Atu hatudu exemplu hanesan atu permit host espesífiku no labele blokeia hotu host seluk, ita bele uza ACL (Access Control List) iha router.
Iha dalan ida hanesan ne'e, ami sei kria du hetan du instrusaun ida: permit ba host espesífiku, no deny boot ba sira seluk. Iha kazu ne'e, ami sei uza ACL standart, tamba ita boot presiza ona kontrola ho IP address origem deit.
Exemplu
Kria ACL Standart:
Router(config)# access-list 1 permit 192.168.1.10
Router(config)# access-list 1 deny any
Aplika ACL ba Interface:
Router(config)# interface GigabitEthernet0/0
Router(config-if)# ip access-group 1 in
Iha exemplu ne'e, ita kria ACL ida ho ID 1. Ami permit IP address 192.168.1.10 (ne'ebé representa host espesífiku) atu hetan asesu. Depois, ita boot blokeia hotu tráfiku seluk ho instrusaun "deny any".
Finalmente, ita aplika ACL ida ba interface GigabitEthernet0/0, ho opsaun "in" hodi hatudu katak ACL sei kontrola tráfiku ne'ebé tama ba interface ne'e (entrada).
Tuir exemplu ne'e, ita hatene katak hotu host ne'ebé la'ós 192.168.1.10 sei blokeia boot liu, no deit host ho endereçu IP ne'ebé mak hetan permit boot hetan asesu.
Favor hatene katak kada rede ka topolojia boot diferente, no ita presiza adapta ACL ho kada kazu ida-idak.
Permit a Specific host and deny all ather host neé katak ita fo permisaun ba ip ka host ida i block tiha ip ka host tomak iha Network ida nia laran, exemplo ita sei hare tuir topology network ida tuir mai nee:
Topology ida neé ita sei konfigura host 10.0.0.3 sei iha Permisaun asesu ba iha Network 172.16.1.0/24 maibe host sira husi Network 10.0.0.1/24 sei la iha permisaun atu asesu ba iha Network 172.16.1.0/24.
#Konfigursaun iha Router RTR001
hostname Rtr001
!
ip dhcp pool Lantai_III
network 30.0.0.0 255.255.255.0
defaul0.0.1
dns-server 172.16.1.2
!
no ip cef
no ipv6 cef
!
spanning-tree mode pvst
!
interface FastEthernet0/0
ip address 30.0.0.1 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet0/1
ip address 40.0.0.1 255.255.255.0
duplex auto
speed auto
!
interface Ethernet0/0/0
ip address 172.16.1.1 255.255.255.240
ip access-group TEST-II out
duplex auto
speed auto
!
interface Ethernet0/1/0
no ip address
duplex auto
speed auto
!
interface Serial0/3/0
ip address 50.0.0.1 255.255.255.252
!
interface Vlan1
no ip address
shutdown
!
ip classless
ip route 20.0.0.0 255.255.255.0 50.0.0.2
ip route 10.0.0.0 255.255.255.0 50.0.0.2
!
ip flow-export version 9
!
!
ip access-list standard TEST-II
permit host 10.0.0.3
deny 10.0.0.0 0.0.0.255
permit any
!
line con 0
!
line aux 0
!
line vty 0 4
login
!
end
=============================
#Konfigurasaun iha Rtr002
hostname Rtr002
!
ip dhcp pool Lantai_II
network 20.0.0.0 255.255.255.0
default-router 20.0.0.1
dns-server 172.16.1.2
ip dhcp pool Lantai_I
network 10.0.0.0 255.255.255.0
default-router 10.0.0.1
dns-server 172.16.1.2
!
no ip cef
no ipv6 cef
!
!
spanning-tree mode pvst
!
!
interface FastEthernet0/0
ip address 20.0.0.1 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet0/1
ip address 10.0.0.1 255.255.255.0
duplex auto
speed auto
!
interface Ethernet0/0/0
no ip address
duplex auto
speed auto
shutdown
!
interface Ethernet0/1/0
no ip address
duplex auto
speed auto
shutdown
!
interface Serial0/3/0
ip address 50.0.0.2 255.255.255.252
clock rate 2000000
!
interface Vlan1
no ip address
shutdown
!
ip classless
ip route 30.0.0.0 255.255.255.0 50.0.0.1
ip route 40.0.0.0 255.255.255.0 50.0.0.1
ip route 172.16.1.0 255.255.255.240 50.0.0.1
!
ip flow-export version 9
!
!
line con 0
!
line aux 0
!
line vty 0 4
login
!
end
# koko test Ping husi host 10.0.0.3 ba host 172.16.1.3
# koko test ping husi 10.0.0.2 ba host 172.16.1.2
# Loke web browser husi host 10.0.0.3 ba host 172.16.1.2
# Loke Web browser husi host 10.0.0.2 ba host 172.16.1.2
keta haluha koko halo konfigurasaun iha network seluk iha topology neé; atu bele konpriende liu tan konaba access list nia fungsaun.
Hamutuk ita bele dezemvolve cisco iha Timor Leste.
