Slias Astro Blog
返回

网络复习参考

编辑页面

ACL(Access Control List)

image-20250611164713468

通配符掩码

image-20250611164857444

ACL 的标识

image-20250611164927865

基本 ACL

image-20250611165050338

二层 ACL

配置 ACL 包过滤

image-20250611165206504

开启防火墙
[sysname] firewall enable

设置防火墙的默认过滤方式
[sysname] firewall default {permit | deny}

配置基本ACL acl-number范围为2000 - 2999
[sysname] acl number acl-number(range 2000 - 2999)

定义规则
 ->制定要匹配的源IP地址范围
 ->指定动作是permit or deny
[sysname-acl-basic-2000] rule [rule-id] {deny | permit} [fragment | logging | source {sour-addr sour-wildcard | any} | time-range time-name]

配置高级IPv4 ACL，并指定ACL序号
[sysname] acl number acl-number

定义规则
需要配置规则来匹配源IP地址、目的IP地址、IP承载的协议类型、协议端口号等信息
指定动作是permit或deny
[sysname-acl-adv-3000] rule [ rule-id ] { deny | permit } protocol [ destination { dest-addr dest-wildcard | any } | destination-port operator port1 [ port2 ] established | fragment | source { sour-addr sour-wildcard | any } | source-port operator port1 [ port2 ] | time-range time-name]


在接口上应用ACL
traffic-filter { inbound | outbound } acl {acl-number}

删除ACL配置
undo acl {acl-number}

删除接口上已应用的ACL配置
undo traffic-filter {inbound | outbound}

ACL的匹配顺序
acl number acl-number [match-order {auto | config}]

基础 ACL 配置

image-20250611170342039

[RTA] firewall enable
[RTA] acl number 2000
[RTA-acl-basic-2000] rule deny source 172.16.0.1 0
[RTA-acl-basic-2000] rule permit source any
[RTA-G0/1] traffic-filter inbound acl 2000

高级 ACL 配置

image-20250611170540160

[RTC] firewall enable
[RTC] acl number 3000
[RTC-acl-adv-3000] rule deny ip source 172.16.0.1 0 destination 192.168.0.0 0.0.1.255
[RTC-acl-adv-3000] rule permit ip source any
[RTC-G0/0] traffic-filter inbound acl 3000

高级 ACL 配置 WWW 服务

image-20250611171135691

firewall enable
acl number 3000
rule deny tcp source 172.16.0.1 0 destination 192.168.0.0 0.0.1.255 destination-port eq www
rule permit ip source any
int g0/0
traffic-filter inbound acl 3000

高级 ACL 配置 telnet 服务

image-20250611171531151

firewall enable
acl number 3000
rule permit tcp source 200.2.2.2 0 destination-port eq 23
rule deny tcp source any destination-port eq 23
int g0/0
traffic-filter inbound acl 3000
int g0/1
traffic-filter inbound acl 3000
int g0/2
traffic-filter inbound acl 3000

[RTB] 的配置

acl number 2000
rule permit source 200.2.2.2 0
rule deny source any
user-interface vty 0 4
acl 2000 inbound

NAT

image-20250611171949936

配置 BasicNAT

image-20250611172102877

Example

image-20250611172408379

acl number 2000
rule 0 permit source 10.0.0.0 0.0.0.255
nat address-group 1 198.76.29.11 198.76.28.20
int g0/1
nat outbound 2000 address-group 1 no-pat

还是上边这个图，我们配置一个 NAPT 来进行实现(地址池变为只有一个 198.78.26.11)

acl number 2000
rule 0 permit source 10.0.0.0 0.0.0.255
nat address-group 1 198.76.28.11
intface g0/1
nat outbound 2000 address-group 1

Easy IP

image-20250611173127327

Example

image-20250611173246629

acl number 2000
rule 0 permit source 10.0.0.0 0.0.0.255
intface g0/1
nat outbound 2000

NATServer

Example

image-20250611173552001

以太网交换原理

VLAN（虚拟局域网）

VLAN 的分类

image-20250611174348822

image-20250611174403453

image-20250611174422069

image-20250611174430501

VLAN 技术原理

image-20250611174554197

image-20250611174602160

image-20250611174610164

Access、Trunk 和 Hybrid 的区别

VLAN 配置命令（重点）

Example

image-20250611175058712

[swa] vlan 10
port g1/0/1
vlan 20
port g1/0/2
int g1/0/24
port link-type trunk
port trunk allow-pass vlan 10 20
[swb] vlan 10
port g1/0/1
vlan 20
port g1/0/2
int g1/0/24
port link-type trunk
port trunk allow-pass

Vlan 考点

下图为 Access 接口

image-20250612135510694

下图为 Trunk 接口 的工作原理

image-20250612140725778

Vlan 间路由的交换方案

三层交换

   vlan 100
   port e0/1 to e0/8
   intface vlan 100
   ip add 1.1.1.254 255.255.255.0
   vlan 200
   port e0/1 to e0/8
   intface vlan 200
   ip add 2.2.2.254 255.255.255.0

单臂路由配置

image-20250612162548134

int g0/0/0
ip add 192.20.126.1 24
int g0/0/0.127
dot1q termination vid 127
ip add 192.20.127.1 24
arp broadcast enable
int g0/0/0.128
dot1q termination vid 128
ip add 192.20.128.1 24
arp broadcast enable
int g0/0/0.129
dot1q termination vid 129
ip add 192.20.129.1 24
arp broadcast enable
int g0/0/1
ip add 192.20.130.1 24
int g0/0/1.131
dot1q termination vid 131
ip add 192.20.131.1 24
arp broadcast enable
RT1:
int loop 0
ip add 1.1.1.1 255.255.255.255
ospf 1
area 0
network 1.1.1.1 0.0.0.0
network 192.20.126.0 0.0.0.255
network 192.20.127.0 0.0.0.255
network 192.20.128.0 0.0.0.255
network 192.20.129.0 0.0.0.255
network 192.20.132.0 0.0.0.255

RT2:
int loop 2
ip add 2.2.2.2 32
ospf 1
area 0
network 2.2.2.2 0.0.0.0
network 192.20.130.0 0.0.0.255
network 192.20.131.0 0.0.0.255
network 192.20.132.0 0.0.0.255

三层交换机配置

image-20250612163503485

LSW3:
int vlanif 126
ip add 192.20.126.1 24
int vlanif 127
ip add 192.20.127.1 24
int vlanif 128
ip add 192.20.128.1 24
int vlanif 129
ip add 192.20.128.1 24
vlan batch 126 to 129
int g0/0/2
port link-type access
port default vlan 129
int g0/0/1
port link-type access
port default vlan 128
int g0/0/3
port link-type trunk
port trunk allow-pass vlan all

PPP

主验证方
ppp authentication-mode pap
local-user wtc password {cipher | simple} 123
local-user wtc service-type ppp

被验证方
ppp pap local-user wtc password cipher 123
主验证方
ppp authentication-mode chap
local-user wtc password cipher 123
local-user wtc service-type ppp

被验证方
ppp chap user wtc
ppp chap password cipher 123

PAP 验证配置举例

image-20250612162124917

CHAP 验证配置举例

image-20250612162232411

编辑页面
分享到：
Share this post via WhatsApp Share this post on Facebook Share this post on X Share this post via Telegram Share this post on Pinterest Share this post via email
上一篇
Java学习 - JavaWeb
下一篇
Java学习 - day003