Learning IOS and JUNOS

以下範例示範如何使用Unicast RPF搭配ACL及Log紀錄。 在這個範例中，利用extended ACL 197來允許或拒絕特定網路位址範圍的流量。在interface Ethernet0上設定Unicast RPF來檢查到達該介面的封包。 比方說，來源位址192.168.201.10的封包到達Ethernet0會被drop是因為在ACL 197的deny條件(access-list 197 deny ip 192.168.201.0 0.0.0.63 any log-input)。在這個案例中，ACL的資訊會被紀錄下來，被drop的封包數量會針對每個interface及整體為單位加以統計。 來源位址192.168.201.100的封包到達interface Ethernet0/1/1會被轉送因為在ACL 197中的permit條件(access-list 197 permit ip 192.168.201.64 0.0.0.63 any log-input)。ACL資訊像是被drop或是被抑制的封包被紀錄下來，或是轉送至log server。 int eth0/1/1 ip address 192.168.200.225 255.255.255.0 ip verify unicast reverse-path 197 ! int eth0/1/2 ip address 192.168.201.1 255.255.255.0 ! access-list 197 deny ip 192.168.201.0 0.0.0.63 any log-input access-list 197 permit ip 192.168.201.64 0.0.0.63 any log-input access-list 197 deny ip 192.168.201.128 0.0.0.63 any log-input access-list 197 permit ip 192.168.201.192 0.0.0.63 any log-input access-list 197 deny ip 10.0.0.0 0.255.255.255 any log-input access-list 197 deny ip 172.16.0.0 0.15.255.255 a...

Benefits of Lock-and-Key Lock-and-key provides the same benefits as standard and static extended access lists (these benefits are discussed in the chapter "Access Control Lists: Overview and Guidelines"). However, lock-and-key also has the following security benefits over standard and static extended access lists: Lock-and-key uses a challenge mechanism to authenticate individual users. Lock-and-key provides simpler management in large internetworks. In many cases, lock-and-key reduces the amount of router processing required for access lists. Lock-and-key reduces the opportunity for network break-ins by network hackers. With lock-and-key, you can specify which users are permitted access to which source and destination hosts. These users must pass a user authentication process before they are permitted access to their designated hosts. Lock-and-key creates dynamic user access through a firewall, without compromising other configured security restrictions. When to Use Lock-an...

Benefits The ability to apply sequence numbers to IP access list entries simplifies access list changes. Prior to the IP Access List Entry Sequence Numbering feature, there was no way to specify the position of an entry within an access list. If a user wanted to insert an entry (statement) in the middle of an existing list, all of the entries after the desired position had to be removed, then the new entry was added, and then all the removed entries had to be reentered. This method was cumbersome and error prone. This feature allows users to add sequence numbers to access list entries and resequence them. When a user adds a new entry, the user chooses the sequence number so that it is in a desired position in the access list. If necessary, entries currently in the access list can be resequenced to create room to insert the new entry. Sequence Numbering Behavior For backward compatibility with previous releases, if entries with no sequence numbers are applied, the first entry is assigne...