HCIP实验-OSPF综合

实验拓扑图；

实验要求：

1.如图连接，合理规划IP地址，所有路由器各自创建一个loopback接口

2.R1再创建三个接口IP地址为201.1.1.1/24、201.1.2.1/24、201.1.3.1/24

R5再创建三个接口IP地址为202.1.1.1/24、202.1.2.1/24、202.1.3.1/24

R7再创建三个接口IP地址为203.1.1.1/24、203.1.2.1/24、203.1.3.1/24

3.如图运行路由协议

3.1 R1 -R2 -R3之间使用MGRE网络，为hub-spoke 网络结构，R1为hub端 ，

部署OSPF网络,MGRE修改为BMA网络类型

3.2 R2-R4之间启用PPP pap 单项认证 ， R3-R4之间启用PPP的chap双向认证

4.area 1 区域不得出现4.5类LSA

5.其他区域优先通过R3访问R1 三个环回接口

6.尽量减少路由条目数量

7.area 1 区域增加安全性

8.全网可达

实验过程：

1.IP地址规划

如图所示：

2.基础配置并完成公网全通

R1:

[Huawei]int l0

[Huawei-LoopBack0]ip add 201.1.1.1 24

[Huawei-LoopBack0]int l1

[Huawei-LoopBack1]ip add 201.1.2.1 24

[Huawei-LoopBack1]int l2

[Huawei-LoopBack2]ip add 201.1.3.1 24

[Huawei-LoopBack2]int g0/0/0

[Huawei-GigabitEthernet0/0/0]ip add 18.1.1.1 24

[Huawei]ip route-static 0.0.0.0 0 18.1.1.2

R2:

[Huawei]int l0

[Huawei-LoopBack0]ip add 204.1.0.1 24

[Huawei-LoopBack0]q

[Huawei]int g0/0/0

[Huawei-GigabitEthernet0/0/0]ip add 28.1.1.1 24

[Huawei-GigabitEthernet0/0/0]int s4/0/0

[Huawei-Serial4/0/0]ip add 204.1.2.1 30

[Huawei]ip route-static 0.0.0.0 0 28.1.1.2

R3:

[Huawei]int l0

[Huawei-LoopBack0]ip add 204.1.1.1 24

[Huawei-LoopBack0]int g0/0/0

[Huawei-GigabitEthernet0/0/0]ip add 38.1.1.1 24

[Huawei-GigabitEthernet0/0/0]int s4/0/0

[Huawei-Serial4/0/0]ip add 204.1.3.1 30

[Huawei-Serial4/0/0]q

[Huawei]ip route-static 0.0.0.0 0 38.1.1.2

R4:

[Huawei]int l0

[Huawei-LoopBack0]ip add 200.1.0.1 24

[Huawei-LoopBack0]int s4/0/0

[Huawei-Serial4/0/0]ip add 204.1.2.2 30

[Huawei-Serial4/0/0]int s4/0/1

[Huawei-Serial4/0/1]ip add 204.1.3.2 30

[Huawei-Serial4/0/1]int g0/0/0

[Huawei-GigabitEthernet0/0/0]ip add 202.1.0.1 30

[Huawei-GigabitEthernet0/0/0]int g0/0/1

[Huawei-GigabitEthernet0/0/1]ip add 200.1.1.1 30

R5:

[Huawei]int l0

[Huawei-LoopBack0]ip add 202.1.1.1 24

[Huawei-LoopBack0]int l1

[Huawei-LoopBack1]ip add 202.1.2.1 24

[Huawei-LoopBack1]int l2

[Huawei-LoopBack2]ip add 202.1.3.1 24

[Huawei-LoopBack2]int g0/0/0

[Huawei-GigabitEthernet0/0/0]ip add 202.1.0.2 30

R6:

[Huawei]int l0

[Huawei-LoopBack0]ip add 200.1.2.1 24

[Huawei-LoopBack0]int g0/0/0

[Huawei-GigabitEthernet0/0/0]ip add 200.1.1.2 30

[Huawei-GigabitEthernet0/0/0]int g0/0/1

[Huawei-GigabitEthernet0/0/1]ip add 203.1.0.1 30te.

R7:

[Huawei]int l0

[Huawei-LoopBack0]ip add 203.1.1.1  24

[Huawei-LoopBack0]int l1

[Huawei-LoopBack1]ip add 203.1.2.1 24

[Huawei-LoopBack1]int l2

[Huawei-LoopBack2]ip add 203.1.3.1 24

[Huawei-LoopBack2]int g0/0/0

[Huawei-GigabitEthernet0/0/0]ip add 203.1.0.2 30

R8:

[Huawei]int l0

[Huawei-LoopBack0]ip add 8.8.8.8 24

[Huawei-LoopBack0]int g0/0/0

[Huawei-GigabitEthernet0/0/0]ip add 18.1.1.2 24

[Huawei-GigabitEthernet0/0/0]int g0/0/1

[Huawei-GigabitEthernet0/0/1]ip add 28.1.1.2 24

[Huawei-GigabitEthernet0/0/1]int g0/0/2

[Huawei-GigabitEthernet0/0/2]ip add 38.1.1.2 24

此时公网全通，如图：

3.做MGRE并按照实验要求做R2-R4之间启用PPP pap 单项认证，R3-R4之间启用PPP的chap双向认证

MGRE:

R1:

[Huawei]int Tunnel 0/0/0

[Huawei-Tunnel0/0/0]ip add 201.1.0.1 29

[Huawei-Tunnel0/0/0]tunnel-protocol gre p2mp

[Huawei-Tunnel0/0/0]source 18.1.1.1

[Huawei-Tunnel0/0/0]nhrp entry multicast dynamic

R2:

[Huawei]int Tunnel 0/0/0

[Huawei-Tunnel0/0/0]ip add 201.1.0.2 29

[Huawei-Tunnel0/0/0]tunnel-protocol gre p2mp

[Huawei-Tunnel0/0/0]source g0/0/0

[Huawei-Tunnel0/0/0]nhrp entry 201.1.0.1 18.1.1.1 register

R3:

[Huawei]int Tunnel 0/0/0

[Huawei-Tunnel0/0/0]ip add 201.1.0.3 29

[Huawei-Tunnel0/0/0]tunnel-protocol gre p2mp

[Huawei-Tunnel0/0/0]source g0/0/0

[Huawei-Tunnel0/0/0]nhrp entry 201.1.0.1 18.1.1.1 register

认证：

R2:

[Huawei]aaa

[Huawei-aaa]local-user a password cipher 123

[Huawei-aaa]local-user a service-type ppp

[Huawei-aaa]q

[Huawei]int s4/0/0

[Huawei-Serial4/0/0]ppp authentication-mode pap

R3:

[Huawei]aaa

[Huawei-aaa]local-user b password cipher 123

[Huawei-aaa]local-user b service-type ppp

[Huawei-aaa]q

[Huawei]int s4/0/0

[Huawei-Serial4/0/0]ppp authentication-mode chap

[Huawei-Serial4/0/0]ppp chap user c

[Huawei-Serial4/0/0]ppp chap password cipher 321

R4:

[Huawei]int s4/0/0

[Huawei-Serial4/0/0]ppp pap local-user a password cipher 123

[Huawei]int s4/0/1

[Huawei-Serial4/0/1]ppp chap user b

[Huawei-Serial4/0/1]ppp chap password cipher 123

[Huawei-Serial4/0/1]q

[Huawei]aaa

[Huawei-aaa]local-user c password cipher 321

[Huawei-aaa]local-user c service-type ppp

[Huawei-aaa]q

[Huawei]int s4/0/1

[Huawei-Serial4/0/1]ppp authentication-mode chap

4.按实验要求启协议

注意更改MGRE中接口的工作方式和非中心站点的优先级

R1:

[Huawei]ospf

[Huawei-ospf-1]area 0

[Huawei-ospf-1-area-0.0.0.0]network 201.1.0.0 0.0.255.255

[Huawei]int Tunnel 0/0/0

[Huawei-Tunnel0/0/0]ospf network-type broadcast

R2:

[Huawei]ospf

[Huawei-ospf-1]area 0

[Huawei-ospf-1-area-0.0.0.0]network 201.1.0.0 0.0.255.255

[Huawei-ospf-1-area-0.0.0.0]q

[Huawei-ospf-1]area 1

[Huawei-ospf-1-area-0.0.0.1]network 204.1.0.0 0.0.255.255

[Huawei]int Tunnel 0/0/0

[Huawei-Tunnel0/0/0]ospf network-type broadcast

[Huawei-Tunnel0/0/0]ospf dr-priority 0

R3:

[Huawei]ospf

[Huawei-ospf-1]area 0

[Huawei-ospf-1-area-0.0.0.0]network 201.1.0.0 0.0.255.255

[Huawei-ospf-1-area-0.0.0.0]q

[Huawei-ospf-1]area 1

[Huawei-ospf-1-area-0.0.0.1]network 204.1.0.0 0.0.255.255

[Huawei]int Tunnel 0/0/0

[Huawei-Tunnel0/0/0]ospf network-type broadcast

[Huawei-Tunnel0/0/0]ospf dr-priority 0

R4:

[Huawei]ospf

[Huawei-ospf-1]area 1

[Huawei-ospf-1-area-0.0.0.1]network 204.1.0.0 0.0.255.255

[Huawei-ospf-1-area-0.0.0.1]q

[Huawei-ospf-1]q

[Huawei]ospf 2

[Huawei-ospf-2]area 2

[Huawei-ospf-2-area-0.0.0.2]network 200.1.0.0 0.0.255.255

[Huawei-ospf-2-area-0.0.0.2]q

[Huawei-ospf-2]q

[Huawei]rip

[Huawei-rip-1]version 2

[Huawei-rip-1]network 202.1.0.0

R5:

[Huawei]rip

[Huawei-rip-1]version 2

[Huawei-rip-1]network 202.1.1.0

[Huawei-rip-1]network 202.1.0.0

[Huawei-rip-1]network 202.1.2.0

[Huawei-rip-1]network 202.1.3.0

R6:

[Huawei]ospf

[Huawei-ospf-1]area 2

[Huawei-ospf-1-area-0.0.0.2]network 200.1.0.0 0.0.255.255

[Huawei-ospf-1-area-0.0.0.2]q

[Huawei]rip

[Huawei-rip-1]version 2

[Huawei-rip-1]network 203.1.0.0

R7:

[Huawei]rip

[Huawei-rip-1]version 2

[Huawei-rip-1]network 203.1.1.0

[Huawei-rip-1]network 203.1.0.0

[Huawei-rip-1]network 203.1.2.0

[Huawei-rip-1]network 203.1.3.0

5.用重发布和合理的优化策略使得全网通（实现要求4和6）

区域汇总减少骨干的LSA：

R2:

[Huawei]ospf

[Huawei-ospf-1]area 1

[Huawei-ospf-1-area-0.0.0.1]abr-summary 204.1.0.0 255.255.252.0

[Huawei-ospf-1]area 0

[Huawei-ospf-1-area-0.0.0.1]abr-summary 201.1.0.0 255.255.252.0

R3:

[Huawei]ospf

[Huawei-ospf-1]area 1

[Huawei-ospf-1-area-0.0.0.1]abr-summary 204.1.0.0 255.255.252.0

[Huawei-ospf-1]area 0

[Huawei-ospf-1-area-0.0.0.1]abr-summary 201.1.0.0 255.255.252.0

R4:

[Huawei]ospf 2

[Huawei-ospf-2]area 2

[Huawei-ospf-2-area-0.0.0.2]abr-summary 200.1.0.0 255.255.252.0

R5:

[Huawei]int g0/0/0

[Huawei-GigabitEthernet0/0/0]rip summary-address 202.1.0.0255.255.252.0

R7:

[Huawei]int g0/0/0

[Huawei-GigabitEthernet0/0/0]rip summary-address 202.1.0.0255.255.252.0

汇总后的路由表:

重发布实现全网通：

R6:

[Huawei]ospf

[Huawei-ospf-1]import-route rip

[Huawei-ospf-1]q

[Huawei]rip

[Huawei-rip-1]default-route originate

R4:

[Huawei]ospf

[Huawei-ospf-1]import-route rip

[Huawei-ospf-1]import-route ospf 2

[Huawei-ospf-1]q

[Huawei]ospf 2

[Huawei-ospf-2]default-route-advertise always

[Huawei-ospf-2]q

[Huawei]rip

[Huawei-rip-1]default-route originate

在此只做单向重发布时因为对于RIP200,AREA2,RIP100来说走自己及右方区域的路由自己有，剩下的只需缺省指向左方区域，所以只需将自己的路由转给左方即可，这样可以减少自己的路由条目；

此时，全网可达：

将AREA1改为NSSA，进一步减少LSA

R2:

[Huawei]ospf

[Huawei-ospf-1]area 1

[Huawei-ospf-1-area-0.0.0.1]nssa

R3:

[Huawei]ospf

[Huawei-ospf-1]area 1

[Huawei-ospf-1-area-0.0.0.1]nssa

R4:

[Huawei]ospf

[Huawei-ospf-1]area 1

[Huawei-ospf-1-area-0.0.0.1]nssa

6.其他区域优先通过R3访问R1 三个环回接口

只需将R3上将area0的汇总取消即可，利用最长掩码匹配即可优选R3访问R1的环回

7.area 1 区域增加安全性

R1:

[Huawei]ospf

[Huawei-ospf-1]ar 0

[Huawei-ospf-1-area-0.0.0.0]authentication-mode md5 1 cipher 123

R2:

[Huawei]ospf

[Huawei-ospf-1]ar 0

[Huawei-ospf-1-area-0.0.0.0]authentication-mode md5 1 cipher 123

R3:

[Huawei]ospf

[Huawei-ospf-1]ar 0

[Huawei-ospf-1-area-0.0.0.0]authentication-mode md5 1 cipher 123

8.私网访问公网

R2:

[Huawei]ospf

[Huawei-ospf-1]area 1

[Huawei-ospf-1]default-route-advertise always

[Huawei-ospf-1]q

[Huawei]acl 2000

[Huawei-acl-basic-2000]rule permit source 204.1.0.0 0.0.255.255

[Huawei-acl-basic-2000]rule permit source 202.1.0.0 0.0.255.255

[Huawei-acl-basic-2000]rule permit source 200.1.0.0 0.0.255.255

[Huawei-acl-basic-2000]rule permit source 203.1.0.0 0.0.255.255

[Huawei-acl-basic-2000]q

[Huawei]int g0/0/0

[Huawei-GigabitEthernet0/0/0]nat outbound 2000

R3:与R2相同