一,实验拓扑
二,实验目的
1、R4为ISP,其上只配置IP地址;R4与其他所直连设备间均使用公有IP;
2、R3-R5、R6、R7为MGRE环境,R3为中心站点;
3、整个OSPF环境IP基于172.16.0.0/16划分;除了R12有两个环回,其他路由器均有一个环回IP
4、所有设备均可访问R4的环回;
5、减少LSA的更新量,加快收敛,保障更新安全;
6、全网可达;
三,实验思路:
1,IP地址划分
172.16.0.0/16
172.16.00000000.00000000/16
先划分5个区域给area(2的3次方)
area0:172.16.000 00000.00000000/19 --- 172.16.0.0/19
划分7个网段,R4,R5,R6,R7的环回,1个MA,1个p2p,1个隧道
172.16.00000000.00000000/24 --- 172.16.0.0/24 --- P2P
172.16.00000001.00000000/24 --- 172.16.1.0/24 --- MA
172.16.00000010.00000000/24 --- 172.16.2.0/24 --- R4(环回)
172.16.00000011.00000000/24 --- 172.16.3.0/24 --- R5(环回)
172.16.00000100.00000000/24 --- 172.16.4.0/24 --- R6(环回)
172.16.00000101.00000000/24 --- 172.16.5.0/24 --- R7(环回)
172.16.00000110.00000000/24 --- 172.16.6.0/24 --- 隧道
area1:172.16.001 00000.00000000/19 --- 172.16.32.0/19
划分5个网段(8 = 3的3次方),R1,R2,R3的环回,1个骨干(MA),1个p2p,但是考虑到与用户端相连不需要那么多主机位,应该在往后数几位。--- 24为掩码
172.16.001 00000.00000000/24 --- 172.16.32.0/24 --- p2p
172.16.001 00001.00000000/24 --- 172.16.33.0/24 --- MA
172.16.001 00010.00000000/24 --- 172.16.34.0/24 --- R1(环回)
172.16.001 00011.00000000/24 --- 172.16.35.0/24 --- R2(环回)
172.16.001 00100.00000000/24 --- 172.16.36.0/24 --- R3(环回)
area2:172.16.010 00000.00000000/19 --- 172.16.64.0/19
划分3个网段,1个MA --- 划分2个网段,1个P2P,1个R11环回
172.16.01000000.00000000/24 --- 172.16.64.0/24 --- P2P
172.16.01000001.00000000/24 --- 172.16.65.0/24 --- MA
172.16.01000001.00000000/30 --- 172.16.65.0/30
172.16.01000001.00000100/30 --- 172.16.65.4/30
172.16.01000010.00000000/24 --- 172.16.66.0/24 --- R11(环回)
area3:172.16.011 00000.00000000/19 --- 172.16.96.0/19
划分3个网段,1个MA --- 划分两个网段,1个P2P,1个R8的环回
172.16.01100000.00000000/24 --- 172.16.96.0/24 --- P2P
172.16.01100001.00000000/24 --- 172.16.97.0/24 --- MA
172.16.01100001.00000000/30 --- 172.16.97.0/30
172.16.01100001.00000100/30 --- 172.16.97.4/30
172.16.01100010.00000000/24 --- 172.16.98.0/24 --- R8(环回)
area4:172.16.100 00000.00000000/19 --- 172.16.128.0/19
划分4个网段,1个MA --- 细致划分1个网段,1个P2P,R9,R10的环回
172.16.10000000.00000000/24 --- 172.16.128.0/24 --- P2P
172.16.10000001.00000000/24 --- 172.16.129.0/24 --- MA
172.16.10000001.00000000/30 --- 172.16.129.0/30
172.16.10000010.00000000/24 --- 172.16.130.0/24 --- R9(环回)
172.16.10000011.00000000/24 --- 172.16.131.0/24 --- R10(环回)
RIP:L0: 192.168.1.0/24
L1: 192.168.2.0/24
2.实现私网互通,公网通
要实现全网互通的话需要构建vpn通道,使用MGRE技术,再用OSPF来动态获取路由(OSPF和MGRE使用的时候有两个问题,其一:接口类型为p2p的类型,与其他接口类型不一样,所以要改接口类型,可以统一改成广播的类型。其二:分部向总部注册,导致每个分部和总部建立邻居时都要进行DR/BDR选举,从而导致area 0的DR/BDR的选举混乱,所以要取消各个分部的选举),实现跨公网达到私网互通,ASBR设备做路由引入,AR12设备也是如此。再实现公网通,在每个区域的公网边界路由器上写默认缺省。
3.保障安全,加快收敛
在各个OSPF区域中做区域认证,缩短halo时间。
4.优化路由
将area 1 设置成totally stub区域,area 2,area3设置成totally NSSA区域(会默认下发路由),注意设置成这些特殊区域过后,在area 3区域中都是默认缺省,导致area 4中R10设备不能学习到其他区域的路由信息,所以需要在AR9在area 4中下发一条默认缺省。
5.私网可访问公网:
在公网边界路由上做NAT地址转换。
四,实验过程:
实现公网通
配置缺省路由:
在AR3,5,6,7配置缺省:
[AR3]ip route-static 0.0.0.0 0 34.0.0.4
[AR5]ip route-static 0.0.0.0 0 45.0.0.4
[AR6]ip route-static 0.0.0.0 0 46.0.0.4
[AR7]ip route-static 0.0.0.0 0 47.0.0.4
实现私网通---搭建MGRE:
AR3:
[AR3]inte Tunnel 0/0/0
[AR3-Tunnel0/0/0]tunnel-protocol gre p2mp
[AR3-Tunnel0/0/0]source 34.0.0.3
[AR3-Tunnel0/0/0]nhrp network-id 100
AR5:
[AR5]inte Tunnel 0/0/0
[AR5-Tunnel0/0/0]ip add 172.16.6.5 24
[AR5-Tunnel0/0/0]tunnel-protocol gre p2mp
[AR5-Tunnel0/0/0]source Serial 4/0/0
[AR5-Tunnel0/0/0]nhrp network-id 100
[AR5-Tunnel0/0/0]nhrp entry 172.16.6.3 34.0.0.3 register
AR6:
[AR6]inte Tunnel 0/0/0
[AR6-Tunnel0/0/0]ip add 172.16.6.6 24
[AR6-Tunnel0/0/0]tunnel-protocol gre p2mp
[AR6-Tunnel0/0/0]source Serial 4/0/0
[AR6-Tunnel0/0/0]nhrp network-id 100
[AR6-Tunnel0/0/0]nhrp entry 172.16.6.3 34.0.0.3 register
AR7:
[AR7]inte Tunnel 0/0/0
[AR7-Tunnel0/0/0]ip add 172.16.6.7 24
[AR7-Tunnel0/0/0]tunnel-protocol gre p2mp
[AR7-Tunnel0/0/0]source g 0/0/0
[AR7-Tunnel0/0/0]nhrp network-id 100
[AR7-Tunnel0/0/0]nhrp entry 172.16.6.3 34.0.0.3 register
实现私网通--OSPF配置:
area 1:
AR1:
[AR1]ospf 1 router-id 1.1.1.1
[AR1-ospf-1]area 1
[AR1-ospf-1-area-0.0.0.1]network 172.16.33.0 0.0.0.255
[AR1-ospf-1-area-0.0.0.1]network 172.16.34.0 0.0.0.255
AR2:
[AR2]ospf 1 router-id 2.2.2.2
[AR2-ospf-1]area 1
[AR2-ospf-1-area-0.0.0.1]network 172.16.33.0 0.0.0.255
[AR2-ospf-1-area-0.0.0.1]network 172.16.35.0 0.0.0.255
AR3:
[AR3]ospf 1 router-id 3.3.3.3
[AR3-ospf-1]area 1
[AR3-ospf-1-area-0.0.0.1]network 172.16.33.0 0.0.0.255
[AR3-ospf-1-area-0.0.0.1]network 172.16.36.0 0.0.0.255
area 0://由于MGRE是p2p接口类型,需要更改OSPF接口类型,再开启nhrp的伪广播功能,再取消分部的OSPF的选举:
AR3:
[AR3]inter Tunnel 0/0/0
[AR3-Tunnel0/0/0]ospf network-type broadcast //更改接口类型
[AR3-Tunnel0/0/0]nhrp entry multicast dynamic //开启伪广播
[AR3]ospf 1
[AR3-ospf-1]area 1
[AR3-ospf-1-area-0.0.0.1]network 172.16.6.0 0.0.0.255
AR5:
[AR5]inter Tunnel 0/0/0
[AR5-Tunnel0/0/0]ospf network-type broadcast
[AR5-Tunnel0/0/0]ospf dr-priority 0
[AR5]ospf 1 router-id 5.5.5.5
[AR5-ospf-1]area 0
[AR5-ospf-1-area-0.0.0.0]network 172.16.6.0 0.0.0.255
[AR5-ospf-1-area-0.0.0.0]network 172.16.3.0 0.0.0.255
AR6:
[AR6]inter Tunnel 0/0/0
[AR6-Tunnel0/0/0]ospf network-type broadcast
[AR6-Tunnel0/0/0]ospf dr-priority 0
[AR6]ospf 1 router-id 6.6.6.6
[AR6-ospf-1]area 0
[AR6-ospf-1-area-0.0.0.0]network 172.16.6.0 0.0.0.255
[AR6-ospf-1-area-0.0.0.0]network 172.16.4.0 0.0.0.255
AR7:
[AR7]inter Tunnel 0/0/0
[AR7-Tunnel0/0/0]ospf network-type broadcast
[AR7-Tunnel0/0/0]ospf dr-priority 0
[AR7]ospf 1 router-id 7.7.7.7
[AR7-ospf-1]area 0
[AR7-ospf-1-area-0.0.0.0]network 172.16.6.0 0.0.0.255
[AR7-ospf-1-area-0.0.0.0]network 172.16.5.0 0.0.0.255
area 2:
AR6:
[AR6]ospf 1
[AR6-ospf-1]area 2
[AR6-ospf-1-area-0.0.0.2]network 172.16.64.0 0.0.31.255
AR11:
[AR11]ospf 1 router-id 11.11.11.11
[AR11-ospf-1]area 2
[AR11-ospf-1-area-0.0.0.2]network 172.16.64.0 0.0.31.255
AR12:
[AR12]ospf 1 router-id 12.12.12.12
[AR12-ospf-1]area 2
[AR12-ospf-1-area-0.0.0.2]network 172.16.64.0 0.0.31.255
rip:
[AR12]rip 1
[AR12-rip-1]v 2
[AR12-rip-1]undo summary
[AR12-rip-1]network 192.168.1.0
[AR12-rip-1]network 192.168.2.0
进程导入:
[AR12-ospf-1]import-route rip 1
area 3:
AR7:
[AR7]ospf 1
[AR7-ospf-1]area 3
[AR7-ospf-1-area-0.0.0.3]network 172.16.96.0 0.0.31.255
AR8:
[AR8]ospf 1 router-id 8.8.8.8
[AR8-ospf-1]area 3
[AR8-ospf-1-area-0.0.0.3]network 172.16.96.0 0.0.31.255
AR9:
[AR9]ospf 1 router-id 9.9.9.9
[AR9-ospf-1]area 3
[AR9-ospf-1-area-0.0.0.3]network 172.16.96.0 0.0.31.255
area 4:
AR9:
[AR9]ospf 2 //注意这里是进程2,后面要做进程导入
[AR9-ospf-2]area 4
[AR9-ospf-2-area-0.0.0.4]network 172.16.128.0 0.0.31.255
AR10:
[AR10]ospf 2 router-id 10.10.10.10
[AR10-ospf-2]area 4
[AR10-ospf-2-area-0.0.0.4]network 172.16.128.0 0.0.31.255
进程导入:
AR9:
[AR9-ospf-1]import-route ospf 2
[AR9-ospf-2]import-route ospf 1
配置完以上基本可以实现私网全私网通测试(AR10环回pingAR12环回):
5.保障安全,加快收敛速度:
area1:
[R1-ospf-1-area-0.0.0.1]authentication-mode md5 1 cipher 123456
[R2-ospf-1-area-0.0.0.1]authentication-mode md5 1 cipher 123456
[R3-ospf-1-area-0.0.0.1]authentication-mode md5 1 cipher 123456
area0:
[R3-ospf-1-area-0.0.0.0]authentication-mode md5 1 cipher wj123456
[R5-ospf-1-area-0.0.0.0]authentication-mode md5 1 cipher wj123456
[R6-ospf-1-area-0.0.0.0]authentication-mode md5 1 cipher wj123456
[R7-ospf-1-area-0.0.0.0]authentication-mode md5 1 cipher wj123456
area2:
R6-ospf-1-area-0.0.0.2]authentication-mode md5 1 cipher wx123456
[R11-ospf-1-area-0.0.0.2]authentication-mode md5 1 cipher wx123456
[R12-ospf-1-area-0.0.0.2]authentication-mode md5 1 cipher wx123456
area3:
[R7-ospf-1-area-0.0.0.3]authentication-mode md5 1 cipher wangjing123
[R8-ospf-1-area-0.0.0.3]authentication-mode md5 1 cipher wangjing123
[R9-ospf-1-area-0.0.0.3]authentication-mode md5 1 cipher wangjing123
area4:
[R9-ospf-2-area-0.0.0.4]authentication-mode md5 1 cipher 456789
[R10-ospf-2-area-0.0.0.4]authentication-mode md5 1 cipher 456789
R1为例:
[R1-GigabitEthernet0/0/0]ospf timer hello 5
6.路由优化,实现私网可访问公网:
ABR聚合:
AR3: [R3-ospf-1-area-0.0.0.1]abr-summary 172.16.32.0 255.255.224.0
AR6: [R6-ospf-1-area-0.0.0.2]abr-summary 172.16.64.0 255.255.224.0
AR7: [R7-ospf-1-area-0.0.0.3]abr-summary 172.16.96.0 255.255.224.0
ASBR聚合:
AR12: [R12-ospf-1]asbr-summary 192.168.0.0 255.255.254.0
AR9: [R9-ospf-1]asbr-summary 172.16.128.0 255.255.224.0
设置totally stub区域以及totally NSSA区域(设置这两个区域会在该区域类自动下发一条指向ABR设备的默认缺省,所以一会实现私网访问公网可省略下发默认缺省,但是要在area 4区域内下发默认缺省,因为AR8与AR9建立邻居,而AR8上的ospf只剩下默认缺省了,area 4学习不到其他区域
的路由信息)
totally stub区域:area1(以AR1为例子,其他属于area 1区域的均相同的配置命令)
totally nssa区域:area 2,area 3(以AR11为例子,其他属于area 2,3区域的均相同配置命令)
[AR1-ospf-1-area-0.0.0.1]stub no-summary
[AR11-ospf-1-area-0.0.0.2]nssa no-summary
[AR10]ip route-static 0.0.0.0 0 172.16.129.1 //AR10配置默认缺省
在以上域都划分为特殊区域过后,AR10配置默认缺省过后,ping测试(AR10环回pingAR12环回):
OSPF明显变少了
lsdb明显减少,网络中传递的lsa信息大大减少
NAT转换,实现私网访问公网:
AR3:[R3]acl 2000
[R3-acl-basic-2000]rule permit source 172.16.32.0 0.0.31.255
[R3-acl-basic-2000]q
[R3]int s4/0/0
[R3-Serial4/0/0]nat outbound 2000
AR6:[R6]acl 2000
[R6-acl-basic-2000]rule permit source 172.16.64.0 0.0.31.255
[R6-acl-basic-2000]rule permit source 192.165.1.0 0.0.0.255
[R6-acl-basic-2000]rule permit source 192.165.2.0 0.0.0.255
[R6-acl-basic-2000]q
[R6]int s4/0/0
[R6-Serial4/0/0]nat outbound 2000
AR7:[R7]acl 2000
[R7-acl-basic-2000]rule permit source 172.16.96.0 0.0.31.255
[R7-acl-basic-2000]rule permit source 172.16.128.0 0.0.31.255
[R7-acl-basic-2000]q
[R7]int g 0/0/0
[R7-GigabitEthernet0/0/0]nat outbound 2000