問題?
爲知足業務需求和保證數據訪問安全性,要求市場部不能訪問財務部、研發部,公司總部不能訪問研發部node
過濾策略,可以對接收或發佈的路由進行過濾,能夠調用ACL、ip-prefix等工具來匹配路由,可應用於ISIS、OSPF、BGP等協議。filter-policy分爲import和export兩個方向安全
對協議接收的路由進行過濾:網絡
filter-policy { acl-number | ip-prefix ip-prefix-name } import
對協議發佈的路由進行過濾:app
filter-policy { acl-number | ip-prefix ip-prefix-name } export
場景:R一、R二、R3之間運行RIP協議,要求R2過濾掉其中奇數路由
在R2中查看RIP學習到的路由ide
[R2]display ip routing-table protocol rip Route Flags: R - relay, D - download to fib ------------------------------------------------------------------------------ Public routing table : RIP Destinations : 5 Routes : 5 RIP routing table status : <Active> Destinations : 5 Routes : 5 Destination/Mask Proto Pre Cost Flags NextHop Interface 172.16.1.0/24 RIP 100 1 D 10.1.12.1 GigabitEthernet 0/0/0 172.16.2.0/24 RIP 100 1 D 10.1.12.1 GigabitEthernet 0/0/0 172.16.3.0/24 RIP 100 1 D 10.1.12.1 GigabitEthernet 0/0/0 172.16.4.0/24 RIP 100 1 D 10.1.12.1 GigabitEthernet 0/0/0 172.16.5.0/24 RIP 100 1 D 10.1.12.1 GigabitEthernet 0/0/0 RIP routing table status : <Inactive> Destinations : 0 Routes : 0
在R2上面作filter-policy來實現需求工具
# acl number 2000 rule 5 deny source 172.16.1.0 0.0.6.0 rule 100000 permit #
注意:ACL用於控制平面過濾路由的時候,最後都會有一條隱含拒絕全部,所以須要容許其餘流量放行學習
# rip 1 version 2 filter-policy 2000 import #
注意:在R2的import調用的時候,會影響到R2自己的流量code
[R2]display ip routing-table protocol rip Route Flags: R - relay, D - download to fib ------------------------------------------------------------------------------ Public routing table : RIP Destinations : 2 Routes : 2 RIP routing table status : <Active> Destinations : 2 Routes : 2 Destination/Mask Proto Pre Cost Flags NextHop Interface 172.16.2.0/24 RIP 100 1 D 10.1.12.1 GigabitEthernet 0/0/0 172.16.4.0/24 RIP 100 1 D 10.1.12.1 GigabitEthernet 0/0/0 RIP routing table status : <Inactive> Destinations : 0 Routes : 0
在R3上面查看rip的路由orm
<R3>display ip routing-table protocol rip Route Flags: R - relay, D - download to fib ------------------------------------------------------------------------------ Public routing table : RIP Destinations : 3 Routes : 3 RIP routing table status : <Active> Destinations : 3 Routes : 3 Destination/Mask Proto Pre Cost Flags NextHop Interface 10.1.12.0/24 RIP 100 1 D 10.1.23.2 GigabitEthernet 0/0/1 172.16.2.0/24 RIP 100 2 D 10.1.23.2 GigabitEthernet 0/0/1 172.16.4.0/24 RIP 100 2 D 10.1.23.2 GigabitEthernet 0/0/1 RIP routing table status : <Inactive> Destinations : 0 Routes : 0 <R3>
# rip 1 version 2 network 10.0.0.0 filter-policy 2000 export #
[R2]display ip routing-table protocol rip Route Flags: R - relay, D - download to fib ------------------------------------------------------------------------------ Public routing table : RIP Destinations : 5 Routes : 5 RIP routing table status : <Active> Destinations : 5 Routes : 5 Destination/Mask Proto Pre Cost Flags NextHop Interface 172.16.1.0/24 RIP 100 1 D 10.1.12.1 GigabitEthernet 0/0/0 172.16.2.0/24 RIP 100 1 D 10.1.12.1 GigabitEthernet 0/0/0 172.16.3.0/24 RIP 100 1 D 10.1.12.1 GigabitEthernet 0/0/0 172.16.4.0/24 RIP 100 1 D 10.1.12.1 GigabitEthernet 0/0/0 172.16.5.0/24 RIP 100 1 D 10.1.12.1 GigabitEthernet 0/0/0 RIP routing table status : <Inactive> Destinations : 0 Routes : 0
<R3>display ip routing-table protocol rip Route Flags: R - relay, D - download to fib ------------------------------------------------------------------------------ Public routing table : RIP Destinations : 3 Routes : 3 RIP routing table status : <Active> Destinations : 3 Routes : 3 Destination/Mask Proto Pre Cost Flags NextHop Interface 10.1.12.0/24 RIP 100 1 D 10.1.23.2 GigabitEthernet 0/0/1 172.16.2.0/24 RIP 100 2 D 10.1.23.2 GigabitEthernet 0/0/1 172.16.4.0/24 RIP 100 2 D 10.1.23.2 GigabitEthernet 0/0/1 RIP routing table status : <Inactive> Destinations : 0 Routes : 0
filter-policy在import方向上調用的時候,會影響自身路由表的變化
filter-policy在export方向上調用的時候,不會影響自身路由表的變化router
場景:R一、R二、R3之間運行OSPF協議,要求R2過濾掉其中奇數路由
[R2]display ospf peer brief OSPF Process 1 with Router ID 10.1.12.2 Peer Statistic Information ---------------------------------------------------------------------------- Area Id Interface Neighbor id State 0.0.0.0 GigabitEthernet0/0/0 10.1.12.1 Full 0.0.0.0 GigabitEthernet0/0/1 10.1.23.3 Full ----------------------------------------------------------------------------
[R2]display ip routing-table protocol ospf Route Flags: R - relay, D - download to fib ------------------------------------------------------------------------------ Public routing table : OSPF Destinations : 5 Routes : 5 OSPF routing table status : <Active> Destinations : 5 Routes : 5 Destination/Mask Proto Pre Cost Flags NextHop Interface 172.16.1.1/32 OSPF 10 1 D 10.1.12.1 GigabitEthernet 0/0/0 172.16.2.1/32 OSPF 10 1 D 10.1.12.1 GigabitEthernet 0/0/0 172.16.3.1/32 OSPF 10 1 D 10.1.12.1 GigabitEthernet 0/0/0 172.16.4.1/32 OSPF 10 1 D 10.1.12.1 GigabitEthernet 0/0/0 172.16.5.1/32 OSPF 10 1 D 10.1.12.1 GigabitEthernet 0/0/0 OSPF routing table status : <Inactive> Destinations : 0 Routes : 0
在R2上面作filter-policy來實現需求
# acl number 2000 rule 5 deny source 172.16.1.0 0.0.6.0 rule 100000 permit #
注意:ACL用於控制平面過濾路由的時候,最後都會有一條隱含拒絕全部,所以須要容許其餘流量放行
# ospf 1 filter-policy 2000 import #
查看R2的路由表和R2的LSDB表
[R2]display ip routing-table protocol ospf Route Flags: R - relay, D - download to fib ------------------------------------------------------------------------------ Public routing table : OSPF Destinations : 2 Routes : 2 OSPF routing table status : <Active> Destinations : 2 Routes : 2 Destination/Mask Proto Pre Cost Flags NextHop Interface 172.16.2.0/24 OSPF 10 1 D 10.1.12.1 GigabitEthernet 0/0/0 172.16.4.0/24 OSPF 10 1 D 10.1.12.1 GigabitEthernet 0/0/0 OSPF routing table status : <Inactive> Destinations : 0 Routes : 0
[R2]display ospf lsdb OSPF Process 1 with Router ID 10.1.12.2 Link State Database Area: 0.0.0.0 Type LinkState ID AdvRouter Age Len Sequence Metric Router 10.1.23.3 10.1.23.3 452 36 80000004 1 Router 10.1.12.2 10.1.12.2 457 48 80000007 1 Router 10.1.12.1 10.1.12.1 98 96 80000015 1 Network 10.1.23.3 10.1.23.3 452 32 80000002 0 Network 10.1.12.1 10.1.12.1 507 32 80000002 0
因爲OSPF是鏈路狀態路由協議,傳遞是LSA信息,而你的filter-polic過濾的是路由信息,所以R3路由表中能夠學習到完整的條目
<R3>display ip routing-table protocol ospf Route Flags: R - relay, D - download to fib ------------------------------------------------------------------------------ Public routing table : OSPF Destinations : 6 Routes : 6 OSPF routing table status : <Active> Destinations : 6 Routes : 6 Destination/Mask Proto Pre Cost Flags NextHop Interface 10.1.12.0/24 OSPF 10 2 D 10.1.23.2 GigabitEthernet 0/0/1 172.16.1.0/24 OSPF 10 2 D 10.1.23.2 GigabitEthernet 0/0/1 172.16.2.0/24 OSPF 10 2 D 10.1.23.2 GigabitEthernet 0/0/1 172.16.3.0/24 OSPF 10 2 D 10.1.23.2 GigabitEthernet 0/0/1 172.16.4.0/24 OSPF 10 2 D 10.1.23.2 GigabitEthernet 0/0/1 172.16.5.0/24 OSPF 10 2 D 10.1.23.2 GigabitEthernet 0/0/1 OSPF routing table status : <Inactive> Destinations : 0 Routes : 0 <R3>
[R2]display ip routing-table protocol ospf Route Flags: R - relay, D - download to fib ------------------------------------------------------------------------------ Public routing table : OSPF Destinations : 5 Routes : 5 OSPF routing table status : <Active> Destinations : 5 Routes : 5 Destination/Mask Proto Pre Cost Flags NextHop Interface 172.16.1.0/24 OSPF 10 1 D 10.1.12.1 GigabitEthernet 0/0/0 172.16.2.0/24 OSPF 10 1 D 10.1.12.1 GigabitEthernet 0/0/0 172.16.3.0/24 OSPF 10 1 D 10.1.12.1 GigabitEthernet 0/0/0 172.16.4.0/24 OSPF 10 1 D 10.1.12.1 GigabitEthernet 0/0/0 172.16.5.0/24 OSPF 10 1 D 10.1.12.1 GigabitEthernet 0/0/0 OSPF routing table status : <Inactive> Destinations : 0 Routes : 0 [R2]
# acl number 2000 rule 5 deny source 172.16.1.0 0.0.6.0 rule 100000 permit #
注意:ACL用於控制平面過濾路由的時候,最後都會有一條隱含拒絕全部,所以須要容許其餘流量放行
# ospf 1 filter-policy 2000 import #
[R2]display ip routing-table protocol ospf Route Flags: R - relay, D - download to fib ------------------------------------------------------------------------------ Public routing table : OSPF Destinations : 2 Routes : 2 OSPF routing table status : <Active> Destinations : 2 Routes : 2 Destination/Mask Proto Pre Cost Flags NextHop Interface 172.16.2.0/24 OSPF 10 1 D 10.1.12.1 GigabitEthernet 0/0/0 172.16.4.0/24 OSPF 10 1 D 10.1.12.1 GigabitEthernet 0/0/0 OSPF routing table status : <Inactive> Destinations : 0 Routes : 0
由於R2是ABR路由器。而OSPF在整個區域內是鏈路狀態路由協議,在區域間是距離矢量路由協議,因此,能夠在R2的的import方向上進行過濾動做,故所以R3上面也沒有奇數路由條目
[R3]display ip routing-table protocol ospf Route Flags: R - relay, D - download to fib ------------------------------------------------------------------------------ Public routing table : OSPF Destinations : 3 Routes : 3 OSPF routing table status : <Active> Destinations : 3 Routes : 3 Destination/Mask Proto Pre Cost Flags NextHop Interface 10.1.12.0/24 OSPF 10 2 D 10.1.23.2 GigabitEthernet 0/0/1 172.16.2.0/24 OSPF 10 2 D 10.1.23.2 GigabitEthernet 0/0/1 172.16.4.0/24 OSPF 10 2 D 10.1.23.2 GigabitEthernet 0/0/1 OSPF routing table status : <Inactive> Destinations : 0 Routes : 0
在OSPF進程下進行調用
# ospf 1 filter-policy 2000 export #
[R2]display ip routing-table protocol ospf Route Flags: R - relay, D - download to fib ------------------------------------------------------------------------------ Public routing table : OSPF Destinations : 5 Routes : 5 OSPF routing table status : <Active> Destinations : 5 Routes : 5 Destination/Mask Proto Pre Cost Flags NextHop Interface 172.16.1.0/24 OSPF 10 1 D 10.1.12.1 GigabitEthernet 0/0/0 172.16.2.0/24 OSPF 10 1 D 10.1.12.1 GigabitEthernet 0/0/0 172.16.3.0/24 OSPF 10 1 D 10.1.12.1 GigabitEthernet 0/0/0 172.16.4.0/24 OSPF 10 1 D 10.1.12.1 GigabitEthernet 0/0/0 172.16.5.0/24 OSPF 10 1 D 10.1.12.1 GigabitEthernet 0/0/0 OSPF routing table status : <Inactive> Destinations : 0 Routes : 0
[R3]display ip routing-table protocol ospf Route Flags: R - relay, D - download to fib ------------------------------------------------------------------------------ Public routing table : OSPF Destinations : 6 Routes : 6 OSPF routing table status : <Active> Destinations : 6 Routes : 6 Destination/Mask Proto Pre Cost Flags NextHop Interface 10.1.12.0/24 OSPF 10 2 D 10.1.23.2 GigabitEthernet 0/0/1 172.16.1.0/24 OSPF 10 2 D 10.1.23.2 GigabitEthernet 0/0/1 172.16.2.0/24 OSPF 10 2 D 10.1.23.2 GigabitEthernet 0/0/1 172.16.3.0/24 OSPF 10 2 D 10.1.23.2 GigabitEthernet 0/0/1 172.16.4.0/24 OSPF 10 2 D 10.1.23.2 GigabitEthernet 0/0/1 172.16.5.0/24 OSPF 10 2 D 10.1.23.2 GigabitEthernet 0/0/1 OSPF routing table status : <Inactive> Destinations : 0 Routes : 0
總結:因爲R2和R3之間傳遞的仍是鏈路狀態路由信息
Route-Policy是一種功能很是強大的路由策略工具,它能夠靈活地與ACL、IP-Prefix List、As-Path-Filter等其它工具配合使用
路由策略的做用是當路由器在發佈、接收和引入路由信息時,可根據實際組網須要實施一些策略,以便對路由信息進行過濾或改變路由信息的屬性,如:
控制路由的發佈:只發布知足條件的路由信息。
控制路由的接收:只接收必要、合法的路由信息,以控制路由表的容量,提升網絡的安全性。
過濾和控制引入的路由:一種路由協議在引入其它路由協議時,只引入一部分知足條件的路由信息,並對所引入的路由信息的某些屬性進行設置,以使其知足本協議的要求。
命令語法:
Route-Policy: route-policy route-policy-name { permit | deny } node node if-match {acl/cost/interface/ip next-hop/ip-prefix} apply {cost/ip-address next-hop/tag}
Route-Policy由若干個node構成,node之間是「或」的關係。且每一個node下能夠有若干個if-mach和apply子句,if-match之間是「與」的關係
Route-Policy的每一個node都有相應的permit模式或deny模式
若是是permit模式,則當路由項知足該node的全部if-match子句時,就被容許經過該node的過濾並執行該node的apply子句,且再也不進入下一個node
若是路由項沒有知足該node的全部if-match子句,則會進入下一個node繼續進行過濾。
若是是deny模式,則當路由項知足該node的全部if-match子句時,就被拒絕經過該node的過濾,這時apply子句不會被執行,而且不進入下一個node;不然就進入下一個node繼續進行過濾
若是都沒有匹配成功的話,router-policy默認狀況下是拒絕經過
在R2上面將RIP進程引進OSPF,經過route-policy修改路由的屬性,並將全部奇數路由的cost值修改成100,偶數路由打上路由標記Tag爲200
# acl number 2000 rule 5 permit source 172.16.1.0 0.0.6.0
偶數路由
# acl number 2001 rule 5 permit source 172.16.0.0 0.0.6.0 rule 100000 permit #
# route-policy R2O permit node 10 if-match acl 2000 apply cost 100 # route-policy R2O permit node 20 if-match acl 2001 apply tag 200 # route-policy R2O permit node 1000 #
注意:
後面添加了一條node爲1000的條目 目的是爲了讓其餘路由經過
# ospf 1 import-route rip 1 route-policy R2O #
R3]display ip routing-table protocol ospf Route Flags: R - relay, D - download to fib ------------------------------------------------------------------------------ Public routing table : OSPF Destinations : 6 Routes : 6 OSPF routing table status : <Active> Destinations : 6 Routes : 6 Destination/Mask Proto Pre Cost Flags NextHop Interface 10.1.12.0/24 O_ASE 150 1 D 10.1.23.2 GigabitEthernet 0/0/1 172.16.1.0/24 O_ASE 150 100 D 10.1.23.2 GigabitEthernet 0/0/1 172.16.2.0/24 O_ASE 150 1 D 10.1.23.2 GigabitEthernet 0/0/1 172.16.3.0/24 O_ASE 150 100 D 10.1.23.2 GigabitEthernet 0/0/1 172.16.4.0/24 O_ASE 150 1 D 10.1.23.2 GigabitEthernet 0/0/1 172.16.5.0/24 O_ASE 150 100 D 10.1.23.2 GigabitEthernet 0/0/1 OSPF routing table status : <Inactive> Destinations : 0 Routes : 0
[R3]display ospf lsdb ase OSPF Process 1 with Router ID 10.1.23.3 Link State Database Type : External Ls id : 10.1.23.0 Adv rtr : 10.1.12.2 Ls age : 34 Len : 36 Options : E seq# : 80000002 chksum : 0xade6 Net mask : 255.255.255.0 TOS 0 Metric: 1 E type : 2 Forwarding Address : 0.0.0.0 Tag : 1 Priority : Low Type : External Ls id : 172.16.4.0 Adv rtr : 10.1.12.2 Ls age : 34 Len : 36 Options : E seq# : 80000002 chksum : 0x9499 Net mask : 255.255.255.0 TOS 0 Metric: 1 E type : 2 Forwarding Address : 0.0.0.0 Tag : 200 Priority : Low Type : External Ls id : 172.16.5.0 Adv rtr : 10.1.12.2 Ls age : 505 Len : 36 Options : E seq# : 80000001 chksum : 0x6131 Net mask : 255.255.255.0 TOS 0 Metric: 100 E type : 2 Forwarding Address : 0.0.0.0 Tag : 1 Priority : Low Type : External Ls id : 172.16.2.0 Adv rtr : 10.1.12.2 Ls age : 37 Len : 36 Options : E seq# : 80000002 chksum : 0xaa85 Net mask : 255.255.255.0 TOS 0 Metric: 1 E type : 2 Forwarding Address : 0.0.0.0 Tag : 200 Priority : Low Type : External Ls id : 172.16.3.0 Adv rtr : 10.1.12.2 Ls age : 508 Len : 36 Options : E seq# : 80000001 chksum : 0x771d Net mask : 255.255.255.0 TOS 0 Metric: 100 E type : 2 Forwarding Address : 0.0.0.0 Tag : 1 Priority : Low Type : External Ls id : 172.16.1.0 Adv rtr : 10.1.12.2 Ls age : 510 Len : 36 Options : E seq# : 80000001 chksum : 0x8d09 Net mask : 255.255.255.0 TOS 0 Metric: 100 E type : 2 Forwarding Address : 0.0.0.0 Tag : 1 Priority : Low Type : External Ls id : 10.1.12.0 Adv rtr : 10.1.12.2 Ls age : 42 Len : 36 Options : E seq# : 80000002 chksum : 0x2778 Net mask : 255.255.255.0 TOS 0 Metric: 1 E type : 2 Forwarding Address : 0.0.0.0 Tag : 1 Priority : Low
對比項 | router-policy | ACL或者前綴列表 |
---|---|---|
permit的意思 | 是指將匹配到的路由容許經過或者被執行路由策略 | 是指匹配該路由 |
deny的意思 | 是指將路由進行過濾 | 是指不匹配該路由 |
# acl number 2000 rule 5 deny source 172.16.1.0 0 rule 10 permit source 172.16.2.0 0 acl number 2001 rule 5 deny source 172.16.3.0 0 rule 10 permit source 172.16.4.0 0 #
# route-policy R2O deny node 10 if-match acl 2000 # route-policy R2O permit node 20 if-match acl 2001 apply cost 50 # route-policy R2O permit node 1000 #
# ospf 1 import-route rip 1 route-policy R2O #
第四步:在R3上面查看路由表
<R3>display ip routing-table protocol ospf Route Flags: R - relay, D - download to fib ------------------------------------------------------------------------------ Public routing table : OSPF Destinations : 5 Routes : 5 OSPF routing table status : <Active> Destinations : 5 Routes : 5 Destination/Mask Proto Pre Cost Flags NextHop Interface 10.1.12.0/24 O_ASE 150 1 D 10.1.23.2 GigabitEthernet 0/0/1 172.16.1.0/24 O_ASE 150 1 D 10.1.23.2 GigabitEthernet 0/0/1 172.16.3.0/24 O_ASE 150 1 D 10.1.23.2 GigabitEthernet 0/0/1 172.16.4.0/24 O_ASE 150 50 D 10.1.23.2 GigabitEthernet 0/0/1 172.16.5.0/24 O_ASE 150 1 D 10.1.23.2 GigabitEthernet 0/0/1 OSPF routing table status : <Inactive> Destinations : 0 Routes : 0
在node 10上面,router-policy的匹配模式爲deny,if-match中調用了acl 2000,該節點會匹配到172.16.2.0這條路由,而172.16.1.0在這個節點不會被匹配到,而且會放到下面的節點進行匹配,所以這個節點所實現的做用是將172.16.2.0過濾掉
在node 20上面,router-policy的匹配模式爲permit,if-match中調用了acl 2001,該節點會匹配到172.16.4.0這條路由,而172.16.3.0這個節點會放到下面的節點進行匹配,所以這個節點所實現的做用是將172.16.4.0路由的cost值屬性改成50
在node 30上面,router-policy的匹配模式爲permit,其做用是將前面節點沒有被匹配到的路由所有匹配到,所以在上面的節點未被匹配的172.16.1.0和172.16.3.0將被容許經過,且不修改任何屬性