H3C 路由器禁止使用traceroute 探测路由

rwrr322

原理：禁止从外网回到本地的 icmp icmp-type ttl-exceeded 数据包

1、定义ACL
定义ACL抓取 icmp icmp-type ttl-exceeded 和icmp icmp-type timestamp-reply
acl num 3889
rule 2 permit icmp icmp-type timestamp-reply
rule 3 permit icmp icmp-type ttl-exceeded
定义允许的目标，这样可以灵活增加某些目标可以实现traceroute
acl number 3888
rule 0 permit ip destination 202.97.0.1 0

2、定义classifier
traffic classifier per-icmp operator and
if-match acl 3888
traffic classifier deny-icmp operator and
if-match acl 3889
3、定义behavior
traffic behavior per
filter permit
traffic behavior deny
filter deny
4、定义qos policy
qos policy icmp
classifier per-icmp behavior per
classifier deny-icmp behavior deny


5、在接口下应用
interface Tunnel222
description shttbgp-gu-0423
ip address 172.16.99.222 255.255.255.252
source 10.127.29.1
destination 172.16.99.201
qos apply policy icmp inbound


测试是否成功

未应用QOS前
[jinan5500-2]trace -a 111.xxx.x.160  101.227.13.208
traceroute to 101.227.13.208(101.227.13.208) 30 hops max,40 bytes packet, press CTRL_C to break
1  10.100.10.2 3 ms 2 ms 1 ms
2  172.16.99.221 21 ms 22 ms 22 ms
3  10.100.222.13 25 ms 24 ms 25 ms
4  222.44.86.129 23 ms 22 ms 22 ms
5  172.16.30.1 22 ms 172.16.30.9 22 ms 172.16.30.1 22 ms
6  222.44.1.33 23 ms 222.44.1.37 24 ms 222.44.1.33 22 ms
7  61.237.0.238 22 ms 61.237.0.234 22 ms 61.237.0.238 32 ms
8  202.97.15.77 27 ms 29 ms 27 ms
9  202.97.48.209 27 ms 26 ms 27 ms
10  202.101.63.117 25 ms 26 ms 26 ms
11  * 101.95.207.18 28 ms *

应用QOS后
[jinan5500-2]trace -a 111.xxx.x.160  101.227.13.208
traceroute to 101.227.13.208(101.227.13.208) 30 hops max,40 bytes packet, press CTRL_C to break
1  10.100.10.2 8 ms 3 ms 2 ms
2  * * *
3  * * *
4  * * *
5  * * *
6  * * *
7  * * *
8  * * *
9  * * *
10  * * *
11  * * *
12  * * *
13  * * *
14  101.227.13.208 31 ms 32 ms 30 ms