华为S5700系列交换机使用高级ACL限制不同网段的用户互访

组网图形

使用高级ACL限制不同网段的用户互访示例 

组网需求

如图一所示,某公司通过Switch实现各部门之间的互连。为方便管理网络,管理员为公司的研发部和市场部规划了两个网段的IP地址。同时为了隔离广播域,又将两个部门划分在不同VLAN之中。现要求Switch能够限制两个网段之间互访,防止公司机密泄露。

配置思路

采用如下的思路在Switch上进行配置:

1.   配置高级ACL和基于ACL的流分类,使设备可以对研发部与市场部互访的报文进行过滤。

2.   配置流行为,拒绝匹配上ACL的报文通过。

3.   配置并应用流策略,使ACL和流行为生效。

操作步骤

1.   配置接口所属的VLAN以及接口的IP地址

# 创建VLAN10和VLAN20。

1
2
3
<HUAWEI> system-view
[HUAWEI] sysname Switch
[Switch] vlan batch 10 20

# 配置Switch的接口GE1/0/1和GE1/0/2为trunk类型接口,并分别加入VLAN10和VLAN20。

1
2
3
4
5
6
7
8
[Switch] interface gigabitethernet 1/0/1
[Switch-GigabitEthernet1/0/1] port link-type trunk
[Switch-GigabitEthernet1/0/1] port trunk allow-pass vlan 10
[Switch-GigabitEthernet1/0/1] quit
[Switch] interface gigabitethernet 1/0/2
[Switch-GigabitEthernet1/0/2] port link-type trunk
[Switch-GigabitEthernet1/0/2] port trunk allow-pass vlan 20
[Switch-GigabitEthernet1/0/2] quit

# 创建VLANIF10和VLANIF20,并配置各VLANIF接口的IP地址。

1
2
3
4
5
6
[Switch] interface vlanif 10
[Switch-Vlanif10] ip address 10.1.1.1 24
[Switch-Vlanif10] quit
[Switch] interface vlanif 20
[Switch-Vlanif20] ip address 10.1.2.1 24
[Switch-Vlanif20] quit

2.   配置ACL

# 创建高级ACL 3001并配置ACL规则,拒绝研发部访问市场部的报文通过。

1
2
3
[Switch] acl 3001
[Switch-acl-adv-3001] rule deny ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255
[Switch-acl-adv-3001] quit

# 创建高级ACL 3002并配置ACL规则,拒绝市场部访问研发部的报文通过。

1
2
3
[Switch] acl 3002
[Switch-acl-adv-3002] rule deny ip source 10.1.2.0 0.0.0.255 destination 10.1.1.0 0.0.0.255
[Switch-acl-adv-3002] quit

3.   配置基于高级ACL的流分类

# 配置流分类tc1,对匹配ACL 3001和ACL 3002的报文进行分类。

1
2
3
4
[Switch] traffic classifier tc1
[Switch-classifier-tc1] if-match acl 3001
[Switch-classifier-tc1] if-match acl 3002
[Switch-classifier-tc1] quit

4.   配置流行为

# 配置流行为tb1,动作为拒绝报文通过。

1
2
3
[Switch] traffic behavior tb1
[Switch-behavior-tb1] deny
[Switch-behavior-tb1] quit

5.   配置流策略

# 定义流策略,将流分类与流行为关联。

1
2
3
[Switch] traffic policy tp1
[Switch-trafficpolicy-tp1] classifier tc1 behavior tb1
[Switch-trafficpolicy-tp1] quit

6.   在接口下应用流策略

# 由于研发部和市场部互访的流量分别从接口GE1/0/1和GE1/0/2进入Switch,所以在接口GE1/0/1和GE1/0/2的入方向应用流策略。

1
2
3
4
5
6
[Switch] interface gigabitethernet 1/0/1
[Switch-GigabitEthernet1/0/1] traffic-policy tp1 inbound
[Switch-GigabitEthernet1/0/1] quit
[Switch] interface gigabitethernet 1/0/2
[Switch-GigabitEthernet1/0/2] traffic-policy tp1 inbound
[Switch-GigabitEthernet1/0/2] quit

7.   验证配置结果

# 查看ACL规则的配置信息。

1
2
3
4
5
6
7
8
[Switch] display acl 3001
Advanced ACL 3001, 1 rule                                                     
Acl's step is 5                                                              
 rule 5 deny ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255
[Switch] display acl 3002
Advanced ACL 3002, 1 rule                                                     
Acl's step is 5                                                              
 rule 5 deny ip source 10.1.2.0 0.0.0.255 destination 10.1.1.0 0.0.0.255

# 查看流分类的配置信息。

1
2
3
4
5
6
7
8
9
10
[Switch] display traffic classifier user-defined
  User Defined Classifier Information:
   Classifier: tc1
    Precedence: 5
    Operator: OR
    Rule(s) : if-match acl 3001                                              
              if-match acl 3002
  
 
Total classifier number is 1

# 查看流策略的配置信息。

1
2
3
4
5
6
7
[Switch] display traffic policy user-defined tp1
  User Defined Traffic Policy Information:                                   
  Policy: tp1                                                                
   Classifier: tc1                                                            
    Operator: OR                                                             
     Behavior: tb1                                                           
      Deny

# 研发部和市场部所在的两个网段之间不能互访。

配置文件

Switch的配置文件

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
#
sysname Switch
#
vlan batch 10 20
#
acl number 3001                                                              
 rule 5 deny ip source 10.1.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255     
acl number 3002                                                               
 rule 5 deny ip source 10.1.2.0 0.0.0.255 destination 10.1.1.0 0.0.0.255
#
traffic classifier tc1 operator or precedence 5
if-match acl 3001                                                           
 if-match acl 3002
#
traffic behavior tb1
deny
#
traffic policy tp1 match-order config
classifier tc1 behavior tb1
#
interface Vlanif10
ip address 10.1.1.1 255.255.255.0
#
interface Vlanif20
ip address 10.1.2.1 255.255.255.0
#
interface GigabitEthernet1/0/1
port link-type trunk                                                         
 port trunk allow-pass vlan 10
 traffic-policy tp1 inbound
#
interface GigabitEthernet1/0/2
port link-type trunk                                                        
 port trunk allow-pass vlan 20
 traffic-policy tp1 inbound
#
return
posted @   Chuyio  阅读(8724)  评论(0编辑  收藏  举报
努力加载评论中...
点击右上角即可分享
微信分享提示