acl综合配置练习

TTAstandardizationoffice【TTA5AB-TTAK08-TTA2C】acl综合配置练习ACL综合配置练习姓名：学号：班级：任务1：配置带有CHAP身份验证的PPP步骤1：将HQ和B1之间的链路配置为使用带有CHAP身份验证的PPP封装Password:HQ>enablePassword:HQ#configtHQ(config)#usernameB1passwordcisco123HQ(config)#interfaces0/0/0HQ(config-if)#noshutdownHQ(config-if)#encapsulationpppHQ(config-if)#encapsulationpppHQ(config-if)#pppauthenticationchapHQ(config-if)#endHQ#copyrunning-configstartup-configHQ#Password:B1>enablePassword:B1#configtB1(config)#usernameHQpasswordcisco123B1(config)#interfaces0/0/0B1(config-if)#noshutdownB1(config-if)#encapsulationpppB1(config-if)#pppauthenticationchapB1(config-if)#endB1#copyrunning-configstartup-config步骤2：将HQ和B2之间的链路配置为使用带有CHAP身份验证的PPP封装HQ#configtHQ(config)#usernameB2passwordcisco123HQ(config)#interfaces0/0/1HQ(config-if)#noshutdownHQ(config-if)#encapsulationpppHQ(config-if)#pppauthenticationchapHQ(config-if)#endHQ#copyrunning-configstartup-configHQ#Password:B2>enablePassword:B2#configtB2(config)#usernameHQpasswordcisco123B2(config)#interfaces0/0/0B2(config-if)#noshutdownB2(config-if)#encapsulationpppB2(config-if)#pppauthenticationchapB2(config-if)#endB2#copyrunning-configstartup-config步骤3：检查路由器之间是否已恢复连通性HQpingB1HQpingB2任务2：配置默认路由步骤1：配置从HQ到ISP的默认路由HQ#configtHQ(config)#iproute0.0.0HQ(config)#endHQ#copyrunning-configstartup-configHQ#步骤2：测试与WebServer的连通性任务3：配置OSPF路由步骤1：在HQ上配置OSPFHQ#configtHQ(config)#routerospf1HQ(config-router)#networkHQ(config-router)#networkHQ(config-router)#network10.1.1HQ(config-router)#network10.1.1HQ(config-router)#passive-interfacef0/0HQ(config-router)#passive-interfacef0/1HQ(config-router)#passive-interfaces0/1/0HQ(config-router)#log-adjacency-changesHQ(config-router)#default-informationoriginateHQ(config-router)#endHQ#copyrunning-configstartup-configHQ#步骤2：在B1和B2上配置OSPFPassword:B1>enablePassword:B1#configtB1(config)#routerospf1B1(config-router)#networkB1(config-router)#networkB1(config-router)#network10.1.1B1(config)#routerospf1B1(config-router)#passive-interfacef0/0B1(config-router)#passive-interfacef0/1B1(config-router)#endB1#copyrunning-configstartup-configB1#Password:B2>enablePassword:B2#configtB2(config)#routerospf1B2(config-router)#network10.1.10.0.0.255area00.0.0.255area0B2(config-router)#passive-interfacef0/0B2(config-router)#passive-interfacef0/1B2(config-router)#endB2#copyrunning-configstartup-configB2#步骤3：测试整个网络的连通性PC1pingPC2PC1pingPC4PC1pingPC5PC1pingPC6PC1pingServer-PT内部网PC1pingServer-PTWebServerPC5pingServer-PTWebServer任务4：实施多项ACL安全策略步骤1：实施第一项安全策略HQ>enablePassword:HQ#configtHQ(config)#access-list10denyHQ(config)#access-list10permitanyHQ(config)#interfacef0/1HQ(config-if)#ipaccess-group10outHQ(config-if)#endHQ#copyrunning-configstartup-configHQ#步骤2：检查第一项安全策略是否已实现PC5pingPC1步骤4：实施第二项安全策略B1(config)#access-list115denyiphost.5B1(config)#access-list115permitipanyanyB1(config)#interfacef0/0B1(config-if)#ipaccess-group115inB1(config-if)#endB1#copyrunning-configstartup-configB1#步骤5：检查第二项安全策略是否已实现PC5pingPC3步骤7：实施第三项安全策略配置前测试PC2pingServer-PT内部的PC3pingServer-PT内部的配置HQ(config)#access-list101denytcHQ(config)#access-list101permitipanyanyHQ(config)#interfacef0/0HQ(config-if)#ipaccess-group101in配置后测试步骤10：实施第四项安全策略B2>enablePassword:B2#configtB2(config)#ipaccess-listextendedNO_FTP0.0.0B2(config-ext-nacl)#permitipanyanyB2(config-ext-nacl)#interfacef0/1B2(config-if)#ipaccess-groupNO_FTPinB2(config-if)#endB2#copyrunning-configstartup-configB2#步骤11：检测结果步骤12：实施第五项安全策略HQ#configtHQ(config)#ipaccess-listextendedFIREWALLHQ(config-ext-nacl)#permiticmpanyanyecho-replyHQ(config-ext-nacl)#permittcpanyanyestablishedHQ(config-ext-nacl)#denyipanyanyHQ(config-ext-nacl)#interfaces0/1/0HQ(config-if)#descriptionLinktoISPHQ(config-if)#ipaccess-groupFIREWALLinHQ(config-if)#endHQ#copyrunning-configstartup-configHQ#步骤13：检查第五项安全策略是否已实现PC1pingWebServerPC4pingWebServerWebServerpingPC1WebServerpingPC5