目的：Inside只能訪問Private的www流量,Private只能telnet Inside.

ACL處理流程

Inbound

Outbound

Configuration:

Inside:

interface FastEthernet1/0
ip address 1.1.1.1 255.255.255.0
duplex auto
speed auto
!??????
ip route 0.0.0.0 0.0.0.0 1.1.1.10

?

GW1:

crypto keyring cisco?
? pre-shared-key address 64.1.1.1 key cisco
!
crypto isakmp policy 10
authentication pre-share
crypto isakmp profile isaprof
?? keyring cisco
?? match identity address 64.1.1.1 255.255.255.255
!
crypto ipsec transform-set SET esp-3des esp-md5-hmac
!
crypto map cisco 10 ipsec-isakmp
set peer 64.1.1.1
set transform-set SET
set isakmp-profile isaprof
match address ***
!????
interface FastEthernet1/0
ip address 1.1.1.10 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet1/1
ip address 202.1.1.1 255.255.255.0
duplex auto
speed auto
crypto map cisco
!
ip route 0.0.0.0 0.0.0.0 202.1.1.10
!
ip access-list extended ***
permit ip 1.1.1.0 0.0.0.255 2.2.2.0 0.0.0.255

?

Internet:

interface FastEthernet1/0
ip address 202.1.1.10 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet1/1
ip address 64.1.1.10 255.255.255.0
duplex auto
speed auto

?

GW2:

crypto keyring cisco?
? pre-shared-key address 202.1.1.1 key cisco
!
crypto isakmp policy 10
authentication pre-share
crypto isakmp profile isaprof
?? keyring cisco
?? match identity address 202.1.1.1 255.255.255.255
!
crypto ipsec transform-set SET esp-3des esp-md5-hmac
!
crypto map cisco 10 ipsec-isakmp
set peer 202.1.1.1
set transform-set SET
set isakmp-profile isaprof
match address ***
!???????
interface FastEthernet1/0
ip address 64.1.1.1 255.255.255.0
duplex auto
speed auto
crypto map cisco
!
interface FastEthernet1/1
ip address 2.2.2.10 255.255.255.0
duplex auto
speed auto
!
ip route 0.0.0.0 0.0.0.0 64.1.1.10
!
ip access-list extended ***
permit ip 2.2.2.0 0.0.0.255 1.1.1.0 0.0.0.255

?

Private:

interface FastEthernet1/0
ip address 2.2.2.2 255.255.255.0
duplex auto
speed auto
!???????
ip route 0.0.0.0 0.0.0.0 2.2.2.10

增加控制:

GW1:

ip access-list extended gw1.inbound
permit udp host 64.1.1.1 eq isakmp host 202.1.1.1 eq isakmp
permit esp host 64.1.1.1 host 202.1.1.1
ip access-list extended gw1.outbound
permit esp host 202.1.1.1 host 64.1.1.1

interface FastEthernet1/1
ip access-group gw1.inbound in
ip access-group gw1.outbound out

ip access-list extended crypto.inbound
permit tcp 2.2.2.0 0.0.0.255 1.1.1.0 0.0.0.255 eq telnet
permit tcp 2.2.2.0 0.0.0.255 eq www 1.1.1.0 0.0.0.255
ip access-list extended crypto.outbound
permit tcp 1.1.1.0 0.0.0.255 2.2.2.0 0.0.0.255 eq www
permit tcp 1.1.1.0 0.0.0.255 eq telnet 2.2.2.0 0.0.0.255

crypto map cisco 10 ipsec-isakmp
set ip access-group crypto.inbound in
set ip access-group crypto.outbound out

GW2:

ip access-list extended gw2.inbound
permit udp host 202.1.1.1 eq isakmp host 64.1.1.1 eq isakmp
permit esp host 202.1.1.1 host 64.1.1.1
ip access-list extended gw2.outbound
permit esp host 64.1.1.1 host 202.1.1.1

interface FastEthernet1/0
ip access-group gw2.inbound in
ip access-group gw2.outbound out

?

ip access-list extended crypto.inbound
permit tcp 1.1.1.0 0.0.0.255 2.2.2.0 0.0.0.255 eq www
permit tcp 1.1.1.0 0.0.0.255 eq telnet 2.2.2.0 0.0.0.255
ip access-list extended crypto.outbound
permit tcp 2.2.2.0 0.0.0.255 1.1.1.0 0.0.0.255 eq telnet
permit tcp 2.2.2.0 0.0.0.255 eq www 1.1.1.0 0.0.0.255

crypto map cisco 10 ipsec-isakmp
set ip access-group crypto.inbound in
set ip access-group crypto.outbound out

只能訪問www,不能PING

只能telnet,不能PING

轉(zhuǎn)載于:https://blog.51cto.com/q3322095/992149

總結(jié)

以上是生活随笔為你收集整理的路由器的×××流量过滤的全部?jī)?nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯(cuò)，歡迎將生活随笔推薦給好友。