Краткая шпаргалка по настройке маршрутизаторов cisco

1. Access control list

gw1(config)# ip access-list extended Servers-out
gw1(config-ext-nacl)# remark WEB
gw1(config-ext-nacl)# permit tcp any host 172.16.0.2 eq 80
gw1(config)# int fa0/0.3
gw1(config-subif)# ip access-group Servers-out out

gw1(config)# ip access-list extended Servers-out
gw1(config-ext-nacl)# permit tcp host 172.16.6.66 host 172.16.0.2 range 20 ftp
gw1(config-ext-nacl)# permit tcp host 172.16.6.66 host 172.16.0.2 eq telnet
##file##
gw1(config)# ip access-list extended Servers-out
gw1(config-ext-nacl)# permit tcp 172.16.0.0 0.0.255.255 host 172.16.0.3 eq 445
gw1(config-ext-nacl)# permit tcp any host 172.16.0.3 range 20 21
##mail##
gw1(config)# ip access-list extended Servers-out
gw1(config-ext-nacl)#permit tcp any host 172.16.0.4 eq pop3
gw1(config-ext-nacl)#permit tcp any host 172.16.0.4 eq smtp
##dns##
gw1(config)# ip access-list extended Servers-out
gw1(config-ext-nacl)# permit udp 172.16.0.0 0.0.255.255 host 172.16.0.5 eq 53
##icmp##
gw1(config-ext-nacl)# remark ICMP
gw1(config-ext-nacl)# 1 permit icmp any any

http://www.cisco.com/c/en/us/support/docs/ip/access-lists/26448-ACLsamples.html


2. Объектные группы:

object-group service INET-PORTS
description Ports allowed for some hosts
tcp eq www
tcp eq 8080
tcp eq 443

object-group network HOSTS-TO-INET
description Hosts allowed to browse the net
host 172.16.6.66
host 172.16.6.67
host 172.16.6.68

ip access-list extended INET-OUT
permit object-group INET-PORTS object-group HOSTS-TO-INET any

3. Динамический NAT

Router(config)#access-list 101 permit 172.16.4.0 0.0.0.255
Router(config)#ip nat inside source list 101 interface fa0/1 overload
Router(config)# ip nat inside source static tcp 172.16.6.61 3389 198.51.100.2 3389 -- проброс порта

Полезные команды

show ip access-lists %имя ACL% -- вывод списка правил и кол-ва совпадений по указанному ACL