CCNA之五访问列表与telnet访问控制

CCNA之五：访问列表与telnet访问控制环境：两台路由器由串口相连。要求：只允许R1的loop1能ping通R2的loop0；并且在R2上做telnet访问控制，只允许R1的loop0能够远程登录，不能使用deny语句。步骤一、连通性配置r1的配置：r1(config)#interfaceloopback0r1(config-if)#ipaddress10.1.1.1255.255.255.0r1(config-if)#interfaceloopback1r1(config-if)#ipadress10.1.2.1255.255.255.0r1(config-if)#interfaces0r1(config-if)#ipaddress30.1.1.1255.255.255.0r1(config-if)#noshutdownr1(config)#iproute0.0.0.00.0.0.030.1.1.2配置缺省路由r2的配置：r2(config)#interfaceloopback0r2(config-if)#ipaddress20.1.1.1255.255.255.0r2(config-if)#interfaces1r2(config-if)#ipaddress30.1.1.2255.255.255.0r2(config-if)#clockrate64000r2(config-if)#noshutdownr2(config)#iproute0.0.0.00.0.0.030.1.1.1配置缺省路由做ping测试:r1#pingProtocol[ip]:TargetIPaddress:20.1.1.1Extendedcommands[n]:ySourceaddressorinterface:10.1.1.1!!!!!步骤二、配置VTYr2(config)#usernameciscoprivilege15passwordciscor2(config)#linevty04r2(config-line)#loginlocal测试：r1#telnet30.1.1.2/source-interfaceloopback0使用回环接口做为源Trying30.1.1.2...OpenUserAccessVerificationPassword:r2r1#telnet30.1.1.2/source-interfaceloopback1以LOOP1做为源地址Trying30.1.1.2...OpenUserAccessVerificationUsername:cisco输入用户名Password:输入密码，登录r2r2步骤三、配置访问列表r2(config)#access-list102permiticmphost10.1.2.1host20.1.1.1r2(config)#access-list102permittcpanyanyeqtelnet创建扩展访问列表102r2(config)#interfaces1r2(config-if)#ipaccess-group102in将列表加载到接口r2(config-if)#ping测试:r1#pingProtocol[ip]:TargetIPaddress:20.1.1.1Extendedcommands[n]:ySourceaddressorinterface:10.1.2.1!!!!!r1#pingProtocol[ip]:TargetIPaddress:20.1.1.1Extendedcommands[n]:ySourceaddressorinterface:10.1.1.1…..步骤四、创建telnet访问列表r2(config)#access-list10permithost10.1.1.1创建标准访问列表10r2(config)#linevty04r2(config-line)#access-class10in加载列表10r2(config-line)#exitr2(config)#测试:r1#telnet30.1.1.2Trying30.1.1.2...%Connectionrefusedbyremotehostr1#telnet30.1.1.2/source-interfaceloopback0Trying30.1.1.2...OpenUserAccessVerificationPassword:r2步骤五、显示配置结果访问列表配置：r2#showaccess-lists显示访问列表StandardIPaccesslist10permit10.1.1.1(2matches)ExtendedIPaccesslist102Permiticmphost10.1.2.1host20.1.1.1(163matches)permittcpanyanyeqtelnet(162matches)r1当前配置：r1#showrunning-confighostnamer1noipdomain-lookup!interfaceLoopback0ipaddress10.1.1.1255.255.255.0!interfaceLoopback1ipaddress10.1.2.1255.255.255.0!interfaceSerial0ipaddress30.1.1.1255.255.255.0clockrate64000!iproute0.0.0.00.0.0.030.1.1.2!endr2的当前配置：r2#showrunning-config!hostnamer2!noipdomain-lookup!interfaceLoopback0ipaddress20.1.1.1255.255.255.0!interfaceSerial1ipaddress30.1.1.2255.255.255.0ipaccess-group102in!iproute0.0.0.00.0.0.030.1.1.1!access-list10permit10.1.1.1access-list102permiticmphost10.1.2.1host20.1.1.1access-list102permittcpanyanyeqtelnet!linevty04access-class10inpasswordciscologin!end总结：这个很简单的一个lab。我希望大家注意一个就是r2(config)#usernameciscoprivilege15passwordcisco上面这个句子是定义了cisco用户的权限是15level的，默认情况下cisco的远程用户不定义级别，只有在输入enable的密码后，才能拥有privilege15level的权限。但是如果定义了权限的话，那么telnet上去后，就直接进入特权模式，而不需要知道enable的密码了·！请大家注意这个特性~！