/* Configure a GigE interface with an IPv4 address */
Router(config)# interface gigabitEthernet 0/0/0/0
Router(config-if)# ipv4 address 10.1.1.1 255.255.255.0
Router(config-if)# no shut
Router(config-if)# commit
Thu Jan 25 10:07:54.700 IST
Router(config-if)# exit
/* Verify if the interface is up */
Router(config)# do show ipv4 interface brief
Thu Jan 25 10:08:49.087 IST
Interface IP-Address Status Protocol Vrf-Name
GigabitEthernet0/0/0/0 10.1.1.1 Up Up default
/* Configure an IPv4 ingress ACL */
Router(config)# ipv4 access-list V4-ACL-INGRESS
Router(config-ipv4-acl)# 10 permit tcp 10.2.1.1 0.0.0.255 any
Router(config-ipv4-acl)# 20 deny udp any any
Router(config-ipv4-acl)# 30 permit ipv4 10.2.0.0 0.255.255.255 any
Router(config-ipv4-acl)# commit
Thu Jan 25 10:16:11.473 IST
/* Verify the ingress ACL creation */
Router(config)# do show access-lists ipv4
Thu Jan 25 10:25:19.896 IST
...
ipv4 access-list V4-ACL-INGRESS
10 permit tcp 10.2.1.0 0.0.0.255 any
20 deny udp any any
30 permit ipv4 10.0.0.0 0.255.255.255 any
/* Apply the ingress ACL to the GigE interface */
Router(config)# interface GigabitEthernet 0/0/0/0
Router(config-if)# ipv4 access-group V4-ACL-INGRESS ingress
Router(config-if)# commit
Thu Jan 25 10:28:19.671 IST
Router(config-if)# exit
/* Verify if the ingress ACL has been successfully applied to the interface */
Router(config)# do show ipv4 interface
Thu Jan 25 10:29:44.944 IST
GigabitEthernet0/0/0/0 is Up, ipv4 protocol is Up
Vrf is default (vrfid 0x60000000)
Internet address is 10.1.1.1/24
MTU is 1514 (1500 is available to IP)
Helper address is not set
Directed broadcast forwarding is disabled
Outgoing access list is not set
Inbound common access list is not set, access list is V4-ACL-INGRESS
Proxy ARP is disabled
ICMP redirects are never sent
ICMP unreachables are always sent
ICMP mask replies are never sent
Table Id is 0xe0000000
ギガビット イーサネット インターフェイス上に IPv4 入力 ACL を正常に設定しました。
ギガビット イーサネット インターフェイス上での出力 IPv4 ACL の設定
GigE インターフェイス上で出力 IPv4 ACL を設定するには、次の設定を使用します。
/* Configure a GigE interface with an IPv4 address */
Router(config)# interface gigabitEthernet 0/0/0/1
Router(config-if)# ipv4 address 20.1.1.1 255.255.255.0
Router(config-if)# no shut
Router(config-if)# commit
Thu Jan 25 10:08:38.767 IST
Router(config-if)# exit
/* Verify if the interface is up */
Router(config)# do show ipv4 interface brief
Thu Jan 25 10:08:49.087 IST
Interface IP-Address Status Protocol Vrf-Name
GigabitEthernet0/0/0/0 10.1.1.1 Up Up default
GigabitEthernet0/0/0/1 20.1.1.1 Up Up default
/* Configure an IPv4 egress ACL */
Router(config)# ipv4 access-list V4-ACL-EGRESS
Router(config-ipv4-acl)# 10 permit ipv4 10.2.0.0 0.255.255.255 20.2.0.0 0.255.255.255
Router(config-ipv4-acl)# 20 deny ipv4 any any
Router(config-ipv4-acl)# commit
Thu Jan 25 10:25:04.655 IST
/* Verify the egress ACL creation */
Router(config)# do show access-lists ipv4
Thu Jan 25 10:25:19.896 IST
ipv4 access-list V4-ACL-EGRESS
10 permit ipv4 10.0.0.0 0.255.255.255 20.0.0.0 0.255.255.255
20 deny ipv4 any any
...
/* Apply the egress ACL to the GigE interface */
Router(config)# interface GigabitEthernet 0/0/0/1
Router(config-if)# ipv4 access-group V4-ACL-EGRESS egress
Router(config-if)# commit
Thu Jan 25 10:28:45.937 IST
Router(config-if)# exit
/* Verify if the egress ACL has been successfully applied to the interface */
Router(config)# do show ipv4 interface
Thu Jan 25 10:29:44.944 IST
GigabitEthernet0/0/0/1 is Up, ipv4 protocol is Up
Vrf is default (vrfid 0x60000000)
Internet address is 20.1.1.1/24
MTU is 1514 (1500 is available to IP)
Helper address is not set
Directed broadcast forwarding is disabled
Outgoing access list is V4-ACL-EGRESS
Inbound common access list is not set, access list is not set
Proxy ARP is disabled
ICMP redirects are never sent
ICMP unreachables are always sent
ICMP mask replies are never sent
Table Id is 0xe0000000
...
/* Configure a GigE interface with an IPv6 address */
Router(config)# interface gigabitEthernet 0/0/0/0
Router(config-if)# ipv6 address 1001::1/64
Router(config-if)# no shut
Router(config-if)# commit
Thu Jan 25 10:07:54.700 IST
Router(config-if)# exit
/* Verify if the interface is up */
Router(config)# do show ipv6 interface brief
Thu Jan 25 12:38:35.742 IST
GigabitEthernet0/0/0/0 [Up/Up]
fe80::bd:b9ff:fea9:5606
1001::1
…
/* Configure an IPv6 ingress ACL */
Router(config)# ipv6 access-list V6-INGRESS-ACL
Router(config-ipv6-acl)# 10 permit ipv6 any any
Router(config-ipv6-acl)# 20 deny udp any any
Router(config-ipv6-acl)# commit
Thu Jan 25 11:31:24.488 IST
Router(config-ipv6-acl)# exit
/* Verify the ingress ACL creation */
Router(config)# do show access-lists ipv6
Thu Jan 25 11:34:56.911 IST
ipv6 access-list V6-INGRESS-ACL
10 permit ipv6 any any
20 deny udp any any
/* Apply the ingress ACL to the GigE interface */
Router(config)# interface gigabitEthernet 0/0/0/0
Router(config-if)# ipv6 access-group V6-INGRESS-ACL ingress
Router(config-if)# commit
Thu Jan 25 11:32:55.194 IST
Router(config-if)# exit
/* Verify if the ingress ACL has been successfully applied to the interface */
Router(config)# do show ipv6 interface
Thu Jan 25 11:34:08.028 IST
GigabitEthernet0/0/0/0 is Up, ipv6 protocol is Up, Vrfid is default (0x60000000)
IPv6 is enabled, link-local address is fe80::bd:b9ff:fea9:5606
Global unicast address(es):
1001::1, subnet is 1001::/64
Joined group address(es): ff02::1:ff00:1 ff02::1:ffa9:5606 ff02::2
ff02::1
MTU is 1514 (1500 is available to IPv6)
ICMP redirects are disabled
ICMP unreachables are enabled
ND DAD is enabled, number of DAD attempts 1
ND reachable time is 0 milliseconds
ND cache entry limit is 1000000000
ND advertised retransmit interval is 0 milliseconds
Hosts use stateless autoconfig for addresses.
Outgoing access list is not set
Inbound common access list is not set, access list is V6-INGRESS-ACL
Table Id is 0xe0800000
Complete protocol adjacency: 0
Complete glean adjacency: 0
Incomplete protocol adjacency: 0
Incomplete glean adjacency: 0
Dropped protocol request: 0
Dropped glean request: 0
…
ギガビット イーサネット インターフェイス上に IPv6 入力 ACL を正常に設定しました。
ギガビット イーサネット インターフェイス上での出力 IPv6 ACL の設定
GigE インターフェイス上で出力 IPv6 ACL を設定するには、次の設定を使用します。
/* Configure a GigE interface with an IPv6 address */
Router(config)# interface GigabitEthernet 0/0/0/1
Router(config-if)# ipv6 address 2001::1/64
Router(config-if)# no shut
Router(config-if)# commit
Thu Jan 25 11:41:25.778 IST
Router(config-if)# exit
/* Verify if the interface is up */
Router(config)# do show ipv6 interface brief
Thu Jan 25 12:38:35.742 IST
GigabitEthernet0/0/0/0 [Up/Up]
fe80::bd:b9ff:fea9:5606
1001::1
GigabitEthernet0/0/0/1 [Up/Up]
fe80::23:e9ff:fea8:a44e
2001::1
/* Configure an IPv6 egress ACL */
Router(config)# ipv6 access-list V6-EGRESS-ACL
Router(config-ipv6-acl)# 10 permit ipv6 any any
Router(config-ipv6-acl)# 20 deny udp any any
Router(config-ipv6-acl)# commit
Thu Jan 25 11:44:03.969 IST
Router(config-ipv6-acl)# exit
/* Verify the egress ACL creation */
Router(config)# do show access-lists ipv6
Thu Jan 25 11:45:53.823 IST
ipv6 access-list V6-EGRESS-ACL
10 permit ipv6 any any
20 deny udp any any
…
/* Apply the egress ACL to the GigE interface */
Router(config)# interface gigabitEthernet 0/0/0/1
Router(config-if)# ipv6 access-group V6-EGRESS-ACL egress
Router(config-if)# commit
Thu Jan 25 11:45:12.682 IST
Router(config-if)# exit
/* Verify if the egress ACL has been successfully applied to the interface */
Router(config)# do show ipv6 interface
Thu Jan 25 11:46:43.234 IST
…
GigabitEthernet0/0/0/1 is Up, ipv6 protocol is Up, Vrfid is default (0x60000000)
IPv6 is enabled, link-local address is fe80::23:e9ff:fea8:a44e
Global unicast address(es):
2001::1, subnet is 2001::/64
Joined group address(es): ff02::1:ff00:1 ff02::1:ffa8:a44e ff02::2
ff02::1
MTU is 1514 (1500 is available to IPv6)
ICMP redirects are disabled
ICMP unreachables are enabled
ND DAD is enabled, number of DAD attempts 1
ND reachable time is 0 milliseconds
ND cache entry limit is 1000000000
ND advertised retransmit interval is 0 milliseconds
Hosts use stateless autoconfig for addresses.
Outgoing access list is V6-EGRESS-ACL
Inbound common access list is not set, access list is not set
Table Id is 0xe0800000
Complete protocol adjacency: 0
Complete glean adjacency: 0
Incomplete protocol adjacency: 0
Incomplete glean adjacency: 0
Dropped protocol request: 0
Dropped glean request: 0
...
/* Configure a bundle interface with an IPv6 address */
Router(config)# interface Bundle-Ether 1
Router(config-if)# ipv6 address 3001::1/64
Router(config-if)# no shut
Router(config-if)# commit
Thu Jan 25 13:53:47.435 IST
Router(config-if)# exit
/* Configure an IPv6 egress ACL */
Router(config)# ipv6 access-list V6-EGRESS-ACL-bundle interface
Router(config-ipv6-acl)# 10 permit tcp any any range 3000 4000
Router(config-ipv6-acl)# 20 permit ipv6 any any
Router(config-ipv6-acl)# commit
Thu Jan 25 13:57:14.960 IST
Router(config-ipv6-acl)# exit
/* Configure an IPv6 ingress ACL to deny ingress traffic on the bundle interface */
Router(config)# ipv6 access-list V6-DENY-INGRESS-ACL
Router(config-ipv6-acl)# 10 deny ipv6 any any
Router(config-ipv6-acl)# commit
Thu Jan 25 13:59:23.198 IST
Router(config-ipv6-acl)# exit
/* Verify the egress and ingress ACL creation */
Router(config)# do show access-lists ipv6
Thu Jan 25 14:00:24.055 IST
ipv6 access-list V6-DENY-INGRESS-ACL
10 deny ipv6 any any
ipv6 access-list V6-EGRESS-ACL-BI
10 permit tcp any any range 3000 4000
20 permit ipv6 any any
...
/* Apply the egress and ingress ACLs to the bundle interface */
Router(config)# interface Bundle-Ether 1
Router(config-if)# ipv6 access-group V6-EGRESS-ACL-BI egress
Router(config-if)# ipv6 access-group V6-DENY-INGRESS-ACL ingress
Router(config-if)# commit
Thu Jan 25 14:04:19.536 IST
Router(config-if)# exit
/* Verify if the ACLs have been successfully applied to the interface */
Router(config)# do show ipv6 interface
Thu Jan 25 11:46:43.234 IST
…
Thu Jan 25 14:04:51.322 IST
Bundle-Ether1 is Down, ipv6 protocol is Down, Vrfid is default (0x60000000)
IPv6 is enabled, link-local address is fe80::1:10ff:fe87:8d04 [TENTATIVE]
Global unicast address(es):
3001::1, subnet is 3001::/64 [TENTATIVE]
Joined group address(es): ff02::2 ff02::1
MTU is 1514 (1500 is available to IPv6)
ICMP redirects are disabled
ICMP unreachables are enabled
ND DAD is enabled, number of DAD attempts 1
ND reachable time is 0 milliseconds
ND cache entry limit is 1000000000
ND advertised retransmit interval is 0 milliseconds
ND router advertisements are sent every 160 to 240 seconds
ND router advertisements live for 1800 seconds
Hosts use stateless autoconfig for addresses.
Outgoing access list is V6-EGRESS-ACL-BI
Inbound common access list is not set, access list is V6-DENY-INGRESS-ACL
Table Id is 0xe0800000
Complete protocol adjacency: 0
Complete glean adjacency: 0
Incomplete protocol adjacency: 0
Incomplete glean adjacency: 0
Dropped protocol request: 0
Dropped glean request: 0
*/ Create an Access List*/
Router(config)#ipv4 access-list acl_1
*/Add entries (ACEs) to the ACL*/
Router(config-ipv4-acl)#10 permit ip host 10.3.3.3 host 172.16.5.34
Router(config-ipv4-acl)#20 permit icmp any any
Router(config-ipv4-acl)#30 permit tcp any host 10.3.3.3
Router(config-ipv4-acl)#end
*/Verify the entries of the ACL*/:
Router#show access-lists ipv4 acl_1
ipv4 access-list acl_1
10 permit ip host 10.3.3.3 host 172.16.5.34
20 permit icmp any any
30 permit tcp any host 10.3.3.3
*/Add new entries, one with a sequence number "15" and another without a sequence number to the ACL. Delete an entry with the sequence number "30":*/
Router(config)#ipv4 access-list acl_1
Router(config-ipv4-acl)# 15 permit 10.5.5.5 0.0.0.255
Router(config-ipv4-acl)# no 30
Router(config-ipv4-acl)# permit 10.4.4.4 0.0.0.255
Router(config-ipv4-acl)# commit
*/When an entry is added without a sequence number, it is automatically given a sequence number
that puts it at the end of the access list. Because the default increment is 10, the entry will have a sequence
number 10 higher than the last entry in the existing access list*/
*/Verify the entries of the ACL:*/
Router(config)#show access-lists ipv4 acl_1
ipv4 access-list acl_1
10 permit ipv4 host 10.3.3.3 host 172.16.5.34
15 permit 10.5.5.5 0.0.0.255---*/newly added ACE (with the sequence number)*/
20 permit icmp any any
30 permit ipv4 10.4.4.0 0.0.0.255 any ---*/newly added ACE (without the sequence number)*/
*/The entry with the sequence number 30, that is, "30 permit tcp any host 10.3.3.3" is deleted from the ACL*/
ACL ベース転送を使用すると、ブロードキャスト TV over IP、IP テレフォニー、データなどを対象としたサービスを複数のプロバイダーから選択することが可能になり、カフェテリア形式でインターネットにアクセスできます。サービス プロバイダーは、ユーザ
トラフィックをさまざまなコンテンツ プロバイダーに迂回させることができます。
ローカル IP インターフェイス宛のパケット（「for-us」パケット）は、ABF アクションが含まれているルールに一致した場合はリダイレクトの対象になります。これは、「for-us」パケットへの一致を避けるために十分な具体的なルールを作成するか、またはABF
ルールの照合よりも前に（高いプライオリティの）明確な許可 ACL ルールを ACL に配置することで防ぐことができます。
設定例
ACL ベースの転送を設定するには、次のタスクを実行します。
/* Enter IPv4 access list configuration mode and configure an ACL: */
router# configure
router(config)# ipv4 access-list abf-acl
/* Set the conditions for the ACL and configure ABF: */
/* The next hop for this entry is specified. */
router(config-ipv4-acl)# 10 permit ipv4 192.168.18.0 0.255.255.255 any nexthop1 ipv4 192.168.20.2
router(config-ipv4-acl)# 15 permit ipv4 192.168.21.0 0.0.0.255 any
router(config-ipv4-acl)# 20 permit ipv4 192.168.22.0 0.0.255.255 any nexthop1 ipv4 192.168.23.2
/* More than two nexthops */
router(config-ipv4-acl)# 25 permit tcp any range 2000 3000 any range 4000 5000 nexthop1 ipv4 192.168.23.1 nexthop2 ipv4 192.168.24.1 nexthop3 ipv4 192.168.25.1
/* VRF support on ABF */
router(config-ipv4-acl)# 30 permit tcp any eq www host 192.168.12.2 precedence immediate nexthop1 vrf vrf1_ipv4 ipv4 192.168.13.2 nexthop2 vrf vrf1_ipv4 ipv4 192.168.14.2
router(config-ipv4-acl)# 35 permit ipv4 any any
router(config-ipv4-acl)# commit
/* (Optional) Display ACL information: */
router# show access-lists ipv4 abf-acl
実行コンフィギュレーション
ipv4 access-list abf-acl
10 permit ipv4 192.168.18.0 0.255.255.255 any nexthop1 192.168.20.2
15 permit ipv4 192.168.21.0 0.0.0.255 any
20 permit ipv4 192.168.22.0 0.0.255.255 any nexthop1 192.168.23.2
25 permit tcp any range 2000 3000 any range 4000 5000 nexthop1 ipv4 192.168.23.1 nexthop2 ipv4 192.168.24.1 nexthop3 ipv4 192.168.25.1
30 permit tcp any eq www host 192.168.12.2 precedence immediate nexthop1 vrf vrf1_ipv4 ipv4 192.168.13.2 nexthop2 vrf vrf1_ipv4 ipv4 192.168.14.2
35 permit ipv4 any any
commit
!
確認
ABF 内の IP ネクストホップの状態を確認し、その予想されるネクストホップが起動するようにするには、次のコマンドを使用します。
Router# show access-lists ipv4 abf nexthops client pfilter_ea location 0/0/CPU0
Wed Jan 24 14:18:58.667 UTC
ACL name : abf-acl
ACE seq. NH-1 NH-2 NH-3
--------- --------------- --------------- ---------------
10 192.168.13.2
status UP
at status Not Present
exist No
vrf default
track
pd ctx Present
25 192.168.14.2 192.168.11.1 192.168.12.1
status UP Down Down
at status Not Present Not Present Not Present
exist No Yes Yes
vrf default default default
track
pd ctx Present Not present Not present
30 192.168.15.1 192.168.12.7
status Unknown Unknown
at status Not Present Not Present
exist No Yes
vrf vrf1_ipv4 vrf1_ipv4
track
pd ctx Not present Not present
RP/0/RP0/CPU0:router(config)# ipv4 access-list v4-acl-ingressRP/0/RP0/CPU0:router(config-ipv4-acl)# 10 permit tcp any 10.1.1.0/24 dscp cs6RP/0/RP0/CPU0:router(config-ipv4-acl)# 20 deny udp any any eq sshRP/0/RP0/CPU0:router(config-ipv4-acl)# 30 permit ipv4 any anyRP/0/RP0/CPU0:router(config-ipv4-acl)# commitRP/0/RP0/CPU0:router(config-ipv4-acl)# exit
IPv4 出力 ACL を設定します。
RP/0/RP0/CPU0:router(config)# ipv4 access-list v4-acl-egressRP/0/RP0/CPU0:router(config-ipv4-acl)# 10 deny ipv4 any any fragments logRP/0/RP0/CPU0:router(config-ipv4-acl)# 20 deny tcp any any ackRP/0/RP0/CPU0:router(config-ipv4-acl)# 30 permit ipv4 any anyRP/0/RP0/CPU0:router(config-ipv4-acl)# commitRP/0/RP0/CPU0:router(config-ipv4-acl)# exit
/* Enter the global configuraton mode and configure an IPv4 access list */
Router# config
Router(config)# ipv4 access-list TEST
Router(config-ipv4-acl)# 10 permit tcp any any
/* Configure an ACE to match on the dont-fragment flag (indicates a non-fragmented packet)
and forward the packet to the default (pre-configured) next hop */
Router(config-ipv4-acl)# 20 permit tcp any any fragment-type dont-fragment default
/* Configure an ACE to match on the is-fragment flag (indicates a fragmented packet)
and forward the packet to a next hop of 10.10.10.1 */
Router(config-ipv4-acl)# 30 permit udp any any fragment-type is-fragment nexthop1 ipv4 10.10.10.1
/* Configure an ACE to match on the first-fragment flag (indicates the first fragment of a fragmented packet)
and forward the packet to a next hop of 20.20.20.1 */
Router(config-ipv4-acl)# 40 permit ospf any any fragment-type first-fragment nexthop1 ipv4 20.20.20.1
/* Configure an ACE to match on the last-fragment flag (indicates the last fragment of a fragmented packet)
and forward the packet to a next hop of 30.30.30.1 */
Router(config-ipv4-acl)# 50 permit icmp any any fragment-type last-fragment nexthop1 ipv4 30.30.30.1
Router(config-ipv4-acl)# commit
/* Enter the global configuraton mode and configure an IPv4 access list */
Router# config
Thu Jan 11 11:56:27.221 IST
Router(config)# ipv4 access-list ACLFIRSTFRAG
/* Configure an ACE to match on the first fragment.
If the fragment offset value equals 0, the fragment is forwarded to the 192.168.1.2 next hop */
Router(config-ipv4-acl)# 10 permit tcp any any fragment-type first-fragment nexthop1 ipv4 192.168.1.2
/* Configure an ACE to match on the last fragment, and drop the fragment at the interface. */
Router(config-ipv4-acl)# 20 deny tcp any any fragment-type last-fragment
Router(config-ipv4-acl)# commit
Thu Jan 11 12:01:33.297 IST
/* Validate the configuration */
Router(config-ipv4-acl)# do show access-lists
Thu Jan 11 12:05:23.646 IST
ipv4 access-list ACLFIRSTFRAG
10 permit tcp any any fragment-type first-fragment nexthop1 ipv4 192.168.1.20
20 deny tcp any any fragment-type last-fragment
この機能の詳細については、『IP Addresses and Services Configuration Guide for Cisco NCS 540 Series Routers』の「Implementing Access Lists and Prefix Lists」の章を参照してください。詳細なコマンド リファレンスについては、『』の「Access List Commands」の章を参照してください。
Router#
show access-lists ipv4 fragment-offset-acl hardware ing int Bundle-Ether70 loc 0/0/CPU0
Wed Apr 12 19:51:07.837 UTC
ipv4 access-list fragment-offset-acl
10 permit ipv4 any any fragment-offset range 300 400
RP/0/RP0/CPU0:router# configRP/0/RP0/CPU0:router(config)# ipv4 access-list pktlen-v4RP/0/RP0/CPU0:router(config-ipv4-acl)# 10 permit tcp any any packet-length eq 1664RP/0/RP0/CPU0:router(config-ipv4-acl)# 20 permit udp any any packet-length range 1600 2000RP/0/RP0/CPU0:router(config-ipv4-acl)# 30 deny ipv4 any any
ACL をコミットし、IPv4 ACL コンフィギュレーション モードを終了します。
RP/0/RP0/CPU0:router(config-ipv4-acl)# commitRP/0/RP0/CPU0:router(config-ipv4-acl)# end
/* From the global configuration mode, create a network object group. */RP/0/RP0/CPU0:router(config)# object-group network ipv4 netobj1RP/0/RP0/CPU0:router(config-object-group-ipv4)# description my-network-objectRP/0/RP0/CPU0:router(config-object-group-ipv4)# host 10.1.1.1RP/0/RP0/CPU0:router(config-object-group-ipv4)# 10.2.1.0 255.255.255.0RP/0/RP0/CPU0:router(config-object-group-ipv4)# range 10.3.1.10 10.3.1.50/* Create an access list referencing the object group. */RP/0/RP0/CPU0:router(config)# ipv4 access-list network-object-acl permit ipv4 net-group netobj1 any/* Apply the access list containing the object group to the desired interface and commit your configuration. */RP/0/RP0/CPU0:router(config)# interface Te/0/0/0/3 RP/0/RP0/CPU0:router(config-if)# ipv4 address 1.1.1.1/24RP/0/RP0/CPU0:router(config-if)# no shutRP/0/RP0/CPU0:router(config-if)# ipv4 access-group network-object-acl ingress compress level 3RP/0/RP0/CPU0:router(config-if)# commit
Tue Mar 28 10:23:34.106 IST
RP/0/0/CPU0:Mar 28 10:37:48.570 : ifmgr[397]: %PKT_INFRA-LINK-3-UPDOWN : Interface TenGigE0/0/0/10/3 , changed state to Down
RP/0/0/CPU0:Mar 28 10:37:48.608 : ifmgr[397]: %PKT_INFRA-LINK-3-UPDOWN : Interface TenGigE0/0/0/10/3 , changed state to Up
RP/0/RP0/CPU0:router(config-if)# exit
実行コンフィギュレーション
設定を確認します。
RP/0/RP0/CPU0:router(config)# show run
Tue Mar 28 10:37:55.737 IST
Building configuration...
!! IOS XR Configuration 0.0.0
...
!
object-group network ipv4 netobj1
10.2.1.0/24
host 10.1.1.1
range 10.3.1.10 10.3.1.50
description my-network-object
!
!
ipv4 access-list network-object-acl
10 permit ipv4 net-group netobj1 any
!
interface Te0/0/0/0/3
ipv4 address 1.1.1.1 255.255.255.0
ipv4 access-group network-object-acl ingress compress level 3
!
ネットワーク オブジェクトグループ ACL は正常に設定されました。
ポート オブジェクトグループ ACL の設定
ポート オブジェクト グループには単一または複数のポート オブジェクトを含めることができます。
設定
次の一連の設定ステートメントを使用して、ポート オブジェクトグループ ACL を設定します。
/* From the global configuration mode, create a port object group, and commit your configuration. */RP/0/RP0/CPU0:router(config)# object-group port portobj1RP/0/RP0/CPU0:router(config-object-group-ipv4)# description my-port-objectRP/0/RP0/CPU0:router(config-object-group-ipv4)# eq bgpRP/0/RP0/CPU0:router(config-object-group-ipv4)# range 100 200RP/0/RP0/CPU0:router(config-object-group-ipv4)# commitRP/0/RP0/CPU0:router(config-object-group-ipv4)# exit/* Create an access list referencing the object group. */RP/0/RP0/CPU0:router(config)# ipv4 access-list port-object-acl permit ipv4 net-group portobj1 /* Apply the access list containing the object group to the desired interface and commit your configuration. */RP/0/RP0/CPU0:router(config)# interface Te0/0/0/3 RP/0/RP0/CPU0:router(config-if)# ipv4 address 2.2.2.2/24RP/0/RP0/CPU0:router(config-if)# ipv4 access-group port-obj-acl ingress compress level 3RP/0/RP0/CPU0:router(config-if)# no shutRP/0/RP0/CPU0:router(config-if)# commit
Tue Mar 28 10:23:34.106 IST
RP/0/0/CPU0:Mar 28 10:37:48.570 : ifmgr[397]: %PKT_INFRA-LINK-3-UPDOWN : Interface TenGigE0/0/0/10/3 , changed state to Down
RP/0/0/CPU0:Mar 28 10:37:48.608 : ifmgr[397]: %PKT_INFRA-LINK-3-UPDOWN : Interface TenGigE0/0/0/10/3 , changed state to Up
RP/0/RP0/CPU0:router(config-if)# exit
実行コンフィギュレーション
設定を確認します。
RP/0/RP0/CPU0:router(config)# show run
Tue Mar 28 10:37:55.737 IST
Building configuration...
!! IOS XR Configuration 0.0.0
...
object-group port portobj1
eq bgp
range 100 200
!
ipv4 access-list port-object-acl
10 permit tcp net-group portobj1
!
interface Te/0/0/0/3ipv4 access-group port-obj-acl ingress compress level 3
!
end
!
/* Enable TTL matching in the global configuration mode by using the hw-module command */
Router(config)# hw-module profile tcam format access-list ipv4 dst-addr dst-port proto port-range enable-set-ttl ttl-match
/* Configure an IPv4 ACL with the TTL parameters */
Router(config)# ipv4 access-list acl-v4
Router(config-ipv4-acl)# 10 deny tcp any any ttl eq 100
Router(config-ipv4-acl)# 20 permit tcp any any ttl range 1 50 set ttl 200
Router(config-ipv4-acl)# 30 permit tcp any any ttl neq 100 set ttl 255
Router(config-ipv4-acl)# commit
Thu Nov 2 12:22:58.948 IST
/* Attach the IPv4 ACL to the GigE interface */
Router(config)# interface Te0/0/0/0
Router(config-if)# ipv4 address 15.1.1.1 255.255.255.0
Router(config-if)# ipv4 access-group acl-v4 ingress
Router(config-if)# commit
実行コンフィギュレーション
show run コマンドを使用して設定を検証します。
Router(config)# show run
Thu Nov 2 14:01:53.376 IST
Building configuration...
!! IOS XR Configuration 0.0.0
!! Last configuration change at Thu Nov 2 12:22:59 2017 by annseque
!
hw-module profile tcam format access-list ipv4 dst-addr dst-port proto port-range enable-set-ttl ttl-match
!
ipv4 access-list acl-v4
10 deny tcp any any ttl eq 100
20 permit tcp any any ttl range 1 50 set ttl 200
30 permit tcp any any ttl neq 100 set ttl 255
!
interface Te0/0/0/0
ipv4 address 15.1.1.1 255.255.255.0
ipv4 access-group acl-v4 ingress
!
/* Enable TTL matching in the global configuration mode by using the hw-module command */
Router(config)# hw-module profile tcam format access-list ipv6 dst-addr dst-port enable-set-ttl ttl-match
/* Configure an IPv6 ACL with the TTL parameters */
Router(config)# ipv4 access-list acl-v6
Router(config-ipv4-acl)# 10 deny tcp any any ttl eq 50
Router(config-ipv4-acl)# 20 permit tcp any any ttl lt 50 set ttl 255
Router(config-ipv4-acl)# 30 permit tcp any any ttl gt 50 set ttl 200
Router(config-ipv4-acl)# commit
Thu Nov 2 12:22:58.948 IST
/* Attach the IPv6 ACL to the GigE interface */
Router(config)# interface Te0/0/0/0
Router(config-if)# ipv6 address 2001:2:1::1/64
Router(config-if)# ipv6 access-group acl-v6 ingress
Router(config-if)# commit
実行コンフィギュレーション
show run コマンドを使用して設定を検証します。
Router(config)# show run
Thu Nov 2 14:01:53.376 IST
Building configuration...
!! IOS XR Configuration 0.0.0
!! Last configuration change at Thu Nov 2 12:22:59 2017 by annseque
!
hw-module profile tcam format access-list ipv6 dst-addr dst-port enable-set-ttl ttl-match
!
ipv4 access-list acl-v6
10 deny tcp any any ttl eq 50
20 permit tcp any any ttl lt 50 set ttl 255
30 permit tcp any any ttl gt 50 set ttl 200
!
interface Te0/0/0/0
ipv6 address 2001:2:1::1/64
ipv4 access-group acl-v6 ingress
!
「Deny all routes with a prefix of 10/8」というコメントが付いたプレフィックス リスト「pfx_2」を作成します。このプレフィックス リストは、128.0.0.0/8 の /24 に一致するプレフィックスをすべて拒否します。
Router#configure
Router(config)#ipv4 prefix-list pfx_2
Router(config-ipv4_pfx)#10 remark Deny all routes with a prefix of 10/8
Router(config-ipv4_pfx)#20 deny 128.0.0.0/8 eq 24
/* Repeat the above step as necessary. Use the no sequence-number command to delete an entry. */
Router(config-ipv4_pfx)#commit
実行コンフィギュレーション
Router#show running-config ipv4 prefix-list pfx_2
ipv4 prefix-list pfx_2
10 remark Deny all routes with a prefix of 10/8
20 deny 128.0.0.0/8 eq 24
!
確認
許可とコメントの設定が設定されているコンフィギュレーションに合致していることを確認します。
Router# show prefix-list pfx_2
ipv4 prefix-list pfx_2
10 remark Deny all routes with a prefix of 10/8
20 deny 128.0.0.0/8 eq 24
RP/0/RP0/CPU0:ios#
Router#config
Router(config)#ipv4 prefix-list cl_1
Router(config)#10 permit 172.16.0.0 0.0.255.255
/* Repeat the above step as necessary adding statements by sequence number where you planned; use the no sequence-number command to delete an entry */
Router(config)#commitend
Router#resequence prefix-list ipv4 cl_1 20 15
フィードバック