防火墙技术试验报告范本

1、防火墙技术实验报告时间： 2012-03-13实验名称：简单的 AAA 配置班级计算机网络技术 100#姓名#实验内容1、拓扑图：2、实验设备：1).用一台 PC 机桥接到 VMware 内 win server2003 服务器；2).用两台 Router c3600 ，一台做 NAS 、一台做 Client ；3、实验步骤：NAS：NAS(config)#int f1/0NAS(config-if)#ip add 192.168.139.254 255.255.255.0NAS(config-if)#no shutNAS(config)#int f0/0NAS(config-if)#ip a

2、dd 192.168.2.254 255.255.255.0NAS(config-if)#no shut配置 enable 密码NAS(config)#username cisco privilege 15 password ciscoNAS(config)#enable secret ciscoNAS(config)#aaa new-model 开启 AAA 功能 NAS(config)#aaa authen login NAS(config)#aaa authen login NAS(config)#line vty 0 15 NAS(config-line)#login authen N

3、AS(config-line)#exi NAS(config)#line con 0cisco group tacacs+ locallhy noneciscoNAS(config-line)#login authentication lhyNAS(config-line)#exi 配置共享 keyNAS(config)#tacacs-server host 192.168.139.4 key ciscoClient:Client(config)#int f0/0Client(config-if)#ip add 192.168.2.2 255.255.255.0Client(config-if

4、)#no shutClient(config)#no ip routingClient(config)#ip default-gateway 192.168.2.254Client#ping 192.168.139.254Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 192.168.139.254, timeout is 2 seconds: !在 VMware 中配置：List users beginning withletter/number:ABCDEFGHIJKLNN0PQRSTUVVXY2一0一 1 一

5、 2一3 一4一5一6一7飞一9 一Real Name Description |ccnp|Shared Profile Components圈1齬Ge up Setup Shared Profile ComponentsNetwork ConfiourtionSupplementary User InfoccnpCiscoSecure PAP (Also used for CHAP/MS-CHAP/ARAP, if the Separate厂 RoutingrEnabledlote: PPP LCP vill be 3irtoatically enabled if this service

6、is enabledEnable Optionsa No Enable Privilege r Max Privilege for any AAAClientJJNASNAS#test aaa group tacacs+Trying to authenticate with Servergroup tacacs+Sending password认证成功User successfully authenticatedNAS#NAS(config)#aaa authentication enable default group tacacs+cisco cisco new-code将 enable

7、加入 AAA 认证中默认审计方NAS(config)#aaa authorization exec default group tacacs+NAS(config)#aaa accounting exec default start-stop group tacacs+式NAS(config)#aaa accounting commands 15 default start-stop group tacacs+命令审计方式 Client:将 enable 加入 AAA 认证里的验证结果：lient#telnet 192.168.139.254Trying 192.168.139.254 . O

8、penUser Access VerificationUsername: ciscoPassword:NASenPassword:NAS#conf tNAS(config-if)#end验证成功NAS#exiConnection to 192.168.139.254 closed by foreign hostClient#授权( authorization )验证结果：Client#telnet 192.168.139.254Trying 192.168.139.254 . OpenUsername: ciscoPassword:NAS# 直接进入特权模式NAS#conf tNAS(conf

9、ig)#exiNAS#exiConnection to 192.168.139.254 closed by foreign hostClient#授权成功审计( accounting )用 default 验证：Client#telnet 192.168.139.254Trying 192.168.139.254 . OpenUsername: ciscoPassword:NAS#conf tEnter configuration commands, one per line.End with CNTL/Z.NAS(config)#endNAS#sh running-configNAS#sh

10、versionNAS#exiConnection to 192.168.139.254 closed by foreign hostClient#审计( accounting )用 commands 验证：Client#telnet 192.168.139.254Trying 192.168.139.254 . OpenUsername: ciscoPassword:NAS#conf tEnter configuration commands, one per line.End with CNTL/Z.NAS(config)#exiNAS#sh running-configNAS#sh versionNAS#conf tEnter configuration commands, one per line.End with CNTL/Z.NAS(config)#int lo 0NAS(config-if)#ip add 2.2.2.2 255.255.255.0NAS(config-if)#exiNAS(config)#exiNAS#exiConnection to 192.168.139.254 closed by f