实验内容
- 完成各设备配置是的全网互通
- 在R2上部部署标准访问控制列表，只允许192.168.12.0/24网段的用户穿越R2访问3.3.3.3，其他进入R2 S0/0接口的流量全部丢弃。
- 在R2上部署ACL，只允许从1.1.1.1到3.3.3.3的ICMP流量以及R1到3.3.3.3的Telnet流量经过
- 经过R2，其他从R2的S0/0接口进入的流量过滤掉
实验目的
掌握标准ACL的配置
理解标准ACL的接入控制中的应用
实验步骤
要求一：
绘制网络拓扑图如下所示：
实验十八——————ACL配置2
IP基本地址信息为：
PC1 的IP地址：1.1.1.1 网关地址：1.1.1.254
PC2的IP地址：3.3.3.3 网关地址：3.3.3.254
路由器地址信息为：
实验十八——————ACL配置2
实验十八——————ACL配置2
路由器其他配置信息
R1:
实验十八——————ACL配置2
R2：
实验十八——————ACL配置2
R3:
实验十八——————ACL配置2
连通性测试
PC>ipconfig
FastEthernet0 Connection:(default port)
Link-local IPv6 Address.........: FE80::204:9AFF:FEB1:913D
IP Address......................: 1.1.1.1
Subnet Mask.....................: 255.255.255.0
Default Gateway.................: 1.1.1.254
PC>ping 1.1.1.254
Pinging 1.1.1.254 with 32 bytes of data:
Reply from 1.1.1.254: bytes=32 time=0ms TTL=255
Reply from 1.1.1.254: bytes=32 time=0ms TTL=255
Reply from 1.1.1.254: bytes=32 time=1ms TTL=255
Reply from 1.1.1.254: bytes=32 time=0ms TTL=255
Ping statistics for 1.1.1.254:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 1ms, Average = 0ms
PC>ping 192.168.12.1
Pinging 192.168.12.1 with 32 bytes of data:
Reply from 192.168.12.1: bytes=32 time=0ms TTL=255
Reply from 192.168.12.1: bytes=32 time=0ms TTL=255
Reply from 192.168.12.1: bytes=32 time=0ms TTL=255
Reply from 192.168.12.1: bytes=32 time=0ms TTL=255
Ping statistics for 192.168.12.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
PC>ping 192.168.12.2
Pinging 192.168.12.2 with 32 bytes of data:
Reply from 192.168.12.2: bytes=32 time=1ms TTL=254
Reply from 192.168.12.2: bytes=32 time=5ms TTL=254
Reply from 192.168.12.2: bytes=32 time=4ms TTL=254
Reply from 192.168.12.2: bytes=32 time=5ms TTL=254
Ping statistics for 192.168.12.2:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 1ms, Maximum = 5ms, Average = 3ms
PC>ping 192.168.23.2
Pinging 192.168.23.2 with 32 bytes of data:
Reply from 192.168.23.2: bytes=32 time=1ms TTL=254
Reply from 192.168.23.2: bytes=32 time=1ms TTL=254
Reply from 192.168.23.2: bytes=32 time=2ms TTL=254
Reply from 192.168.23.2: bytes=32 time=5ms TTL=254
Ping statistics for 192.168.23.2:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 1ms, Maximum = 5ms, Average = 2ms
PC>ping 192.168.23.3
Pinging 192.168.23.3 with 32 bytes of data:
Reply from 192.168.23.3: bytes=32 time=12ms TTL=253
Reply from 192.168.23.3: bytes=32 time=2ms TTL=253
Reply from 192.168.23.3: bytes=32 time=2ms TTL=253
Reply from 192.168.23.3: bytes=32 time=14ms TTL=253
Ping statistics for 192.168.23.3:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 2ms, Maximum = 14ms, Average = 7ms
PC>ping 3.3.3.3.
PC>ping 3.3.3.3
Pinging 3.3.3.3 with 32 bytes of data:
Request timed out.
Reply from 3.3.3.3: bytes=32 time=7ms TTL=125
Reply from 3.3.3.3: bytes=32 time=2ms TTL=125
Reply from 3.3.3.3: bytes=32 time=3ms TTL=125
Ping statistics for 3.3.3.3:
Packets: Sent = 4, Received = 3, Lost = 1 (25% loss),
Approximate round trip times in milli-seconds:
Minimum = 2ms, Maximum = 7ms, Average = 4ms
PC>基于以上验证，说明全网通！
要求二：
在R2上部署标准访问控制列表，只允许192.168.12.0/24网段的用户穿越R2访问3.3.3.3，其他进入R2 s0/0/0接口的流量全部丢弃。
R2的配置如下：
实验十八——————ACL配置2
用ip地址为192.168.12.1的R1测试的时候发现可以ping通
实验十八——————ACL配置2
用PC1(ip地址为1.1.1.1）,发现不可以ping通
实验十八——————ACL配置2
结论：发现其他进入R2 s0/0/0接口的流量全部丢弃，无法到达3.3.3.3。
要求三：
在R2上部署ACL，只允许从1.1.1.1到3.3.3.3的ICMP流量以及R1到3.3.3.3的telnet流经过R2，其他从R2 s0/0/0接口进入的流量过滤掉。
R2的配置如下：
实验十八——————ACL配置2
开启R3的Telnet：
实验十八——————ACL配置2
测试：
实验十八——————ACL配置2
由测试内容我们可以发现ICMP的流量可以到达3.3.3.3，同时可以Telnet到3.3.3.3
至此，该实验结束！
