实验一：DM×××基本Hub-Spoke实验
步骤一：配置底层
R1：
!
interface Loopback0
ip address 10.1.1.1 255.255.255.0
!
interface FastEthernet0/0
ip address dhcp
!
ip route 0.0.0.0 0.0.0.0 61.128.1.10
!
R2：
!
interface Loopback0
ip address 10.1.2.1 255.255.255.0
!
interface FastEthernet0/0
ip address dhcp
!
ip route 0.0.0.0 0.0.0.0 172.9.1.10
!
R3:
!
interface Loopback0
ip address 10.1.3.1 255.255.255.0
!
interface FastEthernet0/0
ip address 202.100.1.1 255.255.255.0
!
ip route 0.0.0.0 0.0.0.0 202.100.1.10
!
Internet:
ip dhcp excluded-address 61.128.1.1 61.128.1.99
ip dhcp excluded-address 172.9.1.1 172.9.1.99
!
ip dhcp pool VLAN128
network 61.128.1.0 255.255.255.0
default-router 61.128.1.10
!
ip dhcp pool VLAN172
network 172.9.1.0 255.255.255.0
default-router 172.9.1.10
!
no spanning-tree vlan 100
no spanning-tree vlan 128
no spanning-tree vlan 172
!
interface FastEthernet1/1
switchport access vlan 128
!
interface FastEthernet1/2
switchport access vlan 172
!
interface FastEthernet1/3
switchport access vlan 100
!
interface Vlan100
ip address 202.100.1.10 255.255.255.0
!
interface Vlan128
ip address 61.128.1.10 255.255.255.0
!
interface Vlan172
ip address 172.9.1.10 255.255.255.0
!
步骤二：GRE与NHRP配置
R1：
!
interface Tunnel0
ip address 10.1.123.1 255.255.255.0
ip nhrp network-id 123
ip nhrp nhs 10.1.123.3 nbma 202.100.1.1 // 启用NHRP
tunnel source FastEthernet0/0
tunnel destination 202.100.1.1
R2：
!
interface Tunnel0
ip address 10.1.123.2 255.255.255.0
ip nhrp network-id 123
ip nhrp nhs 10.1.123.3 nbma 202.100.1.1 // NHC要指NHS
tunnel source FastEthernet0/0
tunnel destination 202.100.1.1
R3:
!
interface Tunnel0
ip address 10.1.123.3 255.255.255.0
no ip redirects
ip nhrp network-id 123
tunnel source 202.100.1.1
tunnel mode gre multipoint // Hub起mGRE
步骤三：测试与检查
R3：
R3#sh ip nhrp // 查看映射表
10.1.123.1/32 via 10.1.123.1
Tunnel0 created 00:21:06, expire 01:38:53
Type: dynamic, Flags: unique registered used
NBMA address: 61.128.1.100
10.1.123.2/32 via 10.1.123.2
Tunnel0 created 00:21:58, expire 01:38:01
Type: dynamic, Flags: unique registered used
NBMA address: 172.9.1.100
实验二：DM×××中的EIGRP
1、本实验接实验一，配置略
2、在Hub和Spoke路由器上写静态路由，使三个站点之间可以互通
3、删除需求2的静态，在三个站点之间启用EIGRP，思考存在的问题及解决方法
4、理解Hub-Spoke模式中数据流的转发路径
5、配置IPsec，DM×××中的数据进行保护
需求一：写静态路由
R1：ip route 10.1.3.0 255.255.255.0 10.1.123.3
R3：ip route 10.1.1.0 255.255.255.0 10.1.123.1
需求二：配置EIGRP
R1：
!
router eigrp 90
no auto-summary
network 10.1.1.0 0.0.0.255
network 10.1.123.0 0.0.0.255
!
R2：
!
router eigrp 90
no auto-summary
network 10.1.2.0 0.0.0.255
network 10.1.123.0 0.0.0.255
!
R3：
!
interface Tunnel0
ip nhrp map multicast dynamic
no ip split-horizon eigrp 90
!
router eigrp 90
no auto-summary
network 10.1.1.0 0.0.0.255
network 10.1.123.0 0.0.0.255
!
R2#sh ip ei nei
EIGRP-IPv4 Neighbors for AS(90)
H Address Interface Hold Uptime SRTT RTO Q Seq
(sec) (ms) Cnt Num
0 10.1.123.3 Tu0 14 00:00:06 216 1470 0 192
R3#sh ip ei nei
EIGRP-IPv4 Neighbors for AS(90)
H Address Interface Hold Uptime SRTT RTO Q Seq
(sec) (ms) Cnt Num
1 10.1.123.2 Tu0 14 00:01:08 270 1620 0 3
0 10.1.123.1 Tu0 13 01:25:05 259 1554 0 10
DM×××发展一阶段：
1、组播映射问题：mGRE默认不支持组播、广播的，点到点的支持，除非ip nhrp map multicast dynamic谁向我发注册，我向谁发组播；show ip nhrp multicast查看映射表
2、HUB要关闭水平分割
3、Spoke去往其他Spoke路由，下一跳在HUB上
4、HUB起mGRE，Spoke起点到点GRE，Spoke只跟HUB建立IGP邻居关系，Spoke之间互访一定走HUB
需求三：配置IPsec
R1、R2：
!
crypto isakmp policy 10
authentication pre-share
crypto isakmp key cisco address 202.100.1.1
!
crypto ipsec transform-set TS esp-3des esp-sha-hmac
!
crypto ipsec profile IPSEC-P
set transform-set TS
!
inter Tunnel0
tunnel protection ipsec profile IPSEC-P
!
R3：
!
crypto isakmp policy 10
authentication pre-share
crypto isakmp key cisco address 0.0.0.0 0.0.0.0 // Spoke端DHCP获得IP，不确定
!
crypto ipsec transform-set TS esp-3des esp-sha-hmac
!
crypto ipsec profile IPSEC-P
set transform-set TS
!
inter Tunnel0
tunnel protection ipsec profile IPSEC-P
!
R3#sh cryp sess
Crypto session current status
Interface: Tunnel0
Session status: UP-ACTIVE
Peer: 172.9.1.100 port 500
IKEv1 SA: local 202.100.1.1/500 remote 172.9.1.100/500 Active
IKEv1 SA: local 202.100.1.1/500 remote 172.9.1.100/500 Active
IPSEC FLOW: permit 47 host 202.100.1.1 host 172.9.1.100
Active SAs: 6, origin: crypto map
Interface: Tunnel0
Session status: UP-ACTIVE
Peer: 61.128.1.100 port 500
IKEv1 SA: local 202.100.1.1/500 remote 61.128.1.100/500 Active
IKEv1 SA: local 202.100.1.1/500 remote 61.128.1.100/500 Active
IPSEC FLOW: permit 47 host 202.100.1.1 host 61.128.1.100
Active SAs: 6, origin: crypto map
需求四：第二阶段的DM×××
R1：
!
interface Tunnel0
tunnel source FastEthernet0/0
tunnel mode gre multipoint
ip nhrp map multicast 202.100.1.1 // 解决组播映射问题
R2：
!
interface Tunnel0
tunnel source FastEthernet0/0
tunnel mode gre multipoint
ip nhrp map multicast 202.100.1.1 // 解决组播映射问题
R3:
!
interface Tunnel0
ip address 10.1.123.3 255.255.255.0
no ip redirects
ip nhrp network-id 123
tunnel source 202.100.1.1
tunnel mode gre multipoint // Hub起mGRE
ip nhrp map multicast dynamic // 动态形成组播映射表，谁发注册
no ip split-horizon eigrp 90 // 解决水平分割
no ip next-hop-self eigrp 90 // 解决第三方下一跳问题
!
第三方下一跳（DV路由协议都有当路由器在从某一个接口更新时，如果发现出接口和这个路由条目在本地路由表中的下一跳在同一网络，那么发出更新时，下一跳不变；rip缺省启用，EIGRP缺省关闭
R3#show ip nhrp
10.1.123.1/32 via 10.1.123.1
Tunnel0 created 00:00:01, expire 01:59:58
Type: dynamic, Flags: unique registered used
NBMA address: 61.128.1.1
10.1.123.2/32 via 10.1.123.2
Tunnel0 created 00:00:39, expire 01:59:21
Type: dynamic, Flags: unique registered
NBMA address: 172.9.1.1
注意点:
1.R2 ping 10.1.123.3, 然后show ip nhrp会发现R2会产生一条去往10.1.123.3的NHRP映射表项.这是通过NHRP Request/NHRP Reply学习到的,可以抓包或者debug来观察这个过程
2.因为R2可以从R1学到去往10.1.123.3的映射表项,此时,R2可以直接去往R3,不需要HUB中转.可以traceroute检查.
需求五：第三阶段的DM×××中的OSPF
R1：
!
interface Tunnel0
tunnel source FastEthernet0/0
tunnel mode gre multipoint
ip nhrp map multicast 202.100.1.1 // 解决组播映射问题
ip ospf network point-to-multipoint // tunnel接口ospf缺省类型是ptp，如果改成broadcast，要退出选举DR
ip nhrp shortcut // 启用shortcut数据优化
R2：
!
interface Tunnel0
tunnel source FastEthernet0/0
tunnel mode gre multipoint
ip nhrp map multicast 202.100.1.1 // 解决组播映射问题
ip ospf network point-to-multipoint
ip nhrp shortcut
R3:
!
interface Tunnel0
ip address 10.1.123.3 255.255.255.0
ip nhrp network-id 123
tunnel source 202.100.1.1
tunnel mode gre multipoint // Hub起mGRE
ip nhrp map multicast dynamic // 动态形成组播映射表，谁发注册
ip ospf network point-to-multipoint
ip nhrp redirect
!
DM×××三阶段发展：
1、Hub起mGRE，Spoke端起mGRE
2、通过NHRP来解决Spoke到Spoke之间的次优路径问题，NHRP Redirect缺省关闭（ICMP redirect：网关如果发现数据包的入口和出口是同一个接口，就告诉主机重定向消息把网关设置为最优网关）
3、HUB端启用NHRP Redirect，Spoke端启用NHRP shortcut捷径
转载于:https://blog.51cto.com/moyupaigutang/1919303
1399
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
