小公司ACL网络规划
实验要求：5个部门之间不能互相访问，但是都可以访问服务区和Internet。服务区不能访问Internet。Internet不能主动发起访问内部服务。 实验器材：路由器route(3620);交换机switch(2950),和6台pc等。 实验目的：了解vlan的划分；访问控制列表的设置；trunk的封装；以及防火墙的设置等。
vlan划分部分route: enconf tint e0/0.1encapsulation islvlan 1 ip add192.168.1.1 255.255.255.0no shutint e0/0.2encapsulationisl vlan 2ip add192.168.2.1 255.255.255.0no shutint e0/0.3encapsulationisl vlan 3ip add192.168.3.1 255.255.255.0no shutint e0/0.4encapsulationisl vlan 4ip add 192.168.4.1255.255.255.0no shutint e0/0.5encapsulationisl vlan 5ip add192.168.5.1 255.255.255.0no shutint e0/0.6encapsulationisl vlan 6ip add192.168.6.1 255.255.255.0no shut switch:envlan databasevlan 2 namevlan2vlan 3 namevlan3vlan 4 namevlan4vlan 5 namevlan5vlan 6 namevlan6crl+zenconf tint fa0/2switchportaccess vlan 2int fa0/3switchportaccess vlan 3int fa0/4switchportaccess vlan 4int fa0/5switchportaccess vlan 5int fa0/6switchportaccess vlan 6int fa0/7switchport modetrunkswitchporttrunk encapsulation isl pc1: 192.168.1.2 255.255.255.0pc2: 192.168.2.2 255.255.255.0pc3: 192.168.3.2 255.255.255.0pc4: 192.168.4.2 255.255.255.0pc5: 192.168.5.2 255.255.255.0pc6: 192.168.6.2 255.255.255.0 设置访问控制列表部分；以及防火墙的设置:比较烦琐，我不修改他的设置了，重新在最下面为大家举一部分，其它的参照就可以了route:enconf taccess-list 101deny tcp 192.168.1.2 0.0.0255 any establishedpermit tcp anyany establishedaccess-list102permit ip 192.168.1.2 0.0.0.255 192.168.2.10.0.4.255access-list103permit ip 192.168.2.2 0.0.0.255 192.168.1.20.0.0.255denyip192.168.2.2 0 0.0.255 192.168.3.2 0.0.4.255access-list 104permit ip 192.168.3.2 0.0.0.255 192.168.1.20.0.0.255deny ip192.168.3.2 0.0.0.255 192.168.4.2 0.0.3.255.deny ip192.168.3.2 0.0.0.255 192.168.2.2 0.0.0.255acces-list 105permit ip 192.168.4.2 0.0.0.255 192.168.1.20.0.0.255deny ip192.168.4.2 0.0.0.255 192.168.5.2 0.0.2.255deny ip192.168.4.2 0.0.0.255 192.168.2.2 0.0.2.255access-list 106permit ip 192.168.5.2 0.0.0.255 192.168.1.20.0.0.255deny ip192.168.5.2 0.0.0.255 192.168.2.1 0.0.3.255deny ip192.168.5.2 0.0.0.255 192.168.6.2 0.0.0.255access-list 107permit ip 192.168.6.2 0.0.0.255 192.168.1.20.0.0.255deny ip192.168.6.2 0.0.0.255 192.168.2.2.10.0.4.255int e0/0.1ip access-group101ip access-group 102 inint e0/0.2ip access-group101ip access-group 103 inint e0/0.3ip access-group101ip access-group 104 in int e0/0.4ip access-group101 ip access-group 105 inint e0/0.5int access-group101 int access-group106 inint e0/0.6int access-group101int access-group107 in access-list 101permittcp 192.168.0.0 0.0.7.255anyint e/0.1ip access-group101 outaccess-list 102deny tcp 192.168.3.0 0.0.0.255 anyaccess-list 102deny tcp 192.168.4.0 0.0.0.255 anyaccess-list 102deny tcp 192.168.5.0 0.0.0.255 anyaccess-list 102deny tcp 192.168.6.0 0.0.0.255 anyaccess-list 102permit tcp 192.168.1.0 0.0.0.255 anyaccess-list 102permit tcp any any establishedint e0/0.2ip access-group102 out
页:
[1]