一、实验拓扑及要求
要求
1、R4为ISP,其上只能配置IP地址,R4与其他所有直连设备间使用公有IP;
2、解决ospf不规则区域的3种方式都得使用
3、整个OSPF环境Ip地址为172.16.0.0/16 ,进程100使用192.168.1.0/24
4、所有设备均可访问R4的环回 ,r14 上有两个环回
5、减少LSA的更新量,加快收敛,保障更新安全
6、全网可达
二、实验步骤
1、IP地址规划
2、配置底层IP地址
R1
[r1-GigabitEthernet0/0/0]ip address 192.168.1.1 24
[r1-LoopBack0]ip address 1.1.1.1 24
R2
[r2-LoopBack0]ip address 2.2.2.2 24
[r2-GigabitEthernet0/0/0]ip address 192.168.1.2 24
R3
[r3-GigabitEthernet0/0/0]ip address 192.168.1.3 24
[r3-GigabitEthernet0/0/1]ip address 34.1.1.1 24
[r3-LoopBack0]ip address 3.3.3.3 24
R4[ISP]
[ISP-GigabitEthernet0/0/0]ip address 34.1.1.2 24
[ISP-LoopBack0]ip address 4.4.4.4 24
[ISP-GigabitEthernet0/0/1]ip address 45.1.1.1 24
3、区域配置
area0
R5
[r5-GigabitEthernet0/0/0]ip address 45.1.1.2 24
[r5-GigabitEthernet0/0/1]ip address 172.16.0.1 20
[r5-LoopBack0]ip address 172.16.16.1 22
R6
[r6-LoopBack0]ip address 172.16.20.1 22
[r6-GigabitEthernet0/0/0]ip address 172.16.0.2 20
R7
[r7-GigabitEthernet0/0/0]ip address 172.16.0.3 20
[r7-LoopBack0]ip address 172.16.24.1 22
R8
[r8-GigabitEthernet0/0/0]ip address 172.16.0.4 20
[r8-LoopBack0]ip address 172.16.28.1 22
area1
R6
[r6-GigabitEthernet0/0/1]ip address 172.16.32.1 21
R13
[r13-GigabitEthernet0/0/0]ip address 172.16.32.2 21
[r13-GigabitEthernet0/0/1]ip address 172.16.40.1 21
[r13-LoopBack0]ip address 172.16.48.1 21
R14
[r14-GigabitEthernet0/0/0]ip address 172.16.40.2 21
[r14-LoopBack0]ip address 172.16.56.1 21
area2
R7
[r7-GigabitEthernet0/0/1]ip address 172.16.64.1 21
R9
[r9-GigabitEthernet0/0/0]ip address 172.16.64.2 21
[r9-LoopBack0]ip address 172.16.80.1 21
area3
R8
[r8-GigabitEthernet0/0/1]ip address 172.16.96.1 21
R11
[r11-GigabitEthernet0/0/0]ip address 172.16.96.2 21
[r11-GigabitEthernet0/0/1]ip address 172.16.114.1 21
[r11-LoopBack0]ip address 172.16.128.1 21
R12
[r12-GigabitEthernet0/0/0]ip address 172.16.114.2 21
[r12-LoopBack0]ip address 172.16.136.1 21
area4
R9
[r9-GigabitEthernet0/0/1]ip address 172.16.128.1 21
R10
[r10-GigabitEthernet0/0/0]ip address 172.16.128.2 21
[r10-LoopBack0]ip address 172.16.144.1 21
area5
R14
[r14-GigabitEthernet0/0/1]ip address 172.16.172.1 21
R15
[r15-GigabitEthernet0/0/0]ip address 172.16.172.2 21
[r15-LoopBack0]ip address 172.16.180.1 21
4、OSPF进行宣告
area0
R5
[r5]ospf 100 router-id 5.5.5.5
[r5-ospf-100]area 0
[r5-ospf-100-area-0.0.0.0]network 172.16.0.1 0.0.0.0
[r5-ospf-100-area-0.0.0.0]network 172.16.16.1 0.0.0.0
R6
[r6]ospf 100 router-id 6.6.6.6
[r6-ospf-100]area 0
[r6-ospf-100-area-0.0.0.0]network 172.16.0.2 0.0.0.0
[r6-ospf-100-area-0.0.0.0]network 172.16.20.1 0.0.0.0
R7
[r7]ospf 100 router-id 7.7.7.7
[r7-ospf-100]area 0
[r7-ospf-100-area-0.0.0.0]network 172.16.0.3 0.0.0.0
[r7-ospf-100-area-0.0.0.0]network 172.16.24.1 0.0.0.0
R8
[r8]ospf 100 router-id 8.8.8.8
[r8-ospf-100]area 0
[r8-ospf-100-area-0.0.0.0]network 172.16.0.4 0.0.0.0
[r8-ospf-100-area-0.0.0.0]network 172.16.28.1 0.0.0.0
area1
R6
[r6]ospf 100 router-id 6.6.6.6
[r6-ospf-100]area 1
[r6-ospf-100-area-0.0.0.1]network 172.16.32.1 0.0.0.0
R13
[r13]ospf 100 router-id 13.13.13.13
[r13-ospf-100]area 1
[r13-ospf-100-area-0.0.0.1]network 0.0.0.0 255.255.255.255
R14
[r14]ospf 100 router-id 14.14.14.14
[r14-ospf-100]area 1
[r14-ospf-100-area-0.0.0.1]network 0.0.0.0 255.255.255.255
R15
[r15]ospf 100 router-id 15.15.15.15
[r15-ospf-100]area 1
[r15-ospf-100-area-0.0.0.1]network 172.16.172.2 0.0.0.0
area2
R7
[r7-ospf-100]area 2
[r7-ospf-100-area-0.0.0.2]network 172.16.64.1 0.0.0.0
R9
[r9]ospf 100 router-id 9.9.9.9
[r9-ospf-100]area 2
[r9-ospf-100-area-0.0.0.2]network 172.16.64.2 0.0.0.0
[r9-ospf-100-area-0.0.0.2]network 172.16.80.1 0.0.0.0
area3
R11
[r11]ospf 100 router-id 11.11.11.11
[r11-ospf-100]area 3
[r11-ospf-100-area-0.0.0.3]network 0.0.0.0 255.255.255.255
R12
[r12]ospf 100 router-id 12.12.12.12
[r12-ospf-100]area 3
[r12-ospf-100-area-0.0.0.3]network 0.0.0.0 255.255.255.255
R8
[r8]ospf 100 router-id 8.8.8.8
[r8-ospf-100]area 3
[r8-ospf-100-area-0.0.0.3]network 172.16.96.1 0.0.0.255
area4
R9
[r9-ospf-100]area 4
[r9-ospf-100-area-0.0.0.4]network 172.16.128.1 0.0.0.0
R10
[r10]ospf 100 router-id 10.10.10.10
[r10-ospf-100]area 4
[r10-ospf-100-area-0.0.0.4]network 0.0.0.0 255.255.255.255
area5
R15
[r15-ospf-100]area 5
[r15-ospf-100-area-0.0.0.5]network 172.168.180.1 0.0.0.0
R1~R3ospf宣告
R1
[r1]ospf 101 router-id 1.1.1.1
[r1-ospf-101]area 0
[r1-ospf-101-area-0.0.0.0]network 0.0.0.0 255.255.255.255
R2
[r2]ospf 101 router-id 2.2.2.2
[r2-ospf-101]area 0
[r2-ospf-101-area-0.0.0.0]network 0.0.0.0 255.255.255.255
R3
[r3]ospf 101 router-id 3.3.3.3
[r3-ospf-101]area 0
[r3-ospf-101-area-0.0.0.0]network 192.168.1.3 0.0.0.0
[r3-ospf-101-area-0.0.0.0]network 3.3.3.3 0.0.0.0
5、跨区域通信
(1)虚链路
R9
[r9]ospf 100
[r9-ospf-100]area 2
[r9-ospf-100-area-0.0.0.2]vlink-peer 7.7.7.7
R7
[r7]ospf 100
[r7-ospf-100]area 2
[r7-ospf-100-area-0.0.0.2]vlink-peer 9.9.9.9
(2)多进程双向重发布技术
[r15]ospf 100
[r15-ospf-100]ar
[r15-ospf-100]area 5
[r15-ospf-100-area-0.0.0.5]undo network 172.168.180.1 0.0.0.0
[r15]ospf 102 router-id 15.12.15.12
[r15-ospf-102]area 5
[r15-ospf-102-area-0.0.0.5]network 172.168.180.1 0.0.0.0
[r15]ospf 100
[r15-ospf-100]import-route ospf 102
[r15-ospf-100]q
[r15]osp
[r15]ospf 102
[r15-ospf-102]import-route ospf 100
此时R5pingR15可以ping通
(3)Tunnel隧道
[r3]interface Tunnel 0/0/0
[r3-Tunnel0/0/0]tunnel-protocol gre
[r3-Tunnel0/0/0]source g0/0/1
[r3-Tunnel0/0/0]destination 45.1.1.2
[r3-Tunnel0/0/0]ip address 192.168.3.1 24
[r3-Tunnel0/0/0]q
[r3]ospf 101
[r3-ospf-101]area 0
[r3-ospf-101-area-0.0.0.0]network 192.168.3.1 0.0.0.0
[r5]interface Tunnel 0/0/0
[r5-Tunnel0/0/0]tunnel-protocol gre
[r5-Tunnel0/0/0]source g0/0/0
[r5-Tunnel0/0/0]destination 34.1.1.1
[r5-Tunnel0/0/0]ip address 192.168.3.2 24
[r5-Tunnel0/0/0]q
[r5]ospf 100
[r5-ospf-100]area 0
[r5-ospf-100-area-0.0.0.0]network 192.168.3.2 0.0.0.0
(4)R3和R5添加缺省路由
[r3]ip route-static 0.0.0.0 0 34.1.1.2
[r5]ip route-static 0.0.0.0 0 45.1.1.1
(5)由于R4是ISP,所以用NAT进行地址转换
[r3]acl 2000
[r3-acl-basic-2000]rule 5 permit source any
[r3-acl-basic-2000]q
[r3]int g0/0/1
[r3-GigabitEthernet0/0/1]nat outbound 2000
[r3-GigabitEthernet0/0/1]q
[r3]ospf 101
[r3-ospf-101]default-route-advertise
[r5]acl 2000
[r5-acl-basic-2000]rule 5 permit source any
[r5-acl-basic-2000]q
[r5]interface g0/0/0
[r5-GigabitEthernet0/0/0]nat outbound 2000
[r5-GigabitEthernet0/0/0]q
[r5]ospf 100
[r5-ospf-100]default-route-advertise
6、优化
(1) 加快收敛
[r8]interface GigabitEthernet 0/0/1
[r8-GigabitEthernet0/0/1]ospf timer hello 5
[r11]interface GigabitEthernet 0/0/0
[r11-GigabitEthernet0/0/0]ospf timer hello
(2) 保证更新安全
① 接口认证
[r8]interface g0/0/1
[r8-GigabitEthernet0/0/1]ospf authentication-mode simple cipher 123 #明文认证
[r8-GigabitEthernet0/0/1]ospf authentication-mode md5 #密文认证
[r11]interface GigabitEthernet 0/0/0
[r11-GigabitEthernet0/0/0]ospf authentication-mode simple cipher 123 #明文认证
[r11-GigabitEthernet0/0/0]ospf authentication-mode md5 #密文认证
② 区域密文认证
[r8]ospf 100
[r8-ospf-100]area 3
[r8-ospf-100-area-0.0.0.3]authentication-mode simple cipher 123
[r8-ospf-100-area-0.0.0.3]authentication-mode md5
[r11]ospf 100
[r11-ospf-100]area 3
[r11-ospf-100-area-0.0.0.3]authentication-mode simple cipher 123
[r11-ospf-100-area-0.0.0.3]authentication-mode md5
③ 虚链路认证
[r7]ospf 100
[r7-ospf-100]area 2
[r7-ospf-100-area-0.0.0.2]vlink-peer 9.9.9.9 simple cipher 123
[r7-ospf-100-area-0.0.0.2]vlink-peer 9.9.9.9 md5
[r9]ospf 100
[r9-ospf-100]area 2
[r9-ospf-100-area-0.0.0.2]vlink-peer 7.7.7.7 simple cipher 123
[r9-ospf-100-area-0.0.0.2]vlink-peer 7.7.7.7 md5
(3) 减少LSA
① 末梢区域—拒绝4、5类LSA;产生一条3类缺省
[r12]ospf 100
[r12-ospf-100]area 3
[r12-ospf-100-area-0.0.0.3]stub
[r11]ospf 100
[r11-ospf-100]area 3
[r11-ospf-100-area-0.0.0.3]stub
② 完全末梢区域—在末梢区域的基础上进一步拒绝3类的LSA,仅保留一条3类的缺省,先将该区域配置为末梢区域,然后仅需要在ABR上定义为完全末梢即可
[r8]ospf 100
[r8-ospf-100]area 3
[r8-ospf-100-area-0.0.0.3]stub no-summary
③ NSSA区域
[r15]ospf 100
[r15-ospf-100]area 1
[r15-ospf-100-area-0.0.0.1]nssa
[r14]ospf 100
[r14-ospf-100]area 1
[r14-ospf-100-area-0.0.0.1]nssa
[r13]ospf 100
[r13-ospf-100]area 1
[r13-ospf-100-area-0.0.0.1]nssa
[r6]ospf 100
[r6-ospf-100]area 1
[r6-ospf-100-area-0.0.0.1]nssa no-summary
[r6]display ospf lsdb
④ 骨干区域优化
[r8]ospf 100
[r8-ospf-100]area 3
[r8-ospf-100-area-0.0.0.3]abr-summary 172.16.96.0 255.255.224.0
⑤ 域外路由汇总
[r15]ospf 100
[r15-ospf-100]area 5
[r15-ospf-100-area-0.0.0.5]abr-summary 172.16.168.0 255.255.224.0