在JUNIPER MX960中查询流量的策略

在juniperMX960设备中查询哪些地址能够访问指定网段错误示范show configuration | match 10.192 | display setset firewall filter AFstaticip-authen term 1 from source-address 10.192.0.0/24set firewall filter anfang term 0 from destination-address 10.192.0.1/32set firewall filter anfang term 0 from destination-address 10.192.0.8/32set firewall filter anfang term 0 from destination-address 10.192.0.9/32set firewall filter anfang term 0 from destination-address 10.192.0.10/32set firewall filter anfang term 0 from destination-address 10.192.0.14/32set firewall filter anfang term 0 from destination-address 10.192.0.19/32set firewall filter anfang term 0 from destination-address 10.192.0.42/32set firewall filter anfang term 0 from destination-address 10.192.0.254/32set routing-options static route 10.192.0.0/24 next-hop 10.255.0.34set routing-options static route 10.192.4.0/24 next-hop 10.255.0.34set routing-options static route 10.192.5.0/24 next-hop 10.255.0.34set routing-options static route 10.192.6.0/24 next-hop 10.255.0.34set routing-options static route 10.192.7.0/24 next-hop 10.255.0.34set routing-options static route 10.192.8.0/24 next-hop 10.255.0.34set routing-options static route 10.192.9.0/24 next-hop 10.255.0.34set routing-options static route 10.192.10.0/24 next-hop 10.255.0.34正确示范先找路由通过路由确定接口show route 10.192.0.1inet.0: 28132 destinations, 28137 routes (28132 active, 0 holddown, 0 hidden) Active Route, - Last Active, * Both10.192.0.0/24 *[Static/5] 8w3d 14:36:23 to 10.255.0.34 via ge-12/1/5.0drcom-static.inet.0: 416 destinations, 416 routes (416 active, 0 holddown, 0 hidden) Active Route, - Last Active, * Both0.0.0.0/0 *[Static/5] 8w3d 14:36:28 to 10.255.0.41 via ae12.3906redirect.inet.0: 416 destinations, 416 routes (416 active, 0 holddown, 0 hidden) Active Route, - Last Active, * Both0.0.0.0/0 *[Static/5] 2w0d 23:38:25 to 10.211.220.9 via ge-0/0/4.0{master:member1-re0}在接口下查找相关配置show configuration interfaces ge-12/1/5description S127-anfang;unit 0 {family inet {filter {input AFstaticip-authen;output anfang;}address 10.255.0.33/29;}}找到相关的filter在filter中确定input方向的流量相关配置show configuration firewall filter AFstaticip-autheninterface-specific;term accept {from {destination-address {172.16.0.0/12; ### 数据中心网段210.45.144.0/20; ### 图书馆网段121.251.64.0/20; ### 学院楼网段10.0.0.0/8; ### 校园内网网段192.168.0.0/16;}}then accept;}在这个term中accept几乎全校网段这是input方向即相当于全校网段都可以访问10.192.0.1网段在filter中确定output方向的流量相关配置show configuration firewall filter anfangterm 0 {from {destination-address {10.192.0.1/32;10.255.0.34/32;10.192.0.8/32;10.192.0.9/32;10.192.0.10/32;10.192.0.14/32;10.192.0.19/32;10.192.0.42/32;10.192.0.254/32;}}then accept;}在这个filter中可以发现从本设备可以访问的IP地址