ACL（访问控制列表）之包过滤组网实现

最新推荐文章于 2026-06-20 16:32:51 发布

原创最新推荐文章于 2026-06-20 16:32:51 发布 · 151 阅读

4 ·

本内容遵循CC 4.0 BY-SA版权协议

GEO检测

标签

#网络

今天我们来介绍一下访问控制列表ACL，ACL用于在网络设备中抓取链路，进而根据抓取的流量实现很多功能。比如包过滤、QOS限速和带宽保障、NAT、策略路由、路由策略、流量统计、抓包或者debug等。今天我们来讲一下ACL之包过滤组网实现。

一组网与用户需求

如上图：

下面是汇聚交换机，其下面有3个办公网段，分别是192.168.1.0、192.168.2.0、192.168.3.0，网关在汇聚交换机，汇聚交换机与核心交换机三层路由互联

核心交换机上面有5个网段，分别是192.168.11.0、192.168.12.0、192.168.13.0，是办公网； 192.168.200.0属于数据中心网络，10.1.1.0属于其他网络，网关也在核心交换机；192.168.100.0属于互联地址。

整个网络运行ospf达到互联互通。

现在汇聚交换机下办公网之间不允许互通，核心交换机下面的办公网之间不允许互通，汇聚和核心下面的办公网也不允许互访

但是汇聚、核心交换机下面的办公网可以访问数据中心、其他网络和互联地址

二设备配置

2.1 核心交换机设备配置

sysname HX

ospf 1

area 0.0.0.0

network 10.1.1.0 0.0.0.255

network 192.168.11.0 0.0.0.255

network 192.168.12.0 0.0.0.255

network 192.168.13.0 0.0.0.255

network 192.168.100.0 0.0.0.3

network 192.168.200.0 0.0.0.255

vlan 11 to 13

vlan 100

vlan 200

vlan 1000

acl advanced 3000 //定义acl规划抓取数据流

rule 0 permit ip source 192.168.0.0 0.0.255.255 destination 192.168.100.0 0.0.0.3

rule 1 permit ip source 192.168.0.0 0.0.255.255 destination 192.168.200.0 0.0.0.255

rule 2 deny ip source 192.168.0.0 0.0.255.255 destination 192.168.0.0 0.0.255.255

rule 100 permit ip

interface Vlan-interface11

ip address 192.168.11.1 255.255.255.0

packet-filter 3000 inbound //应用包过滤

interface Vlan-interface12

ip address 192.168.12.1 255.255.255.0

packet-filter 3000 inbound

interface Vlan-interface13

ip address 192.168.13.1 255.255.255.0

packet-filter 3000 inbound

interface Vlan-interface100

ip address 192.168.100.1 255.255.255.252

interface Vlan-interface200

ip address 192.168.200.1 255.255.255.0

interface Vlan-interface1000

ip address 10.1.1.1 255.255.255.0

2.2 汇聚交换机设备配置

sysname HuiJu

ospf 1

area 0.0.0.0

network 192.168.1.0 0.0.0.255

network 192.168.2.0 0.0.0.255

network 192.168.3.0 0.0.0.255

network 192.168.100.0 0.0.0.3

vlan 1

vlan 2 to 3

vlan 100

acl advanced 3000 //定义acl规划抓取数据流

rule 0 permit ip source 192.168.0.0 0.0.255.255 destination 192.168.100.0 0.0.0.3

rule 1 permit ip source 192.168.0.0 0.0.255.255 destination 192.168.200.0 0.0.0.255

rule 2 deny ip source 192.168.0.0 0.0.255.255 destination 192.168.0.0 0.0.255.255

rule 100 permit ip

interface Vlan-interface1

ip address 192.168.1.1 255.255.255.0

packet-filter 3000 inbound

interface Vlan-interface2

ip address 192.168.2.1 255.255.255.0

packet-filter 3000 inbound

interface Vlan-interface3

ip address 192.168.3.1 255.255.255.0

packet-filter 3000 inbound

interface Vlan-interface100

ip address 192.168.100.2 255.255.255.252

interface GigabitEthernet1/0/1

port link-mode bridge

port access vlan 100

combo enable fiber

interface GigabitEthernet1/0/2

port link-mode bridge

combo enable fiber

interface GigabitEthernet1/0/3

port link-mode bridge

port access vlan 2

combo enable fiber

interface GigabitEthernet1/0/4

port link-mode bridge

port access vlan 3

combo enable fiber

三路由查看

3.1 核心交换机查看OSPF邻居和路由

<HX>dis ospf peer

OSPF Process 1 with Router ID 192.168.200.1

Neighbor Brief Information

Area: 0.0.0.0

Router ID Address Pri Dead-Time State Interface

192.168.100.2 192.168.100.2 1 37 Full/BDR Vlan100

<HX>

<HX>dis ip routing-table

Destinations : 35 Routes : 35

Destination/Mask Proto Pre Cost NextHop Interface

192.168.1.0/24 O_INTRA 10 2 192.168.100.2 Vlan100

192.168.2.0/24 O_INTRA 10 2 192.168.100.2 Vlan100

192.168.3.0/24 O_INTRA 10 2 192.168.100.2 Vlan100

192.168.11.0/24 Direct 0 0 192.168.11.1 Vlan11

3.2 汇聚交换机查看OSPF邻居和路由

<HuiJu>dis ospf peer

OSPF Process 1 with Router ID 192.168.100.2

Neighbor Brief Information

Area: 0.0.0.0

Router ID Address Pri Dead-Time State Interface

192.168.200.1 192.168.100.1 1 36 Full/DR Vlan100

<HuiJu>

<HuiJu>dis ip route

<HuiJu>dis ip rou

<HuiJu>dis ip routing-table

Destinations : 29 Routes : 29

Destination/Mask Proto Pre Cost NextHop Interface

10.1.1.0/24 O_INTRA 10 2 192.168.100.1 Vlan100

192.168.11.0/24 O_INTRA 10 2 192.168.100.1 Vlan100

192.168.12.0/24 O_INTRA 10 2 192.168.100.1 Vlan100

192.168.13.0/24 O_INTRA 10 2 192.168.100.1 Vlan100

192.168.200.0/24 O_INTRA 10 2 192.168.100.1 Vlan100

<HuiJu>

四业务测试-需求实现

4.1 PC1测试除办公网外其他都可以访问

<PC1>ping -c 2 192.168.2.1

Ping 192.168.2.1 (192.168.2.1): 56 data bytes, press CTRL+C to break

Request time out

<PC1>ping -c 2 192.168.3.1

Ping 192.168.3.1 (192.168.3.1): 56 data bytes, press CTRL+C to break

Request time out

<PC1>ping -c 2 192.168.11.1

Ping 192.168.11.1 (192.168.11.1): 56 data bytes, press CTRL+C to break

Request time out

<PC1>ping -c 2 192.168.12.1

Ping 192.168.12.1 (192.168.12.1): 56 data bytes, press CTRL+C to break

Request time out

<PC1>

<PC1>ping -c 2 192.168.13.1

Ping 192.168.13.1 (192.168.13.1): 56 data bytes, press CTRL+C to break

Request time out

<PC1>ping -c 2 192.168.100.1

Ping 192.168.100.1 (192.168.100.1): 56 data bytes, press CTRL+C to break

56 bytes from 192.168.100.1: icmp_seq=0 ttl=254 time=1.174 ms

56 bytes from 192.168.100.1: icmp_seq=1 ttl=254 time=1.652 ms

<PC1>ping -c 2 192.168.200.1

Ping 192.168.200.1 (192.168.200.1): 56 data bytes, press CTRL+C to break

56 bytes from 192.168.200.1: icmp_seq=0 ttl=254 time=0.967 ms

56 bytes from 192.168.200.1: icmp_seq=1 ttl=254 time=0.734 ms

<PC1>ping -c 2 10.1.1.1

Ping 10.1.1.1 (10.1.1.1): 56 data bytes, press CTRL+C to break

56 bytes from 10.1.1.1: icmp_seq=0 ttl=254 time=1.225 ms

56 bytes from 10.1.1.1: icmp_seq=1 ttl=254 time=1.423 ms

<PC1>

4.2 PC2测试除办公网外其他都可以访问

<PC2>

<PC2>ping -c 2 192.168.1.1

Ping 192.168.1.1 (192.168.1.1): 56 data bytes, press CTRL+C to break

Request time out

<PC2>ping -c 2 192.168.3.1

Ping 192.168.3.1 (192.168.3.1): 56 data bytes, press CTRL+C to break

Request time out

<PC2>ping -c 2 192.168.11.1

Ping 192.168.11.1 (192.168.11.1): 56 data bytes, press CTRL+C to break

Request time out

<PC2>ping -c 2 192.168.12.1

Ping 192.168.12.1 (192.168.12.1): 56 data bytes, press CTRL+C to break

Request time out

<PC2>ping -c 2 192.168.13.1

Ping 192.168.13.1 (192.168.13.1): 56 data bytes, press CTRL+C to break

Request time out

<PC2>ping -c 2 192.168.100.1

Ping 192.168.100.1 (192.168.100.1): 56 data bytes, press CTRL+C to break

56 bytes from 192.168.100.1: icmp_seq=0 ttl=254 time=1.549 ms

56 bytes from 192.168.100.1: icmp_seq=1 ttl=254 time=1.355 ms

<PC2>ping -c 2 192.168.200.1

Ping 192.168.200.1 (192.168.200.1): 56 data bytes, press CTRL+C to break

56 bytes from 192.168.200.1: icmp_seq=0 ttl=254 time=1.109 ms

56 bytes from 192.168.200.1: icmp_seq=1 ttl=254 time=1.318 ms

<PC2>ping -c 2 10.1.1.1

Ping 10.1.1.1 (10.1.1.1): 56 data bytes, press CTRL+C to break

56 bytes from 10.1.1.1: icmp_seq=0 ttl=254 time=1.058 ms

56 bytes from 10.1.1.1: icmp_seq=1 ttl=254 time=1.333 ms

4.3 PC11测试处办公网外其他都可以访问

<PC11>ping -c 2 192.168.1.1

Ping 192.168.1.1 (192.168.1.1): 56 data bytes, press CTRL+C to break

Request time out

--- Ping statistics for 192.168.1.1 ---