实验报告实验名称实验11访问控制列表及配置实验拓扑图如下所示：S0/0/1F0/02960PC1PC2F0/0一、对设备连线并进行子网规划和基本配置(1)R2:R2(config)#no ip domain lookupR2(config)#line console 0R2(config-line)#logging synchronousR2(config-line)#exec-timeout 0 0R2(config)#int s0/0/1R2(config-if)#ip add R2(config-if)#no shutR2(config-if)#int f0/0R2(config-if)#ip add R2(config-if)#no shut配置RIP协议R2(config)#router ripR2(config-router)#network R2(config-router)#network (2)R3：R3(config)#int s0/2/1R3(config-if)#ip add R3(config-if)#no shutR3(config-if)#exitR3(config)#int f0/0R3(config-if)#ip add R3(config-if)#no shut配置RIP协议R2(config)#router ripR2(config-router)#network R2(config-router)#network PC1 ping PC2R2#ping Success rate is 100 percent (5/5), round-trip min/avg/max = 12/15/16PC2 ping PC1R3#ping Success rate is 100 percent (5/5), round-trip min/avg/max = 12/15/16 ms二、根据拓扑图，设计标准ACL,首先使得PC1所在的网络不能通过路由器R1访问PC2所在的 网络，然后使得PC2所在的网络不能通过路由器R2访问PC1所在的网络。(1)在 R3 上配置标准 ACLR3(config)#access-list 2 deny R3(config)#access-list 2 permit anyR3(config)#int f0/0R3(config-if)#ip access-group 2 outPC1所在网络不能访问PC2所在网络(不可达)C:Documents and SettingsAdministratorping Pinging 172.16.1.2 with 32 bytes of data:Reply from 192.168.100.2: Destination net unreachable.Reply from 192.168.100.2: Destination net unreachable.Reply from 192.168.100.2: Destination net unreachable.Reply from 192.168.100.2: Destination net unreachable.Ping statistics for 172.16.1.2:Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),Approximate round trip times in milli-seconds:Minimum = 0ms, Maximum = 0ms, Average = 0msPC2 所在网络不能访问 PC1 所在网络（超时）C:Documents and SettingsAdministratorping Pinging 10.1.1.2 with 32 bytes of data:Request timed out.Request timed out.Request timed out.Request timed out.Ping statistics for 10.1.1.2:Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),三、根据拓扑图，设计扩展ACL,在R1路由器上禁止PC2所在网络的http请求和所有的telnet 请求，但仍能互相 ping 通。(1) R3 关闭 AC1R3(config-if)#no ip access-group 2 outR3(config-if)#(2) R3 上配置扩展 ACLR3(config)#ip http serverR3(config)#$tcp 172.16.0.0 0.0.255.255 10.0.0.0 0.255.255.255 eq wwwR3(config)#access-list 101 deny tcp any anyeq 23R3(config)#access-list 101 permit ip any anyR3(config)#int f0/0R3(config-if)#ip access-group 101 in配置完成后 ping 一下，应该都是通的。