stalker86 писал(а):
А пример Ваших arp правил можете показать?
Код:
#allow traffic for specified ports
create access_profile ethernet source_mac 00-00-00-00-00-00 profile_id 1
#to manually allow any traffic for port X add following rule:
#config access_profile profile_id 1 add access_id auto_assign ethernet source_mac 00-00-00-00-00-00 port X permit
#allow tagged frames
create access_profile packet_content_mask offset_0-15 0x0 0x0 0x0 0xffff0000 profile_id 2
config access_profile profile_id 2 add access_id auto_assign packet_content offset 12 0x81000000 port all permit
#deny networks 172.17.0.0/16 and 10.99.0.0/16 for subscribers
create access_profile packet_content_mask offset_0-15 0x0 0x0 0x0 0xffff0000 offset_16-31 0x0 0x0 0x0 0xffff profile_id 3
config access_profile profile_id 3 add access_id auto_assign packet_content offset 12 0x08000000 offset 28 0xac11 port 1-24 deny
config access_profile profile_id 3 add access_id auto_assign packet_content offset 12 0x08000000 offset 28 0x0a63 port 1-24 deny
#allow individual source network for a specific subscriber. (!) this rule applies only to untagged traffic
create access_profile packet_content_mask offset_0-15 0x0 0x0 0x0 0xffff0000 offset_16-31 0x0 0x0 0xffff 0xfef80000 profile_id 5
config access_profile profile_id 5 add access_id auto_assign packet_content offset 12 0x08000000 offset 24 0x0aXX offset 28 0xYY080000 port 1 permit
config access_profile profile_id 5 add access_id auto_assign packet_content offset 12 0x08000000 offset 24 0x0aXX offset 28 0xYY100000 port 2 permit
...
#permit ARP with correct 4th octet (between port*8 and port*8+7). (!) these rules applies only to untagged traffic
create access_profile packet_content_mask offset_0-15 0x0 0x0 0x0 0xffff0000 offset_16-31 0x0 0x0 0x0 0xf8 profile_id 6
config access_profile profile_id 6 add access_id auto_assign packet_content offset 12 0x08060000 offset 28 0x08 port #1 permit
config access_profile profile_id 6 add access_id auto_assign packet_content offset 12 0x08060000 offset 28 0x10 port #2 permit
...
#DSCP mapping on valid multicast groups
create access_profile ip dscp profile_id 7
config access_profile profile_id 7 add access_id auto_assign ip dscp 48 port 25 permit priority 6
#deny multicast from subscribers. (!) this rule applies only to untagged traffic
create access_profile packet_content_mask offset_0-15 0x0 0x0 0x0 0xffff0000 offset_16-31 0x0 0x0 0x0 0x0000f000 profile_id 8
config access_profile profile_id 8 add access_id auto_assign packet_content offset 12 0x08000000 offset 28 0x0000e000 port 1-24 deny
#deny ARP (optional), IP (optional) and broadcast. permit IPv6. deny unknown ethernet. (for subscribers)
create access_profile ethernet source_mac 00-00-00-00-00-00 destination_mac FF-FF-FF-FF-FF-FF ethernet_type profile_id 9
config access_profile profile_id 9 add access_id auto_assign ethernet ethernet_type 0x0806 port 1-24 deny
config access_profile profile_id 9 add access_id auto_assign ethernet ethernet_type 0x0800 port 1-24 deny
config access_profile profile_id 9 add access_id auto_assign ethernet destination_mac FF-FF-FF-FF-FF-FF port 1-24 deny
config access_profile profile_id 9 add access_id auto_assign ethernet ethernet_type 0x86dd port 1-24 permit
config access_profile profile_id 9 add access_id auto_assign ethernet source_mac 00-00-00-00-00-00 port -124 deny
IP-сети разрешаются по принципу 10.128.4-5.8-15 или 10.143.8-9.80-87. То есть в 3-м октете 2 числа, а в 4-м - 8. Сети у меня на абонента с маской /29 и "плавающим" третьим октетом.
В ARP проверяется только 4-й октет.
То есть XX в правилах - это второй октет, а YY - третий. А совпадение с третьим и четвертым обеспечивается прерывающейся маской 0xfef80000.
Вход
Регистрация
FAQ
Поиск
