Extreme Networks ExtremeWare 7.2e, Инструкция по установке и эксплуатации

Страница: 166 / 344

166 ExtremeWare 7.2e Installation and User Guide
Security
• Inter-area Filter
—For switches configured to support multiple OSPF areas (an ABR function), an
access profile can be applied to an OSPF area that filters a set of OSPF inter-area routes from being
sourced from any other areas. To configure an inter-area filter policy, use the following command:
configure ospf area <area identifier> interarea-filter [<access profile> | none]
• External Filter —For switches configured to support multiple OSPF areas (an ABR function), an
access profile can be applied to an OSPF area that filters a set of OSPF external routes from being
advertised into that area. To configure an external filter policy, use the following command:
configure ospf area <area identifier> external-filter [<access profile> |none]
NOTE
If any of the external routes specified in the filter have already been advertised, those routes will remain
until the associated LSAs in that area time-out.
• ASBR Filter —For switches configured to support RIP and static route re-distribution into OSPF, an
access profile can be used to limit the routes that are advertised into OSPF for the switch as a whole.
To configure an ASBR filter policy, use the following command:
configure ospf asbr-filter [<access profile> | none]
• Direct Filter —For switches configured to support direct route re-distribution into OSPF, an access
profile can be used to limit the routes that are advertised into OSPF for the switch as a whole. To
configure a direct filter policy, use the following command:
configure ospf direct-filter [<access profile> | none]
Example
Figure 27 illustrates an OSPF network that is similar to the network used previously in the RIP example.
In this example, access to the Internet is accomplished by using the ASBR function on the switch labeled
Internet. As a result, all routes to the Internet will be done through external routes. Suppose the
network administrator wishes to only allow access to certain internet addresses falling within the range
192.1.1.0/24 to the internal backbone.