Example for Configuring Packet Filtering

Procedure

1. Create VLANs and configure interfaces on SwitchA.

   # Create VLAN 100 and VLAN 200.

   <HUAWEI> system-view
   [~HUAWEI] sysname SwitchA
   [*HUAWEI] commit
   [~SwitchA] vlan batch 100 200
   [*SwitchA] commit
   

   # 10GE1/0/2 and 10GE1/0/3 on SwitchB are access interfaces by default. Add 10GE1/0/2 to VLAN 100 and 10GE1/0/3 to VLAN 200, and configure 10GE1/0/1 as a trunk interface and add 10GE1/0/1 to VLAN 100 and VLAN 200.

   [~SwitchA] interface 10ge 1/0/1
   [~SwitchA-10GE1/0/1] port link-type trunk
   [*SwitchA-10GE1/0/1] port trunk allow-pass vlan 100 200
   [*SwitchA-10GE1/0/1] quit
   [*SwitchA] interface 10ge 1/0/2
   [*SwitchA-10GE1/0/2] port default vlan 100
   [*SwitchA-10GE1/0/2] quit
   [*SwitchA] interface 10ge 1/0/3
   [*SwitchA-10GE1/0/3] port default vlan 200
   [*SwitchA-10GE1/0/3] quit
   [*SwitchA] commit
   

2. Create VLANs and configure interfaces on SwitchB.

   # Create VLAN 100 and VLAN 200.

   <HUAWEI> system-view
   [~HUAWEI] sysname SwitchB
   [*SwitchB] vlan batch 100 200
   [*SwitchB] commit
   

   # Configure 10GE1/0/1 as a trunk interface and add 10GE1/0/1 to VLAN 100 and VLAN 200.

   [~SwitchB] interface 10ge 1/0/1
   [~SwitchB-10GE1/0/1] port link-type trunk
   [*SwitchB-10GE1/0/1] port trunk allow-pass vlan 100 200
   [*SwitchB-10GE1/0/1] quit
   [*SwitchB] commit
   

3. Configure an ACL rule.

   # Create ACL 3001 on SwitchB to match flows with source IP address 192.168.4.1 and destination IP address 192.168.2.1 (flows sent from the web server to the PC in the multimedia room).

   [~SwitchB] acl 3001
   [*SwitchB-acl4-advance-3001] rule permit ip destination 192.168.2.1 24 source 192.168.4.1 24
   [*SwitchB-acl4-advance-3001] quit
   [*SwitchB] commit

4. Configure a traffic classifier.

   # Create a traffic classifier named c1 on SwitchB and reference ACL 3001 in the traffic classifier.

   [~SwitchB] traffic classifier c1
   [*SwitchB-classifier-c1] if-match acl 3001
   [*SwitchB-classifier-c1] quit
   [*SwitchB] commit

5. Configure a traffic behavior.

   # Configure a traffic behavior named b1 on SwitchB and define the deny action.

   [~SwitchB] traffic behavior b1
   [*SwitchB-behavior-b1] deny
   [*SwitchB-behavior-b1] quit
   [*SwitchB] commit

6. Configure a traffic policy and apply the traffic policy to 10GE1/0/1 in the inbound direction.

   # Create a traffic policy named p1 on SwitchB and bind the traffic policy to the traffic classifier and traffic behavior.

   [~SwitchB] traffic policy p1
   [*SwitchB-trafficpolicy-p1] classifier c1 behavior b1
   [*SwitchB-trafficpolicy-p1] quit
   [*SwitchB] commit

   # Apply the traffic policy p1 to 10GE1/0/1 in the inbound direction.

   [~SwitchB] interface 10ge 1/0/1
   [~SwitchB-10GE1/0/1] traffic-policy p1 inbound
   [*SwitchB-10GE1/0/1] quit
   [*SwitchB] commit
   [~SwitchB] quit

7. Verify the configuration.

   # Check the ACL rule configuration.

   <SwitchB> display acl 3001
   Advanced ACL 3001, 1 rule                                                                                                           
   ACL's step is 5                                                                                                                     
    rule 5 permit ip source 192.168.4.0 0.0.0.255 destination 192.168.2.0 0.0.0.255 (0 times matched)                                 
   

   # View the traffic classifier configuration.

   <SwitchB> display traffic classifier c1
     Traffic Classifier Information:
       Classifier: c1
         Type: OR
         Rule(s):
           if-match acl 3001

   # View the traffic policy configuration.

   <SwitchB> display traffic policy p1
     Traffic Policy Information:
       Policy: p1
         Classifier: c1
           Type: OR
         Behavior: b1
           Deny