策略路由pbr+mstp +vrrp +双线nat

策略路由pbr+mstp +vrrp +双线nat

拓扑

使用技术

使用到的技术：
	单区域ospf 
  dhcp
  nat

  mstp
  vrrp+track

	端口聚合
  nqa+pbr 策略路由
  
  
  

接入层

jieruA

sys
sysname jieruA

# 创建vlan
vlan batch 10 20 30 40

# 端口分配
int e0/0/1
port link-type access 
port default vlan 10

int e0/0/2
port link-type access 
port default vlan 20

int e0/0/3
port link-type trunk 
port trunk allow-pass vlan all 

int e0/0/4
port link-type trunk 
port trunk allow-pass vlan all 

# mstp 
stp region-configuration 
region-name wlgc
instance 1 vlan 10 30
instance 2 vlan 20 40 
active region-configuration

jieruB

sys
sysname jieruB

# 创建vlan
vlan batch 10 20 30 40

# 端口分配
int e0/0/1
port link-type access 
port default vlan 30

int e0/0/2
port link-type access 
port default vlan 40

int e0/0/3
port link-type trunk 
port trunk allow-pass vlan all 

int e0/0/4
port link-type trunk 
port trunk allow-pass vlan all 

# mstp 
stp region-configuration 
region-name wlgc
instance 1 vlan 10 30
instance 2 vlan 20 40 
active region-configuration

核心层

coreA

sys
sysname coreA

# 创建vlan
vlan batch 10 20 30 40 50

# 端口分配
int g0/0/2
port link-type access 
port default vlan 50

int g0/0/3
port link-type trunk 
port trunk allow-pass vlan all 

int g0/0/4
port link-type trunk 
port trunk allow-pass vlan all 

# 链路聚合
int Eth-Trunk 1
port link-type trunk 
port trunk allow-pass vlan 10 20 30 40
# 加入
int g0/0/23 
eth-trunk 1

int g0/0/24
eth-trunk 1

# mstp 
stp region-configuration 
region-name wlgc
instance 1 vlan 10 30
instance 2 vlan 20 40 
active region-configuration 

quit
# mstp 根桥指定
stp instance 1 root primary 
stp instance 2 root secondary 

# vrrp配置
int vlan 10
ip address 192.168.10.252 24
vrrp vrid 10 virtual-ip 192.168.10.254
vrrp vrid 10 priority 110
# 配置上联接口检测，直连接口(配置的是本机的端口)检测不通时，降级
vrrp vrid 10 track interface g0/0/2 reduced 50

int vlan 20
ip address 192.168.20.252 24
vrrp vrid 20 virtual-ip 192.168.20.254
# 配置上联接口检测，直连接口(配置的是本机的端口)检测不通时，降级
vrrp vrid 20 track interface g0/0/2 reduced 50

int vlan 30
ip address 192.168.30.252 24
vrrp vrid 30 virtual-ip 192.168.30.254
vrrp vrid 30 priority 110
# 配置上联接口检测，直连接口(配置的是本机的端口)检测不通时，降级
vrrp vrid 30 track interface g0/0/2 reduced 50

int vlan 40
ip address 192.168.40.252 24
vrrp vrid 40 virtual-ip 192.168.40.254
# 配置上联接口检测，直连接口(配置的是本机的端口)检测不通时，降级
vrrp vrid 40 track interface g0/0/2 reduced 50

## 这里配置完，建议display ip int brief
## 顺带验证vlan pc间是否能够通信

# 上联接口vlan
int vlan 50
ip address 192.168.252.1 24

# 配置ospf
ospf 100 router-id 1.1.1.1
area 0 
network 0.0.0.0 255.255.255.255


# dhcp，两台核心上都要配置
dhcp enable

ip pool dhcp10
dns-list 8.8.8.8
gateway-list 192.168.10.254
# 对应网段
network 192.168.10.0 mask 24 

# 应用
int vlan 10
dhcp select global 

ip pool dhcp20
dns-list 8.8.8.8
gateway-list 192.168.20.254
# 对应网段
network 192.168.20.0 mask 24 

# 应用
int vlan 20
dhcp select global 

coreB

sys
sysname coreB 

# 创建vlan
vlan batch 10 20 30 40 60

# 端口分配
int g0/0/1
port link-type access 
port default vlan 60

int g0/0/3
port link-type trunk 
port trunk allow-pass vlan all 

int g0/0/4
port link-type trunk 
port trunk allow-pass vlan all 

# 链路聚合
int Eth-Trunk 1
port link-type trunk 
port trunk allow-pass vlan 10 20 30 40

# 加入
int g0/0/23 
eth-trunk 1

int g0/0/24
eth-trunk 1

# mstp 
stp region-configuration 
region-name wlgc
instance 1 vlan 10 30
instance 2 vlan 20 40 
active region-configuration 

quit
# mstp 根桥指定
stp instance 2 root primary 
stp instance 1 root secondary 

# vrrp 配置
int vlan 10
ip address 192.168.10.253 24
vrrp vrid 10 virtual-ip 192.168.10.254 
# 配置上联接口检测，直连接口(配置的是本机的端口)检测不通时，降级
vrrp vrid 10 track interface g0/0/1 reduced 50

int vlan 20
ip address 192.168.20.253 24
vrrp vrid 20 virtual-ip 192.168.20.254
vrrp vrid 20 priority 110
# 配置上联接口检测，直连接口(配置的是本机的端口)检测不通时，降级
vrrp vrid 20 track interface g0/0/1 reduced 50

int vlan 30
ip address 192.168.30.253 24
vrrp vrid 30 virtual-ip 192.168.30.254
# 配置上联接口检测，直连接口(配置的是本机的端口)检测不通时，降级
vrrp vrid 30 track interface g0/0/1 reduced 50

int vlan 40
ip address 192.168.40.253 24
vrrp vrid 40 virtual-ip 192.168.40.254
vrrp vrid 40 priority 110
# 配置上联接口检测，直连接口(配置的是本机的端口)检测不通时，降级
vrrp vrid 40 track interface g0/0/1 reduced 50

## 这里配置完，建议display ip int brief，验证vlan ip
## 顺带验证vlan pc间是否能够通信

# 上联接口vlan
int vlan 60
ip address 192.168.253.1 24

# 配置ospf
ospf 100 router-id 2.2.2.2
area 0 
network 0.0.0.0 255.255.255.255


# dhcp，两台核心上都要配置
dhcp enable

ip pool dhcp10
dns-list 8.8.8.8
gateway-list 192.168.10.254
# 对应网段
network 192.168.10.0 mask 24 

# 应用
int vlan 10
dhcp select global 

ip pool dhcp20
dns-list 8.8.8.8
gateway-list 192.168.20.254
# 对应网段
network 192.168.20.0 mask 24 

# 应用
int vlan 20
dhcp select global 

出口

ARA

sys
sysname ARA

int g0/0/2
ip address 192.168.252.2 24

int g0/0/1
ip address 23.1.1.1 24

int g0/0/0
ip address 120.36.2.1 24

# 默认路由
ip route-static 0.0.0.0 0.0.0.0 120.36.2.2

# ospf 
ospf 100 router-id 3.3.3.3
# 默认路由重分布
default-route-advertise
area 0 
network 192.168.0.0 0.0.255.255
network 23.1.1.0 0.0.0.255

# nat ，配置nat后，可以测试pc和远端设备通信情况
acl 3000
rule 5 permit ip source 192.168.0.0 0.0.255.255
int g0/0/0
nat outbound 3000


# pbr 配置，两个路由上都要，在netx-hop、nqa配置中目的地址略有不同
acl 3100
rule 5 permit ip source 192.168.10.0 0.0.0.255

policy-based-route pbr permit node 5
if-match acl 3100
apply ip-address next-hop 120.36.2.2


acl 3200
rule 5 permit ip source 192.168.20.0 0.0.0.255

policy-based-route pbr permit node 10
if-match acl 3200
apply ip-address next-hop 23.1.1.2 

ARB

sys
sysname ARB

int g0/0/2
ip address 59.56.101.1 24

int g1/0/0
ip address 23.1.1.2 24

int g0/0/1
ip address 192.168.253.2 24

# 默认路由
ip route-static 0.0.0.0 0.0.0.0 59.56.101.2

# ospf 
ospf 100 router-id 3.3.3.3
# 默认路由重分布
default-route-advertise
area 0 
network 192.168.0.0 0.0.255.255
network 23.1.1.0 0.0.0.255

# nat ，配置nat后，可以测试pc和远端设备通信情况
acl 3000
rule 5 permit ip source 192.168.0.0 0.0.255.255
int g0/0/2
nat outbound 3000



# pbr 配置，两个路由上都要，在netx-hop略有不同
acl 3100
rule 5 permit ip source 192.168.10.0 0.0.0.255

policy-based-route pbr permit node 5
if-match acl 3100
apply ip-address next-hop 23.1.1.1


acl 3200
rule 5 permit ip source 192.168.20.0 0.0.0.255

policy-based-route pbr permit node 10
if-match acl 3200
apply ip-address next-hop 59.56.101.2

外网ISP

sys
sysname ISP

int g1/0/0
ip address 120.36.2.2 24

int g0/0/0
ip address 59.56.101.2 24

int g0/0/1
ip address 8.8.8.254 24

效果图

接入层

jieruA

出现问题

vrrp 主备异常

1.首先查看核心交换机之间是否能够互相通信
2.查看优先级，是否因为track降级后，主备发生切换
3.检查配置命令，是否配置错了上联接口

PC和vrrp或核心交换机ping不通

检查pc 通过dhcp分配到的IP，是否和其他有冲突