久しぶりにGNS3（その19：ルート制御）

## ルート制御（アクセスコントロール）？
適切な言葉が見つからず。内容は簡単。NATの内側ネットワークからのアクセスを制限するもの。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/634816/e3da4296-d8fe-b6c9-3cf5-0762ddcfe53c.png)
1. 各PCは異なるネットワークに属す
1. PC1とPC2とはNATの内側、PC3とPC4とはNATの外側
1. PC1はPC3にアクセスできるが、PC2やPC4にはアクセスできない
1. PC2はPC4にアクセスできるが、PC1やPC3にはアクセスできない

## 設定
PCは自明のため、省略（固定IPアドレスアサイン）。関連する部分のみ記載。

### NAT-Router
```
interface Ethernet0/0
 ip address 192.168.0.1 255.255.255.0
 ip nat inside

interface Ethernet0/1
 ip address 10.0.0.1 255.255.255.0
 ip nat outside

ip nat inside source list 1 interface Ethernet0/1 overload
ip route 0.0.0.0 0.0.0.0 Ethernet0/1
ip route 172.16.0.0 255.255.0.0 Ethernet0/0

access-list 1 permit any
```

### L3SW-1
NAT外側のL3SW-2では、PC1やPC2のアドレスが見えないため、PC3やPC4へのアクセス制御はL3SW-1にて実施する必要がある。

```
interface Ethernet0/0
 no switchport
 ip address 192.168.0.2 255.255.255.0

interface Ethernet0/1
 no switchport
 ip address 172.16.0.1 255.255.255.0
 ip access-group AC172-29-10 in
 ip access-group AC172-16-1 out

interface Ethernet0/2
 no switchport
 ip address 172.16.1.1 255.255.255.0
 ip access-group AC192-168-10 in
 ip access-group AC172-16-0 out

ip route 0.0.0.0 0.0.0.0 Ethernet0/0
!
ip access-list extended AC172-16-0
 deny   ip 172.16.0.0 0.0.0.255 any
 permit ip any any
ip access-list extended AC172-16-1
 deny   ip 172.16.1.0 0.0.0.255 any
 permit ip any any
ip access-list extended AC172-29-10
 deny   ip any 172.29.10.0 0.0.0.255
 permit ip any any
ip access-list extended AC192-168-10
 deny   ip any 192.168.10.0 0.0.0.255
 permit ip any any
```


### L3SW-2
```
interface Ethernet0/0
 no switchport
 ip address 10.0.0.2 255.255.255.0

interface Ethernet0/1
 no switchport
 ip address 192.168.10.1 255.255.255.0

interface Ethernet0/2
 no switchport
 ip address 172.29.10.1 255.255.255.0
```

## テスト
PC1のコンソール
```
PC1> ping 172.16.1.2
172.16.1.2 icmp_seq=1 timeout
*172.16.0.1 icmp_seq=2 ttl=255 time=1.416 ms (ICMP type:3, code:13, Communication administratively prohibited)
*172.16.0.1 icmp_seq=3 ttl=255 time=1.630 ms (ICMP type:3, code:13, Communication administratively prohibited)
*172.16.0.1 icmp_seq=4 ttl=255 time=0.606 ms (ICMP type:3, code:13, Communication administratively prohibited)
*172.16.0.1 icmp_seq=5 ttl=255 time=0.708 ms (ICMP type:3, code:13, Communication administratively prohibited)

PC1> ping 172.16.1.1
172.16.1.1 icmp_seq=1 timeout
172.16.1.1 icmp_seq=2 timeout
172.16.1.1 icmp_seq=3 timeout
172.16.1.1 icmp_seq=4 timeout
172.16.1.1 icmp_seq=5 timeout

PC1> ping 192.168.10.2
84 bytes from 192.168.10.2 icmp_seq=1 ttl=61 time=3.043 ms
84 bytes from 192.168.10.2 icmp_seq=2 ttl=61 time=1.376 ms
84 bytes from 192.168.10.2 icmp_seq=3 ttl=61 time=1.342 ms
84 bytes from 192.168.10.2 icmp_seq=4 ttl=61 time=1.307 ms
84 bytes from 192.168.10.2 icmp_seq=5 ttl=61 time=1.138 ms

PC1> ping 172.29.10.2
*172.16.0.1 icmp_seq=1 ttl=255 time=0.609 ms (ICMP type:3, code:13, Communication administratively prohibited)
*172.16.0.1 icmp_seq=2 ttl=255 time=0.672 ms (ICMP type:3, code:13, Communication administratively prohibited)
*172.16.0.1 icmp_seq=3 ttl=255 time=0.567 ms (ICMP type:3, code:13, Communication administratively prohibited)
*172.16.0.1 icmp_seq=4 ttl=255 time=1.261 ms (ICMP type:3, code:13, Communication administratively prohibited)
*172.16.0.1 icmp_seq=5 ttl=255 time=0.615 ms (ICMP type:3, code:13, Communication administratively prohibited)
```
ほぼ期待どおりであるが、172.16.0.0/24から172.16.1.0/24への制御をしている中で、PC1からPC2へのping結果（Communication administratively prohibited）とL3SW-1のEthernet0/2へのping結果（timeout）とが異なる理由はよくわからず。

PC2からのping結果も下記する。
```
PC2> ping 192.168.10.2
*172.16.1.1 icmp_seq=1 ttl=255 time=0.534 ms (ICMP type:3, code:13, Communication administratively prohibited)
*172.16.1.1 icmp_seq=2 ttl=255 time=0.571 ms (ICMP type:3, code:13, Communication administratively prohibited)
*172.16.1.1 icmp_seq=3 ttl=255 time=1.030 ms (ICMP type:3, code:13, Communication administratively prohibited)
*172.16.1.1 icmp_seq=4 ttl=255 time=0.593 ms (ICMP type:3, code:13, Communication administratively prohibited)
*172.16.1.1 icmp_seq=5 ttl=255 time=0.584 ms (ICMP type:3, code:13, Communication administratively prohibited)

PC2> ping 172.29.10.2 
84 bytes from 172.29.10.2 icmp_seq=1 ttl=61 time=6.537 ms
84 bytes from 172.29.10.2 icmp_seq=2 ttl=61 time=1.976 ms
84 bytes from 172.29.10.2 icmp_seq=3 ttl=61 time=2.122 ms
84 bytes from 172.29.10.2 icmp_seq=4 ttl=61 time=2.724 ms
84 bytes from 172.29.10.2 icmp_seq=5 ttl=61 time=2.453 ms
```

## おわりに
ここに記載の手法が適切か不明。こういった制御をする王道が知りたい（少々調べたがみつからず）。