华为ACL配置（基本ACL+高级ACL+综合应用）

华为ACL配置（基本ACL+高级ACL+综合应用）一、基本ACLPC1不能ping通Server1PC2可以ping通Server1PC1可以ping通PC2R1配置[R1]interface

g0/0/0

[R1-GigabitEthernet0/0/0]ip

address

54

24

[R1-GigabitEthernet0/0/0]int

g0/0/1

[R1-GigabitEthernet0/0/1]ip

address

54

24

[R1-GigabitEthernet0/0/1]int

g0/0/2

[R1-GigabitEthernet0/0/2]ip

address

54

24

[R1]acl

2000

[R1-acl-basic-2000]rule

5

deny

source

//抓取这个IP流量并拒绝它

[R1]interface

g0/0/0

[R1-GigabitEthernet0/0/0]traffic-filter

outbound

acl

2000

//相对于PC1来说在出接口上调用验证配置效果PC1不能ping通Server1PC2可以ping通Server1PC1可以ping通PC2二、高级ACL允许Client1访问Server1的Web服务允许Client1访问网络/24禁止Client1访问其它网络R1配置[R1]interface

g0/0/0

[R1-GigabitEthernet0/0/0]ip

address

54

24

[R1-GigabitEthernet0/0/0]int

g0/0/1

[R1-GigabitEthernet0/0/1]ip

address

24

[R1]ip

route-static

0

[R1]acl

3000

[R1-acl-adv-3000]rule

5

permit

tcp

source

0

destination

0

destination-port

eq

80

[R1-acl-adv-3000]rule

10

permit

ip

source

0

destination

55

[R1-acl-adv-3000]rule

15

deny

ip

source

0

destination

any

[R1]interface

g0/0/0

[R1-GigabitEthernet0/0/0]traffic-filter

inbound

acl

3000R2配置[R2]interface

g0/0/0

[R2-GigabitEthernet0/0/0]ip

address

24

[R2-GigabitEthernet0/0/0]int

g0/0/1

[R2-GigabitEthernet0/0/1]ip

address

24

[R2-GigabitEthernet0/0/1]int

g0/0/2

[R2-GigabitEthernet0/0/2]ip

address

54

24

[R2]ip

route-static

24

[R2]ip

route-static

24

R3配置[R3]interface

g0/0/0

[R3-GigabitEthernet0/0/0]ip

address

24

[R3-GigabitEthernet0/0/0]int

g0/0/1

[R3-GigabitEthernet0/0/1]ip

address

54

24

[R3]ip

route-static

0

验证配置效果1.Client1可以访问Server1的Web服务；2.Client1可以ping通网络/243.Client1不能ping通网络/24，以及其他网段Client1通Server1Client1通R3三、华为ACL综合应用R1只允许WG登录，WG能ping通Server1和Client1YF和CW之间不能互通，但都可以和WG互通YF可以访问Client1CW不能访问Client1YF和CW只能访问Server1的WWW服务只有WG才能访问Server1的所有服务WG配置[WG]interface

g0/0/0

[WG-GigabitEthernet0/0/0]ip

address

24R2配置[R2]interface

g0/0/0

[R2-GigabitEthernet0/0/0]ip

address

54

24

[R2-GigabitEthernet0/0/0]int

g0/0/1

[R2-GigabitEthernet0/0/1]ip

address

54

24

[R2-GigabitEthernet0/0/1]int

g0/0/2

[R2-GigabitEthernet0/0/2]ip

address

24R1配置[R1]interface

g0/0/0

[R1-GigabitEthernet0/0/0]ip

address

24

[R1-GigabitEthernet0/0/0]int

g0/0/1

[R1-GigabitEthernet0/0/1]ip

address

54

24

[R1-GigabitEthernet0/0/1]int

g0/0/2

[R1-GigabitEthernet0/0/2]ip

address

24

[R1-GigabitEthernet0/0/2]int

g0/0/0

[R1-GigabitEthernet0/0/0]ip

address

24R3配置[R3]interface

g0/0/0

[R3-GigabitEthernet0/0/0]ip

address

24

[R3-GigabitEthernet0/0/0]int

g0/0/1

[R3-GigabitEthernet0/0/1]ip

address

54

24

[R3-GigabitEthernet0/0/1]int

g0/0/2

[R3-GigabitEthernet0/0/2]ip

address

54

24WG配置（OSPF）[WG]ospf

1

router-id

[WG-ospf-1]area

0

[WG-ospf-1-area-]network

55R2配置（OSPF）[R2]ospf

1

router-id

[R2-ospf-1]area

0

[R2-ospf-1-area-]network

55

[R2-ospf-1-area-]network

55

[R2-ospf-1-area-]network

55R1配置（OSPF）[R1]ospf

1

router-id

[R1-ospf-1]ar

[R1-ospf-1]area

0

[R1-ospf-1-area-]net

[R1-ospf-1-area-]network

55

[R1-ospf-1-area-]network

55

[R1-ospf-1-area-]network

55R3配置（OSPF）[R3]ospf

1

router-id

[R3-ospf-1]area

0

[R3-ospf-1-area-]network

55

[R3-ospf-1-area-]network

55

[R3-ospf-1-area-]network

55R1配置（ACL）[R1]acl

2000

//

创建基本ACL

2000

[R1-acl-basic-2000]rule

5

permit

source

0

//

仅仅允许

的流量

[R1]user-interface

vty

0

4

//

进入

VTY，配置

telnet

参数

[R1-ui-vty0-4]acl

2000

inbound

//

在

VTY

入向，应用

ACL

2000

[R1-ui-vty0-4]authentication-mode

aaa

//

进入

VTY

，开启

AAA

认证模式

[R1-ui-vty0-4]aaa

//

进入

AAA

模式

[R1-aaa]local-user

HCIE

password

cipher

HUAWEI

//

创建用户

HCIE

和

密码

HUAWEI

[R1-aaa]local-user

HCIE

service-type

telnet

//

为用户

HCIE

指定

telnet

服务R2配置（ACL）[R2]acl

3000

[R2-acl-adv-3000]rule

10

permit

ip

source

0

destination

0

//允许和之间的所有流量

[R2-acl-adv-3000]rule

20

permit

ip

source

0

destination

0

//允许和之间所有的流量

[R2-acl-adv-3000]rule

30

permit

tcp

source

0

destination

0

destination-port

eq

80

//

允许

仅能访问

的

web

服务

[R2-acl-adv-3000]rule

40

deny

ip

source

0

destination

any

//拒绝所有类型的流量

[R2]interface

g0/0/1

//

进入YF的网关接口

[R2-GigabitEthernet0/0/1]traffic-filter

inbound

acl

3000

//

在接口的入方向调用

ACL

3000R3配置（ACL）[R3]acl

3000

[R3-acl-adv-3000]rule

10

permit

ip

source

0

destination

0

//允许和之间的所有流量

[R3-acl-adv-3000]rule

20

permit

tcp

source

0

destination

0

destination-port

eq

80

//

允许

仅能访问

之间的

web

流量

[R3-acl-adv-3000]rule

30

deny

ip

source

0

destination

any

//

拒绝所有其他类型的流量

[R3]interface

g0/0/1

//

进入