Filter-Policy(过滤-策略)是一个很常用的路由信息过滤工具,能够对接收、发布、引入的路由进行过滤,可应用于IS-IS、OSPF、BGP等协议。
filter-policy import:不发布路由
filter-policy export:不收路由
filter-policy import:不把路由加入到路由表中
filter-policy export:过滤路由信息、过滤从其它协议引入的路由
1. 实验目的
2. 实验拓扑
Filter-policy实验拓扑如图所示:
3. 实验步骤
(1) 网络连通性
R1的配置
Enter system view, return user view with Ctrl+Z.
[Huawei]sysname R1
[R1]undo info-center enable
Info: Information center is disabled.
[R1]interface g0/0/0
[R1-GigabitEthernet0/0/0]ip address 12.1.1.1 24
[R1-GigabitEthernet0/0/0]quit
R2的配置
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]sysname R2
[R2]interface g0/0/1
[R2-GigabitEthernet0/0/1]ip address 12.1.1.2 24
[R2-GigabitEthernet0/0/1]quit
[R2]interface g0/0/0
[R2-GigabitEthernet0/0/0]ip address 23.1.1.2 24
[R2-GigabitEthernet0/0/0]quit
[R2]interface LoopBack 0
[R2-LoopBack0]ip address 2.2.2.2 32
[R2-LoopBack0]quit
R3的配置
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]sysname R3
[R3]interface g0/0/1
[R3-GigabitEthernet0/0/1]ip address 23.1.1.3 24
[R3-GigabitEthernet0/0/1]quit
[R3]interface LoopBack 0
[R3-LoopBack0]ip address 3.3.3.3 32
[R3-LoopBack0]quit
(2) 配置OSPF
R1的配置
[R1]ospf router-id 1.1.1.1
[R1-ospf-1]area 0
[R1-ospf-1-area-0.0.0.0]network 12.1.1.0 0.0.0.255
[R1-ospf-1-area-0.0.0.0]quit
R2的配置
[R2]ospf router-id 2.2.2.2
[R2-ospf-1]area 0
[R2-ospf-1-area-0.0.0.0]network 2.2.2.2 0.0.0.0
[R2-ospf-1-area-0.0.0.0]network 12.1.1.0 0.0.0.255
[R2-ospf-1-area-0.0.0.0]network 23.1.1.0 0.0.0.255
[R2-ospf-1-area-0.0.0.0]quit
R3的配置
[R3]ospf router-id 3.3.3.3
[R3-ospf-1]area 0
[R3-ospf-1-area-0.0.0.0]network 23.1.1.0 0.0.0.255
[R3-ospf-1-area-0.0.0.0]network 3.3.3.3 0.0.0.0
[R3-ospf-1-area-0.0.0.0]quit
4. 实验调试
(1)在R1上创建四个环回口,IP地址分别为192.168.1.0/24,192.168.2.0/24、192.168.3.0/24、192.168.4.0/24,并且全部宣告进OSPF。
[R1]interface LoopBack 0
[R1-LoopBack0]ip address 192.168.1.1 24
[R1-LoopBack0]ip address 192.168.2.1 24 sub
[R1-LoopBack0]ip address 192.168.3.1 24 sub
[R1-LoopBack0]ip address 192.168.4.1 24 sub
[R1-LoopBack0]ospf enable area 0 //接口的地址都宣告在区域0
[R1-LoopBack0]ospf network-type broadcast //网络类型为广播
(2)在R2和R3上分别查看OSPF的路由表
在R2上查看OSPF的路由表
[R2]display ospf routing
OSPF Process 1 with Router ID 2.2.2.2
Routing Tables
Routing for Network
Destination Cost Type NextHop AdvRouter Area
2.2.2.2/32 0 Stub 2.2.2.2 2.2.2.2 0.0.0.0
12.1.1.0/24 1 Transit 12.1.1.2 2.2.2.2 0.0.0.0
23.1.1.0/24 1 Transit 23.1.1.2 2.2.2.2 0.0.0.0
3.3.3.3/32 1 Stub 23.1.1.3 3.3.3.3 0.0.0.0
192.168.1.0/24 1 Stub 12.1.1.1 1.1.1.1 0.0.0.0
192.168.2.0/24 1 Stub 12.1.1.1 1.1.1.1 0.0.0.0
192.168.3.0/24 1 Stub 12.1.1.1 1.1.1.1 0.0.0.0
192.168.4.0/24 1 Stub 12.1.1.1 1.1.1.1 0.0.0.0
Total Nets: 8
Intra Area: 8 Inter Area: 0 ASE: 0 NSSA: 0
在R3上查看OSPF的路由表
[R3]display ospf routing
OSPF Process 1 with Router ID 3.3.3.3
Routing Tables
Routing for Network
Destination Cost Type NextHop AdvRouter Area
3.3.3.3/32 0 Stub 3.3.3.3 3.3.3.3 0.0.0.0
23.1.1.0/24 1 Transit 23.1.1.3 3.3.3.3 0.0.0.0
2.2.2.2/32 1 Stub 23.1.1.2 2.2.2.2 0.0.0.0
12.1.1.0/24 2 Transit 23.1.1.2 1.1.1.1 0.0.0.0
192.168.1.0/24 2 Stub 23.1.1.2 1.1.1.1 0.0.0.0
192.168.2.0/24 2 Stub 23.1.1.2 1.1.1.1 0.0.0.0
192.168.3.0/24 2 Stub 23.1.1.2 1.1.1.1 0.0.0.0
192.168.4.0/24 2 Stub 23.1.1.2 1.1.1.1 0.0.0.0
Total Nets: 8
Intra Area: 8 Inter Area: 0 ASE: 0 NSSA: 0
通过以上输出可以看到路由器R2和R3都学习到了这4条路由
(3)通过Filter-policy实现在R2上看不到192.168.1.0这条路由,但是在R3上可以看到
第一步:抓取路由
[R2]ip ip-prefix ly index 10 permit 192.168.2.0 24 //创建前缀列表ly允许192.168.2.0
[R2]ip ip-prefix ly index 20 permit 192.168.3.0 24 //创建前缀列表ly允许192.168.3.0
[R2]ip ip-prefix ly index 30 permit 192.168.4.0 24 //创建前缀列表ly允许192.168.4.0
第二步:通过Filter-policy调用
[R2]ospf
[R2-ospf-1]filter-policy ip-prefix ly import
【技术要点】
filter-policy import命令对接收的路由设置过滤策略,只有通过过滤策略的路由才被添加到路由表中,没有通过过滤策略的路由不会被添加进路由表,但不影响对外发布出去。
(4)分别查看R3和R2的路由表
第一步:查看R3的OSPF路由表
[R3]display ospf routing
OSPF Process 1 with Router ID 3.3.3.3
Routing Tables
Routing for Network
Destination Cost Type NextHop AdvRouter Area
3.3.3.3/32 0 Stub 3.3.3.3 3.3.3.3 0.0.0.0
23.1.1.0/24 1 Transit 23.1.1.3 3.3.3.3 0.0.0.0
2.2.2.2/32 1 Stub 23.1.1.2 2.2.2.2 0.0.0.0
12.1.1.0/24 2 Transit 23.1.1.2 1.1.1.1 0.0.0.0
192.168.1.0/24 2 Stub 23.1.1.2 1.1.1.1 0.0.0.0
192.168.2.0/24 2 Stub 23.1.1.2 1.1.1.1 0.0.0.0
192.168.3.0/24 2 Stub 23.1.1.2 1.1.1.1 0.0.0.0
192.168.4.0/24 2 Stub 23.1.1.2 1.1.1.1 0.0.0.0
Total Nets: 8
Intra Area: 8 Inter Area: 0 ASE: 0 NSSA: 0
通过以上输出可以看到R3上四条路由都在路由表里
第二步:查看R2的OSPF路由表
[R2]display ospf routing
OSPF Process 1 with Router ID 2.2.2.2
Routing Tables
Routing for Network
Destination Cost Type NextHop AdvRouter Area
2.2.2.2/32 0 Stub 2.2.2.2 2.2.2.2 0.0.0.0
12.1.1.0/24 1 Transit 12.1.1.2 2.2.2.2 0.0.0.0
23.1.1.0/24 1 Transit 23.1.1.2 2.2.2.2 0.0.0.0
3.3.3.3/32 1 Stub 23.1.1.3 3.3.3.3 0.0.0.0
192.168.1.0/24 1 Stub 12.1.1.1 1.1.1.1 0.0.0.0
192.168.2.0/24 1 Stub 12.1.1.1 1.1.1.1 0.0.0.0
192.168.3.0/24 1 Stub 12.1.1.1 1.1.1.1 0.0.0.0
192.168.4.0/24 1 Stub 12.1.1.1 1.1.1.1 0.0.0.0
Total Nets: 8
Intra Area: 8 Inter Area: 0 ASE: 0 NSSA: 0
通过以上输出可以看到这四个路由也在OSPF的路由表里面
第三步:查看全局路由表
[R2]display ip routing-table
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: Public
Destinations : 10 Routes : 10
Destination/Mask Proto Pre Cost Flags NextHop Interface
2.2.2.2/32 Direct 0 0 D 127.0.0.1 LoopBack0
12.1.1.0/24 Direct 0 0 D 12.1.1.2 GigabitEthernet0/0/1
12.1.1.2/32 Direct 0 0 D 127.0.0.1 GigabitEthernet0/0/1
23.1.1.0/24 Direct 0 0 D 23.1.1.2 GigabitEthernet0/0/0
23.1.1.2/32 Direct 0 0 D 127.0.0.1 GigabitEthernet0/0/0
127.0.0.0/8 Direct 0 0 D 127.0.0.1 InLoopBack0
127.0.0.1/32 Direct 0 0 D 127.0.0.1 InLoopBack0
192.168.2.0/24 OSPF 10 1 D 12.1.1.1 GigabitEthernet0/0/1
192.168.3.0/24 OSPF 10 1 D 12.1.1.1 GigabitEthernet0/0/1
192.168.4.0/24 OSPF 10 1 D 12.1.1.1 GigabitEthernet0/0/1
通过以上输出可以看到全局路由表里面没有192.168.1.0这条路由
【技术要点】
在链路状态路由协议中,各路由设备之间传递的是LSA信息,然后设备根据LSA汇总成的LSDB信息计算出路由表。但是Filter-Policy只能过滤路由信息,无法过滤LSA。
(5)在R1上撤销对192.168.1.0/24、192.168.2.0/24、192.168.3.0/24、192.168.4.0/24这四条路由的宣告,改为引入直连,但是要保证R2和R3上只能收到192.168.1.0这条路由
第一步:撤销路由宣告和Filter-Policy
[R1]interface LoopBack 0
[R1-LoopBack0]undo ospf enable 1 area 0
[R2]undo ip ip-prefix ly
[R2]ospf
[R2-ospf-1]undo filter-policy ip-prefix ly import
第二步:引入直连路由
[R1]ospf
[R1-ospf-1]import-route direct
[R1-ospf-1]quit
第三步:查看R2的路由表
[R2]display ip routing-table
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: Public
Destinations : 12 Routes : 12
Destination/Mask Proto Pre Cost Flags NextHop Interface
2.2.2.2/32 Direct 0 0 D 127.0.0.1 LoopBack0
3.3.3.3/32 OSPF 10 1 D 23.1.1.3 GigabitEthernet0/0/0
12.1.1.0/24 Direct 0 0 D 12.1.1.2 GigabitEthernet0/0/1
12.1.1.2/32 Direct 0 0 D 127.0.0.1 GigabitEthernet0/0/1
23.1.1.0/24 Direct 0 0 D 23.1.1.2 GigabitEthernet0/0/0
23.1.1.2/32 Direct 0 0 D 127.0.0.1 GigabitEthernet0/0/0
127.0.0.0/8 Direct 0 0 D 127.0.0.1 InLoopBack0
127.0.0.1/32 Direct 0 0 D 127.0.0.1 InLoopBack0
192.168.1.0/24 O_ASE 150 1 D 12.1.1.1 GigabitEthernet0/0/1
192.168.2.0/24 O_ASE 150 1 D 12.1.1.1 GigabitEthernet0/0/1
192.168.3.0/24 O_ASE 150 1 D 12.1.1.1 GigabitEthernet0/0/1
192.168.4.0/24 O_ASE 150 1 D 12.1.1.1 GigabitEthernet0/0/1
通过以上输出可以看到引入了四条外部路由
第四步:查看R3的路由表
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: Public
Destinations : 11 Routes : 11
Destination/Mask Proto Pre Cost Flags NextHop Interface
2.2.2.2/32 OSPF 10 1 D 23.1.1.2 GigabitEthernet0/0/1
3.3.3.3/32 Direct 0 0 D 127.0.0.1 LoopBack0
12.1.1.0/24 OSPF 10 2 D 23.1.1.2 GigabitEthernet0/0/1
23.1.1.0/24 Direct 0 0 D 23.1.1.3 GigabitEthernet0/0/1
23.1.1.3/32 Direct 0 0 D 127.0.0.1 GigabitEthernet0/0/1
127.0.0.0/8 Direct 0 0 D 127.0.0.1 InLoopBack0
127.0.0.1/32 Direct 0 0 D 127.0.0.1 InLoopBack0
192.168.1.0/24 O_ASE 150 1 D 23.1.1.2 GigabitEthernet0/0/1
192.168.2.0/24 O_ASE 150 1 D 23.1.1.2 GigabitEthernet0/0/1
192.168.3.0/24 O_ASE 150 1 D 23.1.1.2 GigabitEthernet0/0/1
192.168.4.0/24 O_ASE 150 1 D 23.1.1.2 GigabitEthernet0/0/1
通过以上输出可以看到也引入了四条外部路由
第五步:通过Filter-policy让R2和R3只能收到192.168.1.0这条路由
[R1]ip ip-prefix ly permit 192.168.1.0 24
[R1]ospf
[R1-ospf-1]filter-policy ip-prefix ly export
【技术要点】
第六步:查看R2的路由表
[R2]display ip routing-table
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: Public
Destinations : 9 Routes : 9
Destination/Mask Proto Pre Cost Flags NextHop Interface
2.2.2.2/32 Direct 0 0 D 127.0.0.1 LoopBack0
3.3.3.3/32 OSPF 10 1 D 23.1.1.3 GigabitEthernet0/0/0
12.1.1.0/24 Direct 0 0 D 12.1.1.2 GigabitEthernet0/0/1
12.1.1.2/32 Direct 0 0 D 127.0.0.1 GigabitEthernet0/0/1
23.1.1.0/24 Direct 0 0 D 23.1.1.2 GigabitEthernet0/0/0
23.1.1.2/32 Direct 0 0 D 127.0.0.1 GigabitEthernet0/0/0
127.0.0.0/8 Direct 0 0 D 127.0.0.1 InLoopBack0
127.0.0.1/32 Direct 0 0 D 127.0.0.1 InLoopBack0
192.168.1.0/24 O_ASE 150 1 D 12.1.1.1 GigabitEthernet0/0/1
通过以上输出 可以看到R2的路由表里面只有一条192.168.1.0的外部路由
第七步:查看R3的路由表
[R3]display ip routing-table
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: Public
Destinations : 8 Routes : 8
Destination/Mask Proto Pre Cost Flags NextHop Interface
2.2.2.2/32 OSPF 10 1 D 23.1.1.2 GigabitEthernet0/0/1
3.3.3.3/32 Direct 0 0 D 127.0.0.1 LoopBack0
12.1.1.0/24 OSPF 10 2 D 23.1.1.2 GigabitEthernet0/0/1
23.1.1.0/24 Direct 0 0 D 23.1.1.3 GigabitEthernet0/0/1
23.1.1.3/32 Direct 0 0 D 127.0.0.1 GigabitEthernet0/0/1
127.0.0.0/8 Direct 0 0 D 127.0.0.1 InLoopBack0
127.0.0.1/32 Direct 0 0 D 127.0.0.1 InLoopBack0
192.168.1.0/24 O_ASE 150 1 D 23.1.1.2 GigabitEthernet0/0/1