華為ACL配置（基本ACL+高級ACL+綜合應(yīng)用）一、基本ACLPC1不能ping通Server1PC2可以ping通Server1PC1可以ping通PC2R1配置[R1]interface

g0/0/0

[R1-GigabitEthernet0/0/0]ip

address

54

24

[R1-GigabitEthernet0/0/0]int

g0/0/1

[R1-GigabitEthernet0/0/1]ip

address

54

24

[R1-GigabitEthernet0/0/1]int

g0/0/2

[R1-GigabitEthernet0/0/2]ip

address

54

24

[R1]acl

2000

[R1-acl-basic-2000]rule

5

deny

source

//抓取這個IP流量并拒絕它

[R1]interface

g0/0/0

[R1-GigabitEthernet0/0/0]traffic-filter

outbound

acl

2000

//相對于PC1來說在出接口上調(diào)用驗(yàn)證配置效果PC1不能ping通Server1PC2可以ping通Server1PC1可以ping通PC2二、高級ACL允許Client1訪問Server1的Web服務(wù)允許Client1訪問網(wǎng)絡(luò)/24禁止Client1訪問其它網(wǎng)絡(luò)R1配置[R1]interface

g0/0/0

[R1-GigabitEthernet0/0/0]ip

address

54

24

[R1-GigabitEthernet0/0/0]int

g0/0/1

[R1-GigabitEthernet0/0/1]ip

address

24

[R1]ip

route-static

0

[R1]acl

3000

[R1-acl-adv-3000]rule

5

permit

tcp

source

0

destination

0

destination-port

eq

80

[R1-acl-adv-3000]rule

10

permit

ip

source

0

destination

55

[R1-acl-adv-3000]rule

15

deny

ip

source

0

destination

any

[R1]interface

g0/0/0

[R1-GigabitEthernet0/0/0]traffic-filter

inbound

acl

3000R2配置[R2]interface

g0/0/0

[R2-GigabitEthernet0/0/0]ip

address

24

[R2-GigabitEthernet0/0/0]int

g0/0/1

[R2-GigabitEthernet0/0/1]ip

address

24

[R2-GigabitEthernet0/0/1]int

g0/0/2

[R2-GigabitEthernet0/0/2]ip

address

54

24

[R2]ip

route-static

24

[R2]ip

route-static

24

R3配置[R3]interface

g0/0/0

[R3-GigabitEthernet0/0/0]ip

address

24

[R3-GigabitEthernet0/0/0]int

g0/0/1

[R3-GigabitEthernet0/0/1]ip

address

54

24

[R3]ip

route-static

0

驗(yàn)證配置效果1.Client1可以訪問Server1的Web服務(wù)；2.Client1可以ping通網(wǎng)絡(luò)/243.Client1不能ping通網(wǎng)絡(luò)/24，以及其他網(wǎng)段Client1通Server1Client1通R3三、華為ACL綜合應(yīng)用R1只允許WG登錄，WG能ping通Server1和Client1YF和CW之間不能互通，但都可以和WG互通YF可以訪問Client1CW不能訪問Client1YF和CW只能訪問Server1的WWW服務(wù)只有WG才能訪問Server1的所有服務(wù)WG配置[WG]interface

g0/0/0

[WG-GigabitEthernet0/0/0]ip

address

24R2配置[R2]interface

g0/0/0

[R2-GigabitEthernet0/0/0]ip

address

54

24

[R2-GigabitEthernet0/0/0]int

g0/0/1

[R2-GigabitEthernet0/0/1]ip

address

54

24

[R2-GigabitEthernet0/0/1]int

g0/0/2

[R2-GigabitEthernet0/0/2]ip

address

24R1配置[R1]interface

g0/0/0

[R1-GigabitEthernet0/0/0]ip

address

24

[R1-GigabitEthernet0/0/0]int

g0/0/1

[R1-GigabitEthernet0/0/1]ip

address

54

24

[R1-GigabitEthernet0/0/1]int

g0/0/2

[R1-GigabitEthernet0/0/2]ip

address

24

[R1-GigabitEthernet0/0/2]int

g0/0/0

[R1-GigabitEthernet0/0/0]ip

address

24R3配置[R3]interface

g0/0/0

[R3-GigabitEthernet0/0/0]ip

address

24

[R3-GigabitEthernet0/0/0]int

g0/0/1

[R3-GigabitEthernet0/0/1]ip

address

54

24

[R3-GigabitEthernet0/0/1]int

g0/0/2

[R3-GigabitEthernet0/0/2]ip

address

54

24WG配置（OSPF）[WG]ospf

1

router-id

[WG-ospf-1]area

0

[WG-ospf-1-area-]network

55R2配置（OSPF）[R2]ospf

1

router-id

[R2-ospf-1]area

0

[R2-ospf-1-area-]network

55

[R2-ospf-1-area-]network

55

[R2-ospf-1-area-]network

55R1配置（OSPF）[R1]ospf

1

router-id

[R1-ospf-1]ar

[R1-ospf-1]area

0

[R1-ospf-1-area-]net

[R1-ospf-1-area-]network

55

[R1-ospf-1-area-]network

55

[R1-ospf-1-area-]network

55R3配置（OSPF）[R3]ospf

1

router-id

[R3-ospf-1]area

0

[R3-ospf-1-area-]network

55

[R3-ospf-1-area-]network

55

[R3-ospf-1-area-]network

55R1配置（ACL）[R1]acl

2000

//

創(chuàng)建基本ACL

2000

[R1-acl-basic-2000]rule

5

permit

source

0

//

僅僅允許

的流量

[R1]user-interface

vty

0

4

//

進(jìn)入

VTY，配置

telnet

參數(shù)

[R1-ui-vty0-4]acl

2000

inbound

//

在

VTY

入向，應(yīng)用

ACL

2000

[R1-ui-vty0-4]authentication-mode

aaa

//

進(jìn)入

VTY

，開啟

AAA

認(rèn)證模式

[R1-ui-vty0-4]aaa

//

進(jìn)入

AAA

模式

[R1-aaa]local-user

HCIE

password

cipher

HUAWEI

//

創(chuàng)建用戶

HCIE

和

密碼

HUAWEI

[R1-aaa]local-user

HCIE

service-type

telnet

//

為用戶

HCIE

指定

telnet

服務(wù)R2配置（ACL）[R2]acl

3000

[R2-acl-adv-3000]rule

10

permit

ip

source

0

destination

0

//允許和之間的所有流量

[R2-acl-adv-3000]rule

20

permit

ip

source

0

destination

0

//允許和之間所有的流量

[R2-acl-adv-3000]rule

30

permit

tcp

source

0

destination

0

destination-port

eq

80

//

允許

僅能訪問

的

web

服務(wù)

[R2-acl-adv-3000]rule

40

deny

ip

source

0

destination

any

//拒絕所有類型的流量

[R2]interface

g0/0/1

//

進(jìn)入YF的網(wǎng)關(guān)接口

[R2-GigabitEthernet0/0/1]traffic-filter

inbound

acl

3000

//

在接口的入方向調(diào)用

ACL

3000R3配置（ACL）[R3]acl

3000

[R3-acl-adv-3000]rule

10

permit

ip

source

0

destination

0

//允許和之間的所有流量

[R3-acl-adv-3000]rule

20

permit

tcp

source

0

destination

0

destination-port

eq

80

//

允許

僅能訪問

之間的

web

流量

[R3-acl-adv-3000]rule

30

deny

ip

source

0

destination

any

//

拒絕所有其他類型的流量

[R3]interface

g0/0/1

//

進(jìn)入