ena

conf t
vlan 11
exit
vlan 8
exit
vlan 20
exit
int range f0/1-10
sw mod acc
sw acc vlan 11
int range f0/11-15
sw mod acc
sw acc vlan 8
exit
int range f0/16-20
sw mod acc
sw acc vlan 20
exit
int f0/24
sw mod trunk

modo troncal

int f0/24
sw mod trunk

exit

do wr

inter gi0/1.11
enca do 11
ip add 192.168.0.1 255.255.255.128
no shut
exit
inter gi0/1.8
enca do 8
ip add 192.168.0.129 255.255.255.192
no shut
exit

inter gi0/1.11
enca do 11
ip add 192.168.0.193 255.255.255.192
no shut
exit
inter gi0/1.8
enca do 8
ip add 192.168.1.1 255.255.255.224
no shut
exit
inter gi0/1.20
enca do 20
ip add 192.168.1.33 255.255.255.240
no shut
exit

router eigrp 1
network 192.168.0.0
network 192.168.1.0
network 192.168.0.192
network 192.168.0.128
network 192.168.1.48
network 192.168.0.0
no auto-summary
exit

router eigrp 1
network 192.168.0.0
network 192.168.1.0
network 192.168.0.192
network 192.168.0.128
network 192.168.1.48
network 192.168.1.32
network 172.30.40.48
no auto-summary
exit

ip dhcp excluded-address 192.168.1.1 192.168.1.10

ip dhcp excluded-address 192.168.1.33 192.168.1.40
ip dhcp pool Lan_8
network 192.168.1.0 255.255.255.224
default-router 192.168.1.1
exit
ip dhcp pool Lan_20
network 192.168.1.32 255.255.255.240
default-router 192.168.1.33
exit
inter vlan 8
ip add 192.168.1.10 255.255.255.224
exit
inter vlan 20
ip add 192.168.1.40 255.255.255.240
exit

ip dhcp excluded-address 192.168.0.1 192.168.0.10

ip dhcp excluded-address 192.168.0.129 192.168.0.130
ip dhcp pool Lan_11
network 192.168.0.0 255.255.255.128
default-router 192.168.0.1
exit
ip dhcp pool Lan_8
network 192.168.0.128 255.255.255.192
default-router 192.168.0.129
exit
inter vlan 8
ip add 192.168.1.10 255.255.255.224
exit

SSH
ip domain-name REDES.COM
crypto key generate rsa
:1024
line vty 0 4
transport input ssh
login local
username CARLOS privilege 15 password CISCO
enable secret CLASS
encapsulacion y enrutar para otra subinterfaz

DENEGAR SSH

access-list 21 permit 192.168.1.0 0.0.0.255

access-list 21 deny any
line vty 0 4
access-class 21 in
int g0/0
ip access-group 100 out
exit

SOLICITUD DE PING DE UNA SUBRED Y PERMITIR DHCP QUE BRINDA EL SERVIDOR

access-list 100 permit icmp 192.168.1.32 0.0.0.15 host 172.30.40.50

access-list 100 permit udp any any eq bootps
access-list 100 permit udp any any eq bootpc

access-list 101 deny icmp 172.16.0.0 0.0.0.255 host 10.10.20.10

access-list 101 deny icmp 172.16.1.0 0.0.0.255 host 10.10.20.10
access-list 101 deny icmp 172.16.2.0 0.0.0.127 host 10.10.20.10
access-list 101 deny icmp 172.16.2.128 0.0.0.127 host 10.10.20.10
access-list 101 deny icmp 172.16.3.0 0.0.0.63 host 10.10.10.20
access-list 101 deny icmp 172.16.3.64 0.0.0.63 host 10.10.20.10
access-list 101 deny icmp 172.16.3.128 0.0.0.31 host 10.10.20.10
access-list 101 deny icmp 172.16.3.160 0.0.0.15 host 10.10.20.10
access-list 101 permit udp any any eq bootps
access-list 101 permit udp any any eq bootpc
inter gi0/0
ip acc 101 in
exit

ip access-group 102 in
!
access-list 100 permit tcp any any eq www
access-list 100 permit tcp any any eq 21
access-list 100 permit tcp any any eq 20
En el esquema anterior, denegar FTP entre las subredes y permitir todo lo dems.

access-list 101 deny tcp 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255 eq 21

access-list 101 deny tcp 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255 eq 20
access-list 101 permit ip any any
interface F0/1
ip access-group 101 in

Ejemplo 2

En el esquema anterior, denegar solo telnet a la subred 192.168.1.0.

access-list 101 deny tcp 192.168.1.0 0.0.0.255 any eq 23

access-list 101 permit ip any any
interface F0/0
ip access-group 101 out

un host nose comunique con otra subred

access-list 10 deny host 192.168.0.195

access-list 10 permit any

int g0/1.8
ip access-group 10 out
exit