1、4.访问控制列表（ACL）(1)标准RouterAH3Cinterface e0/0H3C-ethernet e0/0ip address 192.168.1.1 255.255.255.0H3Cinterface e0/1H3C-ethernet e0/1ip address 198.1.1.1 255.255.255.0H3Cospf 2H3C-ospf2area 0H3C-ospf-area0network 192.168.1.0 0.0.0.255H3C-ospf-area0network 198.168.1.0 0.0.0.255H3Cdisplay ip routH3C firew
2、all enableH3Cfirewall default deny/permit （默认为 permit）H3Cacl number 2000H3C-acl-2000rule permit source 192.168.2.0 0.0.0.255H3Cinterface e1H3C-ui-ethernet1firewall packet-filter 2000 inboundH3Cdisplay acl 2000H3Cundo acl number 2000RouterBH3Cinterface e0/1H3C-ethernet e0/1ip address 192.168.2.1 255.
3、255.255.0H3Cinterface e0/0H3C-ethernet e0/0ip address 198.1.1.2 255.255.255.0H3Cospf 2H3C-ospf2area 0H3C-ospf-area0network 192.168.2.0 0.0.0.255network 198.168.1.0 0.0.0.255H3Cdisplay ip rout(2)扩展RouterAH3Cinterface e0/0H3C-ethernet e0/0ip address 192.168.1.1 255.255.255.0H3Cinterface e0/1H3C-ethern
4、et e0/1ip address 198.1.1.1 255.255.255.0H3Cospf 2H3C-ospf2area 0H3C-ospf-area0network 192.168.1.0 0.0.0.255network 198.168.1.0 0.0.0.255H3Cdisplay ip routRouterBH3Cinterface e0/1H3C-ethernet e0/1ip address 192.168.2.1 255.255.255.0H3Cinterface e0/0H3C-ethernet e0/0ip address 198.1.1.2 255.255.255.0
5、H3Cospf 2H3C-ospf2area 0H3C-ospf-area0network 192.168.2.0 0.0.0.255network 198.168.1.0 0.0.0.255H3C firewall enableH3Cfirewall default permitH3Cacl number 3000(30003999)H3C-acl-3000rule deny icmp source 192.168.2.2 0 desination 192.168.1.2 icmp-type echorule permit ip source any destination any H3Ci
6、nterface e0/1H3C-ethernet0/1firewall packet-filter 3000 inboundquitH3Cdisplay acl allH3Cdisplay acl 3000H3Cundo acl number 3000(3)基于 VTYRouterAH3Cinterface e0/0H3C-ethernet e0/0ip address 192.168.1.1 255.255.255.0H3Cinterface e0/1H3C-ethernet e0/1ip address 198.1.1.1 255.255.255.0H3Cospf 2H3C-ospf2a
7、rea 0H3C-ospf-area0network 192.168.1.0 0.0.0.255network 198.168.1.0 0.0.0.255H3Cdisplay ip routH3Cfirewall enable H3Cfirewall default deny H3Cacl number 2000H3C-acl-2000rule deny source anyH3Cuser-interface vty 0 4H3C-ui-vty0-4authentication-mode noneuser privilege level 3acl 2000 inboundH3Ctelnet s
8、erver enableH3Cdisplay acl alltelnet RouterBH3Cinterface e0/1H3C-ethernet e0/1ip address 192.168.2.1 255.255.255.0H3Cinterface e0/0H3C-ethernet e0/0ip address 198.1.1.2 255.255.255.0H3Cospf 2H3C-ospf2area 0H3C-ospf-area0network 192.168.2.0 0.0.0.255network 198.168.1.0 0.0.0.255H3Cuser-interface vty
9、0 4H3C-ui-vty0-4authentication-mode noneuser privilege level 3telnet (4) 包过滤控制访问列表的功能配置一、组网需求：在 RouterA上对内网地址 2.2.2.2、24 访问外网做限制，使其无法访问3.3.3.2、24 的 WEB界面二、组网图：RouterA:H3Cinterface g0/1H3C-G0/1ip add 2.2.2.1 255.255.255.0H3Cinterface G0/0H3C-G0/0ip add 1.1.1.1 255.255.255.0H3Crip H3C-rip-1network 2.2
10、.2.0 network 1.1.1.0H3Cfirewall enable 使能防火墙功能H3Cfirewall default permit 配置防火墙缺省过滤方式为允许包通过定义用于包过滤的访问控制的 ACLH3Cacl number 3005H3C-acl-3005description deny_souce_ip_wwwH3C-acl-3005rule 0 deny tcp source 2.2.2.2 0 destination-port eq wwwH3C-acl-3005rule 5 permit tcp source 2.2.2.2 0对于 inbound流量进行过滤H3Cinterface G0/1H3C-G0/1firewall packet-filter 3005 inboundRouterB：H3Cinterface G0/0H3C-G0/0ip add 1.1.1.2 255.255.255.0H3Cinterface G0/1H3C-G0/1ip add 3.3.3.1 255.255.255.0H3Crip H3C-rip-1network 1.1.1.0 network 3.3.3.0
