网工笔记整理:策略工具Filter-policy的使用

一、概述

Filter-Policy(过滤-策略)是一个很常用的路由信息过滤工具,能够对接收、发布、引入的路由进行过滤,可应用于IS-IS、OSPF、BGP等协议。

  • Filter-policy在距离矢量路由协议中的应用

filter-policy import:不发布路由

filter-policy export:不收路由

  • Filter-policy在链路状态路由协议中的应用

filter-policy import:不把路由加入到路由表中

filter-policy export:过滤路由信息、过滤从其它协议引入的路由

二、实验配置

1. 实验目的

  1. 熟悉Filter-policy的应用场景
  2. 掌握Filter-policy的配置方法

2. 实验拓扑

Filter-policy实验拓扑如图所示:

   网工笔记整理:策略工具Filter-policy的使用_第1张图片          

3. 实验步骤

(1) 网络连通性

R1的配置

system-view

Enter system view, return user view with Ctrl+Z.

[Huawei]sysname R1

[R1]undo info-center enable

Info: Information center is disabled.

[R1]interface g0/0/0

[R1-GigabitEthernet0/0/0]ip address 12.1.1.1 24

[R1-GigabitEthernet0/0/0]quit

R2的配置

system-view

Enter system view, return user view with Ctrl+Z.

[Huawei]undo info-center enable

Info: Information center is disabled.

[Huawei]sysname R2     

[R2]interface g0/0/1

[R2-GigabitEthernet0/0/1]ip address 12.1.1.2 24

[R2-GigabitEthernet0/0/1]quit

[R2]interface g0/0/0

[R2-GigabitEthernet0/0/0]ip address 23.1.1.2 24

[R2-GigabitEthernet0/0/0]quit

[R2]interface LoopBack 0

[R2-LoopBack0]ip address 2.2.2.2 32

[R2-LoopBack0]quit

R3的配置

system-view

Enter system view, return user view with Ctrl+Z.

[Huawei]undo info-center enable

Info: Information center is disabled.

[Huawei]sysname R3

[R3]interface g0/0/1

[R3-GigabitEthernet0/0/1]ip address 23.1.1.3 24

[R3-GigabitEthernet0/0/1]quit

[R3]interface LoopBack 0

[R3-LoopBack0]ip address 3.3.3.3 32

[R3-LoopBack0]quit

(2) 配置OSPF

R1的配置

[R1]ospf router-id 1.1.1.1

[R1-ospf-1]area 0

[R1-ospf-1-area-0.0.0.0]network 12.1.1.0 0.0.0.255

[R1-ospf-1-area-0.0.0.0]quit

R2的配置

[R2]ospf router-id 2.2.2.2

[R2-ospf-1]area 0

[R2-ospf-1-area-0.0.0.0]network 2.2.2.2 0.0.0.0

[R2-ospf-1-area-0.0.0.0]network 12.1.1.0 0.0.0.255

[R2-ospf-1-area-0.0.0.0]network 23.1.1.0 0.0.0.255

[R2-ospf-1-area-0.0.0.0]quit

R3的配置

[R3]ospf router-id 3.3.3.3

[R3-ospf-1]area 0

[R3-ospf-1-area-0.0.0.0]network 23.1.1.0 0.0.0.255

[R3-ospf-1-area-0.0.0.0]network 3.3.3.3 0.0.0.0

[R3-ospf-1-area-0.0.0.0]quit

4. 实验调试

(1)在R1上创建四个环回口,IP地址分别为192.168.1.0/24,192.168.2.0/24、192.168.3.0/24、192.168.4.0/24,并且全部宣告进OSPF。

[R1]interface LoopBack 0

[R1-LoopBack0]ip address 192.168.1.1 24

[R1-LoopBack0]ip address 192.168.2.1 24 sub

[R1-LoopBack0]ip address 192.168.3.1 24 sub

[R1-LoopBack0]ip address 192.168.4.1 24 sub

[R1-LoopBack0]ospf enable area 0  //接口的地址都宣告在区域0

[R1-LoopBack0]ospf network-type broadcast  //网络类型为广播

(2)在R2和R3上分别查看OSPF的路由表

 在R2上查看OSPF的路由表

[R2]display ospf routing

         OSPF Process 1 with Router ID 2.2.2.2

                  Routing Tables

 Routing for Network

 Destination        Cost  Type       NextHop         AdvRouter       Area

 2.2.2.2/32         0     Stub       2.2.2.2         2.2.2.2         0.0.0.0

 12.1.1.0/24        1     Transit    12.1.1.2        2.2.2.2         0.0.0.0

 23.1.1.0/24        1     Transit    23.1.1.2        2.2.2.2         0.0.0.0

 3.3.3.3/32         1     Stub       23.1.1.3        3.3.3.3         0.0.0.0

 192.168.1.0/24     1     Stub       12.1.1.1        1.1.1.1         0.0.0.0

 192.168.2.0/24     1     Stub       12.1.1.1        1.1.1.1         0.0.0.0

 192.168.3.0/24     1     Stub       12.1.1.1        1.1.1.1         0.0.0.0

 192.168.4.0/24     1     Stub       12.1.1.1        1.1.1.1         0.0.0.0

 Total Nets: 8  

 Intra Area: 8  Inter Area: 0  ASE: 0  NSSA: 0

在R3上查看OSPF的路由表

[R3]display ospf routing

         OSPF Process 1 with Router ID 3.3.3.3

                  Routing Tables

 Routing for Network

 Destination        Cost  Type       NextHop         AdvRouter       Area

 3.3.3.3/32         0     Stub       3.3.3.3         3.3.3.3         0.0.0.0

 23.1.1.0/24        1     Transit    23.1.1.3        3.3.3.3         0.0.0.0

 2.2.2.2/32         1     Stub       23.1.1.2        2.2.2.2         0.0.0.0

 12.1.1.0/24        2     Transit    23.1.1.2        1.1.1.1         0.0.0.0

 192.168.1.0/24     2     Stub       23.1.1.2        1.1.1.1         0.0.0.0

 192.168.2.0/24     2     Stub       23.1.1.2        1.1.1.1         0.0.0.0

 192.168.3.0/24     2     Stub       23.1.1.2        1.1.1.1         0.0.0.0

 192.168.4.0/24     2     Stub       23.1.1.2        1.1.1.1         0.0.0.0

 Total Nets: 8  

 Intra Area: 8  Inter Area: 0  ASE: 0  NSSA: 0

通过以上输出可以看到路由器R2和R3都学习到了这4条路由

(3)通过Filter-policy实现在R2上看不到192.168.1.0这条路由,但是在R3上可以看到

第一步:抓取路由

[R2]ip ip-prefix ly index 10 permit 192.168.2.0 24  //创建前缀列表ly允许192.168.2.0

[R2]ip ip-prefix ly index 20 permit 192.168.3.0 24  //创建前缀列表ly允许192.168.3.0

[R2]ip ip-prefix ly index 30 permit 192.168.4.0 24  //创建前缀列表ly允许192.168.4.0

第二步:通过Filter-policy调用

[R2]ospf

[R2-ospf-1]filter-policy ip-prefix ly import

【技术要点】

filter-policy import命令对接收的路由设置过滤策略,只有通过过滤策略的路由才被添加到路由表中,没有通过过滤策略的路由不会被添加进路由表,但不影响对外发布出去。

(4)分别查看R3和R2的路由表

第一步:查看R3的OSPF路由表

[R3]display ospf routing

         OSPF Process 1 with Router ID 3.3.3.3

                  Routing Tables

 Routing for Network

 Destination        Cost  Type       NextHop         AdvRouter       Area

 3.3.3.3/32         0     Stub       3.3.3.3         3.3.3.3         0.0.0.0

 23.1.1.0/24        1     Transit    23.1.1.3        3.3.3.3         0.0.0.0

 2.2.2.2/32         1     Stub       23.1.1.2        2.2.2.2         0.0.0.0

 12.1.1.0/24        2     Transit    23.1.1.2        1.1.1.1         0.0.0.0

 192.168.1.0/24     2     Stub       23.1.1.2        1.1.1.1         0.0.0.0

 192.168.2.0/24     2     Stub       23.1.1.2        1.1.1.1         0.0.0.0

 192.168.3.0/24     2     Stub       23.1.1.2        1.1.1.1         0.0.0.0

 192.168.4.0/24     2     Stub       23.1.1.2        1.1.1.1         0.0.0.0

 Total Nets: 8  

 Intra Area: 8  Inter Area: 0  ASE: 0  NSSA: 0

通过以上输出可以看到R3上四条路由都在路由表里

第二步:查看R2的OSPF路由表

[R2]display ospf routing

         OSPF Process 1 with Router ID 2.2.2.2

                  Routing Tables

 Routing for Network

 Destination        Cost  Type       NextHop         AdvRouter       Area

 2.2.2.2/32         0     Stub       2.2.2.2         2.2.2.2         0.0.0.0

 12.1.1.0/24        1     Transit    12.1.1.2        2.2.2.2         0.0.0.0

 23.1.1.0/24        1     Transit    23.1.1.2        2.2.2.2         0.0.0.0

 3.3.3.3/32         1     Stub       23.1.1.3        3.3.3.3         0.0.0.0

 192.168.1.0/24     1     Stub       12.1.1.1        1.1.1.1         0.0.0.0

 192.168.2.0/24     1     Stub       12.1.1.1        1.1.1.1         0.0.0.0

 192.168.3.0/24     1     Stub       12.1.1.1        1.1.1.1         0.0.0.0

 192.168.4.0/24     1     Stub       12.1.1.1        1.1.1.1         0.0.0.0

 Total Nets: 8  

 Intra Area: 8  Inter Area: 0  ASE: 0  NSSA: 0

通过以上输出可以看到这四个路由也在OSPF的路由表里面

第三步:查看全局路由表

[R2]display ip routing-table

Route Flags: R - relay, D - download to fib

------------------------------------------------------------------------------

Routing Tables: Public

         Destinations : 10       Routes : 10      

Destination/Mask    Proto   Pre  Cost      Flags NextHop         Interface

        2.2.2.2/32  Direct  0    0           D   127.0.0.1       LoopBack0

       12.1.1.0/24  Direct  0    0           D   12.1.1.2        GigabitEthernet0/0/1

       12.1.1.2/32  Direct  0    0           D   127.0.0.1       GigabitEthernet0/0/1

       23.1.1.0/24  Direct  0    0           D   23.1.1.2        GigabitEthernet0/0/0

       23.1.1.2/32  Direct  0    0           D   127.0.0.1       GigabitEthernet0/0/0

      127.0.0.0/8   Direct  0    0           D   127.0.0.1       InLoopBack0

      127.0.0.1/32  Direct  0    0           D   127.0.0.1       InLoopBack0

    192.168.2.0/24  OSPF    10   1           D   12.1.1.1        GigabitEthernet0/0/1

    192.168.3.0/24  OSPF    10   1           D   12.1.1.1        GigabitEthernet0/0/1

    192.168.4.0/24  OSPF    10   1           D   12.1.1.1        GigabitEthernet0/0/1

通过以上输出可以看到全局路由表里面没有192.168.1.0这条路由

【技术要点】

在链路状态路由协议中,各路由设备之间传递的是LSA信息,然后设备根据LSA汇总成的LSDB信息计算出路由表。但是Filter-Policy只能过滤路由信息,无法过滤LSA。

(5)在R1上撤销对192.168.1.0/24、192.168.2.0/24、192.168.3.0/24、192.168.4.0/24这四条路由的宣告,改为引入直连,但是要保证R2和R3上只能收到192.168.1.0这条路由

第一步:撤销路由宣告和Filter-Policy

[R1]interface LoopBack 0

[R1-LoopBack0]undo ospf enable 1 area 0

[R2]undo ip ip-prefix ly

[R2]ospf

[R2-ospf-1]undo filter-policy ip-prefix ly import

第二步:引入直连路由

[R1]ospf

[R1-ospf-1]import-route direct

[R1-ospf-1]quit

第三步:查看R2的路由表

[R2]display ip routing-table

Route Flags: R - relay, D - download to fib

------------------------------------------------------------------------------

Routing Tables: Public

         Destinations : 12       Routes : 12      

Destination/Mask    Proto   Pre  Cost      Flags NextHop         Interface

        2.2.2.2/32  Direct  0    0           D   127.0.0.1       LoopBack0

        3.3.3.3/32  OSPF    10   1           D   23.1.1.3        GigabitEthernet0/0/0

       12.1.1.0/24  Direct  0    0           D   12.1.1.2        GigabitEthernet0/0/1

       12.1.1.2/32  Direct  0    0           D   127.0.0.1       GigabitEthernet0/0/1

       23.1.1.0/24  Direct  0    0           D   23.1.1.2        GigabitEthernet0/0/0

       23.1.1.2/32  Direct  0    0           D   127.0.0.1       GigabitEthernet0/0/0

      127.0.0.0/8   Direct  0    0           D   127.0.0.1       InLoopBack0

      127.0.0.1/32  Direct  0    0           D   127.0.0.1       InLoopBack0

    192.168.1.0/24  O_ASE   150  1           D   12.1.1.1        GigabitEthernet0/0/1

    192.168.2.0/24  O_ASE   150  1           D   12.1.1.1        GigabitEthernet0/0/1

    192.168.3.0/24  O_ASE   150  1           D   12.1.1.1        GigabitEthernet0/0/1

    192.168.4.0/24  O_ASE   150  1           D   12.1.1.1        GigabitEthernet0/0/1

通过以上输出可以看到引入了四条外部路由

第四步:查看R3的路由表

display ip routing-table

Route Flags: R - relay, D - download to fib

------------------------------------------------------------------------------

Routing Tables: Public

         Destinations : 11       Routes : 11      

Destination/Mask    Proto   Pre  Cost      Flags NextHop         Interface

        2.2.2.2/32  OSPF    10   1           D   23.1.1.2        GigabitEthernet0/0/1

        3.3.3.3/32  Direct  0    0           D   127.0.0.1       LoopBack0

       12.1.1.0/24  OSPF    10   2           D   23.1.1.2        GigabitEthernet0/0/1

       23.1.1.0/24  Direct  0    0           D   23.1.1.3        GigabitEthernet0/0/1

       23.1.1.3/32  Direct  0    0           D   127.0.0.1       GigabitEthernet0/0/1

      127.0.0.0/8   Direct  0    0           D   127.0.0.1       InLoopBack0

      127.0.0.1/32  Direct  0    0           D   127.0.0.1       InLoopBack0

    192.168.1.0/24  O_ASE   150  1           D   23.1.1.2        GigabitEthernet0/0/1

    192.168.2.0/24  O_ASE   150  1           D   23.1.1.2        GigabitEthernet0/0/1

    192.168.3.0/24  O_ASE   150  1           D   23.1.1.2        GigabitEthernet0/0/1

    192.168.4.0/24  O_ASE   150  1           D   23.1.1.2        GigabitEthernet0/0/1

通过以上输出可以看到也引入了四条外部路由

第五步:通过Filter-policy让R2和R3只能收到192.168.1.0这条路由

[R1]ip ip-prefix ly permit 192.168.1.0 24  

[R1]ospf

[R1-ospf-1]filter-policy ip-prefix ly export

【技术要点】

  • OSPF通过命令import-route引入外部路由后,为了避免路由环路的产生,通过filter-policy export命令对引入的路由在发布时进行过滤,只将满足条件的外部路由转换为Type5 LSA(AS-external-LSA)并发布出去。
  • 当网络中同时部署了IS-IS和其他路由协议时,如果已经在边界设备上引入其他路由协议的路由,缺省情况下,该设备将把引入的全部外部路由发布给IS-IS邻居。如果只希望将引入的部分外部路由发布给邻居,可以使用filter-policy export命令实现。

第六步:查看R2的路由表

[R2]display ip routing-table

Route Flags: R - relay, D - download to fib

------------------------------------------------------------------------------

Routing Tables: Public

         Destinations : 9        Routes : 9       

Destination/Mask    Proto   Pre  Cost      Flags NextHop         Interface

        2.2.2.2/32  Direct  0    0           D   127.0.0.1       LoopBack0

        3.3.3.3/32  OSPF    10   1           D   23.1.1.3        GigabitEthernet0/0/0

       12.1.1.0/24  Direct  0    0           D   12.1.1.2        GigabitEthernet0/0/1

       12.1.1.2/32  Direct  0    0           D   127.0.0.1       GigabitEthernet0/0/1

       23.1.1.0/24  Direct  0    0           D   23.1.1.2        GigabitEthernet0/0/0

       23.1.1.2/32  Direct  0    0           D   127.0.0.1       GigabitEthernet0/0/0

      127.0.0.0/8   Direct  0    0           D   127.0.0.1       InLoopBack0

      127.0.0.1/32  Direct  0    0           D   127.0.0.1       InLoopBack0

    192.168.1.0/24  O_ASE   150  1           D   12.1.1.1        GigabitEthernet0/0/1

通过以上输出 可以看到R2的路由表里面只有一条192.168.1.0的外部路由

第七步:查看R3的路由表

[R3]display ip routing-table

Route Flags: R - relay, D - download to fib

------------------------------------------------------------------------------

Routing Tables: Public

         Destinations : 8        Routes : 8       

Destination/Mask    Proto   Pre  Cost      Flags NextHop         Interface

        2.2.2.2/32  OSPF    10   1           D   23.1.1.2        GigabitEthernet0/0/1

        3.3.3.3/32  Direct  0    0           D   127.0.0.1       LoopBack0

       12.1.1.0/24  OSPF    10   2           D   23.1.1.2        GigabitEthernet0/0/1

       23.1.1.0/24  Direct  0    0           D   23.1.1.3        GigabitEthernet0/0/1

       23.1.1.3/32  Direct  0    0           D   127.0.0.1       GigabitEthernet0/0/1

      127.0.0.0/8   Direct  0    0           D   127.0.0.1       InLoopBack0

      127.0.0.1/32  Direct  0    0           D   127.0.0.1       InLoopBack0

    192.168.1.0/24  O_ASE   150  1           D   23.1.1.2        GigabitEthernet0/0/1

你可能感兴趣的:(笔记,网络,运维,tcp/ip,数据通信,华为)