论文课程网站 建设背景网络推广方案例子

旁挂组网负载分担组网场景实验

一、拓扑

二、需求

1、SW3的流量正常情况下：SW1_VRF-->FW1--->SW1_Public--->R5故障情况下：SW2_VRF-->FW2--->SW2_Public--->R62、SW4的流量正常情况下：SW2_VRF-->FW2--->SW2_Public--->R6故障情况下：SW1_VRF-->FW1--->SW1_Public--->R53、交换网络负载均衡

三、分析

四、配置

二层交换网络

使用传统三层架构中MSTP+VRRP组网形式VLAN 2--->SW3,SW4作为备份
VLAN 3--->SW4,SW3作为备份
MSTP设计--->SW3、4、5运行实例1：VLAN 2
实例2：VLAN 3SW3是实例1的主根，实例2的备份根；
SW4是实例2的主根，实例1的备份根IP地址规划：
SW3：
VLAN 2:192.168.2.1/24
VLAN 3:192.168.3.1/24SW4：
VLAN 2:192.168.2.2/24
VLAN 3:192.168.3.2/24虚拟IP：
VLAN 2:192.168.2.254/24
VLAN 3:192.168.3.254/24

二层交换配置

sw3：创建vlanvlan batch 2 3int g 0/0/3port link-type trunkport trunk allow-pass  vlan 2 3int g 0/0/4port link-type trunkport trunk allow-pass  vlan 2 3生成树配置stp enablestp mode mstpstp region-configurationregion-name  aainstance 1 vlan 2instance 2 vlan   3active region-configurationdisplay  stp  region-configurationstp  instance  1  root  primarystp  instance  2  root  secondarystp  instance  0  root  paimary默认设置但不能省略IP地址配置interface  vlanif   2ip ad  192.168.2.1  24vrrp  vrid  1  virtual-ip  192.168.2.254vrrp  vrid  1  priority   120vrrp  vrid  1  preempt-mode  timer   delay  20----抢占延迟vrrp  vrid  1  track   interface   g    0/0/1   reduced   15----上行接口监控vrrp  vrid  1   track  interface  g  0/0/2   reduced  15---上行接口监控interface  vlanif   3IP ad  192.168.3.1  24vrrp  vrid   1  virtual-ip  192.168.3.254  

sw4创建vlanvlan batch 2 3int g 0/0/3port link-type trunkport trunk allow-pass  vlan 2 3int g 0/0/4port link-type trunkport trunk allow-pass  vlan 2 3生成树配置stp enablestp mode mstpstp region-configurationregion-name  aainstance 1 vlan 2instance 2 vlan   3active region-configurationdisplay  stp  region-configurationstp  instance  1  root  secondarystp  instance  2  root  primarystp  instance  0  root secondaryIP地址配置interface  vlanif   2ip ad  192.168.2.2 24vrrp  vrid  1  virtual-ip  192.168.2.254interface  vlanif   3IP ad  192.168.3.2  24vrrp  vrid   1  virtual-ip  192.168.3.254  vrrp  vrid  1  priority   120vrrp  vrid  1  preempt-mode  timer   delay  20vrrp  vrid  1  track   interface   g    0/0/1   reduced   15vrrp  vrid  1   track  interface  g  0/0/2   reduced  15

sw5vlan 配置vlan batch  2  3int  g  0//0/3port  link -type  accessport  de   vlan  2int   g  0/0/4po  link  accesspo  de  vlan 3int   g   0/0/1po link  trunkport  trunk  allow-pas  vlan 2  3int   g   0/0/2po link  trunkport  trunk  allow-pas  vlan 2  3stp配置stp  enablestp  mode  mstpstp  region-configuration region-name  aainstance  1  vlan2instance  2  vlan 3active  region-configurationdsiplay  stp  brief-----检查配置

汇聚到核心层路由

SW1-SW2：VLAN 102---10.10.2.0/24
SW1-SW3：VLAN 103---10.10.3.0/24
SW1-SW4：VLAN 104---10.10.4.0/24
SW2-SW3：VLAN 203---10.20.3.0/24
SW2-SW4：VLAN 204---10.20.4.0/24VRF空间配置信息：
名称：VRF
RD：100:1
RT：100:1SW3：
主要流量发送给SW1，备份发给SW2
SW4：
主要流量发送给SW2，备份发给SW1------------------------------------sw3与sw4只需要修改路由的cost值便可满足需求SW1：
192.168.2.0/24--->主要发送给SW3，备份给SW4
192.168.3.0/24--->主要发送给SW4，备份给SW3SW2：
192.168.2.0/24--->主要发送给SW3，备份给SW4
192.168.3.0/24--->主要发送给SW4，备份给SW3
-------------------------------------------
SW3：
将SW3本地发送的192.168.3.0/24路由的开销值改大
192.168.2.0/24路由开销不变
通过重发布，来调用路由策略
重发布时，不要引入其他路由信息sw4与sw3对称。

配置

sw3创建vlanvlan  batch 103  203int g 0/0/1port link-type accessport  default  vlan 103undo stp enableint g 0/0/2port link-type accessport default vlan 203stp enable配置IPinterface vlanif 103ip ad 10.10.3.3 24interface vlanif 203ip ad 10.20.3.3 24配置OSPFospf 1 router-id 3.3.3.3area 0network 10.10.3.0 0.0.0.0network 10.203.3 0.0.0.0network 192.168.2.1 0.0.0.0network 192.168.3.1 0.0.0.0静默接口ospf 1silent-interface vlanif 2silent-interface vlanif 3

sw4创建vlanvlan batch 104 204int g 0/0/1port link-type accessport default vlan 204stp enableint g 0/0/2port link-type accessport default vlan 104stp enable配置IPint vlanif 104ip ad 10.10.4.4 24int vlanif 204ip ad 10.20.4.4 24配置OSPFospf 1 router-id 4.4.4.4area 0network 10.10.4.4 0.0.0.0network 10.20.4.4 0.0.0.0network 192.168.2.2 0.0.0.0network 192.168.3.2 0.0.0.0静默接口ospf 1silent-interface vlanif 2silent-interface vlanif 3

sw1配置VRFvpn-target 100:1  bothrouter-distinguisher 100:1ip vpn-instance VRF创建vlan vlan batch 102 103 104int g 0/0/5port link-type accessport default vlan 103undo stp enableint g 0/0/4port link-type trunkundo port trunk allow-pass vlan 1port trunk allow-pass vlan 102undo stp enableint g 0/0/6port link-type accessport default vlan 104undo stp enable接口配置interface vlanif  102ip banding vpn-instance vrf将接口划入到VRF此交换机中在接口配置之前执行不然配置会被清理ip ad 10.10.2.1 24interface vlanif 103ip banding vpn-instance vrfip ad 10.10.3.1 24int v 104ip banding vpn-instance vrfip ad 10.10.4.1 24dis ip routing-table vpn-instance vrf-----查看实例路由ping -vpn-instance vrf  10.10.2.1----------测试ospf配置ospf 1 router-id 1.1.1.1 vpn-instance vrfarea 0 network 10.10.2.1 0.0.0.0network  10.10.3.1 0.0.0.0network 10.10.4.1 0.0.0.0display ospf peer brief----查看邻居dis ip routing-table vpn-instance----查看vrf路由

sw2配置VRFvpn-target 100:1  bothrouter-distinguisher 100:1ip vpn-instance VRF创建vlan vlan batch 102 203 204int g 0/0/4port link-type trunkundo port trunk allow-pass vlan 1port trunk allow-pass vlan 102undo stp enableint g 0/0/5port link-type accessport default vlan 204undo stp enableport link-type accessport default vlan 203undo stp enable接口配置interface vlanif  102ip banding vpn-instance vrf------将接口划入到VRF此交换机中在接口配置之前执行不然配置会被清理ip ad 10.10.2.2 24interface vlanif 203ip banding vpn-instance vrfip ad 10.20.3.2 24int v 204ip banding vpn-instance vrfip ad 10.20.4.2 24ospf配置ospf 1 router-id 2.2.2.2 vpn-instance vrfarea 0 network 10.10.2.2 0.0.0.0network  10.20.3.2 0.0.0.0network 10.20.4.2 0.0.0.0dis ospf peer briefdis ip routing-table vpn-instance

路由策略：sw3interface vlanif 203ospf  cost 5ospf  1area 0undo network  192.168.2.1 0.0.0.0undo network 192.168.3.1 0.0.0.0抓流量ip ip-prefix aa permit 192.168.3.0 24ip ip-prefix bb permit 192.168.2.0 24做策略router-policy aa permit node 10if-match ip-prefix aaapply cost 5router-policy aa permit node 20if-match ip-prefx bb调用ospf 1 import-route direct route-policy aasw4interface vlanif 104ospf cost 5ospf  1area 0undo network  192.168.2.2 0.0.0.0undo network 192.168.3.2 0.0.0.0sw3抓流量ip ip-prefix aa permit 192.168.2.0 24ip ip-prefix bb permit 192.168.3.0 24做策略router-policy aa permit node 10if-match ip-prefix aaapply cost 5router-policy aa permit node 20if-match ip-prefx bb调用ospf 1 import-route direct route-policy aa

VRF交换机与防火墙的路由交互

FW1为主
VRRP备份组1---VRRP备份组5
VRRP备份组3---VRRP备份组7FW2为主
VRRP备份组2---VRRP备份组6
VRRP备份组4---VRRP备份组8VRRP备份组1：VRF使用，SW1为Master，SW2为Backup
VLAN 401---10.40.1.0/24
SW1：10.40.1.1/24
SW2：10.40.1.2/24
虚拟地址：10.40.1.100VRRP备份组2：VRF使用，SW2为Master，SW1为Backup
VLAN 402---10.40.2.0/24
SW1：10.40.2.1/24
SW2：10.40.2.2/24
虚拟地址：10.40.2.100VRRP备份组3：Public使用，SW1为Master，SW2为Backup
VLAN 403---10.40.3.0/24
SW1：10.40.3.1/24
SW2：10.40.3.2/24
虚拟地址：10.40.3.100VRRP备份组4：Public使用，SW2为Master，SW1为Backup
VLAN 404---10.40.4.0/24
SW1：10.40.4.1/24
SW2：10.40.4.2/24
虚拟地址：10.40.4.100VRRP备份组5：防火墙使用，FW1为Master，FW2为Backup
VLAN 401---10.40.1.0/24
FW1：10.40.1.10/24
FW2：10.40.1.20/24
虚拟地址：10.40.1.200VRRP备份组6：防火墙使用，FW2为Master，FW1为Backup
VLAN 402---10.40.2.0/24
FW1：10.40.2.10/24
FW2：10.40.2.20/24
虚拟地址：10.40.2.200VRRP备份组7：防火墙使用，FW1为Master，FW2为Backup
VLAN 403---10.40.3.0/24
FW1：10.40.3.10/24
FW2：10.40.3.20/24
虚拟地址：10.40.3.200VRRP备份组8：防火墙使用，FW2为Master，FW1为Backup
VLAN 404---10.40.4.0/24
FW1：10.40.4.10/24
FW2：10.40.4.20/24
虚拟地址：10.40.4.200

配置

sw1vrfvlan batch 401 402int g 0/0/3po li t po t all vlan 401 402int g 0/0/4po t all vlan 401 402int v 401ip banding vpn-instance vrfip ad 10.40.1.1 24vrrp vrid 1 virtual-ip 10.40.1.100vrrp vrid 1 priority 120vrrp vrid 1 preempt-mode timer delay 60vrrp vrid 1 track int g 0/0/3 reduced 30int v 402ip banding vpn-instance vrfip ad 10.40.2 .1 24vrrp vrid 2 virtual-ip 10.40.2.100publicvlan  batch 403 404int g 0/0/1po li tpo t all vlan 403 404int g 0/0/2po li tpo t all vlan 403 404int v 403ip ad 10.40.3.1 24vrrp vrid 3 virtual-ip 10.40.3.100vrrp vrid 3 priority  120vrrp vrid 3 preempt-mode timer delay 60int v 404ip ad 10.40.4.1 24vrrp vrid 4 virtual-ip 10.40.4.100路由配置IP route-static vpn-instance vrf  0.0.0.0 0 10.40.1.200IP route-static vpn-instance vrf  0.0.0.0 0 10.40.2.200 preference 70ip route-static 192.168.0.0  16 10.40.3.200ip route-static 192.168.0.0 16 10.40.4.200 preference 70

sw2publicvlan  batch 403 404int g 0/0/1po li tpo t all vlan 403 404int g 0/0/2po li tpo t all vlan 403 404int v 403ip ad 10.40.3.2 24vrrp vrid 3 virtual-ip 10.40.3.100int v 404ip ad 10.40.4.2 24vrrp vrid 4 virtual-ip 10.40.4.100vrrp vrid 4 priority 120vrrp vrid 4 preempt-mode timer delay 60vrrp vrid 4 track interface g 0/0/1 reduced 30vrfvlan batch 401 402int g 0/0/3po li t po t all vlan 401 402int g 0/0/4po lin tpo t all vlan 401 402int v 401ip banding vpn-instance vrfip ad 10.40.1.2 24vrrp vrid 1 virtual-ip 10.40.1.100int v 402ip banding vpn-instance vrfip ad 10.40.2 .2 24vrrp vrid 2 virtual-ip 10.40.2.100vrrp vrid 2 priority 120vrrp vrid  2 preempt-mode timer delay 60vrrp vrid 2 track interace g 0/0/3 reduced 30路由配置IP route-static vpn-instance vrf  0.0.0.0 0 10.40.2.200IP route-static vpn-instance vrf  0.0.0.0 0 10.40.1.200 preference 70ip route-static 192.168.0.0  16 10.40.4.200ip route-static 192.168.0.0 16 10.40.3.200 preference 70

fw1vlan batch 401 402 403 404interface virtual-templateint g 1/0/0ip ad 10.10.10.1 30interface g 1/0/2.401ip ad 10.40.1.10 24vlan-type dotlq 401int g 1/0/2 .402ip ad 10.40.2.10 24vlan-type dotlq 402int g 1/0/3.403ip ad 10.40.3.10 24vlan-type dotlq 403int g 1/0/3.404ip ad  10.40.4.10 24vlan-type dotlq 404firewall zone trustadd int g 1/0/2.401add int g 1/0/2.402firewall zone untrustadd int g 1/0/3.403add int g 1/0/3.404firewall zone dmzadd int g 1/0/0双机热备int g 1/0/2.401vrrp vrid 5 virtual-ip 10.40.1.200 activeint g 1/0/2.402vrrp vrid 6 virtual-ip 10.40.2.200 standbyint g 1/0/3.403vrrp vrid 7 virtual-ip 10.40.3.200 activeint g 1/0/3.404vrrrp vrid 8 virtual-ip 10.40.4.200 standbyhrp mrror session enable快速备份hrp interface g 1/0/0 remote 10.10.10.2定义心跳线与对端IPhrp enable路由配置IP route-static 0.0.0.0  0 10.40.3.100IP route-static 0.0.0.0  0 10.40.4.100 preference 70ip route-static 192.168.0.0  16  10.40.1.100ip route-static 192.168.0.0  16  10.40.2.100 preference  70安全策略security-policyrule name t_to_usouce-zone trustdestination-zone untrustsouce-addess 192.168.0.0 16action permitdis security -policy rule all显示所有策略激活接口int g 1/0/2ip ad 1.1.1.1 24undo ip adint g 1/0/3ip ad 1.1.1.1 24undo ip ad 

fw2vlan batch 401 402 403 404interface virtual-template待定int g 1/0/0ip ad 10.10.10.2 30interface g 1/0/2.401ip ad 10.40.1.20 24vlan-type dotlq 401int g 1/0/2 .402ip ad 10.40.2.20 24vlan-type dotlq 402int g 1/0/3.403ip ad 10.40.3.20 24vlan-type dotlq 403int g 1/0/3.404ip ad  10.40.4.20 24vlan-type dotlq 404firewall zone trustadd int g 1/0/2.401add int g 1/0/2.402firewall zone untrustadd int g 1/0/3.403add int g 1/0/3.404firewall zone dmzadd int g 1/0/0双机热备int g 1/0/2.401vrrp vrid 5 virtual-ip 10.40.1.200  standbyint g 1/0/2.402vrrp vrid 6 virtual-ip 10.40.2.200 avtiveint g 1/0/3.403vrrp vrid 7 virtual-ip 10.40.3.200 standbyint g 1/0/3.404vrrrp vrid 8 virtual-ip 10.40.4.200 activehrp mrror session enable快速备份hrp interface g 1/0/0 remote 10.10.10.1定义心跳线与对端IPhrp enable路由配置IP route-static 0.0.0.0  0 10.40.4.100IP route-static 0.0.0.0  0 10.40.3.100 preference 70ip route-static 192.168.0.0  16  10.40.2.100ip route-static 192.168.0.0  16  10.40.1.100 preference  70激活接口int g 1/0/2ip ad 1.1.1.1 24undo ip adint g 1/0/3ip ad 1.1.1.1 24undo ip ad 

核心到边界

SW1-SW2：VLAN 201 --- 10.20.1.0/24
SW1-R5：VLAN 105 ---- 10.10.5.0/24
SW2-R6：VLAN 206 ---- 10.20.6.0/24
R5-R6： ---- 10.56.0.0/24

配置

sw1vlan batch 201 105int g 0/0/7po lin accpo default vlan 105undo stp enableint g 0/0/2po t all vlan 201undo stp enableint  v  105ip ad 10.10.5.1 24int v 201 ip ad 10.20.1.1 24ospf 2 route-id 1.1.1.1area 0network 10.20.1.1 0.0.0.0network 10.10.5.1 0.0.0.0ospf 2import-route static

sw2vlan batch 201 206int g 0/0/7po lin accpo default vlan 206undo stp enableint g 0/0/2po t all vlan 201undo stp enableint  v  206ip ad 10.20.6.2 24int v 201 ip ad 10.20.1.2 24ospf 2 route-id 2.2.2.2area 0network 10.20.1.2 0.0.0.0network 10.20.6.2 0.0.0.0ospf 1default-route-advertise--------下放路由ospf 2import-route static-------导入静态路由

r5int g 0/0/0ip  ad  10.10.5.5 24int g 0/0/1ip ad 10.56.0.5 24ospf 1 route-id  5.5.5.5area 0network 10.56.0.5 0.0.0.0network 10.10.5.5 0.0.0.0int g 0/0/2ip ad 12.0.0.5 24ip route-static 0.0.0.0 0 12.0.0.100ospf 1default-route-advertiseacl 2000rule permit souce 192.168.0.0 0.0.255.255int g 0/0/2nat outbound 2000

r6int g  0/0/0ip ad 10.20.6.6 24int g 0/0/1ip ad 10.56.0.6 24ospf 1 route-id 6.6.6.6aera 0 nerwork 10.56.0.6 0.0.0.0network 10.20.6.6  0.0.0.0int g 0/0/2ip ad 13.0.0.6 24ip route-static 0.0.0.0 0 13.0.0.100ospf 1default-route-advertiseacl 2000rule permit souce 192.168.0.0 0.0.255.255int g 0/0/2nat outbound 2000

ispint g 0/0/0ip ad 12.0.0.100 24int g 0/0/1ip ad 13.0.0.100 24interface loopback 0ip ad 100.1.1 24