使用二层ACL禁止特定用户上网示例(MAC地址、限制MAC、traffic policy、)

使用二层ACL禁止特定用户上网示例(MAC地址、限制MAC、traffic policy、)

使用二层ACL禁止特定用户上网示例

00e0-f201-0101-pc1------sw----------g0/0/2-Switch-g0/0/1-------router-互联网

组网需求
如图所示，Switch作为网关设备，下挂用户PC。
管理员发现PC1（MAC地址为00e0-f201-0101）用户是非法用户，要求禁止该用户上网。
配置思路
采用如下的思路在Switch上进行配置：
    配置二层ACL和基于ACL的流分类，使设备对MAC地址为00e0-f201-0101的报文进行过滤，从而禁止该地址对应的用户上网。
    配置流行为，拒绝匹配上ACL的报文通过。
    配置并应用流策略，使ACL和流行为生效。

操作步骤
配置ACL
    # 配置符合要求的二层ACL。
    <HUAWEI> system-view
    [HUAWEI] sysname Switch
    [Switch] acl 4000
    [Switch-acl-L2-4000] rule deny source-mac 00e0-f201-0101 ffff-ffff-ffff

#注意根据需要是否需要加destination

 rule 5 deny destination-mac 5489-9802-1444 source-mac 5489-9854-36a2

    [Switch-acl-L2-4000] quit
配置基于ACL的流分类
    # 配置流分类tc1，对匹配ACL 4000的报文进行分类。
    [Switch] traffic classifier tc1
    [Switch-classifier-tc1] if-match acl 4000
    [Switch-classifier-tc1] quit
配置流行为
    # 配置流行为tb1，动作为拒绝报文通过。
    [Switch] traffic behavior tb1
    [Switch-behavior-tb1] deny
    [Switch-behavior-tb1] quit
配置流策略
    # 配置流策略tp1，将流分类tc1与流行为tb1关联。
    [Switch] traffic policy tp1
    [Switch-trafficpolicy-tp1] classifier tc1 behavior tb1
    [Switch-trafficpolicy-tp1] quit
应用流策略
    # 由于PC1的报文从接口GE0/0/2进入Switch并流向Internet，所以可以在接口GE0/0/2的入方向应用流策略tp1。
    [Switch] interface gigabitethernet 0/0/2
    [Switch-GigabitEthernet0/0/2] traffic-policy tp1 inbound
    [Switch-GigabitEthernet0/0/2] quit
验证配置结果
    # 查看ACL规则的配置信息。
    [Switch] display acl 4000
    L2 ACL 4000, 1 rule                                                             
    Acl's step is 5                                                                 
     rule 5 deny source-mac 00e0-f201-0101
    # 查看流分类的配置信息。
    [Switch] display traffic classifier user-defined
       User Defined Classifier Information:
        Classifier: tc1
         Operator: OR
         Rule(s) : if-match acl 4000                                                                        
    Total classifier number is 1                                                    
    # 查看流策略的配置信息。
    [Switch] display traffic policy user-defined tp1
      User Defined Traffic Policy Information:                                      
      Policy: tp1                                                                   
       Classifier: tc1                                                              
        Operator: OR                                                                
         Behavior: tb1                                                              
          Deny  
    # 查看流策略的应用信息。
    [Switch] display traffic-policy applied-record
    #                                                                                                                                   
    -------------------------------------------------                                                                                   
      Policy Name:   tp1                                                                                                                
      Policy Index:  0                                                                                                                  
         Classifier:tc1     Behavior:tb1                                                                                                
    -------------------------------------------------                                                                                   
     *interface GigabitEthernet0/0/2                                                                             
        traffic-policy tp1 inbound                                                                                                      
          slot 0    :  success                                                                                                          
    -------------------------------------------------                                                                                   
      Policy total applied times: 1.                                                                                                    
    #
    # 源MAC地址是00e0-f201-0101的用户无法上网。

配置文件
Switch的配置文件
#
sysname Switch
#
acl number 4000
 rule 5 deny source-mac 00e0-f201-0101
#
traffic classifier tc1 operator or
 if-match acl 4000
#
traffic behavior tb1
 deny
#
traffic policy tp1 match-order config
 classifier tc1 behavior tb1
#
interface GigabitEthernet0/0/2
 traffic-policy tp1 inbound  
#
return

ACL（列表、list、全）acllist
http://www.zh-cjh.com/wenzhangguilei/1514.html
文章归类、所有文章列表、LISTLIST
http://www.zh-cjh.com/wangzhangonggao/2195.html