Enye into endilibele ukuyikhankanya kukuba i-ACL ayihluli kuphela i-traffic ngokuvumela / ukukhanyela, yenza imisebenzi emininzi. Ngokomzekelo, i-ACL isetyenziselwa ukubethela i-VPN traffic, kodwa ukuphumelela uviwo lwe-CCNA, kufuneka ukwazi kuphela ukuba isetyenziselwa njani ukucoca i-traffic. Masibuyele kwiNgxaki yoku-1.
Sifumene ukuba i-accounting kunye necandelo lokuthengisa itrafikhi inokuvalwa kwi-interface ye-R2 yemveliso usebenzisa olu luhlu lulandelayo lwe-ACL.
Ungazikhathazi malunga nefomathi yolu luhlu, oko kuthetha nje njengomzekelo ukukunceda uqonde ukuba yintoni ACL. Siza kufika kwifomati eyiyo xa sele siqalisile ngePacket Tracer.
Inombolo yoMsebenzi wesi-2 ivakala ngolu hlobo: igumbi lomncedisi linganxibelelana nayo nayiphi na inginginya, ngaphandle kwenginginya yesebe lolawulo. Oko kukuthi, iikhomputha zegumbi lomncedisi ziyakwazi ukufikelela kuzo naziphi na iikhomputha kumasebe okuthengisa kunye ne-accounting, kodwa akufanele abe nokufikelela kwiikhomputha kwisebe lolawulo. Oku kuthetha ukuba abasebenzi be-IT begumbi lomncedisi akufanele babe nokufikelela kude kwikhompyutheni yentloko yesebe lolawulo, kodwa xa kukho iingxaki, beza eofisini yakhe kwaye balungise ingxaki kwindawo leyo. Qaphela ukuba lo msebenzi awusebenzi kuba andazi ukuba kutheni igumbi lomncedisi lingenakukwazi ukunxibelelana kwinethiwekhi kunye nesebe lolawulo, ngoko ke kule meko sijonga nje isifundo.
Ukusombulula le ngxaki, kufuneka uqale uqonde indlela yendlela. Idatha esuka kwigumbi lomncedisi ifika kwi-interview yegalelo G0/1 ye-router R1 kwaye ithunyelwa kwisebe lolawulo ngokusebenzisa ujongano lwemveliso G0/0.
Ukuba sisebenzise i-Deny 192.168.1.192/27 imeko kwi-interface yegalelo ye-G0 / 1, kwaye njengoko ukhumbula, umgangatho we-ACL ubekwe kufutshane nomthombo wezithuthi, siya kuthintela zonke izithuthi, kubandakanywa nesebe lokuthengisa kunye ne-accounting.
Ekubeni sifuna ukuvimba kuphela i-traffic ejoliswe kwisebe lolawulo, kufuneka sisebenzise i-ACL kwi-interface ye-output G0/0. Le ngxaki ingasonjululwa kuphela ngokubeka i-ACL kufutshane nendawo ekuyiwa kuyo. Ngelo xesha, i-traffic evela kwinethiwekhi yesebe le-accounting kunye neyokuthengisa kufuneka ifikelele ngokukhululekile kwisebe lolawulo, ngoko umgca wokugqibela woluhlu uya kuba yiMvume nayiphi na umyalelo - ukuvumela nayiphi na i-traffic, ngaphandle kwe-traffic echazwe kwimeko yangaphambili.
Masiqhubele phambili kwiNombolo yesi-3 yoMsebenzi: iLaptop ye-3 yeLaptop evela kwisebe lokuthengisa akufanele ifikelele kuzo naziphi na izixhobo ngaphandle kwezo zibekwe kuthungelwano lwendawo yesebe lokuthengisa. Makhe sicinge ukuba umqeqeshwa usebenza kule khompyutha kwaye akufuneki adlulele ngaphaya kweLAN yakhe.
Kule meko, kufuneka usebenzise i-ACL kwi-interface yegalelo ye-G0/1 ye-router R2. Ukuba sabela idilesi ye-IP 192.168.1.3/25 kule khompyutha, ngoko imeko ye-Deny 192.168.1.3/25 kufuneka ihlangane, kwaye i-traffic evela kuyo nayiphi na enye idilesi ye-IP kufuneka ingavalwa, ngoko umgca wokugqibela woluhlu uya kuba yiMvume. nayiphi na.
Nangona kunjalo, ukuvala itrafikhi akuyi kuba nasiphumo kwiLaptop2.
Umsebenzi olandelayo uya kuba nguMsebenzi we-4: kuphela i-PC0 yekhompyutha yesebe lezemali inokufikelela kwinethiwekhi yeseva, kodwa kungekhona isebe lokulawula.
Ukuba uyakhumbula, i ACL ukusuka Task #1 iibhloko zonke traffic ephumayo kwi S0/1/0 ujongano umzila R2, kodwa Task #4 uthi kufuneka siqinisekise ukuba kuphela PC0 traffic udlula, ngoko ke kufuneka senze ngaphandle.
Yonke imisebenzi esiyisombululayo ngoku kufuneka ikuncede kwimeko yokwenyani xa useka ii-ACL zenethiwekhi yeofisi. Ukuze kube lula, ndisebenzise uhlobo lweklasi lokungena, kodwa ndikucebisa ukuba ubhale phantsi yonke imigca ngesandla ephepheni okanye uthayiphe kwikhompyutheni ukuze wenze izilungiso kwiingeniso. Kwimeko yethu, ngokwemiqathango ye-Task No. 1, uluhlu lwe-ACL yeklasi yaqulunqwa. Ukuba sifuna ukongeza ngaphandle kuyo kwiPC0 yohlobo lweMvume , ngoko sinokubeka lo mgca wesine kuphela kuluhlu, emva kweMvume Nawuphi na umgca. Nangona kunjalo, ekubeni idilesi yale khomputha ibandakanyiwe kuluhlu lweedilesi zokukhangela imeko ye-Deny 0/192.168.1.128, itrafikhi yayo iya kuvalwa ngokukhawuleza emva kokuba le meko idibene kwaye i-router ayiyi kufikelela kumgca wesine wokutshekisha, ukuvumela. itrafikhi kule dilesi ye IP.
Ngoko ke, kuya kufuneka ndilubuyisele ngokupheleleyo uluhlu lwe-ACL yoMsebenzi weNombolo 1, ukucima umgca wokuqala kunye nomgca weMvume ye-192.168.1.130 / 26, evumela i-traffic ukusuka kwi-PC0, kwaye uphinde ungene kwimigca evimbela zonke izithuthi. ukusuka kumasebe ogcino-zincwadi nentengiso.
Ngaloo ndlela, kumgca wokuqala sinomyalelo wedilesi ethile, kwaye okwesibini - ngokubanzi kwinethiwekhi yonke apho le dilesi ikhona. Ukuba usebenzisa uhlobo lwangoku ACL, ungenza lula utshintsho kuyo ngokubeka umgca Permit 192.168.1.130/26 njengomyalelo wokuqala. Ukuba une ACL yakudala, kuya kufuneka uyisuse ngokupheleleyo uze uphinde ufake imiyalelo ngolandelelwano oluchanekileyo.
Isisombululo kwiNgxaki ye-4 kukubeka umgca weMvume 192.168.1.130/26 ekuqaleni kwe-ACL ukusuka kwiNgxaki ye-1, kuba kuphela kulo mzekelo kuya kuthuthwa kwi-PC0 ngokukhululekile ukushiya ujongano lwemveliso ye-router R2. I-traffic ye-PC1 iya kuvalwa ngokupheleleyo ngenxa yokuba idilesi yayo ye-IP ixhomekeke kwisithintelo esiqulethwe kumgca wesibini woluhlu.
Ngoku siya kudlulela kwi-Packet Tracer ukwenza izicwangciso eziyimfuneko. Sele ndiqwalasele iidilesi ze-IP zazo zonke izixhobo kuba imizobo yangaphambili eyenziwe lula bekunzima ukuyiqonda. Ukongezelela, ndilungiselele i-RIP phakathi kwee-routers ezimbini. Kwi-topology yenethiwekhi enikiweyo, unxibelelwano phakathi kwazo zonke izixhobo ze-4 subnets zinokwenzeka ngaphandle kwezithintelo. Kodwa ngokukhawuleza ukuba sisebenzise i-ACL, i-traffic traffic iya kuqala ukuhluzwa.
Ndiza kuqala nge-PC1 yesebe lezemali kwaye ndizame ukucofa idilesi ye-IP engu-192.168.1.194, eyeye-Server0, ekwigumbi lomncedisi. Njengoko ubona, i-ping iphumelele ngaphandle kweengxaki. Ndiphinde ndaphumelela iLaptop0 kwisebe lolawulo. Ipakethi yokuqala ilahlwa ngenxa ye-ARP, i-3 eseleyo i-pinged ngokukhululekile.
Ukuze uququzelele ukuhluzwa kwe-traffic, ndingena kwiisetingi ze-router ye-R2, ndivule imowudi yoqwalaselo lwehlabathi kwaye ndiza kwenza uluhlu lwangoku lwe-ACL. Sikwanayo ne-ACL 10 ekhangelekayo. Ukwenza uluhlu lokuqala, ndifaka umyalelo apho kufuneka uchaze igama loluhlu olufanayo ukuba sabhala phantsi ephepheni: ip ukufikelela-uluhlu olusemgangathweni ACL Secure_Ma_And_Se. Emva koko, inkqubo ikhuthaza iiparameters ezinokwenzeka: Ndiyakwazi ukukhetha ukukhanyela, ukuphuma, akukho, imvume okanye ukuphawula, kwaye kwakhona ufake iNombolo yolandelelwano ukusuka kwi-1 ukuya kwi-2147483647. Ukuba andiyenzi oku, inkqubo iya kuyinika ngokuzenzekelayo.
Ngoko ke, andiyifaki le nombolo, kodwa ngoko nangoko ndiye kumamkeli mvume 192.168.1.130 umyalelo, ekubeni le mvume isebenza kwisixhobo esithile PC0. Ndingasebenzisa kwakhona i-Wildcard Mask ebuyela umva, ngoku ndiza kukubonisa indlela yokwenza.
Emva koko, ndifaka umyalelo ukukhanyela 192.168.1.128. Ekubeni sinayo / 26, ndisebenzisa imaski ebuyela umva kwaye ndongeze umyalelo ngayo: khanyela 192.168.1.128 0.0.0.63. Ngaloo ndlela, ndiyakhanyela i-traffic kwinethiwekhi 192.168.1.128/26.
Ngokufanayo, ndivala itrafikhi kwinethiwekhi elandelayo: ukukhanyela 192.168.1.0 0.0.0.127. Zonke ezinye iitrafikhi zivumelekile, ngoko ke ndifaka imvume yomyalelo nayiphi na. Okulandelayo kufuneka ndisebenzise olu luhlu kujongano, ngoko ke ndisebenzisa umyalelo int s0/1/0. Emva koko ndichwetheza i-ip access-group Secure_Ma_And_Se, kwaye inkqubo iyandikhuthaza ukuba ndikhethe i-interface - kwiipakethi ezingenayo kunye nokuphumayo. Kufuneka sisebenzise i-ACL kujongano lwemveliso, ngoko ndisebenzisa i-ip ukufikelela-iqela Secure_Ma_And_Se ngaphandle umyalelo.
Makhe siye kumgca womyalelo we-PC0 kunye ne-ping idilesi ye-IP 192.168.1.194, eyeyeseva ye-Server0. I-ping iphumelele kuba sisebenzise imeko ekhethekileyo ye-ACL ye-PC0 traffic. Ukuba ndenza okufanayo kwi-PC1, inkqubo iya kuvelisa impazamo: "i-host host ayifumaneki", ekubeni i-traffic esuka kwiidilesi ze-IP ezisele zesebe le-accounting zivaliwe ekufikeleleni kwigumbi lomncedisi.
Ngokungena kwi-CLI ye-router ye-R2 kwaye uchwetheze umyalelo we-ip-list-idilesi yokubonisa, unokubona indlela i-traffic network network network yahanjiswa ngayo-ibonisa ukuba mangaphi amaxesha i-ping idluliselwe ngokwemvume kwaye mangaphi amaxesha. ivaliwe ngokwesalelo.
Singahlala sisiya kwiisethingi ze-router kwaye sibone uluhlu lokufikelela. Ngaloo ndlela, imiqathango yeMisebenzi yeNombolo ye-1 kunye neNombolo yesi-4 idibene. Makhe ndikubonise enye into. Ukuba ndifuna ukulungisa into ethile, ndingangena kwimowudi yoqwalaselo lwehlabathi lonke lwezicwangciso ze-R2, ngenisa i-ip yokufikelela-uluhlu olusemgangathweni olusemgangathweni Secure_Ma_And_Se kwaye emva koko umyalelo othi "host 192.168.1.130 ayivumelekanga" - akukho mvume yokusingatha 192.168.1.130.
Ukuba sijonga uluhlu lokufikelela kwakhona, siya kubona ukuba umgca we-10 ulahlekile, sinemigca engama-20,30, i-40 kunye ne-XNUMX kuphela ekhohlo, unokuhlela uluhlu lokufikelela kwi-ACL kwiisetingi ze-router, kodwa kuphela ukuba ayihlanganiswanga kwifom yakudala.
Ngoku makhe siqhubele phambili kwi-ACL yesithathu, kuba ikwachaphazela umzila we-R2. Ichaza ukuba nayiphi na i-traffic evela kwi-Laptop3 akufanele ishiye inethiwekhi yesebe lentengiso. Kule meko, iLaptop2 kufuneka inxibelelane ngaphandle kweengxaki kwiikhompyuter zesebe lezemali. Ukuvavanya oku, ndifaka idilesi ye-IP 192.168.1.130 kule laptop kwaye ndiqinisekise ukuba yonke into isebenza.
Ngoku ndiza kuya kumgca womyalelo weLaptop3 kwaye ndifake idilesi 192.168.1.130. I-Pinging iphumelele, kodwa asiyidingi, kuba ngokwemiqathango yomsebenzi, iLaptop3 inokunxibelelana kuphela neLaptop2, efumaneka kwinethiwekhi yesebe lokuthengisa. Ukwenza oku, kufuneka udale enye i-ACL usebenzisa indlela yakudala.
Ndiza kubuyela kwisetingi ze-R2 kwaye ndizame ukubuyisela ingeniso ecinyiweyo ye-10 ndisebenzisa umamkeli mvume 192.168.1.130 umyalelo. Uyabona ukuba olu ngeniso luvela ekupheleni kwoluhlu kwinombolo 50. Nangona kunjalo, ukufikelela akusayi kusebenza, kuba umgca ovumela umphathi othile usekupheleni koluhlu, kwaye umgca ovimbela yonke i-traffic yenethiwekhi iphezulu. kuluhlu. Ukuba sizama ukucofa iLaptop0 yesebe lolawulo ukusuka kwiPC0, siya kufumana umyalezo βindawo ekuyiwa kuyo ayifikeleleki,β nangona kukho imvume yokungena kwinombolo 50 kwi-ACL.
Ngoko ke, ukuba ufuna ukuhlela i ACL ekhoyo, kufuneka ufake umyalelo akukho host imvume 2 kwimo ye-R192.168.1.130 (config-std-nacl), khangela ukuba umgca 50 uye wanyamalala kuluhlu, kwaye ufake umyalelo 10 imvume host 192.168.1.130. Siyabona ukuba uluhlu ngoku lubuyele kwimo yalo yokuqala, kunye nolu ngeniso lubekwe kwindawo yokuqala. Amanani olandelelwano anceda ukuhlela uluhlu nangaluphi na uhlobo, ngoko ke uhlobo lwangoku lwe-ACL lulungele kakhulu kunolo lwakudala.
Ngoku ndiza kubonisa indlela i-classic form yoluhlu lwe-ACL 10 olusebenza ngayo, kufuneka ungenise umyalelo wokufikelela-uluhlu lwe-10? Emva koko ndingenisa umgca wofikelelo-uluhlu 10 khanyela umamkeli, emva koko ndichwetheza ufikelelo lomyalelo-uluhlu 10 khanyela 192.168.1.3 kwaye ndongeze imaski ebuyela umva. Ekubeni sinomkhosi, imaski ye-subnet yangaphambili yi-255.255.255.255, kwaye umva ngu-0.0.0.0. Ngenxa yoko, ukukhanyela itrafikhi yomamkeli, kufuneka ndifake umyalelo wofikelelo-uluhlu 10 khanyela 192.168.1.3 0.0.0.0. Emva koku, kufuneka ucacise iimvume, apho ndichwetheza ufikelelo lomyalelo-uluhlu lwe-10 luvumela nayiphi na. Olu luhlu kufuneka lusetyenziswe kwi-interface ye-G0/1 ye-router R2, ngoko ke ndifaka ngokulandelelana imiyalelo kwi-g0/1, i-ip access-group 10 in. Nokuba loluphi uluhlu olusetyenziswayo, oluqhelekileyo okanye lwangoku, imiyalelo efanayo isetyenziselwa ukusebenzisa olu luhlu kujongano.
Ukujonga ukuba izicwangciso zichanekile, ndiya kwi-terminal yomyalelo weLaptop3 kwaye ndizame ukubethelela idilesi ye-IP 192.168.1.130 - njengoko ubona, inkqubo ibika ukuba i-host host ayifumaneki.
Mandikukhumbuze ukuba ukujonga uluhlu ungasebenzisa zombini uluhlu lofikelelo lwe-ip kwaye ubonise uluhlu lofikelelo-imiyalelo. Kufuneka sisombulule enye ingxaki, ehambelana ne-router ye-R1. Ukwenza oku, ndiya kwi-CLI yale router kwaye ndiye kwimodi yoqwalaselo lwehlabathi kwaye ufake i-IP yokufikelela-uluhlu olusemgangathweni olusemgangathweni Secure_Ma_From_Se. Ekubeni sinawo womnatha 192.168.1.192/27, subnet imaski yayo iya kuba 255.255.255.224, nto leyo ethetha ukuba imaski reverse iya kuba 0.0.0.31 kwaye kufuneka singene ukukhanyela 192.168.1.192 0.0.0.31 umyalelo. Ekubeni zonke ezinye iitrafikhi zivumelekile, uluhlu luphela ngemvume yomyalelo nayiphi na. Ukuze usebenzise i ACL ujongano imveliso umzila kaThixo, sebenzisa ip ukufikelela-iqela Secure_Ma_From_Se ngaphandle umyalelo.
Ngoku ndiza kuya kwi-terminal yomyalelo we-Server0 kwaye ndizame ukucofa iLaptop0 yesebe lolawulo kwidilesi ye-IP 192.168.1.226. Umzamo awuphumelelanga, kodwa ukuba i-pinged idilesi 192.168.1.130, uxhulumaniso lusekwe ngaphandle kweengxaki, oko kukuthi, sasinqande ikhompyutha yomncedisi ekunxibelelaneni nesebe lolawulo, kodwa ivumele unxibelelwano kunye nazo zonke ezinye izixhobo kwamanye amasebe. Ngaloo ndlela, sizisombulule ngempumelelo zonke iingxaki ezi-4.
Makhe ndikubonise enye into. Singena kwizicwangciso ze-router ye-R2, apho sineentlobo ezi-2 ze-ACL - zakudala kunye nezanamhlanje. Masithi ndifuna ukuhlela i-ACL 10, uluhlu lofikelelo lwe-IP oluMgangatho lwe-10, olukwimo yalo yakudala inamangeniso amabini u-10 no-20. amangeno ngaphandle kwamanani phantsi kwesihloko ngokubanzi Secure_Ma_And_Se, kwaye ngezantsi kukho ezimbini ACL 4 amangeno ohlobo lwakudala ephinda igama lofikelelo-uluhlu olufanayo 10.
Ukuba ndifuna ukwenza utshintsho oluthile, olufana nokususa inginginya yokukhanyela 192.168.1.3 ungeno kunye nokwazisa ungeno lwesixhobo kumsebenzi womnatha owahlukileyo, kufuneka ndisebenzise umyalelo wokucima olo ngeniso kuphela: akukho luhlu lofikelelo 10 khanyela umamkeli 192.168.1.3 .10. Kodwa nje ukuba ndifake lo myalelo, onke amangeno e-ACL XNUMX ayanyamalala ngokupheleleyo. Indlela yokurekhoda yangoku isebenziseka ngakumbi, njengoko ivumela ukuhlela simahla.
Ukuze ufunde izinto eziphathekayo kwesi sifundo sevidiyo, ndikucebisa ukuba ubukele kwakhona kwaye uzame ukusombulula iingxaki ezixoxwe ngokwakho ngaphandle kweengcebiso. I-ACL yisihloko esibalulekileyo kwikhosi ye-CCNA, kwaye abaninzi badidekile, umzekelo, inkqubo yokudala i-reverse Wildcard Mask. Ndiyakuqinisekisa, qonda nje umxholo wokuguqulwa kwemaski, kwaye yonke into iya kuba lula kakhulu. Khumbula ukuba eyona nto ibalulekileyo ekuqondeni izihloko zekhosi zeCCNA luqeqesho olusebenzayo, kuba uqheliselo kuphela luya kukunceda uqonde oku okanye loo ngcamango yeCisco. Ukuziqhelanisa ayikokukopa-ukuncamathisela amaqela am, kodwa ukusombulula iingxaki ngendlela yakho. Zibuze imibuzo: yintoni ekufuneka yenziwe ukunqanda ukuhamba kwezithuthi ukusuka apha ukuya phaya, apho ungafaka khona iimeko, njl., kwaye uzame ukuziphendula.
Enkosi ngokuhlala nathi. Ngaba uyawathanda amanqaku ethu? Ngaba ufuna ukubona umxholo onomdla ngakumbi? Sixhase ngokufaka iodolo okanye ngokucebisa abahlobo, I-30% isaphulelo kubasebenzisi beHabr kwi-analogue ekhethekileyo yeeseva zomgangatho wokungena, eyenzelwe wena: (ifumaneka nge-RAID1 kunye ne-RAID10, ukuya kuthi ga kwi-24 cores kunye ne-40GB DDR4).
I-Dell R730xd 2 amaxesha aphantsi? Kuphela apha eNetherlands! Dell R420 - 2x E5-2430 2.2Ghz 6C 128GB DDR3 2x960GB SSD 1Gbps 100TB - ukusuka $99! Funda malunga
umthombo: www.habr.com