1-7 ACL排错.ppt

Access Control Lists Configuring and Troubleshooting ACLs Testing Packets with Numbered Standard IPv4 ACLs Numbered Standard IPv4 ACL Configuration Numbered Standard IPv4 ACLExample 1 Numbered Standard IPv4 ACL Example 2 Numbered Standard IPv4 ACL Example 3 Standard ACLs to Control vty Access Testing Packets with Numbered Extended IPv4 ACLs Numbered Extended IPv4 ACL Configuration Numbered Extended IPv4 ACL Example 1 Numbered Extended IPv4 ACL Example 2 Named IP ACL Configuration Named Standard IPv4 ACL Example Named Extended IPv4 ACL Example Commenting ACL Statements Monitoring ACL Statements Verifying ACLs Troubleshooting Common ACL Errors Troubleshooting Common ACL Errors (Cont.) Troubleshooting Common ACL Errors (Cont.) Troubleshooting Common ACL Errors (Cont.) Troubleshooting Common ACL Errors (Cont.) Troubleshooting Common ACL Errors (Cont.) Visual Objective 6-1: Implementing and Troubleshooting ACLs Summary Standard IPv4 ACLs allow you to filter based on source IP address. Extended ACLs allow you to filter based on source IP address, destination IP address, protocol, and port number. Named ACLs allow you to delete individual statements froman ACL. You can use the show access-lists and show ip interface commands to troubleshoot common ACL configuration errors. Layer 2 of 2 Purpose: This layer shows the ip access-group command. Emphasize: The ip access-group command links an access list to an interface. Only one access list per interface, per direction, per protocol is allowed. The ip access-group field descriptions are as follows: list—Number of the access list to be linked to this interface. direction—Default is outbound. Note: Create the access list first before applying it to the interface. If it is applied to the interface before it is created, the action will be to permit all traffic. However, as soon as you create the first statement in the access list, the access list will be active on the interface. Since there is the implicit deny all at