---

? 需求：在R2上，允許R1主動訪問R3的流量，R3主動訪問R1所有流量都拒絕。 ? R2： ? ip access-list extended out_acl permit ip any any reflect any_acl???? //指定該條語句執(zhí)行自反，自反列表的名字為any_acl. ? ? ip access-list extended in_acl evaluate any_acl???????????????????????????????? //計算并生成自反列表 deny ip any any ? interface FastEthernet1/0 ip access-group in_acl in ip access-group out_acl out ? 說明1：reflect和evalute后面的對應名應該相同，此例中為any_acl 說明2：自反ACL只能在命名的擴展ACL里定義 ? ? 結(jié)果： ? R1#ping 10.0.23.3 Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.23.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 16/40/108 ms
R1#ping 10.0.23.3 Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.23.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/72/164 ms
R1# ? ? R2#sh access-lists
Reflexive IP access list any_acl
???? permit icmp host 10.0.23.3 host 10.0.12.1? (20 matches) (time left 283)
Extended IP access list in_acl
??? 10 evaluate any_acl
??? 20 deny ip any any
Extended IP access list out_acl
??? 10 permit ip any any reflect any_acl (10 matches)
R2# ? ? R3#ping 10.0.12.1 Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.12.1, timeout is 2 seconds:
U.U.U
Success rate is 0 percent (0/5)
R3#

轉(zhuǎn)載于:https://blog.51cto.com/wenbin0924/616889

總結(jié)

以上是生活随笔為你收集整理的自反ACL访问控制列表的应用的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯，歡迎將生活随笔推薦給好友。