第十二章IP访问控制列表预案.ppt

* 扩展访问列表应用举例2 RouterX(config)# access-list 101 deny tcp 55 any eq 23 RouterX(config)# access-list 101 permit ip any any (implicit deny all) RouterX(config)# interface ethernet 0 RouterX(config-if)# ip access-group 101 out Deny only Telnet traffic from subnet out E0 Permit all other traffic wg_ro_a#show ip int e0 Ethernet0 is up, line protocol is up Internet address is 1/24 Broadcast address is 55 Address determined by setup command MTU is 1500 bytes Helper address is not set Directed broadcast forwarding is disabled Outgoing access list is not set Inbound access list is 1 Proxy ARP is enabled Security level is default Split horizon is enabled ICMP redirects are always sent ICMP unreachables are always sent ICMP mask replies are never sent IP fast switching is enabled IP fast switching on the same interface is disabled IP Feature Fast switching turbo vector IP multicast fast switching is enabled IP multicast distributed fast switching is disabled text ommitted 查看访问列表 查看访问列表的语句 wg_ro_a#show access-lists Standard IP access list 1 permit permit permit permit Extended IP access list 101 permit tcp host any eq telnet permit tcp host any eq ftp permit tcp host any eq ftp-data wg_ro_a#show {protocol} access-list {access-list number} wg_ro_a#show access-lists {access-list number} 本章总结 访问列表的分类：标准ACL，扩展ACL. 标准ACL和扩展ACL的区别. 使用标准ACL来限制远程访问. * ISBN 978-7-115-36692-4 第十二章IP访问控制列表 《计算机网络实践教程》配套PPT 本章目标 通过本章的学习，您应该掌握以下内容: 掌握访问列表的分类：标准ACL，扩展ACL. 知道标准ACL和扩展ACL的区别. 使用标准ACL来限制远程访问. 管理网络中逐步增长的 IP 数据 当数据通过路由器时进行过滤 为什么要使用访问列表 ACL的应用:过滤 允许、拒绝数据包通过路由器 允许、拒绝Telnet会话的建立 没有设置ACL时，所有的数据包都可以在网络上传输 虚拟会话 (IP) 端口上的数据传输 ACL的其它应用 基于数据包检测的特殊数据通讯应用 InboundInterface Packets N Y Packet Discard Bucket Choose Interface N Access List? Routing Table Entry? Y Outbound Interfaces Packet S0 出端口方向上的访问列表 Outbound Interfaces Packet N Y Packet Discard Bucket Choose Interfac