2–AMALIY ISH
MAVZU: ACL RO`YXATINI SOZLASH (STANDART, EXTENDED)
Ishdan maqsad: Ma’lumot uzatish tarmoqlarida qo‘llaniluvchi ACL-ro`yxati
tuzish, sozlash va tekshirish qoidalarini tadqiq qilish.
Nazariy ma’lumotlar
Tarmoq trafigini filtrlash uchun ACL (Access Control List)
marshrutizatorning infterfeysida uzatilayotgan paketni o‘tkazishni yoki blokka
tushirishni tekshiradi. Marshrutizator har bir paketni tekshiradi va ACL da
o‘rnatilgan mezonlarga asosan paketni nima qilish: uzatish yoki tashlab yuborish
kerakligini aniqlaydi.
ACL ni mezonlari quyidagilar:
– trafikni uzatuvchi manzili;
– trafikni qabul qiluvchi manzili;
– yuqori pog‘ona protokollari.
IP ACL – bu IP paketga qo‘llaniladigan rad etish va ruxsat berish
xolatlarining ketma – ket buyruqlar to‘plami. Marshrutizator ACL ni shartlariga
mos ravishda bittalab paketni tekshiradi. IP ACL ni quyidagi turlari sozlanishi
mumkin:
– standart ACL;
– kengaytirilgan ACL;
– dinamik ACL (qulf va kalit);
– nomlangan ACL IP – ro‘yxatlar;
– refleksif ACL;
– proksi – autentifikatsiya;
– Turbo ACL.
Standart ACL buyrug‘ini ko‘rinishi quyidagicha:
1.
Standart ACL (faqat ro‘yxatdan o‘tgan mijozlar uchun) IP
paketlarni uzatuvchi manzili bilan ro‘yxatga kiritilgan manzillarni solishtirish
orqali trafikni boshqaradi.
Standart ACL ro‘yxatini
qabul qiluvchi manziliga yaqinroq
joylashtirilishi maqbul hisoblanadi, chunki ushbu trafikning ACL qo‘llaniladigan
interfeysidagi boshqa tarmoqlarga yetib borishini oldini oladi. Kirish ro‘yxatlari
ramziy nomlar yoki nomerlar bilan belgilanadi:
 standart: 1 dan 99 gacha;
 kengaytirilgan: 100 dan 199 gacha.
Standart ACL ro‘yxati
Router(config)#access-list <ro‘yxat nomeri 1 dan
99 gacha > {permit | deny | remark} {address | any |
host}[source-wildcard] [log]
 permit: ruhsat;
 deny: rad etish;
 remark: kirish ro‘yxati bo‘yicha sharx;
 address: tarmoqqa ruxsat berish yoki rad etish;
 any: barcha ruxsat yoki rad etish;
 host: hostga ruxsat yoki rad etish;
 source-wildcard: WildCard tarmoq maskasi;
 log: ushbu ACL yozuvidan o‘tadigan paketlarni jurnalga yozishni yoqish.
Interfeysga biriktirish
Router(config-if)#ip access-group < ACL nomi yoki
ro‘yxat nomeri> {in | out}
 in: kiruvchi yo‘nalish;
 out: chiquvchi yo‘nalish;
access-list access-list-number {permit|deny} {host|source sourcewildcard|any}.
Standart ACL (faqat ro`yxatdan o‘tgan mijozlar uchun) IP paketlarni
uzatuvchi manzili bilan ro`yxatga kiritilgan manzillarni solishtirish orqali trafikni
boshqaradi.
Standart ACL ro`yxat bo`yicha tanlangan hostni tarmoqqa kirishiga
ruxsat berish
6.1- rasm. Standart ACL ro`yxat bo`yicha tarmoq tuzilishi
6.1– rasmda Hostni tarmoqqa kirishiga ruxsat berilishi ko‘rsatilgan. B
tarmoqdagi xost 192.168.10.1 dan A tarmoqqa yo‘naltirilgan barcha trafiklarni
qabul qiladi va bir vaqtda boshqa B tarmoqdan A tarmoqqa yo‘naltirilgan barcha
trafiklar rad etiladi.
R1 marshrutizatorning jadvali tarmoq xostga qanday kirishga ruxsat
berishini ko‘rsatadi. Chiqish ma’lumotlari quyidagicha:
– bu konfiguratsiya IP manzili 192.168.10.1 bo‘lgan xostni R1
marshrutizatorga Ethernet 0 interfeys orqali o‘tkazadi;
– bu xostda A tarmoqning IP xizmatlariga kirish mavjud;
– B tarmoqning boshqa xostlari A tarmoqqa kira olmaydi;
– ACL da ruxsat bermaslikning boshqa instruksiyasi sozlanmagan.
Har bir ACL ning oxirida noaniq sharoitda deny all (barchani ta’qiqlash)
mavjud. Barchasi ruxsat etilmasa, barchasi bekor qilinadi.
ACL B tarmoqdan A tarmoqqa yo‘naltirilgan IP paketlarni, B
tarmoqdan chiquvchi paketlardan boshqa barcha paketlarni filtrlaydi. B xostdan
A tarmoqqa yo‘naltirilgan paketlar ruxsat etiladi.
ACL ni sozlashni boshqa usuli:
access-list 1 permit 192.168.10.1 0.0.0.0.
Tarmoqqa tanlangan xostni kirishini ta’qiqlash
6.2 – rasmda B xostdan A tarmoqqa yo‘naltirilgan barcha trafiklarni
o‘tishi bekor qilinadi va shu vaqtda B tarmoqdan A tarmoqqa yo‘naltirilgan
boshqa barcha trafiklarni o‘tishi ruxsat etiladi.
6.2- rasm. Tarmoq tuzilishi
Bu konfiguratsiya 192.168.10.1/32 xostdan qabul qilingan barcha
paketlarni Ethernet 0 yoki R1 orqali ta’qiqlaydi va boshqa barcha paketlarni qabul
qilinishiga ruxsat beradi. Boshqa barcha paketlarga ruxsat berish uchun quyidagi
buyruqni ishlatish kerak: access list 1 permit any. Har bir ACL ning ohirida
noaniq sharoitda deny all (barchani ta’qiqlash) mavjud.
Shartni qo‘yilishi ACL ro`yxatini ishlashi uchun muhim. Agar yozuvni
teskari tartibda joylashtirsak, ushbu buyruqda ko‘rsatilganidek, birinchi qator
paketning ixtiyoriy uzatuvchi manziliga mos keladi. Shu sababli A tarmoqqa
192.168.10.1/32 xostini kirishini blokka tushira olmaydi.
access-list 1 permit any
access-list 1 deny host 192.168.10.1
Amaliy ish
Standart ACL bo’yicha tarmoq yaratish va sozlash
Cisco Packet Tracer dasturida kompyuter, kommutator, router, serverdan iborat
tarmoq quriladi. Kompyuterlarga, routerga, serverga IP manzillar beriladi.
Serverga hamma kompyuterdan so’rov jo’natib ko’riladi.
6.3- rasm. Tarmoq sxemasi
Routerga ACL standart sozlashlarni bajarish uchun quyidagi buyruqlar kiritiladi:
Router#conf t
Router(config)#ip access-list ?
extended Extended Access List
standard Standard Access List
Router(config)#ip access-list standard ?
<1-99> Standard IP access-list number
WORD Access-list name
Router(config)#ip access-list standard 5
Router(config-std-nacl)# ?
<1-2147483647> Sequence Number
default Set a command to its defaults
deny Specify packets to reject
exit Exit from access-list configuration mode
no Negate a command or set its defaults
permit Specify packets to forward
remark Access list entry comment
Router(config-std-nacl)#deny host 192.168.1.2
Router(config-std-nacl)#permit any
Router(config-std-nacl)#exit
Router(config)#int f0/0
Router(config-if)#ip access-group 5 in
Router(config-if)#exit
Router(config)#exit
Router#show access-lists
Standard IP access list 5
10 deny host 192.168.1.2
20 permit any
Keyin belgilangan kompyuterdan serverga ping so’rov beriladi. Natijada o’sha
kompyuterdan serverga so’rov bormaydi:
6.4- rasm. Kompyuterdan serverga ping so’rovi
Topshiriq
– Standart ACL bo`yicha tarmoq yarating va qoidalar ro`yxati bo`yicha
konfiguratsiya sozlamalarini kiriting.
– Extended ACL bo`yicha tarmoq yarating va qoidalar ro`yxati bo`yicha
konfiguratsiya sozlamalarini kiriting.
– Ikkala usul bo`yicha marshrutizator kiritilgan qoidalar ro`yxatini tahlil
qiling
Ishni bajarish tartibi
1. Cisco packet tracer dasturi ishga tushiriladi.
2. Laboratoriya ishi uchun cisco 2960 kommutatori, 2911 marshruzatori
tanlanadi.
3. Quyida keltirilgan topologiya quriladi.
4. Qurilgan topologiya testlab ko`riladi.
RIP protokoli
1.
SWITCH_1ga quyidagi buyruqlar ketma ketligi kiritiladi.
Switch>en
Switch#conf t
Switch(config)#int range fastEthernet 0/1-2
Switch(config-if-range)#switchport mode access
Switch(config-if-range)#switchport access vlan 2
Switch(config)#int range fastEthernet 0/3-4
Switch(config-if-range)#switchport mode access
Switch(config-if-range)#switchport access vlan 3
Switch(config)#int fastEthernet 0/5
Switch(config-if)#switchport mode trunk
Switch(config-if)#switchport trunk allowed vlan 2,3
Switch(config-if) do wr
Switch(config)#end
2.
ROUTER_1ga quyida buyruqlar ketma ketligi kiritiladi.
continue with configuration dialog? [yes/no]: no
Router>enable
Router#conf t
Router(config)#int gigabitEthernet 0/0
Router(config-if)#no shutdown
Router(config-if)#exit
Router(config)# int gigabitEthernet 0/0.2
Router(config-subif)#encapsulation dot1Q 2
Router(config-subif)# ip address 192.168.10.1 255.255.255.128
Router(config-subif)#exit
Router(config)# int gigabitEthernet 0/0.3
Router(config-subif)#encapsulation dot1Q 3
Router(config-subif)# ip address 192.168.20.129 255.255.255.192
Router(config-subif)#exit
Router(config)# int gigabitEthernet 0/1
Router(config-if)#no shutdown
Router(config-if)#ip address 10.10.10.1 255.255.255.252
Router(config-if)#exit
Router(config)#ip dhcp pool t1
Router(dhcp-config)#network 192.168.10.0 255.255.255.128
Router(dhcp-config)#default-router r
Router(dhcp-config)#default-router 192.168.10.1
Router(dhcp-config)#dns-server 8.8.8.8
Router(dhcp-config)#ip dhcp pool t2
Router(dhcp-config)#network 192.168.10.128 255.255.255.192
Router(dhcp-config)#default-router 192.168.10.129
Router(dhcp-config)#dns-server 8.8.8.8
Router(dhcp-config)#do wr
Router(dhcp-config)#exit
Router(config)#router rip
Router(config-router)#version 2
Router(config-router)#network 10.10.10.0
Router(config-router)#network 192.168.10.0
Router(config-router)#network 192.168.10.128
Router(config-subif)#do wr
Router(config-subif)#exit
3.
SWITCH_2ga quyidagi buyruqlar ketma ketligi kiritiladi.
Switch>en
Switch#conf t
Switch(config)#int range fastEthernet 0/1-2
Switch(config-if-range)#switchport mode access
Switch(config-if-range)#switchport access vlan 2
Switch(config)#int range fastEthernet 0/3-4
Switch(config-if-range)#switchport mode access
Switch(config-if-range)#switchport access vlan 3
Switch(config)#int fastEthernet 0/5
Switch(config-if)#switchport mode trunk
Switch(config-if)#switchport trunk allowed vlan 2,3
Switch(config-if) do wr
Switch(config)#end
4.
ROUTER_2ga quyida buyruqlar ketma ketligi kiritiladi.
continue with configuration dialog? [yes/no]: no
Router>enable
Router#conf t
Router(config)#interface gigabitEthernet 0/0
Router(config-if)#no shutdown
Router(config-if)#exit
Router(config)#interface gigabitEthernet 0/0.2
Router(config-subif)#encapsulation dot1Q 2
Router(config-subif)#ip address 192.168.20.65 255.255.255.240
Router(config-subif)#exit
Router(config)#ip dhcp pool t11
Router(dhcp-config)#network 192.168.20.64 255.255.255.240
Router(dhcp-config)#default-router 192.168.20.65
Router(dhcp-config)#dns-server 8.8.4.4
Router(dhcp-config)#ip dhcp pool t22
Router(dhcp-config)#network 192.168.20.0 255.255.255.224
Router(dhcp-config)#default-router 192.16.20.1
Router(dhcp-config)#dns-server 8.8.4.4
Router(dhcp-config)#exit
Router(config)#interface gigabitEthernet 0/1
Router(config-if)#no shutdown
Router(config-if)#ip address 10.10.10.2 255.255.255.252
Router(config-if)#do wr
Router(config-if)#exit
Router(config)#interface gigabitEthernet 0/0.3
Router(config-subif)#encapsulation dot1Q 3
Router(config-subif)#ip address 192.168.20.1 255.255.255.224
Router(config-subif)#do wr
Router(config-subif)#exit
Router(config)#router rip
Router(config-router)#version 2
Router(config-router)#network 10.10.10.0
Router(config-router)#network 192.168.20.64
Router(config-router)#network 192.168.20.0
Router(config-router)#do wr
Router(config-router)#exit
5.Qurilgan topologiyani testlab ko’rish.
OSPF protokoli
1.
SWITCH_1ga quyidagi buyruqlar ketma ketligi kiritiladi.
Switch>
Switch>en
Switch#conf t
Switch(config)#interface range fastEthernet 0/1-2
Switch(config-if-range)#switchport mode access
Switch(config-if-range)#switchport access vlan 2
Switch(config-if-range)#exit
Switch(config)#interface range fastEthernet 0/3-4
Switch(config-if-range)#switchport mode access
Switch(config-if-range)#switchport access vlan 3
Switch(config-if-range)#exit
Switch(config)#interface fastEthernet 0/5
Switch(config-if)#switchport mode trunk
Switch(config-if)#switchport trunk allowed vlan 2,3
Switch(config-if)#do wr
Switch(config-if)#exit
2.
ROUTER_1ga quyida buyruqlar ketma ketligi kiritiladi.
continue with configuration dialog? [yes/no]: no
Router>enable
Router#conf t
Router(config)#int gigabitEthernet 0/0
Router(config-if)#no shutdown
Router(config-if)#exit
Router(config-subif)#ip address 192.168.40.1 255.255.255.0
Router(config)#interface gigabitEthernet 0/1
Router(config-if)#no shutdown
Router(config-if)#ip address 10.10.10.1 255.255.255.252
Router(config-if)#exit
Router(config)#interface gigabitEthernet 0/2
Router(config-if)#no shutdown
Router(config-if)#ip address 10.10.10.5 255.255.255.252
Router(config-if)#exit
Router(config)#ip dhcp pool n1
Router(dhcp-config)#network 192.168.30.0 255.255.255.0
Router(dhcp-config)#default-router 192.168.30.1
Router(dhcp-config)#dns-server 8.8.8.8
Router(dhcp-config)#exit
Router(config)#ip dhcp pool n2
Router(dhcp-config)#network 192.168.40.0 255.255.255.0
Router(dhcp-config)#default-router 192.168.40.1
Router(dhcp-config)#dns-server 8.8.4.4
Router(dhcp-config)#exit
Router(config)#
Router#conf t
Router(config)#interface loopback 0
Router(config-if)#ip address 172.20.20.1 255.255.255.255
Router(config-if)#ex
Router(config)#router ospf 1
Router(config-router)#network 192.168.30.0 0.0.0.255 area 0
Router(config-router)#network 192.168.40.0 0.0.0.255 area 0
Router(config-router)#network 10.10.10.0 0.0.0.3 area 0
Router(config-router)#network 10.10.10.4 0.0.0.3 area 0
Router(config-router)#end
3.
SWITCH_2ga quyidagi buyruqlar ketma ketligi kiritiladi.
Switch>enable
Switch#conf t
Switch(config)#interface range fastEthernet 0/1-2
Switch(config-if-range)#switchport mode access
Switch(config-if-range)#switchport access vlan 2
Switch(config)#interface range fastEthernet 0/3-4
Switch(config-if-range)#switchport mode access
Switch(config-if-range)#switchport access vlan 3
Switch(config-if-range)#exit
Switch(config)#interface fastEthernet 0/5
Switch(config-if)#switchport mode trunk
Switch(config-if)#switchport trunk allowed vlan 2,3
1.
2. ROUTER_2ga quyida buyruqlar ketma ketligi kiritiladi.
continue with configuration dialog? [yes/no]: no
Router>enable
Router>en
Router#conf t
Router(config)#interface gigabitEthernet 0/0
Router(config-if)#no shutdown
Router(config-if)#exit
Router(config)#interface gigabitEthernet 0/0.2
Router(config-subif)#encapsulation dot1Q 2
Router(config-subif)#ip address 192.168.50.1 255.255.255.0
Router(config-subif)#exit
Router(config)#interface gigabitEthernet 0/0.3
Router(config-subif)#encapsulation dot1Q 3
Router(config-subif)#ip address 192.168.60.1 255.255.255.0
Router(config-subif)#exit
Router(config)#interface gigabitEthernet 0/1
Router(config-if)#no shutdown
Router(config-if)#ip address 10.10.10.6 255.255.255.252
Router(config-if)#exit
Router(config)#interface gigabitEthernet 0/2
Router(config-if)#no shutdown
Router(config-if)#ip address 10.10.10.10 255.255.255.252
Router(config-if)#exit
Router(config)#ip dhcp pool k1
Router(dhcp-config)#network 192.168.50.0 255.255.255.0
Router(dhcp-config)#default-router 192.168.50.1
Router(dhcp-config)#dns-server 8.8.4.4
Router(dhcp-config)#exit
Router(config)#ip dhcp pool k2
Router(dhcp-config)#network 192.168.60.0 255.255.255.0
Router(dhcp-config)#default-router 192.168.60.1
Router(dhcp-config)#dns-server 8.5.2.3
Router#conf t
Router(config)#interface loopback 0
Router(config-if)#ip address 172.20.20.1 255.255.255.255
Router(config-if)#exit
Router(config)#router ospf 2
Router(config-router)#network 192.168.50.0 0.0.0.255 area 0
Router(config-router)#network 192.168.60.0 0.0.0.255 area 0
Router(config-router)#network 10.10.10.4 0.0.0.3 area 0
Router(config-router)#network 10.10.10.8 0.0.0.3 area 0
Router(config-router)#do wr
SWITCH_3ga quyidagi buyruqlar ketma ketligi kiritiladi.
Switch>
Switch>EN
Switch#CONF T
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#IN
Switch(config)#INterface R
Switch(config)#INterface Range F
Switch(config)#INterface Range FastEthernet 0/1-2
Switch(config-if-range)#swi
Switch(config-if-range)#switchport mo
Switch(config-if-range)#switchport mode ac
Switch(config-if-range)#switchport mode access
Switch(config-if-range)#swi
Switch(config-if-range)#switchport ac
Switch(config-if-range)#switchport access vl
Switch(config-if-range)#switchport access vlan 2
% Access VLAN does not exist. Creating vlan 2
Switch(config-if-range)#ex
Switch(config-if-range)#exit
Switch(config)#in
Switch(config)#interface r
Switch(config)#interface range f
Switch(config)#interface range fastEthernet 0/3-4
Switch(config-if-range)#swi
Switch(config-if-range)#switchport mo
Switch(config-if-range)#switchport mode ac
Switch(config-if-range)#switchport mode access
Switch(config-if-range)#swi
Switch(config-if-range)#switchport ac
Switch(config-if-range)#switchport access vl
Switch(config-if-range)#switchport access vlan 3
% Access VLAN does not exist. Creating vlan 3
Switch(config-if-range)#ex
Switch(config-if-range)#exit
Switch(config)#in
Switch(config)#interface f
Switch(config)#interface fastEthernet 0/5
Switch(config-if)#swi
Switch(config-if)#switchport m
Switch(config-if)#switchport mode t
Switch(config-if)#switchport mode trunk
Switch(config-if)#swi
Switch(config-if)#switchport t
Switch(config-if)#switchport trunk al
Switch(config-if)#switchport trunk allowed vl
Switch(config-if)#switchport trunk allowed vlan 2,3
Switch(config-if)#do wr
Building configuration...
[OK]
Switch(config-if)#
Switch(config-if)#ex
Switch(config-if)#exit
3.
ROUTER_3ga quyida buyruqlar ketma ketligi kiritiladi.
continue with configuration dialog? [yes/no]: no
Router>enable
Router#conf t
Router(config)#interface gigabitEthernet 0/0
Router(config-if)#no shutdown
Router(config-if)#exit
Router(config)#interface gigabitEthernet 0/0.2
Router(config-subif)#encapsulation dot1Q 2
Router(config-subif)#ip address 192.168.20.65 255.255.255.240
Router(config-subif)#exit
Router(config-subif)#encapsulation dot1Q 2
Router(config-subif)#ip address 192.168.10.1 255.255.255.0
Router(config-subif)#exit
Router(config)#interface gigabitEthernet 0/0.3
Router(config-subif)#encapsulation dot1Q 3
Router(config-subif)#ip address 192.168.20.1 255.255.255.0
Router(config-subif)#exit
Router(config)#interface gigabitEthernet 0/1
Router(config-if)#no shutdown
Router(config-if)#ip address 10.10.10.2 255.255.255.252
Router(config-if)#exit
Router(config)#interface gigabitEthernet 0/2
Router(config-if)#no shutdown
Router(config-if)#ip address 10.10.10.9 255.255.255.252
Router(config-if)#exit
Router(config)#ip dhcp pool t1
Router(dhcp-config)#network 192.168.10.0 255.255.255.0
Router(dhcp-config)#default-router 192.168.10.1
Router(dhcp-config)#dns-server 8.8.8.8
Router(dhcp-config)#exit
Router(config)#ip dhcp pool t2
Router(dhcp-config)#network 192.168.20.0 255.255.255.0
Router(dhcp-config)#default-router 192.168.20.1
Router(dhcp-config)#dns-server 8.8.4.4
Router(dhcp-config)#do wr
Router(dhcp-config)#exit
Router>enable
Router#conf t
Router(config)#interface l
Router(config)#interface loopback 0
Router(config-if)#ip address 172.20.20.1 255.255.255.255
Router(config-if)#exit
Router(config)#router ospf 3
Router(config-router)#network 192.168.10.0 0.0.0.255 area 0
Router(config-router)#network 192.168.20.0 0.0.0.255 area 0
Router(config-router)#network 10.10.10.0 0.0.0.3 area 0
Router(config-router)#network 10.10.10.8 0.0.0.3 area 0
Router(config-router)#end
Router#5. Qurilgan topologiyani testlab ko’rish.