Cisco anti-DDoS list application (1)

This article describes in detail the overall configuration process of the Self-reverse access table from the overall configuration process, and lists the configuration results of the show run, I believe that after reading this article, you will have a clear configuration process for the Self-counter list.

The self-reverse access table is actually an additional feature or feature that extends the I P naming access table. You can use a p e r m I t statement to create an extended I P named access table for all protocols that want to create reverse table items. You must also use the r e f l e c t keyword in each p e r m I t statement to indicate that you need to use an auto-reverse enable table item in the access table. In addition to using the r e f l e c t keyword in one or more p e r m I t statements, two related I O S statements must also be considered. One is the e v a l u a t e Statement, which should be added to the end of the list to end the self-reverse access table. The other statement is the I preflexice-list timeout command, which is used to change the global t I m e-o u t value of the temporary self-reverse Access Table item. The default value is 300 s, you can modify the global timeout value through ip reflexive-list timeout in global mode or set the timeout value in the corresponding application line, which takes precedence over the global setting value ).

The basic format of the anti-list is:

Ip access-list extended xxx

Permit protocol source destination reflect name [time-out seconds]

Ip access-list extended yyy

Evaluate name)

Finally, it is enabled on the interface, which is similar to the application rules of the common list.

First, check the configuration of the Self-counter list before the test:

R2 #

R2 # sh ip acce

Reflexive IP access list cisco

Extended IP access list infilter

10 permit ospf any (33 matches) display definitions allow ospf traffic to pass through)

20 evaluate cisco

Extended IP access list outfilter

10 permit ospf any (39 matches)

20 permit icmp any host 2.2.2.2 reflect cisco

30 permit icmp any host 30.1.1.1 reflect cisco

40 permit tcp any host 2.2.2.2 eq telnet reflect cisco

50 permit tcp any host 30.1.1.1 eq telnet reflect cisco

R2 #

Check whether the configuration of the Self-counter list after the test is different:

Reflexive IP access list cisco

Permit tcp host 2.2.2.2 eq telnet host 1.1.1.1 eq 13232 (73 matches) (time left 293)

Permit icmp host 2.2.2.2 host 1.1.1.1 (19 matches) (time left 262) This is a temporary enabling table item created dynamically. The default time is S)

Extended IP access list infilter

10 permit ospf any (100 matches)

20 evaluate cisco

Extended IP access list outfilter

10 permit ospf any (105 matches)

20 permit icmp any host 2.2.2.2 reflect cisco (22 matches)

30 permit icmp any host 30.1.1.1 reflect cisco (11 matches)

40 permit tcp any host 2.2.2.2 eq telnet reflect cisco (245 matches)

50 permit tcp any host 30.1.1.1 eq telnet reflect cisco (138 matches)

R2 #

Then let's take a look at the application under the interface:

Interface Serial1/0

Ip address 2.2.2.1 255.255.255.0

Ip access-group infilter in

Clock rate 64000

!

Interface Serial1/1

Ip address 1.1.1.2 255.255.255.0

Ip access-group outfilter in

Note: Applications in the internal and external lists do not have to be under the same interface.

OK. Now let's test the ping result on R1:

R1 # ping 2.2.2.2

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 136/213/268 MS

R1 # ping 30.1.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 30.1.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 72/164/268 MS

R1 #