Expand ACL-Wang Bei's study notes
IP-ACL (layer 3 ACL for layer 3 traffic)
Standard ACL:
Can only match the source IP address of an IP packet
Extended ACL:
(source IP destination IP) transport layer protocol capable of simultaneously matching IP packets
Expand ACL to match traffic, more accurately: determine the only 5 tuples of traffic: source IP, destination IP, source port, destination port, transport layer protocol. For data, which can be represented by "transport layer protocol + port number", it means that the data belongs to the "application layer". When a router looks up the routing table, there is a longest matching principle. The longer the match, the more accurate the address.
Experiment name: the principle and Application of extended ACL
Lab Topology:
Lab requirements:
R1 can ping to R4
Loopback 0 of R1 cannot telnet R4
The steps of the experiment:
1. Ensure network interconnection
# configure the device port address based on the topology diagram
# configure static routes to ensure interconnection of network segments
& write one by one
& default route: 0.0.0.0 0.0.0.0-> 0.0.0.0Universe 0, indicating all networks.
2 、 Configure ACL policy if you want to grab a traffic, you must know a traffic configuration command: (R2) ip access-list extended Deny-telnet 10 deny tcp 10.10.1.0 0.0.255 10.0.255 10.4.0 0.0.255 eq telnet 20 deny tcp 10.10.1.0 0.0.0.255 192.168.34.0 0.0.0.255 eq telnet 30 permit ip any any
!
Or
Ip access-list extended Deny-telnet 10 deny tcp 10.10.1.1 0.0.0.0 10.10.4.4 0.0.0.0 eq telnet 20 deny tcp 10.10.1.1 0.0.0.0 192.168.34.4 0.0.0.0 eq telnet 30 permit ip 0.0.0.0 255.255. 255.255 0.0.0.0 255.255.255.2553 、 Call ACL policy R2: interface fas0/1 ip access-group Deny-telnet in 4, Verify ACL policy R2: show ip access-list show ip interface fas0/1 R1: telnet 10.10.4.4 / source-interface loopback 0-> no telnet 192.168.34.4 / source-interface loopback 0-> all types of traffic between all other no addresses It all works.
Note:
ACL does not work on traffic initiated by local devices, only on traversing traffic
=
ISP (internet service provider)
EMS
