华为本地pbr及mqc及traffic-filter使用案例

实施需求
1、实现ar1始发流量1.1.1.1访问pc5时，走ar2转发
2、实现ar1始发流量11.11.11.11访问pc5时，走ar3转发
3、实现pc1访问pc5时，走ar2转发
4、实现pc2访问pc5时，走ar3转发
5、实现pc1不能访问pc3网段，可以访问pc4网段
6、实现pc2不能访问pc4网段，可以访问pc3网段
7、pc4不能访问pc5网段

使用技术主要以下三个
1、在ar1上配置pbr，实现对ar1始发流量控制
2、在ar1上配置mqc，实现对流量过滤和路径控制
3、在ar3上配置traffic-filter，实现pc4对pc5的流量过滤

ar1

ip local policy-based-route ar1-pc5 //在ar1上部署本地pbr

router id 1.1.1.1

acl number 3000
rule 5 permit ip source 1.1.1.1 0 destination 192.168.40.0 0.0.0.255
acl number 3001
rule 5 permit ip source 11.11.11.11 0 destination 192.168.40.0 0.0.0.255
acl number 3011
rule 5 permit ip source 192.168.10.11 0 destination 192.168.20.0 0.0.0.255
acl number 3012
rule 5 permit ip source 192.168.10.11 0 destination 192.168.30.0 0.0.0.255
acl number 3013
rule 5 permit ip source 192.168.10.12 0 destination 192.168.20.0 0.0.0.255
acl number 3014
rule 5 permit ip source 192.168.10.12 0 destination 192.168.30.0 0.0.0.255
acl number 3015
rule 5 permit ip source 192.168.10.11 0 destination 192.168.40.0 0.0.0.255
acl number 3016
rule 5 permit ip source 192.168.10.12 0 destination 192.168.40.0 0.0.0.255

traffic classifier 3013 operator or
if-match acl 3013
traffic classifier 3014 operator or
if-match acl 3014
traffic classifier 3015 operator or
if-match acl 3015
traffic classifier 3011 operator or
if-match acl 3011
traffic classifier 3016 operator or
if-match acl 3016
traffic classifier 3012 operator or
if-match acl 3012

traffic behavior 10.0.13.3
redirect ip-nexthop 10.0.13.3
traffic behavior permit
traffic behavior deny
deny
traffic behavior 10.0.12.2
redirect ip-nexthop 10.0.12.2

traffic policy ar1
classifier 3011 behavior deny
classifier 3014 behavior deny
classifier 3012 behavior permit
classifier 3013 behavior permit
classifier 3015 behavior 10.0.12.2
classifier 3016 behavior 10.0.13.3

interface GigabitEthernet0/0/0
ip address 10.0.12.1 255.255.255.0

interface GigabitEthernet0/0/1
ip address 10.0.13.1 255.255.255.0

interface GigabitEthernet0/0/2
ip address 192.168.10.1 255.255.255.0
traffic-policy ar1 inbound

interface LoopBack0
ip address 1.1.1.1 255.255.255.255

interface LoopBack1
ip address 11.11.11.11 255.255.255.255

ospf 1
filter-policy ip-prefix 40 import
//在ar1上部署本地pbr实现需求1,在ar1上把192.168.40.0的路由过滤掉（只能过滤掉ip路由表,ospf路由表中的过滤不了）
area 0.0.0.0
network 1.1.1.1 0.0.0.0
network 10.0.12.1 0.0.0.0
network 10.0.13.1 0.0.0.0
network 11.11.11.11 0.0.0.0
network 192.168.10.1 0.0.0.0

ip ip-prefix 40 index 15 deny 192.168.40.0 24
ip ip-prefix 40 index 20 permit 0.0.0.0 0 less-equal 32

//用本地pbr控制本机上的始发路由走向（本地始发流量控制用mqc无效）
policy-based-route ar1-pc5 permit node 10
if-match acl 3000
apply ip-address next-hop 10.0.12.2
policy-based-route ar1-pc5 permit node 20
if-match acl 3001
apply ip-address next-hop 10.0.13.3

ar2
router id 2.2.2.2

interface GigabitEthernet0/0/0
ip address 10.0.12.2 255.255.255.0

interface GigabitEthernet0/0/1
ip address 10.0.24.2 255.255.255.0

interface GigabitEthernet0/0/2
ip address 192.168.20.1 255.255.255.0

interface LoopBack0
ip address 2.2.2.2 255.255.255.255

ospf 1
area 0.0.0.0
network 2.2.2.2 0.0.0.0
network 10.0.12.2 0.0.0.0
network 10.0.24.2 0.0.0.0
network 192.168.20.1 0.0.0.0

ar3

router id 3.3.3.3

acl number 3000
rule 10 deny ip source 192.168.30.10 0 destination 192.168.40.10 0

interface GigabitEthernet0/0/0
ip address 10.0.13.3 255.255.255.0

interface GigabitEthernet0/0/1
ip address 10.0.34.3 255.255.255.0

interface GigabitEthernet0/0/2
ip address 192.168.30.1 255.255.255.0
traffic-filter inbound acl 3000
// ar3上部署traffic-filter对pc4到pc5网段过滤

interface LoopBack0
ip address 3.3.3.3 255.255.255.255

ospf 1
area 0.0.0.0
network 3.3.3.3 0.0.0.0
network 10.0.13.3 0.0.0.0
network 10.0.34.3 0.0.0.0
network 192.168.30.1 0.0.0.0

ar4
router id 4.4.4.4

interface GigabitEthernet0/0/0
ip address 10.0.24.4 255.255.255.0

interface GigabitEthernet0/0/1
ip address 10.0.34.4 255.255.255.0

interface GigabitEthernet0/0/2
ip address 192.168.40.1 255.255.255.0

interface LoopBack0
ip address 4.4.4.4 255.255.255.255

ospf 1
area 0.0.0.0
network 4.4.4.4 0.0.0.0
network 10.0.24.4 0.0.0.0
network 10.0.34.4 0.0.0.0
network 192.168.40.1 0.0.0.0

测试ar1本地始发流量走向
[r1]tracert -a 11.11.11.11 192.168.40.10
[r1]tracert -a 1.1.1.1 192.168.40.10

实现pc1不能访问pc3网段，可以访问pc4网段

实现pc1访问pc5时，走ar2转发

实现pc2不能访问pc4网段，可以访问pc3网段

实现pc2访问pc5时，走ar3转发

pc4不能访问pc5网段