Portál AbcLinuxu, 23. dubna 2024 21:34
Mam zasadni problem. na koncovem routeru na ktery se mi dostavaji routy pomoci OSPF potrebuji odfiltrovat nejake subnety. melo by to jit pomoci ospfd a access\/listu ale nejak neprichazim na to jak to filtrovat. pro predstavu je to asi takhle
192.168.1.0 192.168.1.0 192.168.2.0 router1 ---------------------- router2 192.168.3.0 192.168.3.0
to znamena ze na routeru router2 potrebuji odfiltrovat routu 192.168.2.0
nevi nekdo jak to udelat tak abych nemusel zaasahovat do nastaveni ospfd na routeru1 ale nastavil bych si pouze ospfd na router2 berte to tak ze veskere subnety jsou jak na router1 tak na router2 distribuovany pomoci OSPFD
to jsem zkousel ale nejak jsem to nepochopil a nebo spatne. to bych musel udelat na router1, ale ja to pravidlo potrebuji odfiltrovat az na tom router2. na jine routery se ta routa jiz propagovat zase ma.
konfigurak na router2
Current configuration: ! hostname console-hates-ospfd password heslo enable password heslo log file /var/log/quagga/ospfd.log log stdout ! ! ! interface eth0 ip ospf cost 10 ! interface eth1 ip ospf cost 10 ! interface eth2 ! interface lo ! interface sit0 ! interface tap0 description OpenVPN ip ospf network point-to-point ip ospf cost 5000 ! router ospf ospf router-id 10.3.6.144 redistribute connected redistribute static passive-interface eth0 passive-interface eth1 passive-interface eth2 network 10.8.0.0/24 area 1.5.3.0 network 192.168.88.0/24 area 1.5.3.0 network 192.168.89.0/24 area 1.5.3.0 neighbor 10.8.0.1 ! line vty ! end
a prijate routy
88.146.196.127 10.8.0.1 255.255.255.255 UGH 20 0 0 tap0 10.132.29.130 10.8.0.1 255.255.255.255 UGH 20 0 0 tap0 88.146.196.126 10.8.0.1 255.255.255.255 UGH 20 0 0 tap0 88.146.196.125 10.8.0.1 255.255.255.255 UGH 20 0 0 tap0 192.168.55.4 10.8.0.1 255.255.255.252 UG 5020 0 0 tap0 192.168.55.0 10.8.0.1 255.255.255.252 UG 5020 0 0 tap0 10.132.29.136 10.8.0.1 255.255.255.248 UG 20 0 0 tap0 10.132.29.8 10.8.0.1 255.255.255.248 UG 20 0 0 tap0 10.132.29.128 10.8.0.1 255.255.255.248 UG 20 0 0 tap0 10.132.29.0 10.8.0.1 255.255.255.248 UG 20 0 0 tap0 10.132.29.144 10.8.0.1 255.255.255.248 UG 20 0 0 tap0 10.132.29.168 10.8.0.1 255.255.255.248 UG 20 0 0 tap0 10.132.29.40 10.8.0.1 255.255.255.248 UG 20 0 0 tap0 10.132.29.160 10.8.0.1 255.255.255.248 UG 20 0 0 tap0 10.132.29.32 10.8.0.1 255.255.255.248 UG 20 0 0 tap0 10.132.29.184 10.8.0.1 255.255.255.248 UG 20 0 0 tap0 10.132.29.56 10.8.0.1 255.255.255.248 UG 20 0 0 tap0 10.132.29.176 10.8.0.1 255.255.255.248 UG 20 0 0 tap0 10.132.29.48 10.8.0.1 255.255.255.248 UG 20 0 0 tap0 10.132.29.16 10.8.0.1 255.255.255.240 UG 20 0 0 tap0 10.132.29.240 10.8.0.1 255.255.255.240 UG 5030 0 0 tap0 10.9.0.0 10.8.0.1 255.255.255.240 UG 20 0 0 tap0 10.132.29.192 10.8.0.1 255.255.255.224 UG 5030 0 0 tap0 10.132.29.64 10.8.0.1 255.255.255.192 UG 20 0 0 tap0 172.20.21.0 10.8.0.1 255.255.255.0 UG 20 0 0 tap0 192.168.5.0 10.8.0.1 255.255.255.0 UG 5020 0 0 tap0 172.20.20.0 10.8.0.1 255.255.255.0 UG 20 0 0 tap0 192.168.4.0 10.8.0.1 255.255.255.0 UG 5030 0 0 tap0 192.168.3.0 10.8.0.1 255.255.255.0 UG 5030 0 0 tap0 192.168.2.0 10.8.0.1 255.255.255.0 UG 5020 0 0 tap0 192.168.1.0 10.8.0.1 255.255.255.0 UG 5010 0 0 tap0 172.16.0.0 10.8.0.1 255.255.255.0 UG 5020 0 0 tap0 10.8.0.0 0.0.0.0 255.255.255.0 U 0 0 0 tap0 10.3.6.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 192.168.89.0 0.0.0.0 255.255.255.0 U 0 0 0 eth2 172.20.10.0 10.8.0.1 255.255.255.0 UG 5040 0 0 tap0 192.168.88.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1 127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo 0.0.0.0 10.8.0.1 0.0.0.0 UG 1 0 0 tap0
co potrebuji tak je aby napriklad routy 192.168.2.0/24 a routa 0.0.0.0 nebyla v routovaci tabulce a byly odfiltrovany
Myslim, ze na router 1 pujde zakazat propagaci pres tu mapu, takze se tam sice ta routa dostane,ale nebude se propagovat dal:
access-list stub accept 192.168.2.0/24
access-list stub deny any any
route-map filter deny 1 match ip address stub
redistribute connected metric 100 metric-type 1 route-map filter
Tak nejak..
NN
asi jsem to blbe popsal. rekneme ze router2 ma dostavat tyhle routy z routeru 1. to ze je na routeru 1 routa 192.168.1.0 .2.0 .3.0 je v poradku. dale je router 3 ktery tyto routy dostat ma ale router 2 ma dostat pouze rozsah 192.168.1.0 a .3.0/24 tak ze filtrovat potrebuji az na routeru2 a ne na routeru1. pokud bych ten filtr udelal na router1 tak se mi nezpropaguje na router3. doufam ze jsem se do toho nezamotal.
Myslel jsem router 2, kazdopadne jak mate zepojeny router 3, protoze pokud predchozi aplikujete na router 2
routery za routerem 2 to uz neuvidi, alespon si to tak predstavuji. Nebo chcete pouze filtrovat tuto jednu sit
pouze na tomto routerua, ale propagovat ji dal?
NN
Pro predstavu prikladam nakres casti site v priloze.
Jedna se mi o tenhle pripad
Routery R1 - R5 si mezi sebou predavaji routy vcetne bran do internetu. to je v poradku. a vsechno funguje tak jak ma. dale je pomoci VPNky pripojen router R6, ktery ma svou defaultni branu. co ja potrebuji tak na routeru R6 odfiltrovat routu pro defaultni branu (dostane se mi na ni totiz routa 0.0.0.0 via 10.8.0.1) a kvuli ni mi spadne tunel. dale co bych potreboval, aby jiz na tom routeru nebyly site napriklad 192.168.2.0/24 a 192.168.3.0/24. Pravidlo by melo byt na in (tj odfiltruj routy, ktere prichazi skrze OSPF a nedavej je do filtrovaci tabulky). Na routeru R6 je jeste navic vic routovacich tabulek a podle pravidel se dale routuje. ale to si jiz poresim. jedna se mi hlavne o ten filtr tech rout, ktere prichazeji do OSPF.
Tiskni
Sdílej:
ISSN 1214-1267, (c) 1999-2007 Stickfish s.r.o.
