注册
登录
| 关键词： nbsp interface ip TELNET access address permit 2.2 255.255 170.1 |
如果R2访问R1，首先需要通过TELNET路由器获得认证，一旦获得，路由器建立一临时访问表使用户能够到达目的主机。通过LOCK-AND-KEY安全，可以指定允许哪些用户访问哪些源或目的主机。LOCK-AND-KEY工作过程1)R2通过虚拟的终端接口远程登陆到R12)R1打开远程对话框并提示输入用户密码，如果通过，允许访问。3)R2随后知道退出对话框，动态表中建立一临时条目项。4）然后R2来的数据流就能够到R15）预定义超时后，临时表删除。 R1 hostname r1!logging rate-limit console 10 except errors!username r2 password 0 r2 用户认证username r2 autocommand access-enable timeout 5 时间限制ip subnet-zerono ip fingerip telnet source-interface Ethernet0 将所有的TELNET数据包的源设置为E0 IP为1。1。1。1 no ip domain-lookup!cns event-service server!!!!!interface Ethernet0 ip address 1.1.1.1 255.255.255.0 no keepalive!interface Serial0 ip address 170.1.12.1 255.255.255.0 ip access-group 100 in clockrate 64000!interface Serial1 no ip address shutdown!ip kerberos source-interface anyno ip classlessip route 2.2.2.0 255.255.255.0 Serial0no ip http server!access-list 1 permit 2.2.2.2access-list 100 dynamic tempaccess permit tcp host 2.2.2.2 host 1.1.1.1 eq telnet logaccess-list 100 permit tcp any host 170.1.12.1 eq telnet logaccess-list 100 deny ip any any log!!line con 0 exec-timeout 0 0 logging synchronous transport input noneline aux 0line vty 0 4 login local 在登陆时启用本地的密码验证!end r2#r2#sh ruBuilding configuration... Current configuration : 738 bytes!version 12.1no service single-slot-reload-enableservice timestamps debug uptimeservice timestamps log uptimeno service password-encryptionservice udp-small-serversservice tcp-small-servers!hostname r2!logging rate-limit console 10 except errors!ip subnet-zerono ip fingerno ip domain-lookup!cns event-service server!!!!!interface Ethernet0 ip address 2.2.2.2 255.255.255.0 no keepalive!interface Serial0 ip address 170.1.12.2 255.255.255.0!interface Serial1 no ip address shutdown!ip kerberos source-interface anyno ip classlessip route 1.1.1.0 255.255.255.0 Serial0no ip http server!!!line con 0 exec-timeout 0 0 logging synchronous transport input noneline aux 0line vty 0 4 login!end 验证检测 r2# telnet 170.1.12.1Trying 170.1.12.1 ... Open User Access Verification Username: r2Password:List#100-tempaccess already contains this IP address pair r1#sh ip access-listsStandard IP access list 1 permit 2.2.2.2Extended IP access list 100 Dynamic tempaccess permit tcp host 2.2.2.2 host 1.1.1.1 eq telnet log permit tcp host 170.1.12.2 host 1.1.1.1 eq telnet log (time left 128) permit tcp any host 170.1.12.1 eq telnet log (159 matches) deny ip any any log |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
