配置ACL6及IPv6报文过滤实验

学习精彩网络技术老师：华为、华三、锐捷、WLAN、IPv6等全套视频课程
学习精彩网络技术老师：华为HCIA和HCIP数通eNSP实战视频课
学习IPv6全套课程：IPv6组网实战从入门到精通视频课程

本举例介绍ACL6及IPv6报文过滤的配置过程。

组网需求

如图1所示，路由器RouterA通过POS接口与RouterB相连。在RouterA上配置ACL6规则，禁止源地址为2001:db8::2的IPv6报文进入RouterA的接口POS1/0/0。

图1 配置ACL6及IPv6报文过滤组网图

配置思路

配置ACL6的思路如下：

定义ACL6编号

定义ACL6的具体规则

定义报文过滤分类、动作和策略

数据准备

为完成此配置例，需准备如下的数据：

ACL6编号

拒绝通过的源IPv6地址

操作步骤

1. 分别在RouterA和RouterB上使能IPv6转发能力，并配置接口参数，确认连通性

# 配置RouterA。

<HUAWEI> system-view

[HUAWEI] sysname RouterA

[RouterA] ipv6

[RouterA] interface pos 1/0/0

[RouterA-Pos1/0/0] ipv6 enable

[RouterA-Pos1/0/0] ipv6 address 2001:db8::1 64

[RouterA-Pos1/0/0] undo shutdown

[RouterA-Pos1/0/0] quit

# 配置RouterA上的静态路由。

[RouterA] ipv6 route-static 2001:db8:1:: 64 2001:db8::2

# 配置RouterB。

<HUAWEI> system-view

[HUAWEI] sysname RouterB

[RouterB] ipv6

[RouterB] interface loopback 2

[RouterB-LoopBack2] ipv6 enable

[RouterB-LoopBack2] ipv6 address 2001:db8:1::1 64

[RouterB-LoopBack2] quit

[RouterB] interface pos 1/0/0

[RouterB-Pos1/0/0] ipv6 enable

[RouterB-Pos1/0/0] ipv6 address 2001:db8::2 64

[RouterB-Pos1/0/0] undo shutdown

[RouterB-Pos1/0/0] quit

# 从RouterB的POS1/0/0接口ping RouterA的POS1/0/0接口。

[RouterB] ping ipv6 -a 2001:db8::1

  PING 2001:DB8::1 : 56  data bytes, press CTRL_C to break

    Reply from 2001:DB8::1

    bytes=56 Sequence=1 hop limit=64  time = 80 ms

    Reply from 2001:DB8::1

    bytes=56 Sequence=2 hop limit=64  time = 50 ms

    Reply from 2001:DB8::1

    bytes=56 Sequence=3 hop limit=64  time = 40 ms

    Reply from 2001:DB8::1

    bytes=56 Sequence=4 hop limit=64  time = 30 ms

    Reply from 2001:DB8::1

    bytes=56 Sequence=5 hop limit=64  time = 1 ms

  --- 2001:DB8::1 ping statistics ---

    5 packet(s) transmitted

    5 packet(s) received

    0.00% packet loss

    round-trip min/avg/max = 1/40/80 ms

Ping操作执行成功，没有超时或异常延迟。

# 从RouterB的Loopback2接口ping RouterA的POS1/0/0接口。

[RouterB] ping ipv6 -a 2001:db8::1

  PING 2001:DB8::1 : 56  data bytes, press CTRL_C to break

    Reply from 2001:DB8::1

    bytes=56 Sequence=1 hop limit=64  time = 60 ms

    Reply from 2001:DB8::1

    bytes=56 Sequence=2 hop limit=64  time = 30 ms

    Reply from 2001:DB8::1

    bytes=56 Sequence=3 hop limit=64  time = 20 ms

    Reply from 2001:DB8::1

    bytes=56 Sequence=4 hop limit=64  time = 50 ms

    Reply from 2001:DB8::1

    bytes=56 Sequence=5 hop limit=64  time = 20 ms

  --- 2001:DB8::1 ping statistics ---

    5 packet(s) transmitted

    5 packet(s) received

    0.00% packet loss

    round-trip min/avg/max = 20/36/60 ms

Ping操作执行成功，没有超时或异常延迟。

1. 在RouterA上配置一个ACL6规则，并在接口上应用该规则，用于拒绝来自2001:db8::2的IPv6报文

# 配置RouterA。

[RouterA] acl ipv6 number 3001

[RouterA-acl6-adv-3001] rule deny ipv6 source 2001:db8::2/128

[RouterA-acl6-adv-3001] quit

[RouterA] traffic classifier bb

[RouterA-classifier-bb] if-match ipv6 acl 3001

[RouterA-classifier-bb] quit

[RouterA] traffic behavior aa

[RouterA-behavior-aa] permit

[RouterA-behavior-aa] quit

[RouterA] traffic policy cc

[RouterA-trafficpolicy-cc] classifier bb behavior aa

[RouterA-trafficpolicy-cc] quit

[RouterA] interface pos 1/0/0

[RouterA-Pos1/0/0] traffic-policy cc inbound 

[RouterA-Pos1/0/0] quit

1. 验证配置结果

# 从RouterB的POS1/0/0接口ping RouterA的POS1/0/0接口。

[RouterB] ping ipv6 -a 2001:db8::1

  PING 2001:DB8::1 : 56  data bytes, press CTRL_C to break

    Request time out

    Request time out

    Request time out

    Request time out

    Request time out

  --- 2001:DB8::1 ping statistics ---

    5 packet(s) transmitted

    0 packet(s) received

    100.00% packet loss

    round-trip min/avg/max = 0/0/0 ms

Ping操作执行不成功。

# 从RouterB的Loopback2接口ping RouterA的POS1/0/0接口。

[RouterB] ping ipv6 -a 2001:db8::1

  PING 2001:DB8::1 : 56  data bytes, press CTRL_C to break

    Reply from 2001:DB8::1

    bytes=56 Sequence=1 hop limit=64  time = 80 ms

    Reply from 2001:DB8::1

    bytes=56 Sequence=2 hop limit=64  time = 50 ms

    Reply from 2001:DB8::1

    bytes=56 Sequence=3 hop limit=64  time = 40 ms

    Reply from 2001:DB8::1

    bytes=56 Sequence=4 hop limit=64  time = 40 ms

    Reply from 2001:DB8::1

    bytes=56 Sequence=5 hop limit=64  time = 30 ms

  --- 2001:DB8::1 ping statistics ---

    5 packet(s) transmitted

    5 packet(s) received

    0.00% packet loss

    round-trip min/avg/max = 30/48/80 ms

Ping操作执行成功，没有超时或异常延迟。

IPv6 ACL's step is 5

配置文件

Router A的配置

#

 sysname RouterA

#

 ipv6

#

acl ipv6 number 3001

 rule 0 deny ipv6 source 2001:DB8::2/128

#

traffic classifier bb operator or

 if-match ipv6 acl 3001

#

traffic behavior aa

#

traffic policy cc

 undo share-mode

 classifier bb behavior aa

#

interface pos1/0/0

 link-protocol ppp

 undo shutdown

traffic-policy cc inbound

 ipv6 enable

 ipv6 address 2001:DB8::1/64

#

 ipv6 route-static 2001:DB8:1:: 64 2001:DB8::2

#

return

Router B的配置

#

 sysname RouterB

#

 ipv6

#

interface pos1/0/0

 link-protocol ppp

 undo shutdown

 ipv6 enable        

 ipv6 address 2001:DB8::2/64

#

interface LoopBack2

 ipv6 enable        

 ipv6 address 2001:DB8:1::1/64

#

return