2024-08-30 15:59:38 +08:00
|
|
|
|
# ACL + Telnet
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2024-09-02 08:58:20 +08:00
|
|
|
|
- **需求**
|
|
|
|
|
|
- 为了便于设备管理，为设备开启远程管理功能，登录密码：HCIE
|
|
|
|
|
|
- 仅仅允许 192.168.1.254 远程登录 R2，拒绝其他所有IP地址
|
|
|
|
|
|
- 拒绝 R1的任何IP地址远程登录 R3，其他设备都可以
|
|
|
|
|
|
|
2024-08-30 15:59:38 +08:00
|
|
|
|
### 一 、IP & Routing
|
|
|
|
|
|
|
|
|
|
|
|
- **PC、Client、Server**
|
|
|
|
|
|
|
|
|
|
|
|
- **AR1**
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
[AR1]int g0/0/0
|
|
|
|
|
|
[AR1-GigabitEthernet0/0/0]ip add 192.168.12.1 24
|
|
|
|
|
|
[AR1-GigabitEthernet0/0/0]int g0/0/2
|
|
|
|
|
|
[AR1-GigabitEthernet0/0/2]ip add 192.168.1.254 24
|
|
|
|
|
|
[AR1-GigabitEthernet0/0/2]quit
|
|
|
|
|
|
[AR1]ip route-static 192.168.2.0 24 192.168.12.2
|
|
|
|
|
|
[AR1]ip route-static 192.168.3.0 24 192.168.12.2
|
|
|
|
|
|
[AR1]ip route-static 192.168.23.0 24 192.168.12.2
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
- **AR2**
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
[AR2]int g0/0/0
|
|
|
|
|
|
[AR2-GigabitEthernet0/0/0]ip add 192.168.12.2 24
|
|
|
|
|
|
[AR2-GigabitEthernet0/0/0]int g0/0/1
|
|
|
|
|
|
[AR2-GigabitEthernet0/0/1]ip add 192.168.23.2 24
|
|
|
|
|
|
[AR2-GigabitEthernet0/0/1]int g0/0/2
|
|
|
|
|
|
[AR2-GigabitEthernet0/0/2]ip add 192.168.2.254 24
|
|
|
|
|
|
[AR2-GigabitEthernet0/0/2]quit
|
|
|
|
|
|
[AR2]ip route-static 192.168.1.0 24 192.168.12.1
|
|
|
|
|
|
[AR2]ip route-static 192.168.3.0 24 192.168.23.3
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
- **AR3**
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
[AR3]int g0/0/0
|
|
|
|
|
|
[AR3-GigabitEthernet0/0/0]ip add 192.168.23.3 24
|
|
|
|
|
|
[AR3-GigabitEthernet0/0/0]int g0/0/2
|
|
|
|
|
|
[AR3-GigabitEthernet0/0/2]ip add 192.168.3.254 24
|
|
|
|
|
|
[AR3-GigabitEthernet0/0/2]quit
|
|
|
|
|
|
[AR3]ip route-static 192.168.1.0 24 192.168.23.2
|
|
|
|
|
|
[AR3]ip route-static 192.168.2.0 24 192.168.23.2
|
|
|
|
|
|
[AR3]ip route-static 192.168.12.0 24 192.168.23.2
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
- **连通性测试**
|
|
|
|
|
|
|
|
|
|
|
|
> 三个终端全部互通
|
|
|
|
|
|
|
|
|
|
|
|
### 二、Telnet
|
|
|
|
|
|
|
|
|
|
|
|
- **AR2**
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
[AR2]user-interface vty 0 4
|
|
|
|
|
|
[AR2-ui-vty0-4]authentication-mode password
|
|
|
|
|
|
Please configure the login password (maximum length 16):123456
|
|
|
|
|
|
[AR2-ui-vty0-4]protocol inbound all
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
- **AR3**
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
[AR3]user-interface vty 0 4
|
|
|
|
|
|
[AR3-ui-vty0-4]authentication-mode password
|
|
|
|
|
|
Please configure the login password (maximum length 16):123456
|
|
|
|
|
|
[AR3-ui-vty0-4]protocol inbound all
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
- **远程连接测试**
|
|
|
|
|
|
|
|
|
|
|
|
- AR1 远程 AR2
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
telnet -a 192.168.1.254 192.168.12.2 【Success】
|
|
|
|
|
|
telnet -a 192.168.1.254 192.168.23.2 【Success】
|
|
|
|
|
|
telnet -a 192.168.1.254 192.168.2.254 【Success】
|
|
|
|
|
|
|
|
|
|
|
|
telnet -a 192.168.12.1 192.168.12.2 【Success】
|
|
|
|
|
|
telnet -a 192.168.12.1 192.168.23.2 【Success】
|
|
|
|
|
|
telnet -a 192.168.12.1 192.168.2.254 【Success】
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
- AR3 远程 AR2
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
telnet -a 192.168.3.254 192.168.12.2 【Success】
|
|
|
|
|
|
telnet -a 192.168.3.254 192.168.23.2 【Success】
|
|
|
|
|
|
telnet -a 192.168.3.254 192.168.2.254 【Success】
|
|
|
|
|
|
|
|
|
|
|
|
telnet -a 192.168.23.3 192.168.12.2 【Success】
|
|
|
|
|
|
telnet -a 192.168.23.3 192.168.23.2 【Success】
|
|
|
|
|
|
telnet -a 192.168.23.3 192.168.2.254 【Success】
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
- AR1 远程 AR3
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
telnet -a 192.168.1.254 192.168.23.3 【Success】
|
|
|
|
|
|
telnet -a 192.168.1.254 192.168.3.254 【Success】
|
|
|
|
|
|
|
|
|
|
|
|
telnet -a 192.168.12.1 192.168.23.3 【Success】
|
|
|
|
|
|
telnet -a 192.168.12.1 192.168.3.254 【Success】
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
### 三、ACL
|
|
|
|
|
|
|
|
|
|
|
|
- **AR2**
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
[AR2]acl 2000
|
|
|
|
|
|
[AR2-acl-basic-2000]rule 10 permit source 192.168.1.254 0.0.0.0
|
|
|
|
|
|
[AR2-acl-basic-2000]quit
|
|
|
|
|
|
[AR2]user-interface vty 0 4
|
|
|
|
|
|
[AR2-ui-vty0-4]acl 2000 inbound
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
- 注释
|
|
|
|
|
|
|
|
|
|
|
|
1. `[AR2]acl 2000`：这条命令创建了一个编号为2000的基本ACL。
|
|
|
|
|
|
2. `[AR2-acl-basic-2000]rule 10 permit source 192.168.1.254 0.0.0.0`：在ACL 2000中添加了一条规则，规则编号为10，这条规则允许源IP地址为192.168.1.254的所有数据包通过。`0.0.0.0`表示对源IP地址进行精确匹配。
|
|
|
|
|
|
3. `[AR2-acl-basic-2000]quit`：退出ACL 2000的配置模式。
|
|
|
|
|
|
4. `[AR2]user-interface vty 0 4`：进入VTY行0到4的配置模式。VTY是Virtual Teletype的缩写，通常用于远程登录设备。
|
|
|
|
|
|
5. `[AR2-ui-vty0-4]acl 2000 inbound`：将之前创建的ACL 2000应用到VTY行0到4的入方向。这意味着只有当远程登录的源IP地址匹配ACL 2000中的规则时，才能访问这些VTY行。
|
|
|
|
|
|
|
|
|
|
|
|
> 这样配置后，只有来自192.168.1.254的远程登录请求才能通过VTY 0到4访问设备。其他地址的请求将被拒绝。
|
|
|
|
|
|
|
|
|
|
|
|
- 远程连接测试
|
|
|
|
|
|
|
|
|
|
|
|
- AR1 远程 AR2
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
telnet -a 192.168.1.254 192.168.12.2 【Success】
|
|
|
|
|
|
telnet -a 192.168.1.254 192.168.23.2 【Success】
|
|
|
|
|
|
telnet -a 192.168.1.254 192.168.2.254 【Success】
|
|
|
|
|
|
|
|
|
|
|
|
telnet -a 192.168.12.1 192.168.12.2 【Defeat】
|
|
|
|
|
|
telnet -a 192.168.12.1 192.168.23.2 【Defeat】
|
|
|
|
|
|
telnet -a 192.168.12.1 192.168.2.254 【Defeat】
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
> AR1只有1.254可以远程AR2，12.1不可以远程AR2
|
|
|
|
|
|
|
|
|
|
|
|
- AR3 远程 AR2
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
telnet -a 192.168.3.254 192.168.12.2 【Defeat】
|
|
|
|
|
|
telnet -a 192.168.3.254 192.168.23.2 【Defeat】
|
|
|
|
|
|
telnet -a 192.168.3.254 192.168.2.254 【Defeat】
|
|
|
|
|
|
|
|
|
|
|
|
telnet -a 192.168.23.3 192.168.12.2 【Defeat】
|
|
|
|
|
|
telnet -a 192.168.23.3 192.168.23.2 【Defeat】
|
|
|
|
|
|
telnet -a 192.168.23.3 192.168.2.254 【Defeat】
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
> AR3不可以远程AR2
|
|
|
|
|
|
|
|
|
|
|
|
- **AR3**
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
[AR3]acl 2000
|
|
|
|
|
|
[AR3-acl-basic-2000]rule 10 deny source 192.168.1.254 0.0.0.0
|
|
|
|
|
|
[AR3-acl-basic-2000]rule 20 deny source 192.168.12.1 0.0.0.0
|
|
|
|
|
|
[AR3-acl-basic-2000]rule 30 permit source any
|
|
|
|
|
|
[AR3-acl-basic-2000]quit
|
|
|
|
|
|
[AR3]user-interface vty 0 4
|
|
|
|
|
|
[AR3-ui-vty0-4]acl 2000 inbound
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
- 注释
|
|
|
|
|
|
|
|
|
|
|
|
1. `[AR3]acl 2000`：这条命令指示设备创建一个新的基本ACL，编号为2000。
|
|
|
|
|
|
2. `[AR3-acl-basic-2000]rule 10 deny source 192.168.1.254 0.0.0.0`：在ACL 2000中添加了一条规则，编号为10，该规则用于拒绝源IP地址为192.168.1.254的所有数据包。
|
|
|
|
|
|
3. `[AR3-acl-basic-2000]rule 20 deny source 192.168.12.1 0.0.0.0`：接着添加了一条规则，编号为20，该规则用于拒绝源IP地址为192.168.12.1的所有数据包。
|
|
|
|
|
|
4. `[AR3-acl-basic-2000]rule 30 permit source any`：最后添加了一条规则，编号为30，允许任何源IP地址的数据包通过。这条规则通常放在ACL的末尾，作为默认规则，匹配所有未被之前规则拒绝的流量。
|
|
|
|
|
|
5. `[AR3]user-interface vty 0 4`：进入VTY行0到4的配置界面，这些界面用于远程登录设备。
|
|
|
|
|
|
6. `[AR3-ui-vty0-4]acl 2000 inbound`：将之前创建的ACL 2000应用到VTY行0到4的入方向。这意味着只有当远程登录的源IP地址不匹配ACL 2000中规则10和规则20所拒绝的地址时，才能通过这些VTY行进行远程登录。
|
|
|
|
|
|
|
|
|
|
|
|
> 配置的ACL将拒绝来自192.168.1.254和192.168.12.1的远程登录请求，而允许来自其他所有地址的请求。这样的配置有助于增强网络设备的安全性。
|
|
|
|
|
|
|
|
|
|
|
|
- 远程连接测试
|
|
|
|
|
|
|
|
|
|
|
|
- AR1 远程 AR3
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
telnet -a 192.168.1.254 192.168.23.3 【Defeat】
|
|
|
|
|
|
telnet -a 192.168.1.254 192.168.3.254 【Defeat】
|
|
|
|
|
|
|
|
|
|
|
|
telnet -a 192.168.12.1 192.168.23.3 【Defeat】
|
|
|
|
|
|
telnet -a 192.168.12.1 192.168.3.254 【Defeat】
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
- AR2 远程 AR3
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
telnet -a 192.168.3.254 192.168.23.3 【Success】
|
|
|
|
|
|
telnet -a 192.168.3.254 192.168.3.254 【Success】
|
|
|
|
|
|
|
|
|
|
|
|
telnet -a 192.168.23.3 192.168.23.3 【Success】
|
|
|
|
|
|
telnet -a 192.168.23.3 192.168.3.254 【Success】
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
|
