[MGRE实验]构建MGRE实现VPN，各私网之间互相访问。

一、实验拓扑

• 实验要求

1. 利用MGRE VPN实现总部与分部间的互通

• 实验思路

1. 按照图示配置各设备IP地址
2. 在内外网出口设备上配置静态缺省路由，实现公网互通
3. 配置公共隧道tunnel与NHRP
4. 配置私网动态路由协议RIP

5、测试全网通

• 配置步骤

1. 按照图示配置各设备IP地址

[r1]int g0/0/0

[r1-GigabitEthernet0/0/0]ip add   

[r1-GigabitEthernet0/0/0]ip address 192.168.1.1 24

[r1-GigabitEthernet0/0/0]

Oct 23 2023 17:00:07-08:00 r1 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP

on the interface GigabitEthernet0/0/0 has entered the UP state.

[r1-GigabitEthernet0/0/0]int s4/0/0

[r1-Serial4/0/0]ip add      

[r1-Serial4/0/0]ip address 15.1.1.1 24

[r2]int g0/0/0

[r2-GigabitEthernet0/0/0]ip add   

[r2-GigabitEthernet0/0/0]ip address 192.168.2.1 24

Oct 23 2023 17:01:59-08:00 r2 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP

on the interface GigabitEthernet0/0/0 has entered the UP state.

[r2-GigabitEthernet0/0/0]int s4/0/0

[r2-Serial4/0/0]ip add      

[r2-Serial4/0/0]ip address 25.1.1.1 24

[r3]int g0/0/0

[r3-GigabitEthernet0/0/0]ip add   

[r3-GigabitEthernet0/0/0]ip address 192.168.3.1 24

Oct 23 2023 17:03:02-08:00 r3 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP

on the interface GigabitEthernet0/0/0 has entered the UP state.

[r3-GigabitEthernet0/0/0]int s4/0/0

[r3-Serial4/0/0]ip add      

[r3-Serial4/0/0]ip address 35.1.1.1 24

[r4]int g0/0/1

[r4-GigabitEthernet0/0/1]ip add   

[r4-GigabitEthernet0/0/1]ip address 192.168.4.1 24

Oct 23 2023 17:03:56-08:00 r4 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol IP

on the interface GigabitEthernet0/0/1 has entered the UP state.

[r4-GigabitEthernet0/0/1]int g0/0/0

[r4-GigabitEthernet0/0/0]ip add   

[r4-GigabitEthernet0/0/0]ip address 45.1.1.1 24

Oct 23 2023 17:04:08-08:00 r4 %%01IFNET/4/LINK_STATE(l)[1]:The line protocol IP

on the interface GigabitEthernet0/0/0 has entered the UP state.

[r5]int s4/0/1

[r5-Serial4/0/1]ip add      

[r5-Serial4/0/1]ip address 15.1.1.2 24

[r5-Serial4/0/1]

Oct 23 2023 17:04:58-08:00 r5 %%01IFNET/4/LINK_STATE(l)[0]:The line protocol PPP

 IPCP on the interface Serial4/0/1 has entered the UP state.

[r5-Serial4/0/1]int s3/0/1

[r5-Serial3/0/1]ip add      

[r5-Serial3/0/1]ip address 25.1.1.2 24

[r5-Serial3/0/1]

Oct 23 2023 17:05:23-08:00 r5 %%01IFNET/4/LINK_STATE(l)[1]:The line protocol PPP

 IPCP on the interface Serial3/0/1 has entered the UP state.

[r5-Serial3/0/1]ip add      

[r5-Serial3/0/1]int s4/0/0

[r5-Serial4/0/0]ip add      

[r5-Serial4/0/0]ip address 35.1.1.2 24

[r5-Serial4/0/0]

Oct 23 2023 17:05:54-08:00 r5 %%01IFNET/4/LINK_STATE(l)[2]:The line protocol PPP

 IPCP on the interface Serial4/0/0 has entered the UP state.

[r5-Serial4/0/0]int g0/0/0

[r5-GigabitEthernet0/0/0]ip add   

[r5-GigabitEthernet0/0/0]ip address 45.1.1.2 24

Oct 23 2023 17:06:06-08:00 r5 %%01IFNET/4/LINK_STATE(l)[3]:The line protocol IP

on the interface GigabitEthernet0/0/0 has entered the UP state.

[r5-GigabitEthernet0/0/0]int l0

[r5-LoopBack0]ip add

[r5-LoopBack0]ip address 5.5.5.5 24

1. 在内外网出口设备上配置静态缺省路由，实现公网互通

[r1]ip route-static 0.0.0.0 0 15.1.1.2

[r2]ip route-static 0.0.0.0 0 25.1.1.2

[r3]ip route-static 0.0.0.0 0 35.1.1.2

[r4]ip route-static 0.0.0.0 0 45.1.1.2

测试：公网互通

3、配置pap和chap认证，以及hdlc

[r5-aaa]local-user pap password cipher 123456 privilege level 15

[r5-aaa]local-user pap service-type ppp

[r5-Serial4/0/1]ppp authentication-mode pap

[r5-aaa]local-user chap password cipher 123456 privilege level 15

[r5-Serial3/0/1]ppp authentication-mode chap

[r1-Serial4/0/0]ppp pap local-user pap password  cipher 123456

[r2-Serial4/0/0]ppp chap user chap

[r2-Serial4/0/0]ppp chap password cipher 123456

[r5-Serial4/0/0]link-protocol hdlc

[r3-Serial4/0/0]link-protocol hdlc

1. 配置公共隧道tunnel与NHRP
      mgre环境：

中心站点：

[r1]int Tunnel 0/0/0

[r1-Tunnel0/0/0]ip add    

[r1-Tunnel0/0/0]ip address 10.1.2.1 24

[r1-Tunnel0/0/0]tunnel-protocol gre p2mp

[r1-Tunnel0/0/0]source 15.1.1.1

[r1-Tunnel0/0/0]nhrp entry multicast dynamic

[r1-Tunnel0/0/0]nhrp network-id 100  //中心站点创建域编号

各分支站点：

注：分支站点的公网地址不固定

[r2]int Tunnel 0/0/0

[r2-Tunnel0/0/0]ip address 10.1.2.2 24

[r2-Tunnel0/0/0]tunnel-protocol gre p2mp

[r2-Tunnel0/0/0]source s4/0/0

[r2-Tunnel0/0/0]nhrp en 

[r2-Tunnel0/0/0]nhrp entry 10.1.2.1 15.1.1.1 register

[r2-Tunnel0/0/0]nhrp network-id 100

[r3]int Tunnel 0/0/0

[r3-Tunnel0/0/0]ip address 10.1.2.3 24

[r3-Tunnel0/0/0]tunnel-protocol gre p2mp

[r3-Tunnel0/0/0]source s4/0/0

[r3-Tunnel0/0/0]nhrp entry 10.1.2.1 15.1.1.1 register

[r3-Tunnel0/0/0]nhrp network-id 100

gre环境:

[r1]int Tunnel 0/0/1

[r1-Tunnel0/0/1]ip address 10.1.1.1 24

[r1-Tunnel0/0/1]tunnel-protocol gre

[r1-Tunnel0/0/1]source 15.1.1.1

[r1-Tunnel0/0/1]destination 45.1.1.1

[r4]int tun0/0/1

[r4-Tunnel0/0/1]ip address 10.1.1.2 24

[r4-Tunnel0/0/1]tunnel-protocol gre

[r4-Tunnel0/0/1]source 45.1.1.1

[r4-Tunnel0/0/1]destination 15.1.1.1

测试：查看站点注册情况

各分支：

中心站点情况：

测试gre环境:

1. 配置私网路由（静态/RIP/OSPF），以RIP为例

[r1]rip 1

[r1-rip-1]v 2

[r1-rip-1]net

[r1-rip-1]network 192.168.1.0

[r1-rip-1]net

[r1-rip-1]network 10.0.0.0

[r1-rip-1]undo sum   

[r1-rip-1]undo summary

[r2]rip 1

[r2-rip-1]v 2

[r2-rip-1]undo sum

[r2-rip-1]net 192.168.2.0

[r2-rip-1]net 10.0.0.0

[r3]rip 1

[r3-rip-1]v 2

[r3-rip-1]undo summ

[r3-rip-1]net 192.168.3.0

[r3-rip-1]net 10.0.0.0

[r4]rip 1

[r4-rip-1]v 2

[r4-rip-1]undo summ

[r4-rip-1]net 192.168.4.0

[r4-rip-1]net 10.0.0.0

测试：各路由器RIP表的学习情况，发现只有R1获取了分支站点的私网路由。而分支的RIP表不全

解决方法：在中心站点获取伪广播

[R1]int Tunnel 0/0/0

[R1-Tunnel0/0/0]nhrp entry multicast dynamic

查看中心和分支路由表，发现分支rip表里只有192.168.1.0/24的路由，没有其他分支站点的私网路由

对于上述情况解决方法：关闭中心站点的水平分割

[R1-Tunnel0/0/0]undo rip split-horizon

此时查看分支站点RIP路由表，就全学到了

1. 测试全网通

1.0-2.0：

2.0-3.0：

3.0-4.0：