Skip to main content
您好,欢迎光临IDC汇,需要什么服务器直接咨询客服,方便快捷。客服QQ 点击这里给我发消息
首页 > 服务器安全 »正文

ORF 出站路由过滤

服务器安全 webadmin 2020-07-01 08:48:40 查看评论 加入收藏

此实验 是为了验证ORF(出站路由过滤)

 

ORF 出站路由过滤

 

R1配置:

Loopback0 1.1.1.1

Loopback1 192.168.1.1/24

Loopback2 192.168.2.1/24

Loopback3 192.168.3.1/24

Loopback4 192.168.4.1/24

E1/0 10.1.12.1

R2配置:

Loopback 2.2.2.2

E1/0 10.1.12.2

 

配置IGP(RIP)保持连通性:

R1配置:

router rip

 version 2

 network 1.0.0.0

 network 10.0.0.0

 network 192.168.1.0

 network 192.168.2.0

 network 192.168.3.0

 network 192.168.4.0

 no auto-summary

R2配置:

router rip

 version 2

 network 2.0.0.0

 network 10.0.0.0

 no auto-summary

 

开始配置BGP:

 

R1配置:

router bgp 1

 bgp router-id 1.1.1.1

 bgp log-neighbor-changes

 network 1.1.1.0 mask 255.255.255.255

 network 10.1.12.0 mask 255.255.255.0

 network 192.168.1.0

 network 192.168.2.0

 network 192.168.3.0

 network 192.168.4.0

 neighbor 2.2.2.2 remote-as 2

 neighbor 2.2.2.2 ebgp-multihop 2

 neighbor 2.2.2.2 update-source Loopback0

 

R2配置:

router bgp 2

 bgp router-id 2.2.2.2

 bgp log-neighbor-changes

 network 2.2.2.2 mask 255.255.255.255 backdoor

 network 10.1.12.0 mask 255.255.255.0

 neighbor 1.1.1.1 remote-as 1

 neighbor 1.1.1.1 ebgp-multihop 2

 neighbor 1.1.1.1 update-source Loopback0

 

BGP 配置完成,这时可以在R2上看到R1通告的192.168.1.0/24 192.168.2.0/24 192.168.3.0/24 192.168.4.0/24 四条路由。

 

R2#sh ip bgp

BGP table version is 6, local router ID is 2.2.2.2

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,

              x best-external, a additional-path, c RIB-compressed,

Origin codes: i - IGP, e - EGP, ? - incomplete

RPKI validation codes: V valid, I invalid, N Not found

 

     Network          Next Hop            Metric LocPrf Weight Path

 r>  10.1.12.0/24     1.1.1.1                  0             0 1 i

 *>  192.168.1.0      1.1.1.1                  0             0 1 i

 *>  192.168.2.0      1.1.1.1                  0             0 1 i

 *>  192.168.3.0      1.1.1.1                  0             0 1 i

 *>  192.168.4.0      1.1.1.1                  0             0 1 i

 

现在开始在R2上配置ORF过滤掉192.168.1.0/24 192.168.3.0/24,使R2只接收192.168.2.0/24 192.168.4.0/24两条路由


首先配置prefix-list列表:

ip prefix-list 1 seq 5 permit 192.168.2.0/24

ip prefix-list 1 seq 10 permit 192.168.4.0/24

 

之后在R1/R2上追加配置:

router bgp 1

neighbor 2.2.2.2 capability orf prefix-list receive

 

*Jul 12 14:44:55.843: %BGP-5-ADJCHANGE: neighbor 2.2.2.2 Down Capability changed

*Jul 12 14:44:55.843: %BGP_SESSION-5-ADJCHANGE: neighbor 2.2.2.2 IPv4 Unicast topology base removed from session  Capability changed

*Jul 12 14:44:56.271: %BGP-5-ADJCHANGE: neighbor 2.2.2.2 Up

 

配置完成后,会提示 capability changed。

 

router bgp 2

nei 1.1.1.1 capability orf prefix-list both

nei 1.1.1.1 prefix-list 1 in

 

*Jul 12 14:35:27.863: %BGP-5-ADJCHANGE: neighbor 1.1.1.1 Down Capability changed

*Jul 12 14:35:27.863: %BGP_SESSION-5-ADJCHANGE: neighbor 1.1.1.1 IPv4 Unicast topology base removed from session  Capability changed

*Jul 12 14:35:28.823: %BGP-5-ADJCHANGE: neighbor 1.1.1.1 Up

 

配置完成后,会提示 capability changed。

 

R2上的配置:

命令neighbor 1.1.1.1 capability orf prefix-list both 的作用是:激活R2与R1 BGP邻居之间的ORF功能,表明R1与R2 “交换”prefix-list。


命令nei 1.1.1.1 prefix-list 1 in的作用是:R2只接收路由前缀192.168.2.0/24 192.168.4.0/24这两条路由,拒绝其他所有路由。


命令clear ip bgp 1.1.1.1 in prefix-filter 的作用是:迫使R2把本路由器设置的入站方向的prefix-list推送给R1。

 

R1上的配置:

命令neighbor 2.2.2.2 capability orf prefix-list receive的作用是:接受R2推送过来关于ORF的相关路由过滤设置。

 

至此,配置完成,可在R1上查看效果:


R1#sh ip bgp neighbors 2.2.2.2 advertised-routes

BGP table version is 6, local router ID is 1.1.1.1

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,

              x best-external, a additional-path, c RIB-compressed,

Origin codes: i - IGP, e - EGP, ? - incomplete

RPKI validation codes: V valid, I invalid, N Not found

 

     Network          Next Hop            Metric LocPrf Weight Path

 *>  192.168.2.0      0.0.0.0                  0         32768 i

 *>  192.168.4.0      0.0.0.0                  0         32768 i

 

Total number of prefixes 2

 

在R1上能看到R1只向R2发送路由192.168.2.0/24 192.168.4.0/24这两条路由,其他的路由都被拒绝,证明R2的配置正确,并且R1收到了R2推送过来的ORF过滤路由配置。

 

 

R2#sh ip bgp

BGP table version is 9, local router ID is 2.2.2.2

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,

              x best-external, a additional-path, c RIB-compressed,

Origin codes: i - IGP, e - EGP, ? - incomplete

RPKI validation codes: V valid, I invalid, N Not found

 

     Network          Next Hop            Metric LocPrf Weight Path

 *>  10.1.12.0/24     0.0.0.0                  0         32768 i

 *>  192.168.2.0      1.1.1.1                  0             0 1 i

 *>  192.168.4.0      1.1.1.1                  0             0 1 i

 

同样的,在R2上也能看到效果,从R1只收到permit的两条路由前缀。


所以实际上ORF是借助prefix-list去实现路由过滤的一个特性,在本地将prefix-list推送给对端,让对端来执行路由前缀的过滤。

 


广告06

微信