OSPF网络设计部署案例

来自华为官网的案例，原文地址：https://support.huawei.com/enterprise/zh/doc/EDOC1100333628/d7f06eeb
我在这里用1台交换机代替运营商，并用一台PC模拟8.8.8.8。内网的PC能Ping通8.8.8.8表示可以上外网，两台路由器上做了Easy-IP的NAT。

我没有采用华为官网上的VlanID，没有完全采用官网示例的IP地址，因为官网案例没有全面地描述每一个细节。

设备的主要配置如下：

SW1的配置：

dis cu

sysname SW1

vlan batch 221 888

interface Vlanif1

interface Vlanif221
ip address 221.192.217.1 255.255.255.248

interface Vlanif888
ip address 8.8.8.1 255.0.0.0

interface GigabitEthernet0/0/1
port link-type access
port default vlan 221

interface GigabitEthernet0/0/2
port link-type access
port default vlan 221

interface GigabitEthernet0/0/24
port link-type access
port default vlan 888

R1的配置：

dis cu
[V200R003C00]

sysname R1

acl number 2000 ------为NAT准备的ACL
rule 10 permit source 10.10.0.0 0.0.255.255
rule 20 permit source 10.20.0.0 0.0.255.255
rule 30 permit source 10.30.0.0 0.0.255.255

interface GigabitEthernet0/0/0
ip address 221.192.217.2 255.255.255.248
nat outbound 2000 ------配置NAT

interface GigabitEthernet0/0/1
ip address 10.200.10.1 255.255.255.252

interface LoopBack0
ip address 10.0.0.1 255.255.255.255

ospf 1 router-id 10.0.0.1
default-route-advertise ------在OSPF进程里发布缺省路由，不带always参数，意思是非强制下发缺省路由。非强制下发，意思是只有ASBR自身的路由表中存在缺省路由时才能发布，没有就不能发布；因为R1和R2连接了自治区域外的交换机，所以它们是ASBR；
area 0.0.0.0
network 10.200.10.0 0.0.0.3

ip route-static 0.0.0.0 0.0.0.0 221.192.217.1

R2的配置：

dis cu
[V200R003C00]

sysname R2

acl number 2000
rule 10 permit source 10.10.0.0 0.0.255.255
rule 20 permit source 10.20.0.0 0.0.255.255
rule 30 permit source 10.30.0.0 0.0.255.255

interface GigabitEthernet0/0/0
ip address 221.192.217.3 255.255.255.248
nat outbound 2000

interface GigabitEthernet0/0/1
ip address 10.200.20.1 255.255.255.252
ospf cost 10 ----默认情况下内网上外网的流量优先走R1，所以在R2这里将端口的ospf的Cost值调大；对端交换机也要调大，否则会形成不对称路由；

interface LoopBack0
ip address 10.0.0.2 255.255.255.255

ospf 1 router-id 10.0.0.2
default-route-advertise
area 0.0.0.0
network 10.200.20.0 0.0.0.3

ip route-static 0.0.0.0 0.0.0.0 221.192.217.1

SW2的配置：

dis cu

sysname SW2

vlan batch 1001 to 1003 2001 to 2002

interface Vlanif1001
ip address 10.100.10.1 255.255.255.252

interface Vlanif1002
ip address 10.100.20.1 255.255.255.252

interface Vlanif1003
ip address 10.100.30.1 255.255.255.252

interface Vlanif2001
ip address 10.200.10.2 255.255.255.252

interface Vlanif2002
ip address 10.200.20.2 255.255.255.252
ospf cost 10

interface GigabitEthernet0/0/1
port link-type access
port default vlan 2001

interface GigabitEthernet0/0/2
port link-type access
port default vlan 2002

interface GigabitEthernet0/0/3
port link-type access
port default vlan 1001

interface GigabitEthernet0/0/4
port link-type access
port default vlan 1002

interface GigabitEthernet0/0/5
port link-type access
port default vlan 1003

interface LoopBack0
ip address 10.0.0.3 255.255.255.255

ospf 1 router-id 10.0.0.3
area 0.0.0.0
network 10.200.10.0 0.0.0.3
network 10.200.20.0 0.0.0.3
area 0.0.0.10
abr-summary 10.10.0.0 255.255.0.0 ----对非骨干区域的网段进行汇总（摘要），发布进骨干区域，Area0。本例中Area 10里有10.10.1.0，10.10.2.0，10.10.3.0网段，汇总后就变为：10.10.0.0/16，一条汇总路由概括多条明细路由。
network 10.100.10.0 0.0.0.3
nssa no-summary ----非骨干区域都设置为Totally NSSA区域，因此需要在ABR上配置此命令，即不下发area 0里的网络摘要（汇总），只下发一条全0的默认路由；
area 0.0.0.20
abr-summary 10.20.0.0 255.255.0.0
network 10.100.20.0 0.0.0.3
nssa no-summary
area 0.0.0.30
abr-summary 10.30.0.0 255.255.0.0
network 10.100.30.0 0.0.0.3
nssa no-summary

ip route-static 10.10.0.0 255.255.0.0 NULL0 ----添加黑洞路由。核心交换机上有去往内网各个网段的明细路由，如果不设置黑洞路由，假设10.10.1.1，ping一个地址：10.10.5.1，核心交换机会将报文送至路由器，路由器上有汇总后的路由：10.10.0.0/16，下一跳是核心交换机，这样报文会来回传递，直到TTL变为0；添加黑洞路由以后，核心交换机收到目的地址类似10.10.5.1的报文，直接送入黑洞。
ip route-static 10.20.0.0 255.255.0.0 NULL0
ip route-static 10.30.0.0 255.255.0.0 NULL0

SW3的配置：

dis cu

sysname SW3

vlan batch 101 to 103 1001

interface Vlanif101
ip address 10.10.1.254 255.255.255.0

interface Vlanif102
ip address 10.10.2.254 255.255.255.0

interface Vlanif103
ip address 10.10.3.254 255.255.255.0

interface Vlanif1001
ip address 10.100.10.2 255.255.255.252

interface GigabitEthernet0/0/1
port link-type access
port default vlan 1001

interface GigabitEthernet0/0/11
port link-type access
port default vlan 101

interface GigabitEthernet0/0/12
port link-type access
port default vlan 102

interface GigabitEthernet0/0/13
port link-type access
port default vlan 103

interface LoopBack0
ip address 10.0.0.4 255.255.255.255

ospf 1 router-id 10.0.0.4
silent-interface Vlanif101 ------汇聚交换机连接PC或二层交换机的端口，没有必要发送OSPF Hello报文，设成静默接口；
silent-interface Vlanif102
silent-interface Vlanif103
area 0.0.0.10
network 10.10.1.0 0.0.0.255
network 10.10.2.0 0.0.0.255
network 10.10.3.0 0.0.0.255
network 10.100.10.0 0.0.0.3
nssa ----将所在区域设成NSSA区域（对端的ABR上 设为 nssa no-summary，将此区域设置为Totally NSSA区域）；

SW4的配置：

dis cu

sysname SW4

vlan batch 201 to 203 1002

interface Vlanif201
ip address 10.20.1.254 255.255.255.0

interface Vlanif202
ip address 10.20.2.254 255.255.255.0

interface Vlanif203
ip address 10.20.3.254 255.255.255.0

interface Vlanif1002
ip address 10.100.20.2 255.255.255.252

interface GigabitEthernet0/0/1
port link-type access
port default vlan 1002

interface GigabitEthernet0/0/14
port link-type access
port default vlan 201

interface GigabitEthernet0/0/15
port link-type access
port default vlan 202

interface GigabitEthernet0/0/16
port link-type access
port default vlan 203

interface LoopBack0
ip address 10.0.0.5 255.255.255.255

ospf 1 router-id 10.0.0.5
silent-interface Vlanif201
silent-interface Vlanif202
silent-interface Vlanif203
area 0.0.0.20
network 10.100.20.0 0.0.0.3
network 10.20.1.0 0.0.0.255
network 10.20.2.0 0.0.0.255
network 10.20.3.0 0.0.0.255
nssa

SW5的配置：

dis cu

sysname SW5

vlan batch 301 to 303 1003

interface Vlanif301
ip address 10.30.1.254 255.255.255.0

interface Vlanif302
ip address 10.30.2.254 255.255.255.0

interface Vlanif303
ip address 10.30.3.254 255.255.255.0

interface Vlanif1003
ip address 10.100.30.2 255.255.255.252

interface GigabitEthernet0/0/1
port link-type access
port default vlan 1003

interface GigabitEthernet0/0/17
port link-type access
port default vlan 301

interface GigabitEthernet0/0/18
port link-type access
port default vlan 302

interface GigabitEthernet0/0/19
port link-type access
port default vlan 303

interface LoopBack0
ip address 10.0.0.6 255.255.255.255

ospf 1 router-id 10.0.0.6
silent-interface Vlanif301
silent-interface Vlanif302
silent-interface Vlanif303
area 0.0.0.30
network 10.100.30.0 0.0.0.3
network 10.30.1.0 0.0.0.255
network 10.30.2.0 0.0.0.255
network 10.30.3.0 0.0.0.255
nssa