基于ACL的访问控制及安全策略的设计实验报告.docx
29页
实 验 报 告课程名称思科路由器开放实验实验名称基于ACL的访问控制及安全策略的设计实验实验时间2012年6月2-3日实 验 报 告实验名称基于ACL的访问控制及安全策略的设计实验实验类型开放实验实验学时16实验时间2012.6.1-2012.6.2一、 实验目的和要求访问控制列表（Access Control List，ACL） 是路由器和交换机接口的指令列表，用来控制端口进出的数据包验要求学生掌握访问控制列表的配置，理解ACL的执行过程；能够根据ACL设计安全的网络实验要求完成以下工作：1. 标准ACL实验目标：本实验拒绝student所在网段访问路由器R2，同时只允许主机teacher访问路由器R2的telnet服务2. 扩展ACL实验：实验目标：学生不能访问ftp,但能访问www，教师不受限制3. 防止地址欺骗外部网络的用户可能会伪装自己的ip地址，比如使用内部网的合法IP地址或者回环地址作为源地址，从而实现非法访问解决办法：将可能伪装到的ip地址拒绝掉二、实验环境(实验设备)PC机，并安装Cisco Packet Tracer软件或者是真实的思科网络设备（路由器交换机）三、实验原理及内容一 基本ACL实验：1.标准ACL。
实验目标：本实验拒绝student所在网段访问路由器R2，同时只允许主机teacher访问路由器R2的telnet服务实验拓补图如下：实验配置如下：Router>enRouter#conf tEnter configuration commands, one per line. End with CNTL/Z.Router(config)#host R1R1(config)#int f0/0R1(config-if)#ip add 10.20.170.1 255.255.255.0R1(config-if)#no shut%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to upR1(config-if)#exitR1(config)#int s0/0/0R1(config-if)#ip add 192.168.12.1 255.255.255.0R1(config-if)#clock rate 64000R1(config-if)#no shut%LINK-5-CHANGED: Interface Serial0/0/0, changed state to downR1(config-if)#exitR1(config)#router eigrp 100R1(config-router)#network 10.20.170.0 0.0.0.255R1(config-router)#network 192.168.12.0 R1(config-router)#no autoR1(config-router)#endR1#%SYS-5-CONFIG_I: Configured from console by consoleR1#copy run startDestination filename [startup-config]? Building configuration...[OK]Router>enRouter#conf tEnter configuration commands, one per line. End with CNTL/Z.Router(config)#host R2R2(config)#int s0/0/1R2(config-if)#ip add 192.168.12.2 255.255.255.0 R2(config-if)#no shut%LINK-5-CHANGED: Interface Serial0/0/1, changed state to upR2(config-if)#%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0/1, changed state to upR2(config-if)#exitR2(config)#int s0/0/0R2(config-if)#ip add 192.168.23.1 255.255.255.0R2(config-if)#clock rate 64000R2(config-if)#no shut%LINK-5-CHANGED: Interface Serial0/0/0, changed state to downR2(config-if)#exitR2(config)#int f0/0R2(config-if)#ip add 10.20.168.1 255.255.255.0R2(config-if)#no shutR2(config-if)#%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to upR2(config-if)#exit%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to upR2(config)#router eigrp 100R2(config-router)#net 192.168.12.0 R2(config-router)#%DUAL-5-NBRCHANGE: IP-EIGRP 100: Neighbor 192.168.12.1 (Serial0/0/1) is up: new adjacencyR2(config-router)#net 192.168.23.0 R2(config-router)#net 10.20.168.0 0.0.0.255R2(config-router)#no autoR2(config-router)#%DUAL-5-NBRCHANGE: IP-EIGRP 100: Neighbor 192.168.12.1 (Serial0/0/1) is up: new adjacencyR2(config-router)#exitR2(config)#exitR2#%SYS-5-CONFIG_I: Configured from console by consoleR2#copy run startDestination filename [startup-config]? Building configuration...[OK]Router>enRouter#conf tEnter configuration commands, one per line. End with CNTL/Z.Router(config)#host R3R3(config)#int s0/0/1R3(config-if)#ip add 192.168.23.2 255.255.255.0R3(config-if)#no shutR3(config-if)#%LINK-5-CHANGED: Interface Serial0/0/1, changed state to upR3(config-if)#exitR3(config)#int f0/0R3(config-if)#ip add 10.20.66.1 255.255.255.0R3(config-if)#no shutR3(config-if)#%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to upR3(config-if)#exitR3(config)#router eigrp 100R3(config-router)#net 10.20.66.0 0.0.0.255R3(config-router)#net 192.168.23.0R3(config-router)#no autoR3(config-router)#%DUAL-5-NBRCHANGE: IP-EIGRP 100: Neighbor 192.168.23.1 (Serial0/0/1) is up: new adjacencyR3(config-router)#endR3#%SYS-5-CONFIG_I: Configured from console by consoleR3#copy run startDestination filename [startup-config]? Building configuration...[OK]配ACL之前，student去ping R2的三个接口的ip地址，也可以ping 服务器 10.20.168.7，应该ping得通。
R2#conf tEnter configuration commands, one per line. End with CNTL/Z.R2(config)#access-list 1 deny 10.20.170.0 0.0.0.255R2(config)#access-list 1 permit anyR2(config)#int s0/0/1R2(config-if)#ip access-group 1 inR2(config-if)#exitR2(config)#access-list 2 permit host 10.20.66.10R2(config)#line vty 0 4R2(config-line)#password 501R2(config-line)#loginR2(config-line)#access-class 2 inR2(config-line)#endR2#%SYS-5-CONFIG_I: Configured from console by consoleR2#copy run startDestination filename [startup-config]? Building configuration...配ACL之后，student去ping R2的三个接口的ip地址，也可以ping 服务器 10.20.168.7，应该ping不通。
PC>ping 10.20.168.7Pinging 10.20.168.7 with 32 bytes of data:Request timed out.Request timed out.Request timed out.。
