如上图所示,我朋友一个项目,核心路由器是7206,然后接三个PIX535,分别用与移动、电信、网通的互联,业主要求选路优化、自动切换,我搭建了上图来模拟实际环境,其中,R7与R4,5,6之间放置一个交换机用于模拟由于光电收发器引起的以太网终结性。具体思路采用电信网络写静态路由,默认走移动,并在用RTR/SLA检测网络的可达性。对于IP规划,用172.16.xy.0/30来进行Rx与Ry互联,其中172.16.xy.1用于x.y里2个数字较小的路由器上,即:R3和R6的互联,R3端:172.16.36.1/30,R6端是172.16.36.2/30。另外:
172.16.14.0/30----模拟移动网络
172.16.25.0/30----模拟电信网络
172.16.36.0/30----模拟网通网络
------------实际情况里因为不知道移动的IP地址段,所以具体路由写电信和网通的,默认的写移动的。下面是一些关键步骤的讲解:
R4,R5,R6上的配置(以R4为例)
1、 配置NAT和路由
ip route 0.0.0.0 0.0.0.0 172.16.14.1---------指向移动端的IP
ip route 10.0.0.0 255.0.0.0 172.16.47.2---------回指,通信是双向的
int s1/0
ip nat out
int e0/0
ip nat in
access-list 1 permit 10.0.0.0 0.255.255.255
ip nat inside source list 1 inter s1/0 overload
2、 配置ACL-------------------------为什么要这样配置呢?实际情况中也是必须的,你猜猜
no access-list 100
access-list 100 deny icmp any host 172.16.25.1 log
access-list 100 deny icmp any host 172.16.36.1 log---log参数不需要,此处是为了观察实验效果
access-list 100 permit icmp any any
int e0/0
ip access-group 100 in
R7上的配置
1、配置SLA
ip sla monitor 1--------建立监视组--监视移动端的IP
type echo protocol ipIcmpEcho 172.16.14.1 source-interface Loopback0---采用icmp协议来监视,即发出icmp echo包来探测对端的可达性,source-interface,指定探测数据的源IP,
timeout 999----999ms,不能大于frequency的值
frequency 1--------1s,即1s 发送一个
exit----------------下同
ip sla monitor 2--------建立监视组--监视电信端的IP
type echo protocol ipIcmpEcho 172.16.25.1 source-interface Loopback0
timeout 999
frequency 1
exit
ip sla monitor 3--------建立监视组--监视网通端的IP
type echo protocol ipIcmpEcho 172.16.36.1 source-interface Loopback0
timeout 999
frequency 1
exit
ip sla monitor schedule 1 life forever start-time now
ip sla monitor schedule 2 life forever start-time now
ip sla monitor schedule 3 life forever start-time now--------定义sla监视组的schedule,life ,forever,开始时间,now,看的懂的吧。
2、定义track组
track 111 rtr 1 reachability
track 222 rtr 2 reachability
track 333 rtr 3 reachability
3、 写路由
ip route 0.0.0.0 0.0.0.0 172.16.47.1 name to_cmobile track 111---------------------------------①
ip route 0.0.0.0 0.0.0.0 172.16.57.1 name to_telecom track 222 22-----------------------------②
ip route 0.0.0.0 0.0.0.0 172.16.67.1 name to_cnc track 333 33----------------------------------③
ip route 172.16.25.0 255.255.255.252 172.16.57.1 name to_telecom track 222---------------④
ip route 172.16.36.0 255.255.255.252 172.16.67.1 name to_cnc track 333--------------------⑤
这里的路由是关键,路由写的好坏决定RTR/SLA能否真正发挥作用,下面对5条路由进行详细点评:
第①条:主默认路由,在网络正常的情况下,除电信网通的具体路由之外,都走移动这一条线路,Ad值是默认的1,并根据track组111的情况来决定是否将此路由放入到路由表中,即当移动端IP可达时,放入7206的路由表里。
第②条:指向电信的默认路由,AD为22,当移动链路失效时,TRACK111 time out,路由①消失,此时,路由②出现在7206的路由表里,保证网络的畅通并无路由黑洞。
第③条:和第二条一样,不同的是AD为33。
第④条:此条其实应该代表了一批静态路由,汇总后的CHINANET的路由大概有250条左右,并根据track组的状态来决定此一批静态路由是否出现在7206的路由表里。
第⑤条:和第四条一样,代表了大概160条网通路由。
4、 RTR跨三层监测的逻辑死循环
由于此case中,RTR监测组监测的是目标已经跨了三层,所以存在一个逻辑死循环,以R7--SW----R4---R1,为例,R7跨了R4在监测R1上与R4互连的端口,当检测到那个端口down掉之后,相关路由按计划的消失,但问题出现了,但移动的这根线路恢复时,
一方面:不考虑RTR/SLA,R7本身需要一条路由指向移动端的互联端口,或者静态,或者动态,此处为默认路由,没有这一条默认路由,就无法到达被监测的互联端口。
另一方面:移动的线路down掉之后,TRACK111监测组还一直在工作:他不断的还以R7的 L0的IP为源IP,向被监测的互联端口发送ICMP ECHO 探测包,只要结果是time out,路由器就不会把R4上的默认路由放入到路由表里。OK,逻辑死循环出现,路由器无法在物理线路回复后将流量回归。
5、 一个CISCO隐藏命令 RTR RESET
RTR RESET这里介绍一个关于RTR的隐藏命令:RTR RESET(CONFIG模式下),此命令的作用是讲SLA/RTR功能重置,并在将配置文件里关于SLA的配置去掉,用了此命令后,路由恢复、流量逐渐回归
6、 使用RESET之后的配置恢复
这个。。。好象没什么好讲的,最简单的是在特权模式下:config mem,将内存中的配置信息重新写入到NVRAM里的配置文件里。一切正常
对于死循环的解决方案:
对于此死循环的解决方案:在原配置中,为了ICMP ECHO REQUEST包到达被探测目的IP,是采用了默认路由或者与模拟ISP网段的几个路由,经鸟人小灰狼的提醒,把达到被探测目的IP写几条专门的路由,并且不track(的确也没track的必要),这样一但线路恢复,也不会因为死循环而致使探测包无法到达目的,相关配置就是增加以下三条路由:
ip route 172.16.14.1 255.255.255.255 172.16.47.1 name rtr-cnc
ip route 172.16.25.1 255.255.255.255 172.16.57.1 name rtr-cm
ip route 172.16.36.1 255.255.255.255 172.16.67.1 name rtr-telecom
7、 上面R4,R5,R6上的那些ACL是干什么的?
ISP之间是互联互通的,如果不用这些ACL deny掉相关的ICMP包,将会引起网络的不端的震荡。
我们还是以R4为例来说明,假设移动的线路断掉了,那原来的默认路由消失,去电信的AD为22的静态路由出现在路由表里,此时,SLA MONITOR 1的ICMP ECHO包通过此条默认路由,跨越ISP,到达了移动端的IP,这样一来,TRACK 111 返回的给路由器的信息就是OK,那么原先AD为1的路由取代了AD为22的默认路由出现在了路由表里,接着,SLA在路由收敛完成,CEF表重写完毕后,SLA MOTITOR 1 发出的ICMP ECHO包又time out了,因为实际上移动进来的线路是断开着的…………于是网络开始大震荡,震荡的比西门大官人的床还要厉害。
附配置:
R1(config-if)#do sh ru
Building configuration...
Current configuration : 1063 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip subnet-zero
!
!
no ip domain lookup
!
!
!
!
!
interface Loopback0
ip address 11.11.11.1 255.255.255.255
!
interface Serial1/0
ip address 172.16.14.1 255.255.255.252
serial restart-delay 0
no fair-queue
!
interface Serial1/1
ip address 172.16.12.1 255.255.255.252
serial restart-delay 0
!
interface Serial1/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/3
no ip address
shutdown
serial restart-delay 0
!
router ospf 100
log-adjacency-changes
network 11.11.11.1 0.0.0.0 area 0
network 172.16.12.0 0.0.0.3 area 0
network 172.16.14.0 0.0.0.3 area 0
!
ip http server
ip classless
!
!
!
line con 0
exec-timeout 0 0
line aux 0
line vty 0 4
login
!
!
!
end
===================================================
R2#do sh run
^
% Invalid input detected at '^' marker.
R2#sh run
Building configuration...
Current configuration : 1078 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R2
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip subnet-zero
!
!
no ip domain lookup
!
!
!
!
!
interface Loopback0
ip address 22.22.22.1 255.255.255.255
!
interface Serial1/0
ip address 172.16.12.2 255.255.255.252
serial restart-delay 0
no fair-queue
!
interface Serial1/1
ip address 172.16.23.1 255.255.255.252
serial restart-delay 0
!
interface Serial1/2
ip address 172.16.25.1 255.255.255.252
serial restart-delay 0
!
interface Serial1/3
no ip address
shutdown
serial restart-delay 0
!
router ospf 100
log-adjacency-changes
network 22.22.22.1 0.0.0.0 area 0
network 172.16.12.0 0.0.0.3 area 0
network 172.16.23.0 0.0.0.3 area 0
network 172.16.25.0 0.0.0.3 area 0
!
ip http server
ip classless
!
!
!
line con 0
exec-timeout 0 0
line aux 0
line vty 0 4
login
!
!
!
end
=========================================================
r3#sh run
Building configuration...
Current configuration : 1063 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R3
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip subnet-zero
!
!
no ip domain lookup
!
!
!
!
!
interface Loopback0
ip address 33.33.33.1 255.255.255.255
!
interface Serial1/0
ip address 172.16.23.2 255.255.255.252
serial restart-delay 0
no fair-queue
!
interface Serial1/1
ip address 172.16.36.1 255.255.255.252
serial restart-delay 0
!
interface Serial1/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/3
no ip address
shutdown
serial restart-delay 0
!
router ospf 100
log-adjacency-changes
network 33.33.33.1 0.0.0.0 area 0
network 172.16.23.0 0.0.0.3 area 0
network 172.16.36.0 0.0.0.3 area 0
!
ip http server
ip classless
!
!
!
line con 0
exec-timeout 0 0
line aux 0
line vty 0 4
login
!
!
!
end
===========================================================
R4(config-if)#do sh run
Building configuration...
Current configuration : 1360 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R4
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip subnet-zero
!
!
no ip domain lookup
!
!
!
!
!
interface Loopback0
ip address 44.44.44.1 255.255.255.255
!
interface Ethernet0/0
ip address 172.16.47.1 255.255.255.252
ip access-group 100 in
ip nat inside
full-duplex
!
interface Ethernet0/1
no ip address
shutdown
half-duplex
!
interface Ethernet0/2
no ip address
shutdown
half-duplex
!
interface Ethernet0/3
no ip address
shutdown
half-duplex
!
interface Serial1/0
ip address 172.16.14.2 255.255.255.252
ip nat outside
serial restart-delay 0
no fair-queue
!
interface Serial1/1
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/3
no ip address
shutdown
serial restart-delay 0
!
ip nat inside source list 1 interface Serial1/0 overload
ip http server
ip classless
ip route 0.0.0.0 0.0.0.0 172.16.14.1
ip route 10.0.0.0 255.0.0.0 172.16.47.2
!
!
access-list 1 permit 10.0.0.0 0.255.255.255
access-list 100 deny icmp any host 172.16.25.1 log
access-list 100 deny icmp any host 172.16.36.1 log
access-list 100 permit icmp any any
!
line con 0
exec-timeout 0 0
line aux 0
line vty 0 4
login
!
!
!
end
===========================================================
R5(config-if)#do sh run
Building configuration...
Current configuration : 1385 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R5
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip subnet-zero
!
!
no ip domain lookup
!
!
!
!
!
interface Loopback0
ip address 55.55.55.1 255.255.255.255
!
interface Ethernet0/0
ip address 172.16.57.1 255.255.255.252
ip access-group 100 in
ip access-group 100 out
ip nat inside
full-duplex
!
interface Ethernet0/1
no ip address
shutdown
half-duplex
!
interface Ethernet0/2
no ip address
shutdown
half-duplex
!
interface Ethernet0/3
no ip address
shutdown
half-duplex
!
interface Serial1/0
no ip address
shutdown
serial restart-delay 0
no fair-queue
!
interface Serial1/1
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/2
ip address 172.16.25.2 255.255.255.252
ip nat outside
serial restart-delay 0
!
interface Serial1/3
no ip address
shutdown
serial restart-delay 0
!
ip nat inside source list 1 interface Serial1/2 overload
ip http server
ip classless
ip route 0.0.0.0 0.0.0.0 172.16.25.1
ip route 10.0.0.0 255.0.0.0 172.16.57.2
!
!
access-list 1 permit 10.0.0.0 0.255.255.255
access-list 100 deny icmp any host 172.16.14.1 log
access-list 100 deny icmp any host 172.16.36.1 log
access-list 100 permit icmp any any
!
line con 0
exec-timeout 0 0
line aux 0
line vty 0 4
login
!
!
!
end
===================================================================
R6(config-if)#do sh run
Building configuration...
Current configuration : 1396 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R6
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip subnet-zero
!
!
no ip domain lookup
!
!
!
!
!
interface Loopback0
ip address 66.66.66.1 255.255.255.255
!
interface Ethernet0/0
ip address 172.16.67.1 255.255.255.252
ip access-group 100 in
ip nat inside
full-duplex
!
interface Ethernet0/1
no ip address
shutdown
half-duplex
!
interface Ethernet0/2
no ip address
shutdown
half-duplex
!
interface Ethernet0/3
no ip address
shutdown
half-duplex
!
interface Serial1/0
no ip address
ip nat outside
shutdown
serial restart-delay 0
no fair-queue
!
interface Serial1/1
ip address 172.16.36.2 255.255.255.252
ip nat outside
serial restart-delay 0
!
interface Serial1/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/3
no ip address
shutdown
serial restart-delay 0
!
ip nat inside source list 1 interface Serial1/1 overload
ip http server
ip classless
ip route 0.0.0.0 0.0.0.0 172.16.36.1
ip route 10.0.0.0 255.0.0.0 172.16.67.2
!
!
access-list 1 permit 10.0.0.0 0.255.255.255
access-list 100 deny icmp host 10.0.0.1 host 172.16.14.1 log
access-list 100 deny icmp host 10.0.0.1 host 172.16.25.1 log
access-list 100 permit icmp any any
!
line con 0
exec-timeout 0 0
line aux 0
line vty 0 4
login
!
!
!
end
=======================================================================
R7#sh run
Building configuration...
Current configuration : 1752 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R7
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
!
!
ip cef
no ip domain lookup
7#sh run
Building configuration...
Current configuration : 1752 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R7
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
!
!
ip cef
no ip domain lookup
!
!
ip sla monitor 1
type echo protocol ipIcmpEcho 172.16.14.1 source-interface Loopback0
timeout 999
frequency 1
ip sla monitor schedule 1 life forever start-time now
ip sla monitor 2
type echo protocol ipIcmpEcho 172.16.25.1 source-interface Loopback0
timeout 999
frequency 1
ip sla monitor schedule 2 life forever start-time now
ip sla monitor 3
type echo protocol ipIcmpEcho 172.16.36.1 source-interface Loopback0
timeout 999
frequency 1
ip sla monitor schedule 3 life forever start-time now
!
!
track 111 rtr 1 reachability
!
track 222 rtr 2 reachability
!
track 333 rtr 3 reachability
!
!
!
!
!
interface Loopback0
ip address 10.0.0.1 255.255.255.0
!
interface Ethernet0/0
ip address 172.16.47.2 255.255.255.252
full-duplex
!
interface Ethernet0/1
ip address 172.16.57.2 255.255.255.252
full-duplex
!
interface Ethernet0/2
ip address 172.16.67.2 255.255.255.252
full-duplex
!
interface Ethernet0/3
no ip address
shutdown
half-duplex
!
ip http server
no ip http secure-server
ip route 0.0.0.0 0.0.0.0 172.16.47.1 name to_cmobile track 111
ip route 0.0.0.0 0.0.0.0 172.16.57.1 22 name to_telecom track 222
ip route 172.16.25.0 255.255.255.252 172.16.57.1 name to_telecom track 222
ip route 0.0.0.0 0.0.0.0 172.16.67.1 33 name to_cnc track 333
ip route 172.16.36.0 255.255.255.252 172.16.67.1 name to_cnc track 333
ip route 172.16.14.1 255.255.255.255 172.16.47.1 name rtr-cnc
ip route 172.16.25.1 255.255.255.255 172.16.57.1 name rtr-cm
ip route 172.16.36.1 255.255.255.255 172.16.67.1 name rtr-telecom
!
!
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
!
line con 0
exec-timeout 0 0
line aux 0
line vty 0 4
login
!
!
end
转载于:https://blog.51cto.com/liangrui/520517