CCNA 作業五 Access Control List

shie

課程PPT檔案講解錄影 : https://drive.google.com/file/d/1ghrhSJdwsL6dG-aHmjvbS9ZXfO_d50Vl/view?usp=sharing

實驗實作錄影 : https://drive.google.com/file/d/1wWb0aXk-w8M4Xw0-GPmlsM-Gvffo86GT/view?usp=sharing

Refer : https://mouse.ee.aeust.edu.tw/Books/Network2/CCNP8/Lab%2008.ppt

Refer : https://mouse.ee.aeust.edu.tw/Books/Network2/CCNP8/Lab%2011.ppt

作業
(LAN 部分使用 211.11.xxx/24,
WAN 部分使用 171.41.xxx/24,
xxx代表學號末3碼,
學號末3碼超過250,使用末2碼

模擬練習
1.明瞭OSPF動態繞送的運作原理
2.明瞭Access Control List工作原理

步驟:
1. PC1 tracert PC6
2. In Router 1,Router 2, Router3, Router4
   刪除所有EIGRP路由
   conf t
   no router eigrp 100
   router ospf 100
   network 211.81.xxx.0 0.0.0.255 area 0
   network 151.61.0.0 0.0.255.255 area 0
3. R1 s1/2 斷線
   conf t
   int s1/2
   shutdown
4.等待一段時間並觀察路由表   PC1 tracert PC6

作業圖 I Router 1 的 OSPF routing table



作業圖 II Router1 s1/2 斷線前後 PC1 tracert PC6 (三步變成四步)



I. 標準 ACL
實驗要求：不允許172.16.0.0/16, 192.168.2.0/24, 192.168.3.1連線至PC1。
For router 1

en
conf t
access-list 1 deny 172.16.0.0 0.0.255.255
access-list 1 deny 192.168.2.0 0.0.0.255
access-list 1 deny host 192.168.3.1
access-list 1 permit any
int f0/0
ip access-group 1 out
exit
exit
copy run start
sh ip int f0/0


作業圖 III
Router 1 的組態



作業圖 IV
PC1 Tracert PC6 & PC2



II.延伸ACL
實驗要求：Router 2 只允許由 Router 3 來telnet。

For router 2

en
conf t
line vty 0 4
login
password xxxxxx
exit
access-list 101 permit tcp host 172.16.2.253 any eq telnet
access-list 101 permit tcp host 172.16.3.254 any eq telnet
access-list 101 permit tcp host 172.16.5.253 any eq telnet
access-list 101 deny tcp any any eq telnet
access-list 101 permit ip any any
int s1/1
ip access-group 101 in
int f0/1
ip access-group 101 in
exit
exit
copy run start
sh start

作業圖 V
Router 2 的組態



作業圖 VI
Router 3 telnet Router 2



作業圖 VII
Router 1 telnet Router 2



III.延伸ACL - PING
實驗要求：Router 3 只允許由 PC6 來 ping。

For router 3

en
conf t
access-list 101 permit icmp host 192.168.3.1 any
access-list 101 deny icmp any any
access-list 101 permit ip any any
int s1/0
ip access-group 101 in
int s1/2
ip access-group 101 in
int f0/0
ip access-group 101 in
int f0/1
ip access-group 101 in
exit
exit
copy run start
sh start

作業圖 VIII
Router 3 的組態



作業圖 IX
PC6 Tacert Router 3 & PC 10