控制路由更新数据流(被动接口和分布列表)
控制路由更新数据流(被动接口和分布列表)
本实验使用拓扑：
在
R1
上建立一个环回口模拟
R4
1
．为什么要控制路由更新
首先假设我们在上面的拓扑中配置
rip
协议。在默认情况下，
r1
将通告以下网络
: 10.1.1 .0 10.1.2 .0 10.1.3 .0 10.1.4 .0
A.
由于子网
10.1.3 .0
没有其他的路由器能接受路由更新。所以向
e0/0
口发送
rip
更新没有意义。不但产生了一些不必要的额外开销，并可能引起安全风险。
B.
若
r1
和
r4
是通过
dial-on-demand(
按需拨号
)
的
ISDN
链路相连，那么定期的路由更新会让链路保持在线状态，从而产生高额的费用。
2
．通过
passive-interface
控制路由更新
被动接口可以完全阻止接口发送路由更新。此命令适用于所有的
IGP
协议。
命令格式：
(config-router)#passive-interface type number
实例
1
：禁止
e
口上发送路由更新。
*Nov 18 08:14:47.639: subnet 10.1.3 .0 metric 1
*Nov 18 08:14:47.639: subnet 10.1.4 .0 metric 1
*Nov 18 08:14:47.891: RIP: sending v1 update to 255.255.255.255 via Serial2/0 ( 10.1.2 .1)
*Nov 18 08:14:47.891: RIP: build update entries
*Nov 18 08:14:47.891: subnet 10.1.1 .0 metric 1
*Nov 18 08:14:47.891: subnet 10.1.3 .0 metric 1
*Nov 18 08:14:47.891: subnet 10.1.4 .0 metric 1
*Nov 18 08:14:57.079: RIP: sending v1 update to 255.255.255.255 via Loopback1 ( 10.1.4 .2)
*Nov 18 08:14:57.079: RIP: build update entries
*Nov 18 08:14:57.079: subnet 10.1.1 .0 metric 1
*Nov 18 08:14:57.079: subnet 10.1.2 .0 metric 1
*Nov 18 08:14:57.079: subnet 10.1.3 .0 metric 1
现在输入这个命令：
R1(config)#router rip
R1(config-router)#passive-interface ethernet 0/0
R1(config-router)#end
观察
debug
信息
*Nov 18 08:15:15.507: RIP: sending v1 update to 255.255.255.255 via Serial1/0 ( 10.1.1 .1)
*Nov 18 08:15:15.507: RIP: build update entries
*Nov 18 08:15:15.507: subnet 10.1.2 .0 metric 1
*Nov 18 08:15:15.507: subnet 10.1.3 .0 metric 1
*Nov 18 08:15:15.507: subnet 10.1.4 .0 metric 1
*Nov 18 08:15:25.967: RIP: sending v1 update to 255.255.255.255 via Loopback1 ( 10.1.4 .2)
*Nov 18 08:15:25.967: RIP: build update entries
*Nov 18 08:15:25.967: subnet 10.1.1 .0 metric 1
*Nov 18 08:15:25.967: subnet 10.1.2 .0 metric 1
*Nov 18 08:15:25.967: subnet 10.1.3 .0 metric 1
*Nov 18 08:15:41.587: RIP: sending v1 update to 255.255.255.255 via Serial1/0 ( 10.1.1 .1)
*Nov 18 08:15:41.587: RIP: build update entries
*Nov 18 08:15:41.587: subnet 10.1.2 .0 metric 1
*Nov 18 08:15:41.587: subnet 10.1.3 .0 metric 1
*Nov 18 08:15:41.587: subnet 10.1.4 .0 metric 1
*Nov 18 08:15:41.639: RIP: sending v1 update to 255.255.255.255 via Serial2/0 ( 10.1.2 .1)
*Nov 18 08:15:41.639: RIP: build update entries
*Nov 18 08:15:41.639: subnet 10.1.1 .0 metric 1
*Nov 18 08:15:41.639: subnet 10.1.3 .0 metric 1
*Nov 18 08:15:41.639: subnet 10.1.4 .0 metric 1
*Nov 18 08:15:55.907: RIP: sending v1 update to 255.255.255.255 via Loopback1 ( 10.1.4 .2)
*Nov 18 08:15:55.907: RIP: build update entries
*Nov 18 08:15:55.907: subnet 10.1.1 .0 metric 1
*Nov 18 08:15:55.907: subnet 10.1.2 .0 metric 1
*Nov 18 08:15:55.907: subnet 10.1.3 .0 metric 1
此时没有
e
口的更新。
此命令在不同协议下的工作方式：
RIP:
只接受路由更新但是不发送
OSPF:
即不发送也不接受
EIGRP
和
OSPF:
不发送
hello
分组，不能在接口上与其他路由器建立邻居关系。
实例
2
：在
OSPF
上运用此命令观察现象。
R1(config)#router ospf 10
R1(config-router)#net 10.1.1 .0 0.0.0.255 area 0
R1(config-router)#net 10.1.2 .0 0.0.0.255 area 0
R1(config-router)#net 10.1.3 .0 0.0.0.255 area 0
R1(config-router)#net 10.1.4 .0 0.0.0.255 area 0
R2(config)#router ospf 10
R2(config-router)#net 10.1.1 .0 0.0.0.255 area 0
R3(config)#router ospf 10
R3(config-router)#net 10.1.2 .0 0.0.0.255 area 0
R1#sho ip ospf nei
Neighbor ID Pri State Dead Time Address Interface
10.1.1 .2 0 FULL/ - 00:00:38 10.1.1 .2 Serial1/0
10.1.2 .2 0 FULL/ - 00:00:35 10.1.2 .2 Serial2/0
R1#debug ip ospf hell
OSPF hello events debugging is on
R1#
*Nov 18 08:32:18.611: OSPF: Rcv hello from 10.1.2 .2 area 0 from Serial2/0 10.1.2.2
*Nov 18 08:32:18.611: OSPF: End of hello processing
*Nov 18 08:32:19.659: OSPF: Send hello to 224.0.0.5 area 0 on Serial1/0 from 10.1.1 .1
*Nov 18 08:32:20.459: OSPF: Send hello to 224.0.0.5 area 0 on Serial2/0 from 10.1.2 .1
*Nov 18 08:32:31.019: OSPF: Send hello to 224.0.0.5 area 0 on Ethernet0/0 from 10.1.3 .1
在接口
s1/0
上运行此命令：
R1(config)#router ospf 10
R1(config-router)#passive-interface serial 1/0
R1#sho ip ospf nei
Neighbor ID Pri State Dead Time Address Interface
10.1.2 .2 0 FULL/ - 00:00:33 10.1.2 .2 Serial2/0
此时发现
10.1.1 .2
这个邻居已经没有了。
3
．用分布控制列表过滤路由更新
分布控制列表只抑制某些特定的路由不被发送或接受。
命令格式：
A.
应用于进入路由更新
(config-router)#distribute-list access-list number
in
{interfacename}
B.
应用于出口路由更新
(config-router)#distribute-list access-listnumber
out
(interface name |routing pro|as-number)
实例
3
：禁止
R2
接受有关于网络
10.1.2 .0
的路由更新
R2#sho ip rou
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF , IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
10.0.0 .0/24 is subnetted, 4 subnets
R 10.1.3 .0 [120/1] vi a 10.1.1 .1, 00:00:07, Serial2/0
R 10.1.2 .0 [120/1] vi a 10.1.1 .1, 00:00:07, Serial2/0
C 10.1.1 .0 is directly connected, Serial2/0
R 10.1.4 .0 [120/1] vi a 10.1.1 .1, 00:00:07, Serial2/0
R2(config)#access-list 1 deny 10.1.2 .0
R2(config)#access-list 1 permit any
R2(config)#router rip
R2(config-router)#distribute-list 1 in
180s
后查看路由表：
R2#sh ip rou
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF , IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
10.0.0 .0/24 is subnetted, 4 subnets
R 10.1.3 .0 [120/1] vi a 10.1.1 .1, 00:00:16, Serial2/0
R 10.1.2 .0/24 is possibly down,
routing vi a 10.1.1 .1, Serial2/0
C 10.1.1 .0 is directly connected, Serial2/0
R 10.1.4 .0 [120/1] vi a 10.1.1 .1, 00:00:16, Serial2/0
实例
4
：利用
distribute-list
“伪”被动
EIGRP OSPF
的接口。观察效果。
R1(config)#router eigrp 10
R1(config-router)#net 10.1.1 .0 0.0.0.255
R1(config-router)#net 10.1.2 .0 0.0.0.255
R1(config-router)#net 10.1.3 .0 0.0.0.255
R1(config-router)#net 10.1.4 .0 0.0.0.255
R2(config)#router eigrp 10
R2(config-router)#net 10.1.1 .0 0.0.0.255
R3(config)#router eigrp 10
R3(config-router)#net 10.1.2 .0 0.0.0.255
R2#sho ip rou
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF , IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
10.0.0 .0/8 is variably subnetted, 5 subnets, 2 masks
D 10.1.3 .0/24 [90/2195456] vi a 10.1.1 .1, 00:00:27, Serial2/0
D 10.1.2 .0/24 [90/2681856] vi a 10.1.1 .1, 00:00:27, Serial2/0
C 10.1.1 .0/24 is directly connected, Serial2/0
D 10.1.4 .0/24 [90/2297856] vi a 10.1.1 .1, 00:00:27, Serial2/0
R2#sho ip eigrp nei
IP-EIGRP neighbors for process 10
H Address Interface Hold Uptime SRTT RTO Q Seq
(sec) (ms) Cnt Num
0 10.1.1 .1 Se2/0 11 00:03:42 283 1698 0 1
R2(config)#access-list 3 deny any
R2(config)#router eigrp 10
R2(config-router)#distribute-list 3 out serial 1/0
在
240s
后查看路由表
R2#sho ip rou
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF , IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
10.0.0 .0/8 is variably subnetted, 5 subnets, 2 masks
D 10.1.3 .0/24 [90/2195456] vi a 10.1.1 .1,
00:11:54
, Serial2/0
D 10.1.2 .0/24 [90/2681856] vi a 10.1.1 .1,
00:11:54,
Serial2/0
C 10.1.1 .0/24 is directly connected, Serial2/0
O 10.1.4 .2/32 [110/65] vi a 10.1.1 .1, 00:19:37, Serial2/0
D 10.1.4 .0/24 [90/2297856] vi a 10.1.1 .1, 00:11:54, Serial2/0
此时发现路由器已经有很长时间没有收到路由更新。
R2#sho ip eigrp nei
IP-EIGRP neighbors for process 10
H Address Interface Hold Uptime SRTT RTO Q Seq
(sec) (ms) Cnt Num
0 10.1.1 .1 Se2/0 13 00:13:45 60 360 0 3
发现邻居信息依然存在。说明利用分布列表仍然可以保持邻居信息。
总结：
RIP
和
IGRP
不用和邻接路由器建立邻接关系，当配置了
'passive interface'
后，该路由器仅从相应的接口收听相应的路由协议包，而不发送路由协议包。
'passive interface'
对
OSPF
，
EIGRP
则意义不大，因为这两种路由协议都要建立邻接关系。路由包不容许发送，邻接关系就建立不起来。因此在
OSPF
，
EIGRP
中，这条命令很少用到。
而分布列表对于任何网络协议都是一个比较好的解决显示问题的方法。它可以
“
伪被动
”
端口但是同时保持邻居信息。