首先，确定搭建及配置要求
第一步：搭建拓扑建构，及其配置IP地址
配IP地址
[PC1]interface GigabitEthernet 0/0/0 [PC1-GigabitEthernet0/0/0]ip add 192.168.2.2 24 [PC2]interface GigabitEthernet 0/0/0 [PC2-GigabitEthernet0/0/0]ip add 192.168.2.3 24 [AR1]interface GigabitEthernet 0/0/0 [AR1-GigabitEthernet0/0/0]ip add 192.168.2.1 24 [AR1-GigabitEthernet0/0/0]q [AR1]interface GigabitEthernet 0/0/1 [AR1-GigabitEthernet0/0/1]ip add 192.168.1.1 24 [AR2]interface GigabitEthernet 0/0/0 [AR2-GigabitEthernet0/0/0]ip add 192.168.1.2 24
第二步：给PC1和PC2配置缺省路由
[PC1]ip route-static 0.0.0.0 0 192.168.2.1 [PC2]ip route-static 0.0.0.0 0 192.168.2.1
第三步：在给AR2添加路由表
[AR2]ip route-static 192.168.2.0 24 192.168.1.1
此时，PC1和PC2可以ping通AR1和AR2
第四步：创建ACL列表（扩展列表），并进行配置
[AR1]acl 3000 创建acl列表，3000-3999为扩展列表； [AR1-acl-adv-3000]rule deny icmp source 192.168.2.2 0 destination 192.168.2.1 0 [AR1-acl-adv-3000]rule deny icmp source 192.168.2.2 0 destination 192.168.1.1 0 [AR1-acl-adv-3000]rule deny icmp source 192.168.2.3 0 destination 192.168.1.2 0 [AR1-acl-adv-3000]rule deny tcp source 192.168.2.2 0 destination 192.168.1.2 0 d estination-port eq 23 [AR1-acl-adv-3000]rule deny tcp source 192.168.2.3 0 destination 192.168.1.1 0 d estination-port eq 23 [AR1-acl-adv-3000]rule deny tcp source 192.168.2.3 0 destination 192.168.2.1 0 d estination-port eq 23
第五步：在路由器上开启远程控制，并基于TCP目标端口号23工作
[AR1]aaa [AR1-aaa]local-user shuaige privilege level 15 password cipher 666666 Info: Add a new user. [AR1-aaa]local-user shuaige service-type telnet [AR1-aaa]q [AR1]user-interface vty 0 4 [AR1-ui-vty0-4]authentication-mode aaa [AR2]aaa [AR2-aaa]local-user shuaige privilege level 15 password cipher 666666 Info: Add a new user. [AR2-aaa]local-user shuaige service-type telnet [AR2-aaa]q [AR2]user-interface vty 0 4 [AR2-ui-vty0-4]authentication-mode aaa
第五步：测试一下，是否符合要求
此时，达到实验要求
