使用访问控制列表预防IP地址欺骗（IP Address Spoofing Prevention with ACLs）

约定不等于承诺〃 2022-02-05 00:17 230阅读 0赞

【实验说明】

配置路由器预防IP地址欺骗

【实验拓扑】

IOS：c2691-advsecurityk9-mz.124-11.T2.bin

[![154629940.jpg][]][154629940.jpg]

【实验配置步骤】

*  在网关的outside过滤RFC1918、RFC3300 网络
 *  在网关的入方向过滤RFC2627网络
 *  也就是说，在内部只能是出现我们的网络，在外部不能出现源地址为我们的网络
 *  过滤icmp重定向信息，禁用 IP source routing
 *  不要在内网口上阻止source address 0.0.0.0 ,因为 DHCP 经常使用它来发送请求
 *  配置网络为 “Standard NAT Configuration”.

*  创建 extended access-list OUTSIDE\_IN

o Filter out ICMP redirects and packets sourced from host 0.0.0.0

o Filter out RFC 1918 networks

o Filter out RFC 3330 networks

o As per RFC 2627 deny packets sourced from “our” network 150.1.4.0/24

*  创建 extended access-list INSIDE\_IN

o Filter out ICMP redirects

o Permit UDP packets from 0.0.0.0/32 to 10.0.0.4 (R4’s address) port BOOTPs.

o Permit network 10.0.0.0/24 as per RFC2627

o Block and log everything else.

*  应用access-list INSIDE\_IN 到网关的内网口的入方向
 *  应用access-list OUTSIDE\_IN到网关的外网口的入方向

【实验配置】

**R4:**

no ip source-route

ip access-list extended OUTSIDE\_IN

remark == Redirects may be used for spoofing

deny icmp any any redirect

remark == RFC 1918

deny ip 10.0.0.0 0.255.255.255 any

deny ip 172.16.0.0 0.15.255.255 any

deny ip 192.168.0.0 0.0.255.255 any

remark == RFC 3330

deny ip host 0.0.0.0 any

deny ip 224.0.0.0 31.255.255.255 any

deny ip 127.0.0.0 0.255.255.255 any

deny ip 169.254.0.0 0.0.255.255 any

deny ip 192.0.2.0 0.0.0.255 any

remark == RFC 2627

deny ip 150.1.4.0 0.0.0.255 any

permit ip any any

ip access-list extended INSIDE\_IN

deny icmp any any redirect

permit ip 10.0.0.0 0.0.0.255 any

permit udp host 0.0.0.0 host 10.0.0.4 eq bootps

deny ip any any log

interface Fastethernet 0/0

ip access-group INSIDE\_IN in

interface Serial 0/1

ip access-group OUTSIDE\_IN in

interface Serial 0/0.1

ip access-group OUTSIDE\_IN in

【 Configuring Static NAT配置 】

<table style="font-family:'Helvetica Neue', Helvetica, 'PingFang SC', 'Hiragino Sans GB', 'Microsoft YaHei', '微软雅黑', Arial, sans-serif;font-size:14px;border-collapse:collapse;line-height:25px;"> 
 <tbody style="line-height:25px;"> 
  <tr style="line-height:25px;"> 
   <td style="border:1px solid rgb(221,221,221);line-height:25px;"> 
    <div style="line-height:25px;"> 
     <span style="line-height:22px;"> </span> 
     <div style="line-height:22px;"> 
      <div style="line-height:22px;font-weight:bold;">
        R1: 
      </div> 
      <div style="line-height:22px;">
        interface FastEthernet0/0 
      </div> 
      <div style="line-height:22px;">
        ip address 10.0.0.1 255.255.255.0 
      </div> 
      <div style="line-height:22px;"> 
       <span style="line-height:22px;">ip route 0.0.0.0 0.0.0.0 10.0.0.4</span> 
      </div> 
      <div style="line-height:22px;"> 
       <span style="line-height:22px;"> </span> 
       <div style="line-height:22px;font-weight:bold;"> 
        <br style="line-height:22px;"> &nbsp; 
       </div> 
       <div style="line-height:22px;font-weight:bold;">
         R6: 
       </div> 
       <div style="line-height:22px;">
         interface FastEthernet0/0 
       </div> 
       <div style="line-height:22px;">
         ip address 10.0.0.6 255.255.255.0 
       </div> 
       <div style="line-height:22px;">
         ip route 0.0.0.0 0.0.0.0 10.0.0.4 
       </div> 
      </div> 
     </div> 
     <div style="line-height:22px;"> 
      <b style="line-height:22px;"><br style="line-height:22px;"></b> 
     </div> 
     <div style="line-height:22px;"> 
      <b style="line-height:22px;">R4：</b> 
     </div> 
     <div style="line-height:22px;">
       interface Loopback0 
     </div> 
     <div style="line-height:22px;">
       ip address 150.1.4.4 255.255.255.0 
     </div> 
     <div style="line-height:22px;">
       ip ospf network point-to-point 
     </div> 
     <div style="line-height:22px;">
       ! 
     </div> 
     <div style="line-height:22px;">
       interface FastEthernet0/0 
     </div> 
     <div style="line-height:22px;">
       ip address 10.0.0.4 255.255.255.0 
     </div> 
     <div style="line-height:22px;">
       ip nat inside 
     </div> 
     <div style="line-height:22px;">
       ! 
     </div> 
     <div style="line-height:22px;"> 
      <span style="line-height:22px;">interface Serial0/0</span> 
     </div> 
     <div style="line-height:22px;"> 
      <span style="line-height:22px;">en fram</span> 
     </div> 
     <div style="line-height:22px;"> 
      <span style="line-height:22px;">no sh</span> 
     </div> 
     <div style="line-height:22px;"> 
      <span style="line-height:22px;">!</span> 
     </div> 
     <div style="line-height:22px;">
       interface Serial0/0.1 point-to-point 
     </div> 
     <div style="line-height:22px;">
       ip address 155.1.0.4 255.255.255.0 
     </div> 
     <div style="line-height:22px;">
       frame-relay interface-dlci 405 
     </div> 
     <div style="line-height:22px;">
       ip nat outside 
     </div> 
     <div style="line-height:22px;">
       ! 
     </div> 
     <div style="line-height:22px;">
       interface Serial0/1 
     </div> 
     <div style="line-height:22px;">
       ip address 155.1.45.4 255.255.255.0 
     </div> 
     <div style="line-height:22px;">
       clock rate 2000000 
     </div> 
     <div style="line-height:22px;">
       ip nat outside 
     </div> 
     <div style="line-height:22px;">
       ! 
     </div> 
     <div style="line-height:22px;">
       router ospf 1 
     </div> 
     <div style="line-height:22px;">
       router-id 150.1.4.4 
     </div> 
     <div style="line-height:22px;">
       network 150.1.4.4 0.0.0.0 area 0 
     </div> 
     <div style="line-height:22px;">
       network 155.1.0.4 0.0.0.0 area 0 
     </div> 
     <div style="line-height:22px;">
       network 155.1.45.4 0.0.0.0 area 0 
     </div> 
     <div style="line-height:22px;">
       ! 
     </div> 
     <div style="line-height:22px;">
       router bgp 1 
     </div> 
     <div style="line-height:22px;">
       bgp router-id 150.1.4.4 
     </div> 
     <div style="line-height:22px;">
       neighbor 150.1.5.5 remote-as 2 
     </div> 
     <div style="line-height:22px;">
       neighbor 150.1.5.5 ebgp-multihop 255 
     </div> 
     <div style="line-height:22px;">
       neighbor 150.1.5.5 update-source Loopback0 
     </div> 
     <div style="line-height:22px;"> 
      <br style="line-height:22px;"> &nbsp; 
     </div> 
     <div style="line-height:22px;">
       ip nat inside source static 10.0.0.1 150.1.4.1 
     </div> 
     <div style="line-height:22px;"> 
      <span style="line-height:22px;">ip nat inside source static 10.0.0.6 150.1.4.6</span> 
     </div> 
    </div> </td> 
   <td style="border:1px solid rgb(221,221,221);line-height:25px;"> 
    <div style="line-height:25px;"> 
     <div style="line-height:22px;"> 
      <b style="line-height:25px;"><br style="line-height:25px;"></b> 
     </div> 
     <div style="line-height:25px;"> 
      <div style="line-height:25px;"> 
       <font style="line-height:25px;"><span style="line-height:22px;"><b style="line-height:25px;">R5:</b></span></font> 
      </div> 
      <div style="line-height:25px;"> 
       <font style="line-height:25px;"> </font> 
       <div style="line-height:25px;"> 
        <span style="line-height:22px;">interface Loopback0</span> 
       </div> 
       <div style="line-height:25px;"> 
        <span style="line-height:22px;">ip address 150.1.5.5 255.255.255.0</span> 
       </div> 
       <div style="line-height:25px;"> 
        <span style="line-height:22px;">ip ospf network point-to-point</span> 
       </div> 
       <div style="line-height:25px;"> 
        <span style="line-height:22px;">!</span> 
       </div> 
       <div style="line-height:25px;"> 
        <span style="line-height:22px;">interface Serial0/0</span> 
       </div> 
       <div style="line-height:25px;"> 
        <span style="line-height:22px;">encapsulation frame-relay</span> 
       </div> 
       <div style="line-height:25px;"> 
        <span style="line-height:22px;">!</span> 
       </div> 
       <div style="line-height:25px;"> 
        <span style="line-height:22px;">interface Serial0/0.1 point-to-point</span> 
       </div> 
       <div style="line-height:25px;"> 
        <span style="line-height:22px;">ip address 155.1.0.5 255.255.255.0</span> 
       </div> 
       <div style="line-height:25px;"> 
        <span style="line-height:22px;">frame-relay interface-dlci 504</span> 
       </div> 
       <div style="line-height:25px;"> 
        <span style="line-height:22px;">!</span> 
       </div> 
       <div style="line-height:25px;"> 
        <span style="line-height:22px;">interface Serial0/1</span> 
       </div> 
       <div style="line-height:25px;"> 
        <span style="line-height:22px;">ip address 155.1.45.5 255.255.255.0</span> 
       </div> 
       <div style="line-height:25px;"> 
        <span style="line-height:22px;">clock rate 2000000</span> 
       </div> 
       <div style="line-height:25px;"> 
        <span style="line-height:22px;">!</span> 
       </div> 
       <div style="line-height:25px;"> 
        <span style="line-height:22px;">router ospf 1</span> 
       </div> 
       <div style="line-height:25px;"> 
        <span style="line-height:22px;">router-id 150.1.5.5</span> 
       </div> 
       <div style="line-height:25px;"> 
        <span style="line-height:22px;">network 150.1.5.5 0.0.0.0 area 0</span> 
       </div> 
       <div style="line-height:25px;"> 
        <span style="line-height:22px;">network 155.1.0.5 0.0.0.0 area 0</span> 
       </div> 
       <div style="line-height:25px;"> 
        <span style="line-height:22px;">network 155.1.45.5 0.0.0.0 area 0</span> 
       </div> 
       <div style="line-height:25px;"> 
        <span style="line-height:22px;">!</span> 
       </div> 
       <div style="line-height:25px;"> 
        <span style="line-height:22px;">router bgp 2</span> 
       </div> 
       <div style="line-height:25px;"> 
        <span style="line-height:22px;">bgp router-id 150.1.5.5</span> 
       </div> 
       <div style="line-height:25px;"> 
        <span style="line-height:22px;">neighbor 150.1.4.4 remote-as 1</span> 
       </div> 
       <div style="line-height:25px;"> 
        <span style="line-height:22px;">neighbor 150.1.4.4 ebgp-multihop 255</span> 
       </div> 
       <div style="line-height:25px;"> 
        <span style="line-height:22px;">neighbor 150.1.4.4 update-source Loopback0</span> 
       </div> 
       <div style="line-height:25px;"> 
        <span style="line-height:22px;">neighbor 150.1.4.4 default-originate</span> 
       </div> 
      </div> 
     </div> 
    </div> </td> 
  </tr> 
 </tbody> 
</table>

【实验验证】

**R4\#sho ip access-lists**

Standard IP access list INSIDE\_NETWORK

10 permit 10.0.0.0, wildcard bits 0.0.0.255

Extended IP access list INSIDE\_IN

10 deny icmp any any redirect

20 permit ip 10.0.0.0 0.0.0.255 any

30 permit udp host 0.0.0.0 host 10.0.0.4 eq bootps

40 deny ip any any log

Extended IP access list OUTSIDE\_IN

10 deny icmp any any redirect

20 deny ip 10.0.0.0 0.255.255.255 any