ACL与路由器生成包的相互作用,Router Self-ping.docxVIP

ACL与路由器生成包的相互作用路由器自己产生ping流量，路由器绕过（旁路）来自同一路由器生成的数据包的出站ACL逻辑。这个逻辑有助于避免路由器丢弃自己的开销流量的情况。这一逻辑适用于路由器为开销过程（如路由协议）创建的包，以及ping和traceroute命令。这部分增加的ACL观点会影响排错。Routers bypass their own outbound ACLs for packets generated by the router实验结果：Router Self-Ping of a Serial Interface IPv4 Address（串行链路上的Self-Ping）a self-ping actually sends packets over the serial link, which causes some interested effects with ACLs. When a user issues a self-ping for that local router’s serial IP address, the router actually sends the ICMP echo request out the link to the other router. The neighboring router then receives the packet and routes the packet with the ICMP echo request back to the original router.（在路由器串口上，路由器自己ping自己的串口地址，实际上该数据包会被发送到串行链路上，会发送给邻居路由器，邻居路由器会把ICMP的echo request 发回给源路由。）A self-ping of a serial interface actually tests many parts of a point-to-point serial link, asfollows:■ The link must work at Layers 1, 2, and 3. Specifically, both routers must have a working(up/up) serial interface, with correct IPv4 addresses configured.■ ACLs B, C, and D must permit the ICMP echo request and reply packets.（也就是说串行链路上的路由器接口自己ping自己的时候，该ICMP echo request数据包会在该串行链路上绕一圈！）R1 generates the ICMP echo request, so R1 bypasses outbound ACL A. ACLs B, C, and D could filter the packet. Note that the packet sent by R2 back to R1 is not generated by R2 in this case; R2 is just routing R1’s original packet back to R1.R2要对此ICMP包做路由转发！Router Self-Ping of an Ethernet Interface IPv4 Address(以太网链路上的Self-ping)access-list 挂载在e0/0的in方向，ping 自己被拒绝！再举个例子：In this case, R2 issues a ping 172.16.2.2 command to ping its own G0/2 IP address. Just like with a self-ping on serial links, R2 creates theICMP echo request. However, R2 basically processes the ping down（沿着） its own TCP/IP stack and back up again, with the ICMP echo never leaving the router’s Ethernet interface. R2 does check the Ethernet interface status, showing a failure if the interface is not up/up. R2 does not apply outbound ACL logic to the packet, because