目录
一、相关知识
二、拓扑图
三、配置命令
1、Router0配置命令
2、Router1配置命令
四、验证结果
一、相关知识
扩展ACL则可以同时对源地址、目标地址、协议、端口号、时间范围等来过滤，所以扩展ACL的功能比标准ACL更强。
二、拓扑图
三、配置命令
1、Router0配置命令
Router>enable
Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#interface fastEthernet 1/1
Router(config-if)#ip address 192.168.40.1 255.255.255.0
Router(config-if)#no shutdown
Router(config-if)#exit
Router(config)#interface fastEthernet 1/0
Router(config-if)#ip address 192.168.10.1 255.255.255.0
Router(config-if)#no shutdown
Router(config-if)#exit
Router(config)#interface fastEthernet 0/0
Router(config-if)#ip address 192.168.30.1 255.255.255.0
Router(config-if)#no shutdown
Router(config-if)#exit
Router(config)#router rip
Router(config-router)#version 2
Router(config-router)#no auto-summary
Router(config-router)#network 192.168.10.0
Router(config-router)#network 192.168.30.0
Router(config-router)#network 192.168.40.0
Router(config-router)#exit
Router(config)#access-list 101 permit tcp 192.168.10.0 0.0.0.255 192.168.20.2 0.0.0.0 eq 80
Router(config)#access-list 101 permit tcp 192.168.10.0 0.0.0.255 192.168.20.2 0.0.0.0 eq 20
Router(config)#access-list 101 permit tcp 192.168.10.0 0.0.0.255 192.168.20.2 0.0.0.0 eq 21
Router(config)#access-list 101 deny ip 192.168.10.0 0.0.0.255 host 192.168.20.2
Router(config)#access-list 101 deny icmp 192.168.10.0 0.0.0.255 192.168.40.0 0.0.0.255
Router(config)#access-list 101 permit ip any any
Router(config)#interface fastEthernet 1/0
Router(config-if)#ip access-group 101 in
2、Router1配置命令
Router>enable
Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#interface fastEthernet 0/0
Router(config-if)#ip address 192.168.30.2 255.255.255.0
Router(config-if)#no shutdown
Router(config-if)#exit
Router(config)#interface fastEthernet 1/0
Router(config-if)#ip address 192.168.20.1 255.255.255.0
Router(config-if)#no shutdown
Router(config-if)#exit
Router(config)#router rip
Router(config-router)#version 2
Router(config-router)#no auto-summary
Router(config-router)#network 192.168.20.0
Router(config-router)#network 192.168.30.0
四、验证结果
Router>enable Router#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router(config)#interface fastEthernet 1/1 Router(config-if)#ip address 192.168.40.1 255.255.255.0 Router(config-if)#no shutdown Router(config-if)#exit Router(config)#interface fastEthernet 1/0 Router(config-if)#ip address 192.168.10.1 255.255.255.0 Router(config-if)#no shutdown Router(config-if)#exit Router(config)#interface fastEthernet 0/0 Router(config-if)#ip address 192.168.30.1 255.255.255.0 Router(config-if)#no shutdown Router(config-if)#exit Router(config)#router rip Router(config-router)#version 2 Router(config-router)#no auto-summary Router(config-router)#network 192.168.10.0 Router(config-router)#network 192.168.30.0 Router(config-router)#network 192.168.40.0 Router(config-router)#exit Router(config)#access-list 101 permit tcp 192.168.10.0 0.0.0.255 192.168.20.2 0.0.0.0 eq 80 Router(config)#access-list 101 permit tcp 192.168.10.0 0.0.0.255 192.168.20.2 0.0.0.0 eq 20 Router(config)#access-list 101 permit tcp 192.168.10.0 0.0.0.255 192.168.20.2 0.0.0.0 eq 21 Router(config)#access-list 101 deny ip 192.168.10.0 0.0.0.255 host 192.168.20.2 Router(config)#access-list 101 deny icmp 192.168.10.0 0.0.0.255 192.168.40.0 0.0.0.255 Router(config)#access-list 101 permit ip any any Router(config)#interface fastEthernet 1/0 Router(config-if)#ip access-group 101 in
2、Router1配置命令
Router>enable
Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#interface fastEthernet 0/0
Router(config-if)#ip address 192.168.30.2 255.255.255.0
Router(config-if)#no shutdown
Router(config-if)#exit
Router(config)#interface fastEthernet 1/0
Router(config-if)#ip address 192.168.20.1 255.255.255.0
Router(config-if)#no shutdown
Router(config-if)#exit
Router(config)#router rip
Router(config-router)#version 2
Router(config-router)#no auto-summary
Router(config-router)#network 192.168.20.0
Router(config-router)#network 192.168.30.0
四、验证结果
