配置报文过滤示例
组网需求
如图6-2所示,用户通过SwitchA的接口GE1/0/2连接到外部网络设备。
不同业务的报文在LSW侧使用802.1p优先级进行标识,当报文从接口GE1/0/2到达外部网络时,用户希望能够对数据业务报文进行过滤,优先保证语音和视频业务的业务体验。
配置思路
- 配置各接口,实现用户能通过SwitchA访问外部网络。
- 配置流分类,实现基于802.1p优先级对报文进行分类。
- 配置流行为,实现对满足规则的报文进行禁止或允许动作。
- 配置流策略,绑定上述流分类和流行为,并应用到接口GE1/0/1的入方向,实现报文过滤。
操作步骤
- 创建VLAN并配置各接口
# 在Switch上创建VLAN10。
<HUAWEI> system-view [HUAWEI] sysname SwitchA [SwitchA] vlan 10 [SwitchA-vlan10] quit
# 配置SwitchA上接口GE1/0/1和GE1/0/2为Trunk类型接口,并加入VLAN10。
[SwitchA] interface gigabitethernet 1/0/1 [SwitchA-GigabitEthernet1/0/1] port link-type trunk [SwitchA-GigabitEthernet1/0/1] port trunk allow-pass vlan 10 [SwitchA-GigabitEthernet1/0/1] quit [SwitchA] interface gigabitethernet 1/0/2 [SwitchA-GigabitEthernet1/0/2] port link-type trunk [SwitchA-GigabitEthernet1/0/2] port trunk allow-pass vlan 10 [SwitchA-GigabitEthernet1/0/2] quit
请配置LSW与SwitchA对接的接口为Trunk类型,并加入VLAN10。
# 创建VLANIF10,并为VLANIF10配置IP地址192.168.2.1/24。
[SwitchA] interface vlanif 10 [SwitchA-Vlanif10] ip address 192.168.2.1 24 [SwitchA-Vlanif10] quit
请配置Router与SwitchA对接的接口IP地址为192.168.2.2/24。
- 配置流分类
# 在SwitchA上创建并配置流分类c1、c2、c3,对报文按照802.1p优先级进行分类。
[SwitchA] traffic classifier c1 [SwitchA-classifier-c1] if-match 8021p 2 [SwitchA-classifier-c1] quit [SwitchA] traffic classifier c2 [SwitchA-classifier-c2] if-match 8021p 5 [SwitchA-classifier-c2] quit [SwitchA] traffic classifier c3 [SwitchA-classifier-c3] if-match 8021p 6 [SwitchA-classifier-c3] quit
- 配置流行为
# 在SwitchA上创建流行为b1,并配置禁止动作。
[SwitchA] traffic behavior b1 [SwitchA-behavior-b1] deny [SwitchA-behavior-b1] quit
# 在SwitchA上创建流行为b2和b3,并配置允许动作。
[SwitchA] traffic behavior b2 [SwitchA-behavior-b2] permit [SwitchA-behavior-b2] quit [SwitchA] traffic behavior b3 [SwitchA-behavior-b3] permit [SwitchA-behavior-b3] quit
- 配置流策略并应用到接口上
# 在SwitchA上创建流策略p1,将流分类和对应的流行为进行绑定并将流策略应用到接口GE1/0/1的入方向上,对报文进行过滤。
[SwitchA] traffic policy p1 [SwitchA-trafficpolicy-p1] classifier c1 behavior b1 [SwitchA-trafficpolicy-p1] classifier c2 behavior b2 [SwitchA-trafficpolicy-p1] classifier c3 behavior b3 [SwitchA-trafficpolicy-p1] quit [SwitchA] interface gigabitethernet 1/0/1 [SwitchA-GigabitEthernet1/0/1] traffic-policy p1 inbound [SwitchA-GigabitEthernet1/0/1] quit
- 验证配置结果
# 查看流分类的配置信息。
[SwitchA] display traffic classifier user-defined User Defined Classifier Information: Classifier: c2 Precedence: 10 Operator: OR Rule(s) : if-match 8021p 5 Classifier: c3 Precedence: 15 Operator: OR Rule(s) : if-match 8021p 6 Classifier: c1 Precedence: 5 Operator: OR Rule(s) : if-match 8021p 2 Total classifier number is 3
# 查看流策略的应用信息。
[SwitchA] display traffic-policy applied-record p1 ------------------------------------------------- Policy Name: p1 Policy Index: 0 Classifier:c1 Behavior:b1 Classifier:c2 Behavior:b2 Classifier:c3 Behavior:b3 ------------------------------------------------- *interface GigabitEthernet1/0/1 traffic-policy p1 inbound slot 1 : success ------------------------------------------------- Policy total applied times: 1.
配置文件
SwitchA的配置文件
# sysname SwitchA # vlan batch 10 # traffic classifier c1 operator or precedence 5 if-match 8021p 2 traffic classifier c2 operator or precedence 10 if-match 8021p 5 traffic classifier c3 operator or precedence 15 if-match 8021p 6 # traffic behavior b1 deny traffic behavior b2 permit traffic behavior b3 permit # traffic policy p1 match-order config classifier c1 behavior b1 classifier c2 behavior b2 classifier c3 behavior b3 # interface Vlanif10 ip address 192.168.2.1 255.255.255.0 # interface GigabitEthernet1/0/1 port link-type trunk port trunk allow-pass vlan 10 traffic-policy p1 inbound # interface GigabitEthernet1/0/2 port link-type trunk port trunk allow-pass vlan 10 # return