题目如下：
配置如下：
已知网段，直接配置IP
[pc1-GigabitEthernet0/0/0]ip address 192.168.1.10 24
[pc1]ip route-static 0.0.0.0 0 192.168.1.1
[pc2-GigabitEthernet0/0/0]ip address 192.168.1.11 24
[pc2]ip route-static 0.0.0.0 0 192.168.1.1
[r1-GigabitEthernet0/0/0]ip address 192.168.1.1 24
[r1-GigabitEthernet0/0/1]ip address 192.168.2.1 24
[r2-GigabitEthernet0/0/0]ip address 192.168.2.2 24
[r2]ip route-static 192.168.1.1 24 192.168.2.1
此时检验pc1和pc2是否可以ping通r1和r2
在R1上进行telnet配置
[r1]aaa
[r1-aaa]local-user a privilege level 15 password cipher 12345
[r1-aaa]local-user a service-type telnet
[r1]user-interface vty 0 4
[r1-ui-vty0-4]authentication-mode aaa
在R2上进行telnet配置
[r2]aaa
[r2-aaa]local-user b privilege level 15 password cipher 54321
[r2-aaa]local-user b service-type telnet
[r2]user-interface vty 0 4
[r2-ui-vty0-4]authentication-mode aaa
此时检验pc1和pc2是否可以telnet到r1和r2
接下来写ACL
在R1上写ACL表
[r1]acl name acl1 3000 创建ACL表
[r1-acl-adv-acl1]rule deny icmp source 192.168.1.10 0.0.0.0 destination 192.168.
1.1 0.0.255.0 禁止pc1 ping r1
[r1-acl-adv-acl1]rule deny tcp source 192.168.1.10 0.0.0.0 destination 192.168.2
.2 0.0.0.0 destination-port eq 23 禁止pc1 telnet r2
[r1-acl-adv-acl1]rule deny icmp source 192.168.1.11 0.0.0.0 destination 192.168.
2.2 0.0.0.0 禁止pc2 ping r2
[r1-acl-adv-acl1]rule deny tcp source 192.168.1.11 0.0.0.0 destination 192.168.1
.1 0.0.255.0 destination-port eq 23 禁止pc2 telnet r1
接口调用ACL表
[r1-GigabitEthernet0/0/0]traffic-filter inbound acl name acl1
验证实验
pc1可以telnet r1,不能ping r1 pc1可以ping r2,不能telnet r2
pc2可以ping r1,不能telnet r1 pc2可以telnet r2,不能ping r2
实验完成。
