【华为Datacom】gre vpn 实验，虚拟专网配置

需求

需要将内网覆盖到两个不同区域的公司（北京-湖南）

解决办法：

1. 拉光缆（考虑光模块传输距离中间还需要建设n个传输台站）
2. 租信道（1000M、100M、2M专线）
3. 虚拟专网（VPN）

方法1成本可以百度一下（成本相当于成立了一家新运营商），方法2成本可以百度一下，直接说方案3（0成本），既然是0成本，那运营商为什么要给你转发两个区域之间的内网数据包呢？（正常情况公网路由不可达会直接丢掉数据包）

• 问题：假设运营商是顺丰（暂只履行普通网费职能-专门负责从湖南分拣中心到北京分拣中心的运输，不包入户），把内部自建网络看成公司内部外卖小哥（只履行同城到户），现在湖南分公司需要送一个文件包到北京公司（要求到户），那怎么弄呢？
• 解决办法：把文件包先按美团外卖的方式打包（发件人发件人），然后再用顺丰的箱子打包（填上湖南分拣中心-北就分拣中心）并交给顺丰，公司常年雇两个分拣中心顺丰（既是顺丰工作人员又是公司员工-负责打包传递和拆包传递）。

申明：本实验仅限具备公网IP的网络环境，不适用共享子网的家庭宽带（大部分家用）

实验

R1路由配置

[V200R003C00]
#
 sysname R1
#
 snmp-agent local-engineid 800007DB03000000000000
 snmp-agent 
#
 clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
 drop illegal-mac alarm
#
 wlan ac-global carrier id other ac id 0
#
 set cpu-usage threshold 80 restore 75
#
acl number 2000  
 rule 10 permit source 192.168.1.0 0.0.0.255 
#
aaa 
 authentication-scheme default
 authorization-scheme default
 accounting-scheme default
 domain default 
 domain default_admin 
 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
 local-user admin service-type http
#
firewall zone Local
 priority 15
#
interface GigabitEthernet0/0/0
 ip address 192.168.1.254 255.255.255.0 
#
interface GigabitEthernet0/0/1
 ip address 12.1.1.1 255.255.255.0 
 nat outbound 2000
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
 ip address 1.1.1.1 255.255.255.255 
#
interface Tunnel0/0/0
 ip address 192.168.3.1 255.255.255.0 
 tunnel-protocol gre
 source 12.1.1.1
 destination 34.1.1.4
#
ospf 10 router-id 1.1.1.1 
 area 0.0.0.0 
  network 192.168.1.254 0.0.0.0 
  network 192.168.3.1 0.0.0.0 
#
ip route-static 0.0.0.0 0.0.0.0 GigabitEthernet0/0/1 12.1.1.2
#
user-interface con 0
 authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return

R2路由配置

[V200R003C00]
#
 sysname R2
#
 snmp-agent local-engineid 800007DB03000000000000
 snmp-agent 
#
 clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
 drop illegal-mac alarm
#
 wlan ac-global carrier id other ac id 0
#
 set cpu-usage threshold 80 restore 75
#
aaa 
 authentication-scheme default
 authorization-scheme default
 accounting-scheme default
 domain default 
 domain default_admin 
 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
 local-user admin service-type http
#
firewall zone Local
 priority 15
#
interface GigabitEthernet0/0/0
 ip address 12.1.1.2 255.255.255.0 
#
interface GigabitEthernet0/0/1
 ip address 23.1.1.2 255.255.255.0 
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
 ip address 2.2.2.2 255.255.255.255 
#
ospf 10 router-id 2.2.2.2 
 area 0.0.0.0 
  network 0.0.0.0 255.255.255.255 
#
user-interface con 0
 authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return

R3路由配置

[V200R003C00]
#
 sysname R3
#
 snmp-agent local-engineid 800007DB03000000000000
 snmp-agent 
#
 clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
 drop illegal-mac alarm
#
 wlan ac-global carrier id other ac id 0
#
 set cpu-usage threshold 80 restore 75
#
aaa 
 authentication-scheme default
 authorization-scheme default
 accounting-scheme default
 domain default 
 domain default_admin 
 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
 local-user admin service-type http
#
firewall zone Local
 priority 15
#
interface GigabitEthernet0/0/0
 ip address 23.1.1.3 255.255.255.0 
#
interface GigabitEthernet0/0/1
 ip address 34.1.1.3 255.255.255.0 
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
 ip address 3.3.3.3 255.255.255.255 
#
ospf 10 router-id 3.3.3.3 
 area 0.0.0.0 
  network 0.0.0.0 255.255.255.255 
#
user-interface con 0
 authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return

R4路由配置

[V200R003C00]
#
 sysname R4
#
 snmp-agent local-engineid 800007DB03000000000000
 snmp-agent 
#
 clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
 drop illegal-mac alarm
#
 wlan ac-global carrier id other ac id 0
#
 set cpu-usage threshold 80 restore 75
#
acl number 2000  
 rule 10 permit source 192.168.2.0 0.0.0.255 
#
aaa 
 authentication-scheme default
 authorization-scheme default
 accounting-scheme default
 domain default 
 domain default_admin 
 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
 local-user admin service-type http
#
firewall zone Local
 priority 15
#
interface GigabitEthernet0/0/0
 ip address 34.1.1.4 255.255.255.0 
 nat outbound 2000
#
interface GigabitEthernet0/0/1
 ip address 192.168.2.254 255.255.255.0 
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
 ip address 4.4.4.4 255.255.255.255 
#
interface Tunnel0/0/0
 ip address 192.168.3.4 255.255.255.0 
 tunnel-protocol gre
 source 34.1.1.4
 destination 12.1.1.1
#
ospf 10 router-id 4.4.4.4 
 area 0.0.0.0 
  network 192.168.2.254 0.0.0.0 
  network 192.168.3.4 0.0.0.0 
#
ip route-static 0.0.0.0 0.0.0.0 GigabitEthernet0/0/0 34.1.1.3
#
user-interface con 0
 authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return

网络测试

通过公网已实现私网互通

分析

• OSPF建立

dis ospf peer brief

• 抓包分析
  

dis ip routing-table protocol ospf