题目:
1、R4为ISP,其上只配置IP地址;R4与其他所直连设备间均使用公有IP; 2、R3-R5、R6、R7为MGRE环境,R3为中心站点; 3、整个OSPF环境IP基于172.16.0.0/16划分;除了R12有两个环回,其他路由器均有一个环回IP 4、所有设备均可访问R4的环回; 5、减少LSA的更新量,加快收敛,保障更新安全; 6.加快收敛 ---- 更改hello时间! 7.全网可达;
拓扑图
实验思路:
1.配置IP 2.公网通 --- 配置静态缺省 (area0为主干区) 3.配置OSPF进程,以及网段宣告 (R3不宣告公网,area4起另一个ospf进程) 4.路由引入 --- RIP想要访问域内的路由器 5.让私网互通,须在area0中配置MGRE协议,使用隧道接口,并启用ospf进程 --- 宣告隧道地址 6.在ospf中配置路由协议,改优先级 进入隧道口:ospf dr-priority 0 7.由于所有设备均可访问R4的环回,所以在R3上面做nat --- easy IP 8.R9上面做路由引入;将ospf1引入到ospf2,相反也要引入; 9.减少LSA数目 --- 做特殊区域!!!减少到极致的:完全末梢和完全非纯末梢区域 (路由引入只能对公网中的设备减少LSA数目!) 10.加快收敛:更改hello时间! 11.保障更新安全----做认证 查看邻居表和路由表
实验具体操作:
1.配置IP
R1: [R1]int g0/0/0 [R1-GigabitEthernet0/0/0]ip add 172.16.33.1 24 [R1-GigabitEthernet0/0/0]int l0 [R1-LoopBack0]ip add 172.16.34.1 24 [R1]dis ip int b --- 查看接口 R2: [R2]int g0/0/0 [R2-GigabitEthernet0/0/0]ip add 172.16.33.2 24 [R2-GigabitEthernet0/0/0]int l0 [R2-LoopBack0]ip add 172.16.35.1 24 [R2]dis ip int b --- 查看接口 R3: [R3]int g0/0/0 [R3-GigabitEthernet0/0/0]ip add 172.16.33.3 24 [R3]int l0 [R3-LoopBack0]ip add 172.16.36.1 24 [R3-LoopBack0]int s4/0/0 [R3-Serial4/0/0]ip add 34.0.0.3 24 [R3]dis ip int b --- 查看接口 R4: [R4]int s4/0/0 [R4-Serial4/0/0]ip add 34.0.0.4 24 [R4-Serial4/0/0]int s4/0/1 [R4-Serial4/0/1]ip add 45.0.0.4 24 [R4-Serial4/0/1]int s3/0/0 [R4-Serial3/0/0]ip add 46.0.0.4 24 [R4-Serial3/0/0]int g0/0/0 [R4-GigabitEthernet0/0/0]ip add 47.0.0.4 24 [R4-GigabitEthernet0/0/0]int l0 [R4-LoopBack0]ip add 172.16.2.1 24 [R4]dis ip int b --- 查看接口 R5: [R5]int s4/0/0 [R5-Serial4/0/0]ip add 45.0.0.5 24 [R5-Serial4/0/0]int l0 [R5-LoopBack0]ip add 172.16.3.1 24 [R5-LoopBack0]dis ip int b R6: [R6]int s4/0/0 [R6-Serial4/0/0]ip add 46.0.0.6 24 [R6-Serial4/0/0]int l0 [R6-LoopBack0]ip add 172.16.4.1 24 [R6-LoopBack0]int g0/0/0 [R6-GigabitEthernet0/0/0]ip add 172.16.65.1 30 [R6]dis ip int b --- 查看接口 R7: [R7]int g0/0/0 [R7-GigabitEthernet0/0/0]ip add 47.0.0.7 24 [R7-GigabitEthernet0/0/0]int l0 [R7-LoopBack0]ip add 172.16.5.1 24 [R7]int g0/0/1 [R7-GigabitEthernet0/0/1]ip add 172.16.97.1 30 [R7]dis ip int b --- 查看接口 R8: [R8]int g0/0/0 [R8-GigabitEthernet0/0/0]ip add 172.16.97.2 30 [R8-GigabitEthernet0/0/0]int g0/0/1 [R8-GigabitEthernet0/0/1]ip add 172.16.97.5 30 [R8-GigabitEthernet0/0/1]int l0 [R8-LoopBack0]ip add 172.16.98.1 24 [R8]dis ip int b --- 查看接口 R9: [R9]int g0/0/0 [R9-GigabitEthernet0/0/0]ip add 172.16.97.5 30 [R9-GigabitEthernet0/0/0]int g0/0/1 [R9-GigabitEthernet0/0/1]ip add 172.16.129.1 30 [R9-GigabitEthernet0/0/1]int l0 [R9-LoopBack0]ip add 172.16.130.1 24 [R9]dis ip int b --- 查看接口 R10: [R10]int g 0/0/0 [R10-GigabitEthernet0/0/0]ip add 172.16.129.2 30 [R10-GigabitEthernet0/0/0]int l0 [R10-LoopBack0]ip add 172.16.131.1 24 [R10]dis ip int b R11: [R11]int g0/0/0 [R11-GigabitEthernet0/0/0]ip add 172.16.65.2 30 [R11-GigabitEthernet0/0/0]int g0/0/1 [R11-GigabitEthernet0/0/1]ip add 172.16.65.5 30 [R11-GigabitEthernet0/0/1]int l0 [R11-LoopBack0]ip add 172.16.66.1 24 [R11]dis ip int b R12: [R12]int g 0/0/0 [R12-GigabitEthernet0/0/0]ip add 172.16.65.6 30 [R12]int l0 [R12-LoopBack0]ip add 172.16.160.1 24 [R12-LoopBack0]int l1 [R12-LoopBack1]ip add 172.16.161.1 24 [R12-LoopBack1]dis ip int b
2.公网通 --- 配置静态缺省
[R3]ip route-static 0.0.0.0 0 34.0.0.4
[R5]ip route-static 0.0.0.0 0 45.0.0.4
[R6]ip route-static 0.0.0.0 0 46.0.0.4
[R7]ip route-static 0.0.0.0 0 47.0.0.4
相互测试
3.启用OSPF进程,让私网能够通
R1: [R1]ospf 1 router-id 1.1.1.1 [R1-ospf-1]area 1 [R1-ospf-1-area-0.0.0.1]network 172.16.33.0 0.0.0.255 [R1-ospf-1-area-0.0.0.1]network 172.16.34.0 0.0.0.255 R2: [R2]ospf 1 router-id 2.2.2.2 [R2-ospf-1]area 1 [R2-ospf-1-area-0.0.0.1]network 172.16.33.0 0.0.0.255 [R2-ospf-1-area-0.0.0.1]network 172.16.35.0 0.0.0.255 R3: [R3]ospf 1 router-id 3.3.3.3 [R3-ospf-1]area 1 [R3-ospf-1-area-0.0.0.1]network 172.16.36.0 0.0.0.255 [R3-ospf-1-area-0.0.0.1]net [R3-ospf-1-area-0.0.0.1]network 172.16.33.0 0.0.0.255 R5: [R5]ospf 1 router-id 5.5.5.5 [R5-ospf-1]area 0 [R5-ospf-1-area-0.0.0.0]network 172.16.3.0 0.0.0.255 R6: [R6]ospf 1 router-id 6.6.6.6 [R6-ospf-1]area 0 [R6-ospf-1-area-0.0.0.0]network 172.16.4.0 0.0.0.255 [R6]ospf 1 [R6-ospf-2]area 2 [R6-ospf-2-area-0.0.0.2]network 172.16.65.1 0.0.0.0 R7: [R7]ospf 1 router-id 7.7.7.7 [R7-ospf-1]area 0 [R7-ospf-1-area-0.0.0.0]network 172.16.5.0 0.0.0.255 [R7]ospf 1 [R7-ospf-1]area 3 [R7-ospf-1-area-0.0.0.3]net [R7-ospf-1-area-0.0.0.3]network 172.16.97.1 0.0.0.0 注意:R5,R6,R7路由器宣告的时候不要宣告公网网段 R11: [R11]ospf 1 router-id 11.11.11.11 [R11-ospf-1]area 2 [R11-ospf-1-area-0.0.0.2]net [R11-ospf-1-area-0.0.0.2]network 172.16.65.2 0.0.0.0 [R11-ospf-1-area-0.0.0.2]network 172.16.65.5 0.0.0.0 [R11-ospf-1-area-0.0.0.2]network 172.16.66.0 0.0.0.255 R12: [R12]ospf 1 router-id 12.12.12.12 [R12-ospf-1]area 2 [R12-ospf-1-area-0.0.0.2]network 172.16.65.5 0.0.0.0 [R12]rip 1 [R12-rip-1]v 2 [R12-rip-1]undo summary [R12-rip-1]network 172.16.0.0 --- 注意:这里宣告的是主类地址,这里为B类地址,只有前十六位! R8: [R8-ospf-1]ospf 1 [R8]ospf 1 router-id 8.8.8.8 [R8-ospf-1-area-0.0.0.3]network 172.16.97.2 0.0.0.0 [R8-ospf-1-area-0.0.0.3]network 172.15.98.0 0.0.0.0 [R8-ospf-1-area-0.0.0.3]network 172.16.97.5 0.0.0.0 R9: [R9]ospf 1 router-id 9.9.9.9 [R9-ospf-1]area 3 [R9-ospf-1-area-0.0.0.3]network 172.16.97.6 0.0.0.0 [R9]ospf 2 router-id 9.9.9.9 [R9-ospf-2]area 4 [R9-ospf-2-area-0.0.0.4]network 172.16.129.1 0.0.0.0 [R9-ospf-2-area-0.0.0.4]network 172.16.130.0 0.0.0.0 R10: [R10]ospf 1 router-id 10.10.10.10 [R10-ospf-1]area 4 [R10-ospf-1-area-0.0.0.4]network 172.16.129.2 0.0.0.0 [R10-ospf-1-area-0.0.0.4]network 172.16.131.0 0.0.0.0
特别提醒:R12中的g0/0/0口宣告的是在area2中还是在rip中? 两边都有宣告,为了避免这些问题,rip地址尽量不为172.16开头。
3.路由引入 --- 在ASBR设备上 --- R12
[R12]ospf 1 [R12-ospf-1]import-route rip
注意:这里不用将外部的路由引入到内部,因为RIP中没有其他设备需要访问域内,且都在R12上面,所以只需要将域外的引入到域内就好,让域内的可以访问到;
查看邻居表:
4.为了让各个私网互通,启用MGRE隧道
R3: [R3]int Tunnel 0/0/0 [R3-Tunnel0/0/0]ip add 172.16.6.3 24 [R3-Tunnel0/0/0]tunnel-protocol gre p2mp --- 使用协议 [R3-Tunnel0/0/0]source s4/0/0 [R3-Tunnel0/0/0]nhrp network-id 100 --- 创建nhrp域,让其他分支站点都进 [R3-Tunnel0/0/0]nhrp entry multicast dynamic --- 开启广播功能 R5: [R5]int Tunnel 0/0/0 [R5-Tunnel0/0/0]ip add 172.16.6.5 24 [R5-Tunnel0/0/0]tunnel-protocol gre p2mp [R5-Tunnel0/0/0]source s4/0/0 [R5-Tunnel0/0/0]nhrp network-id 100 [R5-Tunnel0/0/0]nhrp entry 172.16.6.3 34.0.0.3 register --- entry后面先跟中心隧道地址,再跟公网地址 R6: [R6]int Tunnel 0/0/0 [R6-Tunnel0/0/0]ip add 172.16.6.6 24 [R6-Tunnel0/0/0]tunnel-protocol gre p2mp [R6-Tunnel0/0/0]source s4/0/0 [R6-Tunnel0/0/0]nhrp network-id 100 [R6-Tunnel0/0/0]nhrp entry 172.16.6.3 34.0.0.0 register R7: [R7]int Tunnel 0/0/0 [R7-Tunnel0/0/0]ip add 172.16.6.7 24 [R7-Tunnel0/0/0]tunnel-protocol gre p2mp [R7-Tunnel0/0/0]source g0/0/0 [R7-Tunnel0/0/0]nhrp network-id 100 [R7-Tunnel0/0/0]nhrp entry 172.16.6.3 34.0.0.3 register 启用ospf进程: R3: [R3]ospf 1 [R3-ospf-1]area 1 [R3-ospf-1-area-0.0.0.1]dis this [V200R003C00] # area 0.0.0.1 network 172.16.33.0 0.0.0.255 network 172.16.36.0 0.0.0.255 # return [R3-ospf-1-area-0.0.0.1]network 172.16.6.0 0.0.0.255 R5: [R5]ospf 1 [R5-ospf-1]dis this [V200R003C00] # ospf 1 router-id 5.5.5.5 area 0.0.0.0 network 172.16.3.0 0.0.0.255 # return [R5-ospf-1] [R5-ospf-1]area 0 [R5-ospf-1-area-0.0.0.0]network 172.16.6.0 0.0.0.255 R6: [R6]ospf 1 [R6-ospf-1]dis this [V200R003C00] # ospf 1 router-id 6.6.6.6 area 0.0.0.0 network 172.16.4.0 0.0.0.255 area 0.0.0.2 network 172.16.65.1 0.0.0.0 # return [R6-ospf-1]area 0 [R6-ospf-1-area-0.0.0.0]network 172.16.6.0 0.0.0.255 R7: [R7]ospf 1 [R7-ospf-1]dis this [V200R003C00] # ospf 1 router-id 7.7.7.7 area 0.0.0.0 network 172.16.5.0 0.0.0.255 area 0.0.0.3 network 172.16.97.1 0.0.0.0 # return [R7-ospf-1]area 0 [R7-ospf-1-area-0.0.0.0]network 172.16.6.0 0.0.0.255
注意:使用OSPF进行私网互通,并不是最佳方法,因为使用ospf,会造成以下后果:
1.DR与BDR的选举混乱
2.邻居建立不正常。--- 因为隧道接口是P2P的网络。
由于上面的原因,解决方案: 1.解决邻居关系: 所以我们要进入隧道接口,去把类型给改了,可以改成broadcast; [R7]int t0/0/0 [R7-Tunnel0/0/0]ospf network-type broadcast [R6]int t0/0/0 [R6-Tunnel0/0/0]ospf network-type broadcast [R5]int t0/0/0 [R5-Tunnel0/0/0]ospf network-type broadcast [R3]int t0/0/0 [R3-Tunnel0/0/0]ospf network-type broadcast 2.解决DR与BDR的选举混乱:--- 只留一个DR就行,将其他的分支站点取消选举资格; [R5]int t0/0/0 [R5-Tunnel0/0/0]ospf dr-priority 0 [R6]int t0/0/0 [R6-Tunnel0/0/0]ospf dr-priority 0 [R7]int t0/0/0 [R7-Tunnel0/0/0]ospf dr-priority 0
邻居关系建立正常!!!
可以看到R1没有学到area4的路由。所以我们要做路由引入! 在R9设备上: [R9]ospf 1 [R9-ospf-1]import-route ospf 2 [R9-ospf-1]q [R9]ospf 2 [R9-ospf-2]import-route ospf 1
现在可以看到学到area4的了;
所以私网是可以互通的!
R10也能ping通R2:
R10pingR11、R1环回:
5.在公网中做easy IP
[R3]acl 2000 [R3-acl-basic-2000]rule permit source 172.16.0.0 0.0.255.255 [R3-acl-basic-2000]q [R3]int s4/0/0 [R3-Serial4/0/0]nat outbound 2000 [R5]acl 2000 [R5-acl-basic-2000]rule permit source 172.16.0.0 0.0.255.255 [R5-acl-basic-2000]q [R5]int s4/0/0 [R5-Serial4/0/0]nat outbound 2000 [R5-Serial4/0/0] [R6]acl 2000 [R6-acl-basic-2000]rule permit source 172.16.0.0 0.0.255.255 [R6-acl-basic-2000]q [R6]int s4/0/0 [R6-Serial4/0/0]nat outbound 2000 [R7]acl 2000 [R7-acl-basic-2000]rule permit source 172.16.0.0 0.0.255.255 [R7-acl-basic-2000]q [R7]int g0/0/0 [R7-GigabitEthernet0/0/0]nat outbound 2000
做了这些之后,私网中设备还是不能访问R4,没有缺省;
1.可以手动下发一条缺省: 在R3上面:在OSPF 进程里面,default-router-advertise always 2.做特殊区域: 在R3、R5、R6、R7做ABR聚合 R12、R9做ASBR聚合 ---ABR [R3]ospf 1 [R3-ospf-1]area 1 [R3-ospf-1-area-0.0.0.1]abr-summary 172.16.32.0 255.255.224.0 [R6]ospf 1 [R6-ospf-1]a 2 [R6-ospf-1-area-0.0.0.2]abr-summary 172.16.64.0 255.255.224.0 [R7]ospf 1 [R7-ospf-1]a 3 [R7-ospf-1-area-0.0.0.3]abr-summary 172.16.96.0 255.255.224.0 ----ASBR [R9]ospf 1 [R9-ospf-1]asbr [R9-ospf-1]asbr-summary 172.16.128.0 255.255.224.0 [R12]ospf 1 [R12-ospf-1]asbr [R12-ospf-1]asbr-summary 172.16.160.0 255.255.224.0
查看一下R2的路由表
能看到有聚合路由;
注意:172.16.65.4 这条路由被ospf和rip同时宣告了,所以它不会被聚合;
解决办法:rip的地址换一下,不要以172.16 开头;
路由聚合对area0的设备上的路由有明显减少!,并没有对其他进行很大的减少LSA
6.做特殊区域处理:
[R1]ospf 1 [R1-ospf-1]area 1 [R1-ospf-1-area-0.0.0.1]stub no-summary [R2]ospf 1 [R2-ospf-1]area 1 [R2-ospf-1-area-0.0.0.1]stub no-summary [R3]ospf 1 [R3-ospf-1]area 1 [R3-ospf-1-area-0.0.0.1]stub no-summary [R6]ospf 1 [R6-ospf-1]area 2 [R6-ospf-1-area-0.0.0.2]nssa no-summary [R11]ospf 1 [R11-ospf-1]area 2 [R11-ospf-1-area-0.0.0.2]nssa no-summary [R12]ospf 1 [R12-ospf-1]area 2 [R12-ospf-1-area-0.0.0.2]nssa no-summary [R7]ospf 1 [R7-ospf-1]area 3 [R7-ospf-1-area-0.0.0.3]nssa no-summary [R8]ospf 1 [R8-ospf-1]area 3 [R8-ospf-1-area-0.0.0.3]nssa no-summary [R9]ospf 1 [R9-ospf-1]area 3 [R9-ospf-1-area-0.0.0.3]nssa no-summary
现在可以看到R1和R11上面有明显的精简:
做了特殊区域后,私网就可以ping通R4的环回了:
但是可以看到做了特殊区域后,R10学不到area1和area0、area2的路由
(因为做了特殊区域,特殊区域访问其他区域的时候,都是0.0.0.0的默认路由!!所以R10访问不到了)
解决办法,在R9上面配置一条静态缺省或者手动下发一条缺省!
这里以手动下发为例:
[R9]ospf 2 [R9-ospf-2]default-route-advertise 这里不加always是因为R9开始是存在有缺省。
配置好了之后再查看R10:
可以访问到了!R10可以ping通r4的环回了;
总结一下:
路由聚合与特殊区域区别: 路由聚合只是优化骨干区域的路由表; 特殊区域优化的是其他非骨干的路由表!
7.加快收敛:修改hello时间:
按区域修改: area1: [R1]int g0/0/0 [R1-GigabitEthernet0/0/0]ospf timer hello 5 [R2]int g0/0/0 [R2-GigabitEthernet0/0/0]ospf timer hello 5 [R3]int t0/0/0 [R3-Tunnel0/0/0]ospf timer hello 5 area0: [R3]int t0/0/0 [R3-Tunnel0/0/0]ospf timer hello 5 [R5]int t0/0/0 [R5-Tunnel0/0/0]ospf timer hello 5 [R6]int t0/0/0 [R6-Tunnel0/0/0]ospf timer hello 5 [R7]int t0/0/0 [R7-Tunnel0/0/0]ospf timer hello 5 area2: [R6]int g0/0/0 [R6-GigabitEthernet0/0/0]ospf timer hello 5 [R11]int g0/0/0 [R11-GigabitEthernet0/0/0]ospf timer hello 5 [R12]int g0/0/0 [R12-GigabitEthernet0/0/0]ospf timer hello 5 area3: [R7-Tunnel0/0/0]int g0/0/1 [R7-GigabitEthernet0/0/1]ospf timer hello 5 [R8]int g0/0/0 [R8-GigabitEthernet0/0/0] [R8-GigabitEthernet0/0/0]ospf timer hello 5 [R8-GigabitEthernet0/0/0]int g0/0/1 [R8-GigabitEthernet0/0/1]ospf timer hello 5 [R9]int g0/0/0 [R9-GigabitEthernet0/0/0]ospf timer hello 5 area4: [R9]int g0/0/1 [R9-GigabitEthernet0/0/1]ospf timer hello 5 [R10]int g0/0/0 [R10-GigabitEthernet0/0/0]ospf timer hello 5
相互还是可以ping通的!
8.做安全认证:
area1: [R1]ospf 1 [R1-ospf-1]area 1 [R1-ospf-1-area-0.0.0.1]au [R1-ospf-1-area-0.0.0.1]authentication-mode md5 1 c [R1-ospf-1-area-0.0.0.1]authentication-mode md5 1 cipher 123 [R2]ospf 1 [R2-ospf-1]area 1 [R2-ospf-1-area-0.0.0.1]authentication-mode md5 1 cipher 123 [R3]ospf 1 [R3-ospf-1]area 1 [R3-ospf-1-area-0.0.0.1]authentication-mode md5 1 cipher 123 area0: [R3]ospf 1 [R3-ospf-1]area 1 [R3-ospf-1-area-0.0.0.1]authentication-mode md5 1 cipher 123 [R5]ospf 1 [R5-ospf-1]area 0 [R5-ospf-1-area-0.0.0.0]authentication-mode md5 1 cipher 123 [R6]ospf 1 [R6-ospf-1]area 0 [R6-ospf-1-area-0.0.0.0]authentication-mode md5 1 cipher 123 [R7]ospf 1 [R7-ospf-1]area 0 [R7-ospf-1-area-0.0.0.0]authentication-mode md5 1 cipher 123 [R6-ospf-1]area 2 [R6-ospf-1-area-0.0.0.2]authentication-mode md5 1 cipher 123 [R11]ospf 1 [R11-ospf-1]area 2 [R11-ospf-1-area-0.0.0.2]authentication-mode md5 1 cipher 123 [R12-ospf-1]area 2 [R12-ospf-1-area-0.0.0.2]authentication-mode md5 1 cipher 123 area3: [R7-ospf-1]area 3 [R7-ospf-1-area-0.0.0.3]authentication-mode md5 1 cipher 123 [R8]ospf 1 [R8-ospf-1]area 3 [R8-ospf-1-area-0.0.0.3]authentication-mode md5 1 cipher 123 [R9]ospf 1 [R9-ospf-1]area 3 [R9-ospf-1-area-0.0.0.3]authentication-mode md5 1 cipher 123 area4: [R9]ospf 2 [R9-ospf-2]area 4 [R9-ospf-2-area-0.0.0.4]authentication-mode md5 1 cipher 123 [R10]ospf 1 [R10-ospf-1]area 4 [R10-ospf-1-area-0.0.0.4]authentication-mode md5 1 cipher 123
我自己有相互ping通,并查看路由表和邻居表,都相互学到了路由!
实验完成!!!