Resolución de ejercicios.

ACL CISCO
Configuración de interfaces rnorte y enrutamiento
enable
conf t
hostname RNORTE
interface fa 0/0
ip address 10.11.0.1 255.255.255.252
no shutdown
exit
interface fa 0/1
ip address 196.11.0.1 255.255.255.0
no shutdown
end
conf t
route rip
version 2
network 196.11.0.0
network 10.11.0.0
end
copy run sta
Configuración interfaces rsur yenrutamiento
enable
conf t
hostname RSUR
interface fa 0/0
ip address 10.11.0.2 255.255.255.252
no shutdown
exit
interface fa 0/1
ip address 192.11.0.1 255.255.255.0
no shutdown
end
conf t
route rip
version 2
network 192.11.0.0
network 10.11.0.0
end
copy run sta
1) Elige el router adecuado para que los paquetes del PC1 no sean transmitido por la red
10.XX.0.0. Comprobar que si se permite los paquetes enviados por el PC2.
enable
conf t
access-list 1 deny host 196.11.0.10
access-list 1 permit any
interface fa0/0
ip access-group 1 out
end
copy run sta
show access-list
Comprobación
2) Configurar en la red 192.XX.0.0/24 un filtro “anti-spoofing” para que no sea enviado ningún
paquete por la red 10.XX.0.0 que no coincida con su dirección de origen. Realizarlo también
para la red 196.XX.0.20
RSUR
enable
conf t
access-list 10 permit host 192.11.0.2
access-list 10 permit host 192.11.0.10
access-list 10 permit host 192.11.0.20
access-list 10 deny any
interface fa 0/0
ip access-group 10 in
end
copy run sta
RNORTE
enable
conf t
access-list 11 permit host 196.11.0.2
access-list 11 permit host 196.11.0.10
access-list 11 permit host 196.11.0.20
access-list 11 deny any
interface fa 0/0
ip access-group 11 in
end
copy run sta
3) Borrar las ACLs definidas anteriormente.
RNORTE
enable
show access-list
conf t
no access-list 1
no access-list 11
interface fa 0/0
no ip access-group 1 out
no ip access-gropu 11 in
end
copy run sta
RSUR
enable
show access-list
conf t
no access-list 10
interface fa 0/0
no ip access-group 10 in
end
copy run sta
Uso de ACL COMPLEJAS
4) Permitir que el equipo PC3 pueda utilizar el servidor HTTP de SERVNORTE y no pueda
utilizar el resto de servicios de dicho servidor.
enable
conf t
access-list 101 permit tcp host 192.11.0.10 host 196.11.0.2 eq 80
access-list 101 deny tcp host 192.11.0.10 host 196.11.0.2 eq 25
access-list 101 deny tcp host 192.11.0.10 host 196.11.0.2 eq 53
access-list 101 permit ip any any
interface fa 0/0
ip access-group 101 in
end
copy run sta
5) Permitir que el equipo PC1 pueda utilizar el servidor FTP de SERVSUR y el PC2 no pueda
utilizarlo dicho servicio.
enable
conf t
access-list 101 permit tcp host 196.11.0.10 host 192.11.0.2 eq 20
access-list 101 permit tcp host 196.11.0.10 host 192.11.0.2 eq 21
access-list 101 deny tcp host 196.11.0.20 host 192.11.0.2 eq 20
access-list 101 deny tcp host 196.11.0.20 host 192.11.0.2 eq 21
access-list 101 permit ip any any
interface fa 0/0
ip access-group 101 in
end
copy run sta
6) No permitir que el PC2 pueda comunicarse con el PC4.
RNORTE
enable
conf t
access-list 101 deny ip host 196.11.0.20 host 192.11.0.20
access-list 101 deny icmp host 196.11.0.20 host 192.11.0.20
access-list 101 deny tcp host 196.11.0.20 host 192.11.0.20
access-list 101 deny udp host 196.11.0.20 host 192.11.0.20
access-list 101 permit ip any any
interface fa 0/0
ip access-group 101 in
end
copy run sta
7) Borrar las ACLs anteriores.
9) Borrar las ACL definidas anterioreme.
8) No permitir que los ordenadores de la red 192.XX.0.0 se comuniquen con los ordenadores
de la red 196.XX.0.0
enable
conf t
access-list 100 deny ip 192.11.0.0 0.0.0.255 196.11.0.0 0.0.0.255
access-list 100 deny icmp 192.11.0.0 0.0.0.255 196.11.0.0 0.0.0.255
access-list 100 deny tcp 192.11.0.0 0.0.0.255 196.11.0.0 0.0.0.255
access-list 100 deny udp 192.11.0.0 0.0.0.255 196.11.0.0 0.0.0.255
access-list 100 permit ip any any
interface fa 0/1
ip access-group 100 in
end
copy run sta
9) Borrar las ACL definidas anterioreme.
Enable
Conf t
No Access-list 100
End
Copy run sta
10) Impedir cualquier tráfico ICMP entrante excepto el “Destino Unreachable” y el “Echo
Reply” en el router RNORTE.
enable
conf t
access-list 100 permit icmp any any echo-reply
access-list 100 permit icmp any any host-unreachable
access-list 100 deny icmp any any
access-list 100 permit ip any any
interface fa 0/0
ip access-group 100 in
end
copy run sta