在S7500E上禁止特定IP地址進入網(wǎng)絡(luò)的案例:<H3C>system-viewSystemView:returntoUserViewwithCtrl+Z.[H3C]aclnumber2000#創(chuàng)建匹配源地址是的IP報文。[H3C-acl-basic-2000]ruledenysource0[H3C-acl-basic-2000]quit[H3C]interfaceVlan-interface1#禁止ACL2000匹配的報文進入設(shè)備。（在靠近上行的接口下發(fā)）[H3C-Vlan-interface1]packet-filter2000inbound[H3C-Vlan-interface1]quit反向跟蹤法查詢IP：PC收到一個源地址，會回包，回包就會經(jīng)過相同的路徑。1、查看PC的網(wǎng)關(guān)地址，找到作為PC網(wǎng)關(guān)的設(shè)備。C:\Users\CallCenter>ipconfigWindowsIP配置以太網(wǎng)適配器本地連接：連接特定的DNS后綴 :IPv4地址 :10.XXX.XXX.XXX子網(wǎng)掩碼 :默認網(wǎng)關(guān) :10.XXX.XXX.XXX

2、查看該設(shè)備的路由表，判定該數(shù)據(jù)報回程的時候的路徑。3、在路徑的下一跳設(shè)備上繼續(xù)查找路由表項。<H3C>displayiprouting-tableRoutingTables:PublicDestinations:11Routes:12Destination/MaskProtoPreCostNextHopInterface/0Static60010.153.XX.1M-E1/0/0/010.153.XX.0/24Direct0010.153.XX.11M-E1/0/0/010.153.XX.11/32Direct00InLoop0/8Direct00InLoop0/32Direct00InLoop04、依次排查中間的每臺設(shè)備，發(fā)現(xiàn)下一跳是本機()的時候查看ARP表。<H3C>displayiprouting-tableRoutingTables:PublicDestinations:11Routes:12Destination/MaskProtoPreCostNextHopInterfaceDirect00InLoop010.153.XX.0/21Static60010.153.XX.1M-E1/0/0/0/26Direct00M-E1/0/0/0/32Direct00InLoop0/8Direct00InLoop0/32Direct00InLoop0

5、通過ARP表項找到對應(yīng)的出接口。<H3C>displayarpallIPAddressType:S-StaticMACAddress0011-2233-4455D-DynamicM-MultiportVLANIDInterfaceN/AGE0/0AgingType18D6、根據(jù)接口查找到二層交換機。7、根據(jù)MAC地址表找到接該PC的接口。<H3C>displaymac-addressMACADDRTIME(s)VLANIDSTATEPORTINDEX0011-2233-44551LearnedGigabitEthernet1/0/10011-2233-44561LearnedGigabitEthernet1/0/1MACADDRTIME(s)VLANIDSTATEPORTINDEX0011-2233-44551LearnedGigabitEthernet1/0/10011-2233-44561LearnedGigabitEthernet1/0/1AGINGAGINGAGING8、最終在PC上查看MAC認定是否為該PC。C:\Users\CallCenter>ipconfig/allWindowsIP配置主機名:CallCenter-Ext主機名主DNS后綴:混合:混合IP路由已啟用:否WINS代理已啟用:否DNS后綴搜索列表:以太網(wǎng)適配器本地連接:連接特定的DNS后綴 :描述 :Intel(R)82567LM-3GigabitNetworkConnection物理地址 :00-11-22-33-44-55DHCP已啟用 :是自動配置已啟用 :是IPv4地址 :(首選)子網(wǎng)掩碼 :92獲得租約的時間 :星期日,