1/ IP ACL chuÈn PC1 PC2

HANOI

10.1.128.0
10.1.130.0

10.1.129.0
SAIGON
DANANG

PC3: 10.1.2.2 PC4: 10.1.2.3 PC5 PC6

Yªu cÇu:
- PC3 kh«ng ®îc phÐp truy cËp PC1 hoÆc PC2
- C¸c host ë SAIGON etherner kh«ng ®îc phÐp truy cËp tíi c¸c host ë DANANG
ethernet
- Mäi sù kÕt nèi kh¸c ®Òu ®îc phÐp

Thùc hiÖn:
CÊu h×nh ë DANANG cho danh s¸ch truy nhËp chuÈn (v× c¸c yªu cÇu ®Òu liªn
quan ®Õn DANANG):
interface serial 0/0
ip access-group 3
!
interface serial 1/0
ip access-group 3
!
interface ethernet 0/0
ip access-group 4

1
 !
access-list 3 deny host 10.1.2.1
access-list 3 permit any
!
access-list 4 deny 10.1.3.0 0.0.0.255
access-list 4 permit any

2/ Danh s¸ch truy cËp më réng

PC7 PC1 PC2 PC8

HANOI

10.1.128.0
10.1.130.0

10.1.129.0
SAIGON
DANANG

Yªu cÇu:
1. Web server (PC2) s½n sµng cho mäi ngêi sö dông.
2. NFS server (PC1), vµ c¸c UDP server kh¸c, kh«ng s½n sµng cho c¸c
host, n¬i c¸c ®Þa chØ IP (nöa ®Çu cña c¸c ®Þa chØ IP) cã hiÖu lùc ë mçi
subnet.
3. C¸c gãi gi÷a c¸c host ë DANANG Ethernet vµ SAIGON Ethernet chØ
®îc phÐp khi c¸c gãi ®îc ®Þnh tuyÕn qua mét lo¹t ®êng nèi trùc tiÕp.
4. C¸c Client PC7 vµ PC8 cã thÓ kÕt nèi tíi tÊt c¶ c¸c host trõ PC6.
5. BÊt cø kÕt nèi Client TCP tíi c¸c server ë HANOI lµ kh«ng ®îc phÐp
nÕu kh«ng cô thÓ.

2
 6. Mäi kÕt nèi kh¸c ®îc phÐp

DANANG:
interface serial 0
ip access-group 110
!
interface serial 1/0
ip access-group 111
!
access-list 110 permit TCP any host 10.1.1.2 eq www
access-list 110 deny UDP 0.0.0.128 255.255.255.127 host 10.1.1.1
access-list 110 deny IP 10.1.2.0 0.0.0.255 10.1.3.0 0.0.0.255
access-list 110 permit IP any any
!
access-list 111 permit TCP any host 10.1.1.2 eq www
access-list 1111 deny UPD 0.0.0.128 255.255.255.127 host 10.1.1.1
access-list 111 deny UDP 0.0.0.128 255.2

SAIGON:
interface serial 0/0
ip access-group 110
!
interface serial 1/0
ip access-group 111
!
access-list 110 permit TCP any host 10.1.1.2 eq www
access-list 110 deny UDP 0.0.0.128 255.255.255.127 host 10.1.1.1
access-list 110 deny IP 10.1.3.0 0.0.0.255 10.1.2.0 0.0.0.255
access-list 110 permit IP any any
!
access-list 111 permit TCP any host 10.1.1.2 eq www
access-list 111 deny UDP 0.0.0.128 255..255.255.127 host 10.1.1.1
access-list 111 permit IP any any

HANOI:
interface serial 0/0
ip access-group 112
!
interface serial 1/0
ip access-group 112
!
access-list 112 deny IP host 10.1.1.130 host 10.1.3.2
access-list 112 deny IP host 10.1.1.28 host 10.1.3.2

3
access-list 112 permit IP host 10.1.1.130 any
access-list 112 permit IP host 10.1.1.28 any
access-list 112 deny TCP 10.1.1.0 0.0.0.255 any established
access-list 112 permit IP any any