Не отрабатывают правила на клиентском терминале NTE-2

[Raveren]

На приставке NTE-2 созданы правила:

RulesForVlan604.png (23.94 КБ) 4517 просмотров

Объясните пожалуйста, почему проходят пакеты других VLAN присутствующих на стационарном терминале LTE-2X?

Код: Выделить всё

LTE-2X# show version
Eltex LTE software version 3.16.0 build 49 on 21.04.2017 11:42:28

[Dirks G]

Добрый день.
Вы выполнили реконфигурацию ONT после назначения профиля Rules?

Покажите:

switch
show running-config

[Raveren]

Добрый день.
Вы выполнили реконфигурацию ONT после назначения профиля Rules?

Покажите:

switch
show running-config

Выполнял неоднократно.

Код: Выделить всё

LTE-2X(switch)# sh running-config
management ip 10.x.x.x x.x.x.x
management gateway 10.x.x.x
management vlan 102

mirror rx analyzer front-port 0
mirror tx analyzer front-port 0

ip igmp snooping
ip igmp unregistered ip4-mc drop

mac-address-table aging-time 60

port-channel load-balance mac-ip

qos type 0

interface port-channel 1
  mode lacp
  bridging to front-port 0 , front-port 3
  speed 1000 full
  flow-control off
  pvid 1
  pup 0
  frame-types all
  ingress-filtering
  no uplink
exit

interface pon-port 0
  bridging to pon-port 0 , pon-port 1
exit

interface pon-port 1
  bridging to pon-port 0 , pon-port 1
exit

interface mgmt-pon-port 0
  pvid 102
exit

interface front-port 0
  bridging to front-port 0 , front-port 3
exit

interface front-port 1
  bridging to front-port 0 , front-port 3
  speed 1000 full
  no uplink
  channel-group 1
exit

interface front-port 2
  bridging to front-port 0 , front-port 3
  speed 1000 full
  no uplink
  channel-group 1
exit

interface front-port 3
  bridging to front-port 0 , front-port 1 , front-port 2 , front-port 3 , port-channel 1
  pvid 604
  no ingress-filtering
exit

no vlan 1
vlan 74
  name xxx
  isolation assign group 0 to pon-port 0
  isolation assign group 0 to pon-port 1
  tagged pon-port 0 , pon-port 1 , port-channel 1
exit

vlan 102
  name mgmt
  isolation assign group 0 to pon-port 0
  isolation assign group 0 to pon-port 1
  tagged pon-port 0 , pon-port 1 , port-channel 1
  untagged mgmt-pon-port 0
exit

vlan 105
  name xxx2
  isolation assign group 0 to pon-port 0
  isolation assign group 0 to pon-port 1
  tagged pon-port 0 , pon-port 1 , port-channel 1
exit

vlan 250
  name IPTV
  isolation assign group 0 to pon-port 0
  isolation assign group 0 to pon-port 1
  tagged pon-port 0 , pon-port 1 , front-port 0
  ip igmp snooping enable
  ip igmp snooping querier enable
    ip igmp snooping querier fast-leave
    ip igmp snooping querier user-prio 7
exit

vlan 458
  name xxx3
  isolation assign group 0 to pon-port 0
  isolation assign group 0 to pon-port 1
  tagged pon-port 0 , pon-port 1 , port-channel 1
exit

vlan 600
  name xxx4
  isolation assign group 0 to pon-port 0
  isolation assign group 0 to pon-port 1
  tagged pon-port 0 , pon-port 1 , port-channel 1
exit

vlan 604
  name xxx5
  no isolation assign group to pon-port 0
  no isolation assign group to pon-port 1
  tagged pon-port 0 , pon-port 1 , port-channel 1
  untagged front-port 3
exit

vlan 610
  name xxx6
  isolation assign group 0 to pon-port 0
  isolation assign group 0 to pon-port 1
  tagged pon-port 0 , port-channel 1
exit

vlan 611
  name xxx7
  isolation assign group 0 to pon-port 0
  isolation assign group 0 to pon-port 1
  tagged pon-port 1 , port-channel 1
exit

vlan 612
  name xxx8
  isolation assign group 0 to pon-port 0
  isolation assign group 0 to pon-port 1
  tagged pon-port 1 , port-channel 1
exit

vlan 613
  name xxx9
  isolation assign group 0 to pon-port 0
  isolation assign group 0 to pon-port 1
  tagged pon-port 1 , port-channel 1
exit

vlan 614
  name xxx10
  isolation assign group 0 to pon-port 0
  isolation assign group 0 to pon-port 1
  tagged pon-port 1 , port-channel 1
exit

vlan 615
  name xxx1
  isolation assign group 0 to pon-port 0
  isolation assign group 0 to pon-port 1
  tagged pon-port 1 , port-channel 1
exit

vlan 616
  name xxx12
  isolation assign group 0 to pon-port 0
  isolation assign group 0 to pon-port 1
  tagged pon-port 1 , port-channel 1
exit

vlan 617
  name xxx13
  isolation assign group 0 to pon-port 0
  isolation assign group 0 to pon-port 1
  tagged pon-port 1 , port-channel 1
exit

vlan 618
  name xxx14
  isolation assign group 0 to pon-port 0
  isolation assign group 0 to pon-port 1
  tagged pon-port 1 , port-channel 1
exit

vlan 619
  name xxx15
  isolation assign group 0 to pon-port 0
  isolation assign group 0 to pon-port 1
  tagged pon-port 1 , port-channel 1
exit

vlan 620
  name xxx16
  isolation assign group 0 to pon-port 0
  isolation assign group 0 to pon-port 1
  tagged pon-port 1 , port-channel 1
exit

vlan 621
  name xxx17
  isolation assign group 0 to pon-port 0
  isolation assign group 0 to pon-port 1
  tagged pon-port 1 , port-channel 1
exit

vlan 622
  name xxx18
  isolation assign group 0 to pon-port 0
  isolation assign group 0 to pon-port 1
  tagged pon-port 1 , port-channel 1
exit

vlan 623
  name xxx19
  isolation assign group 0 to pon-port 0
  isolation assign group 0 to pon-port 1
  tagged pon-port 1 , port-channel 1
exit

vlan 624
  name xxx20
  isolation assign group 0 to pon-port 0
  isolation assign group 0 to pon-port 1
  tagged pon-port 1 , port-channel 1
exit

vlan 625
  name xxx21
  isolation assign group 0 to pon-port 0
  isolation assign group 0 to pon-port 1
  tagged pon-port 1 , port-channel 1
exit

vlan 678
  name xxx22
  isolation assign group 0 to pon-port 0
  isolation assign group 0 to pon-port 1
  tagged pon-port 1 , port-channel 1
exit

vlan 901
  name xxx23
  isolation assign group 0 to pon-port 0
  isolation assign group 0 to pon-port 1
  tagged pon-port 0 , pon-port 1
exit

vlan 988
  name xxx24
  isolation assign group 0 to pon-port 0
  isolation assign group 0 to pon-port 1
  tagged pon-port 0 , pon-port 1 , port-channel 1
exit

vlan 1125
  name xxx25
  isolation assign group 0 to pon-port 0
  isolation assign group 0 to pon-port 1
  tagged pon-port 0 , pon-port 1 , port-channel 1
exit

vlan 3104
  name xxx26
  isolation assign group 0 to pon-port 0
  isolation assign group 0 to pon-port 1
  tagged pon-port 0 , port-channel 1
exit



[Raveren]

Wireshark'ом видно пакеты: ARP, LLDP, LOOP, STP, BROWSER, ICMPv6, DHCPv6 а так же Broadcast и Multicast разных протоколов.
Похоже, что гуляет трафик, который обрабатывается CPU.

[Dirks G]

Добрый день.
Подключите ПК за ONT с Linux и запишите дамп трафика.
Отправьте его мне на почту - 3201@eltex.org

[Raveren]

Выслал.

[Raveren]

Ну и в итоге по какой причине правила не отрабатывают? Месяц уже мой дамп рассматриваете.

[Dirks G]

Удалите ONT из конфигурации LTE.
Создайте новый профиль, в котором создайте правило:

0: if (VID !=604) then discard

Других правил не создавайте.

Добавьте ONT в конфигурацию, назначьте это правило на ONT, выполните реконфигурацию ONT и запишите дамп с ПК подключенного к NTE.