组网需求
如图1所示,VLAN10和VLAN20是企业内部的两个部门,分别通过交换机连接到RouterA的GE1/0/0和GE2/0/0。HOSTA和HOSTB是同一部门内的两台主机,IP地址分别为192.168.1.2/24和192.168.1.3/24,属于192.168.1.0/24网段;HOSTC和HOSTD是另一部门的两台主机,IP地址分别为192.168.2.2/24和192.168.2.3/24,属于192.168.2.0/24网段。
RouterA可以通过RouterA→RouterB→RouterD连接到Internet,也可以通过RouterA→RouterC→RouterD连接到Internet,现要求:
- 在两条链路都正常时,企业内部不同网段地址的报文通过不同的链路连接到Internet;
- 当一条链路发生故障时,企业内部不同网段地址的报文都走无故障的链路,避免长时间的业务中断;
- 当故障解决后,恢复报文从不同链路连接到Internet。
设备 | 接口 | IP地址 |
---|---|---|
RouterA | GE1/0/0 | 192.168.1.1/24 |
GE2/0/0 | 192.168.2.1/24 | |
GE3/0/0 | 192.168.3.1/24 | |
GE4/0/0 | 192.168.4.1/24 | |
RouterB | GE1/0/0 | 192.168.3.2/24 |
GE2/0/0 | 192.168.5.2/24 | |
RouterC | GE1/0/0 | 192.168.4.2/24 |
GE2/0/0 | 192.168.6.2/24 | |
RouterD | GE1/0/0 | 192.168.5.1/24 |
GE2/0/0 | 192.168.6.1/24 | |
GE3/0/0 | 192.168.7.1/24 |
配置思路
采用重定向联动NQA测试例的方式实现策略路由,具体配置思路如下:
- 配置各设备接口IP地址及路由协议,使企业用户能通过RouterA访问Internet。
- 配置NQA测试例,检测链路RouterA→RouterB→RouterD和RouterA→RouterC→RouterD是否正常。
- 配置NQA和静态路由联动,实现当链路故障时,流量可以切换到正常链路。
- 配置流分类,匹配规则为匹配报文的源IP地址,实现基于源地址对报文进行分类。
- 配置流行为,即配置NQA与重定向联动,实现当NQA测试例检测到链路RouterA→RouterB→RouterD正常时,将满足规则的报文重定向到192.168.3.2/24,当NQA测试例检测到链路RouterA→RouterC→RouterD正常时,将满足规则的报文重定向到192.168.4.2/24。
- 配置流策略,绑定上述流分类和流行为,并应用到相应的接口,实现策略路由。
操作步骤
- 配置设备间的网络互通
# 配置各接口的IP地址,以RouterA为例。其他设备的配置与之类似,详见配置文件。
<Huawei> system-view [Huawei] sysname RouterA [RouterA] interface gigabitethernet 1/0/0 [RouterA-GigabitEthernet1/0/0] ip address 192.168.1.1 24 [RouterA-GigabitEthernet1/0/0] quit [RouterA] interface gigabitethernet 2/0/0 [RouterA-GigabitEthernet2/0/0] ip address 192.168.2.1 24 [RouterA-GigabitEthernet2/0/0] quit [RouterA] interface gigabitethernet 3/0/0 [RouterA-GigabitEthernet3/0/0] ip address 192.168.3.1 24 [RouterA-GigabitEthernet3/0/0] quit [RouterA] interface gigabitethernet 4/0/0 [RouterA-GigabitEthernet4/0/0] ip address 192.168.4.1 24 [RouterA-GigabitEthernet4/0/0] quit
请配置SwitchA和SwitchB,使其能与RouterA互通。
# 配置各设备间的静态路由。
[RouterA] ip route-static 192.168.7.0 255.255.255.0 192.168.3.2 [RouterA] ip route-static 192.168.7.0 255.255.255.0 192.168.4.2 [RouterA] ip route-static 192.168.5.0 255.255.255.0 192.168.3.2 [RouterA] ip route-static 192.168.6.0 255.255.255.0 192.168.4.2 [RouterB] ip route-static 192.168.7.0 255.255.255.0 192.168.5.1 [RouterB] ip route-static 192.168.1.0 255.255.255.0 192.168.3.1 [RouterB] ip route-static 192.168.2.0 255.255.255.0 192.168.3.1 [RouterC] ip route-static 192.168.7.0 255.255.255.0 192.168.6.1 [RouterC] ip route-static 192.168.1.0 255.255.255.0 192.168.4.1 [RouterC] ip route-static 192.168.2.0 255.255.255.0 192.168.4.1 [RouterD] ip route-static 192.168.1.0 255.255.255.0 192.168.5.2 [RouterD] ip route-static 192.168.1.0 255.255.255.0 192.168.6.2 [RouterD] ip route-static 192.168.2.0 255.255.255.0 192.168.6.2 [RouterD] ip route-static 192.168.2.0 255.255.255.0 192.168.5.2 [RouterD] ip route-static 192.168.3.0 255.255.255.0 192.168.5.2 [RouterD] ip route-static 192.168.4.0 255.255.255.0 192.168.6.2
- 配置NQA测试例
# 在RouterA上配置NQA测试例。
[RouterA] nqa test-instance admin vlan10 [RouterA-nqa-admin-vlan10] test-type icmp [RouterA-nqa-admin-vlan10] destination-address ipv4 192.168.5.1 [RouterA-nqa-admin-vlan10] frequency 10 [RouterA-nqa-admin-vlan10] probe-count 2 [RouterA-nqa-admin-vlan10] start now [RouterA-nqa-admin-vlan10] quit [RouterA] nqa test-instance admin vlan20 [RouterA-nqa-admin-vlan20] test-type icmp [RouterA-nqa-admin-vlan20] destination-address ipv4 192.168.6.1 [RouterA-nqa-admin-vlan20] frequency 10 [RouterA-nqa-admin-vlan20] probe-count 2 [RouterA-nqa-admin-vlan20] start now [RouterA-nqa-admin-vlan20] quit
# 在RouterD上配置NQA测试例。
[RouterD] nqa test-instance admin vlan10 [RouterD-nqa-admin-vlan10] test-type icmp [RouterD-nqa-admin-vlan10] destination-address ipv4 192.168.3.1 [RouterD-nqa-admin-vlan10] frequency 10 [RouterD-nqa-admin-vlan10] probe-count 2 [RouterD-nqa-admin-vlan10] start now [RouterD-nqa-admin-vlan10] quit [RouterD] nqa test-instance admin vlan20 [RouterD-nqa-admin-vlan20] test-type icmp [RouterD-nqa-admin-vlan20] destination-address ipv4 192.168.4.1 [RouterD-nqa-admin-vlan20] frequency 10 [RouterD-nqa-admin-vlan20] probe-count 2 [RouterD-nqa-admin-vlan20] start now [RouterD-nqa-admin-vlan20] quit
- 配置NQA与静态路由联动
# 在RouterA上配置NQA与静态路由联动。
[RouterA] ip route-static 192.168.7.0 255.255.255.0 192.168.3.2 track nqa admin vlan10 [RouterA] ip route-static 192.168.7.0 255.255.255.0 192.168.4.2 track nqa admin vlan20 [RouterA] quit
# 在RouterD上配置NQA与静态路由联动。
[RouterD] ip route-static 192.168.1.0 255.255.255.0 192.168.5.2 track nqa admin vlan10 [RouterD] ip route-static 192.168.1.0 255.255.255.0 192.168.6.2 track nqa admin vlan20 [RouterD] ip route-static 192.168.2.0 255.255.255.0 192.168.5.2 track nqa admin vlan10 [RouterD] ip route-static 192.168.2.0 255.255.255.0 192.168.6.2 track nqa admin vlan20 [RouterD] quit
- 配置流分类
# 在RouterA上创建流分类vlan10、vlan20,分别匹配源地址为192.168.1.0/24和192.168.2.0/24网段的报文。
[RouterA] acl number 2000 [RouterA-acl-basic-2000] rule 10 permit source 192.168.1.0 0.0.0.255 [RouterA-acl-basic-2000] quit [RouterA] acl number 2001 [RouterA-acl-basic-2001] rule 20 permit source 192.168.2.0 0.0.0.255 [RouterA-acl-basic-2001] quit [RouterA] traffic classifier vlan10 [RouterA-classifier-vlan10] if-match acl 2000 [RouterA-classifier-vlan10] quit [RouterA] traffic classifier vlan20 [RouterA-classifier-vlan20] if-match acl 2001 [RouterA-classifier-vlan20] quit
# 在RouterD上创建流分类vlan10、vlan20,分别匹配目的地址为192.168.1.0/24和192.168.2.0/24网段的报文。
[RouterD] acl number 3000 [RouterD-acl-adv-3000] rule 10 permit ip destination 192.168.1.0 0.0.0.255 [RouterD-acl-adv-3000] quit [RouterD] acl number 3001 [RouterD-acl-adv-3001] rule 20 permit ip destination 192.168.2.0 0.0.0.255 [RouterD-acl-adv-3001] quit [RouterD] traffic classifier vlan10 [RouterD-classifier-vlan10] if-match acl 3000 [RouterD-classifier-vlan10] quit [RouterD] traffic classifier vlan20 [RouterD-classifier-vlan20] if-match acl 3001 [RouterD-classifier-vlan20] quit
- 配置流行为
# 在RouterA上创建流行为vlan10,配置NQA测试例admin vlan10与重定向到下一跳192.168.3.2/24联动,当NQA测试例检测到链路正常时,重定向生效;NQA测试例检测到链路故障时,按正常转发路径转发报文。
[RouterA] traffic behavior vlan10 [RouterA-behavior-vlan10] redirect ip-nexthop 192.168.3.2 track nqa admin vlan10 [RouterA-behavior-vlan10] quit
# 在RouterA上创建流行为vlan20,配置NQA测试例admin vlan20与重定向到下一跳192.168.4.2/24联动,当NQA测试例检测到链路正常时,重定向生效;NQA测试例检测到链路故障时,按正常转发路径转发报文。
[RouterA] traffic behavior vlan20 [RouterA-behavior-vlan20] redirect ip-nexthop 192.168.4.2 track nqa admin vlan20 [RouterA-behavior-vlan20] quit
# 在RouterD上创建流行为vlan10,配置NQA测试例admin vlan10与重定向到下一跳192.168.5.2/24联动,当NQA测试例检测到链路正常时,重定向生效;NQA测试例检测到链路故障时,按正常转发路径转发报文。
[RouterD] traffic behavior vlan10 [RouterD-behavior-vlan10] redirect ip-nexthop 192.168.5.2 track nqa admin vlan10 [RouterD-behavior-vlan10] quit
# 在RouterD上创建流行为vlan20,配置NQA测试例admin vlan20与重定向到下一跳192.168.6.2/24联动,当NQA测试例检测到链路正常时,重定向生效;NQA测试例检测到链路故障时,按正常转发路径转发报文。
[RouterD] traffic behavior vlan20 [RouterD-behavior-vlan20] redirect ip-nexthop 192.168.6.2 track nqa admin vlan20 [RouterD-behavior-vlan20] quit
- 配置流策略并应用到接口上
# 在RouterA上创建流策略vlan10、vlan20,将流分类和对应的流行为进行绑定。
[RouterA] traffic policy vlan10 [RouterA-trafficpolicy-vlan10] classifier vlan10 behavior vlan10 [RouterA-trafficpolicy-vlan10] quit [RouterA] traffic policy vlan20 [RouterA-trafficpolicy-vlan20] classifier vlan20 behavior vlan20 [RouterA-trafficpolicy-vlan20] quit
# 将流策略vlan10应用到接口GE1/0/0入方向,将流策略vlan20应用到接口GE2/0/0入方向。
[RouterA] interface gigabitethernet 1/0/0 [RouterA-GigabitEthernet1/0/0] traffic-policy vlan10 inbound [RouterA-GigabitEthernet1/0/0] quit [RouterA] interface gigabitethernet 2/0/0 [RouterA-GigabitEthernet2/0/0] traffic-policy vlan20 inbound [RouterA-GigabitEthernet2/0/0] quit
# 在RouterD上创建流策略vlan10,将流分类和对应的流行为进行绑定。
[RouterD] traffic policy vlan10 [RouterD-trafficpolicy-vlan10] classifier vlan10 behavior vlan10 [RouterD-trafficpolicy-vlan10] classifier vlan20 behavior vlan20 [RouterD-trafficpolicy-vlan10] quit
# 将流策略vlan10应用到接口GE3/0/0入方向。
[RouterD] interface gigabitethernet 3/0/0 [RouterD-GigabitEthernet3/0/0] traffic-policy vlan10 inbound [RouterD-GigabitEthernet3/0/0] quit
- 验证配置结果
# 查看RouterA接口的配置信息。
[RouterA] interface gigabitethernet 1/0/0 [RouterA-GigabitEthernet1/0/0] display this # interface GigabitEthernet1/0/0 ip address 192.168.1.1 255.255.255.0 traffic-policy vlan10 inbound # return [RouterA-GigabitEthernet1/0/0] quit [RouterA] interface gigabitethernet 2/0/0 [RouterA-GigabitEthernet2/0/0] display this # interface GigabitEthernet2/0/0 ip address 192.168.2.1 255.255.255.0 traffic-policy vlan20 inbound # return
# 查看流策略的配置信息。
[RouterA-GigabitEthernet2/0/0] quit [RouterA] display traffic policy user-defined User Defined Traffic Policy Information: Policy: vlan10 Classifier: vlan10 Operator: OR Behavior: vlan10 Redirect: Redirect ip-nexthop 192.168.3.2 track nqa admin vlan10 Precedence: 5 Policy: vlan20 Classifier: vlan20 Operator: OR Behavior: vlan20 Redirect: Redirect ip-nexthop 192.168.4.2 track nqa admin vlan20 Precedence: 5
配置文件
-
RouterA的配置文件
# sysname RouterA # acl number 2000 rule 10 permit source 192.168.1.0 0.0.0.255 acl number 2001 rule 20 permit source 192.168.2.0 0.0.0.255 # traffic classifier vlan10 operator or if-match acl 2000 traffic classifier vlan20 operator or if-match acl 2001 # traffic behavior vlan10 redirect ip-nexthop 192.168.3.2 track nqa admin vlan10 traffic behavior vlan20 redirect ip-nexthop 192.168.4.2 track nqa admin vlan20 # traffic policy vlan10 classifier vlan10 behavior vlan10 precedence 5 traffic policy vlan20 classifier vlan20 behavior vlan20 precedence 5 # interface GigabitEthernet1/0/0 ip address 192.168.1.1 255.255.255.0 traffic-policy vlan10 inbound # interface GigabitEthernet2/0/0 ip address 192.168.2.1 255.255.255.0 traffic-policy vlan20 inbound # interface GigabitEthernet3/0/0 ip address 192.168.3.1 255.255.255.0 # interface GigabitEthernet4/0/0 ip address 192.168.4.1 255.255.255.0 # ip route-static 192.168.5.0 255.255.255.0 192.168.3.2 ip route-static 192.168.6.0 255.255.255.0 192.168.4.2 ip route-static 192.168.7.0 255.255.255.0 192.168.3.2 track nqa admin vlan10 ip route-static 192.168.7.0 255.255.255.0 192.168.4.2 track nqa admin vlan20 # nqa test-instance admin vlan10 test-type icmp destination-address ipv4 192.168.5.1 frequency 10 probe-count 2 start now nqa test-instance admin vlan20 test-type icmp destination-address ipv4 192.168.6.1 frequency 10 probe-count 2 start now # return
-
RouterB的配置文件
# sysname RouterB # interface GigabitEthernet1/0/0 ip address 192.168.3.2 255.255.255.0 interface GigabitEthernet2/0/0 ip address 192.168.5.2 255.255.255.0 # ip route-static 192.168.1.0 255.255.255.0 192.168.3.1 ip route-static 192.168.2.0 255.255.255.0 192.168.3.1 ip route-static 192.168.7.0 255.255.255.0 192.168.5.1 # return
-
RouterC的配置文件
# sysname RouterC # interface GigabitEthernet1/0/0 ip address 192.168.4.2 255.255.255.0 interface GigabitEthernet2/0/0 ip address 192.168.6.2 255.255.255.0 # ip route-static 192.168.1.0 255.255.255.0 192.168.4.1 ip route-static 192.168.2.0 255.255.255.0 192.168.4.1 ip route-static 192.168.7.0 255.255.255.0 192.168.6.1 # return
-
RouterD的配置文件
# sysname RouterD # acl number 3000 rule 10 permit ip destination 192.168.1.0 0.0.0.255 acl number 3001 rule 20 permit ip destination 192.168.2.0 0.0.0.255 # traffic classifier vlan10 operator or if-match acl 3000 traffic classifier vlan20 operator or if-match acl 3001 # traffic behavior vlan10 redirect ip-nexthop 192.168.5.2 track nqa admin vlan10 traffic behavior vlan20 redirect ip-nexthop 192.168.6.2 track nqa admin vlan20 # traffic policy vlan10 classifier vlan10 behavior vlan10 precedence 5 classifier vlan20 behavior vlan20 precedence 10 # interface GigabitEthernet1/0/0 ip address 192.168.5.1 255.255.255.0 interface GigabitEthernet2/0/0 ip address 192.168.6.1 255.255.255.0 interface GigabitEthernet3/0/0 ip address 192.168.7.1 255.255.255.0 traffic-policy vlan10 inbound # ip route-static 192.168.1.0 255.255.255.0 192.168.5.2 track nqa admin vlan10 ip route-static 192.168.1.0 255.255.255.0 192.168.6.2 track nqa admin vlan20 ip route-static 192.168.2.0 255.255.255.0 192.168.5.2 track nqa admin vlan10 ip route-static 192.168.2.0 255.255.255.0 192.168.6.2 track nqa admin vlan20 ip route-static 192.168.3.0 255.255.255.0 192.168.5.2 ip route-static 192.168.4.0 255.255.255.0 192.168.6.2 # nqa test-instance admin vlan10 test-type icmp destination-address ipv4 192.168.3.1 frequency 10 probe-count 2 start now nqa test-instance admin vlan20 test-type icmp destination-address ipv4 192.168.4.1 frequency 10 probe-count 2 start now # return