擴充套件IP訪問控制列表
擴充套件IP訪問控制列表配置
技術原理：
訪問控制列表定義的典型規則主要有以下：源地址、目標地址、上層協議、時間區域；
擴充套件IP訪問列表（編號100-199、2000-2699）使用以上四種組合來進行轉發或者阻斷分組；可以根據資料包的源IP、目的IP、原埠、目的埠、協議來定義規則，進行資料包的過濾。
擴充套件IP訪問列表的配置包括以下兩個部分：
定義擴充套件IP訪問列表
將擴充套件IP訪問列表應用於特定介面上
實驗步驟：
建立拓撲：
1.路由器與路由器之間通過v.35電纜串列埠連線，DCE端連線在R2上，配置其時鐘頻率64000；主機與路由器通過交叉線連線；
2.配置PC機、伺服器及路由器介面IP地址
3.在路由器上配置靜態路由協議，讓
4.在R2上配置編號的ip擴充套件訪問控制列表
5.將擴充套件IP訪問列表應用到介面上。
6.驗證主機之間的互通性
實驗裝置：
Pc一臺；server-PT1臺；Router-PT3臺；交叉線；DCE串列埠線
R0配置：
Router>en
Router#config t
Enter configuration commands, one perline. End with CNTL/Z.
Router(config)#host R0
R0(config)#int fa0/0
R0(config-if)#ip address 172.16.1.1255.255.255.0
R0(config-if)#no shut
%LINK-5-CHANGED: Interface FastEthernet0/0,changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on InterfaceFastEthernet0/0, changed state to up
R0(config-if)#exit
R0(config)#int fa1/0
R0(config-if)#ip address 172.16.2.1255.255.255.0
R0(config-if)#no shut
R0(config-if)#
%LINK-5-CHANGED: Interface FastEthernet1/0,changed state to up
exit
R0(config)#
R1配置：
Router>en
Router#config t
Enter configuration commands, one perline. End with CNTL/Z.
Router(config)#host R1
R1(config)#int fa1/0
R1(config-if)#ip address 172.16.2.2255.255.255.0
R1(config-if)#no shut
%LINK-5-CHANGED: Interface FastEthernet1/0,changed state to up
%LINEPROTO-5-UPDOWN: Line protocol onInterface FastEthernet1/0, changed state to up
R1(config-if)#exit
R1(config)#int se2/0
R1(config-if)#ip address 172.16.3.1255.255.255.0
R1(config-if)#clock rate 64000
R1(config-if)#no shut
%LINK-5-CHANGED: Interface Serial2/0,changed state to down
R1(config-if)#exit
R1(config)#
R2配置：
Router>en
Router#config t
Enter configuration commands, one perline. End with CNTL/Z.
Router(config)#host R2
R2(config)#int se2/0
R2(config-if)#ip address 172.16.3.2255.255.255.0
R2(config-if)#no shut
%LINK-5-CHANGED: Interface Serial2/0,changed state to up
R2(config-if)#exit
R2(config)#int fa0/0
%LINEPROTO-5-UPDOWN: Line protocol onInterface Serial2/0, changed state to up
R2(config-if)#ip address 172.16.4.1255.255.255.0
R2(config-if)#no shut
%LINK-5-CHANGED: Interface FastEthernet0/0,changed state to up
%LINEPROTO-5-UPDOWN: Line protocol onInterface FastEthernet0/0, changed state to up
R2(config-if)#exit
在R0上配置靜態路由：
R0(config)#ip route 0.0.0.0 0.0.0.0172.16.2.2
在R2上配置靜態路由：
R2(config)#ip route 0.0.0.0 0.0.0.0172.16.3.1
在R1上配置靜態路由：
R1(config)#ip route 172.16.1.0255.255.255.0 172.16.2.1
R1(config)#ip route 172.16.4.0255.255.255.0 172.16.3.2
測試連通性：
PC>ping 172.16.4.2
Pinging 172.16.4.2 with 32 bytes of data:
Reply from 172.16.4.2: bytes=32 time=80msTTL=125
Reply from 172.16.4.2: bytes=32 time=80msTTL=125
Reply from 172.16.4.2: bytes=32 time=80msTTL=125
Reply from 172.16.4.2: bytes=32 time=80msTTL=125
Ping statistics for 172.16.4.2:
Packets: Sent = 4, Received = 4, Lost = 0(0% loss),
Approximate round trip times inmilli-seconds:
Minimum = 80ms,Maximum = 80ms, Average = 80ms
Web測試：
配置控制列表：
R1(config)#access-list 100 permit tcp host172.16.1.2 host 172.16.4.2 eq www
R1(config)#access-list 100 deny icmp host172.16.1.2 host 172.16.4.2 echo
R1(config)#int se2/0
R1(config-if)#ip access-group 100 out
R1(config-if)#exit
測試：
PC>ping 172.16.4.2
Pinging 172.16.4.2 with 32 bytes of data:
Reply from 172.16.2.2: Destination hostunreachable.
Reply from 172.16.2.2: Destination hostunreachable.
Reply from 172.16.2.2: Destination hostunreachable.
Reply from 172.16.2.2: Destination hostunreachable.
Ping statistics for 172.16.4.2:
Packets: Sent =4, Received = 0, Lost = 4 (100% loss),
Web測試：
