华为网络工程师项目模拟

leo·li

已于 2023-03-22 17:25:03 修改

阅读量1.8k

点赞数 4

文章标签：华为网络路由器

于 2021-11-23 10:03:26 首次发布

本文链接：https://blog.csdn.net/zero_number/article/details/121456838

版权

此次我们在这个拓扑中展开模拟，我们就模拟是一家新开的小规模公司。在图中我们可以看到，他的网络服务提供商分别是中国电信和中国联通，我们此次目的要让A部门在链路正常的时候走主线路，而在链路出线故障的时候走另外一条线路。B部门同理。

接下来我们先看一下思路：

为了更方便的观察我将所有命令都放在下面

1、为PC添加IP地址

2、给交换机配置端口角色以及进行链路聚合

在LSW3和LSW4上进行配置

[SW3]vlan batch 10 20
Info: This operation may take a few seconds. Please wait for a moment...done

[SW3]interface Ethernet0/0/2
[SW3-Ethernet0/0/2]port link-type access 
[SW3-Ethernet0/0/2]port default vlan 10

[SW3]interface Ethernet0/0/3
[SW3-Ethernet0/0/3]port link-type access 
[SW3-Ethernet0/0/3]port default vlan 10

[SW3]interface Ethernet0/0/1
[SW3-Ethernet0/0/1]port link-type trunk 
[SW3-Ethernet0/0/1]port trunk allow-pass vlan 10 

[SW3]interface Ethernet0/0/5
[SW3-Ethernet0/0/5]port link-type trunk 
[SW3-Ethernet0/0/5]port trunk allow-pass vlan 10 20

[SW4]vlan batch 10 20
Info: This operation may take a few seconds. Please wait for a moment...done

[SW4]interface Ethernet0/0/2
[SW4-Ethernet0/0/2]port link-type access 
[SW4-Ethernet0/0/2]port default vlan 10

[SW4]interface Ethernet0/0/3
[SW4-Ethernet0/0/3]port link-type access 
[SW4-Ethernet0/0/3]port default vlan 10

[SW4]interface Ethernet0/0/4
[SW4-Ethernet0/0/4]port link-type trunk 
[SW4-Ethernet0/0/4]port trunk allow-pass vlan 10 20 

[SW4]interface Ethernet0/0/1
[SW4-Ethernet0/0/1]port link-type trunk 
[SW4-Ethernet0/0/1]port trunk allow-pass vlan 20

在SW1和SW2上进行配置

[SW1]int g0/0/1
[SW1-GigabitEthernet0/0/1]port link-type trunk 
[SW1-GigabitEthernet0/0/1]port trunk allow-pass vlan 10

[SW1 cx]int g0/0/4
[SW1-GigabitEthernet0/0/4]port link-type trunk 
[SW1-GigabitEthernet0/0/4]port trunk allow-pass vlan 10 20

[SW1]int g0/0/2
[SW1-GigabitEthernet0/0/2]port link-type access 
[SW1-GigabitEthernet0/0/2]port default vlan 11

[SW1]int Eth-Trunk 1
[SW1-Eth-Trunk1]trunkport GigabitEthernet 0/0/23 to 0/0/24
[SW1-Eth-Trunk1]port link-type trunk 
[SW1-Eth-Trunk1]port trunk allow-pass vlan 10 20 30
[SW1-Eth-Trunk1]port trunk pvid vlan 30

[SW2]int g0/0/1
[SW2-GigabitEthernet0/0/1]port link-type trunk 
[SW2-GigabitEthernet0/0/1]port trunk allow-pass vlan 20

[SW2]int g0/0/5
[SW2-GigabitEthernet0/0/5]port link-type trunk 
[SW2-GigabitEthernet0/0/5]port trunk allow-pass vlan 10 20

[SW2]int g0/0/2
[SW2-GigabitEthernet0/0/2]port link-type access 
[SW2-GigabitEthernet0/0/2]port default vlan 11

[SW2]int Eth-Trunk 1
[SW2-Eth-Trunk1]trunkport GigabitEthernet 0/0/23 to 0/0/24
[SW2-Eth-Trunk1]port link-type trunk 
[SW2-Eth-Trunk1]port trunk allow-pass vlan 10 20 30
[SW2-Eth-Trunk1]port trunk pvid vlan 30

接着我们在SW1、SW2上配置vlanif

[SW1]interface Vlanif 10
[SW1-Vlanif10]ip address 192.168.10.253 24

[SW1]interface Vlanif 20
[SW1-Vlanif20]ip address 192.168.20.252 24

[SW1]interface Vlanif 30
[SW1-Vlanif30]ip address 192.168.30.1 24

[SW1]interface Vlanif 11
[SW1-Vlanif11]ip address 192.168.11.1 24

[SW2]interface Vlanif 10
[SW2-Vlanif10]ip address 192.168.10.252 24

[SW2]interface Vlanif 20
[SW2-Vlanif20]ip address 192.168.20.253 24

[SW2]interface Vlanif 30
[SW2-Vlanif30]ip address 192.168.30.2 24

[SW2]interface Vlanif 21
[SW2-Vlanif21]ip address 192.168.21.2 24

我们先测试一下链路聚合是否生效

[SW1]display eth-trunk 1
Eth-Trunk1's state information is:
WorkingMode: NORMAL         Hash arithmetic: According to SIP-XOR-DIP         
Least Active-linknumber: 1  Max Bandwidth-affected-linknumber: 8              
Operate status: up          Number Of Up Port In Trunk: 2                     
--------------------------------------------------------------------------------
PortName                      Status      Weight 
GigabitEthernet0/0/23         Up          1      
GigabitEthernet0/0/24         Up          1

[SW2]display eth-trunk 1
Eth-Trunk1's state information is:
WorkingMode: NORMAL         Hash arithmetic: According to SIP-XOR-DIP         
Least Active-linknumber: 1  Max Bandwidth-affected-linknumber: 8              
Operate status: up          Number Of Up Port In Trunk: 2                     
--------------------------------------------------------------------------------
PortName                      Status      Weight 
GigabitEthernet0/0/23         Up          1      
GigabitEthernet0/0/24         Up          1

[SW1]ping 192.168.30.2
  PING 192.168.30.2: 56  data bytes, press CTRL_C to break
    Reply from 192.168.30.2: bytes=56 Sequence=1 ttl=255 time=90 ms
    Reply from 192.168.30.2: bytes=56 Sequence=2 ttl=255 time=10 ms
    Reply from 192.168.30.2: bytes=56 Sequence=3 ttl=255 time=50 ms
    Reply from 192.168.30.2: bytes=56 Sequence=4 ttl=255 time=40 ms
    Reply from 192.168.30.2: bytes=56 Sequence=5 ttl=255 time=30 ms

  --- 192.168.30.2 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 10/44/90 ms

3、接着我们创建生成树实例并配置，接着设置根桥、备份根桥

[SW1]stp region-configuration 
[SW1-mst-region]region-name huawei
[SW1-mst-region]instance 1 vlan 10
[SW1-mst-region]instance 2 vlan 20
[SW1-mst-region]active region-configuration

[SW2]stp region-configuration
[SW2-mst-region] region-name huawei
[SW2-mst-region] instance 1 vlan 10
[SW2-mst-region] instance 2 vlan 20
[SW2-mst-region] active region-configuration

[SW3]stp region-configuration
[SW3-mst-region] region-name huawei
[SW3-mst-region] instance 1 vlan 10
[SW3-mst-region] instance 2 vlan 20
[SW3-mst-region] active region-configuration

[SW4]stp region-configuration
[SW4-mst-region] region-name huawei
[SW4-mst-region] instance 1 vlan 10
[SW4-mst-region] instance 2 vlan 20
[SW4-mst-region] active region-configuration

为生成树实例1和实例2创建根桥和备份根桥

[SW1]stp instance 1 root primary 
[SW1]stp instance 2 root secondary

[SW2]stp instance 1 root secondary 
[SW2]stp instance 2 root primary

接着我们查看mstp的端口信息

[SW1]display stp brief 
 MSTID  Port                        Role  STP State     Protection
   0    GigabitEthernet0/0/1        DESI  FORWARDING      NONE
   0    GigabitEthernet0/0/2        DESI  FORWARDING      NONE
   0    GigabitEthernet0/0/4        DESI  FORWARDING      NONE
   0    Eth-Trunk1                  ROOT  FORWARDING      NONE
   1    GigabitEthernet0/0/1        DESI  FORWARDING      NONE
   1    GigabitEthernet0/0/4        DESI  FORWARDING      NONE
   1    Eth-Trunk1                  DESI  FORWARDING      NONE
   2    GigabitEthernet0/0/4        DESI  FORWARDING      NONE
   2    Eth-Trunk1                  ROOT  FORWARDING      NONE

[SW2]display stp brief 
 MSTID  Port                        Role  STP State     Protection
   0    GigabitEthernet0/0/1        DESI  FORWARDING      NONE
   0    GigabitEthernet0/0/2        DESI  FORWARDING      NONE
   0    GigabitEthernet0/0/5        DESI  FORWARDING      NONE
   0    Eth-Trunk1                  DESI  FORWARDING      NONE
   1    GigabitEthernet0/0/5        DESI  FORWARDING      NONE
   1    Eth-Trunk1                  ROOT  FORWARDING      NONE
   2    GigabitEthernet0/0/1        DESI  FORWARDING      NONE
   2    GigabitEthernet0/0/5        DESI  FORWARDING      NONE
   2    Eth-Trunk1                  DESI  FORWARDING      NONE

[SW3]display stp brief 
 MSTID  Port                        Role  STP State     Protection
   0    Ethernet0/0/1               ALTE  DISCARDING      NONE
   0    Ethernet0/0/2               DESI  FORWARDING      NONE
   0    Ethernet0/0/3               DESI  FORWARDING      NONE
   0    Ethernet0/0/5               ROOT  FORWARDING      NONE
   1    Ethernet0/0/1               ROOT  FORWARDING      NONE
   1    Ethernet0/0/2               DESI  FORWARDING      NONE
   1    Ethernet0/0/3               DESI  FORWARDING      NONE
   1    Ethernet0/0/5               ALTE  DISCARDING      NONE
   2    Ethernet0/0/5               ROOT  FORWARDING      NONE

[SW4]display stp brief 
 MSTID  Port                        Role  STP State     Protection
   0    Ethernet0/0/1               ROOT  FORWARDING      NONE
   0    Ethernet0/0/2               DESI  FORWARDING      NONE
   0    Ethernet0/0/3               DESI  FORWARDING      NONE
   0    Ethernet0/0/4               ALTE  DISCARDING      NONE
   1    Ethernet0/0/4               ROOT  FORWARDING      NONE
   2    Ethernet0/0/1               ROOT  FORWARDING      NONE
   2    Ethernet0/0/2               DESI  FORWARDING      NONE
   2    Ethernet0/0/3               DESI  FORWARDING      NONE
   2    Ethernet0/0/4               ALTE  DISCARDING      NONE

我们可以看到在SW3上阻塞的是Ethernet0/0/5口，SW4上阻塞的是Ethernet0/0/4，已经到到了我们的目的。

此时我们的MSTP已经配置完毕。

4、我们在SW1上和SW2上分别建立VRRP备份组，添加虚拟IP，达到负载分担的一个目的。

[SW1-Vlanif10]vrrp vrid 1 virtual-ip 192.168.10.254
[SW1-Vlanif10]vrrp vrid 1 priority 150
[SW1-Vlanif10]vrrp vrid 1 preempt-mode timer delay 30
[SW1-Vlanif20]vrrp vrid 2 virtual-ip 192.168.20.254

[SW2-Vlanif20]vrrp vrid 2 virtual-ip 192.168.20.254
[SW2-Vlanif20]vrrp vrid 2 priority 150
[SW2-Vlanif20]vrrp vrid 2 preempt-mode timer delay 30
[SW2-Vlanif10]vrrp vrid 1 virtual-ip 192.168.10.254

接着我们查看配置是否生效

[SW1]display vrrp brief 
VRID  State        Interface                Type     Virtual IP     
----------------------------------------------------------------
1     Master       Vlanif10                 Normal   192.168.10.254 
2     Backup       Vlanif20                 Normal   192.168.20.254 
----------------------------------------------------------------
Total:2     Master:1     Backup:1     Non-active:0

[SW2]display vrrp brief 
VRID  State        Interface                Type     Virtual IP     
----------------------------------------------------------------
1     Backup       Vlanif10                 Normal   192.168.10.254 
2     Master       Vlanif20                 Normal   192.168.20.254 
----------------------------------------------------------------
Total:2     Master:1     Backup:1     Non-active:0

我们可以看到192.168.10.254这个网关在SW1上是Master在SW2上是Backup，而SW2上192.168.20.254在SW2上是Master在SW1上是Backup.

我们知道，如果VRRP检测出链路故障会自动切换主备，假设我们的上行链路出现了故障，此时VRRP的通告报文仍然在发送，那么VRRP的抢占机制将不会触发，那么链路将无法恢复正常通信，这里我们设置上行链路DOWN掉主设备优先级减少100，这样VRRP会在上行链路DOWN掉时自动降低优先级，由于触发了减少优先级的命令机制，那么主设备将会切换为备，备就成为了主。

这里我们稍微注意一下，我们设置了抢占延时，时间为30秒。

我们先设置端口异常降低优先级

[SW1-Vlanif10]vrrp vrid 1 track interface g0/0/2 reduced 100

[SW1-GigabitEthernet0/0/2]shutdown

[SW1-Vlanif10]display vrrp brief
VRID  State        Interface                Type     Virtual IP     
----------------------------------------------------------------
1     Backup       Vlanif10                 Normal   192.168.10.254 
2     Backup       Vlanif20                 Normal   192.168.20.254 
----------------------------------------------------------------
Total:2     Master:0     Backup:2     Non-active:0

[SW2]display vrrp brief 
VRID  State        Interface                Type     Virtual IP     
----------------------------------------------------------------
1     Master       Vlanif10                 Normal   192.168.10.254 
2     Master       Vlanif20                 Normal   192.168.20.254 
----------------------------------------------------------------
Total:2     Master:2     Backup:0     Non-active:0

我们可以看到，当上行链路DOWN掉之后，SW1成为了Backup状态，SW2成为了Master。

接着我们将链路恢复，查看是否会自动切换为Master。

[SW1-GigabitEthernet0/0/2]undo shutdown

[SW1]
Nov 23 2021 08:15:59-08:00 SW1 %%01VRRP/4/STATEWARNINGEXTEND(l)[35]:Virtual Rout
er state MASTER changed to BACKUP, because of priority calculation. (Interface=V
lanif20, VrId=2, InetType=IPv4)display vrrp brief
VRID  State        Interface                Type     Virtual IP     
----------------------------------------------------------------
1     Master       Vlanif10                 Normal   192.168.10.254 
2     Backup       Vlanif20                 Normal   192.168.20.254 
----------------------------------------------------------------
Total:2     Master:1     Backup:1     Non-active:0

可以看到SW1经过30秒后又成为了Vlanif10的Master

最后我们开启VRRP认证，模式为MD5，密码为huawei

[SW1-Vlanif10]vrrp vrid 1 authentication-mode md5 huawei
[SW1-Vlanif20]vrrp vrid 2 authentication-mode md5 huawei

[SW2-Vlanif10]vrrp vrid 1 authentication-mode md5 huawei
[SW2-Vlanif20]vrrp vrid 2 authentication-mode md5 huawei

VRRP这里我们就配置完成了。

注：VRRP的抢占功能是默认开启的，而且抢占时间是0秒，就是说上行链路DOWN掉的话会立马切换主备，我们在之前已经修改过抢占时间为30秒了。

5、运行OSPF协议，达到收敛快、无环路的一个目的

我们先为4台AR设备配置IP地址及环回口

[R1]int g0/0/0
[R1-GigabitEthernet0/0/0]ip address 100.1.1.3 29

[R2]int g0/0/0
[R2-GigabitEthernet0/0/0]ip address 200.1.1.3 29

[R3]int g0/0/1
[R3-GigabitEthernet0/0/1]ip address 192.168.34.3 24
[R3]int g0/0/2
[R3-GigabitEthernet0/0/2]ip address 192.168.11.3 24
[R3]int g0/0/0
[R3-GigabitEthernet0/0/0]ip address 100.1.1.2 29
[R3]int loop0
[R3-LoopBack0]ip address 3.3.3.3 32

[R4]int g0/0/1
[R4-GigabitEthernet0/0/1]ip address 192.168.34.4 24
[R4]int g0/0/2
[R4-GigabitEthernet0/0/2]ip address 192.168.21.4 24
[R4]int g0/0/0
[R4-GigabitEthernet0/0/0]ip address 200.1.1.2 29
[R4]int loop0
[R4-LoopBack0]ip address 4.4.4.4 32

[SW1]int loop0
[SW1-LoopBack0]ip address 10.10.10.10 32

[SW2]int loop0
[SW2-LoopBack0]ip address 20.20.20.20 32

将环回口作为Router-id发布自己的直连及环回地址

[R3]ospf 1 router-id 3.3.3.3
[R3-ospf-1-area-0.0.0.0]network 192.168.34.0 0.0.0.255
[R3-ospf-1-area-0.0.0.0]network 192.168.11.0 0.0.0.255
[R3-ospf-1-area-0.0.0.0]network 3.3.3.3 0.0.0.0

[R4]ospf 1 router-id 4.4.4.4 
[R4-ospf-1]area 0
[R4-ospf-1-area-0.0.0.0]network 192.168.34.0 0.0.0.255
[R4-ospf-1-area-0.0.0.0]network 192.168.21.0 0.0.0.255
[R4-ospf-1-area-0.0.0.0]network 4.4.4.4 0.0.0.0

[SW1]ospf 1 router-id 10.10.10.10
[SW1-ospf-1]area 0
[SW1-ospf-1-area-0.0.0.0]network 192.168.0.0 0.0.255.255
[SW1-ospf-1-area-0.0.0.0]network 10.10.10.10 0.0.0.0

[SW2]ospf 1 router-id 10.10.10.10
[SW2-ospf-1]area 0
[SW2-ospf-1-area-0.0.0.0]network 192.168.0.0 0.0.255.255
[SW2-ospf-1-area-0.0.0.0]network 20.20.20.20 0.0.0.0

6、创建访问控制列表，做一个Easy NAT并应用在出接口方向

接着我们在和运营商对接的路由设备上配置访问控制列表并允许源地址192.168.10.0、192.168.20.0网段的地址通过。

[R3-acl-basic-2000]rule 1 permit source 192.168.10.0 0.0.0.255 
[R3-acl-basic-2000]rule 2 permit source 192.168.20.0 0.0.0.255
[R3-GigabitEthernet0/0/0]nat outbound 2000

[R4-acl-basic-2000]rule 1 permit source 192.168.10.0 0.0.0.255 
[R4-acl-basic-2000]rule 2 permit source 192.168.20.0 0.0.0.255
[R4-GigabitEthernet0/0/0]nat outbound 2000

访问控制列表创建好后我们查看PC能否能通上网关

可以看到无法到达运营商网络，这是因为ospf的默认路由未通告到OSPF内，现在我们使用一条命令将默认路由通告至OSPF。

[R3-ospf-1]default-route-advertise always

[R4-ospf-1]default-route-advertise always

以上就是我们的全部配置了

如果有任何错误或者建议的话，欢迎各位朋友指点哦

leo·li

关注

4
点赞
踩
50

收藏

觉得还不错? 一键收藏
打赏
5
评论
复制链接

分享到 QQ

分享到新浪微博

扫一扫