ROUTE-POLICY策略路由规则详解在工程中经常遇到route-policy用于策略路由的情况，下面就对route-polic和ACL间的匹配规则详解如下：一、试验环境A(E0/0)--192.168.1.0--(E0/0)B(S0/0)--10.0.0.0--(S0/0)C(E0/0)--192.168.2.0--(E0/0)D拓扑说明：AB之间的网段为192.168.1.0。AB分别通过E0/0口互联。CD之间的网段为192.168.2.0。CD分别通过E0/0口互联。BC之间分别通过S0/0中间通过帧中继交换机互联,共配置3个子接口，DLCI分别是100200300（两端相同）。二、测试结论：未做任何策略#interfaceEthernet0/0ipaddress192.168.1.1255.255.255.0=在路由器ATracert路由结果如下：
disclock08:48:03UTCFri11/28/2008tracert-m5-a192.168.1.2192.168.2.2tracerouteto192.168.2.2(192.168.2.2)5hopsmax,40bytespacketPressCTRL_Ctobreak1192.168.1.13ms1ms2ms210.0.0.1019ms18ms19ms3192.168.2.220ms21ms20ms由此可得出未做route-policy的时候，是按照全局路由表中的路由条目转发数据流的。1、permit+permit#interfaceEthernet0/0ipaddress192.168.1.1255.255.255.0ippolicyroute-policyt1#aclnumber3000rule0permitipsource192.168.1.00.0.0.255destination192.168.2.00.0.0.255aclnumber3001rule0denyipsource192.168.1.00.0.0.255destination192.168.2.00.0.0.255#route-policyt1permitnode10if-matchacl3000applyip-addressnext-hop10.0.0.2route-policyt1permitnode20applyip-addressnext-hop10.0.0.6在路由器ATracert路由结果如下：disclock08:50:33UTCFri11/28/2008tracert-m5-a192.168.1.2192.168.2.2tracerouteto192.168.2.2(192.168.2.2)5hopsmax,40bytespacketPressCTRL_Ctobreak1192.168.1.12ms2ms1ms210.0.0.220ms20ms22ms3192.168.2.219ms20ms19ms由此结果可得出此时数据流匹配了规则node10。也就是route-policypermit对于和ACLpermit规则匹配的数据流执行node10中的匹配规则。2、permit+deny#interfaceEthernet0/0ipaddress192.168.1.1255.255.255.0ippolicyroute-policyt2#aclnumber3000rule0permitipsource192.168.1.00.0.0.255destination192.168.2.00.0.0.255aclnumber3001rule0denyipsource192.168.1.00.0.0.255destination192.168.2.00.0.0.255#route-policyt2permitnode10if-matchacl3001applylocal-preference2300route-policyt2permitnode20applyip-addressnext-hop10.0.0.6在路由器ATracert路由结果如下：disclock08:53:00UTCFri11/28/2008tracert-m5-a192.168.1.2192.168.2.2tracerouteto192.168.2.2(192.168.2.2)5hopsmax,40bytespacketPressCTRL_Ctobreak1192.168.1.12ms2ms4ms210.0.0.619ms19ms20ms3192.168.2.220ms20ms20ms由此结果的得出route-policy的permit对于和ACLDENY规则相匹配的数据流，不执行node10中的策略，而是继续匹配下面的规则。3、deny+permit#interfaceEthernet0/0ipaddress192.168.1.1255.255.255.0ippolicyroute-policyt3#aclnumber3000rule0permitipsource192.168.1.00.0.0.255destination192.168.2.00.0.0.255aclnumber3001rule0denyipsource192.168.1.00.0.0.255destination192.168.2.00.0.0.255#route-policyt3denynode10if-matchacl3000applyip-addressnext-hop10.0.0.2route-policyt3permitnode20applyip-addressnext-hop10.0.0.6在路由器ATracert路由结果如下：disclock08:54:42UTCFri11/28/2008tracert-m5-a192.168.1.2192.168.2.2tracerouteto192.168.2.2(192.168.2.2)5hopsmax,40bytespacketPressCTRL_Ctobreak1192.168.1.12ms2ms1ms210.0.0.1019ms18ms19ms3192.168.2.220ms20ms22ms由此结果可得出，route-policy的deny对于和ACLpermit规则相匹配的数据流直接进行DENY,并且不再匹配后续的规则，而是转入了系统全局路由表执行常规的路由策略。4、deny+deny#interfaceEthernet0/0ipaddress192.168.1.1255.255.255.0ippolicyroute-policyt4#aclnumber3000rule0permitipsource192.168.1.00.0.0.255destination192.168.2.00.0.0.255aclnumber3001rule0d...
VIP
