Cisco数据包处理流程了解厂商数据包处理流程才能更好的利用ACL等策略以最高效的手段进行访问控制==cisco设备在在此有两个阶段==IOS12.4之前IOS12.4之后案例一before Rele
.
Cisco数据包处理流程
了解厂商数据包处理流程才能更好的利用ACL等策略以最高效的手段进行访问控制
==cisco设备在在此有两个阶段==
IOS12.4之前
IOS12.4之后
案例一
before Release 12.3(8)T
在之前的版本12.4之前我们可以清晰的看到设备对于inbound流量，会在加密前匹配一次inbound方向的ACL，解密之后数据会再一次匹配inbound方向的ACL。已上图为例：
#已A路由器为例（仅允许10.1.1.0/24访问10.1.2.0/24）：
crypto map ***map 10 ipsec-isakmp
set peer 192.168.2.1
set transform-set trans1
match address 101
interface Ethernet0/0
ip address 10.1.1.1 255.255.255.0
interface Serial1/0
ip address 192.168.1.1 255.255.255.0
ip access-group 150 in
ip access-group 160 out
crypto map ***map
access-list 101 permit ip 10.1.1.0 0.0.0.255 10.1.2.0 0.0.0.255
access-list 150 permit udp host 192.168.2.1 eq 500 host 192.168.1.1 eq 500
access-list 150 permit esp host 192.168.2.1 host 192.168.1.1
access-list 150 permit ip 10.1.2.0 0.0.0.255 10.1.1.0 0.0.0.255
access-list 160 permit udp host 192.168.1.1 eq 500 host 192.168.2.1 eq 500
access-list 160 permit ip 10.1.1.0 0.0.0.255 10.1.2.0 0.0.0.255
新的IPsec ××× 没有crypto access ACL访问控制:
新版本的IPsec ××× inbound流量只会在未解密之前匹配inbound ACL，解密后的流量不在匹配inbound ACL，此时解密后的流量会匹配crypto access ACL。已上图为例在新版本下配置无crypto access ACL的IPsec ×××访问控制：
#以A路由器为例（允许10.1.1.0/24访问10.1.2.0/24）
crypto map ***map 10 ipsec-isakmp
set peer 192.168.2.1
set transform-set trans1
match address 101
interface Ethernet0/0
ip address 10.1.1.1 255.255.255.0
interface Serial1/0
ip address 192.168.1.1 255.255.255.0
ip access-group 150 in
ip access-group 160 out
crypto map ***map
access-list 101 permit ip 10.1.1.0 0.0.0.255 10.1.2.0 0.0.0.255
access-list 150 permit udp host 192.168.2.1 eq 500 host 192.168.1.1 eq 500
access-list 150 permit esp host 192.168.2.1 host 192.168.1.1
access-list 160 permit udp host 192.168.1.1 eq 500 host 192.168.2.1 eq 500
access-list 160 permit esp host 192.168.1.1 host 192.168.2.1
新的IPsec ××× 有crypto access ACL访问控制
新版本的IPsec ××× inbound流量只会在未解密之前匹配inbound ACL，解密后的流量不在匹配inbound ACL，此时解密后的流量会匹配crypto access ACL。已上图为例在新版本下配置有crypto access ACL的IPsec ×××访问控制：
#以A路由器为例（仅允许10.1.1.0/24和10.1.2.0/24的telnet流量互通）：
crypto map ***map 10 ipsec-isakmp
set peer 192.168.2.1
set transform-set trans1
set ip access-group 151 in
set ip access-group 161 out
match address 101
interface Ethernet0/0
ip address 10.1.1.1 255.255.255.0
interface Serial1/0
ip address 192.168.1.1 255.255.255.0
ip access-group 150 in
ip access-group 160 out
crypto map ***map
access-list 101 permit ip 10.1.1.0 0.0.0.255 10.1.2.0 0.0.0.255
access-list 150 permit udp host 192.168.2.1 eq 500 host 192.168.1.1 eq 500
access-list 150 permit esp host 192.168.2.1 host 192.168.1.1
access-list 151 permit tcp 10.1.2.0 0.0.0.255 eq telnet 10.1.1.0 0.0.0.255
access-list 151 permit tcp 10.1.2.0 0.0.0.255 10.1.1.0 0.0.0.255 eq telnet
access-list 160 permit udp host 192.168.1.1 eq 500 host 192.168.2.1 eq 500
access-list 160 permit esp host 192.168.1.1 host 192.168.2.1
access-list 161 permit ip 10.1.1.0 0.0.0.255 10.1.2.0 0.0.0.255 eq telnet
access-list 161 permit ip 10.1.1.0 0.0.0.255 eq telnet 10.1.2.0 0.0.0.255