RACL的配置：
初始配置：
R1:
interface s1/1
ip address 192.168.12.1 255.255.255.0
no shut
ip route 192.168.23.0 255.255.255.0 192.168.12.2
line vty 0 4
password fangtao
login
R2:
interface s1/0
ip address 192.168.12.2 255.255.255.0
no shut
interface s1/1
ip address 192.168.23.2 255.255.255.0
no shut
R3:
interface s1/0
ip address 192.168.23.3 255.255.255.0
no shut
ip route 192.168.12.0 255.255.255.0 192.168.23.2
line vty 0 4
password fangtao
login
在R2上配置RACL：
ip access-list extended INTERNAL
permit icmp any any reflect RACL_icmp
permit tcp any any reflect RACL_tcp
deny ip any any
exit
ip access-list extended EXTERNAL
evaluate RACL_icmp
evaluate RACL_tcp
deny ip any any
exit
在R2的外部接口s1/1上激活RACL
interface s1/1
ip access-group INTERNAL out
ip access-group EXTERNAL in
exit
查看R2的ACL:
r2#sh access-list
Extended IP access list EXTERNAL
10 evaluate RACL_icmp
20 evaluate RACL_tcp
30 deny ip any any
Extended IP access list INTERNAL
10 permit icmp any any reflect RACL_icmp
20 permit tcp any any reflect RACL_tcp
30 deny ip any any
Reflexive IP access list RACL_icmp
Reflexive IP access list RACL_tcp
在R3上ping R1：
r3#ping 192.168.12.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.12.1, timeout is 2 seconds:
U.U.U
Success rate is 0 percent (0/5)
无法ping 通，因为外部接口上的ACL拒绝了该ping包
现在在R1上ping R3：
r1#ping 192.168.23.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.23.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 32/63/100 ms
这下查看R2的ACL，发现RACL_icmp条目中多了一条临时的ACL
r2#sh access-list
Extended IP access list EXTERNAL
10 evaluate RACL_icmp
20 evaluate RACL_tcp
30 deny ip any any (22 matches)
Extended IP access list INTERNAL
10 permit icmp any any reflect RACL_icmp (20 matches)
20 permit tcp any any reflect RACL_tcp
30 deny ip any any
Reflexive IP access list RACL_icmp
permit icmp host 192.168.23.3 host 192.168.12.1 (19 matches) (time left 297)
Reflexive IP access list RACL_tcp
责任编辑：小草
您现在的位置： 