FILTER-POLICY的应用实例

具体需求

1）技术部不能访问任何部门，任何部门不能访问技术部

2）销售部不能访问财务部

3）销售部能访问总部

4）财务部能访问总部

5）总部能够访问财务部和销售部

配置内容

R1:

<r1>display current-configuration  

[V200R003C00]

#

sysname r1

#

snmp-agent local-engineid 800007DB03000000000000

snmp-agent  

#

clock timezone China-Standard-Time minus 08:00:00

#

portal local-server load portalpage.zip

#

drop illegal-mac alarm

#

set cpu-usage threshold 80 restore 75

#

acl number 2000  

rule 10 deny source 30.1.1.0 0.0.0.255  

rule 20 permit  

#

aaa  

authentication-scheme default

authorization-scheme default

accounting-scheme default

domain default  

domain default_admin  

local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$

local-user admin service-type http

#

firewall zone Local

priority 15

#

interface GigabitEthernet0/0/0

ip address 10.1.1.1 255.255.255.0  

#

interface GigabitEthernet0/0/1

ip address 13.1.1.1 255.255.255.0  

#

interface GigabitEthernet0/0/2

#

interface NULL0

#

interface LoopBack0

ip address 1.1.1.1 255.255.255.255  

#

ospf 100 router-id 1.1.1.1  

filter-policy 2000 import

area 0.0.0.0  

 network 10.1.1.0 0.0.0.255  

 network 13.1.1.0 0.0.0.255  

#

user-interface con 0

authentication-mode password

user-interface vty 0 4

user-interface vty 16 20

#

wlan ac

#

return

<r1>

R2:

<r2>display current-configuration  

[V200R003C00]

#

sysname r2

#

snmp-agent local-engineid 800007DB03000000000000

snmp-agent  

#

clock timezone China-Standard-Time minus 08:00:00

#

portal local-server load portalpage.zip

#

drop illegal-mac alarm

#

set cpu-usage threshold 80 restore 75

#

aaa  

authentication-scheme default

authorization-scheme default

accounting-scheme default

domain default  

domain default_admin  

local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$

local-user admin service-type http

#

firewall zone Local

priority 15

#

interface GigabitEthernet0/0/0

ip address 20.1.1.2 255.255.255.0  

#

interface GigabitEthernet0/0/1

ip address 23.1.1.2 255.255.255.0  

#

interface GigabitEthernet0/0/2

#

interface NULL0

#

interface LoopBack0

ip address 2.2.2.2 255.255.255.255  

#

ospf 100 router-id 2.2.2.2  

area 0.0.0.0  

 network 20.1.1.0 0.0.0.255  

 network 23.1.1.0 0.0.0.255  

#

user-interface con 0

authentication-mode password

user-interface vty 0 4

user-interface vty 16 20

#

wlan ac

#

return

<r2>

R3:

<r3>display current-configuration  

[V200R003C00]

#

sysname r3

#

snmp-agent local-engineid 800007DB03000000000000

snmp-agent  

#

clock timezone China-Standard-Time minus 08:00:00

#

portal local-server load portalpage.zip

#

drop illegal-mac alarm

#

set cpu-usage threshold 80 restore 75

#

aaa  

authentication-scheme default

authorization-scheme default

accounting-scheme default

domain default  

domain default_admin  

local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$

local-user admin service-type http

#

firewall zone Local

priority 15

#

interface GigabitEthernet0/0/0

ip address 13.1.1.3 255.255.255.0  

#

interface GigabitEthernet0/0/1

ip address 23.1.1.3 255.255.255.0  

#

interface GigabitEthernet0/0/2

ip address 34.1.1.3 255.255.255.0  

#

interface NULL0

#

interface LoopBack0

ip address 3.3.3.3 255.255.255.255  

#

ospf 100 router-id 3.3.3.3  

area 0.0.0.0  

 network 13.1.1.0 0.0.0.255  

 network 23.1.1.0 0.0.0.255  

 network 34.1.1.0 0.0.0.255  

#

user-interface con 0

authentication-mode password

user-interface vty 0 4

user-interface vty 16 20

#

wlan ac

#

return

<r3>

R4:

[r4]display current-configuration  

[V200R003C00]

#

sysname r4

#

snmp-agent local-engineid 800007DB03000000000000

snmp-agent  

#

clock timezone China-Standard-Time minus 08:00:00

#

portal local-server load portalpage.zip

#

drop illegal-mac alarm

#

set cpu-usage threshold 80 restore 75

#

aaa  

authentication-scheme default

authorization-scheme default

accounting-scheme default

domain default  

domain default_admin  

local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$

local-user admin service-type http

#

firewall zone Local

priority 15

#

interface GigabitEthernet0/0/0

ip address 34.1.1.4 255.255.255.0  

#

interface GigabitEthernet0/0/1

ip address 30.1.1.4 255.255.255.0  

#

interface GigabitEthernet0/0/2

ip address 40.1.1.4 255.255.255.0  

#

interface NULL0

#

interface LoopBack0

ip address 4.4.4.4 255.255.255.255  

#

ospf 100 router-id 4.4.4.4  

filter-policy ip-prefix jj export direct

import-route direct

area 0.0.0.0  

 network 34.1.1.0 0.0.0.255  

#

route-policy dd deny node 10  

if-match ip-prefix jj  

#

ip ip-prefix jj index 10 permit 30.1.1.0 24 greater-equal 24 less-equal 24

#

user-interface con 0

authentication-mode password

user-interface vty 0 4

user-interface vty 16 20

#

wlan ac

#

return

[r4]