Enye into engikhohliwe ukuyisho ukuthi i-ACL ayihlungi kuphela ithrafikhi ngokuvumela / ukuphika, yenza imisebenzi eminingi eyengeziwe. Isibonelo, i-ACL isetshenziselwa ukubethela ithrafikhi ye-VPN, kodwa ukuze uphumelele ukuhlolwa kwe-CCNA, udinga kuphela ukwazi ukuthi isetshenziswa kanjani ukuhlunga ithrafikhi. Ake sibuyele ku-Inkinga No.
Sithole ukuthi ithrafikhi yomnyango we-accounting nokuthengisa ingavinjwa kusixhumi esibonakalayo esiphumayo se-R2 kusetshenziswa uhlu olulandelayo lwe-ACL.
Ungakhathazeki ngefomethi yalolu hlu, kuvele kuqondwe njengesibonelo ukukusiza uqonde ukuthi iyini i-ACL. Sizofika kufomethi elungile uma sesiqale nge-Packet Tracer.
I-Task No. 2 izwakala kanje: igumbi leseva lingakwazi ukuxhumana nanoma ibaphi abasingathi, ngaphandle kwabasingathi bomnyango wokuphatha. Okusho ukuthi, amakhompiyutha egumbi leseva angakwazi ukufinyelela noma yimaphi amakhompyutha eminyangweni yokuthengisa neyokubalwa kwezimali, kodwa akufanele abe nokufinyelela kumakhompyutha emnyangweni wokuphatha. Lokhu kusho ukuthi abasebenzi be-IT begumbi leseva akufanele babe nokufinyelela kude kukhompyutha yenhloko yomnyango wabaphathi, kodwa uma kunezinkinga, beza ehhovisi lakhe futhi balungise inkinga khona lapho. Qaphela ukuthi lo msebenzi awusebenzi ngoba angazi nganoma yisiphi isizathu ukuthi kungani igumbi leseva lingakwazi ukuxhumana ngenethiwekhi nomnyango wabaphathi, ngakho-ke kulesi simo sibheka nje isibonelo.
Ukuze uxazulule le nkinga, udinga kuqala ukucacisa indlela yethrafikhi. Idatha evela egumbini leseva ifika kusixhumi esibonakalayo se-G0/1 serutha i-R1 futhi ithunyelwa emnyangweni wabaphathi ngesixhumi esibonakalayo esikhiphayo G0/0.
Uma sisebenzisa isimo se-Deny 192.168.1.192/27 kusixhumi esibonakalayo okokufaka G0/1, futhi njengoba ukhumbula, i-ACL evamile ibekwe eduze nomthombo wethrafikhi, sizovimba yonke ithrafikhi, okuhlanganisa nomnyango wokuthengisa nokubalwa kwezimali.
Njengoba sifuna ukuvimba kuphela ithrafikhi eqondiswe emnyangweni wabaphathi, kufanele sisebenzise i-ACL kusixhumi esibonakalayo esiphumayo G0/0. Le nkinga ingaxazululwa kuphela ngokubeka i-ACL eduze nendawo okuyiwa kuyo. Ngesikhathi esifanayo, ithrafikhi evela kunethiwekhi yomnyango we-accounting kanye nokuthengisa kufanele ifinyelele ngokukhululekile emnyangweni wokuphatha, ngakho-ke umugqa wokugcina wohlu uzoba Imvume noma yimuphi umyalo - ukuvumela noma yikuphi ithrafikhi, ngaphandle kwethrafikhi echazwe esimweni sangaphambilini.
Masiqhubekele ku-Task No. 3: ikhompuyutha ephathekayo yeLaptop 3 yomnyango wezokuthengisa akufanele ibe nokufinyelela kunoma imaphi amadivaysi ngaphandle kwalawo atholakala kunethiwekhi yendawo yomnyango wokuthengisa. Ake sicabange ukuthi oqeqeshwayo usebenza kule khompuyutha futhi akufanele eqe i-LAN yakhe.
Kulokhu, udinga ukusebenzisa i-ACL kusixhumi esibonakalayo esibonakalayo G0/1 somzila R2. Uma sinikeza ikheli le-IP 192.168.1.3/25 kule khompuyutha, kufanele kuhlangatshezwane nemibandela ethi Deny 192.168.1.3/25, futhi ithrafikhi evela kunoma yiliphi elinye ikheli le-IP akumele ivinjwe, ukuze umugqa wokugcina wohlu ube Imvume. noma yikuphi.
Nokho, ukuvimbela ithrafikhi ngeke kube nomthelela ku-Laptop2.
Umsebenzi olandelayo uzoba ngu-Task No. 4: i-PC0 yekhompyutha kuphela yomnyango wezezimali ingaba nokufinyelela kunethiwekhi yeseva, kodwa hhayi umnyango wokuphatha.
Uma ukhumbula, i-ACL esuka ku-Task #1 ivimba yonke into ephumayo ku-S0/1/0 interface yerutha R2, kodwa i-Task #4 ithi sidinga ukuqinisekisa ukuthi kudlula ithrafikhi ye-PC0 kuphela, ngakho-ke kufanele senze okuhlukile.
Yonke imisebenzi esiyixazululayo manje kufanele ikusize esimweni sangempela lapho uhlela ama-ACL enethiwekhi yehhovisi. Ukuze kube lula, ngisebenzise uhlobo lwakudala lokungena, kodwa ngikweluleka ukuthi ubhale phansi yonke imigqa ngesandla ephepheni noma uyibhale kukhompuyutha ukuze ukwazi ukulungisa okufakiwe. Esimweni sethu, ngokwemibandela ye-Task No. 1, uhlu lwakudala lwe-ACL lwahlanganiswa. Uma sifuna ukwengeza okuhlukile kuyo ku-PC0 yohlobo Lwemvume , khona-ke singabeka lo mugqa endaweni yesine kuphela ohlwini, ngemva Kwemvume Noma yimuphi umugqa. Kodwa-ke, njengoba ikheli lale khompyutha lifakwe ebangeni lamakheli okuhlola isimo se-Deny 0/192.168.1.128, ithrafikhi yayo izovinjelwa ngokushesha ngemva kokuba lesi simo sesihlangatshezwane futhi umzila ngeke nje ufinyelele ukuhlola komugqa wesine, okuvumela ithrafikhi kusuka kuleli kheli le-IP.
Ngakho-ke, kuzodingeka ngenze kabusha ngokuphelele uhlu lwe-ACL Lomsebenzi No. 1, ngisuse umugqa wokuqala bese ngifaka esikhundleni semvume yolayini 192.168.1.130/26, evumela ithrafikhi kusuka ku-PC0, bese ngifaka kabusha imigqa evimbela yonke ithrafikhi. kusukela eminyangweni yokubalwa kwezimali neyokuthengisa.
Ngakho-ke, emgqeni wokuqala sinomyalo wekheli elithile, kanti okwesibili - ojwayelekile kuyo yonke inethiwekhi lapho leli kheli likhona. Uma usebenzisa uhlobo lwesimanje lwe-ACL, ungenza kalula izinguquko kulo ngokubeka ulayini Imvume 192.168.1.130/26 njengomyalo wokuqala. Uma une-ACL yakudala, uzodinga ukuyisusa ngokuphelele bese ufaka kabusha imiyalo ngokulandelana kwayo.
Isixazululo senkinga ye-4 ukubeka umugqa weMvume 192.168.1.130/26 ekuqaleni kwe-ACL kusuka ku-Problem No. Ithrafikhi ye-PC1 izovinjwa ngokuphelele ngoba ikheli layo le-IP lingaphansi kokuvinjelwa okuqukethwe emugqeni wesibili wohlu.
Manje sizodlulela ku-Packet Tracer ukuze senze izilungiselelo ezidingekayo. Sengivele ngiwamisile amakheli e-IP awo wonke amadivayisi ngoba imidwebo yangaphambilini eyenziwe lula bekunzima ukuyiqonda. Ngaphezu kwalokho, ngilungiselele i-RIP phakathi kwama-routers amabili. Ku-topology yenethiwekhi enikeziwe, ukuxhumana phakathi kwawo wonke amadivaysi ama-subnets angu-4 kungenzeka ngaphandle kwemikhawulo. Kodwa ngokushesha nje lapho sisebenzisa i-ACL, ithrafikhi izoqala ukuhlungwa.
Ngizoqala nge-PC1 yomnyango wezezimali bese ngizama uku-ping ikheli lasesizindeni se-inthanethi elithi 192.168.1.194, okungele-Server0, elisegumbini leseva. Njengoba ubona, i-ping iphumelela ngaphandle kwezinkinga. Ngiphinde ngifake ngempumelelo iLaptop0 emnyangweni wokuphatha. Iphakethe lokuqala lilahlwa ngenxa ye-ARP, ama-3 asele afakwe ngokukhululekile.
Ukuze ngihlele ukuhlunga kwethrafikhi, ngiya kuzilungiselelo zomzila we-R2, ngivule imodi yokumisa yomhlaba wonke futhi ngizodala uhlu lwesimanje lwe-ACL. Futhi sine-ACL 10 ebukeka yakudala. Ukwakha uhlu lokuqala, ngifaka umyalo lapho kufanele ucacise igama lohlu elifanayo esilibhale phansi ephepheni: i-ip access-list standard ACL Secure_Ma_And_Se. Ngemva kwalokhu, uhlelo lukhuthaza imingcele engenzeka: Ngingakhetha ukuphika, ukuphuma, cha, imvume noma ukuphawula, futhi ngifake Inombolo Yokulandelana kusuka ku-1 kuya ku-2147483647. Uma ngingenzi lokhu, uhlelo luzokwabela ngokuzenzakalelayo.
Ngakho-ke, angiyifaki le nombolo, kodwa ngokushesha ngiya kumsingathi wemvume 192.168.1.130 umyalo, njengoba le mvume isebenza kudivayisi ethile ye-PC0. Ngingasebenzisa futhi i-Wildcard Mask ehlanekezelwe, manje ngizokukhombisa ukuthi ungayenza kanjani.
Okulandelayo, ngifaka umyalo ukuphika 192.168.1.128. Njengoba sinayo /26, ngisebenzisa imaski ehlanekezela futhi ngingezelele umyalo ngayo: phika 192.168.1.128 0.0.0.63. Ngakho, ngiphika ithrafikhi kunethiwekhi 192.168.1.128/26.
Ngokufanayo, ngivimba ithrafikhi kunethiwekhi elandelayo: phika 192.168.1.0 0.0.0.127. Yonke enye ithrafikhi ivunyelwe, ngakho-ke ngifaka imvume yomyalo noma iyiphi. Okulandelayo kufanele ngisebenzise lolu hlu kusixhumi esibonakalayo, ngakho ngisebenzisa umyalo int s0/1/0. Bese ngithayipha i-ip access-group Secure_Ma_And_Se, futhi isistimu ingitshela ukuthi ngikhethe isixhumi esibonakalayo - kumaphakethe angenayo naphumayo ukuze aphume. Sidinga ukusebenzisa i-ACL kusixhumi esibonakalayo esikhiphayo, ngakho-ke ngisebenzisa umyalo we-ip access-group Secure_Ma_And_Se out umyalo.
Ake siye kulayini womyalo we-PC0 bese si-ping ikheli le-IP 192.168.1.194, okungeleseva ye-Server0. I-ping iphumelele ngoba sisebenzise isimo esikhethekile se-ACL sethrafikhi ye-PC0. Uma ngenza okufanayo kusuka ku-PC1, uhlelo luzokhiqiza iphutha: "umsingathi wendawo ayitholakali", njengoba ithrafikhi evela kumakheli e-IP asele omnyango we-accounting ivinjelwe ekufinyeleleni igumbi leseva.
Ngokungena ku-CLI yomzila we-R2 bese uthayipha umyalo we-show-ip address-lists, ungabona ukuthi ithrafikhi yenethiwekhi yomnyango wezezimali yahanjiswa kanjani - ibonisa ukuthi i-ping idluliswe kangaki ngokuvumelana nemvume nokuthi yayiyizikhathi ezingaki. ivinjiwe ngokokwenqatshelwa.
Singaya njalo kuzilungiselelo zerutha futhi sibone uhlu lokufinyelela. Ngakho, izimo zeMisebenzi No. 1 kanye No. 4 ziyafinyelelwa. Ake ngikubonise into eyodwa futhi. Uma ngifuna ukulungisa okuthile, ngingangena kumodi yomhlaba wonke yokucushwa kwezilungiselelo ze-R2, ngifake umyalo we-ip access-list standard Secure_Ma_And_Se bese umyalo othi “host 192.168.1.130 akavunyelwe” - akukho mphathi wemvume 192.168.1.130.
Uma sibheka uhlu lokufinyelela futhi, sizobona ukuthi umugqa we-10 ulahlekile, sinemigqa engu-20,30, 40 kanye ne-XNUMX kuphela esele. ngendlela yakudala.
Manje ake sidlulele ku-ACL yesithathu, ngoba iphinde ithinte umzila we-R2. Ithi noma iyiphi ithrafikhi evela ku-Laptop3 akufanele ishiye inethiwekhi yomnyango wezokuthengisa. Kulokhu, iLaptop2 kufanele ixhumane ngaphandle kwezinkinga namakhompyutha omnyango wezezimali. Ukuhlola lokhu, ngifaka ikheli le-IP elithi 192.168.1.130 kule laptop futhi ngiqinisekise ukuthi konke kuyasebenza.
Manje ngizoya kulayini womyalo weLaptop3 futhi ngifake ikheli 192.168.1.130. I-Pinging iphumelele, kodwa asiyidingi, ngoba ngokwemibandela yomsebenzi, i-Laptop3 ingakwazi ukuxhumana kuphela ne-Laptop2, etholakala kunethiwekhi yomnyango ofanayo wokuthengisa. Ukuze wenze lokhu, udinga ukudala enye i-ACL usebenzisa indlela yakudala.
Ngizobuyela emuva kuzilungiselelo ze-R2 futhi ngizame ukubuyisela okufakiwe okususiwe 10 ngisebenzisa umyalo womsingathi wezimvume 192.168.1.130. Uyabona ukuthi lokhu kufakwa kubonakala ekupheleni kohlu enombolweni engu-50. Nokho, ukufinyelela ngeke kusasebenza, ngoba umugqa ovumela umphathi othile usekupheleni kohlu, futhi umugqa ovimbela yonke ithrafikhi yenethiwekhi uphezulu. ohlwini. Uma sizama ukufaka i-ping ku-Laptop0 yomnyango wokuphatha ku-PC0, sizothola umlayezo othi “umsingathi wendawo akafinyeleleki,” naphezu kweqiniso lokuthi kukhona imvume yokungena enombolweni engu-50 ku-ACL.
Ngakho-ke, uma ufuna ukuhlela i-ACL ekhona, udinga ukufaka umyalo othi akukho mphathi wemvume 2 kumodi ye-R192.168.1.130 (config-std-nacl), hlola ukuthi umugqa 50 unyamalele ohlwini, bese ufaka imvume ye-10. ukusingatha 192.168.1.130. Siyabona ukuthi uhlu selubuyele esimweni salo sokuqala, nalokhu okufakiwe kubekwe kuqala. Izinombolo zokulandelana zisiza ukuhlela uhlu nganoma yiluphi uhlobo, ngakho-ke uhlobo lwesimanje lwe-ACL lusebenziseka kakhulu kunolwakudala.
Manje ngizobonisa ukuthi indlela yakudala yohlu lwe-ACL 10. Ukuze usebenzise uhlu lwakudala, udinga ukufaka umyalo wokufinyelela-uhlu 10?, futhi, ngokulandela ukwaziswa, khetha isenzo osifunayo: phika, vumela noma phawula. Bese ngifaka umugqa wokufinyelela—uhlu 10 wenqaba umsingathi, ngemva kwalokho ngithayipha umyalo wokufinyelela–uhlu 10 phika 192.168.1.3 bese ngengeza imaski ehlehlayo. Njengoba sinomsingathi, imaski ye-subnet eya phambili ingu-255.255.255.255, futhi okuphambene ngu-0.0.0.0. Ngenxa yalokho, ukuze nginqabe ithrafikhi yosokhaya, kufanele ngifake umyalo wokufinyelela—uhlu 10 phika 192.168.1.3 0.0.0.0. Ngemuva kwalokhu, udinga ukucacisa izimvume, engithayipha kuzo umyalo wokufinyelela-uhlu 10 imvume noma yikuphi. Lolu hlu ludinga ukusetshenziswa kusixhumi esibonakalayo se-G0/1 serutha i-R2, ngakho ngifaka ngokulandelana imiyalo kokuthi g0/1, ip access-group 10 in. Kungakhathaliseki ukuthi yiluphi uhlu olusetshenziswayo, lwakudala noma lwesimanje, imiyalo efanayo isetshenziswa ukusebenzisa lolu hlu kusixhumi esibonakalayo.
Ukuhlola ukuthi izilungiselelo zilungile yini, ngiya kutheminali yomugqa womyalo we-Laptop3 bese ngizama ukufaka ikheli le-IP 192.168.1.130 - njengoba ubona, uhlelo lubika ukuthi umsingathi wendawo akafinyeleleki.
Ake ngikukhumbuze ukuthi ukuze uhlole uhlu ungasebenzisa kokubili i-ip yokubonisa izinhlu futhi ubonise imiyalo yohlu lokufinyelela. Kufanele sixazulule enye inkinga, ehlobene nerutha ye-R1. Ukuze ngenze lokhu, ngiya ku-CLI yale router bese ngiya kumodi yokucushwa komhlaba wonke bese ngifaka umyalo we-ip access-list standard Secure_Ma_From_Se. Njengoba sinenethiwekhi 192.168.1.192/27, imaski yayo subnet kuyoba 255.255.255.224, okusho ukuthi imaskhi reverse kuyoba 0.0.0.31 futhi sidinga ukufaka umyalo ukuphika 192.168.1.192 0.0.0.31. Njengoba yonke enye ithrafikhi ivunyelwe, uhlu luphetha ngemvume yomyalo noma iyiphi. Ukuze usebenzise i-ACL kusixhumi esibonakalayo somzila, sebenzisa umyalo we-ip access-group Secure_Ma_From_Se out umyalo.
Manje ngizoya kutheminali yomugqa womyalo we-Server0 bese ngizama uku-ping i-Laptop0 yomnyango wokuphatha ekhelini le-IP 192.168.1.226. Umzamo awuphumelelanga, kodwa uma ngifake i-pinged 192.168.1.130, uxhumano lwasungulwa ngaphandle kwezinkinga, okungukuthi, sinqabele ikhompuyutha yeseva ukuthi ixhumane nomnyango wokuphatha, kodwa sivumele ukuxhumana nawo wonke amanye amadivaysi kweminye iminyango. Ngakho-ke, sizixazulule ngempumelelo zonke izinkinga ezi-4.
Ake ngikubonise okunye. Singena kuzilungiselelo zomzila we-R2, lapho sinezinhlobo ezi-2 ze-ACL - zakudala nesimanje. Ake sithi ngifuna ukuhlela i-ACL 10, uhlu lokufinyelela lwe-IP olujwayelekile 10, olusesimweni salo sakudala oluqukethe okufakiwe okubili 10 no-20. Uma ngisebenzisa umyalo we-do show run, ngiyabona ukuthi okokuqala sinohlu lwesimanje lokufinyelela lwe-4. okufakiwe ngaphandle kwezinombolo ngaphansi kwesihloko esivamile Secure_Ma_And_Se, futhi ngezansi kukhona okufakiwe okubili kwe-ACL 10 yefomu yakudala ephinda igama lohlu olufanayo lokufinyelela 10.
Uma ngifuna ukwenza izinguquko ezithile, ezifana nokukhipha umsingathi wokuphika 192.168.1.3 nokwethula okufakwayo kwedivayisi kunethiwekhi ehlukile, ngidinga ukusebenzisa umyalo wokususa kulokho kufakwa kuphela: akukho hlu lokufinyelela 10 phika umsingathi 192.168.1.3 .10. Kodwa uma nje ngifaka lo myalo, konke okufakiwe kwe-ACL XNUMX kunyamalala ngokuphelele. Yingakho umbono wakudala we-ACL ungalungile kakhulu ukuhlela. Indlela yesimanje yokurekhoda isebenziseka kalula, njengoba ivumela ukuhlela kwamahhala.
Ukuze ufunde okuqukethwe kulesi sifundo sevidiyo, ngikweluleka ukuthi uphinde uyibuke futhi uzame ukuxazulula izinkinga okuxoxwe ngazo uwedwa ngaphandle kokusikisela. I-ACL yisihloko esibalulekile esifundweni se-CCNA, futhi abaningi badidekile, isibonelo, inqubo yokudala i-Wildcard Mask ehlanekezelwe. Ngiyakuqinisekisa, vele uqonde umqondo wokuguqulwa kwemaski, futhi konke kuzoba lula kakhulu. Khumbula ukuthi into ebaluleke kakhulu ekuqondeni izihloko zezifundo ze-CCNA ukuqeqeshwa okusebenzayo, ngoba ukuzilolonga kuphela kuzokusiza uqonde lokhu noma lowo mqondo weCisco. Ukuzijwayeza akukhona ukukopisha-ukunamathisela amaqembu ami, kodwa ukuxazulula izinkinga ngendlela yakho. Zibuze imibuzo: yini okufanele yenziwe ukuze kuvinjwe ukuhamba kwethrafikhi ukusuka lapha kuya lapho, lapho kufanele kusetshenziswe izimo, njll., bese uzama ukuziphendula.
Siyabonga ngokuhlala nathi. Uyazithanda izindatshana zethu? Ufuna ukubona okuqukethwe okuthakaselayo okwengeziwe? Sisekele ngokufaka i-oda noma ngokuncoma kubangani, Isaphulelo sika-30% sabasebenzisi be-Habr ku-analogue ehlukile yamaseva eleveli yokungena, esungulwe yithi ngenxa yakho: (itholakala nge-RAID1 kanye ne-RAID10, kufika kuma-cores angu-24 kuze kufike ku-40GB DDR4).
I-Dell R730xd ishibhile izikhathi ezi-2? Lapha kuphela eNetherlands! I-Dell R420 - 2x E5-2430 2.2Ghz 6C 128GB DDR3 2x960GB SSD 1Gbps 100TB - isuka ku-$99! Funda mayelana
Source: www.habr.com