HSRP配置
1.1 問題
在企業網絡到外部的連接方案中,要求不高的條件下可以是單出口。一旦該出口線路出現問題,整個企業網絡就不能連接到外網了。為了使得企 業網絡到外網連接的高可用性,可以設置兩個以上的出口,然而多個出口對於內網主機意味着我個網關。主機不能同時使用多個網關,當主機所使用的網關出現故障 時,它不能實現網關的自動切換。
- 配置熱備份路由協議
1.2 方案
在出口設備上配置熱備份路由協議(HSRP),組成一個HSRP組,組內兩個出口設備共享一個虛擬IP地址,該IP地址作為內網主機的網關。
HSRP組成員有主備之分,虛擬IP地址被附加到主設備上。如果主設備線路出故障,備份設備會成為主設備,虛擬IP地址也會遷移過來。這樣,不管哪一個出口設備出現問題,不管哪個出口設備在提供外網接入,內網主機的網關都不需要改變。
網絡拓撲圖如圖-1所示:

圖-1
1.3 步驟
實現此案例需要按照如下步驟進行。
步驟一:分別在三台路由器上配置端口IP地址
- tarena-R1(config)# interface f0/0
- tarena-R1(config-if)#ip address 192.168.1.252 255.255.255.0
- tarena-R1(config-if)#no shutdown
- tarena-R1(config-if)#interface f0/1
- tarena-R1(config-if)#ip address 192.168.2.1 255.255.255.0
- tarena-R1(config-if)#no shutdown
- tarena-R2(config)#interface f0/0
- tarena-R2(config-if)#ip address 192.168.1.253 255.255.255.0
- tarena-R2(config-if)#no shutdown
- tarena-R2(config-if)#interface f0/1
- tarena-R2(config-if)#ip address 192.168.3.1 255.255.255.0
- tarena-R2(config-if)#no shutdown
- tarena-R3(config)#interface f0/0
- tarena-R3(config-if)#ip address 192.168.2.2 255.255.255.0
- tarena-R3(config-if)#no shutdown
- tarena-R3(config-if)#interface f0/1
- tarena-R3(config-if)#ip address 192.168.3.2 255.255.255.0
- tarena-R3(config-if)#no shutdown
- tarena-R3(config-if)#interface f1/0
- tarena-R3(config-if)#ip address 192.168.4.254 255.255.255.0
- tarena-R3(config-if)#no shutdown
步驟二:在R1和R2上配置到外網的默認路由
- tarena-R1(config)#ip route 0.0.0.0 0.0.0.0 192.168.2.2
- tarena-R1(config)#end
- tarena-R1#show ip route
- Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
- D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
- N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
- E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
- i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
- * - candidate default, U - per-user static route, o - ODR
- P - periodic downloaded static route
- Gateway of last resort is 192.168.1.2 to network 0.0.0.0
- C 192.168.1.0/24 is directly connected, FastEthernet0/0
- C 192.168.2.0/24 is directly connected, FastEthernet0/1
- S* 0.0.0.0/0 [1/0] via 192.168.2.2
- tarena-R1#
- tarena-R2(config)#ip route 0.0.0.0 0.0.0.0 192.168.3.2
- tarena-R2(config)#exit
- tarena-R2#show ip route
- Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
- D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
- N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
- E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
- i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
- * - candidate default, U - per-user static route, o - ODR
- P - periodic downloaded static route
- Gateway of last resort is 192.168.2.2 to network 0.0.0.0
- C 192.168.1.0/24 is directly connected, FastEthernet0/0
- C 192.168.3.0/24 is directly connected, FastEthernet0/1
- S* 0.0.0.0/0 [1/0] via 192.168.3.2
步驟三:在R3上配置到企業內網的靜態路由
- tarena-R3(config)#ip route 192.168.1.0 255.255.255.0 192.168.2.1
- tarena-R3(config)#ip route 192.168.1.0 255.255.255.0 192.168.3.1
- tarena-R3(config)#end
- tarena-R3#show ip route
- Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
- D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
- N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
- E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
- i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
- * - candidate default, U - per-user static route, o - ODR
- P - periodic downloaded static route
- Gateway of last resort is not set
- S 192.168.1.0/24 [1/0] via 192.168.2.1
- [1/0] via 192.168.3.1
- C 192.168.2.0/24 is directly connected, FastEthernet0/0
- C 192.168.3.0/24 is directly connected, FastEthernet0/1
- C 192.168.4.0/24 is directly connected, FastEthernet1/0
- tarena-R3#
步驟四:在R1上配置HSRP,指定其優先級為200
HSRP的默認優先級為100,路由器啟動后,根據優先級決定誰可以成為活躍路由器,優先級高的將勝出。如果路由器優先級相同,再比較端口IP地址,IP地址大的成為活路躍路由器。
另外,如果優先級低的路由器先啟動了,它將成為活躍路由器。優先級高的路由器啟動后,發現已有活躍路由器存在,它將接受現狀,直到活躍路由器出現故障它才會在重新選舉時成為活躍角色。
- tarena-R1(config)#interface f0/0
- tarena-R1(config-if)#standby 1 ip 192.168.1.254
- tarena-R1(config-if)#standby 1 priority 200
- %HSRP-6-STATECHANGE: FastEthernet0/0 Grp 1 state Speak -> Standby
- %HSRP-6-STATECHANGE: FastEthernet0/0 Grp 1 state Standby -> Active
配置HSRP后,通過輸出日志可以觀察到路由器角色的改變。
步驟五:在R2上配置HSRP,指定其優先級為195
- tarena-R2(config)#interface f0/0
- tarena-R2(config-if)#standby 1 ip 192.168.1.254
- tarena-R2(config-if)#standby 1 priority 195
- %HSRP-6-STATECHANGE: FastEthernet0/0 Grp 1 state Speak -> Standby
步驟六:分別在R1和R2上查看HSRP信息
- tarena-R1#show standby brief
- P indicates configured to preempt.
- |
- Interface Grp Pri P State Active Standby Virtual IP
- Fa0/0 1 200 Active local 192.168.1.253 192.168.1.254
- tarena-R2#show standby brief
- P indicates configured to preempt.
- |
- Interface Grp Pri P State Active Standby Virtual IP
- Fa0/0 1 195 Standby 192.168.2.252 local 192.168.1.254
步驟七:在內部主機上測試到外網主機的連通性
- SERVER>ipconfig
- FastEthernet0 Connection:(default port)
- Link-local IPv6 Address.........: FE80::207:ECFF:FE80:557D
- IP Address......................: 192.168.1.1
- Subnet Mask.....................: 255.255.255.0
- Default Gateway.................: 192.168.1.254
- PC>ping 192.168.4.1
- Pinging 192.168.4.1 with 32 bytes of data:
- Reply from 192.168.4.1: bytes=32 time=0ms TTL=126
- Reply from 192.168.4.1: bytes=32 time=0ms TTL=126
- Reply from 192.168.4.1: bytes=32 time=0ms TTL=126
- Reply from 192.168.4.1: bytes=32 time=1ms TTL=126
- Ping statistics for 192.168.4.1
- Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
- Approximate round trip times in milli-seconds:
- Minimum = 0ms, Maximum = 1ms, Average = 0ms
步驟八:在R1配置端口跟蹤、R2配置占先權
- tarena-R1(config)#interface fastEthernet 0/0
- tarena-R1(config-if)#standby 1 track f0/1
- tarena-R2(config)#interface fastEthernet 0/0
- tarena-R2(config-if)#standby 1 preempt
步驟九:關閉R1的f0/1接口,模擬設備故障,查看R2的HSRP信息
- tarena-R1(config)#interface fastEthernet 0/1
- tarena-R1(config-if)#shutdown
- tarena-R2#show standby brief
- P indicates configured to preempt.
- |
- Interface Grp Pri P State Active Standby Virtual IP
- Fa0/0 1 195 Active local unknown 192.168.1.254
結果顯示R2已成為活躍路由器,而備份路由器狀態未知。虛擬路由器的IP地址192.168.1.254/24也已遷移到R2上了。
步驟十:在R1配置占先權,並激活R1的f0/1接口並查狀態
備份路由器成為活躍路由器后,原來的活躍路由器R1即使線路修復也不會重新成為進入活躍狀態。
為了使路由器完全根據優先級來決定其狀態,需要配置占先權。占先權保證了嚴格根據優先級來決定哪台設備進入活躍狀態。
- tarena-R1(config)#interface f0/0
- tarena-R1(config-if)#standby 1 preempt
- tarena-R1(config)#interface f0/1
- tarena-R1(config-if)#no shutdown
- tarena-R1#show standby brief
- P indicates configured to preempt.
- |
- Interface Grp Pri P State Active Standby Virtual IP
- Fa0/0 1 200 Active local 192.168.1.253 192.168.1.254
2 案例2:三層交換配置HSRP
2.1 問題
以三層交換機代替路由器作為網關設備。
2.2 方案
以三層交換機代替路由器作為網關設備,以vlan1作為網關接口
網絡拓撲如圖-2所示:

圖-2
2.3 步驟
實現此案例需要按照如下步驟進行。
步驟一:分別為三層交換機和路由器配置IP並開啟三層交換機路由功能。
- SM1(config)#ip routing
- SM1(config)#interface vlan 1
- SM1(config-if)#ip address 192.168.1.252 255.255.255.0
- SM1(config-if)#no shutdown
- SM1(config-if)#eixt
- SM1(config)#interface fastEthernet 0/1
- SM1(config-if)#no switchport
- SM1(config-if)#ip address 192.168.2.1 255.255.255.0
- SM1(config-if)#no shutdown
- SM2(config)#ip routing
- SM2(config)#interface vlan 1
- SM2(config-if)#ip add 192.168.1.253 255.255.255.0
- SM2(config-if)#no shutdown
- SM2(config-if)#exit
- SM2(config)#interface f0/1
- SM2(config-if)#no switchport
- SM2(config-if)#ip address 192.168.3.1 255.255.255.0
- Router(config)#interface fastEthernet 0/0
- Router(config-if)#ip address 192.168.2.2 255.255.255.0
- Router(config-if)#no shutdown
- Router(config-if)#exit
- Router(config)#interface fastEthernet 0/1
- Router(config-if)#ip address 192.168.3.2 255.255.255.0
- Router(config-if)#no shutdown
- Router(config-if)#exit
- Router(config)#interface fastEthernet 1/0
- Router(config-if)#ip address 192.168.4.254 255.255.255.0
- Router(config-if)#no shutdown
步驟二:在三層交換機和路由器上配置動態路由,在路由器上查看路由表。
- SM1(config)#router rip
- SM1(config-router)#version 2
- SM1(config-router)#no auto-summary
- SM1(config-router)#network 192.168.1.0
- SM1(config-router)#network 192.168.2.0
- SM2(config)#router rip
- SM2(config-router)#version 2
- SM2(config-router)#no auto-summary
- SM2(config-router)#network 192.168.1.0
- SM2(config-router)#network 192.168.3.0
- Router(config)#router rip
- Router(config-router)#version 2
- Router(config-router)#no auto-summary
- Router(config-router)#network 192.168.2.0
- Router(config-router)#network 192.168.3.0
- Router(config-router)#network 192.168.4.0
- Router#show ip route
- Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
- D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
- N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
- E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
- i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
- * - candidate default, U - per-user static route, o - ODR
- P - periodic downloaded static route
- Gateway of last resort is not set
- R 192.168.1.0/24 [120/1] via 192.168.3.1, 00:00:10, FastEthernet0/1
- [120/1] via 192.168.2.1, 00:00:04, FastEthernet0/0
- C 192.168.2.0/24 is directly connected, FastEthernet0/0
- C 192.168.3.0/24 is directly connected, FastEthernet0/1
- C 192.168.4.0/24 is directly connected, FastEthernet1/0
步驟三:在三層交換機vlan1中配置虛擬網關並設置優先級和占先權
- SM1(config)#interface vlan 1
- SM1(config-if)#standby 1 ip 192.168.1.254
- SM1(config-if)#standby 1 priority 200
- SM1(config-if)#standby 1 preempt
- %HSRP-6-STATECHANGE: Vlan1 Grp 1 state Speak -> Standby
- %HSRP-6-STATECHANGE: Vlan1 Grp 1 state Standby -> Active
- SM2(config)#interface vlan 1
- SM2(config-if)#standby 1 ip 192.168.1.254
- %HSRP-6-STATECHANGE: Vlan1 Grp 1 state Speak -> Standby
- SM2(config-if)#standby 1 priority 195
- SM2(config-if)#standby 1 preempt
步驟四:在三層交換機vlan1中配置端口跟蹤,關閉被跟蹤接口並查看SM1的HSRP狀態
當三層交換機SM1並沒有故障,而是上連端口f0/1接口線路損壞時主備無法快速切換,所以要在主設備上配置端口跟蹤,確保當主設備線路出現問題時備份設備可以快速切換身份
- SM1(config)#interface vlan 1
- SM1(config-if)#standby 1 track f0/1
- SM1(config)#interface f0/1
- SM1(config-if)#shutdown
- SM1(config-if)#end
- SM1#show standby brief
- P indicates configured to preempt.
- Interface Grp Pri P State Active Standby Virtual IP
- Vl1 1 1 190 P Standby 192.168.1.253 local 192.168.1.254
- SM1#
步驟五:測試網路連通性
模擬主設備故障或被跟蹤的端口故障時測試網絡的連通性,確保備份設備被啟用
- server>ping 192.168.4.1
- Pinging 192.168.4.1 with 32 bytes of data:
- Reply from 192.168.4.1: bytes=32 time=1ms TTL=126
- Reply from 192.168.4.1: bytes=32 time=1ms TTL=126
- Reply from 192.168.4.1: bytes=32 time=14ms TTL=126
- Reply from 192.168.4.1: bytes=32 time=15ms TTL=126
- Ping statistics for 192.168.4.1:
- Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
- Approximate round trip times in milli-seconds:
- Minimum = 1ms, Maximum = 15ms, Average = 7ms
3 案例3:STP的配置
3.1 問題
二層網絡中有可能出現因為線路故障而導致的通信故障,通過冗余線路可以消除因為某一線路故障而導致的網絡中斷。
但是因為冗余線路的存在,又可能會出現廣播風暴、相同幀的不斷復制和MAC地址表不穩定。
- 配置Switch1為vlan1的主根,Switch2為vlan1的次根
3.2 方案
為了保證在冗余環境下不會出廣播風暴等問題,引入了生成樹(STP)協議。通過生成樹協議可以把冗余線路上的某一個端口置為阻塞 (BLOCKING)狀態,防止廣播風暴的產生,當某一線路出現故障時,被阻塞的端口自動進入轉發(FORWARDING)狀態,保證網絡的暢通性。
網絡拓撲如圖-3所示:

圖-3
3.3 步驟
實現此案例需要按照如下步驟進行。
步驟一:將三台交換機相連的端口配置為中繼端口
- tarena-sw1(config)#interface range f0/12 -13
- tarena-sw1(config-if-range)#switchport mode trunk
- tarena-sw2(config)#interface range f0/12, f0/23
- tarena-sw2(config-if-range)#switchport mode trunk
- tarena-sw3(config)#interface range f0/13 ,f0/23
- tarena-sw3(config-if-range)#switchport mode trunk
步驟二:調整優先級設置tarena-sw1為根網橋
根網橋唯一的依據是BID最小。BID分為兩個部分:優先級+MAC地址。比較BID時,先比較優先級,如果優先級相同才比較MAC地址。
優先級取值范圍是0到65535,默認值為32768。在查看優先級時,即使是默認值看到的也不是32768,因為交換機的優先級采用系統優先級+VLAN編號的方式,所以查看到的VLAN1默認優先級是32769(系統優先級32768+VLAN編號1)。
- tarena-sw1(config)# spanning-tree vlan 1 priority 28672
- tarena-sw1(config)#exit
- tarena-sw1#show spanning-tree
- VLAN0001
- Spanning tree enabled protocol ieee
- Root ID Priority 28673 //默認優先級為32768
- Address 0060.478B.607B
- This bridge is the root
- Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
- Bridge ID Priority 28673 (priority 24576 sys-id-ext 1)
- Address 0060.478B.607B
- Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
- Aging Time 20
- Interface Role Sts Cost Prio.Nbr Type
- ----------- ------ --- -------- -------- ----------------------
- Fa0/13 Desg FWD 19 128.13 P2p
- Fa0/12 Desg FWD 19 128.12 P2p
查看到的結果,Root ID部分指的是根網橋信息,Bridge ID部分是當前所操作的交換機信息,如果二者一致表示當前操作的交換機就是根網橋。
4 案例4:三層交換配置STP
4.1 問題
配置Switch1為vlan1的次根,Switch2為vlan1的次根。
配置Switch1為vlan2的次根,Switch2為vlan2的次根
4.2 方案
如圖網絡拓撲如圖-4所示:

圖-4
4.3 步驟
實現此案例需要按照如下步驟進行。
步驟一:將四台交換機相連的端口配置為中繼端口,分別創建vlan2
- SM1(config)#vlan 2
- SM1(config)#exit
- SM1(config)#interface range fastEthernet 0/1-3
- SM1(config-if-range)#switchport trunk encapsulation dot1q
- SM1(config-if-range)#switchport mode trunk
- SM2(config)#vlan 2
- SM2(config)#exit
- SM2(config)#interface range fastEthernet 0/1-3
- SM2(config-if-range)#switchport trunk encapsulation dot1q
- SM2(config-if-range)#switchport mode trunk
- Switch1(config)#vlan 2
- Switch1(config)#exit
- Switch1(config)#interface range fastEthernet 0/1-2
- Switch1(config-if-range)#switchport mode trunk
- Switch2(config)#vlan 2
- Switch2(config)#exit
- Switch2(config)#interface range fastEthernet 0/1-2
- Switch2(config-if-range)#switchport mode trunk
步驟二:設置SM1為vlan1的主根vlan2的次根,設置SM2為vlan2的主根vlan1的次根並查看
- SM1(config)#spanning-tree vlan 1 root primary
- SM1(config)#spanning-tree vlan 2 root secondary
- SM1#show spanning-tree
- VLAN0001
- Spanning tree enabled protocol ieee
- Root ID Priority 24577
- Address 00D0.972A.43E5
- This bridge is the root
- Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
- Bridge ID Priority 24577 (priority 24576 sys-id-ext 1)
- Address 00D0.972A.43E5
- Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
- Aging Time 20
- Interface Role Sts Cost Prio.Nbr Type
- ---------------- ---- --- --------- -------- --------------------------------
- Fa0/2 Desg FWD 19 128.2 P2p
- Fa0/3 Desg FWD 19 128.3 P2p
- Fa0/1 Desg FWD 19 128.1 P2p
- VLAN0002
- Spanning tree enabled protocol ieee
- Root ID Priority 24578
- Address 00E0.F9CE.7424
- Cost 19
- Port 3(FastEthernet0/3)
- Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
- Bridge ID Priority 28674 (priority 28672 sys-id-ext 2)
- Address 00D0.972A.43E5
- Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
- Aging Time 20
- Interface Role Sts Cost Prio.Nbr Type
- ---------------- ---- --- --------- -------- --------------------------------
- Fa0/2 Desg FWD 19 128.2 P2p
- Fa0/3 Root FWD 19 128.3 P2p
- Fa0/1 Desg FWD 19 128.1 P2p
- SM2(config)#spanning-tree vlan 1 root secondary
- SM2(config)#spanning-tree vlan 2 root primary
- SM2#show spanning-tree
- VLAN0001
- Spanning tree enabled protocol ieee
- Root ID Priority 24577
- Address 00D0.972A.43E5
- Cost 19
- Port 3(FastEthernet0/3)
- Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
- Bridge ID Priority 28673 (priority 28672 sys-id-ext 1)
- Address 00E0.F9CE.7424
- Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
- Aging Time 20
- Interface Role Sts Cost Prio.Nbr Type
- ---------------- ---- --- --------- -------- --------------------------------
- Fa0/2 Desg FWD 19 128.2 P2p
- Fa0/1 Desg FWD 19 128.1 P2p
- Fa0/3 Root FWD 19 128.3 P2p
- VLAN0002
- Spanning tree enabled protocol ieee
- Root ID Priority 24578
- Address 00E0.F9CE.7424
- This bridge is the root
- Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
- Bridge ID Priority 24578 (priority 24576 sys-id-ext 2)
- Address 00E0.F9CE.7424
- Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
- Aging Time 20
- Interface Role Sts Cost Prio.Nbr Type
- ---------------- ---- --- --------- -------- --------------------------------
- Fa0/2 Desg FWD 19 128.2 P2p
- Fa0/1 Desg FWD 19 128.1 P2p
- Fa0/3 Desg FWD 19 128.3 P2p