配置接口策略路由示例

组网需求

图1所示,VLAN10和VLAN20是企业内部的两个部门,分别通过交换机连接到RouterA的GE1/0/0和GE2/0/0。HOSTA和HOSTB是同一部门内的两台主机,IP地址分别为192.168.1.2/24和192.168.1.3/24,属于192.168.1.0/24网段;HOSTC和HOSTD是另一部门的两台主机,IP地址分别为192.168.2.2/24和192.168.2.3/24,属于192.168.2.0/24网段。

RouterA可以通过RouterA→RouterB→RouterD连接到Internet,也可以通过RouterA→RouterC→RouterD连接到Internet,现要求:

  • 在两条链路都正常时,企业内部不同网段地址的报文通过不同的链路连接到Internet;
  • 当一条链路发生故障时,企业内部不同网段地址的报文都走无故障的链路,避免长时间的业务中断;
  • 当故障解决后,恢复报文从不同链路连接到Internet。

图1 配置接口策略路由组网图

设备

接口

IP地址

RouterA

GE1/0/0

192.168.1.1/24

GE2/0/0

192.168.2.1/24

GE3/0/0

192.168.3.1/24

GE4/0/0

192.168.4.1/24

RouterB

GE1/0/0

192.168.3.2/24

GE2/0/0

192.168.5.2/24

RouterC

GE1/0/0

192.168.4.2/24

GE2/0/0

192.168.6.2/24

RouterD

GE1/0/0

192.168.5.1/24

GE2/0/0

192.168.6.1/24

GE3/0/0

192.168.7.1/24

配置思路

采用重定向联动NQA测试例的方式实现策略路由,具体配置思路如下:

  1. 配置各设备接口IP地址及路由协议,使企业用户能通过RouterA访问Internet。
  2. 配置NQA测试例,检测链路RouterA→RouterB→RouterD和RouterA→RouterC→RouterD是否正常。
  3. 配置NQA和静态路由联动,实现当链路故障时,流量可以切换到正常链路。
  4. 配置流分类,匹配规则为匹配报文的源IP地址,实现基于源地址对报文进行分类。
  5. 配置流行为,即配置NQA与重定向联动,实现当NQA测试例检测到链路RouterA→RouterB→RouterD正常时,将满足规则的报文重定向到192.168.3.2/24,当NQA测试例检测到链路RouterA→RouterC→RouterD正常时,将满足规则的报文重定向到192.168.4.2/24。
  6. 配置流策略,绑定上述流分类和流行为,并应用到相应的接口,实现策略路由。

操作步骤
  1. 配置设备间的网络互通

    # 配置各接口的IP地址,以RouterA为例。其他设备的配置与之类似,详见配置文件。

    <Huawei> system-view
    [Huawei] sysname RouterA
    [RouterA] interface gigabitethernet 1/0/0
    [RouterA-GigabitEthernet1/0/0] ip address 192.168.1.1 24
    [RouterA-GigabitEthernet1/0/0] quit
    [RouterA] interface gigabitethernet 2/0/0
    [RouterA-GigabitEthernet2/0/0] ip address 192.168.2.1 24
    [RouterA-GigabitEthernet2/0/0] quit
    [RouterA] interface gigabitethernet 3/0/0
    [RouterA-GigabitEthernet3/0/0] ip address 192.168.3.1 24
    [RouterA-GigabitEthernet3/0/0] quit
    [RouterA] interface gigabitethernet 4/0/0
    [RouterA-GigabitEthernet4/0/0] ip address 192.168.4.1 24
    [RouterA-GigabitEthernet4/0/0] quit

    请配置SwitchA和SwitchB,使其能与RouterA互通。

    # 配置各设备间的静态路由。

    [RouterA] ip route-static 192.168.7.0 255.255.255.0 192.168.3.2
    [RouterA] ip route-static 192.168.7.0 255.255.255.0 192.168.4.2
    [RouterA] ip route-static 192.168.5.0 255.255.255.0 192.168.3.2
    [RouterA] ip route-static 192.168.6.0 255.255.255.0 192.168.4.2
    [RouterB] ip route-static 192.168.7.0 255.255.255.0 192.168.5.1
    [RouterB] ip route-static 192.168.1.0 255.255.255.0 192.168.3.1
    [RouterB] ip route-static 192.168.2.0 255.255.255.0 192.168.3.1
    [RouterC] ip route-static 192.168.7.0 255.255.255.0 192.168.6.1
    [RouterC] ip route-static 192.168.1.0 255.255.255.0 192.168.4.1
    [RouterC] ip route-static 192.168.2.0 255.255.255.0 192.168.4.1
    [RouterD] ip route-static 192.168.1.0 255.255.255.0 192.168.5.2
    [RouterD] ip route-static 192.168.1.0 255.255.255.0 192.168.6.2
    [RouterD] ip route-static 192.168.2.0 255.255.255.0 192.168.6.2
    [RouterD] ip route-static 192.168.2.0 255.255.255.0 192.168.5.2
    [RouterD] ip route-static 192.168.3.0 255.255.255.0 192.168.5.2
    [RouterD] ip route-static 192.168.4.0 255.255.255.0 192.168.6.2

  2. 配置NQA测试例

    # 在RouterA上配置NQA测试例。

    [RouterA] nqa test-instance admin vlan10
    [RouterA-nqa-admin-vlan10] test-type icmp
    [RouterA-nqa-admin-vlan10] destination-address ipv4 192.168.5.1
    [RouterA-nqa-admin-vlan10] frequency 10
    [RouterA-nqa-admin-vlan10] probe-count 2
    [RouterA-nqa-admin-vlan10] start now
    [RouterA-nqa-admin-vlan10] quit
    [RouterA] nqa test-instance admin vlan20
    [RouterA-nqa-admin-vlan20] test-type icmp
    [RouterA-nqa-admin-vlan20] destination-address ipv4 192.168.6.1
    [RouterA-nqa-admin-vlan20] frequency 10
    [RouterA-nqa-admin-vlan20] probe-count 2
    [RouterA-nqa-admin-vlan20] start now
    [RouterA-nqa-admin-vlan20] quit

    # 在RouterD上配置NQA测试例。

    [RouterD] nqa test-instance admin vlan10
    [RouterD-nqa-admin-vlan10] test-type icmp
    [RouterD-nqa-admin-vlan10] destination-address ipv4 192.168.3.1
    [RouterD-nqa-admin-vlan10] frequency 10
    [RouterD-nqa-admin-vlan10] probe-count 2
    [RouterD-nqa-admin-vlan10] start now
    [RouterD-nqa-admin-vlan10] quit
    [RouterD] nqa test-instance admin vlan20
    [RouterD-nqa-admin-vlan20] test-type icmp
    [RouterD-nqa-admin-vlan20] destination-address ipv4 192.168.4.1
    [RouterD-nqa-admin-vlan20] frequency 10
    [RouterD-nqa-admin-vlan20] probe-count 2
    [RouterD-nqa-admin-vlan20] start now
    [RouterD-nqa-admin-vlan20] quit

  3. 配置NQA与静态路由联动

    # 在RouterA上配置NQA与静态路由联动。

    [RouterA] ip route-static 192.168.7.0 255.255.255.0 192.168.3.2 track nqa admin vlan10
    [RouterA] ip route-static 192.168.7.0 255.255.255.0 192.168.4.2 track nqa admin vlan20
    [RouterA] quit

    # 在RouterD上配置NQA与静态路由联动。

    [RouterD] ip route-static 192.168.1.0 255.255.255.0 192.168.5.2 track nqa admin vlan10
    [RouterD] ip route-static 192.168.1.0 255.255.255.0 192.168.6.2 track nqa admin vlan20
    [RouterD] ip route-static 192.168.2.0 255.255.255.0 192.168.5.2 track nqa admin vlan10
    [RouterD] ip route-static 192.168.2.0 255.255.255.0 192.168.6.2 track nqa admin vlan20
    [RouterD] quit

  4. 配置流分类

    # 在RouterA上创建流分类vlan10、vlan20,分别匹配源地址为192.168.1.0/24和192.168.2.0/24网段的报文。

    [RouterA] acl number 2000
    [RouterA-acl-basic-2000] rule 10 permit source 192.168.1.0 0.0.0.255
    [RouterA-acl-basic-2000] quit
    [RouterA] acl number 2001
    [RouterA-acl-basic-2001] rule 20 permit source 192.168.2.0 0.0.0.255
    [RouterA-acl-basic-2001] quit
    [RouterA] traffic classifier vlan10
    [RouterA-classifier-vlan10] if-match acl 2000
    [RouterA-classifier-vlan10] quit
    [RouterA] traffic classifier vlan20
    [RouterA-classifier-vlan20] if-match acl 2001
    [RouterA-classifier-vlan20] quit

    # 在RouterD上创建流分类vlan10、vlan20,分别匹配目的地址为192.168.1.0/24和192.168.2.0/24网段的报文。

    [RouterD] acl number 3000
    [RouterD-acl-adv-3000] rule 10 permit ip destination 192.168.1.0 0.0.0.255
    [RouterD-acl-adv-3000] quit
    [RouterD] acl number 3001
    [RouterD-acl-adv-3001] rule 20 permit ip destination 192.168.2.0 0.0.0.255
    [RouterD-acl-adv-3001] quit
    [RouterD] traffic classifier vlan10
    [RouterD-classifier-vlan10] if-match acl 3000
    [RouterD-classifier-vlan10] quit
    [RouterD] traffic classifier vlan20
    [RouterD-classifier-vlan20] if-match acl 3001
    [RouterD-classifier-vlan20] quit

  5. 配置流行为

    # 在RouterA上创建流行为vlan10,配置NQA测试例admin vlan10与重定向到下一跳192.168.3.2/24联动,当NQA测试例检测到链路正常时,重定向生效;NQA测试例检测到链路故障时,按正常转发路径转发报文。

    [RouterA] traffic behavior vlan10
    [RouterA-behavior-vlan10] redirect ip-nexthop 192.168.3.2 track nqa admin vlan10
    [RouterA-behavior-vlan10] quit

    # 在RouterA上创建流行为vlan20,配置NQA测试例admin vlan20与重定向到下一跳192.168.4.2/24联动,当NQA测试例检测到链路正常时,重定向生效;NQA测试例检测到链路故障时,按正常转发路径转发报文。

    [RouterA] traffic behavior vlan20
    [RouterA-behavior-vlan20] redirect ip-nexthop 192.168.4.2 track nqa admin vlan20
    [RouterA-behavior-vlan20] quit

    # 在RouterD上创建流行为vlan10,配置NQA测试例admin vlan10与重定向到下一跳192.168.5.2/24联动,当NQA测试例检测到链路正常时,重定向生效;NQA测试例检测到链路故障时,按正常转发路径转发报文。

    [RouterD] traffic behavior vlan10
    [RouterD-behavior-vlan10] redirect ip-nexthop 192.168.5.2 track nqa admin vlan10
    [RouterD-behavior-vlan10] quit

    # 在RouterD上创建流行为vlan20,配置NQA测试例admin vlan20与重定向到下一跳192.168.6.2/24联动,当NQA测试例检测到链路正常时,重定向生效;NQA测试例检测到链路故障时,按正常转发路径转发报文。

    [RouterD] traffic behavior vlan20
    [RouterD-behavior-vlan20] redirect ip-nexthop 192.168.6.2 track nqa admin vlan20
    [RouterD-behavior-vlan20] quit

  6. 配置流策略并应用到接口上

    # 在RouterA上创建流策略vlan10、vlan20,将流分类和对应的流行为进行绑定。

    [RouterA] traffic policy vlan10
    [RouterA-trafficpolicy-vlan10] classifier vlan10 behavior vlan10
    [RouterA-trafficpolicy-vlan10] quit
    [RouterA] traffic policy vlan20
    [RouterA-trafficpolicy-vlan20] classifier vlan20 behavior vlan20
    [RouterA-trafficpolicy-vlan20] quit

    # 将流策略vlan10应用到接口GE1/0/0入方向,将流策略vlan20应用到接口GE2/0/0入方向。

    [RouterA] interface gigabitethernet 1/0/0
    [RouterA-GigabitEthernet1/0/0] traffic-policy vlan10 inbound
    [RouterA-GigabitEthernet1/0/0] quit
    [RouterA] interface gigabitethernet 2/0/0
    [RouterA-GigabitEthernet2/0/0] traffic-policy vlan20 inbound
    [RouterA-GigabitEthernet2/0/0] quit

    # 在RouterD上创建流策略vlan10,将流分类和对应的流行为进行绑定。

    [RouterD] traffic policy vlan10
    [RouterD-trafficpolicy-vlan10] classifier vlan10 behavior vlan10
    [RouterD-trafficpolicy-vlan10] classifier vlan20 behavior vlan20
    [RouterD-trafficpolicy-vlan10] quit

    # 将流策略vlan10应用到接口GE3/0/0入方向。

    [RouterD] interface gigabitethernet 3/0/0
    [RouterD-GigabitEthernet3/0/0] traffic-policy vlan10 inbound
    [RouterD-GigabitEthernet3/0/0] quit

  7. 验证配置结果

    # 查看RouterA接口的配置信息。

    [RouterA] interface gigabitethernet 1/0/0
    [RouterA-GigabitEthernet1/0/0] display this
    #                                                                               
    interface GigabitEthernet1/0/0         
     ip address 192.168.1.1 255.255.255.0                                           
     traffic-policy vlan10 inbound                                                  
    #                                                                               
    return                                                                          
    [RouterA-GigabitEthernet1/0/0] quit
    [RouterA] interface gigabitethernet 2/0/0
    [RouterA-GigabitEthernet2/0/0] display this
    #                                                                               
    interface GigabitEthernet2/0/0         
     ip address 192.168.2.1 255.255.255.0                                           
     traffic-policy vlan20 inbound                                                  
    #                                                                               
    return                                                                          
    

    # 查看流策略的配置信息。

    [RouterA-GigabitEthernet2/0/0] quit
    [RouterA] display traffic policy user-defined
      User Defined Traffic Policy Information:                                      
      Policy: vlan10                                                                
       Classifier: vlan10                                                           
        Operator: OR                                                                
         Behavior: vlan10                                                           
          Redirect:                                                                 
            Redirect ip-nexthop 192.168.3.2 track nqa admin vlan10    
         Precedence: 5              
                                                                                    
      Policy: vlan20                                                                
       Classifier: vlan20                                                           
        Operator: OR                                                                
         Behavior: vlan20                                                           
          Redirect:                                                                 
            Redirect ip-nexthop 192.168.4.2 track nqa admin vlan20 
         Precedence: 5                 
                                                                                    

配置文件
  • RouterA的配置文件

    #
     sysname RouterA
    #                                                                               
    acl number 2000                                                                                                                     
     rule 10 permit source 192.168.1.0 0.0.0.255                                                                                                
    acl number 2001                                                                                                                     
     rule 20 permit source 192.168.2.0 0.0.0.255  
    #                                                                               
    traffic classifier vlan10 operator or                                           
     if-match acl 2000
    traffic classifier vlan20 operator or                                           
     if-match acl 2001
    #                                                                               
    traffic behavior vlan10                                                         
     redirect ip-nexthop 192.168.3.2 track nqa admin vlan10                         
    traffic behavior vlan20                                                         
     redirect ip-nexthop 192.168.4.2 track nqa admin vlan20                         
    #                                                                               
    traffic policy vlan10                                                           
     classifier vlan10 behavior vlan10 precedence 5                                             
    traffic policy vlan20                                                           
     classifier vlan20 behavior vlan20 precedence 5                                             
    #                                                                               
    interface GigabitEthernet1/0/0
     ip address 192.168.1.1 255.255.255.0                                           
     traffic-policy vlan10 inbound                                                  
    #                                                                               
    interface GigabitEthernet2/0/0
     ip address 192.168.2.1 255.255.255.0                                           
     traffic-policy vlan20 inbound                                                  
    #
    interface GigabitEthernet3/0/0
     ip address 192.168.3.1 255.255.255.0                                           
    #                                                                               
    interface GigabitEthernet4/0/0
     ip address 192.168.4.1 255.255.255.0                                           
    #
    ip route-static 192.168.5.0 255.255.255.0 192.168.3.2                           
    ip route-static 192.168.6.0 255.255.255.0 192.168.4.2                           
    ip route-static 192.168.7.0 255.255.255.0 192.168.3.2 track nqa admin vlan10    
    ip route-static 192.168.7.0 255.255.255.0 192.168.4.2 track nqa admin vlan20    
    #                                                                               
    nqa test-instance admin vlan10                                                  
     test-type icmp                                                                 
     destination-address ipv4 192.168.5.1                                           
     frequency 10 
     probe-count 2
     start now
    nqa test-instance admin vlan20                                                  
     test-type icmp                                                                 
     destination-address ipv4 192.168.6.1                                           
     frequency 10 
     probe-count 2
     start now
    #                                                                               
    return
  • RouterB的配置文件

    #
     sysname RouterB
    #                                                                               
    interface GigabitEthernet1/0/0
     ip address 192.168.3.2 255.255.255.0    
    interface GigabitEthernet2/0/0
     ip address 192.168.5.2 255.255.255.0    
    # 
    ip route-static 192.168.1.0 255.255.255.0 192.168.3.1    
    ip route-static 192.168.2.0 255.255.255.0 192.168.3.1
    ip route-static 192.168.7.0 255.255.255.0 192.168.5.1    
    # 
    return
  • RouterC的配置文件

    #
     sysname RouterC
    #                                                                               
    interface GigabitEthernet1/0/0
     ip address 192.168.4.2 255.255.255.0    
    interface GigabitEthernet2/0/0
     ip address 192.168.6.2 255.255.255.0    
    # 
    ip route-static 192.168.1.0 255.255.255.0 192.168.4.1    
    ip route-static 192.168.2.0 255.255.255.0 192.168.4.1
    ip route-static 192.168.7.0 255.255.255.0 192.168.6.1    
    # 
    return
  • RouterD的配置文件

    #
     sysname RouterD
    #
    acl number 3000
     rule 10 permit ip destination 192.168.1.0 0.0.0.255
    acl number 3001
     rule 20 permit ip destination 192.168.2.0 0.0.0.255
    #
    traffic classifier vlan10 operator or
     if-match acl 3000
    traffic classifier vlan20 operator or
     if-match acl 3001
    #
    traffic behavior vlan10
     redirect ip-nexthop 192.168.5.2 track nqa admin vlan10
    traffic behavior vlan20
     redirect ip-nexthop 192.168.6.2 track nqa admin vlan20
    #
    traffic policy vlan10
     classifier vlan10 behavior vlan10 precedence 5
     classifier vlan20 behavior vlan20 precedence 10
    #                                                                               
    interface GigabitEthernet1/0/0
     ip address 192.168.5.1 255.255.255.0    
    interface GigabitEthernet2/0/0
     ip address 192.168.6.1 255.255.255.0    
    interface GigabitEthernet3/0/0
     ip address 192.168.7.1 255.255.255.0    
     traffic-policy vlan10 inbound
    # 
    ip route-static 192.168.1.0 255.255.255.0 192.168.5.2 track nqa admin vlan10
    ip route-static 192.168.1.0 255.255.255.0 192.168.6.2 track nqa admin vlan20
    ip route-static 192.168.2.0 255.255.255.0 192.168.5.2 track nqa admin vlan10
    ip route-static 192.168.2.0 255.255.255.0 192.168.6.2 track nqa admin vlan20
    ip route-static 192.168.3.0 255.255.255.0 192.168.5.2                           
    ip route-static 192.168.4.0 255.255.255.0 192.168.6.2                           
    #                                                                               
    nqa test-instance admin vlan10                                                  
     test-type icmp                                                                 
     destination-address ipv4 192.168.3.1                                           
     frequency 10 
     probe-count 2
     start now
    nqa test-instance admin vlan20                                                  
     test-type icmp                                                                 
     destination-address ipv4 192.168.4.1                                           
     frequency 10 
     probe-count 2
     start now
    #
    return
  • 28
    点赞
  • 21
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值