动态访问列表

如果R2访问R1，首先需要通过TELNET路由器获得认证，一旦获得，路由器建立一临时访问表使用户能够到达目的主机。
通过LOCK-AND-KEY安全，可以指定允许哪些用户访问哪些源或目的主机。
LOCK-AND-KEY工作过程
1)R2通过虚拟的终端接口远程登陆到R1
2)R1打开远程对话框并提示输入用户密码，如果通过，允许访问。
3)R2随后知道退出对话框，动态表中建立一临时条目项。
4）然后R2来的数据流就能够到R1
5）预定义超时后，临时表删除。

R1

hostname r1
!
logging rate-limit console 10 except errors
!
username r2 password 0 r2 用户认证
username r2 autocommand access-enable timeout 5 时间限制
ip subnet-zero
no ip finger
ip telnet source-interface Ethernet0 将所有的TELNET数据包的源设置为E0
IP为1。1。1。1

no ip domain-lookup
!
cns event-service server
!
!
!
!
!
interface Ethernet0
ip address 1.1.1.1 255.255.255.0
no keepalive
!
interface Serial0
ip address 170.1.12.1 255.255.255.0
ip access-group 100 in
clockrate 64000
!
interface Serial1
no ip address
shutdown
!
ip kerberos source-interface any
no ip classless
ip route 2.2.2.0 255.255.255.0 Serial0
no ip http server
!
access-list 1 permit 2.2.2.2
access-list 100 dynamic tempaccess permit tcp host 2.2.2.2 host 1.1.1.1 eq telnet log
access-list 100 permit tcp any host 170.1.12.1 eq telnet log
access-list 100 deny ip any any log
!
!
line con 0
exec-timeout 0 0
logging synchronous
transport input none
line aux 0
line vty 0 4

login local 在登陆时启用本地的密码验证
!
end

r2#
r2#sh ru
Building configuration...

Current configuration : 738 bytes
!
version 12.1
no service single-slot-reload-enable
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
service udp-small-servers
service tcp-small-servers
!
hostname r2
!
logging rate-limit console 10 except errors
!
ip subnet-zero
no ip finger
no ip domain-lookup
!
cns event-service server
!
!
!
!
!
interface Ethernet0
ip address 2.2.2.2 255.255.255.0
no keepalive
!
interface Serial0
ip address 170.1.12.2 255.255.255.0
!
interface Serial1
no ip address
shutdown
!
ip kerberos source-interface any
no ip classless
ip route 1.1.1.0 255.255.255.0 Serial0
no ip http server
!
!
!
line con 0
exec-timeout 0 0
logging synchronous
transport input none
line aux 0
line vty 0 4
login
!
end

验证检测

r2# telnet 170.1.12.1
Trying 170.1.12.1 ... Open

User Access Verification

Username: r2
Password:
List#100-tempaccess already contains this IP address pair

r1#sh ip access-lists
Standard IP access list 1
permit 2.2.2.2
Extended IP access list 100
Dynamic tempaccess permit tcp host 2.2.2.2 host 1.1.1.1 eq telnet log
permit tcp host 170.1.12.2 host 1.1.1.1 eq telnet log (time left 128)
permit tcp any host 170.1.12.1 eq telnet log (159 matches)
deny ip any any log

标签：

版权申明：本站文章部分自网络，如有侵权，请联系：west999com@outlook.com
特别注意：本站所有转载文章言论不代表本站观点，本站所提供的摄影照片，插画，设计作品，如需使用，请与原作者联系，版权归原作者所有