问

S5560s配置ACL规则未按照预期执行

2024-11-20提问

0关注
0收藏，205浏览

zhiliao_iDOYY

zhiliao_iDOYY 零段

粉丝：0人关注：1人

问题描述：

版本信息：

S5560S-28P-SI with 1 Processor                                                                                                                                                                                                     
BOARD TYPE:         S5560S-28P-SI                                                                                                                                                                                                  
DRAM:               512M bytes                                                                                                                                                                                                     
FLASH:              256M bytes                                                                                                                                                                                                     
PCB 1 Version:      VER.B                                                                                                                                                                                                          
Bootrom Version:    152                                                                                                                                                                                                            
CPLD 1 Version:     001                                                                                                                                                                                                            
Release Version:    H3C S5560S-28P-SI-6351P03                                                                                                                                                                                      
Patch Version  :    None                                                                                                                                                                                                           
Reboot Cause  :     UserReboot                                                                                                                                                                                                     
[SubSlot 0] 24GE+4SFP   

配置如下：

acl advanced 3010

rule 1 permit ip source 192.168.8.5 0 destination 192.168.10.0 0.0.0.255

rule 10 permit tcp source 192.168.5.0 0.0.0.255 destination 192.168.10.184 0 destination-port eq www

rule 11 permit tcp source 192.168.6.0 0.0.0.255 destination 192.168.10.184 0 destination-port eq www

rule 12 permit tcp source 192.168.7.0 0.0.0.255 destination 192.168.10.184 0 destination-port eq www

rule 13 permit tcp source 192.168.8.0 0.0.0.255 destination 192.168.10.184 0 destination-port eq www

rule 14 permit tcp source 192.168.16.0 0.0.0.255 destination 192.168.10.184 0 destination-port eq www

rule 15 permit tcp source 172.23.126.0 0.0.1.255 destination 192.168.10.184 0 destination-port eq www

rule 16 permit tcp source 172.25.126.0 0.0.1.255 destination 192.168.10.184 0 destination-port eq www

rule 20 permit tcp source 192.168.5.0 0.0.0.255 destination 192.168.10.184 0 destination-port eq 443

rule 21 permit tcp source 192.168.6.0 0.0.0.255 destination 192.168.10.184 0 destination-port eq 443

rule 22 permit tcp source 192.168.7.0 0.0.0.255 destination 192.168.10.184 0 destination-port eq 443

rule 23 permit tcp source 192.168.8.0 0.0.0.255 destination 192.168.10.184 0 destination-port eq 443

rule 24 permit tcp source 192.168.16.0 0.0.0.255 destination 192.168.10.184 0 destination-port eq 443

rule 25 permit tcp source 172.23.126.0 0.0.1.255 destination 192.168.10.184 0 destination-port eq 443

rule 26 permit tcp source 172.25.126.0 0.0.1.255 destination 192.168.10.184 0 destination-port eq 443

rule 30 permit udp source 192.168.5.0 0.0.0.255 destination 192.168.10.184 0 destination-port eq dns

rule 31 permit udp source 192.168.6.0 0.0.0.255 destination 192.168.10.184 0 destination-port eq dns

rule 32 permit udp source 192.168.7.0 0.0.0.255 destination 192.168.10.184 0 destination-port eq dns

rule 33 permit udp source 192.168.8.0 0.0.0.255 destination 192.168.10.184 0 destination-port eq dns

rule 34 permit udp source 192.168.16.0 0.0.0.255 destination 192.168.10.184 0 destination-port eq dns

rule 35 permit udp source 172.23.126.0 0.0.1.255 destination 192.168.10.184 0 destination-port eq dns

rule 36 permit udp source 172.25.126.0 0.0.1.255 destination 192.168.10.184 0 destination-port eq dns

rule 40 permit tcp source 192.168.5.0 0.0.0.255 destination 192.168.10.12 0 destination-port eq www

rule 41 permit tcp source 192.168.6.0 0.0.0.255 destination 192.168.10.12 0 destination-port eq www

rule 42 permit tcp source 192.168.7.0 0.0.0.255 destination 192.168.10.12 0 destination-port eq www

rule 43 permit tcp source 192.168.8.0 0.0.0.255 destination 192.168.10.12 0 destination-port eq www

rule 44 permit tcp source 192.168.16.0 0.0.0.255 destination 192.168.10.12 0 destination-port eq www

rule 45 permit tcp source 172.23.126.0 0.0.1.255 destination 192.168.10.12 0 destination-port eq www

rule 46 permit tcp source 172.25.126.0 0.0.1.255 destination 192.168.10.12 0 destination-port eq www

rule 50 permit tcp source 192.168.8.0 0.0.0.255 destination 192.168.10.16 0 destination-port eq 443

rule 55 permit tcp source 192.168.7.0 0.0.0.255 destination 192.168.10.184 0 destination-port eq 1521

rule 56 permit tcp source 192.168.8.0 0.0.0.255 destination 192.168.10.184 0 destination-port eq 1521

rule 57 permit tcp source 192.168.7.0 0.0.0.255 destination 192.168.10.184 0 destination-port eq 33306

rule 57 comment allow yanfa access to dev mysql port 33306

rule 59 permit tcp source 192.168.7.0 0.0.0.255 destination 192.168.10.184 0 destination-port eq 1433

rule 59 comment allow yanfa access to yanfa sqlserver port 1433

rule 60 permit tcp source 192.168.7.0 0.0.0.255 destination 192.168.10.184 0 destination-port eq 1434

rule 60 comment allow yanfa access to yanfa sqlserver port 1433

rule 61 permit tcp source 172.23.126.0 0.0.1.255 destination 192.168.10.184 0 destination-port range 8000 8010

rule 62 permit tcp source 192.168.7.0 0.0.0.255 destination 192.168.10.184 0 destination-port range 8000 8010

rule 63 permit tcp source 192.168.8.0 0.0.0.255 destination 192.168.10.184 0 destination-port range 8000 8010

rule 65 permit tcp source 192.168.7.0 0.0.0.255 destination 192.168.10.184 0 destination-port eq 10000

rule 67 permit tcp source 192.168.7.0 0.0.0.255 destination 192.168.10.184 0 destination-port eq 30236

rule 69 permit tcp source 192.168.7.0 0.0.0.255 destination 192.168.10.184 0 destination-port range 54322 54323

rule 69 comment allow yanfa access to yanfa rendajincang db ports

rule 72 permit tcp source 192.168.7.0 0.0.0.255 destination 192.168.10.184 0 destination-port eq 1888

rule 72 comment allow yanfa access to yanfa hive-kerberos

rule 73 permit tcp source 192.168.7.0 0.0.0.255 destination 192.168.10.184 0 destination-port eq 1782

rule 73 comment allow yanfa access to yanfa hive-kerberos

rule 75 permit tcp source 192.168.8.0 0.0.0.255 destination 192.168.10.12 0 destination-port eq ftp

rule 76 permit tcp source 192.168.7.0 0.0.0.255 destination 192.168.10.12 0 destination-port eq ftp

rule 100 deny ip source 192.168.5.0 0.0.0.255 destination 192.168.10.0 0.0.0.255

rule 105 deny ip source 192.168.6.0 0.0.0.255 destination 192.168.10.0 0.0.0.255

rule 110 deny ip source 192.168.7.0 0.0.0.255 destination 192.168.10.0 0.0.0.255

rule 115 deny ip source 192.168.8.0 0.0.0.255 destination 192.168.10.0 0.0.0.255

rule 120 deny ip source 192.168.16.0 0.0.0.255 destination 192.168.10.0 0.0.0.255

rule 125 deny ip source 172.23.126.0 0.0.1.255 destination 192.168.10.0 0.0.0.255

rule 130 deny ip source 172.25.126.0 0.0.1.255 destination 192.168.10.0 0.0.0.255

rule 135 permit ip

interface Vlan-interface10

ip address 192.168.10.1 255.255.255.0

packet-filter filter all

packet-filter 3010 outbound

出现了几个问题：

1. 在 vlan10 设置 packet-filter 3010 inbound 然后测试 deny 无任何效果，于是修改为 outbound 再测试基本上符合配置的deny和permit规则。对于vlan10来说，流量不应该是inbound吗，为什么匹配不到呢？

2. 在 vlan10 的outbound配置后acl的规则基本上都生效了，后续添加其他规则也正常，但是通过 dis packet-filter statistics sum outbound 3010 命令查看匹配的包都是0

   Totally 0 packets permitted, 0 packets denied                                                                                                                                                                                   
   Totally 0% permitted, 0% denied 
3. 后续在使用的时候发现，其他vlan访问vlan10确实根据acl 3010正常deny和permit了，但是无法从 vlan10 的机器主动访问其他vlan的服务了？这也不符合 acl 规则
 
 