WAAM配置举例
3.1 组网需求
本典型配置案例简化组网如下：
图 1 MPLS+IPSEC+WAAM组网图
这里的PC1可以理解为分支的设备，PC2可以理解为总部的设备，分支和总部之间的 网络使用MPLS L3×××，RTA和RTB为CE设备，且分支和总部之间的数据流使用 IPSec ×××进行保护。该方案用于实现我公司推出的基于路由器的广域网优化产品和 MPLS L3×××+IPsec ×××的组合使用，通过在CE上使用WAAM，将流经CE的流量重 定向到WAAM上，WAAM将流量进行优化处理。例如在该组网图中，PC1来的流量达 到RTA之后通过策略路由将流量重定向到WAAM1，在WAAM1上进过压缩等加速处理 后，数据包先进过IPsec处理后被送到MPLS L3×××的环境中。转发到对端先经过 IPsec解密，然后转发到WAAM2，经过WAAM2对数据包进行解压缩等还原处理，然 后转发到PC2，从而完成加速过程。其中MPLS种的PE为运营商提供，H3C的设备做 CE设备。
WAAM提供两种压缩方式：IPcomp和RTM。IPComp 封装（隧道封装）压缩整个数
据包。这表示对 IP 数据包头、TCP/UDP 数据包头和有效载荷进行压缩，并且通过网 络的数据包将加上 IPComp 数据包头。Router Transparency (RTM) ：在 Router Transparency 封装中，仅压缩有效载荷，而将初始 IP 数据包头和初始 TCP/UDP 数 据包头保留为其初始形式，以便其信息可以穿过网络。在需要保留数据包头的环境 中，适合使用 Router Transparency 封装，这些环境包括 QoS 部署、负载平衡、计 费、加密、MPLS 网络和特定防火墙环境。本方案使用IPcomp的压缩方式（WAAM的 默认工作模式是IPcomp）。
3.2 使用版本 图中所有路由器和WAAM采用相同的软件版本。 路由器的版本：
[RTB]display version
H3C Comware Platform Software
Comware Software, Version 5.20, Beta 1609, Standard
Copyright (c) 2004-2007 Hangzhou H3C Tech. Co., Ltd. All rights reserved.
WAAM的版本：
WAAM(config)# show version WAAM, Accelerator 1200 Series Version v6.1(1) (Build2.78)
Compiled on December 31 20:01:43 2007
Kernel version: 2.4.33 Compiled on Dec 31 19:11:38 2007
3.3 配置步骤
3.3.1 主要配置信息
1. 配置信息，使用组网图1
1) RTA上的主要配置：
#
version 5.20, Beta 1609, Standard
#
sysname RTA
#
domain default enable system
#
acl number 3000
rule 30 permit ip source 61.1.1.0 0.0.0.255 destination 63.1.1.0 0.0.0.255
acl number 3200
rule 0 permit ip source 5.1.1.0 0.0.0.255 destination 8.1.1.0 0.0.0.255
#
ike peer rtb
pre-shared-key cipher ktppp1cOnrk=
remote-address 8.1.1.2
#
ipsec proposal 1
#
ipsec policy waamipsec 1 isakmp
security acl 3200
ike-peer rtb proposal 1
#
interface LoopBack1
ip address 72.1.1.1 255.255.255.255
#
interface GigabitEthernet0/0
port link-mode route
ip address 5.1.1.2 255.255.255.0
ipsec policy waamipsec
#
interface GigabitEthernet0/1
port link-mode route
ip address 6.1.1.1 255.255.255.0
ip policy-based-route waam
#
interface GigabitEthernet5/0
port link-mode route
ip address 1.72.1.1 255.255.255.0
#
interface Tunnel2
ip address 91.1.1.1 255.255.255.0
source 5.1.1.2
destination 8.1.1.2
#
bgp 222
import-route direct
import-route ospf 1
undo synchronization
peer 5.1.1.1 as-number 200
#
ospf 1
import-route direct
import-route bgp
area 0.0.0.1
network 5.1.1.0 0.0.0.255
network 6.1.1.0 0.0.0.255
#
policy-based-route waam permit node 0
if-match acl 3000
apply ip-address next-hop 1.72.1.2
#
ip route-static 1.78.1.0 255.255.255.0 Tunnel2
#
2) RTB的配置：
#
version 5.20, Beta 1609, Standard
#
sysname RTB
#
domain default enable system
#
acl number 3000
rule 30 permit ip source 63.1.1.0 0.0.0.255 destination 61.1.1.0 0.0.0.255
acl number 3200
rule 0 permit ip source 8.1.1.0 0.0.0.255 destination 5.1.1.0 0.0.0.255
#
ike peer rta
pre-shared-key cipher ktppp1cOnrk=
remote-address 5.1.1.2
#
ipsec proposal 1
#
ipsec policy waamipsec 1 isakmp
security acl 3200
ike-peer rta
proposal 1
#
interface LoopBack1
ip address 78.1.1.1 255.255.255.255
#
interface GigabitEthernet0/0
port link-mode route
ip address 8.1.1.2 255.255.255.0
ipsec policy waamipsec
#
interface GigabitEthernet0/1
port link-mode route
ip address 9.1.1.1 255.255.255.0
ip policy-based-route waam
#
interface GigabitEthernet7/0
port link-mode route
ip address 1.78.1.1 255.255.255.0
#
interface Tunnel2
ip address 91.1.1.2 255.255.255.0
source 8.1.1.2
destination 5.1.1.2
#
bgp 220
import-route direct
import-route ospf 1
undo synchronization
peer 8.1.1.1 as-number 200
#
ospf 1
import-route direct
import-route bgp
area 0.0.0.1
network 9.1.1.0 0.0.0.255
network 8.1.1.0 0.0.0.255
#
policy-based-route waam permit node 0
if-match acl 3000
apply ip-address next-hop 1.78.1.2
#
ip route-static 1.72.1.0 255.255.255.0 Tunnel2
3) WAAM1的配置：
WAAM(config)# show running-config
Creating configuration ...
# WAAM configuration file
# Generated by WAAM v6.1(1) build 2.78 on Feb 11, 2006 at 22:21
!
hostname WAAM1
!
interface local
ip address 1.72.1.2 255.255.255.0
ip default-gateway 1.72.1.1
deployment onlan
!
subnets
network 61.1.1.0 255.255.255.0 advertise metric 1
!
active-cache web-cache-only
tcp-acceleration
tcp-acceleration enable
!
interface link 1
description L-1.78.1.2
bandwidth 1000
metric 11
link destination 1.78.1.2
!
interface ethernet 0/1
ip address 172.32.30.72 255.255.0.0
!
web-acceleration
http-acceleration
transparency full
!
!
End
4) WAAM2的配置：
WAAM(config)# show running-config
Creating configuration ...
# WAAM configuration file
# Generated by WAAM v6.1(1) build 2.78 on Feb 11, 2006 at 22:21
!
hostname WAAM
!
interface local
ip address 1.78.1.2 255.255.255.0
ip default-gateway 1.78.1.1
deployment onlan
!
subnets
network 63.1.1.0 255.255.255.0 advertise metric 1
!
active-cache web-cache-only
tcp-acceleration
tcp-acceleration enable
!
interface link 1
description L-1.72.1.2
bandwidth 1000
metric 11
link destination 1.72.1.2
!
interface ethernet 0/1
ip address 172.32.30.78 255.255.0.0
!
web-acceleration
http-acceleration
transparency full
!
!
End
3.3.2 主要配置步骤
1) 配置MPLS环境
配置MPLS L3×××的环境,保证私网的路由器互相可达： 对于RTA：
[RTA]bgp 222
[RTA-bgp]import-route direct
[RTA-bgp]import-route ospf 1
[RTA-bgp]undo synchronization
[RTA-bgp]peer 5.1.1.1 as-number 200
[RTA-bgp]ospf 1
[RTA-ospf-1]import-route direct
[RTA-ospf-1]import-route bgp
[RTA-ospf-1]area 0.0.0.1
[RTA-ospf-1-area-0.0.0.1]network 5.1.1.0 0.0.0.255
[RTA-ospf-1-area-0.0.0.1]network 6.1.1.0 0.0.0.255
对于RTB：
[RTB] bgp 220
[RTB-bgp]import-route direct
[RTB-bgp]import-route ospf 1
[RTB-bgp]undo synchronization
[RTB-bgp]peer 8.1.1.1 as-number 200
[RTB-bgp]ospf 1
[RTB-ospf-1]import-route direct
[RTB-ospf-1]import-route bgp
[RTB-ospf-1]area 0.0.0.1
[RTB-ospf-1-area-0.0.0.1]network 9.1.1.0 0.0.0.255
[RTB-ospf-1-area-0.0.0.1]network 8.1.1.0 0.0.0.255
[RTB-ospf-1-area-0.0.0.1]
对于RTC：
[H3C]ospf 1
[H3C-ospf-1]import-route direct
[H3C-ospf-1]area 0.0.0.1
[H3C-ospf-1-area-0.0.0.1]network 6.1.1.0 0.0.0.255
[H3C-ospf-1-area-0.0.0.1]
对于RTD：
[H3C]ospf 2
[H3C-ospf-2]import-route direct
[H3C-ospf-2]area 0.0.0.1
[H3C-ospf-2-area-0.0.0.1]network 9.1.1.0 0.0.0.255
在路由器RTC上ping路由器RTD情况如下：
[H3C]ping 9.1.1.2
PING 9.1.1.2: 56 data bytes, press CTRL_C to break
Reply from 9.1.1.2: bytes=56 Sequence=1 ttl=251 time=3 ms
Reply from 9.1.1.2: bytes=56 Sequence=2 ttl=251 time=3 ms
Reply from 9.1.1.2: bytes=56 Sequence=3 ttl=251 time=2 ms
Reply from 9.1.1.2: bytes=56 Sequence=4 ttl=251 time=3 ms
Reply from 9.1.1.2: bytes=56 Sequence=5 ttl=251 time=2 ms
--- 9.1.1.2 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 2/2/3 ms
2) 配置IPsec ×××的环境：
配置TUNNLE RTA和RTB之间建立隧道 对于RTA：
[RTA]interface Tunnel 2
[RTA-Tunnel2]source 5.1.1.2
[RTA-Tunnel2]destination 8.1.1.2
[RTA-Tunnel2]ip address 91.1.1.1 24
配置路由将WAAM出来的流量引导值tunnel
[RTA]ip route-static 1.78.1.0 255.255.255.0 Tunnel2
对于RTB：
[RTB]interface Tunnel 2
[RTB-Tunnel2]source 8.1.1.2
[RTB-Tunnel2]destination 5.1.1.2
[RTB-Tunnel2]ip address 91.1.1.2 24
配置路由将WAAM出来的流量引导值tunnel
[RTB]ip route-static 1.72.1.0 255.255.255.0 Tunnel2
在RTB上ping tunnel2的RTA侧的地址，应该有如下结果：
[RTB-Tunnel2]ping 91.1.1.1
PING 91.1.1.1: 56 data bytes, press CTRL_C to break
Reply from 91.1.1.1: bytes=56 Sequence=1 ttl=255 time=2 ms
Reply from 91.1.1.1: bytes=56 Sequence=2 ttl=255 time=2 ms
Reply from 91.1.1.1: bytes=56 Sequence=3 ttl=255 time=1 ms
Reply from 91.1.1.1: bytes=56 Sequence=4 ttl=255 time=1 ms
Reply from 91.1.1.1: bytes=56 Sequence=5 ttl=255 time=2 ms
--- 91.1.1.1 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 1/1/2 ms
配置RTA和RTB之间的IPsec
对于RTA
配置ipsec使用的acl
[RTA]acl number 3200
[RTA-acl-adv-3200]rule permit ip source 5.1.1.0 0.0.0.255 destination
8.1.1.0 0.0.0.255
配置peer：
[RTA]ike peer rtb
[RTA-ike-peer-rtb]pre-shared-key waam
[RTA-ike-peer-rtb]remote-address 8.1.1.2
配置协议：
[RTA]ipsec proposal 1
配置策略：
[RTA]ipsec policy waamipsec 1 isakmp
[RTA-ipsec-policy-isakmp-waamipsec-1]security acl 3200
[RTA-ipsec-policy-isakmp-waamipsec-1]ike-peer rtb
[RTA-ipsec-policy-isakmp-waamipsec-1]proposal 1
应用IPsec：
[RTA]interface GigabitEthernet 0/0
[RTA-GigabitEthernet0/0]ipsec policy waamipsec
对于 RTB
配置ipsec使用的acl
[RTB-acl-adv-3004]acl number 3200
[RTB-acl-adv-3200]rule permit ip source 8.1.1.0 0.0.0.255 destination 5.1.1.0
0.0.0.255
配置peer：
[RTB]ike peer rta
[RTB-ike-peer-rta]pre-shared-key waam
[RTB-ike-peer-rta]remote-address 5.1.1.2
配置协议：
[RTB]ipsec proposal 1
配置策略：
[RTB]ipsec policy waamipsec 1 isakmp
[RTB-ipsec-policy-isakmp-waamipsec-1]security acl 3200
[RTB-ipsec-policy-isakmp-waamipsec-1]ike-peer rta
[RTB-ipsec-policy-isakmp-waamipsec-1]proposal 1
在接口下应用策略：
[RTB]interface GigabitEthernet 0/0
[RTB-GigabitEthernet0/0]ipsec policy waamipsec
3) 配置策略路由：
对于RTA
配置WAAM相关的接口
[RTA]interface GigabitEthernet5/0
[RTA-GigabitEthernet5/0]ip address 1.72.1.1 255.255.255.0
配置RTA上策略路由使用的acl
[RTA]acl number 3000
[RTA-acl-adv-3000]rule permit ip source 61.1.1.0 0.0.0.255 destination
63.1.1.0 0.0.0.255
配置相应的策略路由
[RTA]policy-based-route waam permit node 0 [RTA-pbr-waam-0]if-match acl 3000
[RTA-pbr-waam-0]apply ip-address next-hop 1.72.1.2
在流量的入口出使用策略路由
[RTA]interface GigabitEthernet0/1
[RTA-GigabitEthernet0/1]ip policy-based-route waam
对于RTB
配置WAAM相关的接口
[RTB]interface GigabitEthernet7/0
[RTB-GigabitEthernet7/0]ip address 1.78.1.1 255.255.255.0
配置RTB上策略路由使用的acl
[RTB]acl number 3000
[RTB-acl-adv-3000]rule permit ip source 63.1.1.0 0.0.0.255 destination
61.1.1.0 0.0.0.255
[RTB-acl-adv-3000]rule permit ip source 63.1.1.0 0.0.0.255 destination
40.1.1.0 0.0.0.255
配置相应的策略路由
[RTB]policy-based-route waam permit node 0 [RTB-pbr-waam-0]if-match acl 3000
[RTB-pbr-waam-0]apply ip-address next-hop 1.78.1.2
在流量的入口出使用策略路由
[RTB]interface GigabitEthernet0/1
[RTB-GigabitEthernet0/1]ip policy-based-route waam
4) 配置WAAM RTA的配置：
配置与路由器接口的ip地址：
accelerator(config)# interface local
accelerator(local interface)# ip address 1.72.1.2 255.255.255.0
accelerator(local interface)# ip default-gateway 1.72.1.1
accelerator(local interface)#exit
定义保护的子网：
accelerator(config)# subnets
accelerator(SUBNETS)# network 61.1.1.0 255.255.255.0 advertise metric 1
accelerator(SUBNETS)#exit
RTB的配置：
配置与路由器接口的ip地址：
accelerator(config)# interface local
accelerator(local interface)# ip address 1.78.1.2 255.255.255.0
accelerator(local interface)# ip default-gateway 1.78.1.1
配置link：
accelerator(config)# interface link 1 accelerator(LINK)# link destination 1.72.1.2 accelerator(LINK)# bandwidth 1000 accelerator(LINK)# exit
定义保护的子网：
accelerator(config)# subnets
accelerator(SUBNETS)# network 63.1.1.0 255.255.255.0
accelerator(SUBNETS)# exit
accelerator(config)#
3.4 验证结果
以PC1和PC2之间使用FTP传输文件为例验证，
1) 以PC1和PC2之间传输为例验证，在PC1上使用PC2的结果如下：
D:>tracert -d 63.1.1.2
Tracing route to 63.1.1.2 over a maximum of 30 hops
1
1
ms
<1
ms
<1
ms
61.1.1.1
2
<1
ms
1
ms
1
ms
6.1.1.1
3
1
ms
<1
ms
<1
ms
1.72.1.2
4
5
ms
5
ms
5
ms
1.78.1.2
5
5
ms
4
ms
4
ms
1.78.1.1
6
5
ms
4
ms
4
ms
9.1.1.2
7
8
ms
7
ms
6
ms
63.1.1.2
Trace complete.
2) 在PC2上使用PC1的结果如下：
D:>tracert -d 61.1.1.2
Tracing route to 61.1.1.2 over a maximum of 30 hops
1
<1
ms
<1
ms
<1
ms
63.1.1.1
2
1
ms
1
ms
1
ms
9.1.1.1
3
1
ms
1
ms
1
ms
1.78.1.2
4
7
ms
6
ms
6
ms
1.72.1.2
5
4
ms
3
ms
3
ms
1.72.1.1
6
4
ms
4
ms
4
ms
6.1.1.2
7
7
ms
7
ms
6
ms
61.1.1.2
Trace complete.
3) 在RTA上显示ipsec的相关信息，结果如下：
<RTA>display ike sa
total phase-1 SAs: 1
connection-id peer flag phase doi
----------------------------------------------------------
40
8.1.1.2
RD
2
IPSEC
39
8.1.1.2
RD
1
IPSEC
flag meaning
RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT
<RTA>display ipsec sa
===============================
Interface: GigabitEthernet0/0
path MTU: 1500
===============================
----------------------------- IPsec policy name: "waamipsec" sequence number: 1
mode: isakmp
-----------------------------
connection id: 5
encapsulation mode: tunnel
perfect forward secrecy: None
tunnel:
local address: 5.1.1.2
remote address: 8.1.1.2
Flow :
sour addr: 5.1.1.0/255.255.255.0 port: 0 protocol: IP
dest addr: 8.1.1.0/255.255.255.0 port: 0 protocol: IP
[inbound ESP SAs]
spi: 2278684779 (0x87d1f86b)
proposal: ESP-ENCRYPT-DES ESP-AUTH-MD5
sa remaining key duration (bytes/sec): 1887403148/1868
max received sequence-number: 373
anti-replay check enable: Y
anti-replay window size: 32
udp encapsulation used for nat traversal: N
[outbound ESP SAs]
spi: 2172150149 (0x81786185)
proposal: ESP-ENCRYPT-DES ESP-AUTH-MD5
sa remaining key duration (bytes/sec): 1887400568/1868
max sent sequence-number: 395
udp encapsulation used for nat traversal: N
4) 在RTB上显示ipsec的相关信息，结果如下：
<RTB>display ike sa
total phase-1 SAs: 1
connection-id peer flag phase doi
----------------------------------------------------------
12
5.1.1.2
RD|ST
2
IPSEC
11
5.1.1.2
RD|ST
1
IPSEC
flag meaning
RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT
<RTB>display ipsec sa
===============================
Interface: GigabitEthernet0/0
path MTU: 1500
===============================
----------------------------- IPsec policy name: "waamipsec" sequence number: 1
mode: isakmp
-----------------------------
connection id: 4
encapsulation mode: tunnel
perfect forward secrecy: None
tunnel:
local address: 8.1.1.2
remote address: 5.1.1.2
Flow :
sour addr: 8.1.1.0/255.255.255.0 port: 0 protocol: IP
dest addr: 5.1.1.0/255.255.255.0 port: 0 protocol: IP
[inbound ESP SAs]
spi: 2172150149 (0x81786185)
proposal: ESP-ENCRYPT-DES ESP-AUTH-MD5
sa remaining key duration (bytes/sec): 1887402125/1973
max received sequence-number: 377
anti-replay check enable: Y
anti-replay window size: 32
udp encapsulation used for nat traversal: N
[outbound ESP SAs]
spi: 2278684779 (0x87d1f86b)
proposal: ESP-ENCRYPT-DES ESP-AUTH-MD5
sa remaining key duration (bytes/sec): 1887404694/1973
max sent sequence-number: 357
udp encapsulation used for nat traversal: N
<RTB>
5) 在RTA的WAAM1上显示link建立的相关信息，结果如下：
link的状态应该是“accelerating”
accelerator(config)# show interface link summary
--------------------------------------------------------------------------
LINK | DEST IP ADDRESS | DESCRIPTION | BANDWIDTH | LINK STATUS
-----+--------------------+--------------+---------------+----------------
2 | 1.78.1.2 | L-1.78.1.2 | 1000/ N/A | accelerating
non | N/A | non-link | 100000/ N/A | virtual
--------------------------------------------------------------------------
accelerator(config)#
6) 在RTB的WAAM2上显示link建立的相关信息，结果如下：
link的状态应该是“accelerating”
accelerator(config)# show interface link summary
--------------------------------------------------------------------------
LINK | DEST IP ADDRESS | DESCRIPTION | BANDWIDTH | LINK STATUS
-----+--------------------+--------------+---------------+----------------
1 | 1.72.1.2 | L-1.72.1.2 | 1000/ N/A | accelerating
non | N/A | non-link | 100000/ N/A | virtual
--------------------------------------------------------------------------
accelerator(config)#
7) 在PC1上ftp到PC2上get文件到本地。 首先,验证在没有打开FTP加速的情况下，压缩其主要作用。
使能tcp加速，对WAAM1和WAAM2进行同样的操作：
accelerator# configure
accelerator(config)# interface link 2//进入相应 link 视图
accelerator(LINK)# tcp-acceleration
accelerator(TCP-ACC)# use-global-tcp-acceleration disable //关掉全局 TCP 加速
accelerator(TCP-ACC)# tcp-acceleration //使能本 link 的 tcp 加速
accelerator(TCP-ACC)# exit
accelerator(LINK)# exit
Updating link parameters
下载情况如下：
ftp> get 64m.doc
200 PORT command successful.
150 Opening ASCII mode data connection for 64m.doc(67105792 bytes).
226 Transfer complete.
ftp: 收到 67105792 字节，用时 107.02Seconds 627.06Kbytes/sec.
下载时间为“107.02Seconds” 验证使能FTP加速的情况,在这用情况下第二次下载的时候速度会很快： 使用如下命令使能FTP加速，对WAAM1和WAAM2进行同样的操作。
accelerator# configure accelerator(config)# web-acceleration accelerator(web-acceleration)# ftp-acceleration accelerator(ftp-acceleration)# ftp-acceleration accelerator(ftp-acceleration)# exit
Updating FTP acceleration params
Warning: Save the configuration and reboot the Accelerator for new settings
to take effect.
accelerator(web-acceleration)# exit
accelerator(config)# exit
accelerator#
第二次下载情况：
ftp> get 64m.doc
200 PORT command successful.
150 Starting transfer
226 Transfer complete
ftp: 收到 67105792 字节，用时 6.44Seconds 10423.39Kbytes/sec.
下载时间为“6.44Seconds” 由于使用本地下载所以是局域网的速度。
（本文转载自：http://www.91ccie.com/jishuwenzhang/sikehuaweipeizhi/heikejishugonglue/2012-09-27/1227.html
转载于:https://blog.51cto.com/ccie91/1018085
6万+
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
