基本访问控制列表

1、网络拓扑图及信息规划，如上图示

2、路由器基本配置

<AR1>dis cu

[V200R003C00]

#

sysname AR1

#

snmp-agent local-engineid 800007DB03000000000000

snmp-agent

#

clock timezone China-Standard-Time minus 08:00:00

#

portal local-server load portalpage.zip

#

drop illegal-mac alarm

#

set cpu-usage threshold 80 restore 75

#

acl number 2000

rule 5 deny source 192.168.1.0 0.0.0.255

#

aaa

authentication-scheme default

authorization-scheme default

accounting-scheme default

domain default

domain default_admin

local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$

local-user admin service-type http

#

firewall zone Local

priority 15

#

interface GigabitEthernet0/0/0

ip address 192.168.100.254 255.255.255.0

traffic-filter outbound acl 2000

#

interface GigabitEthernet0/0/1

ip address 192.168.1.254 255.255.255.0

#

interface GigabitEthernet0/0/2

ip address 192.168.2.254 255.255.255.0

#

interface NULL0

#

user-interface con 0

authentication-mode password

user-interface vty 0 4

user-interface vty 16 20

#

wlan ac

3.验证

小结 acl部署在靠近目标设备一端

dis acl all 查看

display traffic-filter applied-record

只匹配来源地址