榆树网 » 思科

使用策略路由（PBR）后traceroute不工作

ELM — Sun, 17 Jul 2011 08:17:51 +0000

路由器启用策略路由，用户上网、ping等一切正常，但是traceroute无法工作，具体体现为：

[root@NAT natlog]# traceroute -n cpan.wenzk.com
traceroute to cpan.wenzk.com (221.203.119.98), 30 hops max, 40 byte packets
1  10.0.0.6  0.265 ms !H * *

网络拓扑图：

由于路由器A接口1启用了策略路由，所有允许访问Internet的用户发送过来的数据包都直接修改下一跳为路由器B的接口1的地址，所以在路由器A上就未设置默认路由（也就是8个0的路由）。路由器A为思科的12404路由器。

解决办法：在路由器增加默认路由，默认路由的下一跳可以为任意有效的下一跳地址，有默认路由后traceroute就正常了。

估计思科路由器在执行PBR之前会试图查找路由表，确定下一跳地址为多少，之后才是PBR生效，修改下一跳地址。

uRPF在思科和H3C上现实的差别

ELM — Tue, 24 Aug 2010 03:24:37 +0000

以下文字来自H3C官方网站：http://www.h3c.com.cn/download.do?id=620562

URPF 处理流程
URPF 检查有严格（strict）型和松散（loose）型两种。此外，还可以支持ACL 与缺省路由的检查。
URPF 的处理流程如下：
(1) 如果报文的源地址在路由器的FIB 表中存在对于strict 型检查，反向查找报文出接口，若其中至少有一个出接口和报文的入接口相匹配，则报文通过检查；否则报文将被拒绝。（反向查找是指查找以该报文源IP 地址为目的IP 地址的报文的出接口）对于loose 型检查，报文进行正常的转发。
(2) 如果报文的源地址在路由器的FIB 表中不存在，则检查缺省路由及URPF 的allow-default-route 参数。
对于配置了缺省路由，但没有配置参数allow-default-route 的情况，不管是strict型检查还是loose 型检查，只要报文的源地址在路由器的FIB 表中不存在，该
报文都将被拒绝；
对于配置了缺省路由，同时又配置了参数allow-default-route 的情况下，如果是strict 型检查，只要缺省路由的出接口与报文的入接口一致，则报文将通过
URPF 的检查，进行正常的转发；如果缺省路由的出接口和报文的入接口不一致，则报文将拒绝。如果是loose 型检查，报文都将通过URPF 的检查，进行
正常的转发。
(3) 当且仅当报文被拒绝后，才去匹配ACL。如果被ACL 允许通过，则报文继续进行正常的转发；如果被ACL 拒绝，则报文被丢弃。

以下文字来自CISCO官方网站：http://www.cisco.com/web/about/security/intelligence/unicast-rpf.html
Introduction
Network administrators can use Unicast Reverse Path Forwarding (Unicast RPF) to help limit the malicious traffic on an enterprise network. This security feature works by enabling a router to verify the reachability of the source address in packets being forwarded. This capability can limit the appearance of spoofed addresses on a network. If the source IP address is not valid, the packet is discarded. Unicast RPF works in one of three different modes: strict mode, loose mode, or VRF mode. Note that not all network devices support all three modes of operation. Unicast RPF in VRF mode will not be covered in this document.

When administrators use Unicast RPF in strict mode, the packet must be received on the interface that the router would use to forward the return packet. Unicast RPF configured in strict mode may drop legitimate traffic that is received on an interface that was not the router’s choice for sending return traffic. Dropping this legitimate traffic could occur when asymmetric routing paths are present in the network.

When administrators use Unicast RPF in loose mode, the source address must appear in the routing table. Administrators can change this behavior using the allow-default option, which allows the use of the default route in the source verification process. Additionally, a packet that contains a source address for which the return route points to the Null 0 interface will be dropped. An access list may also be specified that permits or denies certain source addresses in Unicast RPF loose mode.

Care must be taken to ensure that the appropriate Unicast RPF mode (loose or strict) is configured during the deployment of this feature because it can drop legitimate traffic. Although asymmetric traffic flows may be of concern when deploying this feature, Unicast RPF loose mode is a scalable option for networks that contain asymmetric routing paths.
Unicast RPF in an Enterprise Network
In many enterprise environments, it is necessary to use a combination of strict mode and loose mode Unicast RPF. The choice of the Unicast RPF mode that will be used will depend on the design of the network segment connected to the interface on which Unicast RPF is deployed.

Administrators should use Unicast RPF in strict mode on network interfaces for which all packets received on an interface are guaranteed to originate from the subnet assigned to the interface. A subnet composed of end stations or network resources fulfills this requirement. Such a design would be in place for an access layer network or a branch office where there is only one path into and out of the branch network. No other traffic originating from the subnet is allowed and no other routes are available past the subnet.

Unicast RPF loose mode can be used on an uplink network interface that has a default route associated with it.
Unicast RPF Examples
Cisco IOS Devices
An important consideration for deployment is that Cisco Express Forwarding switching must be enabled for Unicast RPF to function. This command has been enabled by default as of IOS version 12.2. If it is not enabled, administrators can enable it with the following global configuration command: ip cef

Unicast RPF is enabled on a per-interface basis. The ip verify unicast source reachable-via rx command enables Unicast RPF in strict mode. To enable loose mode, administrators can use the any option to enforce the requirement that the source IP address for a packet must appear in the routing table. The allow-default option may be used with either the rx or any option to include IP addresses not specifically contained in the routing table. The allow-self-ping option should not be used because it could create a denial of service condition. An access list such as the one that follows may also be configured to specifically permit or deny a list of addresses through Unicast RPF:

interface FastEthernet 0/0
ip verify unicast source reachable-via {rx | any} [allow-default]
[allow-self-ping] [list]

Addresses that should never appear on a network can be dropped by entering a route to a null interface. The following command will cause all traffic received from the 10.0.0.0/8 network to be dropped even if Unicast RPF is enabled in loose mode with the allow-default option: ip route 10.0.0.0 255.0.0.0 Null0

从以上文字可以看出，CISCO在实现uRPF的时候考虑得比H3C稍微多了一点点，起码思科考虑到了路由表中下一跳地址为Null0接口的处理。

两个开源的Netflow Collector

ELM — Sun, 02 May 2010 04:28:27 +0000

1、flow-tools: 附带一堆flow-filter flow-report flow-stat等很有用的工具，通过过简单的写配置文件和脚本操作就可以实现你想要的效果，唯一遗憾，不支持Netflow v9。官方主页：http://www.splintered.net/sw/flow-tools/

2、NFDUMP：这个软件支持Netflow v9，但是自带的工具就相对较少，要实现自己的功能或许需要多写一些脚本才行。官方主页：http://nfdump.sourceforge.net/ http://sourceforge.net/projects/nfsen/

在Cisco 配置Netflow的方法：

在需要收集Netflow的接口启用Netflow功能

 interface fastethernet 0/0
ip route-cache flow

使用下面的命令告诉路由器发送Netflow数据

ip flow-export
ip flow-export version 5
ip flow-cache timeout active 5

This breaks up long-lived flows into 5-minute segments. You can choose any number of minutes between 1 and 60, but should be equal or less than the file rotation period – typically 5 minutes,If you leave it at the default of 30 minutes your traffic reports will have spikes.

在Cisco 6500/7600系列中，确认已经使能”NDE(Netflow Data Export)”.

mls flow ip interface-full
mls flow ipv6 interface-full
mls nde sender version 5

注意IPv6 NDE还没有实现，但是你依然可以使用“show mls netflow ipv6”来查看目前活动的IPv6流数据。
在负载比较重的路由器上可以使用如下设置:

mls aging fast time 4 threshold 2
mls aging normal 32
mls aging long 900

关于Cisco 6509/7609 交换机Netflow的配置[转载]

ELM — Fri, 30 Apr 2010 08:52:38 +0000

Netflow 在6500和7209 交换机上配置和路由器上配置有所不同，在公司开发Netflow的应用上，发现现场工程师基本没有配置对，导致流量出不来。下面列出配置信息；CATOS的配置也的参考该配置

1、首先看看Netflow配置是否正常起来：

Switch# show mls nde

一般看到都是Netflow Data Export disabled 这说明Netflow都没有起来。
参看Cisco 《Configuring NetFlow Data Export》 PDf文档，默认是Disabled的

2、启动netflow

Switch(config)# mls netflow

3、启动netflow 的双向流量
Switch(config)# mls flow ip destination-source

4、启动NDE发送以及发送版本

Switch(config)# mls nde sender [version {5 | 7}]

如果只输入mls nde sender 系统默认启用的是版本7，如果需要版本5，则mls nde sender version 5 ，目前版本能配的是5或7，这两个版本WEB均能出现正常的数据。

对于Cisco IOS 12.17以下版本的交换机，只有版本7。

5、进入VLAN，启动接口Netflow（如果在物理接口上其3层，则直接进入物理接口）。

Switch(config)# interface vlan 5
Switch(config-if)# ip flow-export ingress
Switch(config-if)# ip route-cache flow

6、配置Netflow的数据源，如果没有配置Loopback的接口，可以采用物理接口，建议配置Loopback接口

Switch(config)# ip flow-export source loopback 0

7、检测

Switch# show mls nde （能看到如下的信息，而且明确Netflow Data Export enabled ）

Netflow Data Export enabled
Exporting flows to 10.110.10.254 (9991)
Exporting flows from 10.16.68.72 (55425)
Version: 5
Include Filter not configured
Exclude Filter is:
Total Netflow Data Export Packets are:
49 packets, 0 no packets, 247 records
Total Netflow Data Export Send Errors:
IPWRITE_NO_FIB = 0
IPWRITE_ADJ_FAILED = 0
IPWRITE_PROCESS = 0

Switch(config)# show mls netfow ip

看到大量的流量信息，大量的滚屏信息。

———常规路由器上配置——-

在路由器上开启netflow统计的过程和例子：
开启过程
Command Description
> en 进入授权模式
#config t 进入配置模式
(config)#interface eth 0/0 配置第一块以太网卡接口
(config－if)#ip route-cache flow 启动信息流交换
(config－if)#exit 返回配置状态
(config)#ip flow-export [ip-add] [udp-port] 把统计信息输出到一个指定工作站
(config)#ip flow-export version 设定netflow 的版本号
(config)#ip flow-cache active-timeout 设定netflow 记录活动超时时间
(config)#ip flow-cache entries 设定netflow 记录缓冲区的入口数
(config)#exit 返回授权状态
#copy running-config startup-config 保存运行时配置到启动配置文件中
#show ip flow export 查看netflow输出的统计情况

例子
以开启两个以太网端口为例：

1. 登陆路由器：
telnet 10.1.254.254
2. 输入登陆密码
*******
3. 进入授权模式，输入授权密码
>en
>*****
4. 进入配置模式
#confing t
5. 配置第一块网卡（注意：网卡是指接口。希望监控几个接口就重复这个步骤）
(config)#interface vlan 22 23
(config－if)#ip route-cache flow
(config－if)#exit

6. 配置统计信息的输出目的，即采集服务器的ip和监听端口
(config)#ip flow-export 10.1.200.201 9991
7. 配置输出版本，目前可支持版本1和5
(config)#ip flow-export version 5
8. 配置活动流时间（默认为30分钟，故可不配置，若需要改变则可输入别的数值）
(config)#ip flow-cache active-timeout 30
9. 退出配置模式
(config)#exit
10. 保存配置到启动文件，保证路由器重启后也能能加载flow的配置
#copy running-config startup-config
11. 退出授权模式，然后退出登陆，结束配置
#exit
>exit

From: http://zhuowq.blog.51cto.com/212915/38465

榆树网 » 思科

使用策略路由（PBR）后traceroute不工作

相关文章

uRPF在思科和H3C上现实的差别

相关文章

两个开源的Netflow Collector

相关文章

关于Cisco 6509/7609 交换机Netflow的配置[转载]

相关文章

最近那些事

相关文章