MPLS网络中源地址校验导致网络不通案例.docx

MPLS网络中源地址校验导致网络不通一 障碍现象语音承载网中R7和R6下带用户电话出现单通现象。二 障碍处理过程R7与通过MPLS-VPN网络连入R4 R5的语音承载网。R1 R2 R3通过MPLS网络全互联。R4 R5 R6是语音承载网网络，R4上业务与MPLS网络中Vrf 软交换互联。登录到R7上，ping不通R6的56.0.0.6。通过tracert 测试，发现在R7到 R6的数据包，去程路由为R7-R1-R4-R5-R6（红色表示）。回程路由为：R6-R5-R4-R3-R1-R7(蓝色表示)。进一步检查发现源和目的的路由协议没问题，故障点可能出现数据包的转发层面。在现场抓包测试发现，R7发送报文到R6，R6可以收到R7发送的报文，R6收到R7的报文之后，发送了相应的回应报文，但是R7并没有收到。问题障碍点可能出在R6到R7之间的回程路由上。 进一步检查所有的交换机，没有任何ACL限制。可以排除ACL限制的可能。Client6#ping 13.0.0.1Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 13.0.0.1, timeout is 2 seconds:.Success rate is 0 percent (0/5)在R1上查看R6返回R7的报文的接口状态，R1#show ip int fastEthernet 0/1FastEthernet0/1 is up, line protocol is upInternet address is 13.0.0.1/24Broadcast address is 255.255.255.255Address determined by non-volatile memoryMTU is 1500 bytesHelper address is not setDirected broadcast forwarding is disabledMulticast reserved groups joined: 224.0.0.2 224.0.0.5 224.0.0.6Outgoing access list is not setInbound access list is not setProxy ARP is enabledLocal Proxy ARP is disabledSecurity level is defaultSplit horizon is enabledICMP redirects are always sentICMP unreachables are always sentICMP mask replies are never sentIP fast switching is enabledIP fast switching on the same interface is disabledIP Flow switching is disabledIP CEF switching is enabledIP CEF Feature Fast switching turbo vectorIP multicast fast switching is enabledIP multicast distributed fast switching is disabledIP route-cache flags are Fast, CEFRouter Discovery is disabledIP output packet accounting is disabledIP access violation accounting is disabledTCP/IP header compression is disabledRTP/IP header compression is disabledPolicy routing is disabledNetwork address translation is disabledWCCP Redirect outbound is disabledWCCP Redirect inbound is disabledWCCP Redirect exclude is disabledBGP Policy Mapping is disabledIP verify source reachable-via ANY, allow default5 verification drops0 suppressed verification dropk可发现，R1上Fa0/1口，因为开启了源地址校验，将R6(源地址为56.0.0.6)到R7的流量drop掉了。在R1上将IP verify source reachable-via ANY 去掉，通信正常。三 障碍总结目前从网络安全的角度考虑，大部