访问列表大解密 access-list（访问列表）(5)

reflect+evalute实现单向访问控制列表的最新实验结果

interface Vlan12
ip address 10.147.18.92 255.255.255.240
ip access-group in-filter in
ip access-group out-filter out
ip helper-address 10.147.17.193
no ip redirects
standby 12 ip 10.147.18.94
standby 12 priority 150
standby 12 preempt

第一步:
ip access-list extended in-filter
evaluate abcd
deny ip any any
ip access-list extended out-filter
permit ip any any reflect abcd
结果从VLAN12上的客户机ping其它VLAN的机器,提示:
Reply from 10.147.18.92: Destination net unreachable.

第二步:
将上面的访问控制列表改为:
ip access-list extended in-filter
permit ip any any reflect abcd
ip access-list extended out-filter
evaluate abcd
deny ip any any
结果从VLAN12的客户机可以ping通其它vlan的机器,但其它vlan的机器ping不通vlan12的机器.
观察发现,我从vlan12的客户机上ping 其它vlan里面的任何一台机器的话,就会自动生成一条动态度的

access-list,(假如 我从vlan12的机器10.147.18.90 ping vlan1里面的10.147.17.251)
记录如下:
Reflexive IP access list abcd
permit icmp host 10.147.17.251 host 10.147.18.90 (8 matches) (time left 297)
permit udp host 202.96.170.163 eq 8000 host 10.147.18.90 eq 4000 (6 matches) (time left 247)
permit udp host 224.0.0.2 eq 1985 host 10.147.18.93 eq 1985 (155 matches) (time left 299)
Extended IP access list in-filter
permit ip any any reflect abcd
Extended IP access list out-filter
evaluate abcd
deny ip any any (289 matches)

第三步:我想实现功能:vlan12里的机器能访问所有其他vlan,除了vlan 2(10.147.16.0/255.255.255.128)外均

不能访问vlan12:
将访问控制列表改为:
ip access-list extended in-filter
permit ip any any reflect abcd
ip access-list extended out-filter
evaluate abcd
permit ip 10.147.16.0 0.0.0.128 any
deny ip any any
结果一开始几分钟内,除了定义的VLAN2(10.147.16.0/255.255.255.128)外,其它vlan的机器均ping不通vlan 12 的机器
后来就全部PING
不通,和第二次开发步的结果相同
我用你的方法在cisco3560交换机上测试，应用acl后，双方向都不通了。分析一下怎么回事，配置如下：
4号口划分到vlan3，48号口划分到vlan2

Switch#sh run
Building configuration...

22:07:10: %SYS-5-CONFIG_I: Configured from console by console
Current configuration : 2724 bytes
!
version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname Switch
!
!
no aaa new-model
ip subnet-zero
ip routing
!
!
!
!
no file verify auto
spanning-tree mode pvst
spanning-tree portfast default
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
interface GigabitEthernet0/4
switchport access vlan 3
!
...........

!
interface GigabitEthernet0/48
switchport access vlan 2
!
...........
!
interface Vlan1
no ip address
!
interface Vlan2
ip address 10.10.10.1 255.255.255.0
!
interface Vlan3
ip address 192.9.200.253 255.255.255.0
ip access-group in-control in
ip access-group out-control out
!
ip classless
ip http server
!
ip access-list extended in-control
permit ip any any reflect test
ip access-list extended out-control
evaluate test
deny ip 10.10.10.0 0.0.0.255 any
permit ip any any
!
!
control-plane
!
!
line con 0
line vty 0 4
no login
line vty 5 15
no login
!
end

Switch#