IP--路由--策略
r1
[r1-GigabitEthernet0/0/0]ip add 12.0.0.1 24
[r1-GigabitEthernet0/0/0]int g 0/0/1
[r1-GigabitEthernet0/0/1]ip add 14.0.0.1 24
[r1-GigabitEthernet0/0/1]int l0
[r1-LoopBack0]ip add 1.1.1.1 24
[r1-LoopBack0]int l1
[r1-LoopBack1]ip ad 172.16.1.1 24
[r1-LoopBack1]int l2
[r1-LoopBack2]ip ad 172.16.2.1 24
[r1-LoopBack2]int l3
[r1-LoopBack3]ip ad 172.16.3.1 24
[r1]ip route-static 172.16.0.0 22 NULL 0 路由黑洞
rip配置
[r1-rip-1]network 12.0.0.0
[r1-rip-1]network 14.0.0.0
[r1-rip-1]network 1.0.0.0
[r1-rip-1]network 172.16.0.0
rip手工汇总(r1两个物理接口都要进行汇总)
[r1]int g0/0/0
[r1-GigabitEthernet0/0/0]rip summary-address 172.16.0.0 255.255.252.0 要写完整的掩码
[r1-GigabitEthernet0/0/0]int g 0/0/1
[r1-GigabitEthernet0/0/1]rip summary-address 172.16.0.0 255.255.252.0
r2
[r2]int g 0/0/0
[r2-GigabitEthernet0/0/0]ip ad 12.0.0.2 24
[r2-GigabitEthernet0/0/0]int g 0/0/1
[r2-GigabitEthernet0/0/1]ip ad 23.0.0.1 24
[r2-GigabitEthernet0/0/1]int l0
[r2-LoopBack0]ip add 2.2.2.2 24
rip配置
[r2-rip-1]v 2
[r2-rip-1]network 12.0.0.0
[r2-rip-1]network 23.0.0.0
[r2-rip-1]network 2.0.0.0
r3
[r3]int g 0/0/0
[r3-GigabitEthernet0/0/0]ip ad 23.0.0.2 24
[r3-GigabitEthernet0/0/0]int g 0/0/1
[r3-GigabitEthernet0/0/1]ip ad 34.0.0.1 24
[r3-GigabitEthernet0/0/1]int l0
[r3-LoopBack0]ip ad 3.3.3.3 24
rip配置
[r3-rip-1]network 23.0.0.0
[r3-rip-1]network 34.0.0.0
[r3-rip-1]network 3.0.0.0
r4
[r4]int g0/0/0
[r4-GigabitEthernet0/0/0]ip add 14.0.0.2 24
[r4-GigabitEthernet0/0/0]int g 0/0/01
[r4-GigabitEthernet0/0/1]ip ad 34.0.0.2 24
[r4-GigabitEthernet0/0/1]int g0/0/2
[r4-GigabitEthernet0/0/2]ip ad 45.0.0.1 24
[r4-GigabitEthernet0/0/2]
[r4-GigabitEthernet0/0/2]int g 4/0/0
[r4-GigabitEthernet4/0/0]ip ad 46.0.0.1 24
[r4-GigabitEthernet4/0/0]
[r4]int l0
[r4-LoopBack0]ip ad 4.4.4.4 24
rip配置
[r4-rip-1]network 34.0.0.0
[r4-rip-1]network 45.0.0.0
[r4-rip-1]network 14.0.0.0
[r4-rip-1]network 46.0.0.0
[r4-rip-1]network 4.0.0.0
r5
[r5]int g0/0/0
[r5-GigabitEthernet0/0/0]ip add 45.0.0.2 24
[r5-GigabitEthernet0/0/0]
[r5-GigabitEthernet0/0/0]in l0
[r5-LoopBack0]ip ad 5.5.5.5 24
rip配置
[r5-rip-1]network 45.0.0.0
r6
[r6]in g 0/0/0
[r6-GigabitEthernet0/0/0]ip ad 46.0.0.2 24
[r6-GigabitEthernet0/0/0]
[r6-GigabitEthernet0/0/0]int g 0/0/1
[r6-GigabitEthernet0/0/1]ip ad 67.0.0.1 24
[r6-GigabitEthernet0/0/1]
[r6-GigabitEthernet0/0/1]int l0
[r6-LoopBack0]ip ad 6.6.6.6 24
rip配置
[r6-rip-1]network 46.0.0.0
[r6-rip-1]network 67.0.0.0
[r6-rip-1]network 6.0.0.0
要让ripv1和ripv2互通，两种方法：重发布(不满足条件，拓扑中没有边界设备）
r6出接口配置导入v2
r6和r7路由表获取到了ripv2设备的路由信息.v2和v1互通
r7
[r7]int g 0/0/0
[r7-GigabitEthernet0/0/0]ip ad 67.0.0.2 ^
[r7-GigabitEthernet0/0/0]ip ad 67.0.0.2 24
[r7-GigabitEthernet0/0/0]in l0
[r7-LoopBack0]ip ad 7.7.7.7 24
rip配置
[r7-rip-1]network 67.0.0.0
[r7-rip-1]network 7.0.0.0
要求r3使用r2访问r1：
r3访问r1走负载均衡，上下开销一样，所以加大下面开销，可以在r4的出方向修改，也可以在r3的入方向修改。
创建acl列表，抓取对应网段的流量(只抓取，不做任何动作)
[r3]acl 2000
[r3-acl-basic-2000]rule permit source 1.1.1.0 0
[r3-acl-basic-2000]rule permit source 172.16.0.0 0
去0/0/1接口，调整rip开销值
[r3]int g0/0/1
[r3-GigabitEthernet0/0/1]rip
[r3-GigabitEthernet0/0/1]rip metricin 2000?
INTEGER<0-15> The value of metric adding to route
INTEGER<2000-2999> Basic access-list (add to current using rules)
[r3-GigabitEthernet0/0/1]rip metricin 2000 10
增加路由传递的安全性---做手工认证
r1和r2为例
分别到对应的接口配置---两边格式都要一样
[r1-GigabitEthernet0/0/0]rip authentication-mode md5 usual cipher 123456
[r2-GigabitEthernet0/0/0]rip authentication-mode md5 usual cipher 123456
r5环回没有宣告，在边界上下发一条缺省，要内网的路由期生成指向边界的缺省
[r5-rip-1]default-route originate
R6-R7不能学习到达R1环回路由------过滤（只在r6上面过滤既可以）
r4出方向或者r6入方向
[r6]acl 2000
[r6-acl-basic-2000]rule deny source 1.1.1.0 0
[r6-acl-basic-2000]rule deny source 172.16.0.0 0
[r6-acl-basic-2000]rule permit source any 最后允许所有
[r6-acl-basic-2000]q
[r6]rip
[r6]rip
[r6-rip-1]fi
[r6-rip-1]filter-policy 2000 i
[r6-rip-1]filter-policy 2000 import
r1 telnet r2环回实际上 telnet r7上
1.r7开启telnet：
[r7]aaa
[r7-aaa]local-user xx privilege level 15 password cipher xx
[r7-aaa]local-user xx service-type telnet 规定服务类型
[r7]user-interface vty 0 4 五个虚拟端口
[r7-ui-vty0-4]authentication-mode aaa aaa认证类型
2.还要做端口映射：
r1---r2-----r7（r2此时是边界路由器，r7属于内网，访问端口实际上改变目标ip地址，访问过程改的是目标IP即内网ip地址）华为设备的nat在边界路由器的出接口配置的
[r2-GigabitEthernet0/0/0]nat server protocol tcp global interface loopback 0 23
inside 7.7.7.7 23
Warning:The port 23 is well-known port. If you continue it may cause function fa
ilure.
Are you sure to continue?[Y/N]:y
触发不了nat，r2走r7走了负载均衡，没有走内网，所有要去加大去r7链路的开销值，r7回r2的时候也走了负载均衡，所以也要在r4上配置加大另一条链路的开销值
[r2]acl 2000
[r2-acl-basic-2000]rule permit source 7.0.0.0 0
[r2-acl-basic-2000]q
[r2]int g 0/0/0
[r2-GigabitEthernet0/0/0]rip metricin 2000 10
[r4]acl 2000
[r4-acl-basic-2000]rule permit source 12.0.0.0 0
[r4-acl-basic-2000]q
[r4]int g0/0/0
[r4-GigabitEthernet0/0/0]rip metricout
[r4-GigabitEthernet0/0/0]rip metricin 2000 10
