Cisco-ACL

ACL種類	數字範圍或名稱	差異
Number Standard	1-99,1300-1999	檢查IP或網段
Number Extended	100-199,2000-2699	檢查來源、目的、協定、服務
Named(Standard and Extended)	Name

一、Number Standard標準ACL

允許IP -192.168.0.1

Router(config)#access-list 1 permit host 192.168.0.1

拒絕IP-192.168.0.1

Router(config)#access-list 1 deny host 192.168.0.2

允許IP網段-192.168.1.0~192.168.1.255

Router(config)#access-list 1 permit 192.168.1.0 0.0.0.255

拒絕IP網段-192.168.2.0~192.168.2.127

Router(config)#access-list 1 deny 192.168.2.0 0.0.0.127

拒絕IP網段-192.168.3.0~192.168.3.63

Router(config)#access-list 1 deny 192.168.3.0 0.0.0.63

在gi0/0啟動ACL

Router(config)#int gi0/0

Router(config-if)#ip access-group 1 out

顯示ACL

Router#show access-lists

Standard IP access list 1

10 permit host 192.168.0.1

20 deny host 192.168.0.2

30 permit 192.168.0.128 0.0.0.127

40 permit 192.168.1.0 0.0.0.255

50 deny 192.168.2.0 0.0.0.127

60 deny 192.168.3.0 0.0.0.63

允許IP網段-192.168.0.0~192.168.255.255可以VTY(Telnet)至Router

Router(config)#access-list 10 permit 192.168.0.0 0.0.255.255

Router(config)#line vty 0 15

Router(config-line)#access-class 10 in

二、Number Extended延伸ACL

允許192.168.0.1使用IP Protocol連至任一網路位址

Router(config)#access-list 100 permit ip host 192.168.0.1 any

拒絕任一網路位址使用80 Port連線至192.168.0.1

Router(config)#access-list 100 deny tcp any host 192.168.0.1 eq 80

拒絕192.168.1.0~255使用21 Port連線至192.168.2.0~255

Router(config)#access-list 100 deny tcp 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 eq 21

拒絕所有封包通過

Router(config)#access-list 100 deny ip any any

在gi0/1啟動ACL

Router(config)#int gi0/1

Router(config-if)#ip access-group 100 out

顯示ACL

Router#show access-lists

Extended IP access list 100

10 permit ip host 192.168.0.1 any

20 deny tcp any host 192.168.0.1 eq www

30 deny tcp 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 eq ftp

40 deny ip any any

三、Named 命名延伸ACL

Router(config)#ip access-list standard {<1-99>|Access-list name}

Router(config)#ip access-list standard teacher

Router(config-std-nacl)#permit 172.16.0.0 0.0.255.255

Router(config-std-nacl)#deny any

Router(config-std-nacl)#exit

Router(config)#int gi0/0

 Router(config-if)#ip access-group teacher out

Router(config-if)#^z

Router#sh ip access-lists

Standard IP access list teacher

10 permit 172.16.0.0 0.0.255.255

20 deny any

Router(config)#ip access-list extended {<100-199>|Access-list name}

Router(config)#ip access-list extended student

Router(config-ext-nacl)#permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255

Router(config-ext-nacl)#permit tcp 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 eq 80

Router(config-ext-nacl)#deny ip any any

Router(config-ext-nacl)#exit

Router(config)#int gi0/1

Router(config-if)#ip access-group student out

Router(config-ext-nacl)#^Z

Router#sh ip access-lists

Extended IP access list student

10 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255

20 permit tcp 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 eq www

30 deny ip any any