[네트워크] 알카텔 스위치 ACL 설정 - 설명 및 예제 Config

1. 알카텔 스위치 ACL 설명

※ ACL 적용

: condition - action - rule의 순서로 적용합니다. 그리고 반드시 마지막에 qos enable & qos apply 해주어야 적용이 됩니다. config를 한 상태에서 apply를 하지 않으면 적용이 되지 않습니다.

 

 

※ ACL 삭제

: ACL 전체 삭제qos flush 후 qos apply

 ACL의 삭제는 적용했을 때의 반대로 rule - action - condition의 순서로 삭제하면 됩니다.

 

 

* 명령어 설명

-> qos enable

: qos활성화

-> qos revert

: qosapply 되지 않은 QoS configuration 삭제

-> qos flush

: 설정한QoS configuration을 삭제

-> qos apply

: qos flush 후에 qos apply를 입력해야 전체 삭제 설정이 적용

 

2. 알카텔 ACL Config

 

※ Layer2 ACL (R6/R8)

-> policy condition [condition-name] destination mac 00:00:00:00:00:03

-> policy action [action-name] disposition [accept/deny/drop]

-> policy rule [rule-name]condition [condition-name] action [action-name]

-> qos apply

 

※ Layer3 ACL (R6/8)

-> policy condition [c-name] source ip10.0.0.100 destination ip192.0.0.0 mask 255.0.0.0

-> policy action [a-name]disposition [accept/deny/drop]

-> policy rule [r-name]condition [c-name] action [a-name]

-> qos apply

 

※ Layer4 ACL

-> policy service [se-name#1] destination tcp-port 445 (R8)

-> policy service [se-name#2]destination tcpport 135 (R6)

-> policy service group [se-group-name][se-name#1] [se-name#2] (R6/8)

-> policy condition [c-name]service group [se-group-name](R6/8)

-> policy action [a-name]disposition [accept/deny/drop](R6/8)

-> policy rule [r-name]condition [c-name] action [a-name] (R6/8)

-> qos apply (R6/8)

 

3. 알카텔 ACL 예제

※ 스위치에 특정 IP대역만 ssh 접속 가능한 설정

- policy service s1 protocol 6 destination tcp port 22

- policy service group tcp s1

- policy condition c1 source ip 192.168.1.1

- policy condition drop destination network group Switch service group tcp

- policy action accept

- policy action deny disposition deny

- policy rule r1 precedence 100 condition c1 action accept

- policy rule r2 condition drop action deny

- qos apply

 

 

※ IP가 10.10.10.100을 제외한 모든 IP에 대해서 Switch로 TCP 23,21,80 접속을 차단

- policy service t1 protocol 6 destination tcp port 23

- policy service t2 protocol 6 destination tcp port 21

- policy service t3 protocol 6 destination tcp port 80

- policy service group g_1 t1 t2 t3

- policy condition drop destination network group Switch service group g_1

- policy condition ok_c1 source ip 10.10.10.100 destination network group Switch service group g_1

- policy action accept disposition accept

- policy action deny disposition deny

- policy rule r1 precedence 100 condition ok_c1 action accept

- policy rule drop condition drop action deny

- qos apply