【策略路由选路】

pbr

实现pc1 访问电信 pc2访问移动 pc3访问联通 简单拓扑

1-配置各自IP地址
2-配置防火墙区间
3-设置PBR
4-测试

R1：
interface GigabitEthernet0/0/0
 ip address 1.1.1.1 255.255.255.252

R2：
interface GigabitEthernet0/0/0
 ip address 2.2.2.1 255.255.255.252
 
R3
interface GigabitEthernet0/0/0
 ip address 3.3.3.1 255.255.255.252

FW1：
interface GigabitEthernet1/0/0
 undo shutdown
 ip address 1.1.1.2 255.255.255.252
#
interface GigabitEthernet1/0/1
 undo shutdown
 ip address 2.2.2.2 255.255.255.252
#
interface GigabitEthernet1/0/2
 undo shutdown
 ip address 3.3.3.2 255.255.255.252
#
interface GigabitEthernet1/0/3
 undo shutdown
 ip address 192.168.1.254 255.255.255.0

[FW1]dis zone 
2022-09-02 06:09:49.040 
local
 priority is 100
 interface of the zone is (0):
#
trust
 priority is 85
 interface of the zone is (2):
    GigabitEthernet0/0/0
    GigabitEthernet1/0/3
#
untrust
 priority is 5
 interface of the zone is (3):
    GigabitEthernet1/0/0
    GigabitEthernet1/0/1
    GigabitEthernet1/0/2
#
为三个路由个设置一个loopback口，相同IP以便后面测试，这里设置的是5.5.5.5
[R1]int LoopBack 0
[R1-LoopBack0]ip add 5.5.5.5 32
[R2]int LoopBack 0
[R2-LoopBack0]ip add 5.5.5.5 32
[R3]int LoopBack 0
[R3-LoopBack0]ip add 5.5.5.5 32

添加路由(因为测试，通过静态路由直接丢给防火墙)：
[R1]ip route-static 0.0.0.0 0.0.0.0 1.1.1.2
[R2]ip route-static 0.0.0.0 0.0.0.0 2.2.2.2
[R3]ip route-static 0.0.0.0 0.0.0.0 3.3.3.2
使用link-interface 创建默认路由【router enable 默认添加一条unr的用户路由】
link-interface 0 name DX
 interface GigabitEthernet1/0/0 next-hop 1.1.1.1 router en
#
link-interface 1 name yd
 interface GigabitEthernet1/0/1 next-hop 2.2.2.1 router en
#
link-interface 2 name lt
 interface GigabitEthernet1/0/2 next-hop 3.3.3.1 router en

防火墙开启nat
nat-policy
 rule name internet
  source-zone trust
  destination-zone untrust
  source-address 192.168.1.0 mask 255.255.255.0
  action source-nat easy-ip

设置策略路由：

policy-based-route
 rule name DX 1
  source-zone trust
  source-address 192.168.1.1 mask 255.255.255.255
  ~~destination-address 1.1.1.0 mask 255.255.255.252~~ 
  action pbr next-hop 1.1.1.1
 rule name YD 2
  source-zone trust
  source-address 192.168.1.2 mask 255.255.255.255
 ~~destination-address 2.2.2.0 mask 255.255.255.252~~ 
  action pbr next-hop 2.2.2.1
 rule name LT 3
  source-zone trust
  source-address 192.168.1.0 mask 255.255.255.0
  ~~destination-address 3.3.3.0 mask 255.255.255.252~~   
  action pbr next-hop 3.3.3.1

看到这肯定以为已经做完了，检查发现还是一样随机，等价路由还在生效，删除了pbr的目的指定目的地址才行，想想因为指定，所以5.5.5.5 无法抵达，没有匹配上pbr。