基础配置(送分题):system-view 、sysname、interface vlanif 、IP地址
高频配置(一定要会的):VLAN、DHCP、ACL、策略路由、NAT、静态/默认/RIP/OSPF
偏门考点:IPv6、4G、WLAN、IPSEC
下午占分比例50%
华为基础配置命令
<Huawei>:用户视图
[Huawei]:系统视图
[user-interface vty 04] :进入用户接口视图
[interface g0/0/0]:进入接口视图
[acl 2000]:进入ACL视图
[vlan 10]:进入VLAN视图
[ospf 1]:进入路由协议视图
quit:返回上一层视图
DHCP与VLAN配置
我这里用的ensp模拟器,由于海外针对华为问题,开源软件也告华为侵权致华为下架这款软件了,现在好像华为自己出了款ensp模拟器可以去官网文档查询一下
手动配置IP地址
划分VLAN10、20 ,并将端口1放入VLAN10,端口2放入VLAN20,设置网关
undo info-center enable:关闭提醒信息(不然一直弹出打断敲命令)
<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]vlan batch 10 20
Info: This operation may take a few seconds. Please wait for a moment...done.
[Huawei]interface vlanif 10
[Huawei-Vlanif10]ip address 192.168.10.254 24
[Huawei-Vlanif10]interface vlanif 20
[Huawei-Vlanif20]ip address 192.168.20.254 24
[Huawei-Vlanif20]interface gigabitethernet 0/0/1
[Huawei-GigabitEthernet0/0/1]port link-type access
[Huawei-GigabitEthernet0/0/1]port default vlan 10
[Huawei-GigabitEthernet0/0/1]interface gigabitethernet 0/0/2
[Huawei-GigabitEthernet0/0/2]port link-type access
[Huawei-GigabitEthernet0/0/2]port default vlan 20
[Huawei-GigabitEthernet0/0/2]
给PC1手动添加地址,网关指向我们设置的192.168.10.254
给PC2手动添加地址,网关指向我们设置的192.168.20.254
两台主机相互ping一下测试通了没
基于端口DHCP配置
开启DHCP功能
划分VLAN10、20,并将端口g0/0/1、g0/0/2分配相应VLAN
指定VLAN10、20网关
指定基于端口DHCP
指定dns
指定租期
排除分配地址范围(华为分配地址默认从最大地址开始分配,下面10、20网段我们都是排除了100-253的地址,所以因为会获取到10.99/20.99的IP地址)
<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]dhcp enable
Info: The operation may take a few seconds. Please wait for a moment.done.
[Huawei]vlan batch 10 20
Info: This operation may take a few seconds. Please wait for a moment...done.
[Huawei]interface gigabitethernet 0/0/1
[Huawei-GigabitEthernet0/0/1]port link-type access
[Huawei-GigabitEthernet0/0/1]port default vlan 10
[Huawei-GigabitEthernet0/0/1]interface gigabitethernet 0/0/2
[Huawei-GigabitEthernet0/0/2]port link-type access
[Huawei-GigabitEthernet0/0/2]port default vlan 20
[Huawei-GigabitEthernet0/0/2]q
[Huawei]interface vlanif 10
[Huawei-Vlanif10]ip address 192.168.10.254 24
[Huawei-Vlanif10]dhcp select interface
[Huawei-Vlanif10]dhcp server dns-list 1.1.1.1
[Huawei-Vlanif10]dhcp server lease day 1
[Huawei-Vlanif10]dhcp server excluded-ip-address 192.168.10.100 192.168.10.253
[Huawei-Vlanif10]q
[Huawei]interface vlanif 20
[Huawei-Vlanif20]ip address 192.168.20.254 24
[Huawei-Vlanif20]dhcp select interface
[Huawei-Vlanif20]dhcp server dns-list 2.2.2.2
[Huawei-Vlanif20]dhcp server lease day 2
[Huawei-Vlanif20]dhcp server excluded-ip-address 192.168.20.100 192.168.20.253
[Huawei-Vlanif20]q
[Huawei]
将PC1、2开启DHCP自动获取地址
先使用ipconfig查看获取到的IP地址,然后两台主机相互ping测试互通了没。
基于全局DHCP配置
开启DHCP
创建VLAN10、20
VLAN分配IP并指定DHCP模式
端口分入相应VLAN
创建地址池10、20
指定各自的网关、dns、租期、需要排除的分配地址(保留地址)
<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]dhcp enable
Info: The operation may take a few seconds. Please wait for a moment.done.
[Huawei]vlan batch 10 20
Info: This operation may take a few seconds. Please wait for a moment...done.
[Huawei]interface vlanif 10
[Huawei-Vlanif10]ip address 192.168.10.254 24
[Huawei-Vlanif10]dhcp select glo
[Huawei-Vlanif10]dhcp select global
[Huawei-Vlanif10]q
[Huawei]interface vlanif 20
[Huawei-Vlanif20]ip address 192.168.20.254 24
[Huawei-Vlanif20]dhcp select global
[Huawei-Vlanif20]q
[Huawei]interface gigabitethernet 0/0/1
[Huawei-GigabitEthernet0/0/1]port link-type access
[Huawei-GigabitEthernet0/0/1]port default vlan 10
[Huawei-GigabitEthernet0/0/1]interface gigabitethernet 0/0/2
[Huawei-GigabitEthernet0/0/2]port link-type access
[Huawei-GigabitEthernet0/0/2]port default vlan 20
[Huawei-GigabitEthernet0/0/2]q
[Huawei]ip pool 10
Info:It's successful to create an IP address pool.
[Huawei-ip-pool-10]network 192.168.10.0 mask 24
[Huawei-ip-pool-10]gateway-list 192.168.10.254
[Huawei-ip-pool-10]dns-list 1.1.1.1
[Huawei-ip-pool-10]lease day 1
[Huawei-ip-pool-10]q
[Huawei]ip pool 20
Info:It's successful to create an IP address pool.
[Huawei-ip-pool-20]network 192.168.20.0 mask 24
[Huawei-ip-pool-20]gateway-list 192.168.20.254
[Huawei-ip-pool-20]dns-list 2.2.2.2
[Huawei-ip-pool-20]lease day 2
[Huawei-ip-pool-20]excluded-ip-address 192.168.20.201 192.168.20.253
[Huawei-ip-pool-20]q
[Huawei]
两台PC开启DHCP,查看IP地址并测试互访
PC1:没有设置保留地址,所以获取到10.253最大地址
PC2:保留了20.10-20.253的地址,所以获取到20.9地址
ACL配置
ACL是由一系列permit或deny语句组成的、有序规则的列表
ACL是一个匹配工具,能够对报文进行匹配和区分。
规则编号可写可不写,不写默认按5增加
特殊的通配符:192.168.1.1 0.0.0.0 = 192.168.1.1 0(0.0.0.0可以直接写成1个0),0.0.0.0 255.255.255.255=any (可以写成any)
ACL分类(主要记基本高级)
分类 | 编号 | 规则 |
基本ACL | 2000-2999 | 使用报文的源IP地址来定义规则 |
高级ACL | 3000-3999 | 可使用IPv4源IP、目的IP地址、IP协议类型、TCP/UDP源端口、TCP/UDP目的端口等信息来定义规则 |
二层ACL | 4000-4999 | 使用报文以太网帧头信息定义规则 |
用户自定义ACL | 5000-5999 | 使用报文头、偏移位置、用户自定义字符串定义规则 |
用户ACL | 6000-6999 | 使用基本ACL+高级ACL的规则来定义 |
基本ACL配置
拓扑图
实现配置:在Router上部署基本ACL后,ACL将试图穿越Router的源地址为192.168.1.0/24网段的数据包过滤掉,并放行其他流量,从而禁止192.168.1.0/24网段的用户访问Router右侧的服务器网络。
[Router] acl 2000
[Router-acl-basic-2000] rule deny source 192.168.1.0 0.0.0.255 //拒绝源为192.168.1网段的
[Router-acl-basic-2000] rule permit source any //其它源都允许
[Router] interface GigabitEthernet 0/0/1 //进入g0/0/1接口
[Router-GigabitEthernet0/0/1] traffic-filter inbound acl 2000 //入方向配置流量过滤
[Router-GigabitEthernet0/0/1] quit
高级ACL配置
服务器:192.168.3.100
销售部:192.168.1.1
开发部:192.168.2.1
模拟互联网:1.1.1.1
要求1:销售部不允许访问服务器
要求2:开发部可以访问服务器
要求3:互联网不可以访问服务器
路由器配置
进入系统视图
更改路由器设备名称router
为各个部门指定网关
<Huawei> system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]
[Huawei]
[Huawei]sysname router
[router]interface gigabitethernet 0/0/0
[router-GigabitEthernet0/0/0]ip address 192.168.1.254 24
[router-GigabitEthernet0/0/0]interface gigabitethernet 0/0/1
[router-GigabitEthernet0/0/1]ip address 192.168.2.254 24
[router-GigabitEthernet0/0/1]interface gigabitethernet 0/0/2
[router-GigabitEthernet0/0/2]ip address 1.1.1.254 24
[router-GigabitEthernet0/0/2]interface ethernet 0/0/0
[router-Ethernet0/0/0]ip address 192.168.3.254 24
[router-Ethernet0/0/0
模拟互联网路由器配置
进入系统视图
进入端口g0/0/0
设置网关
添加一条默认静态路由,让流量可以传给1.1.1.254,这个时候所有设备可以访问互联网。
<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]interface gigabitethernet 0/0/0
[Huawei-GigabitEthernet0/0/0]ip address 1.1.1.1 24
[Huawei-GigabitEthernet0/0/0]q
[Huawei]ip route-static 0.0.0.0 0 1.1.1.254
[Huawei]
ACL配置
创建3条acl规则
1.拒绝销售访问192.168.3.100
2.允许开发访问192.168.3.100
3.拒绝互联网访问192.168.3.100
最后在路由器的e0/0/0 接口上应用alc3000。
<router>
<router>sys
Enter system view, return user view with Ctrl+Z.
[router]acl 3000
[router-acl-adv-3000]rule 1 deny ip source 192.168.1.0 0.0.0.255 destination 192
.168.3.100 0.0.0.0
[router-acl-adv-3000]rule 2 permit ip source 192.168.2.0 0.0.0.255 destination 1
92.168.3.100 0.0.0.0
[router-acl-adv-3000]rule 3 deny ip source any destination 192.168.3.100 0.0.0.0
[router-acl-adv-3000]q
[router]interface ethernet 0/0/0
[router-Ethernet0/0/0]traffic-filter outbound acl 3000
NAT配置
NAT技术产生背景
随着互联网用户增多,IPv4地址越发越短,公有地址严重不足。
nat缓解了IPv4地址短缺的问题,另一方面nat技术让外网无法直接使用私有地址的内网进行通信,提升了内网的安全性。
私有IP地址
公有地址:由专门的机构管理,分配可以再Internet上直接通信的IP地址。
私有地址:组织和个人任意使用,无法直接在internet上通信,只能在内部使用的地址。
A类:10.0.0.0~10.255.255.255
B类:172.16.0.0~172.31.255.255
C类:192.168.0.0~192.168.255.255
静态NAT
每个私有地址映射一个公网地址,实际当中基本用不到,一对一映射过于浪费,就算电脑是关机状态地址还是占用中。
<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]interface gigabitethernet 0/0/1
[Huawei-GigabitEthernet0/0/1]nat static global 1.1.1.1 inside 192.168.1.5
[Huawei-GigabitEthernet0/0/1]nat static global 1.1.1.2 inside 192.168.1.6
[Huawei-GigabitEthernet0/0/1]nat static global 1.1.1.3 inside 192.168.1.7
[Huawei-GigabitEthernet0/0/1]
动态NAT
为了避免地址浪费,动态NAT提出了地址池概念,所有公有地址放入地址池中。比静态NAT灵活些,实际项目中也基本上不用,只是没静态NAT那么浪费,只要人数越多公网IP就用的越多。
<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]nat address-group 2 10.1.1.1 10.1.1.50
[Huawei]acl 2000
[Huawei-acl-basic-2000]rule 5 permit source 192.168.1.0 0.0.0.255
[Huawei-acl-basic-2000]q
[Huawei]interface gigabitethernet 0/0/0
[Huawei-GigabitEthernet0/0/0]nat outbound 2000 address-group 2 no-pat
[Huawei-GigabitEthernet0/0/0]
NAPT
从地址池中选择地址转换时不仅转换IP地址,同时会对端口转换,实现1:n的公网映射,有效提高了使用率。
配置时比动态NAT去掉no-pat就是NAPT,注意NAPT的公网地址是地址池中变化的。
<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]nat address-group 2 10.1.1.1 10.1.1.50
[Huawei]acl 2000
[Huawei-acl-basic-2000]rule 5 permit source 192.168.1.0 0.0.0.255
[Huawei-acl-basic-2000]q
[Huawei]interface gigabitethernet 0/0/0
[Huawei-GigabitEthernet0/0/0]nat outbound 2000 address-group 2
[Huawei-GigabitEthernet0/0/0]
Easy-NAT
实现原理和NAPT一样,区别是没有地址池的概念,使用接口地址作为NAT转换的公有地址。
配置时不用配置地址池
<Huawei>
<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]acl 2000
[Huawei-acl-basic-2000]rule 10 permit source 192.168.1.0 0.0.0.255
[Huawei-acl-basic-2000]q
[Huawei]interface gigabitetherne 0/0/1
[Huawei-GigabitEthernet0/0/1]nat outbound 2000
[Huawei-GigabitEthernet0/0/1]
NAT Server
指定公网+端口私网+端口的一对一映射,将内网服务器映射到公网,当私网服务器需要外网访问时使用。
将私网192.168.3.100地址服务器映射公有地址122.1.2.1 80端口。
<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]interface gigabitethernet 0/0/1
[Huawei-GigabitEthernet0/0/1]ip address 122.1.2.1 24
[Huawei-GigabitEthernet0/0/1]nat server protocol tcp global 122.1.2.1 www inside 192.168.3.100 80
[Huawei-GigabitEthernet0/0/1]
eNSP模拟器练习NAT
拓扑图
给PC1、PC2手动设置IP地址
AR1路由器设置IP地址
<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]interface gigabitethernet 0/0/1
[Huawei-GigabitEthernet0/0/1]ip address 192.168.1.254 24
[Huawei-GigabitEthernet0/0/1]
[Huawei-GigabitEthernet0/0/1]interface gigabitethernet 0/0/0
[Huawei-GigabitEthernet0/0/0]ip address 12.1.1.1 24
[Huawei-GigabitEthernet0/0/0]
[Huawei-GigabitEthernet0/0/0]q
[Huawei]sysname AR1
[AR1]
AR2路由器设置地址
<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]sysname AR2
[AR2]undo info-center enable
Info: Information center is disabled.
[AR2]interface gigabitethernet 0/0/0
[AR2-GigabitEthernet0/0/0]ip address 12.1.1.254 24
[AR2-GigabitEthernet0/0/0]
[AR2-GigabitEthernet0/0/0]
练习1:系统模式下配置静态NAT,注意需要去AR1端口下开启静态nat功能
[AR1]nat static global 12.1.1.2 inside 192.168.1.1
[AR1]interface gigabitethernet 0/0/0
[AR1-GigabitEthernet0/0/0]nat static enable
[AR1-GigabitEthernet0/0/0]
练习2:端口模式下配置静态NAT,不需要单独开启静态NAT
[AR1]
[AR1]interface gigabitethernet 0/0/0
[AR1-GigabitEthernet0/0/0]nat static global 12.1.1.3 inside 192.168.1.2
[AR1-GigabitEthernet0/0/0]
练习3:动态NAT,创建地址池,创建基础acl匹配所有1网段地址,抓包查看各自出去的公网地址一个12.1.1.5,一个12.1.1.8
[AR1]
[AR1]nat address-group 1 12.1.1.2 12.1.1.10
[AR1]acl 2000
[AR1-acl-basic-2000]rule 1 permit source 192.168.1.0 0.0.0.255
[AR1-acl-basic-2000]q
[AR1]interface gigabitethernet 0/0/0
[AR1-GigabitEthernet0/0/0]nat outbound 2000 address-group 1 no-pat
[AR1-GigabitEthernet0/0/0]
练习4:NAPT,配置地址池只有一个公网地址,抓包看下两台PC个字出公网的地址是多少,都是12.1.1.2,NAPT是可以端口转换的1个地址n个伪端口号
[AR1]
[AR1]nat address-group 1 12.1.1.2 12.1.1.2
[AR1]acl 2000
[AR1-acl-basic-2000]rule 2 permit source 192.168.1.0 0.0.0.255
[AR1-acl-basic-2000]q
[AR1]interface gigabitethernet 0/0/0
[AR1-GigabitEthernet0/0/0]nat outbound 2000 address-group 1
[AR1-GigabitEthernet0/0/0]
练习5:EasyNAT,抓包查看他们的公网IP都是AR1 g0/0/0的端口地址12.1.1.1。
[AR1]
[AR1]acl 2000
[AR1-acl-basic-2000]rule 100 permit source 192.168.1.0 0.0.0.255
[AR1-acl-basic-2000]q
[AR1]interface gigabitethernet 0/0/0
[AR1-GigabitEthernet0/0/0]nat outbound 2000
[AR1-GigabitEthernet0/0/0]
练习6:NAT Server,将192.168.1.3 服务器的 映射公网12.1.1.3 80端口
<AR1>sys
Enter system view, return user view with Ctrl+Z.
[AR1]interface gigabitethernet 0/0/0
[AR1-GigabitEthernet0/0/0]nat server protocol tcp global 12.1.1.3 www inside 192.168.1.3 80
[AR1-GigabitEthernet0/0/0]
网关冗余VRRP技术
VRRP原理
通过把几台路由器联合组成一台虚拟的 路由设备 ,保证主机的下一跳路由出现故障时,及时将业务切换到备份路由设备,从而保持通讯的连续性和可靠性。
VRRP路由器:运行VRRP协议的路由器。
VRID:一个VRRP组由多台协同工作的路由器(接口)组成,使用相同的VRID进行标识,属于同一个VRRP组的路由器之间交互VRRP协议报文并产生一台虚拟“路由器”,一个VRRP组只能出现一台master路由器。
VRRP典型应用
通过创建多个虚拟路由器,每个物理路由在不同的VRRP组中扮演不同的角色,不同虚拟路由器的Virtual IP作为不同的内网网关地址可以实现流量转发负载分担。
BFD:出现故障时,以毫秒的速度切换主备设备。
VRRP配置
PC1电脑配置
指定ip192.168.10.1 网关192.18.10.254
LSW1交换机配置
ge0/0/1 access ,vlan10
ge0/0/2 trunk
ge0/0/3 trunk
<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]vlan 10
[Huawei-vlan10]q
[Huawei]interface gigabitethernet 0/0/1
[Huawei-GigabitEthernet0/0/1]port link-type access
[Huawei-GigabitEthernet0/0/1]port default vlan 10
[Huawei-GigabitEthernet0/0/1]q
[Huawei]interface gigabitethernet 0/0/2
[Huawei-GigabitEthernet0/0/2]port link-type trunk
[Huawei-GigabitEthernet0/0/2]port trunk allow-pass vlan all
[Huawei-GigabitEthernet0/0/2]q
[Huawei]interface gigabitethernet 0/0/3
[Huawei-GigabitEthernet0/0/3]port link-type trunk
[Huawei-GigabitEthernet0/0/3]port trunk allow-pass vlan all
[Huawei-GigabitEthernet0/0/3]q
[Huawei]
LSW2交换机配置
基础配置
vlan10:192.168.10.252/24
vlan100:192.168.100.1/30
ge 0/0/1 trunk
ge 0/0/3 trunk
ge 0/0/2 access ,vlan100
<Huawei>
<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]sysname LSW2
[LSW2]vlan batch 10 100
Info: This operation may take a few seconds. Please wait for a moment...done.
[LSW2]interface vlanif 10
[LSW2-Vlanif10]ip address 192.168.10.252 24
[LSW2-Vlanif10]q
[LSW2]interface vlanif 100
[LSW2-Vlanif100]ip address 192.168.100.1 30
[LSW2-Vlanif100]q
[LSW2]interface gigabitethernet 0/0/1
[LSW2-GigabitEthernet0/0/1]port link-type trunk
[LSW2-GigabitEthernet0/0/1]port trunk allow-pass vlan all
[LSW2-GigabitEthernet0/0/1]q
[LSW2]interface gigabitethernet 0/0/3
[LSW2-GigabitEthernet0/0/3]port link-type trunk
[LSW2-GigabitEthernet0/0/3]port trunk allow-pass vlan all
[LSW2-GigabitEthernet0/0/3]q
[LSW2]interface gigabitethernet 0/0/2
[LSW2-GigabitEthernet0/0/2]port link-type access
[LSW2-GigabitEthernet0/0/2]port default vlan 100
[LSW2-GigabitEthernet0/0/2]q
[LSW2]
配置VRRP
VRRP虚拟ip:192.168.10.254
优先级120
抢占时间20s
[LSW2]
[LSW2]interface vlanif 10
[LSW2-Vlanif10]vrrp vrid 10 virtual-ip 192.168.10.254
[LSW2-Vlanif10]vrrp vrid 10 priority 120
[LSW2-Vlanif10]vrrp vri 10 preempt-mode timer delay 20
[LSW2-Vlanif10]
配置路由
现在PC1和3台交换机是通的,但是到不了互联网
[LSW2]ip route-static 0.0.0.0 0 192.168.100.2
[LSW2]
LSW3交换机配置
基础配置
vlan10:192.168.10.253/24
vlan200:192.168.200.1/30
ge0/0/1 trunk
ge0/0/3 trunk
ge0/0/2 access,vlan200
<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]sysname LSW3
[LSW3]vlan batch 10 200
Info: This operation may take a few seconds. Please wait for a moment...done.
[LSW3]interface vlanif 10
[LSW3-Vlanif10]ip address 192.168.10.253 24
[LSW3-Vlanif10]q
[LSW3]interface vlanif 200
[LSW3-Vlanif200]ip address 192.168.200.1 30
[LSW3-Vlanif200]q
[LSW3]interface gigabitethernet 0/0/1
[LSW3-GigabitEthernet0/0/1]port link-type trunk
[LSW3-GigabitEthernet0/0/1]port trunk allow-pass vlan all
[LSW3-GigabitEthernet0/0/1]q
[LSW3]interface gigabitethernet 0/0/3
[LSW3-GigabitEthernet0/0/3]port link-type trunk
[LSW3-GigabitEthernet0/0/3]port trunk allow-pass vlan all
[LSW3-GigabitEthernet0/0/3]q
[LSW3]interface gigabitethernet 0/0/2
[LSW3-GigabitEthernet0/0/2]port link-type access
[LSW3-GigabitEthernet0/0/2]port default vlan 200
[LSW3-GigabitEthernet0/0/2]q
[LSW3]
VRRP配置
VRRP虚拟ip:192.168.10.254
默认优先级100,所有LSW2是主,LSW3是备
[LSW3]
[LSW3]interface vlanif 10
[LSW3-Vlanif10]vrrp vrid 10 virtual-ip 192.168.10.254
[LSW3-Vlanif10]q
[LSW3]
配置默认路由
[LSW3]
[LSW3]ip route-static 0.0.0.0 0 192.168.200.2
[LSW3]
R1路由器配置
基础配置
ge0/0/1:192.168.100.2/30
ge0/0/2:192.168.200.2/30
ge0/0/0:100.1.1.2/30
<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]sysname AR1
[AR1]interface gigabitethernet 0/0/1
[AR1-GigabitEthernet0/0/1]ip address 192.168.100.2 30
[AR1-GigabitEthernet0/0/1]q
[AR1]interface gigabitethernet 0/0/2
[AR1-GigabitEthernet0/0/2]ip address 192.168.200.2 30
[AR1-GigabitEthernet0/0/2]q
[AR1]interface gigabitethernet 0/0/0
[AR1-GigabitEthernet0/0/0]ip address 100.1.1.2 30
[AR1-GigabitEthernet0/0/0]q
[AR1]
路由配置
将10网段指向100.1、200.1
回去有两条路,LSW2路由器出现故障挂掉的还可以走右边。
[AR1]
[AR1]ip route-static 192.168.10.0 24 192.168.100.1
[AR1]ip route-static 192.168.10.0 24 192.168.200.1
[AR1]
R2路由器配置
基础配置
ge0/0/0:100.1.1.1/30
<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]sysname AR2
[AR2]interface gigabitethernet 0/0/0
[AR2-GigabitEthernet0/0/0]ip address 100.1.1.1 30
[AR2-GigabitEthernet0/0/0]q
路由配置
将10网段丢给100.1.1.2,不然10网段请求过来,返回不去
[AR2]ip route-static 192.168.10.0 24 100.1.1.2
[AR2]q
<AR2>
至此全部配置完成,这个拓扑主要练习VRRP和路由走向关系。可以用pc1在ping100.1.1.1时候抓包看默认走的左边还是右边。很明显左边是主默认走左边,当我们把LSW2的VRRP优先级调小(比如90,LSW3的优先级是默认的100),会自动走备路线往右边出去。当左边的LSW2交换机优先级调回来时,需要等待20秒后才会回复成master。
浮动路由和BFD配置
拓扑图
电脑配置
pc1:192.168.10.1/24
pc2:192.168.20.1/24
AR1路由器配置
配置4个接口的地址
ge0/0/0:192.168.10.254/24
ge0/0/1:192.168.20.254/24
ge0/0/2:12.1.1.1/30
ge4/0/0:13.1.1.1/30
<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]sysname AR1
[AR1]interface gigabitethernet 0/0/0
[AR1-GigabitEthernet0/0/0]ip address 192.168.10.254 24
[AR1-GigabitEthernet0/0/0]q
[AR1]interface gigabitethernet 0/0/1
[AR1-GigabitEthernet0/0/1]ip address 192.168.20.254 24
[AR1-GigabitEthernet0/0/1]q
[AR1]interface gigabitethernet 0/0/2
[AR1-GigabitEthernet0/0/2]ip address 12.1.1.1 30
[AR1-GigabitEthernet0/0/2]q
[AR1]interface gigabitethernet 4/0/0
[AR1-GigabitEthernet4/0/0]ip address 13.1.1.1 30
[AR1-GigabitEthernet4/0/0]q
[AR1]
配置出口路由地址
[AR1]acl 2000
[AR1-acl-basic-2000]rule 1 permit source 192.168.10.0 0.0.0.255
[AR1-acl-basic-2000]rule 2 permit source 192.168.20.0 0.0.0.255
[AR1-acl-basic-2000]quit
[AR1]interface gigabitethernet 0/0/2
[AR1-GigabitEthernet0/0/2]nat outbound 2000
[AR1-GigabitEthernet0/0/2]
[AR1-GigabitEthernet0/0/2]quit
[AR1]interfa gigabitethernet 4/0/0
[AR1-GigabitEthernet4/0/0]nat outbound 2000
[AR1-GigabitEthernet4/0/0]qui
[AR1]
配置静态路由
电信,联通两条路都可以走
[AR1]
[AR1]ip route-static 0.0.0.0 0.0.0.0 12.1.1.2
[AR1]ip route-static 0.0.0.0 0.0.0.0 13.1.1.2
[AR1]
这时候优先级都是默认60
但是它走的下面联通路线,我们要求优先走电信上面的路线
给联通的优先级调大一点(90),数字越小越优先
[AR1]
[AR1]ip route-static 0.0.0.0 0.0.0.0 13.1.1.2 preference 90
Info: Succeeded in modifying route.
Apr 11 2023 15:04:53-08:00 AR1 %%01RM/4/IPV4_DEFT_RT_CHG(l)[0]:IPV4 default Rout
e is changed. (ChangeType=Delete, InstanceId=0, Protocol=Static, ExitIf=GigabitE
thernet4/0/0, Nexthop=13.1.1.2, Neighbour=0.0.0.0, Preference=1509949440, Label=
NULL, Metric=0)
[AR1]
这时候默认走上面电信,当上面的线路出现故障才走下面的联通
AR2路由器配置
配置两边端口的ip
ge0/0/0:12.1.1.2/30
ge0/0/1:100.1.1.1/30
<Huawei>
<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]sysname AR2
[AR2]interface gigabitethernet 0/0/0
[AR2-GigabitEthernet0/0/0]ip address 12.1.1.2 30
[AR2-GigabitEthernet0/0/0]quit
[AR2]interface gigabitethernet 0/0/1
[AR2-GigabitEthernet0/0/1]ip address 100.1.1.1 30
[AR2-GigabitEthernet0/0/1]q
[AR2]
OSPF宣告所有网段
[AR2]
[AR2]ospf 1
[AR2-ospf-1]area 0
[AR2-ospf-1-area-0.0.0.0]network 0.0.0.0 0.0.0.0
[AR2-ospf-1-area-0.0.0.0]quit
[AR2-ospf-1]quit
AR3路由器配置
ge0/0/1:13.1.1.2/30
ge0/0/0:200.1.1.1/30
<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]sysname AR3
[AR3]interface gigabitethernet 0/0/1
[AR3-GigabitEthernet0/0/1]ip address 13.1.1.2 30
[AR3-GigabitEthernet0/0/1]quit
[AR3]interface gigabitethernet 0/0/0
[AR3-GigabitEthernet0/0/0]ip address 200.1.1.1 30
[AR3-GigabitEthernet0/0/0]quit
[AR3]
OSPF宣告所有网段
[AR3]
[AR3]ospf 1
[AR3-ospf-1]area 0
[AR3-ospf-1-area-0.0.0.0]network 0.0.0.0 0.0.0.0
[AR3-ospf-1-area-0.0.0.0]quit
[AR3-ospf-1]quit
[AR3]
AR4路由器配置
ge0/0/0:100.1.1.2/30
ge0/0/1:200.1.1.2/30
le0:22.22.22.22/32
<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]sysname AR4
[AR4]interface gigabitethernet 0/0/1
[AR4-GigabitEthernet0/0/1]ip address 100.1.1.2 30
[AR4-GigabitEthernet0/0/1]quit
[AR4]interface gigabitethernet 0/0/0
[AR4-GigabitEthernet0/0/0]ip address 200.1.1.2 30
[AR4-GigabitEthernet0/0/0]quit
[AR4]interface loopback 0
[AR4-LoopBack0]ip address 22.22.22.22 32
[AR4-LoopBack0]quit
[AR4]
OSPF宣告所有网段
[AR4]
[AR4]
[AR4]ospf 1
[AR4-ospf-1]area 0
[AR4-ospf-1-area-0.0.0.0]network 0.0.0.0 0.0.0.0
[AR4-ospf-1-area-0.0.0.0]quit
[AR4-ospf-1]
BFD检测配置
在路由和电信中间新增一台不做配置的交换机
这时候依然优先走上面电信线路
但是如果LSW1这台新增交换机的ge 0/0/2接口或电脑的ge 0/0/0接口出现故障,网络就会瘫痪,除非是LSW1的ge 0/0/2端口出现故障才会自动切换走联通路线。
这时候使用BFD,快速检测设备发送和接收两端的通信故障,可以避免发生此类事件。
AR1路由器BFD配置
[AR1]
[AR1]bfd
[AR1-bfd]bfd 1 bind peer-ip 12.1.1.2 source-ip 12.1.1.1 auto
[AR1-bfd-session-1]commit
[AR1-bfd-session-1]quit
上面这条路由跟踪刚刚设置的BFD,如果BFD不通了,就删掉上面的路由,从而实现上面线路出现故障自动走下面。
[AR1]
[AR1]ip route-static 0.0.0.0 0.0.0.0 12.1.1.2 track bfd-session 1
Info: Succeeded in modifying route.
Apr 11 2023 16:02:23-08:00 AR1 %%01RM/4/IPV4_DEFT_RT_CHG(l)[13]:IPV4 default Rou
te is changed. (ChangeType=Delete, InstanceId=0, Protocol=Static, ExitIf=Gigabit
Ethernet0/0/2, Nexthop=12.1.1.2, Neighbour=0.0.0.0, Preference=1006632960, Label
=NULL, Metric=0)
[AR1]
AR2路由器BFD配置
[AR2]
[AR2]bfd
[AR2-bfd]bfd 1 bind peer-ip 12.1.1.1 source-ip 12.1.1.2 auto
[AR2-bfd-session-1]commit
[AR2-bfd-session-1]quit
[AR2]
评论区