ADVPN：Full-Mesh模型组网实验-CSDN博客

本文链接：https://blog.csdn.net/gtj0617/article/details/142170334

正文共：1024 字 12 图，预估阅读时间：2 分钟

前一篇文章我们介绍了ADVPN的Hub-Spoke模型（ADVPN：Hub-Spoke模型组网实验），华三实现ADVPN是基于VAM协议来的。可以看出ADVPN的底层实现还是基于IKE和IPsec来的，采用Client/Server模型，其中VAM作为服务器端，负责收集、维护和分发客户端（ADVPN节点）动态变化的公网地址等信息。

ADVPN节点分为Hub设备和Spoke设备。其中Hub设备是ADVPN网络的中心设备，它是路由信息交换的中心。Spoke设备是ADVPN网络的分支设备，通常是企业分支机构的网关。

从上次的实验中，我们可以看到，Hub-Spoke模型中，Spoke设备之间不能建立隧道直接通信，只能通过Hub设备转发数据。而ADVPN组网结构的另一种模型就是Full-Mesh模型，这种模型下，Spoke设备和Spoke设备之间是可以建立隧道直接通信的。

还是上次的组网拓扑。

在Hub-Spoke模型中，只有Hub设备和Spoke设备之间建立的H-S隧道或S-H隧道。

而在Full-Mesh模型中，Spoke设备和Spoke设备之间也建立起了S-S隧道，可以直接通信，无需绕转Hub设备。这条隧道又称为shortcut（捷径）。

在Full-Mesh的组网方模型，Spoke设备与Hub设备之间建立永久的ADVPN隧道，Spoke设备之间在有数据时动态建立ADVPN隧道。VAM服务器负责管理、维护各个节点的信息，并兼顾对VAM客户端的认证管理。

VAM

VAM的配置和Hub-Spoke模型配置一致。

#
domain advpn
 authentication advpn local
#
domain default enable advpn
#
local-user HUB class network
 password simple HUB
 service-type advpn
#
local-user SPOKE1 class network
 password simple SPOKE1
 service-type advpn
#
local-user SPOKE2 class network
 password simple SPOKE2
 service-type advpn
#
vam server advpn-domain ADVPN id 1
 hub-group HUB
 hub private-address 10.10.10.1
 spoke private-address range 10.10.10.0 10.10.10.255
#
vam server advpn-domain ADVPN id 1
 pre-shared-key simple ADVPN
 authentication-method chap
 server enable

HUB

HUB设备的配置大体和Hub-Spoke模型配置一致，但需要调整GRE封装的ADVPN隧道接口Tunnel1的配置，将OSPF接口的网络类型由p2mp修改为broadcast。

#
vam client name HUB
 advpn-domain ADVPN
 server primary ip-address 15.1.1.5
 pre-shared-key simple ADVPN
 user HUB password simple HUB
 client enable
#
ike keychain ADVPN
 pre-shared-key address 0.0.0.0 0.0.0.0 key simple ADVPN
#
ike profile ADVPN
 keychain ADVPN
#
ipsec transform-set ADVPN
 encapsulation-mode transport
 esp encryption-algorithm des-cbc
 esp authentication-algorithm sha1
#
ipsec profile ADVPN isakmp
 transform-set ADVPN
 ike-profile ADVPN
#
ospf 1
 area 0.0.0.0
  network 10.10.10.0 0.0.0.255
  network 22.1.1.0 0.0.0.255
#
interface Tunnel1 mode advpn gre
 ip address 10.10.10.1 255.255.255.0
 ospf network-type broadcast
 source GigabitEthernet0/0
 tunnel protection ipsec profile ADVPN
 vam client HUB

SPOKE1

和HUB设备一样，将ADVPN隧道接口的OSPF接口网络类型由p2mp修改为broadcast。接口的DR优先级决定了该接口在选举DR/BDR时所具有的资格，数值越大，优先级越高。此时需要将DR优先级配置为0，使设备不参与DR/BDR选举。

#
vam client name SPOKE1
 advpn-domain ADVPN
 server primary ip-address 15.1.1.5
 pre-shared-key simple ADVPN
 user SPOKE1 password simple SPOKE1
 client enable
#
ike keychain ADVPN
 pre-shared-key address 0.0.0.0 0.0.0.0 key simple ADVPN
#
ike profile ADVPN
 keychain ADVPN
#
ipsec transform-set ADVPN
 encapsulation-mode transport
 esp encryption-algorithm des-cbc
 esp authentication-algorithm sha1
#
ipsec profile ADVPN isakmp
 transform-set ADVPN
 ike-profile ADVPN
#
ospf 1
 area 0.0.0.0
  network 10.10.10.0 0.0.0.255
  network 33.1.1.0 0.0.0.255
#
interface Tunnel1 mode advpn gre
 ip address 10.10.10.2 255.255.255.0
 ospf network-type broadcast
 ospf dr-priority 0
 source GigabitEthernet0/0
 tunnel protection ipsec profile ADVPN
 vam client SPOKE1

SPOKE2

配置和SPOKE1配置相似，直接上配置。

#
vam client name SPOKE2
 advpn-domain ADVPN
 server primary ip-address 15.1.1.5
 pre-shared-key simple ADVPN
 user SPOKE2 password simple SPOKE2
 client enable
#
ike keychain ADVPN
 pre-shared-key address 0.0.0.0 0.0.0.0 key simple ADVPN
#
ike profile ADVPN
 keychain ADVPN
#
ipsec transform-set ADVPN
 encapsulation-mode transport
 esp encryption-algorithm des-cbc
 esp authentication-algorithm sha1
#
ipsec profile ADVPN isakmp
 transform-set ADVPN
 ike-profile ADVPN
#
ospf 1
 area 0.0.0.0
  network 10.10.10.0 0.0.0.255
  network 44.1.1.0 0.0.0.255
#
interface Tunnel1 mode advpn gre
 ip address 10.10.10.3 255.255.255.0
 ospf network-type broadcast
 ospf dr-priority 0
 source GigabitEthernet0/0
 tunnel protection ipsec profile ADVPN
 vam client SPOKE2