H3CS95EIRF下IPSACG(MQC方式)实验

1、H3CS95E IRF 下IPS/ACG(MQC 方式)实验1.1 实验内容与目标本实验是让学员能熟悉S95E IRF 下IPS/ACG 的部署完成本实验，您应该能够：掌握S95E IRF 下MQC 引流到IPS/ACG，并实现IPS/ACG 插卡备份1.2 预备知识和技能应了解S95E IRF 的原理及配置，以及IPS/ACG 插卡的工作原理1.3 实验组网图图1-1 S95E IRF 下IPS/ACG 实验环境图1.4 背景需求本实验的场景为IRF 下OAA 插卡部署的典型场景1.5 实验设备与版本本实验所需之主要设备器材如表1-1 所示。表1-1 实验设备和器材名称和型号版本数量描述S9

2、508E R1238P08及以后版本2Secbalde ACG（或者IPS插卡）ACG: E6117P11及以后（IPS: E2110P10及以后）2接入交换机三层接入交换机2以太网线缆- 101.6 实验过程实验任务一：S9500E IRF 下IPS/ACG 部署步骤一：S95E 配置两台S9500E 形成IRF，下联启用VLAN1004-1008 三层，上联VLAN1001-1002 三层。聚合链路上下行，核心交换机和交换机2 的VLAN 通信正常。acsei server enable /通过acsei 协议对插卡的状态进行检测#vlan 1001 to 1008#interface V

3、lan-interface1001ip address 192.168.11.254 255.255.255.0#interface Vlan-interface1002ip address 192.168.12.254 255.255.255.0#interface Vlan-interface1004ip address 192.168.14.254 255.255.255.0#interface Vlan-interface1005ip address 192.168.15.254 255.255.255.0#interface Vlan-interface1006ip address

4、192.168.16.254 255.255.255.0#interface Vlan-interface1007ip address 192.168.17.254 255.255.255.0#interface Vlan-interface1008ip address 192.168.18.254 255.255.255.0#步骤二：部署ACG 插卡使得核心交换机和互联网交换机2 的互访流量经过IRF 成员为1 的ACG-1 插卡，该卡故障后流量切换到IRF 成员为2 的ACG-2 上。S95E 与ACG 插卡接口基础配置interface Ten-GigabitEthernet1/5/0/

5、1port link-type trunkport trunk permit vlan 1 1001 1002 1004 to 1008 /允许业务VLAN 通过，必须同时允许VLAN1stp disable / 关闭stp，否则stp 会将此端口blockmac-address max-mac-count 0 / 关闭mac 学习，防止mac 地址学习偏移#interface Ten-GigabitEthernet2/5/0/1port link-type trunkport trunk permit vlan 1 1001 1002 1004 to 1008 /允许业务VLAN 通过，必须

6、同时允许VLAN1stp disable / 关闭stp，否则stp 会将此端口blockmac-address max-mac-count 0 / 关闭mac 学习，防止mac 地址学习偏移#配置MQC：acl number 3200description Match-ALL-Addressrule 0 permit ipacl number 3300description Match-ALL-Addressrule 0 permit ip#acl number 4000 /匹配二层组播和广播、ARPdescription Match-MultiCast-ARPrule 0 permit d

7、est-mac 0100-0000-0000 ff00-0000-0000rule 5 permit dest-mac ffff-ffff-ffff ffff-ffff-ffffrule 10 permit type 0806 ffff#acl number 3400 /vlan1004-1008 服务器之间互访的流量，目的地址为服务器网段description Match-Internal-Flowrule 0 permit ip destination 192.168.14.0 0.0.0.255rule 5 permit ip destination 192.168.15.0 0.0.0

8、.255rule 10 permit ip destination 192.168.16.0 0.0.0.255rule 15 permit ip destination 192.168.17.0 0.0.0.255rule 20 permit ip destination 192.168.18.0 0.0.0.255#acl number 3500 /vlan1001-1002 服务器之间互访的流量，目的地址为服务器网段description Match-Internet-Flowrule 0 permit ip destination 192.168.11.0 0.0.0.255rule

9、5 permit ip destination 192.168.12.0 0.0.0.255#traffic classifier Multicast-ARP operator andif-match acl 4000traffic classifier All-Address operator andif-match acl 3200if-match forwarding-layer route /仅将三层转发流量引流traffic classifier All-Address-2 operator andif-match acl 3300if-match forwarding-layer

10、route /仅将三层转发流量引流#traffic classifier Internal-Flow-1 operator andif-match acl 3400#traffic classifier Internet-Flow-2 operator andif-match acl 3500#traffic behavior Redirect_ACG_1redirect interface Ten-GigabitEthernet1/5/0/1traffic behavior Redirect_ACG_2redirect interface Ten-GigabitEthernet2/5/0/1

11、traffic behavior Allowfilter permittraffic behavior Deny-Multicast-ARPfilter deny#qos policy ACG-Deny-Multicast-ARPclassifier Multicast-ARP behavior Deny-Multicast-ARP#qos policy ACG_DOWN_STREAM /下行流量MQCclassifier Multicast-ARP behavior Allow /组播、ARP 报文不上ACGclassifier Internet-Flow-2 behavior Allow

12、/vlan1001 和vlan1002之间互访的流量不上ACGclassifier All-Address behavior Redirect_ACG_1 /流量优先上ACG_1classifier All-Address-2 behavior Redirect_ACG_2 /当ACG-1 失效后，流量上ACG_2#qos policy ACG_UP_STREAM /上行流量classifier Multicast-ARP behavior Allow /组播、ARP 报文不上ACGclassifier Internal-Flow-1 behavior Allow /vlan1004-1008

13、 之间互访的流量不上ACGclassifier All-Address behavior Redirect_ACG_1classifier All-Address-2 behavior Redirect_ACG_2在S95E 相关接口上下发MQC:上联接口：interface GigabitEthernet1/10/0/1qos apply policy ACG_DOWN_STREAM inbound#interface GigabitEthernet2/10/0/1qos apply policy ACG_DOWN_STREAM inbound下联的接口：interface GigabitEthernet1/10/0/7qos apply policy ACG_UP_STREAM inbound#interface GigabitEthernet2/10/0/7qos apply policy ACG_UP_STREAM inboundS95E 与ACG 插卡接口报文过滤配置interface Ten-GigabitEthernet1/5/0/1qos apply policy ACG-Deny-Multicast-ARP inbound /这里要在inbound 方向过滤，出方向本机发出的协议报文无法过滤。interface Ten-Gigabit