h3c s95e irf 下ipsacg(mqc 方式)实验

1、H3C S95E IRF 下IPS/ACG(MQC 方式)实验1.1 实验内容与目标本实验是让学员能熟悉S95E IRF 下IPS/ACG 的部署完本钱实验，您应该能够：掌握S95E IRF 下MQC 引流到IPS/ACG，并实现IPS/ACG 插卡备份1.2 预备知识和技能应了解S95E IRF 的原理及配置，以及IPS/ACG 插卡的工作原理1.3 实验组网图  图1-1 S95E IRF 下IPS/ACG 实验环境图1.4 背景需求本实验的场景为IRF 下OAA 插卡部署的典型场景1.5 实验设备与版本本实验所需之主要设备器材如表1-1 所示。表1-1 实验

2、设备和器材名称和型号版本数量描述S9508E R1238P08及以后版本2Secbalde ACG或者IPS插卡ACG: E6117P11及以后IPS: E2110P10及以后2接入交换机三层接入交换机2以太网线缆- 101.6 实验过程实验任务一：S9500E IRF 下IPS/ACG 部署步骤一：S95E 配置两台S9500E 形成IRF，下联启用VLAN1004-1008 三层，上联VLAN1001-1002 三层。聚合链路上下行，核心交换机和交换机2 的VLAN 通信正常。acsei server enable /通过acsei 协议对插卡的状态进行检测#vlan 1001 to 10

3、08#interface Vlan-interface1001ip#interface Vlan-interface1002ip#interface Vlan-interface1004ip#interface Vlan-interface1005ip#interface Vlan-interface1006ip#interface Vlan-interface1007ip#interface Vlan-interface1008ip#步骤二：部署ACG 插卡使得核心交换机和互联网交换机2 的互访流量经过IRF 成员为1 的ACG-1 插卡，该卡故障后流量切换到IRF 成员为2 的ACG-2

4、上。S95E 与ACG 插卡接口根底配置interface Ten-GigabitEthernet1/5/0/1port link-type trunkport trunk permit vlan 1 1001 1002 1004 to 1008 /允许业务VLAN 通过，必须同时允许VLAN1stp disable / 关闭stp，否那么stp 会将此端口blockmac-address max-mac-count 0 / 关闭mac 学习，防止mac 地址学习偏移#interface Ten-GigabitEthernet2/5/0/1port link-type trunkport tr

5、unk permit vlan 1 1001 1002 1004 to 1008 /允许业务VLAN 通过，必须同时允许VLAN1stp disable / 关闭stp，否那么stp 会将此端口blockmac-address max-mac-count 0 / 关闭mac 学习，防止mac 地址学习偏移#配置MQC：acl number 3200description Match-ALL-Addressrule 0 permit ipacl number 3300description Match-ALL-Addressrule 0 permit ip#acl number 4000 /匹配

6、二层组播和播送、ARPdescription Match-MultiCast-ARPrule 0 permit dest-mac 0100-0000-0000 ff00-0000-0000rule 5 permit dest-mac ffff-ffff-ffff ffff-ffff-ffffrule 10 permit type 0806 ffff#acl number 3400 /vlan1004-1008 效劳器之间互访的流量，目的地址为效劳器网段description Match-Internal-Flowrule 0 permit iprule 5 permit iprule 10 p

7、ermit iprule 15 permit iprule 20 permit ip#acl number 3500 /vlan1001-1002 效劳器之间互访的流量，目的地址为效劳器网段description Match-Internet-Flowrule 0 permit iprule 5 permit ip#traffic classifier Multicast-ARP operator andif-match acl 4000traffic classifier All-Address operator andif-match acl 3200if-match forwarding

8、-layer route /仅将三层转发流量引流traffic classifier All-Address-2 operator andif-match acl 3300if-match forwarding-layer route /仅将三层转发流量引流#traffic classifier Internal-Flow-1 operator andif-match acl 3400#traffic classifier Internet-Flow-2 operator andif-match acl 3500#traffic behavior Redirect_ACG_1redirect

9、interface Ten-GigabitEthernet1/5/0/1traffic behavior Redirect_ACG_2redirect interface Ten-GigabitEthernet2/5/0/1traffic behavior Allowfilter permittraffic behavior Deny-Multicast-ARPfilter deny#qos policy ACG-Deny-Multicast-ARPclassifier Multicast-ARP behavior Deny-Multicast-ARP#qos policy ACG_DOWN_

10、STREAM /下行流量MQCclassifier Multicast-ARP behavior Allow /组播、ARP 报文不上ACGclassifier Internet-Flow-2 behavior Allow /vlan1001 和vlan1002之间互访的流量不上ACGclassifier All-Address behavior Redirect_ACG_1 /流量优先上ACG_1classifier All-Address-2 behavior Redirect_ACG_2 /当ACG-1 失效后，流量上ACG_2#qos policy ACG_UP_STREAM /上行流

11、量classifier Multicast-ARP behavior Allow /组播、ARP 报文不上ACGclassifier Internal-Flow-1 behavior Allow /vlan1004-1008 之间互访的流量不上ACGclassifier All-Address behavior Redirect_ACG_1classifier All-Address-2 behavior Redirect_ACG_2在S95E 相关接口上下发MQC:上联接口：interface GigabitEthernet1/10/0/1qos apply policy ACG_DOWN_

12、STREAM inbound#interface GigabitEthernet2/10/0/1qos apply policy ACG_DOWN_STREAM inbound下联的接口：interface GigabitEthernet1/10/0/7qos apply policy ACG_UP_STREAM inbound#interface GigabitEthernet2/10/0/7qos apply policy ACG_UP_STREAM inboundS95E 与ACG 插卡接口报文过滤配置interface Ten-GigabitEthernet1/5/0/1qos apply policy ACG-Deny-Multicast-ARP inbound /这里要在inbound 方向过滤，出方向本机发出的协议报文无法过滤。interface Ten-GigabitEthernet2/5/0/1