码迷,mamicode.com
首页 > 其他好文 > 详细

IPv6 的ACL配置及注意点

时间:2015-01-19 19:15:36      阅读:1215      评论:0      收藏:0      [点我收藏+]

标签:ipv6 acl 配置

IPv6ACL规则如下:

只能使用命名的ACL

2 ACL序号匹配由小到大

默认情况下,隐含permit icmp any any nd-na 和permit icmp anyany nd-ns 用于邻居发现协议的邻居通告和邻居请求,允许接口发送和接收IPv6邻居发现包。

结尾默认隐含 deny ipv6 any any

使用命令ipv6 traffic-filter应用于接口的in or out方向

技术分享

需求:R1配置ACL,禁止R1的环回接口访问R4的环回接口地址;

ACL配置如下,其它配置略:

R1(config)#ipv6 access-list Mao

R1(config-ipv6-acl)#deny 2011::1/1282044::4/128

R1(config-ipv6-acl)#permit any any

R1(config)#int fa0/0

R1(config-if)#ipv6 traffic-filter Mao out

R1#show ipv6 access-list

IPv6 access list Mao

   deny ipv6 host 2011::1 host 2044::4 sequence 10

permit ipv6 anyany sequence 20

R1#ping 2044::4 source 2011::1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2044::4,timeout is 2 seconds:

Packet sent with a source address of2011::1

!!!!!

Success rate is 100 percent (5/5),round-trip min/avg/max = 24/36/52 ms

为什么会ping通呢?是因为命令ipv6 traffic-filter的作用是过滤路由器转发的流量,但不过滤源自本路由器的流量;

现在将ACL进行修改如下,拒绝从R4环回接口发回来的数据包,并将ACL应用至fa0/0的入接口方向上;

R1(config)#ipv6access-list Mao

R1(config-ipv6-acl)#no deny ipv6 host 2011::1 host 2044::4

R1(config-ipv6-acl)#deny ipv6 2044::4/128 2011::1/128

R1(config-ipv6-acl)#permit any any

R1(config-if)#no ipv6 traffic-filter Mao out

R1(config-if)#ipv6 traffic-filter Mao in

R1#ping2044::4 source 2011::1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2044::4,timeout is 2 seconds:

Packet sent with a source address of2011::1

.....

Success rate is 0 percent (0/5)

R1#show access-lists          

IPv6 access list Mao

   deny ipv6 host 2044::4 host 2011::1 (5 matches) sequence 30 //匹配了5个数据包

permit ipv6 anyany (4 matches) sequence 40

总结:命令ipv6traffic-filter不过滤源自本路由器的流量,因此在配置IPv6 ACL时需要注意流量的起源是否来至本路由器。

 

以上例子也可以在R3上配置,如下:

R3(config)#ipv6access-list Mao

R3(config-ipv6-acl)#deny ipv6 2011::1/128 2044::4/128

R3(config-ipv6-acl)#permit any any

R3(config)#int fa0/1

R3(config-if)#ipv6 traffic-filter Mao out

R1#ping 2044::4 source 2011::1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2044::4,timeout is 2 seconds:

Packet sent with a source address of2011::1

SSSSS

Success rate is 0 percent (0/5)

不通,在R1R3之间抓包可知,如下图:

技术分享ICMPv6的类型为1,表示目标不可达,代码字段为5,源地址被入站/出站策略所阻止。


本文出自 “暮云风潇” 博客,请务必保留此出处http://muyun.blog.51cto.com/952166/1605876

IPv6 的ACL配置及注意点

标签:ipv6 acl 配置

原文地址:http://muyun.blog.51cto.com/952166/1605876

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!