基于策略的双出口NAT负载均衡和备份-CSDN博客

本文链接：https://blog.csdn.net/weixin_34071713/article/details/85066316

实验环境：

GNS3 1.0 + i86bi-linux-l3-adventerprisek9-15.4.1T拓扑中
R4、R5分别模拟不同运营商（ISP_A和ISP_B）的两台路由，经过运营商的链路到达因特网中的R2，R2的lo0端口模拟网站服务器
R3模拟本地PC，其中e0/0口和lo0口分别模拟两台不同网段的pc
R1为本地边界路由，需要在此路由上做双出口的策略及NAT，默认adventerprisek9-15.4.1T 设备的内存较小，实验中会报错，所以请先更改R1的内存

实验目的：

通过策略路由后对不同原地址数据流量进行分流，使得不同原地址主机通过不同ISP接口访问Internet，并为不同原地址主机同不同NAT地址进行转换。

当网络链接正常时，网段1（172.16.1.0/24）通过ISP_A到达2.2.2.2，，网段2（172.16.2.0/24）通过 ISP_B到达2.2.2.2 ，达到负载均衡的目的。当ISP_A或ISP_B其中一条链路出现故障时，能实现自动切换达到备份目的。

知识点：

思科路由器一般不用作nat，因为CPU利用率太高。但如果小型企业在内网用户数不多的情况下，防火墙成本较高，如果以现有路由器作上网设备，也是一个经济的选择。在适当的配置下，还能实现灵活的路由策略及nat策略。以下介绍相关的配置命令及实现方法。
NAT相关的配置命令工具介绍。
1、ACL
ACL是用来定义内网上网用户的工具，可以是标准ACL，也可以是扩展ACL；当需要使用到route-map时，它是定义地位范围的工具。
2、route-map
route-map是灵活控制路由策略及NAT策略的有力工具。
3、NAT配置策略
接口命令：ip nat inside、ip nat outside
全局命令：ip nat inside source route-map interface int_name overlaod
4、路由配置策略
接口命令：ip policy route-map name

实验步骤：

一、按照拓扑配置各路由接口IP和路由协议，其中R4、R5、R2运行OSPF area0 ,R2的回环地址2.2.2.2作为internet的服务器做测试使用。

配置R3:

R3(config)#interface e0/0

R3(config-if)#ip address 172.16.1.3 255.255.255.0

R3(config-if)#no sh

R3(config-if)#interface lo0

R3(config-if)#ip address 172.16.2.3 255.255.255.0

R3(config-if)#

R3(config)#ip route 0.0.0.0 0.0.0.0 172.16.1.1

配置R1:

R1(config)#interface e0/0

R1(config-if)#description to LAN

R1(config-if)#ip address 172.16.1.1 255.255.255.0

R1(config-if)#no sh

R1(config-if)#interface s1/0

R1(config-if)#description to ISP_B

R1(config-if)#ip address 15.1.1.1 255.255.255.0

R1(config-if)#no sh

R1(config-if)#interface s1/1

R1(config-if)#description to ISP_A

R1(config-if)#ip address 14.1.1.1 255.255.255.0

R1(config-if)#no sh

R1(config-if)#exit

R1(config)#ip route 0.0.0.0 0.0.0.0 14.1.1.4

R1(config)#ip route 0.0.0.0 0.0.0.0 15.1.1.5

R1(config)#ip route 172.16.2.0 255.255.255.0 172.16.1.3 ###到达LAN 172.16.2.0的回程路由

R1(config)#

配置R4:

R4(config)#interface s1/1

R4(config-if)#ip address 24.1.1.4 255.255.255.0

R4(config-if)#no sh

R4(config-if)#interface s1/0

R4(config-if)#ip address 14.1.1.4 255.255.255.0

R4(config-if)#no sh

R4(config-if)#exit

R4(configf)#router ospf 4

R4(config-router)#network 0.0.0.0 255.255.255.255 area 0

配置R5:

R5(config)#interface s1/0

R5(config-if)#ip address 25.1.1.5 255.255.255.0

R5(config-if)#no sh

R5(config-if)#interface s1/1

R5(config-if)#ip address 15.1.1.5 255.255.255.0

R5(config-if)#no sh

R5(config-if)#exit

R5(config)#router ospf 5

R5(config-router)#network 0.0.0.0 255.255.255.255 area 0

配置R2:

R2(config)#interface lo0

R2(config-if)#ip address 2.2.2.2 255.255.255.255

R2(config-if)#interface s1/0

R2(config-if)#ip address 24.1.1.2 255.255.255.0

R2(config-if)#no sh

R2(config-if)#interface s1/1

R2(config-if)#ip address 25.1.1.2 255.255.255.0

R2(config-if)#no sh

R2(config-if)#exit

R2(config)#router ospf 2

R2(config-router)#network 0.0.0.0 255.255.255.255 area 0

R2(config-router)#

*Aug 13 10:58:47.840: %OSPF-5-ADJCHG: Process 2, Nbr 25.1.1.5 on Serial1/1 from LOADING to FULL, Loading Done

*Aug 13 10:58:47.841: %OSPF-5-ADJCHG: Process 2, Nbr 24.1.1.4 on Serial1/0 from LOADING to FULL, Loading Done

二、验证基本配置

R3:

R3#show ip interface br

R3#show ip interface brief

Interface                  IP-Address      OK? Method Status                Protocol

Ethernet0/0                172.16.1.3      YES manual up                    up

Ethernet0/1                unassigned      YES unset administratively down down

Ethernet0/2                unassigned      YES unset administratively down down

Ethernet0/3                unassigned      YES unset administratively down down

Loopback0                  172.16.2.3      YES manual up                    up

R3#show ip route

Gateway of last resort is 172.16.1.1 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 172.16.1.1

172.16.0.0/16 is variably subnetted, 4 subnets, 2 masks

C        172.16.1.0/24 is directly connected, Ethernet0/0

L        172.16.1.3/32 is directly connected, Ethernet0/0

C        172.16.2.0/24 is directly connected, Loopback0

L        172.16.2.3/32 is directly connected, Loopback0

R3#

R1:

R1#show ip interface brief

Interface                  IP-Address      OK? Method Status                Protocol

Ethernet0/0                172.16.1.1      YES manual up                    up

Ethernet0/1                unassigned      YES unset administratively down down

Ethernet0/2                unassigned      YES unset administratively down down

Ethernet0/3                unassigned      YES unset administratively down down

Serial1/0                  15.1.1.1        YES manual up                    up

Serial1/1                  14.1.1.1        YES manual up                    up

Serial1/2                  unassigned      YES unset administratively down down

Serial1/3                  unassigned      YES unset administratively down down

R1#show ip route

Gateway of last resort is 15.1.1.5 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 15.1.1.5

[1/0] via 14.1.1.4

14.0.0.0/8 is variably subnetted, 2 subnets, 2 masks

C        14.1.1.0/24 is directly connected, Serial1/1

L        14.1.1.1/32 is directly connected, Serial1/1

15.0.0.0/8 is variably subnetted, 2 subnets, 2 masks

C        15.1.1.0/24 is directly connected, Serial1/0

L        15.1.1.1/32 is directly connected, Serial1/0

172.16.0.0/16 is variably subnetted, 3 subnets, 2 masks

C        172.16.1.0/24 is directly connected, Ethernet0/0

L        172.16.1.1/32 is directly connected, Ethernet0/0

S        172.16.2.0/24 [1/0] via 172.16.1.3

R1#

R4:

R4#show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface

2.2.2.2           0   FULL/ -        00:00:38    24.1.1.2        Serial1/1

R4#show ip route

Gateway of last resort is not set

2.0.0.0/32 is subnetted, 1 subnets

O        2.2.2.2 [110/65] via 24.1.1.2, 00:09:27, Serial1/1

14.0.0.0/8 is variably subnetted, 2 subnets, 2 masks

C        14.1.1.0/24 is directly connected, Serial1/0

L        14.1.1.4/32 is directly connected, Serial1/0

15.0.0.0/24 is subnetted, 1 subnets

O        15.1.1.0 [110/192] via 24.1.1.2, 00:09:17, Serial1/1

24.0.0.0/8 is variably subnetted, 2 subnets, 2 masks

C        24.1.1.0/24 is directly connected, Serial1/1

L        24.1.1.4/32 is directly connected, Serial1/1

25.0.0.0/24 is subnetted, 1 subnets

O        25.1.1.0 [110/128] via 24.1.1.2, 00:09:27, Serial1/1

R5:

R5#show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface

2.2.2.2           0   FULL/ -        00:00:39    25.1.1.2        Serial1/0

R5#show ip route

Gateway of last resort is not set

2.0.0.0/32 is subnetted, 1 subnets

O        2.2.2.2 [110/65] via 25.1.1.2, 00:12:50, Serial1/0

14.0.0.0/24 is subnetted, 1 subnets

O        14.1.1.0 [110/192] via 25.1.1.2, 00:12:40, Serial1/0

15.0.0.0/8 is variably subnetted, 2 subnets, 2 masks

C        15.1.1.0/24 is directly connected, Serial1/1

L        15.1.1.5/32 is directly connected, Serial1/1

24.0.0.0/24 is subnetted, 1 subnets

O        24.1.1.0 [110/128] via 25.1.1.2, 00:12:50, Serial1/0

25.0.0.0/8 is variably subnetted, 2 subnets, 2 masks

C        25.1.1.0/24 is directly connected, Serial1/0

L        25.1.1.5/32 is directly connected, Serial1/0

R2:

R2#show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface

25.1.1.5          0   FULL/ -        00:00:38    25.1.1.5        Serial1/1

24.1.1.4          0   FULL/ -        00:00:32    24.1.1.4        Serial1/0

R2#show ip interface brief

Interface                  IP-Address      OK? Method Status                Protocol

Serial0/0                  unassigned      YES unset administratively down down

Serial0/1                  unassigned      YES unset administratively down down

Serial0/2                  unassigned      YES unset administratively down down

Serial0/3                  unassigned      YES unset administratively down down

Serial1/0                  24.1.1.2        YES manual up                    up

Serial1/1                  25.1.1.2        YES manual up                    up

Serial1/2                  unassigned      YES unset administratively down down

Serial1/3                  unassigned      YES unset administratively down down

Loopback0                  2.2.2.2         YES manual up                    up

R2#

连通性测试：

R1#ping 2.2.2.2

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 59/61/63 ms

三、在R1上配置NAT协议

1、配置ACL，定义允许NAT转换的流量：

R1(config)#access-list 1 permit 172.16.1.0 0.0.0.255

R1(config)#access-list 2 permit 172.16.2.0 0.0.0.255

R1(config)#

2、指定内部、外部接口：

R1(config)#interface e0/0

R1(config-if)#ip nat inside

R1(config-if)#interface s1/1

R1(config-if)#ip nat outside

R1(config-if)#interface s1/0

R1(config-if)#ip nat outside

使用IOU设备配置nat时，此时如果报错如下错误，是因为默认存储空间不足，WR保存当前配置后，停止R1，增加设备内存即可：

Regex parse error, please reconfigure!

% NBAR Error: Activation failed due to insufficient Dynamic Memory

% NBAR Error: Stile could not add protocol node

%NAT: Error activating CNBAR on the interface Ethernet0/0

3、配置route-map：

R1(config)#route-map bearmr1 permit 10

R1(config-route-map)#match ip address 1

R1(config-route-map)#match interface s1/1

R1(config-route-map)#exit

####定义route-map bearmr1的两个匹配条件，其中match interface s1/1意思为接口s1/1 up或down的情况，up为匹配，当两个条件都匹配时执行下列转换：ip nat insde source route-map bearmr1 interface s1/1 overload

R1(config)#route-map bearmr2 permit 10

R1(config-route-map)#match ip address 1

R1(config-route-map)#exit

####定义route-map bearmr2的匹配条件，匹配时执行下列转换：ip nat insde source route-map bearmr2 interface s1/1 overload

R1(config)#route-map bearmr3 permit 10

R1(config-route-map)#match ip address 2

R1(config-route-map)#match interface s1/0

R1(config-route-map)#exit

####定义route-map bearmr3的两个匹配条件，其中match interface s1/0意思为接口s1/0 up或down的情况，up为匹配，当两个条件都匹配时执行下列转换：ip nat insde source route-map bearmr3 interface s1/0 overload

R1(config)#route-map bearmr4 permit 10

R1(config-route-map)#match ip address 2

R1(config-route-map)#exit

####定义route-map bearmr4的匹配条件，匹配时执行下列转换：ip nat insde source route-map bearmr4 interface s1/1 overload

4、配置NAT关联，调用以上配置的router-map

R1(config)#ip nat inside source route-map bearmr1 interface s1/1 overload

### route-map bearmr1应用到NAT里，如果匹配条件，流量（172.16.1.0/24）从s1/1接口出去，通过ISP_A到达internet，如果s1/1接口down，则流量从s1/0接口出去，通过ISP_B到达internet

R1(config)#ip nat inside source route-map bearmr2 interface s1/0 overload

###如果s1/1接口down，流量（172.16.1.0/24）从s1/0出去，通过ISP_B到达internet

R1(config)#ip nat inside source route-map bearmr3 interface s1/0 overload

### route-map bearmr3应用到NAT里，如果匹配条件，流量（172.16.2.0/24）从s1/0接口出去，通过ISP_B到达internet，如果s1/0接口down，则流量从s1/1接口出去，通过ISP_A到达internet

R1(config)#ip nat inside source route-map bearmr4 interface s1/1 overload

###如果s1/0接口down，流量（172.16.2.0/24）从s1/1出去，通过ISP_A到达internet

5、配置PBR（基于策略的路由）

R1(config)#route-map bearmr permit 10

R1(config-route-map)#match ip address 1

R1(config-route-map)#matnterface s1/1

R1(config-route-map)#match interface s1/1

R1(config-route-map)#set interface s1/1

R1(config-route-map)#exit

###定义route-map bearmr，当两个match的条件成立时执行set的动作

R1(config)#route-map bearmr permit 20

R1(config-route-map)#match ip address 2

R1(config-route-map)#match interface s1/0

R1(config-route-map)#set interface s1/0

R1(config-route-map)#exit

###定义route-map bearmr，当两个match的条件成立时执行set的动作

6、在R1的s0/0入方向应用PBR

R1(config)#interface e0/0

R1(config-if)#ip policy route-map bearmr

R1(config-if)#end

R1#

再来查看一些基本信息：

R1#show ip nat statistics

Total active translations: 0 (0 static, 0 dynamic; 0 extended)

Peak translations: 18, occurred 00:23:35 ago

Outside interfaces:

Serial1/0, Serial1/1

Inside interfaces:

Ethernet0/0

Hits: 146 Misses: 0

CEF Translated packets: 116, CEF Punted packets: 30

Expired translations: 44

Dynamic mappings:

– Inside Source

[Id: 1] route-map bearmr1 interface Serial1/1 refcount 0

[Id: 2] route-map bearmr2 interface Serial1/0 refcount 0

[Id: 5] route-map bearmr3 interface Serial1/0 refcount 0

[Id: 4] route-map bearmr4 interface Serial1/1 refcount 0

Total doors: 0

Appl doors: 0

Normal doors: 0

Queued Packets: 0

四、测试

1、在R1上打开debug

R1#debug ip nat

IP NAT debugging is on

2、在R3上ping internet，源地址为172.16.2.3

R3#ping 2.2.2.2 source 172.16.1.3

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 16/18/20 ms

在R1上查看NAT转换信息：

R1#

*Aug 13 14:54:16.887: NAT*: s=172.16.1.3->15.1.1.1, d=2.2.2.2 [0] ###源地址被转换成S1/1的接口地址

*Aug 13 14:54:16.908: NAT*: s=2.2.2.2, d=15.1.1.1->172.16.1.3 [0]

*Aug 13 14:54:16.909: NAT*: s=172.16.1.3->15.1.1.1, d=2.2.2.2 [1]

*Aug 13 14:54:16.928: NAT*: s=2.2.2.2, d=15.1.1.1->172.16.1.3 [1]

*Aug 13 14:54:16.928: NAT*: s=172.16.1.3->15.1.1.1, d=2.2.2.2 [2]

*Aug 13 14:54:16.947: NAT*: s=2.2.2.2, d=15.1.1.1->172.16.1.3 [2]

*Aug 13 14:54:16.948: NAT*: s=172.16.1.3->15.1.1.1, d=2.2.2.2 [3]

*Aug 13 14:54:16.967: NAT*: s=2.2.2.2, d=15.1.1.1->172.16.1.3 [3]

*Aug 13 14:54:16.967: NAT*: s=172.16.1.3->15.1.1.1, d=2.2.2.2 [4]

*Aug 13 14:54:16.987: NAT*: s=2.2.2.2, d=15.1.1.1->172.16.1.3 [4]

3、在R3上ping internet，源地址为172.16.2.3

R3#ping 2.2.2.2 source 172.16.2.3

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:

Packet sent with a source address of 172.16.2.3

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 19/25/48 ms

在R1上查看NAT转换信息：

R1#

*Aug 13 15:30:54.631: NAT*: s=172.16.2.3->14.1.1.1, d=2.2.2.2 [20] ###源地址被转换成S1/1的接口地址

*Aug 13 15:30:54.652: NAT*: s=2.2.2.2, d=14.1.1.1->172.16.2.3 [20]

*Aug 13 15:30:54.653: NAT*: s=172.16.2.3->14.1.1.1, d=2.2.2.2 [21]

*Aug 13 15:30:54.673: NAT*: s=2.2.2.2, d=14.1.1.1->172.16.2.3 [21]

*Aug 13 15:30:54.674: NAT*: s=172.16.2.3->14.1.1.1, d=2.2.2.2 [22]

*Aug 13 15:30:54.693: NAT*: s=2.2.2.2, d=14.1.1.1->172.16.2.3 [22]

*Aug 13 15:30:54.694: NAT*: s=172.16.2.3->14.1.1.1, d=2.2.2.2 [23]

*Aug 13 15:30:54.714: NAT*: s=2.2.2.2, d=14.1.1.1->172.16.2.3 [23]

*Aug 13 15:30:54.714: NAT*: s=172.16.2.3->14.1.1.1, d=2.2.2.2 [24]

*Aug 13 15:30:54.733: NAT*: s=2.2.2.2, d=14.1.1.1->172.16.2.3 [24]

4、通过traceroute命令跟踪到达2.2.2.2所经过的路径信息

R R3#traceroute 2.2.2.2 source 172.16.1.3 ###源地址172.16.1.3

Type escape sequence to abort.

Tracing the route to 2.2.2.2

VRF info: (vrf in name/id, vrf out name/id)

1 172.16.1.1 7 msec 1 msec 1 msec

2 15.1.1.5 11 msec 11 msec 11 msec ####通过ISP_B到达

3 25.1.1.2 21 msec 17 msec *

R3#traceroute 2.2.2.2 source 172.16.2.3 ###源地址172.16.2.3

Type escape sequence to abort.

Tracing the route to 2.2.2.2

VRF info: (vrf in name/id, vrf out name/id)

1 172.16.1.1 1 msec 2 msec 6 msec

2 14.1.1.4 10 msec 6 msec 11 msec ####通过ISP_A到达

3 24.1.1.2 18 msec 20 msec *

通过以上测试可以得到结果：网段172.16.2.0/24通过ISP_A到达2.2.2.2

网段172.16.1.0/24通过ISP_B到达2.2.2.2

不指定源地址在测试一次：

R3#traceroute 2.2.2.2

Type escape sequence to abort.

Tracing the route to 2.2.2.2

VRF info: (vrf in name/id, vrf out name/id)

1 172.16.1.1 2 msec 1 msec 6 msec

2 15.1.1.5 11 msec 11 msec 11 msec ###默认情况下通过ISP_B

3 25.1.1.2 20 msec 22 msec *

五、手工关闭R1的s1/1接口，模拟链路故障

R1(config)#interface s1/1

R1(config-if)#shutdown

1、在R3上ping 2.2.2.2，使用源地址172.16.1.2

R3#ping 2.2.2.2 source 172.16.1.3

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:

Packet sent with a source address of 172.16.1.3

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 20/21/27 ms

在R1上查看NAT转换信息：

R1#

*Aug 13 15:46:26.979: %SYS-5-CONFIG_I: Configured from console by console

R1#

*Aug 13 15:47:50.944: NAT*: s=172.16.1.3->15.1.1.1, d=2.2.2.2 [30] ###源地址被转换成S1/0的接口地址

*Aug 13 15:47:50.965: NAT*: s=2.2.2.2, d=15.1.1.1->172.16.1.3 [30]

*Aug 13 15:47:50.965: NAT*: s=172.16.1.3->15.1.1.1, d=2.2.2.2 [31]

*Aug 13 15:47:50.985: NAT*: s=2.2.2.2, d=15.1.1.1->172.16.1.3 [31]

*Aug 13 15:47:50.985: NAT*: s=172.16.1.3->15.1.1.1, d=2.2.2.2 [32]

*Aug 13 15:47:51.006: NAT*: s=2.2.2.2, d=15.1.1.1->172.16.1.3 [32]

*Aug 13 15:47:51.006: NAT*: s=172.16.1.3->15.1.1.1, d=2.2.2.2 [33]

*Aug 13 15:47:51.026: NAT*: s=2.2.2.2, d=15.1.1.1->172.16.1.3 [33]

*Aug 13 15:47:51.026: NAT*: s=172.16.1.3->15.1.1.1, d=2.2.2.2 [34]

*Aug 13 15:47:51.047: NAT*: s=2.2.2.2, d=15.1.1.1->172.16.1.3 [34]

*Aug 13 15:48:51.978: NAT: expiring 15.1.1.1 (172.16.1.3) icmp 6 (6)

2、在R3上ping 2.2.2.2，使用源地址172.16.2.2

R3#ping 2.2.2.2 source 172.16.2.3

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:

Packet sent with a source address of 172.16.2.3

!!!!!

在R1上查看NAT转换信息：

R1#

*Aug 13 15:50:14.814: NAT*: s=172.16.2.3->15.1.1.1, d=2.2.2.2 [35] ###源地址被转换成S1/0的接口地址

*Aug 13 15:50:14.834: NAT*: s=2.2.2.2, d=15.1.1.1->172.16.2.3 [35]

*Aug 13 15:50:14.834: NAT*: s=172.16.2.3->15.1.1.1, d=2.2.2.2 [36]

*Aug 13 15:50:14.854: NAT*: s=2.2.2.2, d=15.1.1.1->172.16.2.3 [36]

*Aug 13 15:50:14.854: NAT*: s=172.16.2.3->15.1.1.1, d=2.2.2.2 [37]

*Aug 13 15:50:14.874: NAT*: s=2.2.2.2, d=15.1.1.1->172.16.2.3 [37]

*Aug 13 15:50:14.874: NAT*: s=172.16.2.3->15.1.1.1, d=2.2.2.2 [38]

*Aug 13 15:50:14.894: NAT*: s=2.2.2.2, d=15.1.1.1->172.16.2.3 [38]

*Aug 13 15:50:14.895: NAT*: s=172.16.2.3->15.1.1.1, d=2.2.2.2 [39]

*Aug 13 15:50:14.914: NAT*: s=2.2.2.2, d=15.1.1.1->172.16.2.3 [39]

*Aug 13 15:51:15.649: NAT: expiring 15.1.1.1 (172.16.2.3) icmp 7 (7)

3、通过traceroute命令跟踪到达2.2.2.2所经过的路径信息

R3#traceroute 2.2.2.2 source 172.16.1.3

Type escape sequence to abort.

Tracing the route to 2.2.2.2

VRF info: (vrf in name/id, vrf out name/id)

1 172.16.1.1 1 msec 1 msec 9 msec

2 15.1.1.5 6 msec 10 msec 10 msec ####通过ISP_B到达

3 25.1.1.2 20 msec 16 msec *

R3#traceroute 2.2.2.2 source 172.16.2.3

Type escape sequence to abort.

Tracing the route to 2.2.2.2

VRF info: (vrf in name/id, vrf out name/id)

1 172.16.1.1 4 msec 2 msec 1 msec

2 15.1.1.5 11 msec 11 msec 10 msec ####通过ISP_B到达

3 25.1.1.2 21 msec 21 msec *

通过以上测试可以得到结果：网段172.16.2.0/24通过ISP_B到达2.2.2.2

网段172.16.1.0/24通过ISP_B到达2.2.2.2

R1#clear access-list counters

R3#ping 2.2.2.2 so e0/0 re 1
Type escape sequence to abort.
Sending 1, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:
Packet sent with a source address of 172.16.1.3
!
Success rate is 100 percent (1/1), round-trip min/avg/max = 20/20/20 ms
R3#ping 2.2.2.2 so l0 re 1
Type escape sequence to abort.
Sending 1, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:
Packet sent with a source address of 172.16.2.3
!
Success rate is 100 percent (1/1), round-trip min/avg/max = 20/20/20 ms

R1#sh access-l
Standard IP access list 1
10 permit 172.16.1.0, wildcard bits 0.0.0.255 (3 matches)
Standard IP access list 2
10 permit 172.16.2.0, wildcard bits 0.0.0.255 (2 matches)

access list 1 命中了3次，是一次策略路由、一次ICMP 请求时的NAT，一次ICMP回应的NAT。
access list 2 命中了2次，是走的默认路由，一次ICMP 请求时的NAT，一次ICMP回应的NAT。
结果证明，虽然ISP_A的链路发生了故障，但是流量可以通过ISP_B到达2.2.2.2internet，实现链路切换和备份功能。

六、实验完成

打开ISP_A的链路接口