侧边栏壁纸
博主头像
福福不服博主等级

孩子会穿过大雨,去懂人间的道理。

  • 累计撰写 77 篇文章
  • 累计创建 91 个标签
  • 累计收到 0 条评论

目 录CONTENT

文章目录

软考:华为配置基础

Monster
2023-09-04 / 0 评论 / 4 点赞 / 92 阅读 / 30186 字 / 正在检测是否收录...
温馨提示:
请确保在评论和互动中保持礼貌和尊重。避免使用侮辱性、歧视性或攻击性语言。我们鼓励建设性的讨论和意见交流。

基础配置(送分题):system-view 、sysname、interface vlanif 、IP地址

高频配置(一定要会的):VLAN、DHCP、ACL、策略路由、NAT、静态/默认/RIP/OSPF

偏门考点:IPv6、4G、WLAN、IPSEC

下午占分比例50%

华为基础配置命令

<Huawei>:用户视图

[Huawei]:系统视图

[user-interface vty 04] :进入用户接口视图

[interface g0/0/0]:进入接口视图

[acl 2000]:进入ACL视图

[vlan 10]:进入VLAN视图

[ospf 1]:进入路由协议视图

quit:返回上一层视图

DHCP与VLAN配置

我这里用的ensp模拟器,由于海外针对华为问题,开源软件也告华为侵权致华为下架这款软件了,现在好像华为自己出了款ensp模拟器可以去官网文档查询一下

手动配置IP地址

  • 划分VLAN10、20 ,并将端口1放入VLAN10,端口2放入VLAN20,设置网关

  • undo info-center enable:关闭提醒信息(不然一直弹出打断敲命令)

<Huawei>system-view 
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]vlan batch 10 20
Info: This operation may take a few seconds. Please wait for a moment...done.
[Huawei]interface vlanif 10
[Huawei-Vlanif10]ip address 192.168.10.254 24
[Huawei-Vlanif10]interface vlanif 20
[Huawei-Vlanif20]ip address 192.168.20.254 24
[Huawei-Vlanif20]interface gigabitethernet 0/0/1
[Huawei-GigabitEthernet0/0/1]port link-type access
[Huawei-GigabitEthernet0/0/1]port default vlan 10
[Huawei-GigabitEthernet0/0/1]interface gigabitethernet 0/0/2
[Huawei-GigabitEthernet0/0/2]port link-type access
[Huawei-GigabitEthernet0/0/2]port default vlan 20
[Huawei-GigabitEthernet0/0/2]

给PC1手动添加地址,网关指向我们设置的192.168.10.254

给PC2手动添加地址,网关指向我们设置的192.168.20.254

两台主机相互ping一下测试通了没

基于端口DHCP配置

  • 开启DHCP功能

  • 划分VLAN10、20,并将端口g0/0/1、g0/0/2分配相应VLAN

  • 指定VLAN10、20网关

  • 指定基于端口DHCP

  • 指定dns

  • 指定租期

  • 排除分配地址范围(华为分配地址默认从最大地址开始分配,下面10、20网段我们都是排除了100-253的地址,所以因为会获取到10.99/20.99的IP地址)

<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]dhcp enable
Info: The operation may take a few seconds. Please wait for a moment.done.
[Huawei]vlan batch 10 20
Info: This operation may take a few seconds. Please wait for a moment...done.
[Huawei]interface gigabitethernet 0/0/1
[Huawei-GigabitEthernet0/0/1]port link-type access
[Huawei-GigabitEthernet0/0/1]port default vlan 10
[Huawei-GigabitEthernet0/0/1]interface gigabitethernet 0/0/2
[Huawei-GigabitEthernet0/0/2]port link-type access
[Huawei-GigabitEthernet0/0/2]port default vlan 20
[Huawei-GigabitEthernet0/0/2]q
[Huawei]interface vlanif 10
[Huawei-Vlanif10]ip address 192.168.10.254 24
[Huawei-Vlanif10]dhcp select interface
[Huawei-Vlanif10]dhcp server dns-list 1.1.1.1
[Huawei-Vlanif10]dhcp server lease day 1
[Huawei-Vlanif10]dhcp server excluded-ip-address 192.168.10.100 192.168.10.253
[Huawei-Vlanif10]q
[Huawei]interface vlanif 20
[Huawei-Vlanif20]ip address 192.168.20.254 24
[Huawei-Vlanif20]dhcp select interface
[Huawei-Vlanif20]dhcp server dns-list 2.2.2.2
[Huawei-Vlanif20]dhcp server lease day 2
[Huawei-Vlanif20]dhcp server excluded-ip-address 192.168.20.100 192.168.20.253
[Huawei-Vlanif20]q
[Huawei]

将PC1、2开启DHCP自动获取地址

先使用ipconfig查看获取到的IP地址,然后两台主机相互ping测试互通了没。

基于全局DHCP配置

  • 开启DHCP

  • 创建VLAN10、20

  • VLAN分配IP并指定DHCP模式

  • 端口分入相应VLAN

  • 创建地址池10、20

  • 指定各自的网关、dns、租期、需要排除的分配地址(保留地址)

<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]dhcp enable
Info: The operation may take a few seconds. Please wait for a moment.done.
[Huawei]vlan batch 10 20
Info: This operation may take a few seconds. Please wait for a moment...done.
[Huawei]interface vlanif 10
[Huawei-Vlanif10]ip address 192.168.10.254 24
[Huawei-Vlanif10]dhcp select glo	
[Huawei-Vlanif10]dhcp select global 
[Huawei-Vlanif10]q
[Huawei]interface vlanif 20
[Huawei-Vlanif20]ip address 192.168.20.254 24
[Huawei-Vlanif20]dhcp select global
[Huawei-Vlanif20]q
[Huawei]interface gigabitethernet 0/0/1
[Huawei-GigabitEthernet0/0/1]port link-type access
[Huawei-GigabitEthernet0/0/1]port default vlan 10
[Huawei-GigabitEthernet0/0/1]interface gigabitethernet 0/0/2
[Huawei-GigabitEthernet0/0/2]port link-type access
[Huawei-GigabitEthernet0/0/2]port default vlan 20
[Huawei-GigabitEthernet0/0/2]q
[Huawei]ip pool 10
Info:It's successful to create an IP address pool.
[Huawei-ip-pool-10]network 192.168.10.0 mask 24
[Huawei-ip-pool-10]gateway-list 192.168.10.254
[Huawei-ip-pool-10]dns-list 1.1.1.1
[Huawei-ip-pool-10]lease day 1
[Huawei-ip-pool-10]q
[Huawei]ip pool 20
Info:It's successful to create an IP address pool.
[Huawei-ip-pool-20]network 192.168.20.0 mask 24
[Huawei-ip-pool-20]gateway-list 192.168.20.254
[Huawei-ip-pool-20]dns-list 2.2.2.2
[Huawei-ip-pool-20]lease day 2
[Huawei-ip-pool-20]excluded-ip-address 192.168.20.201 192.168.20.253
[Huawei-ip-pool-20]q
[Huawei]

两台PC开启DHCP,查看IP地址并测试互访

PC1:没有设置保留地址,所以获取到10.253最大地址

PC2:保留了20.10-20.253的地址,所以获取到20.9地址

ACL配置

ACL是由一系列permit或deny语句组成的、有序规则的列表

ACL是一个匹配工具,能够对报文进行匹配和区分。

规则编号可写可不写,不写默认按5增加

特殊的通配符:192.168.1.1 0.0.0.0 = 192.168.1.1 0(0.0.0.0可以直接写成1个0),0.0.0.0 255.255.255.255=any (可以写成any)

ACL分类(主要记基本高级)

分类

编号

规则

基本ACL

2000-2999

使用报文的源IP地址来定义规则

高级ACL

3000-3999

可使用IPv4源IP、目的IP地址、IP协议类型、TCP/UDP源端口、TCP/UDP目的端口等信息来定义规则

二层ACL

4000-4999

使用报文以太网帧头信息定义规则

用户自定义ACL

5000-5999

使用报文头、偏移位置、用户自定义字符串定义规则

用户ACL

6000-6999

使用基本ACL+高级ACL的规则来定义

基本ACL配置

拓扑图

实现配置:在Router上部署基本ACL后,ACL将试图穿越Router的源地址为192.168.1.0/24网段的数据包过滤掉,并放行其他流量,从而禁止192.168.1.0/24网段的用户访问Router右侧的服务器网络。

[Router] acl 2000
[Router-acl-basic-2000] rule deny source 192.168.1.0 0.0.0.255     //拒绝源为192.168.1网段的
[Router-acl-basic-2000] rule permit source any                     //其它源都允许
[Router] interface GigabitEthernet 0/0/1                           //进入g0/0/1接口                      
[Router-GigabitEthernet0/0/1] traffic-filter inbound acl 2000      //入方向配置流量过滤
[Router-GigabitEthernet0/0/1] quit

高级ACL配置

  • 服务器:192.168.3.100

  • 销售部:192.168.1.1

  • 开发部:192.168.2.1

  • 模拟互联网:1.1.1.1

  • 要求1:销售部不允许访问服务器

  • 要求2:开发部可以访问服务器

  • 要求3:互联网不可以访问服务器

路由器配置

进入系统视图

更改路由器设备名称router

为各个部门指定网关

<Huawei> system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]
[Huawei]
[Huawei]sysname router
[router]interface gigabitethernet 0/0/0
[router-GigabitEthernet0/0/0]ip address 192.168.1.254 24
[router-GigabitEthernet0/0/0]interface gigabitethernet 0/0/1
[router-GigabitEthernet0/0/1]ip address 192.168.2.254 24
[router-GigabitEthernet0/0/1]interface gigabitethernet 0/0/2
[router-GigabitEthernet0/0/2]ip address 1.1.1.254 24
[router-GigabitEthernet0/0/2]interface ethernet 0/0/0
[router-Ethernet0/0/0]ip address 192.168.3.254 24
[router-Ethernet0/0/0

模拟互联网路由器配置

进入系统视图

进入端口g0/0/0

设置网关

添加一条默认静态路由,让流量可以传给1.1.1.254,这个时候所有设备可以访问互联网。

<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]interface gigabitethernet 0/0/0
[Huawei-GigabitEthernet0/0/0]ip address 1.1.1.1 24
[Huawei-GigabitEthernet0/0/0]q
[Huawei]ip route-static 0.0.0.0 0 1.1.1.254
[Huawei]

ACL配置

创建3条acl规则

1.拒绝销售访问192.168.3.100

2.允许开发访问192.168.3.100

3.拒绝互联网访问192.168.3.100

最后在路由器的e0/0/0 接口上应用alc3000。

<router>
<router>sys
Enter system view, return user view with Ctrl+Z.
[router]acl 3000
[router-acl-adv-3000]rule 1 deny ip source 192.168.1.0 0.0.0.255 destination 192
.168.3.100 0.0.0.0
[router-acl-adv-3000]rule 2 permit ip source 192.168.2.0 0.0.0.255 destination 1
92.168.3.100 0.0.0.0
[router-acl-adv-3000]rule 3 deny ip source any destination 192.168.3.100 0.0.0.0

[router-acl-adv-3000]q
[router]interface ethernet 0/0/0
[router-Ethernet0/0/0]traffic-filter outbound acl 3000

NAT配置

NAT技术产生背景

随着互联网用户增多,IPv4地址越发越短,公有地址严重不足。

nat缓解了IPv4地址短缺的问题,另一方面nat技术让外网无法直接使用私有地址的内网进行通信,提升了内网的安全性。

私有IP地址

公有地址:由专门的机构管理,分配可以再Internet上直接通信的IP地址。

私有地址:组织和个人任意使用,无法直接在internet上通信,只能在内部使用的地址。

  • A类:10.0.0.0~10.255.255.255

  • B类:172.16.0.0~172.31.255.255

  • C类:192.168.0.0~192.168.255.255

静态NAT

每个私有地址映射一个公网地址,实际当中基本用不到,一对一映射过于浪费,就算电脑是关机状态地址还是占用中。

<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]interface gigabitethernet 0/0/1
[Huawei-GigabitEthernet0/0/1]nat static global 1.1.1.1 inside 192.168.1.5
[Huawei-GigabitEthernet0/0/1]nat static global 1.1.1.2 inside 192.168.1.6
[Huawei-GigabitEthernet0/0/1]nat static global 1.1.1.3 inside 192.168.1.7
[Huawei-GigabitEthernet0/0/1]

动态NAT

为了避免地址浪费,动态NAT提出了地址池概念,所有公有地址放入地址池中。比静态NAT灵活些,实际项目中也基本上不用,只是没静态NAT那么浪费,只要人数越多公网IP就用的越多。

<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]nat address-group 2 10.1.1.1 10.1.1.50
[Huawei]acl 2000
[Huawei-acl-basic-2000]rule 5 permit source 192.168.1.0 0.0.0.255
[Huawei-acl-basic-2000]q
[Huawei]interface gigabitethernet 0/0/0
[Huawei-GigabitEthernet0/0/0]nat outbound 2000 address-group 2 no-pat
[Huawei-GigabitEthernet0/0/0]

NAPT

从地址池中选择地址转换时不仅转换IP地址,同时会对端口转换,实现1:n的公网映射,有效提高了使用率。

配置时比动态NAT去掉no-pat就是NAPT,注意NAPT的公网地址是地址池中变化的。

<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]nat address-group 2 10.1.1.1 10.1.1.50
[Huawei]acl 2000
[Huawei-acl-basic-2000]rule 5 permit source 192.168.1.0 0.0.0.255
[Huawei-acl-basic-2000]q
[Huawei]interface gigabitethernet 0/0/0
[Huawei-GigabitEthernet0/0/0]nat outbound 2000 address-group 2
[Huawei-GigabitEthernet0/0/0]

Easy-NAT

实现原理和NAPT一样,区别是没有地址池的概念,使用接口地址作为NAT转换的公有地址。

配置时不用配置地址池

<Huawei>
<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]acl 2000
[Huawei-acl-basic-2000]rule 10 permit source 192.168.1.0 0.0.0.255
[Huawei-acl-basic-2000]q
[Huawei]interface gigabitetherne 0/0/1
[Huawei-GigabitEthernet0/0/1]nat outbound 2000
[Huawei-GigabitEthernet0/0/1]

NAT Server

指定公网+端口私网+端口的一对一映射,将内网服务器映射到公网,当私网服务器需要外网访问时使用。

将私网192.168.3.100地址服务器映射公有地址122.1.2.1 80端口。

<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]interface gigabitethernet 0/0/1 
[Huawei-GigabitEthernet0/0/1]ip address 122.1.2.1 24
[Huawei-GigabitEthernet0/0/1]nat server protocol tcp global 122.1.2.1 www inside 192.168.3.100 80
[Huawei-GigabitEthernet0/0/1]

eNSP模拟器练习NAT

拓扑图

给PC1、PC2手动设置IP地址

AR1路由器设置IP地址

<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]interface gigabitethernet 0/0/1
[Huawei-GigabitEthernet0/0/1]ip address 192.168.1.254 24
[Huawei-GigabitEthernet0/0/1]
[Huawei-GigabitEthernet0/0/1]interface gigabitethernet 0/0/0
[Huawei-GigabitEthernet0/0/0]ip address 12.1.1.1 24
[Huawei-GigabitEthernet0/0/0]
[Huawei-GigabitEthernet0/0/0]q
[Huawei]sysname AR1
[AR1]

AR2路由器设置地址

<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]sysname AR2
[AR2]undo info-center enable
Info: Information center is disabled.
[AR2]interface gigabitethernet 0/0/0
[AR2-GigabitEthernet0/0/0]ip address 12.1.1.254 24
[AR2-GigabitEthernet0/0/0]
[AR2-GigabitEthernet0/0/0]

练习1:系统模式下配置静态NAT,注意需要去AR1端口下开启静态nat功能

[AR1]nat static global 12.1.1.2 inside 192.168.1.1
[AR1]interface gigabitethernet 0/0/0
[AR1-GigabitEthernet0/0/0]nat static enable
[AR1-GigabitEthernet0/0/0]

练习2:端口模式下配置静态NAT,不需要单独开启静态NAT

[AR1]
[AR1]interface gigabitethernet 0/0/0
[AR1-GigabitEthernet0/0/0]nat static global 12.1.1.3 inside 192.168.1.2
[AR1-GigabitEthernet0/0/0]

练习3:动态NAT,创建地址池,创建基础acl匹配所有1网段地址,抓包查看各自出去的公网地址一个12.1.1.5,一个12.1.1.8

[AR1]
[AR1]nat address-group 1 12.1.1.2 12.1.1.10
[AR1]acl 2000
[AR1-acl-basic-2000]rule 1 permit source 192.168.1.0 0.0.0.255
[AR1-acl-basic-2000]q
[AR1]interface gigabitethernet 0/0/0
[AR1-GigabitEthernet0/0/0]nat outbound 2000 address-group 1 no-pat
[AR1-GigabitEthernet0/0/0]

练习4:NAPT,配置地址池只有一个公网地址,抓包看下两台PC个字出公网的地址是多少,都是12.1.1.2,NAPT是可以端口转换的1个地址n个伪端口号

[AR1]
[AR1]nat address-group 1 12.1.1.2 12.1.1.2
[AR1]acl 2000
[AR1-acl-basic-2000]rule 2 permit source 192.168.1.0 0.0.0.255
[AR1-acl-basic-2000]q
[AR1]interface gigabitethernet 0/0/0
[AR1-GigabitEthernet0/0/0]nat outbound 2000 address-group 1
[AR1-GigabitEthernet0/0/0]

练习5:EasyNAT,抓包查看他们的公网IP都是AR1 g0/0/0的端口地址12.1.1.1。

[AR1]
[AR1]acl 2000
[AR1-acl-basic-2000]rule 100 permit source 192.168.1.0 0.0.0.255
[AR1-acl-basic-2000]q
[AR1]interface gigabitethernet 0/0/0
[AR1-GigabitEthernet0/0/0]nat outbound 2000
[AR1-GigabitEthernet0/0/0]

练习6:NAT Server,将192.168.1.3 服务器的 映射公网12.1.1.3 80端口

<AR1>sys
Enter system view, return user view with Ctrl+Z.
[AR1]interface gigabitethernet 0/0/0
[AR1-GigabitEthernet0/0/0]nat server protocol tcp global 12.1.1.3 www inside 192.168.1.3 80
[AR1-GigabitEthernet0/0/0]

网关冗余VRRP技术

VRRP原理

通过把几台路由器联合组成一台虚拟的 路由设备 ,保证主机的下一跳路由出现故障时,及时将业务切换到备份路由设备,从而保持通讯的连续性和可靠性。

VRRP路由器:运行VRRP协议的路由器

VRID:一个VRRP组由多台协同工作的路由器(接口)组成,使用相同的VRID进行标识,属于同一个VRRP组的路由器之间交互VRRP协议报文并产生一台虚拟“路由器”,一个VRRP组只能出现一台master路由器

VRRP典型应用

通过创建多个虚拟路由器,每个物理路由在不同的VRRP组中扮演不同的角色,不同虚拟路由器的Virtual IP作为不同的内网网关地址可以实现流量转发负载分担。

BFD:出现故障时,以毫秒的速度切换主备设备。

VRRP配置

PC1电脑配置

指定ip192.168.10.1 网关192.18.10.254

LSW1交换机配置

ge0/0/1 access ,vlan10
ge0/0/2 trunk
ge0/0/3 trunk

<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]vlan 10
[Huawei-vlan10]q
[Huawei]interface gigabitethernet 0/0/1
[Huawei-GigabitEthernet0/0/1]port link-type access
[Huawei-GigabitEthernet0/0/1]port default vlan 10
[Huawei-GigabitEthernet0/0/1]q
[Huawei]interface gigabitethernet 0/0/2
[Huawei-GigabitEthernet0/0/2]port link-type trunk
[Huawei-GigabitEthernet0/0/2]port trunk allow-pass vlan all
[Huawei-GigabitEthernet0/0/2]q
[Huawei]interface gigabitethernet 0/0/3
[Huawei-GigabitEthernet0/0/3]port link-type trunk
[Huawei-GigabitEthernet0/0/3]port trunk allow-pass vlan all
[Huawei-GigabitEthernet0/0/3]q
[Huawei]

LSW2交换机配置

基础配置
vlan10:192.168.10.252/24
vlan100:192.168.100.1/30
ge 0/0/1 trunk
ge 0/0/3 trunk
ge 0/0/2 access ,vlan100

<Huawei>
<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]sysname LSW2
[LSW2]vlan batch 10 100
Info: This operation may take a few seconds. Please wait for a moment...done.
[LSW2]interface vlanif 10
[LSW2-Vlanif10]ip address 192.168.10.252 24
[LSW2-Vlanif10]q
[LSW2]interface vlanif 100
[LSW2-Vlanif100]ip address 192.168.100.1 30
[LSW2-Vlanif100]q
[LSW2]interface gigabitethernet 0/0/1
[LSW2-GigabitEthernet0/0/1]port link-type trunk
[LSW2-GigabitEthernet0/0/1]port trunk allow-pass vlan all
[LSW2-GigabitEthernet0/0/1]q
[LSW2]interface gigabitethernet 0/0/3
[LSW2-GigabitEthernet0/0/3]port link-type trunk
[LSW2-GigabitEthernet0/0/3]port trunk allow-pass vlan all
[LSW2-GigabitEthernet0/0/3]q
[LSW2]interface gigabitethernet 0/0/2
[LSW2-GigabitEthernet0/0/2]port link-type access
[LSW2-GigabitEthernet0/0/2]port default vlan 100
[LSW2-GigabitEthernet0/0/2]q
[LSW2]

配置VRRP
VRRP虚拟ip:192.168.10.254
优先级120
抢占时间20s

[LSW2]
[LSW2]interface vlanif 10
[LSW2-Vlanif10]vrrp vrid 10 virtual-ip 192.168.10.254
[LSW2-Vlanif10]vrrp vrid 10 priority 120
[LSW2-Vlanif10]vrrp vri 10 preempt-mode timer delay 20
[LSW2-Vlanif10]

配置路由
现在PC1和3台交换机是通的,但是到不了互联网

[LSW2]ip route-static 0.0.0.0 0 192.168.100.2
[LSW2]

LSW3交换机配置

基础配置
vlan10:192.168.10.253/24
vlan200:192.168.200.1/30
ge0/0/1 trunk
ge0/0/3 trunk
ge0/0/2 access,vlan200

<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]sysname LSW3
[LSW3]vlan batch 10 200
Info: This operation may take a few seconds. Please wait for a moment...done.
[LSW3]interface vlanif 10
[LSW3-Vlanif10]ip address 192.168.10.253 24
[LSW3-Vlanif10]q
[LSW3]interface vlanif 200
[LSW3-Vlanif200]ip address 192.168.200.1 30
[LSW3-Vlanif200]q
[LSW3]interface gigabitethernet 0/0/1
[LSW3-GigabitEthernet0/0/1]port link-type trunk
[LSW3-GigabitEthernet0/0/1]port trunk allow-pass vlan all
[LSW3-GigabitEthernet0/0/1]q
[LSW3]interface gigabitethernet 0/0/3
[LSW3-GigabitEthernet0/0/3]port link-type trunk
[LSW3-GigabitEthernet0/0/3]port trunk allow-pass vlan all
[LSW3-GigabitEthernet0/0/3]q
[LSW3]interface gigabitethernet 0/0/2
[LSW3-GigabitEthernet0/0/2]port link-type access
[LSW3-GigabitEthernet0/0/2]port default vlan 200
[LSW3-GigabitEthernet0/0/2]q
[LSW3]

VRRP配置
VRRP虚拟ip:192.168.10.254
默认优先级100,所有LSW2是主,LSW3是备

[LSW3]
[LSW3]interface vlanif 10
[LSW3-Vlanif10]vrrp vrid 10 virtual-ip 192.168.10.254
[LSW3-Vlanif10]q
[LSW3]

配置默认路由

[LSW3]
[LSW3]ip route-static 0.0.0.0 0 192.168.200.2
[LSW3]

R1路由器配置

基础配置
ge0/0/1:192.168.100.2/30
ge0/0/2:192.168.200.2/30
ge0/0/0:100.1.1.2/30

<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]sysname AR1
[AR1]interface gigabitethernet 0/0/1
[AR1-GigabitEthernet0/0/1]ip address 192.168.100.2 30
[AR1-GigabitEthernet0/0/1]q
[AR1]interface gigabitethernet 0/0/2
[AR1-GigabitEthernet0/0/2]ip address 192.168.200.2 30
[AR1-GigabitEthernet0/0/2]q
[AR1]interface gigabitethernet 0/0/0
[AR1-GigabitEthernet0/0/0]ip address 100.1.1.2 30
[AR1-GigabitEthernet0/0/0]q
[AR1]

路由配置
将10网段指向100.1、200.1
回去有两条路,LSW2路由器出现故障挂掉的还可以走右边。

[AR1]
[AR1]ip route-static 192.168.10.0 24 192.168.100.1
[AR1]ip route-static 192.168.10.0 24 192.168.200.1
[AR1]

R2路由器配置

基础配置
ge0/0/0:100.1.1.1/30

<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]sysname AR2
[AR2]interface gigabitethernet 0/0/0
[AR2-GigabitEthernet0/0/0]ip address 100.1.1.1 30
[AR2-GigabitEthernet0/0/0]q

路由配置
将10网段丢给100.1.1.2,不然10网段请求过来,返回不去

[AR2]ip route-static 192.168.10.0 24 100.1.1.2
[AR2]q
<AR2>

至此全部配置完成,这个拓扑主要练习VRRP和路由走向关系。可以用pc1在ping100.1.1.1时候抓包看默认走的左边还是右边。很明显左边是主默认走左边,当我们把LSW2的VRRP优先级调小(比如90,LSW3的优先级是默认的100),会自动走备路线往右边出去。当左边的LSW2交换机优先级调回来时,需要等待20秒后才会回复成master。


浮动路由和BFD配置 

拓扑图

电脑配置

pc1:192.168.10.1/24
pc2:192.168.20.1/24

AR1路由器配置

配置4个接口的地址
ge0/0/0:192.168.10.254/24
ge0/0/1:192.168.20.254/24
ge0/0/2:12.1.1.1/30
ge4/0/0:13.1.1.1/30

<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]sysname AR1
[AR1]interface gigabitethernet 0/0/0
[AR1-GigabitEthernet0/0/0]ip address 192.168.10.254 24
[AR1-GigabitEthernet0/0/0]q
[AR1]interface gigabitethernet 0/0/1
[AR1-GigabitEthernet0/0/1]ip address 192.168.20.254 24
[AR1-GigabitEthernet0/0/1]q
[AR1]interface gigabitethernet 0/0/2
[AR1-GigabitEthernet0/0/2]ip address 12.1.1.1 30
[AR1-GigabitEthernet0/0/2]q
[AR1]interface gigabitethernet 4/0/0
[AR1-GigabitEthernet4/0/0]ip address 13.1.1.1 30
[AR1-GigabitEthernet4/0/0]q
[AR1]

配置出口路由地址

[AR1]acl 2000
[AR1-acl-basic-2000]rule 1 permit source 192.168.10.0 0.0.0.255
[AR1-acl-basic-2000]rule 2 permit source 192.168.20.0 0.0.0.255
[AR1-acl-basic-2000]quit
[AR1]interface gigabitethernet 0/0/2
[AR1-GigabitEthernet0/0/2]nat outbound 2000
[AR1-GigabitEthernet0/0/2]
[AR1-GigabitEthernet0/0/2]quit
[AR1]interfa gigabitethernet 4/0/0
[AR1-GigabitEthernet4/0/0]nat outbound 2000
[AR1-GigabitEthernet4/0/0]qui
[AR1]

配置静态路由
电信,联通两条路都可以走

[AR1]
[AR1]ip route-static 0.0.0.0 0.0.0.0 12.1.1.2
[AR1]ip route-static 0.0.0.0 0.0.0.0 13.1.1.2
[AR1]

这时候优先级都是默认60
但是它走的下面联通路线,我们要求优先走电信上面的路线
给联通的优先级调大一点(90),数字越小越优先

[AR1]
[AR1]ip route-static 0.0.0.0 0.0.0.0 13.1.1.2 preference 90
Info: Succeeded in modifying route.
Apr 11 2023 15:04:53-08:00 AR1 %%01RM/4/IPV4_DEFT_RT_CHG(l)[0]:IPV4 default Rout
e is changed. (ChangeType=Delete, InstanceId=0, Protocol=Static, ExitIf=GigabitE
thernet4/0/0, Nexthop=13.1.1.2, Neighbour=0.0.0.0, Preference=1509949440, Label=
NULL, Metric=0) 
[AR1]

这时候默认走上面电信,当上面的线路出现故障才走下面的联通

AR2路由器配置

配置两边端口的ip
ge0/0/0:12.1.1.2/30
ge0/0/1:100.1.1.1/30

<Huawei>
<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]sysname AR2
[AR2]interface gigabitethernet 0/0/0
[AR2-GigabitEthernet0/0/0]ip address 12.1.1.2 30
[AR2-GigabitEthernet0/0/0]quit
[AR2]interface gigabitethernet 0/0/1
[AR2-GigabitEthernet0/0/1]ip address 100.1.1.1 30
[AR2-GigabitEthernet0/0/1]q
[AR2]

OSPF宣告所有网段

[AR2]
[AR2]ospf 1
[AR2-ospf-1]area 0
[AR2-ospf-1-area-0.0.0.0]network 0.0.0.0 0.0.0.0
[AR2-ospf-1-area-0.0.0.0]quit
[AR2-ospf-1]quit

AR3路由器配置

ge0/0/1:13.1.1.2/30
ge0/0/0:200.1.1.1/30

<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]sysname AR3
[AR3]interface gigabitethernet 0/0/1
[AR3-GigabitEthernet0/0/1]ip address 13.1.1.2 30
[AR3-GigabitEthernet0/0/1]quit
[AR3]interface gigabitethernet 0/0/0
[AR3-GigabitEthernet0/0/0]ip address 200.1.1.1 30
[AR3-GigabitEthernet0/0/0]quit
[AR3]

OSPF宣告所有网段

[AR3]
[AR3]ospf 1
[AR3-ospf-1]area 0
[AR3-ospf-1-area-0.0.0.0]network 0.0.0.0 0.0.0.0
[AR3-ospf-1-area-0.0.0.0]quit
[AR3-ospf-1]quit
[AR3]

AR4路由器配置

ge0/0/0:100.1.1.2/30
ge0/0/1:200.1.1.2/30
le0:22.22.22.22/32

<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]sysname AR4
[AR4]interface gigabitethernet 0/0/1
[AR4-GigabitEthernet0/0/1]ip address 100.1.1.2 30
[AR4-GigabitEthernet0/0/1]quit
[AR4]interface gigabitethernet 0/0/0
[AR4-GigabitEthernet0/0/0]ip address 200.1.1.2 30
[AR4-GigabitEthernet0/0/0]quit
[AR4]interface loopback 0
[AR4-LoopBack0]ip address 22.22.22.22 32
[AR4-LoopBack0]quit
[AR4]

OSPF宣告所有网段

[AR4]
[AR4]
[AR4]ospf 1
[AR4-ospf-1]area 0
[AR4-ospf-1-area-0.0.0.0]network 0.0.0.0 0.0.0.0 
[AR4-ospf-1-area-0.0.0.0]quit
[AR4-ospf-1]

BFD检测配置

在路由和电信中间新增一台不做配置的交换机

这时候依然优先走上面电信线路

但是如果LSW1这台新增交换机的ge 0/0/2接口或电脑的ge 0/0/0接口出现故障,网络就会瘫痪,除非是LSW1的ge 0/0/2端口出现故障才会自动切换走联通路线。

这时候使用BFD,快速检测设备发送和接收两端的通信故障,可以避免发生此类事件。

AR1路由器BFD配置

[AR1]
[AR1]bfd
[AR1-bfd]bfd 1 bind peer-ip 12.1.1.2 source-ip 12.1.1.1 auto
[AR1-bfd-session-1]commit
[AR1-bfd-session-1]quit

上面这条路由跟踪刚刚设置的BFD,如果BFD不通了,就删掉上面的路由,从而实现上面线路出现故障自动走下面。

[AR1]
[AR1]ip route-static 0.0.0.0 0.0.0.0 12.1.1.2 track bfd-session 1
Info: Succeeded in modifying route.
Apr 11 2023 16:02:23-08:00 AR1 %%01RM/4/IPV4_DEFT_RT_CHG(l)[13]:IPV4 default Rou
te is changed. (ChangeType=Delete, InstanceId=0, Protocol=Static, ExitIf=Gigabit
Ethernet0/0/2, Nexthop=12.1.1.2, Neighbour=0.0.0.0, Preference=1006632960, Label
=NULL, Metric=0) 
[AR1]

AR2路由器BFD配置

[AR2]
[AR2]bfd
[AR2-bfd]bfd 1 bind peer-ip 12.1.1.1 source-ip 12.1.1.2 auto
[AR2-bfd-session-1]commit
[AR2-bfd-session-1]quit
[AR2]
4
  1. 支付宝打赏

    qrcode alipay
  2. 微信打赏

    qrcode weixin
  3. QQ打赏

    qrcode qq

评论区