IP访问控制列表

    R2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R2(config)#access-list 1 deny 30.1.1.0 0.0.0.255
R2(config)#access-Ust 1 permit any
R2(config)#int s0
R2(config-if)#ip access-group 1 in
R2(config-if)#^Z
R2#sh
14:34:20: %SYS-5-CONFIG_1: Configured from console by console
R2#sh ip access-list 1
Standard IP access list 1
　deny 30.1.1.0,wukdcard buts 0.0.0.255 check=2
　permit any(2 matches)
R2#sh ip int s0
Serial0 is up, line protocol is up
　Internet address is 20.1.1.2/24
　Broadcast address is 255.255.255.255
　Address determined by setup command
　MTU is 1500 bytes
　Helper address is not set
　Directed broadcast forwarding is disabled
　Multicast reserved groups joined: 224.0.0.9
　Outgoing access list is not set
　Inbound access list is 1
　Proxy ARP is enabled
　Security level is default
　... (输出省略)
R2#clear access-list counters
R2#sh ip access-1 1
Standard IP access list 1
　deny30.1 .IA wildcard bits 0.0.0.255
　permit any
R2#
Term_Server#3
[Resuming connection 3 to R3 ... ]
R3#ping 10.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echosto 10.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5). round-tri/min/avg/max=:32/37/48 ms
R3#ping
Protocol [ip]:
Target IP address: 10.1.1.1
Repeat count [5]:
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface: 30.1.1.3
Type of service [0]:
Set DF bit in IP header? [no]:
Validate reply data? [no]:
Data pattern [0xABCD]:
Loose, Strict, Record, Timestamp, Verbose[none]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 5,100-byte ICMP Echos to 10.1.1.1,timeout is 2 seconds:
U.U.U
Success rate is 0 percent (0/5)
R3#^Z
Term_Server#2
[Resuming connection 3 to R2 ... ]
R2#sh ip access-1 1
Standard IP access list 1
　deny 30.1.1.0, wildcard bits 0.0.0.255 (5 matches) checks 15
　permit any (5 matches)

    R2#conft
Enter configuration commands, one per line. End with CNTL/Z.
R2(config)#access-list 101 deny 
icmp 20.1.1.0 0.0.0.255 10.1.1.0 0.0.0.255 echo
R2(config)#access-list 101 permit ip any any
R2(config)#int e0
R2(config-if)#ip access-g 101 out
R2(config-if)#int s0
R2(config-if)#no ipaccess-g 1 in
R2(config-if)#^Z
R2#
R2#sh ip access-list
Standard IP access list 1
　deny 30.1.1.0, wildcard bits 0.0.0.255 (8 matches) check=20
　permit any (20 matches)
　permit ip any any 
R2#
Term_Server#3
[Resuming connection 3 to R3 ...]
R3#ping 10.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:
U.U.U
Success rate is 0 percent(0/5)
R3#telnet 10.1.1.1
Trying 10.1.1.1... Open
User Access Verification
Password:(键入 cisco1 )
R1>en
Password:(键入 cisco )
R1#
R1#exit
[Connection to 10.1.1.1 closed by foreign host]
R3#
Term_Server#2
[Resuming connection 2 to R2 ... ]
R2#sh ip access-list 101
Extended IP access list 101
　deny icmp 20.1.1.0 0.0.0.255 10.1.1.0.0.0.0.255 echo(8 matches)
　permit ip any any (40 matches)
R2#