Menempatkan ACL
Tujuan
Memeriksa konektifitas jaringan
- Menentukan Access Control Lists (ACLs) yang dikonfigurasikan
pada router - router
- Menentukan interface yang sesuai untuk diterapkannya
ACL
- Menjelaskan pengaruh diterapkannya ACL
Persiapan
Pada aktifitas ini akan ditunjukkan bagaimana aliran trafik
terpengaruh dengan diterapkannya ACL berupa diijinkannya atau ditolaknya
trafik pada jaringan. Administrator jaringan telah memutuskan bahwa semua
trafik web dari luar akan mengarah ke Web server. Selain itu, untuk melindungi data
karyawannya, HR server hanya boleh diakses oleh karyawan HR. Karenanya ACLs akan
diterapkan pada jaringan. Teknisi jaringan telah siap mengkonfigurasikan ACLs baik
d router Gateway maupun router Distribution2. Namun demikian ACLs belum
diimplementasikan di interface. Anda diberi tugas untuk menerapkan ACLs dan
menguji bahwa trafik tersebut sudah diijinkan atau ditolak.
Langkah 1: Memeriksa
koneksi jaringan
a.
Periksa apakah semua PC
dapat berkomunikasi dengan yang lainnya dan dengan server-server.
Pembuktian:
PC>ping 192.168.40.2
Pinging 192.168.40.2 with
32 bytes of data:
Reply from 192.168.40.2:
bytes=32 time=18ms TTL=128
Reply from 192.168.40.2:
bytes=32 time=10ms TTL=128
Reply from 192.168.40.2:
bytes=32 time=7ms TTL=128
Reply from 192.168.40.2:
bytes=32 time=10ms TTL=128
Ping statistics for
192.168.40.2:
Packets: Sent = 4, Received = 4, Lost = 0
(0% loss),
Approximate round trip
times in milli-seconds:
Minimum = 7ms, Maximum = 18ms, Average =
11ms
PC>ping 192.168.0.3
Pinging 192.168.0.3
with 32 bytes of data:
Reply from
192.168.0.3: bytes=32 time=26ms TTL=126
Reply from
192.168.0.3: bytes=32 time=22ms TTL=126
Reply from
192.168.0.3: bytes=32 time=26ms TTL=126
Reply from
192.168.0.3: bytes=32 time=23ms TTL=126
Ping statistics for
192.168.0.3:
Packets: Sent = 4, Received = 4, Lost = 0
(0% loss),
Approximate round trip
times in milli-seconds:
Minimum = 22ms, Maximum = 26ms, Average =
24ms
PC>ping 192.168.10.2
Pinging 192.168.10.2
with 32 bytes of data:
Reply from
192.168.10.2: bytes=32 time=24ms TTL=126
Reply from
192.168.10.2: bytes=32 time=27ms TTL=126
Reply from
192.168.10.2: bytes=32 time=22ms TTL=126
Reply from
192.168.10.2: bytes=32 time=23ms TTL=126
Ping statistics for
192.168.10.2:
Packets: Sent = 4, Received = 4, Lost = 0
(0% loss),
Approximate round trip
times in milli-seconds:
Minimum = 22ms, Maximum = 27ms, Average =
24ms
b. Periksa apakah Internet Host dapat mengakses Web server
(192.168.0.3), Sales server (192.168.10.2) dan HR server (192.168.40.2)
menggunakan browser.
Gambar diatas adalah tampilan web ketika mengakses Server
Web (192.168.0.3)
Gambar diatas adalah tampilan web ketika mengakses Seles
server (192.168.10.2)
Langkah 2: Memeriksa Access Control Lists telah dikonfigurasikan
pada router-router.
a. Akses router Distribution2. Gunakan perintah berikut untuk
melihat apakah ACL telah dikonfigurasikan pada router Distribution2:
- show running-config
Distribution2>ena
Distribution2#sh run
Building configuration...
Current configuration : 1238 bytes
!
version 12.3
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Distribution2
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface FastEthernet0/0
no ip address
duplex auto
speed auto
!
interface FastEthernet0/0.30
encapsulation dot1Q 30
ip address 192.168.30.1
255.255.255.0
!
interface FastEthernet0/0.40
encapsulation dot1Q 40
ip address 192.168.40.1
255.255.255.0
!
interface FastEthernet0/1
no ip address
duplex auto
speed auto
!
interface FastEthernet0/1.31
encapsulation dot1Q 31
ip address 192.168.31.1
255.255.255.0
!
interface FastEthernet0/1.41
encapsulation dot1Q 41
ip address 192.168.41.1
255.255.255.0
!
interface Ethernet0/0/0
ip address 192.168.0.2
255.255.255.0
duplex auto
speed auto
!
interface Ethernet0/1/0
ip address 192.168.1.2
255.255.255.0
duplex auto
speed auto
!
interface Vlan1
no ip address
shutdown
!
router eigrp 100
network 192.168.0.0
network 192.168.1.0
network 192.168.30.0
network 192.168.31.0
network 192.168.40.0
network 192.168.41.0
auto-summary
!
ip classless
ip route 0.0.0.0 0.0.0.0 192.168.0.254
!
!
access-list 1 permit 192.168.40.0 0.0.0.255
!
!
!
!
!
line con 0
line vty 0 4
login
!
!
!
end
- show access-lists 1
Distribution2#sh access-lists 1
Standard IP access list 1
permit 192.168.40.0
0.0.0.255
b. Akses router Gateway. Gunakan perintah berikut untuk melihat
konfigurasi ACL pada router Gateway:
- show running-config
Gateway>en
Gateway#sh run
Building configuration...
Current configuration : 758 bytes
!
version 12.3
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Gateway
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface FastEthernet0/0
ip address 201.11.10.1
255.255.255.252
duplex auto
speed auto
!
interface FastEthernet0/1
ip address 192.168.0.254
255.255.255.0
duplex auto
speed auto
!
interface Serial0/0/0
no ip address
shutdown
!
interface Serial0/0/1
no ip address
shutdown
!
interface Vlan1
no ip address
shutdown
!
ip classless
ip route 192.168.0.0 255.255.0.0 FastEthernet0/1
!
!
access-list 100 permit tcp any host 192.168.0.3 eq www
access-list 100 deny tcp any any eq www
access-list 100 permit ip any any
!
!
!
!
!
line con 0
line vty 0 4
login
!
!
!
end
- show access-lists 100
Gateway#sh access-lists 100
Extended IP access list 100
permit tcp any host
192.168.0.3 eq www
deny tcp any any eq www
permit ip any any
Langkah 4: Menentukan interface yang sesuai untuk menerapkan ACL
a. Setelah memeriksa ACL kemudian menentukan pada interface yang mana
ACL seharusnya diterapkan
b. ACL harus diterapkan pada sebuah interface atau sebuah subinterface
sebelum hal itu berpengaruh terhadap trafik jaringan.
c. Extended ACL seharusnya ditempatkan pada interface yang PALING DEKAT dengan SUMBER dan standard ACL seharusnya diletakkan dengan interface PALING DEKAT dengan TUJUAN.
d. Ingat hanya satu ACL per port, per protocol, per direction yang
diijinkan.
e. Terapkan ACL ke interface atau subinterface yang sesuai
Penentuan
Interface
Dipilih sub-interface fa0/0.40 di Router Distribution2 arah OUT
Distribution2>en
Distribution2#conf
t
Distribution2(config)#int
fa0/0.40
Distribution2(config-subif)#ip
access-group 1 out
Pembuktian
Ketika melakukan ping dari Internet Host ke HR Server
PC>ping
192.168.40.2
Pinging
192.168.40.2 with 32 bytes of data:
Reply
from 192.168.0.2: Destination host unreachable.
Reply
from 192.168.0.2: Destination host unreachable.
Reply
from 192.168.0.2: Destination host unreachable.
Reply
from 192.168.0.2: Destination host unreachable.
Ping
statistics for 192.168.40.2:
Packets: Sent = 4, Received = 0, Lost = 4
(100% loss),
Step 4: Examine the affects of the ACL
a. Internet Host should be able to ping any device in the network,
except HR1 or HR server.
b. Internet Host should be able to access Web server (192.168.0.3) using the browser.
c. Internet Host should not be able to access either the HR server (192.168.40.1) or Sales server (192.168.10.2) using the browser.
d. HR2 should be able to access HR server (192.168.40.1) using ping or the browser.
e. RandD2 should not be able to access HR server(192.168.40.1) using ping or the browser.
b. Internet Host should be able to access Web server (192.168.0.3) using the browser.
c. Internet Host should not be able to access either the HR server (192.168.40.1) or Sales server (192.168.10.2) using the browser.
d. HR2 should be able to access HR server (192.168.40.1) using ping or the browser.
e. RandD2 should not be able to access HR server(192.168.40.1) using ping or the browser.
Reflection
1. How can ACLs be used to control the flow of network traffic?
_______________________________________________________________________________________
_______________________________________________________________________________________
2. By default, what is always the last statement in an ACL?
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
2. By default, what is always the last statement in an ACL?
_______________________________________________________________________________________
_______________________________________________________________________________________
Tidak ada komentar:
Posting Komentar