华为NQA与策略路由

 

 

 

 

ISP1、ISP2、NET配置OSPF进行模拟

 

[NET]int GigabitEthernet 0/0/0

[NET-GigabitEthernet0/0/0]ip add 100.1.1.2 24

[NET-GigabitEthernet0/0/0]quit

[NET]int GigabitEthernet 0/0/1

[NET-GigabitEthernet0/0/1]ip add 200.1.1.2 24

[NET-GigabitEthernet0/0/1]quit

[NET]int lo0

[NET-LoopBack0]ip add 8.8.8.8 24

[NET-LoopBack0]quit

 

[NET]ospf 1 router-id 3.3.3.3

[NET-ospf-1]area 0

[NET-ospf-1-area-0.0.0.0]network 100.1.1.0 0.0.0.255

[NET-ospf-1-area-0.0.0.0]network 200.1.1.0 0.0.0.255

[NET-ospf-1-area-0.0.0.0]quit

[NET-ospf-1]import-route direct type 1 //发布直连路由

[NET-ospf-1]quit

 

[ISP1]int GigabitEthernet 0/0/1

[ISP1-GigabitEthernet0/0/1]ip add 100.1.1.1 24

[ISP1-GigabitEthernet0/0/1]quit

[ISP1]int GigabitEthernet 0/0/0

[ISP1-GigabitEthernet0/0/0]ip add 10.1.1.1 24

[ISP1-GigabitEthernet0/0/0]quit

 

[ISP1]ospf 1 router-id 1.1.1.1

[ISP1-ospf-1]area 0

[ISP1-ospf-1-area-0.0.0.0]network 100.1.1.0 0.0.0.255

[ISP1-ospf-1-area-0.0.0.0]quit

[ISP1-ospf-1]import-route direct type 1  //发布直连路由

[ISP1-ospf-1]quit

 

 

 

[ISP2]int GigabitEthernet 0/0/1

[ISP2-GigabitEthernet0/0/1]ip add 200.1.1.1 24

[ISP2-GigabitEthernet0/0/1]quit

[ISP2]int GigabitEthernet 0/0/0

[ISP2-GigabitEthernet0/0/0]ip add 20.1.1.1 24

[ISP2-GigabitEthernet0/0/0]quit

 

[ISP2]ospf 1 router-id 2.2.2.2

[ISP2-ospf-1-area-0.0.0.0]network 200.1.1.0 0.0.0.255

[ISP2-ospf-1-area-0.0.0.0]quit

[ISP2-ospf-1]import-route direct type 1  //发布直连路由

[ISP2-ospf-1]quit

 

 

 

---------------------------------------------------------------

路由器GW接口配置

 

[GW]int GigabitEthernet 1/0/0

[GW-GigabitEthernet1/0/0]ip add 10.1.1.2 24

[GW-GigabitEthernet1/0/0]quit

 

[GW]int GigabitEthernet 2/0/0

[GW-GigabitEthernet2/0/0]ip add 20.1.1.2 24

[GW-GigabitEthernet2/0/0]quit

 

[GW]int GigabitEthernet 0/0/0

[GW-GigabitEthernet0/0/0]ip add 1.1.1.1 24

[GW-GigabitEthernet0/0/0]quit

 

[GW]ip route-static 192.168.0.0 255.255.0.0 1.1.1.2 //配置到内网的路由

 

---------------------------------------------------------------------

交换机SW配置

 

[SW]vlan batch 10 20 100

 

[SW]int vlan 10

[SW-Vlanif10]ip add 192.168.1.254 24

[SW-Vlanif10]quit

[SW]int vlan 20

[SW-Vlanif20]ip add 192.168.2.254 24

[SW-Vlanif20]quit

[SW]int vlan 100

[SW-Vlanif100]ip add 1.1.1.2 24

[SW-Vlanif100]quit

 

 

[SW]int Ethernet0/0/3

[SW-Ethernet0/0/3]port link-type access         

[SW-Ethernet0/0/3]port default vlan 100

[SW-Ethernet0/0/3]quit

[SW]int Ethernet0/0/1

[SW-Ethernet0/0/1]port link-type access         

[SW-Ethernet0/0/1]port default vlan 10

[SW-Ethernet0/0/1]quit

[SW]int Ethernet0/0/2

[SW-Ethernet0/0/2]port link-type access         

[SW-Ethernet0/0/2]port default vlan 20

[SW-Ethernet0/0/2]quit

 

[SW]ip route-static 0.0.0.0 0.0.0.0 1.1.1.1 //配置默认路由

 

--------------------------------------------------------------------

 

GW上配置NAT

 

[GW]acl 2000

[GW-acl-basic-2000]rule permit source any

[GW-acl-basic-2000]quit

 

[GW]int GigabitEthernet 1/0/0

[GW-GigabitEthernet1/0/0]nat outbound 2000

[GW-GigabitEthernet1/0/0]quit

 

[GW]int GigabitEthernet 2/0/0

[GW-GigabitEthernet2/0/0]nat outbound 2000

[GW-GigabitEthernet2/0/0]quit

 

 

GW上配置NQA

 

[GW]nqa test-instance admin nqa_icmp   //创建一个nqa测试实例，测试管理账户名为admin，测试实例名称为nqa_icmp

[GW-nqa-admin-nqa_icmp]test-type icmp   //测试类型为icmp协议测试

[GW-nqa-admin-nqa_icmp]frequency 10   //指定连续两次探测时间间隔为10s

[GW-nqa-admin-nqa_icmp]probe-count 2   //指定一次探测进行的测试次数

[GW-nqa-admin-nqa_icmp]destination-address ipv4 100.1.1.1   //要测试的对端ip地址

[GW-nqa-admin-nqa_icmp]start now   //启动当前测试例

[GW-nqa-admin-nqa_icmp]quit

 

[GW-nqa-admin-nqa_icmp]stop   //停止当前测试例*不需要配置

 

[GW]dis nqa results  //查看网络测试性能

 

 

GW上配置策略路由：vlan10的流量走isp1，vlan20的流量走isp2

并且配置策略路由与NQA联动

 

1、创建ACL，定义策略路由的流量

[GW]acl 2001

[GW-acl-basic-2001]rule permit source 192.168.1.0 0.0.0.255

[GW-acl-basic-2001]quit

 

 

2、配置流分类，匹配ACL

 

[GW]traffic classifier vlan10 operator or

[GW-classifier-vlan10]if-match acl 2001

[GW-classifier-vlan10]quit

 

 

3、配置流行为，设置下一跳地址，并且配置NQA检测

 

[GW]traffic behavior isp1

[GW-behavior-isp1]redirect ip-nexthop 10.1.1.1 track nqa admin nqa_icmp     

[GW-behavior-isp1]quit

 

 

4、配置流策略，关联流分类和流行为

[GW]traffic policy policy_nqa

[GW-trafficpolicy-policy_test]classifier vlan10 behavior isp1

[GW-trafficpolicy-policy_test]quit

 

 

5、在接口上应用流策略，在路由器的内网口应用策略

[GW]int GigabitEthernet 0/0/0

[GW-GigabitEthernet0/0/0]traffic-policy policy_nqa inbound

[GW-GigabitEthernet0/0/0]quit

 

**[GW]ip route-static 100.1.1.1 255.255.255.0 10.1.1.1

配置到NQA监测地址的路由

注：一定要确保到监测的地址能通

 

[GW]ip route-static 0.0.0.0 0.0.0.0 20.1.1.1

配置除了策略路由未匹配的流量的路由：走默认路由

并且当策略路由失效的时候，vlan10的流量通过默认路由走isp2，起到冗余作用

 

----------------------------------------------------------------------

测试验证

 

链路正常的情况下，vlan10的流量走isp1，vlan20的流量走isp2

 

 

当NQA监测的地址出现故障的时候，vlan10的流量走isp2