《基于ACL的访问控制及安全策略的设计实验报告.docx》由会员分享，可在线阅读，更多相关《基于ACL的访问控制及安全策略的设计实验报告.docx（30页珍藏版）》请在三一办公上搜索。
1、实 验 报 告课程名称思科路由器开放实验实验名称基于ACL的访问控制及安全策略的设计实验实验时间2012年6月2-3日实 验 报 告实验名称基于ACL的访问控制及安全策略的设计实验实验类型开放实验实验学时16实验时间2012.6.1-2012.6.2一、 实验目的和要求访问控制列表（Access Control List，ACL） 是路由器和交换机接口的指令列表，用来控制端口进出的数据包。验要求学生掌握访问控制列表的配置，理解ACL的执行过程；能够根据ACL设计安全的网络。实验要求完成以下工作：1. 标准ACL。实验目标：本实验拒绝student所在网段访问路由器R2，同时只允许主机teach
2、er访问路由器R2的telnet服务。2. 扩展ACL实验：实验目标：学生不能访问ftp,但能访问www，教师不受限制。3. 防止地址欺骗。外部网络的用户可能会伪装自己的ip地址，比如使用内部网的合法IP地址或者回环地址作为源地址，从而实现非法访问。解决办法：将可能伪装到的ip地址拒绝掉。二、实验环境(实验设备)PC机，并安装Cisco Packet Tracer软件或者是真实的思科网络设备（路由器交换机）。三、实验原理及内容一 基本ACL实验：1.标准ACL。实验目标：本实验拒绝student所在网段访问路由器R2，同时只允许主机teacher访问路由器R2的telnet服务。实验拓补图如下
3、：实验配置如下：RouterenRouter#conf tEnter configuration commands, one per line. End with CNTL/Z.Router(config)#host R1R1(config)#int f0/0R1(config-if)#ip add 10.20.170.1 255.255.255.0R1(config-if)#no shut%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up%LINEPROTO-5-UPDOWN: Line protocol on In
4、terface FastEthernet0/0, changed state to upR1(config-if)#exitR1(config)#int s0/0/0R1(config-if)#ip add 192.168.12.1 255.255.255.0R1(config-if)#clock rate 64000R1(config-if)#no shut%LINK-5-CHANGED: Interface Serial0/0/0, changed state to downR1(config-if)#exitR1(config)#router eigrp 100R1(config-rou
5、ter)#network 10.20.170.0 0.0.0.255R1(config-router)#network 192.168.12.0 R1(config-router)#no autoR1(config-router)#endR1#%SYS-5-CONFIG_I: Configured from console by consoleR1#copy run startDestination filename startup-config? Building configuration.OKRouterenRouter#conf tEnter configuration command
6、s, one per line. End with CNTL/Z.Router(config)#host R2R2(config)#int s0/0/1R2(config-if)#ip add 192.168.12.2 255.255.255.0 R2(config-if)#no shut%LINK-5-CHANGED: Interface Serial0/0/1, changed state to upR2(config-if)#%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0/1, changed state to upR2
7、(config-if)#exitR2(config)#int s0/0/0R2(config-if)#ip add 192.168.23.1 255.255.255.0R2(config-if)#clock rate 64000R2(config-if)#no shut%LINK-5-CHANGED: Interface Serial0/0/0, changed state to downR2(config-if)#exitR2(config)#int f0/0R2(config-if)#ip add 10.20.168.1 255.255.255.0R2(config-if)#no shut
8、R2(config-if)#%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to upR2(config-if)#exit%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to upR2(config)#router eigrp 100R2(config-router)#net 192.168.12.0 R2(config-router)#%DUAL-5-NBRCHANGE: IP-EIGRP 100: Neighbor
9、 192.168.12.1 (Serial0/0/1) is up: new adjacencyR2(config-router)#net 192.168.23.0 R2(config-router)#net 10.20.168.0 0.0.0.255R2(config-router)#no autoR2(config-router)#%DUAL-5-NBRCHANGE: IP-EIGRP 100: Neighbor 192.168.12.1 (Serial0/0/1) is up: new adjacencyR2(config-router)#exitR2(config)#exitR2#%S
10、YS-5-CONFIG_I: Configured from console by consoleR2#copy run startDestination filename startup-config? Building configuration.OKRouterenRouter#conf tEnter configuration commands, one per line. End with CNTL/Z.Router(config)#host R3R3(config)#int s0/0/1R3(config-if)#ip add 192.168.23.2 255.255.255.0R
11、3(config-if)#no shutR3(config-if)#%LINK-5-CHANGED: Interface Serial0/0/1, changed state to upR3(config-if)#exitR3(config)#int f0/0R3(config-if)#ip add 10.20.66.1 255.255.255.0R3(config-if)#no shutR3(config-if)#%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up%LINEPROTO-5-UPDOWN: Line p
12、rotocol on Interface FastEthernet0/0, changed state to upR3(config-if)#exitR3(config)#router eigrp 100R3(config-router)#net 10.20.66.0 0.0.0.255R3(config-router)#net 192.168.23.0R3(config-router)#no autoR3(config-router)#%DUAL-5-NBRCHANGE: IP-EIGRP 100: Neighbor 192.168.23.1 (Serial0/0/1) is up: new
13、 adjacencyR3(config-router)#endR3#%SYS-5-CONFIG_I: Configured from console by consoleR3#copy run startDestination filename startup-config? Building configuration.OK配ACL之前，student去ping R2的三个接口的ip地址，也可以ping 服务器 10.20.168.7，应该ping得通。R2#conf tEnter configuration commands, one per line. End with CNTL/Z.R
14、2(config)#access-list 1 deny 10.20.170.0 0.0.0.255R2(config)#access-list 1 permit anyR2(config)#int s0/0/1R2(config-if)#ip access-group 1 inR2(config-if)#exitR2(config)#access-list 2 permit host 10.20.66.10R2(config)#line vty 0 4R2(config-line)#password 501R2(config-line)#loginR2(config-line)#access
15、-class 2 inR2(config-line)#endR2#%SYS-5-CONFIG_I: Configured from console by consoleR2#copy run startDestination filename startup-config? Building configuration.配ACL之后，student去ping R2的三个接口的ip地址，也可以ping 服务器 10.20.168.7，应该ping不通。PCping 10.20.168.7Pinging 10.20.168.7 with 32 bytes of data:Request timed
16、 out.Request timed out.Request timed out.Request timed out.Ping statistics for 10.20.168.7: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),OKPCping 192.168.12.2Pinging 192.168.12.2 with 32 bytes of data:Request timed out.Request timed out.Request timed out.Request timed out.Ping statistics fo
17、r 192.168.12.2: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),配ACL之后，teacher机可以telnet R2 ，效果如下。PCtelnet 192.168.23.1Trying 192.168.23.1 .OpenUser Access VerificationPassword: 501R2en% No password set.R2但只允许teacher 机telnet R2，在R3上telnet R2 不成功。R3#telnet 192.168.23.1Trying 192.168.23.1 .% Conn
18、ection refused by remote hostR3#telnet 192.168.12.2Trying 192.168.12.2 .% Connection refused by remote hostR3#telnet 10.20.168.1Trying 10.20.168.1 .% Connection refused by remote host在student机上telnet R2 不成功。PCtelnet 192.168.12.2Trying 192.168.12.2 .% Connection timed out; remote host not respondingP
19、Ctelnet 192.168.23.1Trying 192.168.23.1 .% Connection timed out; remote host not respondingPCtelnet 10.20.168.1Trying 10.20.168.1 .% Connection timed out; remote host not responding在R1上telnet R2 不成功。R1#telnet 192.168.12.2Trying 192.168.12.2 .% Connection refused by remote hostR1#telnet 192.168.23.1T
20、rying 192.168.23.1 .% Connection refused by remote hostR1#telnet 10.20.168.1Trying 10.20.168.1 .% Connection refused by remote hostTeacher机：PCtelnet 192.168.12.1Trying 192.168.12.1 .OpenConnection to 192.168.12.1 closed by foreign hostPCtelnet 10.20.170.1Trying 10.20.170.1 .% Connection timed out; r
21、emote host not respondingPCtelnet 10.20.170.10Trying 10.20.170.10 .% Connection timed out; remote host not respondingR1#telnet 10.20.66.1Trying 10.20.66.1 .OpenConnection to 10.20.66.1 closed by foreign hostR1#telnet 192.168.23.2Trying 192.168.23.2 .OpenConnection to 192.168.23.2 closed by foreign h
22、ostR3enR3#telnet 192.168.12.1Trying 192.168.12.1 .OpenConnection to 192.168.12.1 closed by foreign hostR3#telnet 10.20.170.1Trying 10.20.170.1 .% Connection timed out; remote host not respondingSERVERtelnet 192.168.12.2Trying 192.168.12.2 .% Connection refused by remote hostSERVERtelnet 192.168.23.1
23、Trying 192.168.23.1 .% Connection refused by remote hostSERVERtelnet 10.20.168.1Trying 10.20.168.1 .% Connection refused by remote hostSERVERtelnet 192.168.12.1Trying 192.168.12.1 .OpenConnection to 192.168.12.1 closed by foreign hostSERVERtelnet 10.20.170.1Trying 10.20.170.1 .% Connection timed out
24、; remote host not respondingSERVERtelnet 192.168.23.2Trying 192.168.23.2 .OpenConnection to 192.168.23.2 closed by foreign hostSERVERtelnet 10.20.66.1Trying 10.20.66.1 .OpenConnection to 10.20.66.1 closed by foreign hostSERVERtelnet 10.20.66.10Trying 10.20.66.10 .% Connection refused by remote hostS
25、ERVER2扩展ACL实验：实验目标：学生不能访问ftp,但能访问www，教师不受限制。实验拓补图如下：实验配置如下：R2#sh access-listsStandard IP access list 1 deny 10.20.170.0 0.0.0.255 permit any (11 match(es)Standard IP access list 2 permit host 10.20.66.10R2#sh runinterface Serial0/0/1 ip address 192.168.12.2 255.255.255.0 ip access-group 1 in!line vt
26、y 0 4 access-class 2 in password 501 login!删除ACL：R2#conf tEnter configuration commands, one per line. End with CNTL/Z.R2(config)#int s0/0/1R2(config-if)#no ip access-group 1 inR2(config-if)#exitR2(config)#no access-list 1R2(config)#line vty 0 4R2(config-line)#no access-class 2 inR2(config-line)#no p
27、assword R2(config-if)#exitR2(config)#no access-list 2可以用sh access-lists 和sh run查看。R2#sh access-listsR2#sh runR2#copy run startDestination filename startup-config? Building configuration.OK配ACL之前测试：student的pc机测试结果如下：PCping 10.20.168.7Pinging 10.20.168.7 with 32 bytes of data:Reply from 10.20.168.7: b
28、ytes=32 time=203ms TTL=126Reply from 10.20.168.7: bytes=32 time=141ms TTL=126Reply from 10.20.168.7: bytes=32 time=157ms TTL=126Reply from 10.20.168.7: bytes=32 time=143ms TTL=126Ping statistics for 10.20.168.7: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),Approximate round trip times in mill
29、i-seconds: Minimum = 141ms, Maximum = 203ms, Average = 161msstudent机上测试：PCftp 10.20.168.7Trying to connect.10.20.168.7Connected to 10.20.168.7220- Welcome to PT Ftp serverUsername:cisco331- Username ok, need passwordPassword:cisco230- Logged in(passive mode On)ftpftpctrl+cPacket Tracer PC Command Li
30、ne 1.0PC配dns之后，也就是指定了服务器的ip地址10.20.168.7 和域名 的对应关系之后，也可以以域名的方式登录到ftp服务器。PCftp Trying to Connected to 220- Welcome to PT Ftp serverUsername:cisco331- Username ok, need passwordPassword:cisco230- Logged in(passive mode On)ftpexit Invalid or non supported command.ftpctrl+cPacket Tracer PC Command Line
31、1.0PCPCping 10.20.66.10Pinging 10.20.66.10 with 32 bytes of data:Reply from 10.20.66.10: bytes=32 time=188ms TTL=125Reply from 10.20.66.10: bytes=32 time=172ms TTL=125Reply from 10.20.66.10: bytes=32 time=187ms TTL=125Reply from 10.20.66.10: bytes=32 time=187ms TTL=125Ping statistics for 10.20.66.10
32、: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),Approximate round trip times in milli-seconds: Minimum = 172ms, Maximum = 188ms, Average = 183ms配dns之前，ping teacher 的ip地址，但ping不了域名；配dns之后，ip地址和域名都可以ping通。Teacher的域名，服务器的域名，student的域名。PCping Pinging 10.20.66.10 with 32 bytes of data:Reply from 10
33、.20.66.10: bytes=32 time=156ms TTL=125Reply from 10.20.66.10: bytes=32 time=159ms TTL=125Reply from 10.20.66.10: bytes=32 time=172ms TTL=125Reply from 10.20.66.10: bytes=32 time=156ms TTL=125Ping statistics for 10.20.66.10: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),Approximate round trip t
34、imes in milli-seconds: Minimum = 156ms, Maximum = 172ms, Average = 160msPCping Pinging 10.20.168.7 with 32 bytes of data:Reply from 10.20.168.7: bytes=32 time=157ms TTL=126Reply from 10.20.168.7: bytes=32 time=156ms TTL=126Reply from 10.20.168.7: bytes=32 time=141ms TTL=126Reply from 10.20.168.7: by
35、tes=32 time=125ms TTL=126Ping statistics for 10.20.168.7: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),Approximate round trip times in milli-seconds: Minimum = 125ms, Maximum = 157ms, Average = 144ms在student上测试www服务。在student机的桌面，在WEB浏览器的地址栏里输入http:/10.20.168.7/显示网页内容：Cisco Packet TracerWelcom
36、e to njupt film site. you can download films. Quick Links: A small page Copyrights Image page Image在student机的桌面，在WEB浏览器的地址栏里输入teacher 的pc机测试结果如下：PCping 10.20.168.7Pinging 10.20.168.7 with 32 bytes of data:Request timed out.Reply from 10.20.168.7: bytes=32 time=143ms TTL=126Reply from 10.20.168.7: by
37、tes=32 time=140ms TTL=126Reply from 10.20.168.7: bytes=32 time=127ms TTL=126Ping statistics for 10.20.168.7: Packets: Sent = 4, Received = 3, Lost = 1 (25% loss),Approximate round trip times in milli-seconds:Minimum = 127ms, Maximum = 143ms, Average = 136ms在R1上配ACL。R1(config)#access-list 101 deny tc
38、p 10.20.170.0 0.0.0.255 host 10.20.168.7 eq 21R1(config)#access-list 101 deny tcp 10.20.170.0 0.0.0.255 host 10.20.168.7 eq 20R1(config)#access-list 101 permit ip 10.20.170.0 0.0.0.255 any R1(config)#int f0/0R1(config-if)#ip access-group 101 inR1#sh access-listsExtended IP access list 101 deny tcp 1
39、0.20.170.0 0.0.0.255 host 10.20.168.7 eq ftp deny tcp 10.20.170.0 0.0.0.255 host 10.20.168.7 eq 20 permit ip 10.20.170.0 0.0.0.255 any R1#sh runBuilding configuration.Current configuration : 2004 bytes!version 12.4no service timestamps log datetime msecno service timestamps debug datetime msecno ser
40、vice password-encryption!hostname R1!interface FastEthernet0/0 ip address 10.20.170.1 255.255.255.0 ip access-group 101 in duplex auto speed autoStudent上配好acl后，再测Student能否访问服务器的ftp服务和www服务。PCftp Trying to %Error opening ftp:/ (Timed out).Packet Tracer PC Command Line 1.0PC(Disconnecting from ftp ser
41、ver)PCftp 10.20.168.7Trying to connect.10.20.168.7%Error opening ftp:/10.20.168.7/ (Timed out).Packet Tracer PC Command Line 1.0PC(Disconnecting from ftp server)Packet Tracer PC Command Line 1.0说明student机已不能访问服务器的ftp服务了。二 高级ACL扩展ACL的应用1.防止地址欺骗。R1是内网的边界路由器，R2是外网的边界路由器。外部网络的用户可能会伪装自己的ip地址，比如使用内部网的合法IP
42、地址或者回环地址作为源地址，从而实现非法访问。解决办法：将可能伪装到的ip地址拒绝掉。Router(config)#host R1R1(config)#int s0/0/1R1(config-if)#ip add 201.100.11.1 255.255.255.0R1(config-if)#clock rate 64000R1(config-if)#no shutR1(config)#int f0/0R1(config-if)#ip add 192.5.5.2 255.255.255.0R1(config-if)#no shutR1(config)#router eigrp 100R1(co
43、nfig-router)#net 201.100.11.0*May 10 11:29:29.374: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 100: Neighbor 201.100.11.2(Serial0/0/1) is up: new adjacencyR1(config-router)#net 192.5.5.0R1(config-router)#no auto/*May 10 11:29:57.010: IP-EIGRP(Default-IP-Routing-Table:100): Neighbor 192.168.1.1 not on common subn
44、et for FastEthernet0/0R1(config-router)#*May 10 11:30:00.666: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 100: Neighbor 201.100.11.2(Serial0/0/1) is resync: summary configuredR1(config-router)#*May 10 11:30:00.666: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 100: Neighbor 201.100.11.2(Serial0/0/1) is resync: summary configured*May 10 11:30:10.942: IP-EIGRP(Default-IP-Routing-Table:100): Neighbor 192.168.1.1 not on common subnet for FastEtherne
