扫一扫
分享文章到微信
扫一扫
关注官方公众号
至顶头条
interface Serial 0 ip address 172.16.5.1 255.255.255.0 ip policy route-map sense ! access-list 1 permit 172.16.6.0 0.0.0.255 access-list 2 permit 172.16.7.0 0.0.0.255 ! route-map sense permit 10 match ip address 1 set ip next-hop 172.16.4.2 ! route-map sense permit 20 match ip address 2 set ip next-hop 172.16.4.3 |
<2> Extended ACL
interface Ethernet 0 ip address 172.16.1.4 255.255.255.0 ip policy route-map sense ! access-list 105 permit tcp 172.16.1.0 0.0.0.255 eq ftp any access-list 105 permit tcp 172.16.1.0 0.0.0.255 eq ftp-data any access-list 106 permit tcp 172.16.1.0 0.0.0.255 eq telnet any ! route-map sense permit 10 match ip address 105 set ip next-hop 172.16.2.1 ! route-map sense permit 20 match ip address 106 set ip next-hop 172.16.3.1 |
<3> Length of the Packets
interface Ethernet0 ip address 172.16.1.4 255.255.255.0 ip policy route-map sense ! route-map sense permit 10 match length 1000 1600 set ip next-hop 172.16.2.1 ! route-map sense permit 20 match length 0 400 set ip next-hop 172.16.3.1 |
<4> Router's Packets
interface Ethernet0 ip address 172.16.1.4 255.255.255.0 ip policy route-map sense ! ip local policy route-map sense ! access-list 120 permit ip any 172.16.1.0 0.0.0.255 access-list 120 permit ospf any any ! route-map sense permit 10 match ip address 120 ! route-map sense permit 20 match length 1000 1600 set ip next-hop 172.16.2.1 ! route-map sense permit 30 match length 0 400 set ip next-hop 172.16.3.1 |
注：如果没有第一个route-map条目，router本身的Packets及OSPF的Packets都会由于后两个route-map语句被转发到错误的地址。
Case Study： Policy Routing and Quality of Service Routing
set ip precedence ------------------------------------- Bits Number Keyword 000 0 routine 001 1 priority 010 2 immediate 011 3 flash 100 4 flash-override 101 5 critical 110 6 internet 111 7 network ------------------------------------- set ip tos ------------------------------------- Bits Number Keyword 0000 0 normal 0001 1 min-monetary-cost 0010 2 max-reliability 0100 4 max-throughput 1000 8 min-delay ------------------------------------- interface Serial0 ip address 10.1.18.67 255.255.255.252 ip policy route-map sense ! interface Serial1 ip address 10.34.16.83.255.255.255.252 ip policy route-map sense ! access-list 1 permit 172.16.0.0 0.0.255.255 access-list 110 permit tcp any eq www any ! route-map sense permit 10 match ip address 1 110 set ip precedence critical ! route-map sense permit 20 set ip tos 10 set ip precedence priority Case Study: Route Tagging |
用途：
用于双向重分布时标识特定Domain的路由，以防路由被重分布回起源Domain.
使用方案：
通告路由条目的边缘Router在重分布时给路由条目加上Tag标识，做为Transit Network的Domain，不需要使用和识别Tag，仅仅需要将它传递到它的外部网络即可。
router ospf 1 redistribute igrp 1 metric 10 subnets tag 1 redistribute rip metric 10 subnets route-map sense network 10.100.200.1 0.0.0.0 area 0 ! router rip network 10.0.0.0 ! router igrp 1 network 10.0.0.0 ! access-list 1 permit 10.1.2.3 access-list 2 permit 10.1.2.4 ! route-map sense permit 10 match ip route-source 1 set tag 2 ! route-map sense permit 20 match ip route-source 2 set tag 3 |
（二） Distribute-list
作用：
<1> 控制路由条目的分发，及路由的重分布。
<2> 建立一个"route firewall"
关于路由协议：
Distance Vector Routing Protocol： Route Filtering可以控制其通告/接收的路由条目，及重分布的路由条目。
Link-State Routing Protocol： Route Filtering只可以控制其在重分布时的路由条目。
注： LS Routing Protocol的一个基本的要求就是在一个area内所有Routers的Link State Database必须一致，所以如果Route Filtering能过滤掉LS Routing Protocol的LSA通告，就违背了LS Routing Protocol的规范。
Case Study: Filtering Specific Routes router rip version 2 network 192.168.75.0 distribute-list 1 in Serial1 ! ip classless access 1 permit 0.0.0.0 Case Study: Route Filtering and Redistribution |
注：
distribute-list 命令用于Link-State Routing Protocol时：
与接口联用： 只能使用in参数
与路由进程联用： 只能使用out参数
router ospf 25 redistribute rip metric 100 network 172.16.1.254 0.0.0.0 area 25 network 172.16.8.254 0.0.0.0 area 25 network 172.16.50.254 0.0.0.0 area 25 distribute-list 3 in Ethernet0/0 distribute-list 3 in Ethernet0/1 distribute-list 3 in Ethernet0/2 ! router rip redistribute ospf 25 metric 5 passive-interface Ethernet0/0 passive-interface Ethernet0/1 passive-interface Ethernet0/2 network 192.16.0.0 distribute-list 1 in Ethernet0/3 distribute-list 1 in Ethernet2/0 distribute-ilst 1 in Ethernet2.1 ! ip classless access-list 1 permit 172.16.128.0 0.0.127.255 access-iist 3 permit 172.16.0.0 0.0.127.255 |
<2> 与路由进程联用：
router ospf 25 redistribute rip metric 100 network 172.16.1.254 0.0.0.0 area 25 network 172.16.8.254 0.0.0.0 area 25 network 172.16.50.254 0.0.0.0 area 25 distribute-list 10 out rip ! router rip redistribute ospf 25 metric 5 passive-interface Ethernet0/3 passive-interface Ethernet2/0 passive-interface Ethernet2/1 network 172.16.0.0 distribute-list 20 out ospf 25 ! ip classless access-list 10 permit 172.16.130.0 access-list 10 permit 172.16.145.0 access-list 10 permit 172.16.240.0 access-list 20 permit 172.16.23.0 access-list 20 permit 172.16.9.0 access-list 20 permit 172.16.75.0 |
ip prefix-list list-name description text Case Study: Configuration Example router bgp 3 no synchronization neighbor 172.16.1.2 remote-as 3 neighbor 172.16.20.1 remote-as 1 neighbor 172.16.29.1 prefix-list 1 out no auto-summary ! ip prefix-list 1 seq 5 deny 192.68.10.0/24 ip prefix-list 1 seq 10 permit 0.0.0.0/32 |
router bgp 3 no synchronization neighbor 172.16.1.2 remote-as 3 neighbor 172.16.20.1 remote-as 1 neighbro 172.16.20.1 filter-list 1 out no auto-summary ! ip as-path access-lsit 1 permit ^$ |
（五） 以上过滤命令的执行顺序：
<1> inbound
route-map－>filter-list－>prefix-list，distribute-list
<2> outbound
prefix-list，distribute-list－>filter-list－> route-map
prefix-list，distribute-list用于邻居在一个方向上每次只能用其中的一个
————————————————————————————————————————
总结：
其实这些过滤命令都不是太难，关键是一个过滤的理念。
它们都是很灵活的东西，运用的好，它会有很大的作用；运用得不好，也有可能会有反作用的。
所以说，在配置这些过滤命令的时候，要仔细的斟酌。每一个过滤都要思考一下，当安放到现有的网络会有什么样的效用，这样才不至于等到安放到路由器上以后才认识到过滤的漏洞，才不至于引发安全隐患。
如果您非常迫切的想了解IT领域最新产品与技术信息，那么订阅至顶网技术邮件将是您的最佳途径之一。
5G已至 转型当时——服务提供商如何把握转型的绝佳时机
去集群 更超群——大容量网络演进之路
2019 IBM 中国论坛
H3C 2019 Navigate 领航者峰会
助推数据中心网络现代化转型 打造灵活可靠基础架构平台
京公网安备 11010802021500号