第10章 路由器的高级配置.ppt

Slide 1 of 2 Purpose: The access-list command creates an entry in complex traffic filter list. Emphasize: The access-list field descriptions: list—a number between 100 and 199 protocol—ip, tcp, udp, icmp, igrp, eigrp, ospf and etc……. ip = any internet protocol (see note below) source—ip address source-mask—wildcard-mask of address bits that must match. 0s indicate bits that must match, 1s are dont care. destination—ip address destination-mask—wildcard-mask operator—lt, gt, eq, neq operand—a port number or application name (i.e. “23” or “telnet”) established-only allow established tcp session coming in (ack or rst bit must be set) log-generates a console message when a packet matches the access-list statement Note: If the protocol number is not listed, you may enter the protocol number between 1-255. Slide 2 of 2 Purpose: Layer 2—Adds the access-group command for IP. Emphasize: The list number must match the number (100 to 199) you specified in the access-list command. Slide 1 of 3 Purpose: This 3 layers slide shows an example of an extended IP access list. Emphasize: Slide 2 of 3 Purpose: Emphasize:. Don’t forget to include the permit statement to permit all other IP traffic out on E0. Slide 3 of 3 Purpose: Emphasize: Slide 1 of 3 Purpose: This slide gives another example of an extended IP access list configuration. Emphasize: Notice this example of an IP extended access list specifies a source subnet address and any destination address. Slide 2 of 3 Purpose: Emphasize: Don’t forget to include the permit statement to permit all other IP traffic out on E0. Slide 3 of 3 Purpose: Emphasize: Slide 1 of 1 Purpose: This slide shows how to verify an access list. Emphasize: Lists IP interface information. Indicates whether outgoing access list is set. Review the output of the show ip interface command. The highlighted text shows details about access list settings in the show command output. Slide 1 of 1 Purp