H3C S7500E-XS Traffic Filtering Configuration Examples

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Copyright © 2016 Hangzhou H3C Technologies Co., Ltd. All rights reserved. No part of this manual may be reproduced or transmitted in any form or by any means without prior written consent of Hangzhou H3C Technologies Co., Ltd. The information in this document is subject to change without notice.

 

Introduction· 1

Prerequisites 1

Example: Configuring traffic filtering· 1

Network requirements 1

Requirements analysis 2

Software version used· 3

Configuration restrictions and guidelines 3

Configuration procedures 3

Configuring Switch A·· 3

Configuring Switch B· 4

Verifying the configuration· 4

Configuration files 5

Related documentation· 6

 

Introduction

This document provides traffic filtering configuration examples.

Prerequisites

The configuration examples in this document were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.

This document assumes that you have basic knowledge of traffic filtering.

Example: Configuring traffic filtering

Network requirements

As shown in Figure 1, a company has three branches, each of which has a Marketing department and a Finance department. All Marketing departments belong to VLAN 20. All Finance departments belong to VLAN 30.

Configure traffic filtering to meet the following requirements:

·     HTTP traffic from the Marketing department in each branch is denied.

·     In Branch B, only Host A and Host B can access the server.

·     The Marketing departments in three branches can access one another, and the Finance departments in three branches can access one another.

Figure 1 Network diagram

 

Requirements analysis

To meet the network requirements, you must perform the following tasks:

·     To deny HTTP traffic from the Marketing departments, use one of the following methods:

¡     Filter outgoing traffic from the subnet 192.168.4.0/24 on the interfaces that connect Switch B, Switch C, and Switch D to Switch A.

This method has poor scalability, because new branches require the same configuration on their access switches.

¡     Filter outgoing traffic from the subnet 192.168.4.0/24 on Ten-GigabitEthernet 1/1/4 of Switch A.

This method wastes processing capabilities of Switch A, because Switch A must internally forward all incoming traffic to Ten-GigabitEthernet 1/1/4.

¡     Configure a QoS policy to deny HTTP traffic from the Marketing departments.

This method can automatically adapt to changing network topologies and also saves hardware resources by denying traffic on the incoming interface. This example uses this method.

·     To allow only Host A and Host B to access the server in Branch B, perform the following tasks:

¡     Configure an ACL on Ten-GigabitEthernet 1/1/1 to allow packets from 192.168.4.10/24 and 192.168.4.15/24.

¡     Set the default packet filtering action to deny to deny packets that do not match the configured ACL.

·     To allow traffic from Marketing departments and Finance departments (except HTTP traffic) to the Internet and to allow access among Marketing departments and among Finance departments, perform the following tasks:

¡     Configure Ten-GigabitEthernet 1/1/1 through Ten-GigabitEthernet 1/1/4 as trunk ports.

¡     Assign these interfaces to VLAN 20 and VLAN 30.

Software version used

This configuration example was created and verified on S7500EXS-CMW710-R7178.

Configuration restrictions and guidelines

If a traffic behavior is configured with the filter deny action, all other actions in the behavior except traffic accounting do not take effect.

Configuration procedures

Configuring Switch A

# Create VLAN 20 and VLAN 30.

<SwitchA> system-view

[SwitchA] vlan 20

[SwitchA-vlan20]quit

[SwitchA] vlan 30

# Add Ten-GigabitEthernet 1/1/1 through Ten-GigabitEthernet 1/1/4 to an interface range named myport.

[SwitchA] interface range name myport interface ten-gigabitethernet 1/1/1 to ten-gigabitethernet 1/1/4

# Configures interfaces Ten-GigabitEthernet 1/1/1 through Ten-GigabitEthernet 1/1/4 as trunk ports, assign them to VLAN 20 and VLAN 30, and remove them from VLAN 1.

[SwitchA-if-range-myport] port link-type trunk

[SwitchA-if-range-myport] port trunk permit vlan 20 30

[SwitchA-if-range-myport] undo port trunk permit vlan 1

[SwitchA-if-range-myport] quit

# Configure advanced IPv4 ACL 3000 to match HTTP traffic from subnet 192.168.4.0/24.

[SwitchA] acl number 3000

[SwitchA-acl-adv-3000] rule permit tcp source 192.168.4.0 0.0.0.255 source-port eq 80

[SwitchA-acl-adv-3000] quit

# Create a class named vlan20_http, and use ACL 3000 as the match criterion.

[SwitchA] traffic classifier vlan20_http

[SwitchA-classifier-vlan20_http] if-match acl 3000

[SwitchA-classifier-vlan20_http] quit

# Create a behavior named vlan20_http, and configure traffic filtering to deny traffic of the class vlan20_http.

[SwitchA] traffic behavior vlan20_http

[SwitchA-behavior-vlan20_http] filter deny

[SwitchA-behavior-vlan20_http] quit

# Create a QoS policy named vlan20_http, and associate the class vlan20_http with the behavior vlan20_http in QoS policy vlan20_http.

[SwitchA] qos policy vlan20_http

[SwitchA-qospolicy-vlan20_http] classifier vlan20_http behavior vlan20_http

[SwitchA-qospolicy-vlan20_http] quit

# Apply QoS policy vlan20_http to the inbound direction of VLAN 20 and VLAN 30.

[SwitchA] qos vlan-policy vlan20_http vlan 20 30 inbound

Configuring Switch B

# Configure basic IPv4 ACL 2000 to permit traffic from Host A and Host B.

[SwitchB] acl number 2000

[SwitchB-acl-basic-2000] rule permit source 192.168.4.10 0

[SwitchB-acl-basic-2000] rule permit source 192.168.4.15 0

[SwitchB-acl-basic-2000] quit

# Set the packet filtering default action to deny.

[SwitchB] packet-filter default deny

# Apply ACL 2000 to Ten-GigabitEthernet 1/1/1 to filter outgoing traffic.

[SwitchB] interface ten-gigabitethernet 1/1/1

[SwitchB-Ten-GigabitEthernet1/1/1] packet-filter 2000 outbound

Verifying the configuration

# Verify the QoS policy applied to the inbound direction of VLAN 20 and VLAN 30.

[SwitchA] display qos vlan-policy vlan inbound

 

Vlan 20

 

  Direction: Inbound

 

  Policy: vlan20_http

   Classifier: vlan20_http

     Operator: AND

     Rule(s) :

      If-match acl 3000

     Behavior: vlan20_http

      Filter enable: Deny

 

Vlan 30

 

  Direction: Inbound

 

  Policy: vlan20_http

   Classifier: vlan20_http

     Operator: AND

     Rule(s) :

      If-match acl 3000

     Behavior: vlan20_http

      Filter enable: Deny

# Display application details of ACLs for incoming packet filtering on Ten-GigabitEthernet 1/1/1.

[SwitchB] display packet-filter verbose interface ten-gigabitethernet 1/1/1 outbound

Interface: Ten-GigabitEthernet1/1/1

 Out-bound policy:

  ACL 2000

   rule 0 permit source 192.168.4.10 0

 

  IPv4 default action: Deny

Configuration files

·     Switch A:

#

vlan 20

#

vlan 30

#

interface range name myport interface Ten-GigabitEthernet1/1/1 to Ten-GigabitEthernet1/1/4

#

acl number 3000

 rule 0 permit tcp source 192.168.4.0 0.0.0.255 source-port eq www

#

traffic classifier vlan20_http operator and

 if-match acl 3000

#

traffic behavior vlan20_http

 filter deny

#

qos policy vlan20_http

 classifier vlan20_http behavior vlan20_http

#

 qos vlan-policy vlan20_http vlan 20 inbound

 qos vlan-policy vlan20_http vlan 30 inbound

#

interface Ten-GigabitEthernet1/1/1

 port link-mode bridge

 port link-type trunk

 undo port trunk permit vlan 1

 port trunk permit vlan 20 30

#

interface Ten-GigabitEthernet1/1/2

 port link-mode bridge

 port link-type trunk

 undo port trunk permit vlan 1

 port trunk permit vlan 20 30

#

interface Ten-GigabitEthernet1/1/3

 port link-mode bridge

 port link-type trunk

 undo port trunk permit vlan 1

 port trunk permit vlan 20 30

#

interface Ten-GigabitEthernet1/1/4

 port link-mode bridge

 port link-type trunk

 undo port trunk permit vlan 1

 port trunk permit vlan 20 30

·     Switch B:

#

acl number 2000

 rule 0 permit source 192.168.4.10 0

#

 packet-filter default deny

#

interface Ten-GigabitEthernet1/1/1

 port link-mode bridge

 packet-filter 2000 outbound

#

Related documentation

·     H3C S7500E-XS Switch Series ACL and QoS Configuration Guide-Release 7178

·     H3C S7500E-XS Switch Series ACL and QoS Command Reference-Release 7178