所有资源,此时可使用标准ACL。若只想控制来自某些IP或网段的部分流量,如禁止一些IP地址访问另一个网段,此时可采用扩展ACL。

 

一、组网需求

禁止内网PC1 192.168.1.2 访问互联网,其它地址不受限制

 

二、组网拓扑

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        

 

三、配置要点

1、在全局下配置标准ACL

2、在内网口调用

3、保存配置

 

 四、配置步骤

      1、在全局下配置标准ACL

注意:

1)标准ACL的编号范围:1-99和1300-1999;扩展ACL的编号范围:100-199和2000-2699。

2)标准ACL只匹配源ip地址,扩展ACL可以匹配数据流的五大元素(源ip地址、目的ip地址、源端口、目的端口、协议号)

3)ACL的匹配顺序为从上往下(ACE序号从小到大)匹配ACE条目,若匹配对应的ACE条目后,就执行该ACE条目的行为(允许/拒绝),不会再往下匹配其他ACE条目。

4)ACL最后隐含一体deny any的ACE条目,会拒绝所有流量。若是禁止某网段访问,其他网段均放通,则应该在拒绝流量的ACE配置完成后,再加一条permit any的ACE条目,用来放行其他流量。

Ruijie(config)#ip access-list standard 1       //创建标准acl 1

Ruijie(config-std-nacl)#10 deny 192.168.1.2 0.0.0.0    //配置序列号10的acl条目,匹配PC1的ip 192.168.1.2(ip地址+反掩码)

Ruijie(config-std-nacl)#20 permit any      //配置允许其它流量

Ruijie(config-std-nacl)#exit

2、在内网口调用

 Ruijie(config)#interface fastEthernet 0/0

       Ruijie(config-if-FastEthernet 0/0)#ip access-group 1 in       //在内网口应用acl 1

3、保存配置

Ruijie(config-if-FastEthernet 0/0)#end    

Ruijie#write        //确认配置正确,保存配置

 

五、配置验证

1、分别测试内网PC能否访问互联网,若PC1无法访问互联网,其它PC正常,则配置正确。

2、查看acl的配置

Ruijie#show access-lists

ip access-list standard 1

 10 deny 192.168.1.2 0.0.0.0

 20 permit any

3、查看acl在接口下的应用

Ruijie#show ip access-group

ip access-group 1 in

Applied On interface FastEthernet 0/0.

 

 

 

 

 

00 分享 纠错
相关条目