форумы  помощь  поиск  регистрация  майллист  ВХОД  слежка

Вариант для распечатки		Архивированная нить - только для чтения!  Пред. тема | След. тема
Форумы Маршрутизаторы CISCO и др. оборудование. (Public)
Изначальное сообщение		[Проследить за развитием треда]

"ACL на CISCO3550"
Сообщение от bOT on 09-Дек-04, 11:12  (MSK)
Может кто поможет мне. Прблема в следующем: 3550, на один из портов ставлю список доступа на входящий трафик. В результате режется весь трафик (кроме списка) и на остальных портах. Конфигурация 3550 с одним VLAN. Работаю больше через CMS. Заранее спасибо...
	Рекомендовать в FAQ | Cообщить модератору | Наверх

Индекс форумов | Темы | Пред. тема | След. тема

Сообщения по теме

1. "ACL на CISCO3550"
Сообщение от sh_ (??) on 09-Дек-04, 14:38  (MSK)
s run
	Рекомендовать в FAQ | Cообщить модератору | Наверх

	2. "ACL на CISCO3550"
	Сообщение от bOT on 10-Дек-04, 07:14  (MSK)
	Погляди пожалуйста че я тут накорябал... version 12.1 no service pad service timestamps debug uptime service timestamps log uptime no service password-encryption ! hostname team3550 ! enable secret 5 $1$eMBH$pY5W3Rx6HiDobTCailrui. enable password genby ! clock timezone MSK 3 clock summer-time MSD recurring last Sun Mar 3:00 last Sun Oct 2:00 ip subnet-zero ! ! spanning-tree mode pvst spanning-tree extend system-id interface GigabitEthernet0/1 switchport mode dynamic desirable ip access-group 101 in ! interface GigabitEthernet0/2 switchport mode dynamic desirable ip access-group 101 in spanning-tree portfast ! interface GigabitEthernet0/3 switchport access vlan dynamic switchport mode dynamic desirable spanning-tree portfast ! interface GigabitEthernet0/4 switchport mode dynamic desirable ! interface GigabitEthernet0/5 switchport mode dynamic desirable interface GigabitEthernet0/6 switchport mode dynamic desirable ! interface GigabitEthernet0/7 switchport mode dynamic desirable ! interface GigabitEthernet0/8 switchport mode dynamic desirable ! interface GigabitEthernet0/9 switchport mode dynamic desirable ! interface GigabitEthernet0/10 switchport mode dynamic desirable ! interface GigabitEthernet0/11 switchport mode dynamic desirable ! interface GigabitEthernet0/12 switchport mode dynamic desirable ! interface Vlan1 ip address 172.24.2.230 255.255.248.0 no ip route-cache no ip mroute-cache ! interface Vlan2 no ip address no ip route-cache no ip mroute-cache shutdown ! ip default-gateway 172.24.1.254 ip classless ip http server ! access-list 101 permit ip 172.24.0.0 0.7.255.255 172.24.0.0 0.7.255.255 access-list 101 permit tcp host 172.24.1.67 192.168.0.0 0.0.255.255 access-list 101 deny   ip any any ! line con 0 exec-timeout 0 0 password login line vty 0 4 exec-timeout 0 0 line con 0 exec-timeout 0 0 password login line vty 0 4 exec-timeout 0 0 password login line vty 5 15 password genby login ! ! end
		Рекомендовать в FAQ | Cообщить модератору | Наверх

	3. "ACL на CISCO3550"
	Сообщение от bOT on 10-Дек-04, 07:17  (MSK)
	Я тока начинающий, поэтому не судите строго... :-) Current configuration : 1882 bytes                                   ! version 12.1             no service pad               service timestamps debug uptime                               service timestamps log uptime                             no service password-encryption                               ! hostname team3550                 ! enable secret 5 $1$eMBH$pY5W3Rx6HiDobTCailrui.                                               enable password genby                     ! clock timezone MSK 3                     clock summer-time MSD recurring last Sun Mar 3:00 last Sun Oct 2:00                                                                   ip subnet-zero               ! ! spanning-tree mode pvst                       spanning-tree extend system-id                               ! ! ! ! ! interface GigabitEthernet0/1                             switchport mode dynamic desirable                                   ip access-group 101 in                       ! interface GigabitEthernet0/2                             switchport mode dynamic desirable                                   ip access-group 101 in                       spanning-tree portfast                       ! interface GigabitEthernet0/3                             switchport access vlan dynamic                               switchport mode dynamic desirable                                   spanning-tree portfast                       ! interface GigabitEthernet0/4                             switchport mode d                 ! interface GigabitEthernet0/5                             switchport mode dynamic desirable                                   ! interface GigabitEthernet0/6                             switchport mode dynamic desirable                                   ! interface GigabitEthernet0/7                             switchport mode dynamic desirable                                   ! interface GigabitEthernet0/8                             switchport mode dynamic desirable                                   ! interface GigabitEthernet0/9                             switchport mode dynamic desirable                                   ! interface GigabitEthernet0/10                             switchport mode dynamic desirable                                   ! interface GigabitEthernet0/11                             switchport mode dynamic desirable                                   ! interface GigabitEthernet0/12                             switchport mode dynamic des                           ! interface Vlan1               ip address 172.24.2.230 255.255.248.0                                       no ip route-cache                   no ip mroute-cache                   ! interface Vlan2               no ip address               no ip route-cache                   no ip mroute-cache                   shutdown         ! ip default-gateway 172.24.1.254 ip classless ip http server ! access-list 101 permit ip 172.24.0.0 0.7.255.255 172.24.0.0 0.7.255.255 access-list 101 permit tcp host 172.24.1.67 192.168.0.0 0.0.255.255 access-list 101 deny   ip any any ! line con 0 exec-timeout 0 0 password hf[bvjd login line vty 0 4 exec-timeout 0 0 password genby login line vty 5 15 password genby login ! ! end
		Рекомендовать в FAQ | Cообщить модератору | Наверх

	4. "ACL на CISCO3550"
	Сообщение от bOT on 10-Дек-04, 07:19  (MSK)
	>s run Current configuration : 1882 bytes                                   ! version 12.1             no service pad               service timestamps debug uptime                               service timestamps log uptime                             no service password-encryption                               ! hostname team3550                 ! enable secret 5 $1$eMBH$pY5W3Rx6HiDobTCailrui.                                               enable password genby                     ! clock timezone MSK 3                     clock summer-time MSD recurring last Sun Mar 3:00 last Sun Oct 2:00                                                                   ip subnet-zero               ! ! spanning-tree mode pvst                       spanning-tree extend system-id                               ! ! ! ! ! interface GigabitEthernet0/1                             switchport mode dynamic desirable                                   ip access-group 101 in                       ! interface GigabitEthernet0/2                             switchport mode dynamic desirable                                   ip access-group 101 in                       spanning-tree portfast                       ! interface GigabitEthernet0/3                             switchport access vlan dynamic                               switchport mode dynamic desirable                                   spanning-tree portfast                       ! interface GigabitEthernet0/4                             switchport mode d                 ! interface GigabitEthernet0/5                             switchport mode dynamic desirable                                   ! interface GigabitEthernet0/6                             switchport mode dynamic desirable                                   ! interface GigabitEthernet0/7                             switchport mode dynamic desirable                                   ! interface GigabitEthernet0/8                             switchport mode dynamic desirable                                   ! interface GigabitEthernet0/9                             switchport mode dynamic desirable                                   ! interface GigabitEthernet0/10                             switchport mode dynamic desirable                                   ! interface GigabitEthernet0/11                             switchport mode dynamic desirable                                   ! interface GigabitEthernet0/12                             switchport mode dynamic des                           ! interface Vlan1               ip address 172.24.2.230 255.255.248.0                                       no ip route-cache                   no ip mroute-cache                   ! interface Vlan2               no ip address               no ip route-cache                   no ip mroute-cache                   shutdown         ! ip default-gateway 172.24.1.254 ip classless ip http server ! access-list 101 permit ip 172.24.0.0 0.7.255.255 172.24.0.0 0.7.255.255 access-list 101 permit tcp host 172.24.1.67 192.168.0.0 0.0.255.255 access-list 101 deny   ip any any ! line con 0 exec-timeout 0 0 password hf[bvjd login line vty 0 4 exec-timeout 0 0 password genby login line vty 5 15 password genby login ! ! end
		Рекомендовать в FAQ | Cообщить модератору | Наверх

	5. "ACL на CISCO3550"
	Сообщение от bOT on 10-Дек-04, 07:21  (MSK)
	Млин, ну я загнался, вроде не было сообщеный-и тут куча.... :-))))) Не сочтите за флуд.
		Рекомендовать в FAQ | Cообщить модератору | Наверх

	6. "ACL на CISCO3550"
	Сообщение от sh_ (??) on 13-Дек-04, 19:52  (MSK)
	>>s run > >Current configuration : 1882 bytes >! >version 12.1 >no service pad >service timestamps debug uptime >service timestamps log uptime >no service password-encryption >! >hostname team3550 >! >enable secret 5 $1$eMBH$pY5W3Rx6HiDobTCailrui. >enable password genby >! >clock timezone MSK 3 >clock summer-time MSD recurring last Sun Mar 3:00 last Sun Oct 2:00 > >ip subnet-zero >! >! >spanning-tree mode pvst >spanning-tree extend system-id >! >! >! >! >! >interface GigabitEthernet0/1 > switchport mode dynamic desirable > ip access-group 101 in >! >interface GigabitEthernet0/2 > switchport mode dynamic desirable > ip access-group 101 in > spanning-tree portfast >! >interface GigabitEthernet0/3 > switchport access vlan dynamic > switchport mode dynamic desirable > spanning-tree portfast >! >interface GigabitEthernet0/4 > switchport mode d >! >interface GigabitEthernet0/5 > switchport mode dynamic desirable >! >interface GigabitEthernet0/6 > switchport mode dynamic desirable >! >interface GigabitEthernet0/7 > switchport mode dynamic desirable >! >interface GigabitEthernet0/8 > switchport mode dynamic desirable >! >interface GigabitEthernet0/9 > switchport mode dynamic desirable >! >interface GigabitEthernet0/10 > switchport mode dynamic desirable >! >interface GigabitEthernet0/11 > switchport mode dynamic desirable >! >interface GigabitEthernet0/12 > switchport mode dynamic des >! >interface Vlan1 > ip address 172.24.2.230 255.255.248.0 > no ip route-cache > no ip mroute-cache >! >interface Vlan2 > no ip address > no ip route-cache > no ip mroute-cache > shutdown >! >ip default-gateway 172.24.1.254 >ip classless >ip http server >! >access-list 101 permit ip 172.24.0.0 0.7.255.255 172.24.0.0 0.7.255.255 >access-list 101 permit tcp host 172.24.1.67 192.168.0.0 0.0.255.255 >access-list 101 deny   ip any any >! >line con 0 > exec-timeout 0 0 > password hf[bvjd > login >line vty 0 4 > exec-timeout 0 0 > password genby > login >line vty 5 15 > password genby > login >! >! >end На сколько я понимаю тебе нужно: conf t vlan 2 exit int vlan2 no sh ip add 192.168.0.1 255.255.0.0 exit no access-list 101 access-list 101 permit tcp host 172.24.1.67 192.168.0.0 0.0.255.255 ip routing И в порты, куда включена сетка 192.168.0.0/16, добавить sw ac vl 2 Это имелось в виду?
		Рекомендовать в FAQ | Cообщить модератору | Наверх

	7. "ACL на CISCO3550"
	Сообщение от bOT on 14-Дек-04, 06:10  (MSK)
	Нееее...Не совсем. У меня следующее: 1 порт с выходом в другую подсеть. И на этом порте надо вставить ACL на входящий трафик. Но вся беда в том, что VLAN2 я не могу организовать, т.к. нахожусь в актив директори и менять свой адреса нет возможности. Ставлю нужный ACL, он конечно вроде начинает работать, но без строки >access-list 101 permit ip 172.24.0.0 0.7.255.255 172.24.0.0 0.7.255.255 режет трафик в подсети 172.24.0.0 НО... Я вроде указываю маску 0.7.255.255 , что говорит о том что тока 172.24.0.0 по 172.24.7.256 могут юзать трафик, ан нет-вся планка 172.24.0.0 по прежнему работает. К стати извини что ввел тебя в некоторое заблуждение, S run неверный, но это тока от спешки, ща вставлю, посмотри пожалуйста... Заранее спасибо.
		Рекомендовать в FAQ | Cообщить модератору | Наверх

	8. "ACL на CISCO3550"
	Сообщение от bOT on 14-Дек-04, 06:27  (MSK)
	вот, на второй порт ACL на входящий трафик. доступ тока для 192.168.0.0 Current configuration : 1863 bytes                                   ! version 12.1             no service pad               service timestamps debug uptime                               service timestamps log uptime                             no service password-encryption                               ! hostname team3550                 ! enable secret 5 $1$eMBH$pY5W3Rx6HiDobTCailrui.                                               enable password genby                     ! clock timezone MSK 3                     clock summer-time MSD recurring last Sun Mar 3:00 last Sun Oct 2:00                                                                   ip subnet-zero               ! ! spanning-tree mode pvst                       spanning-tree extend system-id                               ! ! team3550#^@           team3550#show run                 Building configuration...                         Current configuration :                       ! version 12.1             no service pad               service timestamps debug uptime                               service timestamps log uptime                             no service password-encryption                               ! hostname team3550                 ! enable secret 5 $1$eMBH$pY5W3Rx6HiDobTCailrui.                                               enable password genby                     ! clock timezone MSK 3                     clock summer-time MSD recurring last Sun Mar 3:00 last Sun Oct 2:00                                                                   ip subnet-zero               ! ! spanning-tree mode pvst                       spanning-tree extend system-id                               ! ! ! ! ! interface GigabitEthernet0/1                             switchport mode dynamic desirable                                   ! interface GigabitEthernet0/2                             switchport mode dynamic desirable                                   ip access-group 101 in                       spanning-tree portfast                       ! interface GigabitEthernet0/3                             switchport access vlan dynamic                               switchport mode dynamic desirable                                   spanning-tree portfast                       ! interface GigabitEthernet0/4                             switchport mode dynamic desirable                                   ! interface GigabitEthernet0/5                             switchport mode dynamic desirable                                   ! interface GigabitEthernet0/6                             switchport mode dynamic desirable                                   ! interface GigabitEthernet0/7                             switchport mode dynamic desirable                                   ! interface GigabitEthernet0/8                             switchport mode dynamic desirable                                   ! interface GigabitEther                     switchport mode dynamic desirable                                   ! interface GigabitEthernet0/10                             switchport mode dynamic desirable                                   ! interface GigabitEthernet0/11                             switchport mode dynamic desirable                                   ! interface GigabitEthernet0/12                             switchport mode dynamic desirable                                   ! interface Vlan1               ip address 172.24.2.230 255.255.248.0                                       no ip route-cache                   no ip mroute-cache                   ! interface Vlan2               no ip address               no ip route-cache                   no ip mroute-cache                   shutdown         ! ip default-gateway 172.24.1.254 ip classless ip http server ! access-list 101 permit ip 172.24.0.0 0.7.255.255 172.24.0.0 0.7.255.255 access-list 101 permit ip 172.24.0.0 0.7.255.255 192.168.0.0 0.0.255.255 access-list 101 deny   ip any any ! line con 0 exec-timeout 0 0 password hf[bvjd login line vty 0 4 exec-timeout 0 0 password genby login line vty 5 15 password genby login ! ! end
		Рекомендовать в FAQ | Cообщить модератору | Наверх

	9. "ACL на CISCO3550"
	Сообщение от bOT on 14-Дек-04, 06:28  (MSK)
	На VLAN2 не обращай внимание...
		Рекомендовать в FAQ | Cообщить модератору | Наверх

	10. "ACL на CISCO3550"
	Сообщение от sh_ (??) on 14-Дек-04, 10:22  (MSK)
	>Я вроде указываю маску 0.7.255.255 , что говорит о том что тока >172.24.0.0 по 172.24.7.256 могут юзать трафик... 172.24.0.0 - 172.31.255.255 И acl, если не ошибаюсь, нужно на int vlan вешать...
		Рекомендовать в FAQ | Cообщить модератору | Наверх

Удалить

Индекс форумов | Темы | Пред. тема | След. тема

Пожалуйста, прежде чем написать сообщение, ознакомьтесь с данными рекомендациями.