CCNA内部培训-公开课件.ppt

* Slide 1 of 1 Purpose: Emphasize: Use “access-class” to apply the standard access-list to the vty port. The next slide will show a configuration example. * Slide 1 of 1 Purpose: This example shows how to restrict incoming telnet sessions to the router’s vty ports. Emphasize: The access-class is applied as an input filter. Note: Ask the student the effect of changing the direction of the access-class to outbound instead of inbound. Now the router can accept incoming telnet sessions to its vty ports from all hosts but will block outgoing telnet sessions from its vty ports to all hosts except hosts in network . Once a user is telneted into a router’s vty port, the outbound access-class filter will prevent the user from telneting to other hosts as specified by the standard access-list. Remember, when an access-list is applied to an interface, it only block or permit traffic going through the router, it does not block or permit traffic initiated from the router itself. * Slide 1 of 1 Purpose: This slide begins the discussion on extended IP access lists. Emphasize: Distinguish the aspects of the extended IP access list from the standard access list. Your students will perform labs using extended access lists commands. For both standard and extended IP access lists, enter an address mask that identifies which bits in the address field you want the access list to match that will be “don’t care” bit positions. For both types of access lists, the access-group command allows packet filtering into or out of the router. * Slide 2 of 2 Purpose: Layer 2—Adds the access-group command for IP. Emphasize: The list number must match the number (100 to 199) you specified in the access-list command. * Slide 3 of 3 Purpose: Emphasize: * Slide 3 of 3 Purpose: Emphasize: * Slide 3 of 3 Purpose: Layer 3—Finishes with the new form of the access group command, now able to refer to an IP access list name as well as an access list number. Emphasize: