思科雙出口+策略路由+NAT

1. 使用策略路由，從教育網出去的，在教育網接口進行nat轉換
2. 訪問教育網資源平時走教育網，故障走電信
3. 訪問internat走電信線路，故障走教育網
4. 服務器靜態綁定教育網ip，不管電信、聯通、教育網都走教育網訪問，所以服務器數據只能走教育網線路
5. 如果學校內公網不進行nat轉換，則route-map的acl只允許其它

 

 

R5：
interface Loopback1
 ip address 192.168.100.1 255.255.255.0//虛擬服務器地址
!
interface Loopback2
 ip address 192.168.10.1 255.255.255.0//虛擬宿舍地址
!
interface Ethernet0/0
 ip address 10.1.1.1 255.255.255.0//通往出口路由
 half-duplex
!
ip route 0.0.0.0 0.0.0.0 10.1.1.2// 默認路由


R1:
interface Ethernet0/0
 ip address 10.1.1.2 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 ip policy route-map test// 調用策略服務器網段走教育網
 half-duplex
!
interface Ethernet0/1
 ip address 12.1.1.1 255.255.255.0//電信出口ip
 ip nat outside
 ip virtual-reassembly
 half-duplex
!
interface Ethernet0/2
 ip address 13.1.1.1 255.255.255.0//教育網出口ip
 ip nat outside
 ip virtual-reassembly
 half-duplex
!
!
ip route 0.0.0.0 0.0.0.0 12.1.1.2//默認走電信
ip route 0.0.0.0 0.0.0.0 13.1.1.2 100/冗余備份走教育網
ip route 192.168.10.0 255.255.255.0 10.1.1.1//回指路由
ip route 192.168.100.0 255.255.255.0 10.1.1.1//回指路由
ip route 200.1.1.0 255.255.255.0 13.1.1.2//明細教育網路由
!
ip nat inside source route-map dianxing interface Ethernet0/1 overload//轉換關聯，電信走0/1
ip nat inside source route-map jiaoyuwang interface Ethernet0/2 overload//轉換關聯，教育網走0/2
!
access-list 1 permit 192.168.100.0 0.0.0.255//允許網段ACL
no cdp log mismatch duplex
!
route-map test permit 10//策略路由ACL-1下一跳
 match ip address 1
 set ip next-hop 13.1.1.2
!
route-map dianxing permit 10//策略路由
 match interface Ethernet0/1  //定義匹配規則
 set interface Ethernet0/1  //定義發出的數據包的出口
!
route-map jiaoyuwang permit 10
 match interface Ethernet0/2
 set interface Ethernet0/2
!

R2:
interface Ethernet0/1
 ip address 12.1.1.2 255.255.255.0
 half-duplex
!
interface Ethernet0/2
 ip address 23.1.1.1 255.255.255.0
 half-duplex
!
ip route 0.0.0.0 0.0.0.0 23.1.1.2

R3:
interface Ethernet0/1
 ip address 34.1.1.1 255.255.255.0
 half-duplex
!
interface Ethernet0/2
 ip address 13.1.1.2 255.255.255.0
 half-duplex
!
ip route 0.0.0.0 0.0.0.0 34.1.1.2

R4:
interface Loopback1
 ip address 100.1.1.1 255.255.255.0
!
interface Loopback2
 ip address 200.1.1.1 255.255.255.0
!
interface Ethernet0/1
 ip address 34.1.1.2 255.255.255.0
 half-duplex
!
interface Ethernet0/2
 ip address 23.1.1.2 255.255.255.0
 half-duplex
!
ip route 12.1.1.0 255.255.255.0 23.1.1.1
ip route 13.1.1.0 255.255.255.0 34.1.1.1


ACL實現

ip nat inside source list 100 interface GigabitEthernet0/2 overload
ip nat inside source list 101 interface GigabitEthernet0/1 overload
ip classless
ip route 200.1.1.0 255.255.255.0 13.1.1.2 
ip route 0.0.0.0 0.0.0.0 12.1.1.2 
!
!
access-list 100 permit ip any 200.1.1.0 0.0.0.255// 允許訪問教育網200.1.1.0網段
access-list 100 deny ip any any
access-list 101 deny ip any 200.1.1.0 0.0.0.255
access-list 101 permit ip any any