ROUTE-POLICY 策略路由规则详解.docx

ROUTE-POLICY策略路由规则详解 在工程中经常遇到route-policy用于策略路由的情况，下面就对route-polic和ACL间的匹配规则详解如下： 一、 试验环境 A(E0/0)-192.168.1.0-(E0/0)B(S0/0)-10.0.0.0-(S0/0)C(E0/0)-192.168.2.0-(E0/0)D 拓扑说明： AB之间的网段为192.168.1.0。AB分别通过E0/0口互联。 CD之间的网段为192.168.2.0。CD分别通过E0/0口互联。 BC之间分别通过S0/0中间通过帧中继交换机互联,共配置3个子接口，DLCI分别是100200300（两端相同）。 二、 测试结论： 未做任何策略 # interfaceEthernet0/0 ipaddress192.168.1.1255.255.255.0= 在路由器ATracert路由结果如下： disclock 08:48:03UTCFri11/28/2008 tracert-m5-a192.168.1.2192.168.2.2 tracerouteto192.168.2.2(192.168.2.2)5hopsmax,40bytespacket PressCTRL_Ctobreak 1192.168.1.13ms1ms2ms 210.0.0.1019ms18ms19ms 3192.168.2.220ms21ms20ms 由此可得出未做route-policy的时候，是按照全局路由表中的路由条目转发数据流的。 1、 permit+permit # interfaceEthernet0/0 ipaddress192.168.1.1255.255.255.0 ippolicyroute-policyt1 # aclnumber3000 rule0permitipsource192.168.1.00.0.0.255destination192.168.2.00.0.0.255 aclnumber3001 rule0denyipsource192.168.1.00.0.0.255destination192.168.2.00.0.0.255 # route-policyt1permitnode10 if-matchacl3000 applyip-addressnext-hop10.0.0.2 route-policyt1permitnode20 applyip-addressnext-hop10.0.0.6 在路由器ATracert路由结果如下： disclock 08:50:33UTCFri11/28/2008 tracert-m5-a192.168.1.2192.168.2.2 tracerouteto192.168.2.2(192.168.2.2)5hopsmax,40bytespacket PressCTRL_Ctobreak 1192.168.1.12ms2ms1ms 210.0.0.220ms20ms22ms 3192.168.2.219ms20ms19ms 由此结果可得出此时数据流匹配了规则node10。也就是route-policypermit对于和ACLpermit规则匹配的数据流执行node10中的匹配规则。 2、 permit+deny # interfaceEthernet0/0 ipaddress192.168.1.1255.255.255.0 ippolicyroute-policyt2 # aclnumber3000 rule0permitipsource192.168.1.00.0.0.255destination192.168.2.00.0.0.255 aclnumber3001 rule0denyipsource192.168.1.00.0.0.255destination192.168.2.00.0.0.255 # route-policyt2permitnode10 if-matchacl3001 applylocal-preference2300 route-policyt2permitnode20 applyip-addressnext-hop10.0.0.6 在路由器ATracert路由结果如下： disclock 08:53:00UTCFri11/28/2008 tracert-m5-a192.168.1.2192.168.2.2 tracerouteto192.168.2.2(192.168.2.2)5hopsmax,40bytespacket PressCTRL_Ctobreak 1192.168.1.12ms2ms4ms 210.0.0.619ms19ms20ms 3192.168.2.220ms20ms20ms 由此结果的得出route-policy的permit对于和ACLDENY规则相匹配的数据流，不执行node10中的策略，而是继续匹配下面的规则。 3、 deny+permit # interfaceEthernet0/0 ipaddress192.168.1.1255.255.255.0 ippolicyroute-policyt3 # aclnumber3000 rule0permitipsource192.168.1.00.0.0.255destination192.168.2.00.0.0.255 aclnumber3001 rule0denyipsource192.168.1.00.0.0.255destination192.168.2.00.0.0.255 # route-policyt3denynode10 if-matchacl3000 applyip-addressnext-hop10.0.0.2 route-policyt3permitnode20 applyip-addressnext-hop10.0.0.6 在路由器ATracert路由结果如下： disclock 08:54:42UTCFri11/28/2008 tracert-m5-a192.168.1.2192.168.2.2 tracerouteto192.168.2.2(192.168.2.2)5hopsmax,40bytespacket PressCTRL_Ctobreak 1192.168.1.12ms2ms1ms 210.0.0.1019ms18ms19ms 3192.168.2.220ms20ms22ms 由此结果可得出，route-policy的deny对于和ACLpermit规则相匹配的数据流直接进行DENY,并且不再匹配后续的规则，而是转入了系统全局路由表执行常规的路由策略。 4、 deny+deny # interfaceEthernet0/0 ipaddress192.168.1.1255.255.255.0 ippolicyroute-policyt4 # aclnumber3000 rule0permitipsource192.168.1.00.0.0.255destination192.168.2.00.0.0.255 aclnumber3001 rule0denyipsource192.168.1.00.0.0.255destination192.168.2.00.0.0.255 # route-policyt4denynode10 if-matchacl3001 applylocal-preference2300 route-policyt4permitnode20 applyip-addressnext-hop10.0.0.6 在路由器ATracert路由结果如下： tracert-m5-a192.168.1.2192.168.2.2 tracerouteto192.168.2.2(192.168.2.2)5hopsmax,40bytespacket PressCTRL_Ctobreak 1192.168.1.13ms2ms2ms 210.0.0.619ms18ms22ms 3192.168.2.220ms21ms19ms 有此结果可得出：route-policydeny对于和ACLdeny规则相匹配的数据流，不会执行node10的规则，但是会继续匹配下面的规则。 三、 总结策略路由规则如下： 1、 对于和ACL的匹配和常规的ACL匹配规则完全一致，没有什么不同。 2、 对于策略路由来说router-policy尽管也有缺省DENY的规则，但是被DENY的数据流不会丢弃，只是不进行策略路由而已。（对于路由策略则不一样）。 附件1： 相关版本和配置信息： 路由器A: disver HuaweiVersatileRoutingPlatformSoftware VRPsoftware,Version3.40,Release0201P29 Copyright(c)1998-2008HuaweiTechnologiesCo.,Ltd.Allrightsreserved. Withouttheownerspriorwrittenconsent,nodecompiling norreverse-engineeringshallbeallowed. QuidwayAR28-10uptimeis0week,0day,1hour,39minutes Lastreboot2008/11/2807:22:50 SystemreturnedtoROMByCommand. CPUtype:PowerPC8241200MHz 128MbytesSDRAMMemory 32MbytesFlashMemory PCBVersion:4.0 LogicVersion:1.0 BootROMVersion:9.23 SLOT0AUX(Hardware)4.0,(Driver)1.0,(CPLD)1.0 SLOT01FE(Hardware)4.0,(Driver)1.0,(CPLD)1.0 SLOT0WAN(Hardware)4.0,(Driver)1.0,(CPLD)1.0 SLOT31SA(Hardware)1.0,(Driver)1.0,(CPLD)2.0 vrbd RoutingPlatformSoftware VersionAR28-108040V300R003B04D040SP73(COMWAREV300R002B62D014),RELEASESOFTWARE CompiledOct22200818:24:10byjiahua discu discurrent-configuration # sysnameAR2810-A # interfaceEthernet0/0 ipaddress192.168.1.2255.255.255.0 # iproute-static0.0.0.00.0.0.0192.168.1.1preference60 路由器B： AR2810-Bdisversion HuaweiVersatileRoutingPlatformSoftware VRPsoftware,Version3.40,Release0201P29 Copyright(c)1998-2008HuaweiTechnologiesCo.,Ltd.Allrightsreserved. Withouttheownerspriorwrittenconsent,nodecompiling norreverse-engineeringshallbeallowed. QuidwayAR28-10uptimeis0week,0day,0hour,53minutes Lastreboot2021/08/2203:19:36 SystemreturnedtoROMByCommand. CPUtype:PowerPC8241200MHz 128MbytesSDRAMMemory 32MbytesFlashMemory PCBVersion:4.0 LogicVersion:1.0 BootROMVersion:9.23 SLOT0AUX(Hardware)4.0,(Driver)1.0,(CPLD)1.0 SLOT01FE(Hardware)4.0,(Driver)1.0,(CPLD)1.0 SLOT0WAN(Hardware)4.0,(Driver)1.0,(CPLD)1.0 SLOT31SA(Hardware)1.0,(Driver)1.0,(CPLD)2.0 AR2810-Bvrbd RoutingPlatformSoftware VersionAR28-108040V300R003B04D040SP73(COMWAREV300R002B62D014),RELEASESOFTWARE CompiledOct22200818:24:10byjiahua AR2810-Bdiscurrent-configuration # sysnameAR2810-B # aclnumber3000 rule0permitipsource192.168.1.00.0.0.255destination192.168.2.00.0.0.255 aclnumber3001 rule0denyipsource192.168.1.00.0.0.255destination192.168.2.00.0.0.255 # interfaceEthernet0/0 ipaddress192.168.1.1255.255.255.0 ippolicyroute-policyt4 # interfaceSerial0/0 link-protocolfr # interfaceSerial0/0.100 frdlci100 ipaddress10.0.0.1255.255.255.252 # interfaceSerial0/0.200 frdlci200 ipaddress10.0.0.5255.255.255.252 # interfaceSerial0/0.300 frdlci300 ipaddress10.0.0.9255.255.255.252 # route-policyt1permitnode10 if-matchacl3000 applyip-addressnext-hop10.0.0.2 route-policyt1permitnode20 applyip-addressnext-hop10.0.0.6 route-policyt2permitnode10 if-matchacl3001 applylocal-preference2300 route-policyt2permitnode20 applyip-addressnext-hop10.0.0.6 route-policyt3denynode10 if-matchacl3000 applyip-addressnext-hop10.0.0.2 route-policyt3permitnode20 applyip-addressnext-hop10.0.0.6 route-policyt4denynode10 if-matchacl3001 applylocal-preference2300 route-policyt4permitnode20 applyip-addressnext-hop10.0.0.6 # iproute-static192.168.2.0255.255.255.010.0.0.10preference60 路由器C： AR2810-Cdisver HuaweiVersatileRoutingPlatformSoftware VRPsoftware,Version3.40,Release0201P29 Copyright(c)1998-2008HuaweiTechnologiesCo.,Ltd.Allrightsreserved. Withouttheownerspriorwrittenconsent,nodecompiling norreverse-engineeringshallbeallowed. QuidwayAR28-10uptimeis0week,0day,2hours,59minutes Lastreboot2000/10/1100:54:49 SystemreturnedtoROMByCommand. CPUtype:PowerPC8241200MHz 128MbytesSDRAMMemory 32MbytesFlashMemory PCBVersion:4.0 LogicVersion:1.0 BootROMVersion:9.23 SLOT0AUX(Hardware)4.0,(Driver)1.0,(CPLD)1.0 SLOT01FE(Hardware)4.0,(Driver)1.0,(CPLD)1.0 SLOT0WAN(Hardware)4.0,(Driver)1.0,(CPLD)1.0 AR2810-Cvrbd RoutingPlatformSoftware VersionAR28-108040V300R003B04D040SP73(COMWAREV300R002B62D014),RELEASESOFTWARE CompiledOct22200818:24:10byjiahua AR2810-Cdiscu # sysnameAR2810-C # interfaceEthernet0/0 ipaddress192.168.2.1255.255.255.0 # interfaceSerial0/0 clockDTECLK1 link-protocolfr # interfaceSerial0/0.100 frdlci100 ipaddress10.0.0.2255.255.255.252 # interfaceSerial0/0.200 frdlci200 ipaddress10.0.0.6255.255.255.252 # interfaceSerial0/0.300 frdlci300 ipaddress10.0.0.10255.255.255.252 # iproute-static192.168.1.0255.255.255.010.0.0.9preference60 路由器D： disver HuaweiVersa