Вы находитесь на странице: 1из 34

ACL CONFIGURATION

REFERENCES

 https://en.wikipedia.org/wiki/Computer_network
 https://www.digitalocean.com/community/tutorials/an-introduction-to-networking-
terminology-interfaces-and-protocols
 https://www.ccnablog.com/acls-access-control-lists-part-i/
 https://www.udemy.com/cisco-packet-tracer-network-simulator/
 http://mucins.weebly.com/22-topology.html
 https://www.computernetworkingnotes.com/ccna-study-guide/cabling-cisco-devices-
guide.html
 http://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c/scfacls
.html, date of extraction: 12 August 2015.
 https://www.computernetworkingnotes.com/ccna-study-guide/access-control-list-explained-
with-examples.html

DVR & Dr.HS MIC College Of Technology Page 39


ACL CONFIGURATION

ANNEXURE-A
IN Router 0:

Router>en

Router#conf t

Router(config)#no ip domain-lookup

Router(config)#hostname Router0

Router0(config)#service password-encryption

Router0(config)#enable secret class

Router0(config)#line console 0

Router0(config-line)#password cisco

Router0(config-line)#login

Router0(config-line)#logging synchronous

Router0(config-line)#exit

Router0(config)#line vty 0 4

Router0(config-line)#password cisco

Router0(config-line)#login

Router0(config-line)#exit

Router0(config)#banner motd $ UnAuthorized Access Is Prohibited $

Router0(config)#int g0/0

Router0(config-if)#ip address 192.168.1.225 255.255.255.240

Router0(config-if)#no shutdown

Router0(config-if)#int g0/1

Router0(config-if)#ip address 192.168.1.193 255.255.255.224

Router0(config-if)#no shutdown

Router0(config-if)#int s0/1/0

Router0(config-if)#ip address 192.168.1.241 255.255.255.252

DVR & Dr.HS MIC College Of Technology Page 40


ACL CONFIGURATION

Router0(config-if)#no shutdown

Router0(config-if)#router rip

Router0(config-router)#version 2

Router0(config-router)#network 192.168.1.0

Router0(config-router)#exit

Router0(config)#ip access-list standard 2

Router0(config-std-nacl)#deny host 192.168.1.226

Router0(config-std-nacl)#deny host 192.168.1.227

Router0(config-std-nacl)#exit

Router0(config)#do sh ip access-list

Router0(config)#int g0/0

Router0(config-if)#ip access-group 2 IN

Router0(config-if)#exit

Router0(config)#ip access-list standard 4

Router0(config-std-nacl)#deny host 192.168.1.194

Router0(config-std-nacl)#deny host 192.168.1.195

Router0(config-std-nacl)#exit

Router0(config)#int g0/0

Router0(config-if)#ip access-group 4 OUT

Router0(config-if)#exit

Router0(config)#do sh ip access-list

Router0(config)#exit

Router0#copy running-config startup-config

DVR & Dr.HS MIC College Of Technology Page 41


ACL CONFIGURATION

IN Router 1:

Router>en

Router#conf t

Router(config)#no ip domain-lookup

Router(config)#hostname Router1

Router1(config)#service password-encryption

Router1(config)#enable secret class

Router1(config)#line console 0

Router1(config-line)#password cisco

Router1(config-line)#login

Router1(config-line)#logging synchronous

Router1(config-line)#exit

Router1(config)#line vty 0 4

Router1(config-line)#password cisco

Router1(config-line)#login

Router1(config-line)#exit

Router1(config)#banner motd $ UnAuthorized Access Is Prohibited $

Router1(config)#int g0/0

Router1(config-if)#ip address 192.168.1.129 255.255.255.192

Router1(config-if)#no shutdown
DVR & Dr.HS MIC College Of Technology Page 42
ACL CONFIGURATION

Router1(config-if)#int g0/1

Router1(config-if)#ip address 192.168.1.1 255.255.255.128

Router1(config-if)#no shutdown

Router1(config-if)#int s0/1/0

Router1(config-if)#ip address 192.168.1.242 255.255.255.252

Router1(config-if)#no shutdown

Router1(config-if)#router rip

Router1(config-router)#version 2

Router1(config-router)#network 192.168.1.0

Router1(config-router)#exit

Router1(config)#ip access-list standard 1

Router1(config-std-nacl)#deny host 192.168.1.131

Router1(config-std-nacl)#deny host 192.168.1.2

Router1(config-std-nacl)#deny host 192.168.1.3

Router1(config-std-nacl)#permit host 192.168.1.130

Router1(config-std-nacl)#exit

Router1(config)#int s0/1/0

Router1(config-if)#ip access-group 1 OUT

Router1(config-if)#exit

DVR & Dr.HS MIC College Of Technology Page 43


ACL CONFIGURATION

Router1(config)#do sh ip access-list

Router1(config)#ip access-list standard 3

Router1(config-std-nacl)#deny host 192.168.1.2

Router1(config-std-nacl)#deny host 192.168.1.3

Router1(config-std-nacl)#exit

Router1(config)#int g0/1

Router1(config-if)#ip access-group 3 IN

Router1(config-if)#exit

Router1(config)#do sh ip access-list

Router1(config)#exit

Router1#copy running-config startup-config

----------------------------------------------------

IN Switch 0:

Switch>en

Switch#conf t

Switch(config)#no ip domain-lookup

Switch(config)#hostname Switch0

Switch0(config)#service password-encryption

Switch0(config)#enable secret class

Switch0(config)#line console 0

Switch0(config-line)#password cisco

Switch0(config-line)#login

DVR & Dr.HS MIC College Of Technology Page 44


ACL CONFIGURATION

Switch0(config-line)#logging synchronous

Switch0(config-line)#exit

Switch0(config)#line vty 0 4

Switch0(config-line)#password cisco

Switch0(config-line)#login

Switch0(config-line)#exit

Switch0(config)#banner motd $ UnAuthorized Access Is Prohibited $

Switch0(config)#exit

Switch0#copy running-config startup-config

---------------------------------------------------

IN Switch 1:

Switch>en

Switch#conf t

Switch(config)#no ip domain-lookup

Switch(config)#hostname Switch1

Switch1(config)#service password-encryption

Switch1(config)#enable secret class

Switch1(config)#line console 0

Switch1(config-line)#password cisco

Switch1(config-line)#login

Switch1(config-line)#logging synchronous

Switch1(config-line)#exit

Switch1(config)#line vty 0 4

Switch1(config-line)#password cisco

Switch1(config-line)#login

Switch1(config-line)#exit

DVR & Dr.HS MIC College Of Technology Page 45


ACL CONFIGURATION

Switch1(config)#banner motd $ UnAuthorized Access Is Prohibited $

Switch1(config)#exit

Switch1#copy running-config startup-config

---------------------------------------------------

IN SW 2:

Switch>en

Switch#conf t

Switch(config)#no ip domain-lookup

Switch(config)#hostname Switch2

Switch2(config)#service password-encryption

Switch2(config)#enable secret class

Switch2(config)#line console 0

Switch2(config-line)#password cisco

Switch2(config-line)#login

Switch2(config-line)#logging synchronous

Switch2(config-line)#exit

Switch2(config)#line vty 0 4

Switch2(config-line)#password cisco

Switch2(config-line)#login

Switch2(config-line)#exit

Switch2(config)#banner motd $ UnAuthorized Access Is Prohibited $

Switch2(config)#exit

Switch2#copy running-config startup-config

DVR & Dr.HS MIC College Of Technology Page 46


ACL CONFIGURATION

IN SW 3:

Switch>en

Switch#conf t

Enter configuration commands, one per line. End with CNTL/Z.

Switch(config)#no ip domain-lookup

Switch(config)#hostname Switch3

Switch3(config)#service password-encryption

Switch3(config)#enable secret class

Switch3(config)#line console 0

Switch3(config-line)#password cisco

Switch3(config-line)#login

Switch3(config-line)#logging synchronous

Switch3(config-line)#exit

Switch3(config)#line vty 0 4

Switch3(config-line)#password cisco

Switch3(config-line)#login

Switch3(config-line)#exit

Switch3(config)#banner motd $ UnAuthorized Access Is Prohibited $

Switch3(config)#exit

Switch3#copy running-config startup-config

----------------------------------------------------

DVR & Dr.HS MIC College Of Technology Page 47


ACL CONFIGURATION

ANNEXURE-B

IN Switch 0:

Switch0#sh running-config

Building configuration...

Current configuration : 1273 bytes

version 12.2

no service timestamps log datetime msec

no service timestamps debug datetime msec

service password-encryption

hostname Switch0

enable secret 5 $1$mERr$9cTjUIEqNGurQiFU.ZeCi1

no ip domain-lookup

spanning-tree mode pvst

DVR & Dr.HS MIC College Of Technology Page 48


ACL CONFIGURATION

spanning-tree extend system-id

interface FastEthernet0/1

interface FastEthernet0/2

interface FastEthernet0/3

interface FastEthernet0/4

interface FastEthernet0/5

interface FastEthernet0/6

interface FastEthernet0/7

interface FastEthernet0/8

interface FastEthernet0/9

interface FastEthernet0/10

interface FastEthernet0/11

interface FastEthernet0/12

DVR & Dr.HS MIC College Of Technology Page 49


ACL CONFIGURATION

interface FastEthernet0/13

interface FastEthernet0/14

interface FastEthernet0/15

interface FastEthernet0/16

interface FastEthernet0/17

interface FastEthernet0/18

interface FastEthernet0/19

interface FastEthernet0/20

interface FastEthernet0/21

interface FastEthernet0/22

interface FastEthernet0/23

interface FastEthernet0/24

DVR & Dr.HS MIC College Of Technology Page 50


ACL CONFIGURATION

interface GigabitEthernet0/1

interface GigabitEthernet0/2

interface Vlan1

no ip address

shutdown

banner motd ^C UnAuthorized Access Is Prohibited ^C

line con 0

password 7 0822455D0A16

logging synchronous

login

line vty 0 4

password 7 0822455D0A16

login

line vty 5 15

login

DVR & Dr.HS MIC College Of Technology Page 51


ACL CONFIGURATION

end

-------------------------------------------------------

IN Switch 1:

Switch1#sh running-config

Building configuration...

Current configuration : 1273 bytes

version 12.2

no service timestamps log datetime msec

no service timestamps debug datetime msec

service password-encryption

hostname Switch1

enable secret 5 $1$mERr$9cTjUIEqNGurQiFU.ZeCi1

no ip domain-lookup

spanning-tree mode pvst

DVR & Dr.HS MIC College Of Technology Page 52


ACL CONFIGURATION

spanning-tree extend system-id

interface FastEthernet0/1

interface FastEthernet0/2

interface FastEthernet0/3

interface FastEthernet0/4

interface FastEthernet0/5

interface FastEthernet0/6

interface FastEthernet0/7

interface FastEthernet0/8

interface FastEthernet0/9

interface FastEthernet0/10

interface FastEthernet0/11

interface FastEthernet0/12

DVR & Dr.HS MIC College Of Technology Page 53


ACL CONFIGURATION

interface FastEthernet0/13

interface FastEthernet0/14

interface FastEthernet0/15

interface FastEthernet0/16

interface FastEthernet0/17

interface FastEthernet0/18

interface FastEthernet0/19

interface FastEthernet0/20

interface FastEthernet0/21

interface FastEthernet0/22

interface FastEthernet0/23

interface FastEthernet0/24

DVR & Dr.HS MIC College Of Technology Page 54


ACL CONFIGURATION

interface GigabitEthernet0/1

interface GigabitEthernet0/2

interface Vlan1

no ip address

shutdown

banner motd ^C UnAuthorized Access Is Prohibited ^C

line con 0

password 7 0822455D0A16

logging synchronous

login

line vty 0 4

password 7 0822455D0A16

login

line vty 5 15

login

DVR & Dr.HS MIC College Of Technology Page 55


ACL CONFIGURATION

end

-------------------------------------------------------

IN Switch 2:

Switch2#sh running-config

Building configuration...

Current configuration : 1273 bytes

version 12.2

no service timestamps log datetime msec

no service timestamps debug datetime msec

service password-encryption

hostname Switch2

enable secret 5 $1$mERr$9cTjUIEqNGurQiFU.ZeCi1

no ip domain-lookup

spanning-tree mode pvst

DVR & Dr.HS MIC College Of Technology Page 56


ACL CONFIGURATION

spanning-tree extend system-id

interface FastEthernet0/1

interface FastEthernet0/2

interface FastEthernet0/3

interface FastEthernet0/4

interface FastEthernet0/5

interface FastEthernet0/6

interface FastEthernet0/7

interface FastEthernet0/8

interface FastEthernet0/9

interface FastEthernet0/10

interface FastEthernet0/11

interface FastEthernet0/12

DVR & Dr.HS MIC College Of Technology Page 57


ACL CONFIGURATION

interface FastEthernet0/13

interface FastEthernet0/14

interface FastEthernet0/15

interface FastEthernet0/16

interface FastEthernet0/17

interface FastEthernet0/18

interface FastEthernet0/19

interface FastEthernet0/20

interface FastEthernet0/21

interface FastEthernet0/22

interface FastEthernet0/23

interface FastEthernet0/24

DVR & Dr.HS MIC College Of Technology Page 58


ACL CONFIGURATION

interface GigabitEthernet0/1

interface GigabitEthernet0/2

interface Vlan1

no ip address

shutdown

banner motd ^C UnAuthorized Access Is Prohibited ^C

line con 0

password 7 0822455D0A16

logging synchronous

login

line vty 0 4

password 7 0822455D0A16

login

line vty 5 15

login

DVR & Dr.HS MIC College Of Technology Page 59


ACL CONFIGURATION

end

-------------------------------------------------------

IN Switch 3:

Switch3#sh running-config

Building configuration...

Current configuration : 1273 bytes

version 12.2

no service timestamps log datetime msec

no service timestamps debug datetime msec

service password-encryption

hostname Switch3

enable secret 5 $1$mERr$9cTjUIEqNGurQiFU.ZeCi1

no ip domain-lookup

spanning-tree mode pvst

DVR & Dr.HS MIC College Of Technology Page 60


ACL CONFIGURATION

spanning-tree extend system-id

interface FastEthernet0/1

interface FastEthernet0/2

interface FastEthernet0/3

interface FastEthernet0/4

interface FastEthernet0/5

interface FastEthernet0/6

interface FastEthernet0/7

interface FastEthernet0/8

interface FastEthernet0/9

interface FastEthernet0/10

interface FastEthernet0/11

interface FastEthernet0/12

DVR & Dr.HS MIC College Of Technology Page 61


ACL CONFIGURATION

interface FastEthernet0/13

interface FastEthernet0/14

interface FastEthernet0/15

interface FastEthernet0/16

interface FastEthernet0/17

interface FastEthernet0/18

interface FastEthernet0/19

interface FastEthernet0/20

interface FastEthernet0/21

interface FastEthernet0/22

interface FastEthernet0/23

interface FastEthernet0/24

DVR & Dr.HS MIC College Of Technology Page 62


ACL CONFIGURATION

interface GigabitEthernet0/1

interface GigabitEthernet0/2

interface Vlan1

no ip address

shutdown

banner motd ^C UnAuthorized Access Is Prohibited ^C

line con 0

password 7 0822455D0A16

logging synchronous

login

line vty 0 4

password 7 0822455D0A16

login

line vty 5 15

login

DVR & Dr.HS MIC College Of Technology Page 63


ACL CONFIGURATION

end

-------------------------------------------------------

IN Router 0:

Router0#sh running-config

Building configuration...

Current configuration : 1239 bytes

version 15.1

no service timestamps log datetime msec

no service timestamps debug datetime msec

service password-encryption

hostname Router0

enable secret 5 $1$mERr$9cTjUIEqNGurQiFU.ZeCi1

DVR & Dr.HS MIC College Of Technology Page 64


ACL CONFIGURATION

no ip cef

no ipv6 cef

license udi pid CISCO1941/K9 sn FTX1524807Q-

no ip domain-lookup

spanning-tree mode pvst

DVR & Dr.HS MIC College Of Technology Page 65


ACL CONFIGURATION

interface GigabitEthernet0/0

ip address 192.168.1.225 255.255.255.240

ip access-group 2 in

ip access-group 4 out

duplex auto

speed auto

interface GigabitEthernet0/1

ip address 192.168.1.193 255.255.255.224

duplex auto

speed auto

interface Serial0/1/0

ip address 192.168.1.241 255.255.255.252

clock rate 2000000

interface Serial0/1/1

no ip address

clock rate 2000000

shutdown

interface Vlan1

no ip address

DVR & Dr.HS MIC College Of Technology Page 66


ACL CONFIGURATION

shutdown

router rip

version 2

network 192.168.1.0

ip classless

ip flow-export version 9

access-list 2 deny host 192.168.1.226

access-list 2 deny host 192.168.1.227

access-list 4 deny host 192.168.1.194

access-list 4 deny host 192.168.1.195

banner motd ^C UnAuthorized Access Is Prohibited ^C

line con 0

password 7 0822455D0A16

logging synchronous

DVR & Dr.HS MIC College Of Technology Page 67


ACL CONFIGURATION

login

line aux 0

line vty 0 4

password 7 0822455D0A16

login

end

-------------------------------------------------------

IN Router 1:

Router1#sh running-config

Building configuration...

Current configuration : 1287 bytes

version 15.1

no service timestamps log datetime msec

no service timestamps debug datetime msec

service password-encryption

hostname Router1

DVR & Dr.HS MIC College Of Technology Page 68


ACL CONFIGURATION

enable secret 5 $1$mERr$9cTjUIEqNGurQiFU.ZeCi1

no ip cef

no ipv6 cef

license udi pid CISCO1941/K9 sn FTX152402A8-

DVR & Dr.HS MIC College Of Technology Page 69


ACL CONFIGURATION

no ip domain-lookup

spanning-tree mode pvst

interface GigabitEthernet0/0

ip address 192.168.1.129 255.255.255.192

duplex auto

speed auto

interface GigabitEthernet0/1

ip address 192.168.1.1 255.255.255.128

ip access-group 3 in

duplex auto

speed auto

interface Serial0/1/0

ip address 192.168.1.242 255.255.255.252

ip access-group 1 out

DVR & Dr.HS MIC College Of Technology Page 70


ACL CONFIGURATION

interface Serial0/1/1

no ip address

clock rate 2000000

shutdown

interface Vlan1

no ip address

shutdown

router rip

version 2

network 192.168.1.0

ip classless

ip flow-export version 9

access-list 1 deny host 192.168.1.131

access-list 1 deny host 192.168.1.2

access-list 1 deny host 192.168.1.3

access-list 1 permit host 192.168.1.130

access-list 3 deny host 192.168.1.2

access-list 3 deny host 192.168.1.3

DVR & Dr.HS MIC College Of Technology Page 71


ACL CONFIGURATION

banner motd ^C UnAuthorized Access Is Prohibited ^C

line con 0

password 7 0822455D0A16

logging synchronous

login

line aux 0

line vty 0 4

password 7 0822455D0A16

login

end

DVR & Dr.HS MIC College Of Technology Page 72