CCNA教材.ppt

《CCNA教材.ppt》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

1、©2004CiscoSystems,Inc.Allrightsreserved.ICNDv2.2—4-1ManagingIPTrafficwithACLsIntroducingACLsOutlineOverviewACLOverviewACL概述ACLApplicationsACL应用TypesofACLsACL的类型ACLOperationsACL操作ACLStatementProcessingACL状态WildcardMaskingProcess通配符匹配流程SummaryManageIPtrafficasnetworka

2、ccessgrows控制数据流量Filterpacketsastheypassthroughtherouter筛选通过路由器的数据包WhyUseACLs?Permitordenypacketsmovingthroughtherouter.允许或拒绝通过路由器的数据包Permitordenyvtyaccesstoorfromtherouter.允许或拒绝到路由器的vty访问WithoutACLs,allpacketscouldbetransmittedontoallpartsofyournetwork.如果不使用ACL，数据包可

3、以到达网络上的任何部分ACLApplicationsSpecialhandlingfortrafficbasedonpackettests某些控制流量的功能通过测试包来实现OtherACLUsesStandardCheckssourceaddress检查源地址Generallypermitsordeniesentireprotocolsuite允许或拒绝整个协议栈ExtendedCheckssourceanddestinationaddress检查源和目标地址Generallypermitsordeniesspecificpr

4、otocols允许或拒绝指定的协议TypesofACLsHowtoIdentifyACLsStandardIPlists(1-99)testconditionsofallIPpacketsfromsourceaddresses.标准IPlist检查所有包的源地址ExtendedIPlists(100-199)testconditionsofsourceanddestinationaddresses,specificTCP/IPprotocols,anddestinationports.扩展的IPlist检查源和目标地址,指定

5、的协议和目标端口StandardIPlists(1300-1999)(expandedrange).ExtendedIPlists(2000-2699)(expandedrange).OtherACLnumberrangestestconditionsforothernetworkingprotocols.NamedACLsidentifyIPstandardandextendedACLswithanalphanumericstring(name).可以用命名ACL来使用标准或扩展ACLTestingPacketswithS

6、tandardACLsIPDatagramHeaderTCPHeaderTestingPacketswithExtendedACLsOutboundACLOperationIfnoACLstatementmatches,thendiscardthepacket.如果没有ACL匹配,那么数据包将被丢弃AListofTests:DenyorPermit0meanscheckvalueofcorrespondingaddressbit.0意味着检测相应的bit1meansignorevalueofcorrespondingaddr

7、essbit.1意味着忽略相应的bitWildcardBits:HowtoChecktheCorrespondingAddressBits172.30.16.290.0.0.0checksalltheaddressbits.AbbreviatethiswildcardmaskusingtheIPaddressprecededbythekeywordhost(host172.30.16.29).Checkalltheaddressbits(matchall).检测所有的地址位VerifyanIPhostaddress,forex

8、ample:指定一个主机地址，如下:WildcardBitstoMatchaSpecificIPHostAddress通配符匹配指定主机Testconditions:Ignorealltheaddressbits(matchany).忽略所有地址位Anyhostaddress