
此 lab 一定要用 extended 模式,因為 standard 只能限制來源 PCB 過或不過,不能限制只讓它連Srv1
延伸ACL的介面要盡可能靠近拒絕流量的來源,如此才能在不需要的流量流經網路之前將其過濾掉。
To be more precise when matching a certain network traffic, extended access lists are used. With extended access lists, you can match more information, such as:
- source and destination IP address
- type of TCP/IP protocol (TCP, UDP, IP…)
- source and destination port numbers
- service (Telnet、WWW、ftp...)
Two steps are required to configure extended access lists:
1. configure extended access lists using the following command:
(config) access list NUMBER permit|deny IP_PROTOCOL SOURCE_ADDRESS WILDCARD_MASK [PROTOCOL_INFORMATION] DESTINATION_ADDRESS WILDCARD_MASK PROTOCOL_INFORMATION








