实验环境使用华为eNSP(1.2.00.500),交换机版本V2R1,在LSW1做访问策略,拓扑如下:
PC1:10.0.80.254; PC2:10.0.89.254; PC3:10.0.87.254; PC4:10.0.88.254;
Traffic-filter
acl 3000
rule 87 deny ip source 10.0.80.0 0.0.0.255 destination 10.0.87.0 0.0.0.255
rule 88 permit ip source 10.0.80.0 0.0.0.255 destination 10.0.88.0 0.0.0.255
在接口G0/0/1下使用traffic-filter调用acl3000,结果为
PC1-->PC3 不通; PC1-->PC4 通; PC1-->PC2 通;
Traffic-policy
(一)
acl 3000
rule 87 permit ip source 10.0.80.0 0.0.0.255 destination 10.0.87.0 0.0.0.255
rule 88 permit ip source 10.0.80.0 0.0.0.255 destination 10.0.88.0 0.0.0.255
traffic classifier c1 operator and
if-match acl 3000
traffic behavior b1
deny
traffic policy p1
classifier c1 behavior b1
在接口G0/0/1下使用traffic-policy调用p1于inbound方向,结果为
PC1-->PC3 不通; PC1-->PC4 不通; PC1-->PC2 通;在vlan下使用traffic-policy调用p1于inbound方向,结果相同。
(二)
acl 3000
rule 87 deny ip source 10.0.80.0 0.0.0.255 destination 10.0.87.0 0.0.0.255
rule 88 permit ip source 10.0.80.0 0.0.0.255 destination 10.0.88.0 0.0.0.255
traffic classifier c1 operator and
if-match acl 3000
traffic behavior b1
deny
traffic policy p1
classifier c1 behavior b1
在接口G0/0/1下使用traffic-policy调用p1于inbound方向,结果为
PC1-->PC3 不通; PC1-->PC4 不通; PC1-->PC2 通;在vlan下使用traffic-policy调用p1于inbound方向,结果相同。
(三)
acl 3000
rule 87 deny ip source 10.0.80.0 0.0.0.255 destination 10.0.87.0 0.0.0.255
rule 88 permit ip source 10.0.80.0 0.0.0.255 destination 10.0.88.0 0.0.0.255
traffic classifier c1 operator and
if-match acl 3000
traffic behavior b1
permit
traffic policy p1
classifier c1 behavior b1
在接口G0/0/1下使用traffic-policy调用p1于inbound方向,结果为
PC1-->PC3 不通; PC1-->PC4 通; PC1-->PC2 通;在vlan下使用traffic-policy调用p1于inbound方向,结果相同。
(四)
acl 3000
rule 87 permit ip source 10.0.80.0 0.0.0.255 destination 10.0.87.0 0.0.0.255
rule 88 permit ip source 10.0.80.0 0.0.0.255 destination 10.0.88.0 0.0.0.255
traffic classifier c1 operator and
if-match acl 3000
traffic behavior b1
permit
traffic policy p1
classifier c1 behavior b1
在接口G0/0/1下使用traffic-policy调用p1于inbound方向,结果为
PC1-->PC3 通; PC1-->PC4 通; PC1-->PC2 通;在vlan下使用traffic-policy调用p1于inbound方向,结果相同。
结论:
华为设备的ACL仅仅是用于匹配,最好是明确允许或拒绝流量;
使用traffic-policy时,rule匹配后,才匹配behavior,否则,直接放行流量;
使用traffic-policy时,rule匹配后,才匹配behavior,rule或behavior为deny则deny;
访问控制策略尽量用在in方向