【正文】 wall(config)accesslist 101 permit tcp any any eq 53firewall(config)accesslist 101 permit udp any any eq 53firewall(config)accesslist 101 permit tcp any any eq firewall(config)accesslist 101 permit tcp any any eq ftpfirewall(config)accesslist 101 permit tcp any any eq 20firewall(config)accesslist 101 permit tcp any any eq 443firewall(config)accesslist 101 permit tcp any any eq smtpfirewall(config)accesslist 101 permit tcp any any eq pop3firewall(config)accesslist 101 deny ip any any firewall(config)interface fastEthernet 0/2firewall(configif)ip accessgroup 101 infirewall(configif)^Z%SYS5CONFIG_I: Configured from console by consolewrfirewallwrite Building configuration...[OK] 定義和應(yīng)用LAN口的ACL規(guī)則配置命令如下：firewallconfigure terminal Enter configuration mands, one per line. End with CNTL/Z.firewall(config)accesslist 102 permit tcp any host eq firewall(config)accesslist 102 permit tcp any host eq 443firewall(config)accesslist 102 permit tcp any host range 20 21 firewall(config)accesslist 102 permit icmp any host firewall(config)accesslist 102 permit tcp any host range 20 21firewall(config)accesslist 102 permit tcp any host eq smtpfirewall(config)accesslist 102 permit tcp any host eq pop3firewall(config)accesslist 102 permit udp any host 53firewall(config)accesslist 102 permit tcp any host eq 53firewall(config)accesslist 102 permit tcp any host 67 68firewall(config)accesslist 102 deny ip any any firewall(config)interface fastEthernet 0/1firewall(configif)ip accessgroup 102 infirewall(configif)^Zfirewall%SYS5CONFIG_I: Configured from console by consolefirewallwrite Building configuration...[OK] 定義和應(yīng)用DMZ 口的ACL配置配置命令如下：firewallconf tEnter configuration mands, one per line. End with CNTL/Z.firewall(config)accesslist 103 permit tcp any host eq firewall(config)accesslist 103 permit tcp any host eq 443firewall(config)accesslist 103 permit tcp any host range 20 21firewall(config)accesslist 103 permit icmp any host echoreply firewall(config)accesslist 103 permit tcp any host ra 20 21firewall(config)accesslist 103 permit tcp any host eq smtpfirewall(config)accesslist 103 permit tcp any host eq pop3firewall(config)accesslist 103 permit tcp any host eq 53firewall(config)accesslist 103 permit udp any host eq 53firewall(config)accesslist 103 permit tcp any host 67 68firewall(config)accesslist 103 permit tcp any any eq 53firewall(config)accesslist 103 permit udp any any eq 53firewall(config)accesslist 103 permit tcp any any eq firewall(config)accesslist 103 permit tcp any any eq 443firewall(config)accesslist 103 permit tcp any any range 20 21firewall(config)accesslist 103 permit tcp any any eqfirewall(config)accesslist 103 permit tcp any any eq smtp firewall(config)accesslist 103 permit tcp any any eq pop3firewall(config)accesslist 103 permit icmp any any firewall(config)accesslist 103 deny ip any any firewall(config)interface fastEthernet 0/3firewall(configif)ip accessgroup 103 in firewall(configif)^Z%SYS5CONFIG_I: Configured from console by consolefirewallwrfirewallwrite Building configuration...[OK]第九章 校園網(wǎng)各設(shè)備配置和使用注意事項(xiàng) 校園網(wǎng)各設(shè)備基本參數(shù)和安全性設(shè)置：設(shè)置設(shè)備名稱：Switch（config） hostname ——Router（config） hostname ——設(shè)置設(shè)備的加密使能口令：交換機(jī)：Switch（config） enable secret ——路由器：Router（config） enable secret ——設(shè)置登錄虛擬終端線時的口令：交換機(jī)：Switch（config）line vty 0 4Switch（configline）password ——Switch（configline）login路由器：Router（config）line vty 0 4Router（configline）password ——Router（configline）login設(shè)置console口登錄時的口令：Switch（config）line console 0Switch（configline）password ——路由器一樣（以下省略）設(shè)置終端線超時時間：Switch（config）line vty 0 4Switch（configline） exectimeout 0 0Switch（configline）line console 0Switch（configline） exectimeout 0 0（方便配置）設(shè)置禁用IP地址解析特性：Switch（config）no ip domainlookup設(shè)置啟用消息同步特性：Switch（config）logging synchronous在使用匯聚層或者核心層交換機(jī)時要啟用設(shè)備的路由功能：Switch（config）ip routing ACL在此策劃書中只簡寫了幾個樓層的安全配置，在需要的時候應(yīng)該在每個匯聚層都設(shè)置ACL禁止一些病毒可利用端口，組織病毒在校內(nèi)網(wǎng)的無限傳播，還可以使用基于時間的ACL以控制校內(nèi)學(xué)生上網(wǎng)時間，使學(xué)生合理的安排上網(wǎng)時間。、 通用測試、診斷命令ping traceroute show runningconfig show startupconfigshow sessions disconnectshow users clear lineshutdown no shutdown1show ip arp 1show arp1show interfaces 1show ip interface1show version 1dir flash:1dir nvram 1show debugging1undebug all show cdp 2show cdp neighbors 2show cdp neighbors detail2show cdp entry 2show cdp interface2show cdp traffic 2show ip route2show ip protocols 2show interface vlan vlannum2show macaddresstable show vlan3show spanningtree 3show spanningtree blockedports3show spanningtree detail 3show spanningtree interface3show spanningtree vlan 3show spanningtree sunnary3show ip nat translation 3show ip nat translation verbose3show ip nat statistics debug ip nat4show accesslists 4show ip accesslists33 / 3