ip redirects问题详解

ip redirect是ICMP协议中规定的一种状态，在此例中所有的数据包都要通过172.16.1.121再转发给防火墙172.16.1.1,121发现1以及所有的客户机都在一个网段内，121就会给客户机发出icmp redirect报文，告诉客户机往外访问的下一跳地址指向172.16.1.1,如果客户机是UNIX操作系统，操作系统会自动在主机路由表中加入这个信息，这样客户机就不必通过172.16.1.121来转发数据包了。但Windows主机好像无此功能，所以就造成了主交换机不断给客户机发icmp redirect报文，导致了整个系统很慢。



所以说：Layer3 Switch与PIX in口连接的时候一般不使用VLAN1，因为可能由于VLAN1的地址重定向功能导至内网访问Internet速度过慢。

解决方案：
1>关闭vlan1的重定向功能
interface vlan1
 no ip redirects

2>将PIX的in口与Layer3的其它VLAN相连

在使用PIX做外出口时，一般都不要分于VLAN1,因为管理上的问题，VLAN1的数据会传到全网。将它分与其它vlan也便于网络的隔离操作。


Cisco 'ICMP redirect' Usage Guidelines

An ICMP redirect message can be generated by a router when a packet is
received and transmitted on the same interface. In this situation, the
router will forward the original packet and send a ICMP redirect
message back to the sender of the original packet. This behavior allows
the sender to bypass the router and forward future packets directly to
the destination (or a router closer to the destination).
There are two types of ICMP redirect messages: redirect for a host
address or redirect for an entire subnet.
The ip icmp redirect command determines the type of ICMP redirects sent
by the system and is configured on a per system basis. Some hosts do
not understand ICMP subnet redirects and need the router to send out
ICMP host redirects. Use the ip icmp redirect host command to have the
router send out ICMP host redirects. Use the ip icmp redirect subnet
command to set the value back to the default, which is to send subnet
redirects.
To prevent the router from sending ICMP redirects, use the no ip
redirects interface configuration command

That meaning is :
ICMP redirects attempt to get a host system (as an example) to send its
packets to the "best" gateway (read router) to get to a particular
destination.

If a host sned a packet to router A and router A has to send it to
router B that is on the same segment, then router A "knows" that the
host is not sending its packet to the best gateway and it send a ICMP
redirect to the host as a hint that it really should be using router B
instead.

[url]http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a0080094702.shtml[/url]

本文出自 “SENSE” 博客，转载请与作者联系！