需求背景
需求1:总公司有董事办网和员工网,并且有两条出口线路,其中1.1.1.2为中国电信1Gbps高速线路,2.2.2.2为中国移动100Mbps专线低速链路,公司希望董事办192.168.1.0/24可以总是走1Gbps专线,而员工网走中国移动100Mpbs专线;
思路:使用策略路由,对内网流量进行过滤,IP重定向,自定义公网出口,并且使用NAT技术进行IP地址转换,使得内网IP使用公网IP可以访问互联网;
需求2:总公司和分公司需要内网直接通信,内网互相访问,公司希望建立一条VPN GRE隧道,来使得总司和分司内部网络互通;
思路:总公司和分公司出口路由器通过部署GRE隧道,使得内网互通;
网络拓补图
第一步:基础网络设备打通,使得彼此可以互相访问
LSW1
<Huawei>sy
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center en
Info: Information center is disabled.
[Huawei]sysname LSW1
[LSW1]dhcp en
Info: The operation may take a few seconds. Please wait for a moment.done.
[LSW1]vlan batch 10 20 30
Info: This operation may take a few seconds. Please wait for a moment...done.
[LSW1]interface Vlanif 10
[LSW1-Vlanif10]ip address 10.1.1.2 24
[LSW1-Vlanif10]quit
[LSW1]interface Vlanif 20
[LSW1-Vlanif20]ip address 192.168.1.1 24
[LSW1-Vlanif20]dhcp se in
[LSW1-Vlanif20]quit
[LSW1]interface Vlanif 30
[LSW1-Vlanif30]ip address 192.168.2.1 24
[LSW1-Vlanif30]dhcp select interface
[LSW1-Vlanif30]quit
[LSW1]interface GigabitEthernet 0/0/1
[LSW1-GigabitEthernet0/0/1]port link-type access
[LSW1-GigabitEthernet0/0/1]port default vlan 10
[LSW1-GigabitEthernet0/0/1]quit
[LSW1]interface GigabitEthernet 0/0/3
[LSW1-GigabitEthernet0/0/3]port link-type access
[LSW1-GigabitEthernet0/0/3]port default vlan 20
[LSW1-GigabitEthernet0/0/3]stp edged-port enable
[LSW1-GigabitEthernet0/0/3]quit
[LSW1]interface GigabitEthernet 0/0/4
[LSW1-GigabitEthernet0/0/4]port link-type access
[LSW1-GigabitEthernet0/0/4]port default vlan 30
[LSW1-GigabitEthernet0/0/4]stp edged-port enable
[LSW1-GigabitEthernet0/0/4]quit
[LSW1]
[LSW1]
[LSW1]ospf 1
[LSW1-ospf-1]area 0
[LSW1-ospf-1-area-0.0.0.0]network 192.168.1.0 0.0.0.255
[LSW1-ospf-1-area-0.0.0.0]network 192.168.2.0 0.0.0.255
[LSW1-ospf-1-area-0.0.0.0]network 10.1.1.2 0.0.0.0
[LSW1-ospf-1-area-0.0.0.0]quit
[LSW1-ospf-1]quit
[LSW1]
[LSW1]ip route-static 0.0.0.0 0 10.1.1.1 //配置一条默认路由,数据包都发往路由器网关
AR1【总公司路由器】
The device is running!
<Huawei>sy
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center e
Info: Information center is disabled.
[Huawei]sys
[Huawei]sysname AR1
[AR1]interface GigabitEthernet 0/0/0
[AR1-GigabitEthernet0/0/0]ip address 10.1.1.1 24
[AR1-GigabitEthernet0/0/0]quit
[AR1]ospf 1
[AR1-ospf-1]area 0
[AR1-ospf-1-area-0.0.0.0]network 10.1.1.1 0.0.0.255
[AR1-ospf-1-area-0.0.0.0]quit
[AR1-ospf-1]quit
//打通内部网络,并且查看路由表,对获得IP的客户端进行ping操作,测试正常
配置公网IP
[AR1]interface GigabitEthernet 0/0/1
[AR1-GigabitEthernet0/0/1]ip address 1.1.1.2 24
[AR1-GigabitEthernet0/0/1]quit
[AR1]interface GigabitEthernet 0/0/2
[AR1-GigabitEthernet0/0/2]ip address 2.2.2.2 24
[AR1-GigabitEthernet0/0/2]quit
[AR1]
AR6【分公司路由器】
[Huawei]sysname AR6
[AR6]undo info-center enable
Info: Information center is disabled.
[AR6]dhcp enable
Info: The operation may take a few seconds. Please wait for a moment.done.
[AR6]int
[AR6]interface g
[AR6]interface GigabitEthernet 0/0/1
[AR6-GigabitEthernet0/0/1]ip address 172.16.1.1 24
[AR6-GigabitEthernet0/0/1]dhcp select interface
[AR6-GigabitEthernet0/0/1]quit
//配置分公司内部网络
配置公网IP
[AR6]interface GigabitEthernet 0/0/0
[AR6-GigabitEthernet0/0/0]ip address 100.1.1.2 24
[AR6-GigabitEthernet0/0/0]quit
[AR6]
给运营商设备打通网络,模拟运营商,此处忽略代码,不与展示,此处我是用OSPF协议,使得公网IP能全通。
需求1实验代码【总公司】
//使用ACL将内网2个网段匹配出来
[AR1]acl 3000
[AR1-acl-adv-3000]rule permit ip source 192.168.1.0 0.0.0.255
[AR1-acl-adv-3000]rule permit ip source 192.168.2.0 0.0.0.255
[AR1-acl-adv-3000]quit
//写两条默认路由到公网,使得到2出公网都可达
[AR1]ip route-static 0.0.0.0 0 1.1.1.1
[AR1]ip route-static 0.0.0.0 0 2.2.2.1
//两个接口下分别配置EasyNat实现内网访问公网需求
[AR1]interface GigabitEthernet 0/0/1
[AR1-GigabitEthernet0/0/1]nat outbound 3000
[AR1-GigabitEthernet0/0/1]quit
[AR1]interface GigabitEthernet 0/0/2
[AR1-GigabitEthernet0/0/2]nat outbound 3000
[AR1-GigabitEthernet0/0/2]quit
[AR1]
[AR1]traffic classifier dongshi operator or //创建董事办流分类
[AR1-classifier-dongshi]if-match acl 3001 //如果匹配董事办网段
[AR1-classifier-dongshi]quit
[AR1]traffic behavior dongshi //定义流行为
[AR1-behavior-dongshi]redirect ip-nexthop 1.1.1.1 //重定向下一跳为中国电信高速链路
[AR1-behavior-dongshi]quit
[AR1]traffic classifier yuangon operator or
[AR1-classifier-yuangon]if-match acl 3002
[AR1-classifier-yuangon]quit
[AR1]traffic behavior yuangon
[AR1-behavior-yuangon]redirect ip-nexthop 2.2.2.1//重定向下一跳为中国移动低速链路
[AR1-behavior-yuangon]quit
[AR1]traffic policy company //创建“company”流策略
[AR1-trafficpolicy-company]classifier dongshi behavior dongshi //应用董事办策略
[AR1-trafficpolicy-company]classifier yuangon behavior yuangon //应用员工网策略
[AR1-trafficpolicy-company]quit
[AR1]interface GigabitEthernet 0/0/0//在该接口下对流入的内网流量应用流策略
[AR1-GigabitEthernet0/0/0]traffic-policy company inbound
[AR1-GigabitEthernet0/0/0]quit
[AR1]
<AR1>
备注:重定向IP的时候,千万不要写错下一跳IP地址,不然不会生效
需求1测试:
PC1测试
应用策略之前,走了移动低速链路
PC>tracert 3.3.3.1
traceroute to 3.3.3.1, 8 hops max
(ICMP), press Ctrl+C to stop
1 192.168.1.1 31 ms 15 ms 32 ms
2 * * *
3 2.2.2.1 47 ms 46 ms 63 ms
4 5.5.5.2 62 ms 32 ms 47 ms
5 4.4.4.1 78 ms 62 ms 63 ms
6 3.3.3.1 93 ms 63 ms 62 ms
应用策略之后,走了电信高速链路
PC>
PC>
PC>tracert 3.3.3.1
traceroute to 3.3.3.1, 8 hops max
(ICMP), press Ctrl+C to stop
1 192.168.1.1 32 ms 15 ms 31 ms
2 * * *
3 3.3.3.1 63 ms 62 ms 47 ms
//备注:因为3.3.3.1和1.1.1.1是同一台设备,所以此处的确走了出口IP:1.1.1.1
PC2测试
应用流策略之前,员工网络走了电信高速路径
PC>tracert 1.1.1.1
traceroute to 1.1.1.1, 8 hops max
(ICMP), press Ctrl+C to stop
1 192.168.2.1 16 ms 15 ms 32 ms
2 * * *
3 1.1.1.1 31 ms 47 ms 47 ms
应用流策略之后,不论公网哪个IP地址,都走了下面的低速链路
PC>
PC>tracert 1.1.1.1
traceroute to 1.1.1.1, 8 hops max
(ICMP), press Ctrl+C to stop
1 192.168.2.1 32 ms 15 ms 32 ms
2 * * *
3 2.2.2.1 46 ms 47 ms 47 ms
4 5.5.5.2 63 ms 47 ms 78 ms
5 4.4.4.1 62 ms 63 ms 78 ms
6 1.1.1.1 62 ms 63 ms 78 ms
分公司内网PC访问外网需求
[AR6]ip route-static 0.0.0.0 0 100.1.1.1
[AR6]acl 3000
[AR6-acl-adv-3000]rule permit ip source 172.16.1.0 0.0.0.255
[AR6-acl-adv-3000]quit
[AR6]interface GigabitEthernet 0/0/0
[AR6-GigabitEthernet0/0/0]nat outbound 3000
[AR6-GigabitEthernet0/0/0]quit
[AR6]
[AR6]
分公司PC测试ping公网任意IP地址可达,证明OK
PC>ping 4.4.4.4
Ping 4.4.4.4: 32 data bytes, Press Ctrl_C to break
Request timeout!
--- 4.4.4.4 ping statistics ---
2 packet(s) transmitted
0 packet(s) received
100.00% packet loss
PC>ping 4.4.4.1
Ping 4.4.4.1: 32 data bytes, Press Ctrl_C to break
From 4.4.4.1: bytes=32 seq=1 ttl=253 time=31 ms
From 4.4.4.1: bytes=32 seq=2 ttl=253 time=31 ms
From 4.4.4.1: bytes=32 seq=3 ttl=253 time=16 ms
From 4.4.4.1: bytes=32 seq=4 ttl=253 time=31 ms
From 4.4.4.1: bytes=32 seq=5 ttl=253 time=31 ms
--- 4.4.4.1 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 16/28/31 ms
PC>ping 1.1.1.1
Ping 1.1.1.1: 32 data bytes, Press Ctrl_C to break
From 1.1.1.1: bytes=32 seq=1 ttl=252 time=32 ms
From 1.1.1.1: bytes=32 seq=2 ttl=252 time=31 ms
From 1.1.1.1: bytes=32 seq=3 ttl=252 time=31 ms
From 1.1.1.1: bytes=32 seq=4 ttl=252 time=31 ms
From 1.1.1.1: bytes=32 seq=5 ttl=252 time=16 ms
--- 1.1.1.1 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 16/28/32 ms
PC>
需求2实验代码
总公司路由器设置,写静态路由,去往172.16.1.0的路由,从tunnel隧道发出
#
interface Tunnel0/0/0
ip address 192.168.100.1 255.255.255.0
tunnel-protocol gre
source 1.1.1.2
destination 100.1.1.2
#
ip route-static 172.16.1.0 255.255.255.0 Tunnel0/0/0
#
分公司路由器设置,使用静态路由进行互访
#
interface Tunnel0/0/0
ip address 192.168.100.2 255.255.255.0
tunnel-protocol gre
source 100.1.1.2
destination 1.1.1.2
#
ip route-static 192.168.1.0 255.255.255.0 Tunnel0/0/0
ip route-static 192.168.2.0 255.255.255.0 Tunnel0/0/0
=====================================================================================
2个客户端ping测试
总公司PC1
PC>ipconfig
Link local IPv6 address...........: fe80::5689:98ff:fe47:2689
IPv6 address......................: :: / 128
IPv6 gateway......................: ::
IPv4 address......................: 192.168.1.254
Subnet mask.......................: 255.255.255.0
Gateway...........................: 192.168.1.1
Physical address..................: 54-89-98-47-26-89
DNS server........................:
PC>ping 172.16.1.254
Ping 172.16.1.254: 32 data bytes, Press Ctrl_C to break
From 172.16.1.254: bytes=32 seq=1 ttl=125 time=78 ms
From 172.16.1.254: bytes=32 seq=2 ttl=125 time=62 ms
From 172.16.1.254: bytes=32 seq=3 ttl=125 time=78 ms
From 172.16.1.254: bytes=32 seq=4 ttl=125 time=63 ms
From 172.16.1.254: bytes=32 seq=5 ttl=125 time=62 ms
--- 172.16.1.254 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 62/68/78 ms
PC>
=====================================================================================
分公司路由器
PC>ipconfig
Link local IPv6 address...........: fe80::5689:98ff:fe5d:62fe
IPv6 address......................: :: / 128
IPv6 gateway......................: ::
IPv4 address......................: 172.16.1.254
Subnet mask.......................: 255.255.255.0
Gateway...........................: 172.16.1.1
Physical address..................: 54-89-98-5D-62-FE
DNS server........................:
PC>
PC>PING 192.168.1.254
Ping 192.168.1.254: 32 data bytes, Press Ctrl_C to break
Request timeout!
From 192.168.1.254: bytes=32 seq=2 ttl=125 time=78 ms
From 192.168.1.254: bytes=32 seq=3 ttl=125 time=63 ms
From 192.168.1.254: bytes=32 seq=4 ttl=125 time=78 ms
From 192.168.1.254: bytes=32 seq=5 ttl=125 time=78 ms
--- 192.168.1.254 ping statistics ---
5 packet(s) transmitted
4 packet(s) received
20.00% packet loss
round-trip min/avg/max = 0/74/78 ms
PC>