z-notes

ACL实现_TCP单向通讯

1.VMNET1网络设置

都不需要设置任何IP

WIN7

虚拟机选择VMNET1

虚拟机选择仅主机

2.VMNET8网络设置

WIN11

虚拟机选择VMNET8

3.ENSP设置

cloud4

cloud2

AR1

<Huawei>sys
[Huawei]interface GigabitEthernet 0/0/0
[Huawei-GigabitEthernet0/0/0]ip address 192.168.2.1 24
[Huawei-GigabitEthernet0/0/0]quit

[Huawei]interface GigabitEthernet 0/0/1
[Huawei-GigabitEthernet0/0/1]ip address 192.168.3.10 24

4.测试通讯情况

WIN11开启远程桌面

WIN7进行登录WIN11

WIN7开启远程桌面

WIN11登录WIN7

5.设置单向TCP

AR1

[Huawei-acl-adv-3000]rule 5 permit tcp destination 192.168.2.0 0.0.0.255 source 
192.168.3.0 0.0.0.255 tcp-flag ack

[Huawei-acl-adv-3000] rule 10 deny tcp source 192.168.2.0 0.0.0.255 destination 192.168.3.0 0.0.0.255 tcp-flag syn 

[Huawei-acl-adv-3000]quit

[Huawei-GigabitEthernet0/0/0]traffic-filter inbound acl 3000

6.测试

WIN7登录WIN11可以正常通讯

WIN11登录WIN7不能正常通讯