ensp基本ACL和高级ACL配置

先搭建拓扑并实现全网互通

路由器AR1配置命令如下：

system-view
sysname AR1
interface GigabitEthernet 0/0/0
ip address 10.148.12.1 24
quit
interface GigabitEthernet 0/0/1
ip address 10.148.10.254 24
quit
interface GigabitEthernet 0/0/2
ip address 10.148.20.254 24
quit
int loopback 0
ip address 1.1.1.1 32
quit

ospf 1 router-id 1.1.1.1
area 0
network 10.148.12.1 0.0.0.0
network 1.1.1.1 0.0.0.0
network 10.148.10.254 0.0.0.0
network 10.148.20.254 0.0.0.0

路由器AR2配置命令如下：

system-view
sysname AR2
interface GigabitEthernet 0/0/0
ip address 10.148.12.2 24
quit
interface GigabitEthernet 0/0/1
ip address 10.148.23.2 24
quit
interface GigabitEthernet 0/0/2
ip address 10.148.30.254 24
quit
int loopback 0
ip address 2.2.2.2 32
quit

ospf 1 router-id 2.2.2.2
area 0
network 10.148.12.2 0.0.0.0
network 10.148.23.2 0.0.0.0
network 2.2.2.2 0.0.0.0
network 10.148.30.254 0.0.0.0

路由器AR3配置命令如下：

system-view
sysname AR3
undo info en
interface GigabitEthernet 0/0/1
ip address 10.148.23.3 24
quit
int loopback 0
ip address 3.3.3.3 32
quit

ospf 1 router-id 3.3.3.3
area 0
network 10.148.23.3 0.0.0.0
network 3.3.3.3 0.0.0.0

测试网络是否互通

接下来配置基本的ACL配置

以路由器AR2为例配置以下命令：

acl 2000
rule deny source 10.148.10.0 0.0.0.255      //禁止10.148.10.0网段通过
rule permit source any                                 //允许剩余的其他网络通过
quit
interface GigabitEthernet 0/0/2
traffic-filter outbound acl 2000

测试

可以看到PC1无法通过AR2的0/0/2接口到达PC3但是PC2可以

接下来配置高级ACL命令

以路由器AR1为例配置以下命令：

acl 3000
rule deny ip source 10.148.20.0 0.0.0.255 destination

10.148.30.0 0.0.0.255
quit
interface GigabitEthernet 0/0/2
traffic-filter inbound acl 3000

测试

经过测试可以看到PC2无法到达10.148.30.0网段了