当前位置: 技术问答>linux和unix
寻6509、访问列表的资料，偶是新手，高手多帮忙！
来源: 互联网 发布时间：2015-01-09
本文导语: 寻6509、访问列表的资料，偶是新手，高手多帮忙！ | Examples These examples show the merge results for various IOS ACL and VACL configurations. Note that in these examples, one VACL and one IOS ACL are config...
寻6509、访问列表的资料，偶是新手，高手多帮忙！
|
Examples
These examples show the merge results for various IOS ACL and VACL configurations. Note that in these examples, one VACL and one IOS ACL are configured
on the same VLAN.
Example 1
This example shows that the VACL does not follow the recommended guidelines (see line 9) and the resultant merge increases the number of ACEs:
******** VACL ***********
1 permit udp host 194.72.72.33 194.72.6.160 0.0.0.15
2 permit udp host 147.150.213.94 194.72.6.64 0.0.0.15 eq bootps
3 permit udp 194.73.74.0 0.0.0.255 host 194.72.6.205 eq syslog
4 permit udp host 167.221.23.1 host 194.72.6.198 eq tacacs
5 permit udp 194.72.136.1 0.0.3.128 194.72.6.64 0.0.0.15 eq tftp
6 permit udp host 193.6.65.17 host 194.72.6.205 gt 1023
7 permit tcp any host 194.72.6.52
8 permit tcp any host 194.72.6.52 eq 113
9 deny tcp any host 194.72.6.51 eq ftp
10 permit tcp any host 194.72.6.51 eq ftp-data
11 permit tcp any host 194.72.6.51
12 permit tcp any eq domain host 194.72.6.51
13 permit tcp any host 194.72.6.51 gt 1023
14 permit ip any host 1.1.1.1
******** IOS ACL ************
1 deny ip any host 239.255.255.255
2 permit ip any any
******** MERGE **********
has 91 entries entries
Example 2
In Example 1, if you follow the guidelines and remove line 9 and modify lines 11 and 12, you get the following equivalent ACL with improved merge results (note
that a deny ACE is not specified):
******** VACL **********
1 permit udp host 194.72.72.33 194.72.6.160 0.0.0.15
2 permit udp host 147.150.213.94 194.72.6.64 0.0.0.15 eq bootps
3 permit udp 194.73.74.0 0.0.0.255 host 194.72.6.205 eq syslog
4 permit udp host 167.221.23.1 host 194.72.6.198 eq tacacs
5 permit udp 194.72.136.1 0.0.3.128 194.72.6.64 0.0.0.15 eq tftp
6 permit udp host 193.6.65.17 host 194.72.6.205 gt 1023
7 permit tcp any host 194.72.6.52
8 permit tcp any host 194.72.6.52 eq 113
9 permit tcp any host 194.72.6.51 eq ftp-data
10 permit tcp any host 194.72.6.51 neq ftp
11 permit tcp any eq domain host 194.72.6.51 neq ftp
12 permit tcp any host 194.72.6.51 gt 1023
13 permit ip any host 1.1.1.1
******** IOS ACL ************
1 deny ip any host 239.255.255.255
2 permit ip any any
******** MERGE ***********
has 78 entries
Example 3
This example shows the VACL does not follow the recommended guidelines, and the resultant merge significantly increases the number of ACEs:
******** VACL ***********
1 deny ip 0.0.0.0 255.255.255.0 any
2 deny ip 0.0.0.255 255.255.255.0 any
3 deny ip any 0.0.0.0 255.255.255.0
4 permit ip any host 239.255.255.255
5 permit ip any host 255.255.255.255
6 deny ip any 0.0.0.255 255.255.255.0
7 permit tcp any range 0 65534 any range 0 65534
8 permit udp any range 0 65534 any range 0 65534
9 permit icmp any any
10 permit ip any any
******** IOS ACL **********
1 deny ip any host 239.255.255.255
2 permit ip any any
******** MERGE **********
has 329 entries
Example 4
This example shows the VACL does not follow the recommended guidelines (three different actions are specified), and the resultant merge significantly increases
the number of ACEs:
******** VACL ***********
1 redirect 4/25 tcp host 192.168.1.67 host 255.255.255.255
2 redirect 4/25 udp host 192.168.1.67 host 255.255.255.255
3 deny tcp any any lt 30
4 deny udp any any lt 30
5 permit ip any any
******* IOS ACL ***********
1 deny ip any host 239.255.255.255
2 permit ip any any
******* MERGE **********
has 142 entries
Example 5
This example shows the VACL has two different actions specified and the merge results are significantly improved:
******** VACL ***********
1 redirect 4/25 tcp host 192.168.1.67 host 255.255.255.255
2 redirect 4/25 udp host 192.168.1.67 host 255.255.255.255
3 permit ip any any
******* IOS ACL ***********
1 deny ip any host 239.255.255.255
2 permit ip any any
******* MERGE **********
has 4 entries
Example 6
This example shows that applying the merging guidelines on a large IOS ACL (no Layer 4 port information is specified on the IOS ACL), produces a merge result
of 801 entries:
******** VACL **********
1 redirect 4/25 tcp host 192.168.1.67 255.255.255.255 0.0.0.0
2 redirect 4/25 udp host 192.168.1.67 255.255.255.255 0.0.0.0
3 redirect 4/25 icmp host 192.168.1.67 host 255.255.255.255
4 redirect 4/25 ip host 192.168.1.67 host 255.255.255.255
5 deny tcp any any lt 30
6 deny udp any any lt 30
7 permit ip any any
******** IOS ACL ***********
1 permit ip 147.150.213.64 0.0.0.31 194.72.6.64 0.0.0.15
2 permit ip 147.150.213.64 0.0.0.31 194.72.6.160 0.0.0.15
3 permit ip 147.150.213.64 0.0.0.31 host 194.72.6.205
4 permit ip 147.151.77.0 0.0.0.255 194.72.6.64 0.0.0.15
5 permit ip 147.151.77.0 0.0.0.255 194.72.6.160 0.0.0.15
6 permit ip 147.151.77.0 0.0.0.255 194.72.6.208 0.0.0.15
7 permit ip 147.151.77.0 0.0.0.255 host 194.72.6.205
8 permit ip host 193.37.169.121 194.72.6.64 0.0.0.15
[...] total 62 entries without L4 information
******** MERGE **********
has 801 ACEs
Example 7
This example shows that the same IOS ACL that was used in Example 6 is merged with a VACL with Layer 4 port information. Following the guidelines in the
"Using the Implicit Deny Action" section, the merge results are good.
******** VACL *********
1 permit tcp host 193.131.248.24 194.73.73.0 0.0.0.15 gt 1023
2 permit tcp host 158.43.128.8 194.72.6.224 0.0.0.7 gt 1023
3 permit udp any 194.72.6.224 0.0.0.7 eq time
4 permit udp any 194.73.73.0 0.0.0.15 eq time
5 permit udp 194.72.7.128 0.0.0.7 194.72.6.224 0.0.0.7 eq 1645
6 permit udp 194.72.7.128 0.0.0.7 194.73.73.0 0.0.0.15 eq 1645
7 permit udp host 158.152.1.65 194.72.6.224 0.0.0.7 gt 1023
8 permit udp host 158.152.1.65 194.73.73.0 0.0.0.15 gt 1023
[...] total 168 entries
******** IOS ACL *********
1 permit ip 147.150.213.64 0.0.0.31 194.72.6.64 0.0.0.15
2 permit ip 147.150.213.64 0.0.0.31 194.72.6.160 0.0.0.15
3 permit ip 147.150.213.64 0.0.0.31 host 194.72.6.205
4 permit ip 147.151.77.0 0.0.0.255 194.72.6.64 0.0.0.15
5 permit ip 147.151.77.0 0.0.0.255 194.72.6.160 0.0.0.15
6 permit ip 147.151.77.0 0.0.0.255 194.72.6.208 0.0.0.15
7 permit ip 147.151.77.0 0.0.0.255 host 194.72.6.205
8 permit ip host 193.37.169.121 194.72.6.64 0.0.0.15
[...] total 62 entries without L4 information
******* MERGE ********
has 1259 ACEs.
These examples show the merge results for various IOS ACL and VACL configurations. Note that in these examples, one VACL and one IOS ACL are configured
on the same VLAN.
Example 1
This example shows that the VACL does not follow the recommended guidelines (see line 9) and the resultant merge increases the number of ACEs:
******** VACL ***********
1 permit udp host 194.72.72.33 194.72.6.160 0.0.0.15
2 permit udp host 147.150.213.94 194.72.6.64 0.0.0.15 eq bootps
3 permit udp 194.73.74.0 0.0.0.255 host 194.72.6.205 eq syslog
4 permit udp host 167.221.23.1 host 194.72.6.198 eq tacacs
5 permit udp 194.72.136.1 0.0.3.128 194.72.6.64 0.0.0.15 eq tftp
6 permit udp host 193.6.65.17 host 194.72.6.205 gt 1023
7 permit tcp any host 194.72.6.52
8 permit tcp any host 194.72.6.52 eq 113
9 deny tcp any host 194.72.6.51 eq ftp
10 permit tcp any host 194.72.6.51 eq ftp-data
11 permit tcp any host 194.72.6.51
12 permit tcp any eq domain host 194.72.6.51
13 permit tcp any host 194.72.6.51 gt 1023
14 permit ip any host 1.1.1.1
******** IOS ACL ************
1 deny ip any host 239.255.255.255
2 permit ip any any
******** MERGE **********
has 91 entries entries
Example 2
In Example 1, if you follow the guidelines and remove line 9 and modify lines 11 and 12, you get the following equivalent ACL with improved merge results (note
that a deny ACE is not specified):
******** VACL **********
1 permit udp host 194.72.72.33 194.72.6.160 0.0.0.15
2 permit udp host 147.150.213.94 194.72.6.64 0.0.0.15 eq bootps
3 permit udp 194.73.74.0 0.0.0.255 host 194.72.6.205 eq syslog
4 permit udp host 167.221.23.1 host 194.72.6.198 eq tacacs
5 permit udp 194.72.136.1 0.0.3.128 194.72.6.64 0.0.0.15 eq tftp
6 permit udp host 193.6.65.17 host 194.72.6.205 gt 1023
7 permit tcp any host 194.72.6.52
8 permit tcp any host 194.72.6.52 eq 113
9 permit tcp any host 194.72.6.51 eq ftp-data
10 permit tcp any host 194.72.6.51 neq ftp
11 permit tcp any eq domain host 194.72.6.51 neq ftp
12 permit tcp any host 194.72.6.51 gt 1023
13 permit ip any host 1.1.1.1
******** IOS ACL ************
1 deny ip any host 239.255.255.255
2 permit ip any any
******** MERGE ***********
has 78 entries
Example 3
This example shows the VACL does not follow the recommended guidelines, and the resultant merge significantly increases the number of ACEs:
******** VACL ***********
1 deny ip 0.0.0.0 255.255.255.0 any
2 deny ip 0.0.0.255 255.255.255.0 any
3 deny ip any 0.0.0.0 255.255.255.0
4 permit ip any host 239.255.255.255
5 permit ip any host 255.255.255.255
6 deny ip any 0.0.0.255 255.255.255.0
7 permit tcp any range 0 65534 any range 0 65534
8 permit udp any range 0 65534 any range 0 65534
9 permit icmp any any
10 permit ip any any
******** IOS ACL **********
1 deny ip any host 239.255.255.255
2 permit ip any any
******** MERGE **********
has 329 entries
Example 4
This example shows the VACL does not follow the recommended guidelines (three different actions are specified), and the resultant merge significantly increases
the number of ACEs:
******** VACL ***********
1 redirect 4/25 tcp host 192.168.1.67 host 255.255.255.255
2 redirect 4/25 udp host 192.168.1.67 host 255.255.255.255
3 deny tcp any any lt 30
4 deny udp any any lt 30
5 permit ip any any
******* IOS ACL ***********
1 deny ip any host 239.255.255.255
2 permit ip any any
******* MERGE **********
has 142 entries
Example 5
This example shows the VACL has two different actions specified and the merge results are significantly improved:
******** VACL ***********
1 redirect 4/25 tcp host 192.168.1.67 host 255.255.255.255
2 redirect 4/25 udp host 192.168.1.67 host 255.255.255.255
3 permit ip any any
******* IOS ACL ***********
1 deny ip any host 239.255.255.255
2 permit ip any any
******* MERGE **********
has 4 entries
Example 6
This example shows that applying the merging guidelines on a large IOS ACL (no Layer 4 port information is specified on the IOS ACL), produces a merge result
of 801 entries:
******** VACL **********
1 redirect 4/25 tcp host 192.168.1.67 255.255.255.255 0.0.0.0
2 redirect 4/25 udp host 192.168.1.67 255.255.255.255 0.0.0.0
3 redirect 4/25 icmp host 192.168.1.67 host 255.255.255.255
4 redirect 4/25 ip host 192.168.1.67 host 255.255.255.255
5 deny tcp any any lt 30
6 deny udp any any lt 30
7 permit ip any any
******** IOS ACL ***********
1 permit ip 147.150.213.64 0.0.0.31 194.72.6.64 0.0.0.15
2 permit ip 147.150.213.64 0.0.0.31 194.72.6.160 0.0.0.15
3 permit ip 147.150.213.64 0.0.0.31 host 194.72.6.205
4 permit ip 147.151.77.0 0.0.0.255 194.72.6.64 0.0.0.15
5 permit ip 147.151.77.0 0.0.0.255 194.72.6.160 0.0.0.15
6 permit ip 147.151.77.0 0.0.0.255 194.72.6.208 0.0.0.15
7 permit ip 147.151.77.0 0.0.0.255 host 194.72.6.205
8 permit ip host 193.37.169.121 194.72.6.64 0.0.0.15
[...] total 62 entries without L4 information
******** MERGE **********
has 801 ACEs
Example 7
This example shows that the same IOS ACL that was used in Example 6 is merged with a VACL with Layer 4 port information. Following the guidelines in the
"Using the Implicit Deny Action" section, the merge results are good.
******** VACL *********
1 permit tcp host 193.131.248.24 194.73.73.0 0.0.0.15 gt 1023
2 permit tcp host 158.43.128.8 194.72.6.224 0.0.0.7 gt 1023
3 permit udp any 194.72.6.224 0.0.0.7 eq time
4 permit udp any 194.73.73.0 0.0.0.15 eq time
5 permit udp 194.72.7.128 0.0.0.7 194.72.6.224 0.0.0.7 eq 1645
6 permit udp 194.72.7.128 0.0.0.7 194.73.73.0 0.0.0.15 eq 1645
7 permit udp host 158.152.1.65 194.72.6.224 0.0.0.7 gt 1023
8 permit udp host 158.152.1.65 194.73.73.0 0.0.0.15 gt 1023
[...] total 168 entries
******** IOS ACL *********
1 permit ip 147.150.213.64 0.0.0.31 194.72.6.64 0.0.0.15
2 permit ip 147.150.213.64 0.0.0.31 194.72.6.160 0.0.0.15
3 permit ip 147.150.213.64 0.0.0.31 host 194.72.6.205
4 permit ip 147.151.77.0 0.0.0.255 194.72.6.64 0.0.0.15
5 permit ip 147.151.77.0 0.0.0.255 194.72.6.160 0.0.0.15
6 permit ip 147.151.77.0 0.0.0.255 194.72.6.208 0.0.0.15
7 permit ip 147.151.77.0 0.0.0.255 host 194.72.6.205
8 permit ip host 193.37.169.121 194.72.6.64 0.0.0.15
[...] total 62 entries without L4 information
******* MERGE ********
has 1259 ACEs.
|
***你可以到
http://chinaunix.net/bbsjh/23/
http://www.net130.com/
了解有关Cisco路由器配置的问题
http://chinaunix.net/bbsjh/23/
http://www.net130.com/
了解有关Cisco路由器配置的问题
|
那要看您6509上的三层模块，是哪一种，有的可能不支持列表
您可能感兴趣的文章:
本站(WWW.)旨在分享和传播互联网科技相关的资讯和技术，将尽最大努力为读者提供更好的信息聚合和浏览方式。
本站(WWW.)站内文章除注明原创外，均为转载、整理或搜集自网络。欢迎任何形式的转载，转载请注明出处。
本站(WWW.)站内文章除注明原创外，均为转载、整理或搜集自网络。欢迎任何形式的转载，转载请注明出处。