0
点赞
收藏
分享

微信扫一扫

HUAWEI-基于流策略实现策略路由+NAT44

心存浪漫 2023-03-03 阅读 28
HUAWEI网络技术IP链路NATPython后端开发

本拓扑参照2018年下半年试题(四)，相关资料文档参照华为官方文档

HUAWEI-基于流策略实现策略路由+NAT44

HUAWEI-基于流策略实现策略路由+NAT44_链路

背景说明： 某公司内部两个网段，192.168.10.0/24和192.168.20.0/24，通过出口路由R1单臂路由实现VLAN间的路由，同时192.168.10.0/24由于业务原因对于流量需求较大，网络管理员决定通过流策略实现192.168.10.0/24通过高速链路使用NAT访问Internet，带宽需求就低的192.168.20.0/24通过低速链路使用NAT访问Internet

IP地址规划表：

本端设备

端口

IP地址或所属VLAN

对端设备

端口

IP地址或所属VLAN

R1

GE 0/0/0

202.100.1.2/29

ISP1

GE 0/0/0

202.100.1.1/29

R1

GE 0/0/1

104.114.128.2/29

ISP2

GE 0/0/0

104.114.128.1/29

R1

GE 0/0/2

SW

GE 0/0/2

R1

GE 0/0/2.1

192.168.10.1/24

SW

GE 0/0/2

VLAN 10

R1

GE 0/0/2.2

192.168.20.1/24

SW

GE 0/0/2

VLAN 20

SW

Eth 0/0/1

VLAN 10

PC1

Eth 0/0/1

192.168.10.10/24

SW

Eth 0/0/2

VLAN 20

PC2

Eth 0/0/1

192.168.20.10/24

配置步骤：

  • 配置VLAN并配置接口，配置单臂路由和静态路由实现网络互通。
  • 配置ACL访问控制列表，匹配192.168.10.0和192.168.20.0的流量
  • 配置流分类，匹配规则为上述ACL规则，使设备可以对报文进行区分
  • 配置流行为，满足不同ACL规则的数据流走不同的链路
  • 配置流策略，绑定流分类和流行为，应用到接口
  • 配置动态NAT，实现内网对外网的转换

项目实施：

一、配置配置VLAN并配置接口，配置单臂路由和静态路由实现网络互通。

[SW] vlan batch 10 20
Info: This operation may take a few seconds. Please wait for a moment...done.
#
[SW]interface Ethernet0/0/1
[SW-Ethernet0/0/1] port link-type access
[SW-Ethernet0/0/1] port default vlan 10
#
[SW-Ethernet0/0/1]interface Ethernet0/0/2
[SW-Ethernet0/0/2] port link-type access
[SW-Ethernet0/0/2] port default vlan 20
#
[SW-Ethernet0/0/2]interface GigabitEthernet0/0/2
[SW-GigabitEthernet0/0/2] port link-type trunk
[SW-GigabitEthernet0/0/2] port trunk allow-pass vlan 10 20

[R1]interface GigabitEthernet0/0/0
[R1-GigabitEthernet0/0/0]
[R1-GigabitEthernet0/0/0]ip address 202.100.1.2 255.255.255.248 
#
[R1-GigabitEthernet0/0/0]interface GigabitEthernet0/0/1
[R1-GigabitEthernet0/0/1]ip address 104.114.128.2 255.255.255.248 
#
[R1-GigabitEthernet0/0/1]interface GigabitEthernet0/0/2.1
[R1-GigabitEthernet0/0/2.1]dot1q termination vid 10
[R1-GigabitEthernet0/0/2.1]ip address 192.168.10.1 255.255.255.0 
[R1-GigabitEthernet0/0/2.1] arp broadcast enable
#
[R1-GigabitEthernet0/0/2.1]interface GigabitEthernet0/0/2.2
[R1-GigabitEthernet0/0/2.2]dot1q termination vid 20
[R1-GigabitEthernet0/0/2.2]ip address 192.168.20.1 255.255.255.0 
[R1-GigabitEthernet0/0/2.2]arp broadcast enable
#
[R1]ip route-static 0.0.0.0 0.0.0.0 202.100.1.1
[R1]ip route-static 0.0.0.0 0.0.0.0 104.114.128.1

[ISP1]interface GigabitEthernet0/0/0
[ISP1-GigabitEthernet0/0/0] ip address 202.100.1.1 255.255.255.248 
#
[ISP1]ip route-static 0.0.0.0 0.0.0.0 202.100.1.2

[ISP2]interface GigabitEthernet0/0/0
[ISP2-GigabitEthernet0/0/0]ip address 104.114.128.1 255.255.255.248 
#
[ISP2]ip route-static 0.0.0.0 0.0.0.0 104.114.128.2

TIPS:如果设备上没有命中下一跳IP地址对应的ARP表项，设备会触发ARP学习，如果一直学习不到ARP，则报文按原始转发路径转发，重定向不生效。

[R1]ping 202.100.1.1
  PING 202.100.1.1: 56  data bytes, press CTRL_C to break
    Reply from 202.100.1.1: bytes=56 Sequence=1 ttl=255 time=40 ms
    Reply from 202.100.1.1: bytes=56 Sequence=2 ttl=255 time=20 ms
    Reply from 202.100.1.1: bytes=56 Sequence=3 ttl=255 time=30 ms
    Reply from 202.100.1.1: bytes=56 Sequence=4 ttl=255 time=30 ms
    Reply from 202.100.1.1: bytes=56 Sequence=5 ttl=255 time=30 ms

  --- 202.100.1.1 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 20/30/40 ms

[R1]ping 104.114.128.1
  PING 104.114.128.1: 56  data bytes, press CTRL_C to break
    Reply from 104.114.128.1: bytes=56 Sequence=1 ttl=255 time=30 ms
    Reply from 104.114.128.1: bytes=56 Sequence=2 ttl=255 time=20 ms
    Reply from 104.114.128.1: bytes=56 Sequence=3 ttl=255 time=20 ms
    Reply from 104.114.128.1: bytes=56 Sequence=4 ttl=255 time=10 ms
    Reply from 104.114.128.1: bytes=56 Sequence=5 ttl=255 time=30 ms

  --- 104.114.128.1 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 10/22/30 ms

[R1]display arp all 
IP ADDRESS      MAC ADDRESS     EXPIRE(M) TYPE        INTERFACE   VPN-INSTANCE 
                                          VLAN/CEVLAN PVC                      
------------------------------------------------------------------------------
202.100.1.2     00e0-fc32-2036            I -         GE0/0/0
202.100.1.1     00e0-fc78-6477  19        D-0         GE0/0/0
104.114.128.2   00e0-fc32-2037            I -         GE0/0/1
104.114.128.1   00e0-fcc5-13c9  20        D-0         GE0/0/1
192.168.10.1    00e0-fc32-2038            I -         GE0/0/2.1
192.168.10.10   5489-984a-4326  16        D-0         GE0/0/2.1
                                            10/-
192.168.20.1    00e0-fc32-2038            I -         GE0/0/2.2
------------------------------------------------------------------------------
Total:7         Dynamic:3       Static:0     Interface:4

二、配置ACL访问控制列表，匹配192.168.10.0和192.168.20.0的流量（需要注意先把内网互访的数据流放行）

[R1]acl 3000  
[R1-acl-adv-3000]
[R1-acl-adv-3000]rule 5 permit ip source 192.168.10.0 0.0.0.255 destination 192.168.20.0 0.0.0.255 
[R1-acl-adv-3000]rule 10 permit ip source 192.168.20.0 0.0.0.255 destination 192.168.10.0 0.0.0.255 
#
[R1-acl-adv-3000]acl number 3101  
[R1-acl-adv-3101]rule 5 permit ip source 192.168.10.0 0.0.0.255 
#
[R1-acl-adv-3101]acl number 3102  
[R1-acl-adv-3102] rule 5 permit ip source 192.168.20.0 0.0.0.255

三、配置流分类，使设备可以对报文进行区分

[R1]traffic classifier c2 operator or
[R1-classifier-c2] if-match acl 3102
#
[R1-classifier-c2]traffic classifier c0 operator or
[R1-classifier-c0] if-match acl 3000
#
[R1-classifier-c0]traffic classifier c1 operator or
[R1-classifier-c1] if-match acl 3101

四、配置流行为，满足不同ACL规则的数据流走不同的链路

[R1]traffic behavior b0
[R1-behavior-b0]permit
#
[R1-behavior-b0]traffic behavior b1
[R1-behavior-b1] redirect ip-nexthop 202.100.1.1
#
[R1-behavior-b1]traffic behavior b2
[R1-behavior-b2] redirect ip-nexthop 104.114.128.1

五、配置流策略，绑定流分类和流行为，应用到接口

[R1]traffic policy p1
[R1-trafficpolicy-p1]classifier c0 behavior b0
[R1-trafficpolicy-p1] classifier c1 behavior b1
[R1-trafficpolicy-p1] classifier c2 behavior b2
#
[R1-GigabitEthernet0/0/2]
[R1-GigabitEthernet0/0/2] traffic-policy p1 inbound

六、配置动态NAT，实现内网对外网的转换

[R1]nat address-group 0 202.100.1.3 202.100.1.5
[R1]nat address-group 1 104.114.1.3 104.114.1.5
#
[R1]interface GigabitEthernet0/0/0
[R1-GigabitEthernet0/0/0] nat outbound 2000 address-group 0 no-pat
#
[R1-GigabitEthernet0/0/0]interface GigabitEthernet0/0/1
[R1-GigabitEthernet0/0/1] nat outbound 2001 address-group 1 no-pat
#路由黑洞(可选)
[R1]ip route-static 202.100.1.3 32 NULL 0
[R1]ip route-static 202.100.1.4 32 NULL 0
[R1]ip route-static 202.100.1.5 32 NULL 0
[R1]ip route-static 104.114.1.3 32 NULL 0
[R1]ip route-static 104.114.1.4 32 NULL 0
[R1]ip route-static 104.114.1.5 32 NULL 0

项目验证：

验证单臂路由：

HUAWEI-基于流策略实现策略路由+NAT44_HUAWEI_02

验证流行为：

[R1]display traffic classifier user-defined 
  User Defined Classifier Information:
   Classifier: c2
    Operator: OR
    Rule(s) : 
     if-match acl 3102
   Classifier: c0
    Operator: OR
    Rule(s) : 
     if-match acl 3000
   Classifier: c1
    Operator: OR
    Rule(s) : 
     if-match acl 3101

验证流分类：

[R1]display traffic behavior user-defined 
  User Defined Behavior Information:
    Behavior: b2 
      Redirect: 
        Redirect ip-nexthop 104.114.128.1

    Behavior: b0 

    Behavior: b1 
      Redirect: 
        Redirect ip-nexthop 202.100.1.1
      statistic: enable

验证流策略：

[R1]dis traffic policy user-defined 
  User Defined Traffic Policy Information:
  Policy: p1
   Classifier: c0
    Operator: OR
     Behavior: b0

   Classifier: c1
    Operator: OR
     Behavior: b1
      Redirect: 
        Redirect ip-nexthop 202.100.1.1
      statistic: enable

   Classifier: c2
    Operator: OR
     Behavior: b2
      Redirect: 
        Redirect ip-nexthop 104.114.128.1

[R1]traffic behavior b1
[R1-behavior-b1]statistic enable 
#
[R1]traffic behavior b2
[R1-behavior-b2]statistic enable 
#
[R1]display traffic policy statistics interface GigabitEthernet 0/0/2 inbound 

 Interface: GigabitEthernet0/0/2
 Traffic policy inbound: p1
 Rule number: 4
 Current status: OK!
Item                           Sum(Packets/Bytes)            Rate(pps/bps)
-------------------------------------------------------------------------------
Matched                                       5/                         0/
                                            510                          0
  +--Passed                                   5/                         0/
                                            510                          0
  +--Dropped                                  0/                         0/
                                              0                          0
    +--Filter                                 0/                         0/
                                              0                          0
    +--CAR                                    0/                         0/
                                              0                          0
  +--Queue Matched                            0/                         0/
                                              0                          0
    +--Enqueued                               0/                         0/
                                              0                          0
    +--Discarded                              0/                         0/
                                              0                          0
  +--Car                                      0/                         0/
                                              0                          0
    +--Green packets                          0/                         0/
                                              0                          0
    +--Yellow packets                         0/                         0/
                                              0                          0
    +--Red packets                            0/                         0/
                                              0                          0
[R1]

PC1流策略验证：抓包验证流量走向

HUAWEI-基于流策略实现策略路由+NAT44_HUAWEI_03

PC2流策略验证：抓包验证流量走向

HUAWEI-基于流策略实现策略路由+NAT44_链路_04


举报

相关推荐

# huawei--流策略+NAT+单臂路由

EthernetIPNATJavaScript前端开发

HuaWei ❉ 路由策略

华为

HuaWei ❀ BGP选择路由的策略

默认值优先级虚拟化云计算

多出口NAT策略路由案例

网络拓扑学经验分享网络协议

策略路由和路由策略

硬件工程射频工程

路由策略，策略路由总结

策略路由模块化数据通信考试认证

路由策略和策略路由

路由表策略路由路由回灌路由环路路由交换网络/安全

路由策略

3c静态路由ip地址H3C认证考试认证

策略路由

策略路由路由表sed路由交换网络/安全

GRE隧道+策略路由，实现路由转发

策略路由gre隧道Linux系统/运维
0 条评论