路由控制实验——个人笔记

最新推荐文章于 2024-12-07 21:48:19 发布

混子不当

最新推荐文章于 2024-12-07 21:48:19 发布

阅读量727

点赞数 2

分类专栏：华为认证数通 Hcip 文章标签：网络网络协议运维

本文链接：https://blog.csdn.net/weixin_53220369/article/details/126137254

版权

数通同时被 3 个专栏收录

15 篇文章

订阅专栏

华为认证

12 篇文章

订阅专栏

Hcip

11 篇文章

订阅专栏

实验需求
Loopback接口所在路由协议如图所示

I.路由引入
1.1 OSPF与ISIS相互引入,使用Type1,

R3:
ospf 1
import-route isis 1 type 1
isis 1
 import-route ospf 1
R4:
ospf 1
import-route isis 1 type 1
isis 1
 import-route ospf 1

并保留起始度量值

   R3:
   ospf 1
 default cost inherit-metric
 [R3-isis-1]import-route  ospf  1 inherit-cost
    R4:
   ospf 1
 default cost inherit-metric
 [R4-isis-1]import-route  ospf  1 inherit-cost

ISIS与RIP相互引入

   *由于ISIS默认引入是Level 2所以要指明是引入Level 1
   [R7-rip-1]import-route  isis 1
   [R7-isis-1]import-route  rip level-1
   [R8-rip-1]import-route  isis 1
   [R8-isis-1]import-route  rip level-1

1.2 150.1.1.1作为非OSPF网络
精确引入到OSPF,类型为Type2

[R1]ip ip-prefix NET1 permit 150.1.1.1 32
[R1]route-policy DIR->OSPF permit node 10
[R1-route-policy]if-match  ip-prefix NET1
[R1]ospf 
[R1-ospf-1]import-route  direct  route-policy DIR->OSPF

II.路由过滤
2.1 OSPF与ISIS之间部署过滤
仅包含150.1.X.X/32的前缀,使用Filter-policy实现

 [R3]ip ip-prefix NET150 permit 150.1.0.0 16 greater-equal 32
    [R3-ospf-1]filter-policy ip-prefix NET150 export isis 1
    [R3-isis-1]filter-policy ip-prefix NET150 export ospf 1
    [R4]ip ip-prefix NET150 permit 150.1.0.0 16 greater-equal 32
    [R4-ospf-1]filter-policy ip-prefix NET150 export isis 1
    [R4-isis-1]filter-policy ip-prefix NET150 export ospf 1

2.2 ISIS与RIP之间部署过滤
仅包含150.1.X.X/32的前缀,使用route-policy实现

  [R7]ip ip-prefix NET150 permit 150.1.0.0 16 greater-equal 32
  [R7]route-policy ISIS->RIP permit  node 10
  [R7-route-policy]if-match  ip-prefix NET150 
  [R7-rip-1]import-route  isis 1 route-policy  ISIS->RIP 
  [R7]ip ip-prefix NET150 permit 150.1.0.0 16 greater-equal 32
  [R7]route-policy RIP->ISIS permit  node 10
  [R7-route-policy]if-match  ip-prefix NET150 
  [R7-isis-1]import-route  isis 1 route-policy  RIP->ISIS
  
  [R8]ip ip-prefix NET150 permit 150.1.0.0 16 greater-equal 32
  [R8]route-policy ISIS->RIP permit  node 10
  [R8-route-policy]if-match  ip-prefix NET150 
  [R8-rip-1]import-route  isis 1 route-policy  ISIS->RIP 
  [R8]ip ip-prefix NET150 permit 150.1.0.0 16 greater-equal 32
  [R8]route-policy RIP->ISIS permit  node 10
  [R8-route-policy]if-match  ip-prefix NET150 
  [R8-isis-1]import-route  isis 1 route-policy  RIP->ISIS
  
  *此时你会发现在R9上看不到150.1.1.1、150.1.2.2、150.1.3.3、150.1.4.4这些路由，
  为什么呢？原因就是在RIP引入到ISIS的时候是引入到Level 1的，此时不能被引入到Level 2上，
  所以此时需要做路由渗透。
  [R5-isis-1]import-route  isis  level-2 into level-1 
  [R6-isis-1]import-route  isis  level-2 into level-1

2.3 OSPF AREA1不能包含LSA4,LSA5.但可以引入外部路由

[R1-ospf-1-area-0.0.0.1]nssa 
[R2-ospf-1-area-0.0.0.1]nssa

2.4 OSPF AREA0不包含AREA1的互联地址

[R2]ip ip-prefix DENY-NET12 deny 155.1.12.0 24 
[R2]ip ip-prefix DENY-NET12 permit 0.0.0.0  0 less-equal  32
R2-ospf-1-area-0.0.0.1]filter  ip-prefix  DENY-NET12 export

2.5 不能影响150.1.X.X之间的通信

2.6 ISIS路由L2朝L1路由渗透仅包含150.1.X.X/32的前缀

[R5]ip ip-prefix NET150 permit  150.1.0.0 16 greater-equal 32
[R5-isis-1]import-route  isis  level-2 into  level-1  filter-policy  ip-prefix  
NET150
[R6]ip ip-prefix NET150 permit  150.1.0.0 16 greater-equal 32
[R6-isis-1]import-route  isis  level-2 into  level-1  filter-policy  ip-prefix  
NET150

III.路由属性修改
3.1 R7,R8上调整开销实现

    R9访问150.1.X.X(X为奇数)下一跳为R7
    [R7]acl  number 2002
    [R7-acl-basic-2002]rule permit  source 150.1.0.0 0.0.254.254 
    [R7-GigabitEthernet0/0/0]rip  metricout 2002 5

   [R8]acl number 2001
   [R8-acl-basic-2001]rule permit source 150.1.1.1 0.0.254.254
   [R8-GigabitEthernet0/0/1]rip  metricout 2001 5

150.1.X.X(X为偶数)下一跳为R8
R7,R8仅允许配置一条ACL

3.2 利用Filter-policy与前缀列表实现

R9上150.1.1.1下一跳为R8;150.1.2.2/32下一跳为R7

[R9]ip ip-prefix FROM_R7 index 10 permit 10.1.79.7 32
[R9]ip ip-prefix FROM_R8 index 10 permit 10.1.89.8 32
[R9]ip ip-prefix DENY_NET1 index 10 deny 150.1.1.1 32
[R9]ip ip-prefix DENY_NET1 index 20 permit 0.0.0.0 0 less-equal 32
[R9]ip ip-prefix DENY_NET2 index 10 deny 150.1.2.2 32
[R9]ip ip-prefix DENY_NET2 index 20 permit 0.0.0.0 0 less-equal 32
[R8-rip-1]filter-policy  ip-prefix DENY_NET1 gateway FROM_R8 import GigabitEther
net 0/0/0
[R9-rip-1]filter-policy  ip-prefix DENY_NET2 gateway FROM_R8 import GigabitEther
net 0/0/1

3.3 利用路由优先级解决R7与R9抵达150.1.9.9的次优路径

[R8]ip ip-prefix NET9 permit  150.1.9.9 32
[R8]route-policy SET_PRE permit node 10
[R8-route-policy]if-match  ip-prefix NET9
[R8-route-policy]apply  preference 14
[R8-rip-1]preference route-policy  SET_PRE 
（改的是rip为14）
*改完之后发现R7这边又有次优路径了，所以我们要在R7、R8上都做优先级的改变。
[R7]ip ip-prefix NET9 permit 150.1.9.9 32
[R7]route-policy SET_PRE permit  node 10
[R7-route-policy]if-match  ip-prefix SET_PRE 
[R7-route-policy]apply  preference  101
[R7-isis-1]preference route-policy  SET_PRE 
（改的是ISIS为101）

IV.路由标记（本人此题放弃思考，麻了。答案仅供参考）
4.1 实现150.1.4.4访问150.1.1.1走最优路径
并消除ISIS与OSPF网络次优路径
配置方法需要有扩展性

[R3-isis-1]cost-style wide
[R3]route-policy OSPF->ISIS permit node 10
[R3-route-policy]apply tag 150
[R3]route-policy ISIS->OSPF deny node 5
[R3-route-policy]if-match  tag  170
[R3]route-policy ISIS->OSPF permit node 10
[R3-route-policy]apply tag 15
[R3]route-policy OSPF->ISIS  deny  node 5
[R3-route-policy]if-match  tag 115
[R3-isis-1]import-route  ospf  1 inherit-cost  route-policy  OSPF->ISIS 
[R3-ospf-1]import-route  isis  1 type 1 route-policy  ISIS->OSPF 
[R3]route-policy SET_PRE permit  node 10
[R3-route-policy]if-match  tag 170
[R3-route-policy]apply preference 151
[R3-isis-1]preference route-policy  SET_PRE 

 [R4-isis-1]cost-style wide
 [R4]route-policy ISIS->OSPF deny node 5
 [R4-route-policy]if-match  tag 150
 [R4]route-policy ISIS->OSPF permit node 10
 [R4]route-policy OSPF->ISIS permit node 10
 [R4-route-policy]apply tag 170
 [R4]route-policy OSPF->ISIS  deny node  5
 [R4-route-policy]if-match  tag  15
 [R4]route-policy ISIS->OSPF  permit  node 10
 [R4-route-policy]apply tag 115
[R4-isis-1]import-route  ospf  1 inherit-cost  route-policy  OSPF->ISIS 
 [R4-ospf-1]import-route  isis  1 route-policy  ISIS->OSPF 
 此时需要填坑，将转发地址清零： [R2-ospf-1-area-0.0.0.1]nssa suppress-forwarding-address 
 [R4]route-policy SET_PRE permit  node 10
 [R4-route-policy]if-match  tag 150
 [R4-route-policy]apply  preference 14
 [R4-ospf-1]preference ase  route-policy  SET_PRE 
 [R4]undo  route-policy SET_PRE
 [R4]route-policy SET_PRE permit  node 10
 [R4-ospf-1]preference ase  14 
 
[R5-isis-1]cost-style wide
[R6-isis-1]cost-style wide
[R7-isis-1]cost-style wide
[R8-isis-1]cost-style wide

VII.策略路由
7.1 R2上部署接口级策略路由实现

  150.1.1.X(X为奇数)访问非OSPF网络下一跳为R3
    150.1.1.X(X为偶数)访问非OSPF网络下一跳为R4
    [R1]ip ip-prefix NET1 index 20 permit 150.1.1.2 32
    [R2]acl 2001
    [R2-acl-basic-2001] rule 5 permit source 150.1.1.1 0.0.0.254
    [R2]acl  number 2002
    [R2-acl-basic-2002]rule  permit  source  150.1.1.0 0.0.0.254
    [R2]policy-based-route PBR permit node 10
    [R2-policy-based-route-PBR-10]if-match  acl  2001
    [R2-policy-based-route-PBR-10]apply ip-address next-hop 155.1.23.3
    [R2]policy-based-route PBR permit  node 20
    [R2-policy-based-route-PBR-20]if-match  acl  2002
    [R2-policy-based-route-PBR-20]apply  ip-address next-hop 155.1.24.4
    [R2-GigabitEthernet0/0/0]ip policy-based-route PBR