How to use Unicast Reverse Path Forwarding command with ACL ?

以下範例示範如何使用Unicast RPF搭配ACL及Log紀錄。

在這個範例中,利用extended ACL 197來允許或拒絕特定網路位址範圍的流量。在interface Ethernet0上設定Unicast RPF來檢查到達該介面的封包。

比方說,來源位址192.168.201.10的封包到達Ethernet0會被drop是因為在ACL 197的deny條件(access-list 197 deny ip 192.168.201.0 0.0.0.63 any log-input)。在這個案例中,ACL的資訊會被紀錄下來,被drop的封包數量會針對每個interface及整體為單位加以統計。

來源位址192.168.201.100的封包到達interface Ethernet0/1/1會被轉送因為在ACL 197中的permit條件(access-list 197 permit ip 192.168.201.64 0.0.0.63 any log-input)。ACL資訊像是被drop或是被抑制的封包被紀錄下來,或是轉送至log server。

int eth0/1/1
ip address 192.168.200.225 255.255.255.0
ip verify unicast reverse-path 197
!
int eth0/1/2
ip address 192.168.201.1 255.255.255.0
!
access-list 197 deny ip 192.168.201.0 0.0.0.63 any log-input
access-list 197 permit ip 192.168.201.64 0.0.0.63 any log-input
access-list 197 deny ip 192.168.201.128 0.0.0.63 any log-input
access-list 197 permit ip 192.168.201.192 0.0.0.63 any log-input
access-list 197 deny ip 10.0.0.0 0.255.255.255 any log-input
access-list 197 deny ip 172.16.0.0 0.15.255.255 any log-input
access-list 197 deny ip 192.168.0.0 0.0.255.255 any log-input
Post a Comment

Popular posts from this blog

Pairwise Master Key (PMK) vs Parewise Transient Key(PTK) vs PseudoRandom Function(PRF) vs GTK (Groupwise Transient Key)

DSSS(直接序列展頻技術) vs OFDM(正交頻率多重分割)

DTMF Relay : RTP-NTE vs SIP INFO vs SIP NOTIFY