華為IP綜合實驗


實驗拓撲

實驗需求

  1. 全網依照拓撲圖配置vlan和IP地址
  2. 總公司:

a) SW3和SW4的互連接口啟用eth-trunk,最大帶寬為2G

b) SW1、SW2、SW3、和SW4運行MSTP,SW1為VLAN10的Root,SW2為VLAN20的Root

c) PC1-PC4需要提供網關冗余,為了提高安全性,需要做認證,並使用BFD動態檢查上行鏈路狀態,實現自動切換

\3. AS100需求:

a) 每台設備都需要配置Loopback接口,地址為X.X.X.X(X為設備編號)

b) AS100底層IGP協議為IS-IS,區域類型為level-2,確保各路由器的loopback接口互通

c) R1與R4建立IBGP鄰居(使用loopback接口)

d) MPLS-VPN需求:

\1. 總公司的PC能訪問分公司1/2的PC,分公司之間不能互訪

\2. R1和SW3、SW4之間運行OSPF協議

\3. R4和R5之間運行BGP協議

\4. R4和R6之間運行OSPF協議

\5. R1和R4建立MP-BGP鄰居

\4. 分公司1需求:

a) SW5為二層交換機,PC5與PC6配置不同VLAN(屬於不同網段),確保兩台PC能互訪

\5. 分公司2需求:

a) PC8與PC7屬於不同VLAN(相同網段),通過VLANIF技術讓兩台PC正常訪問總公司,但是不能互訪

b) 內部IGP運行OSPF協議,為了加快收斂速度,每網段不允許存在DR

實驗步驟

1.配置IP地址和環回口地址

2.在總公司上進行相應VLAN划分與配置

SW1

[Huawei]INT E0/0/3
[Huawei-Ethernet0/0/3]P L A 
[Huawei-Ethernet0/0/3]p d v 100
[Huawei]INT E0/0/4
[Huawei-Ethernet0/0/4P L A 
[Huawei-Ethernet0/0/4]p d v 200
[Huawei-Ethernet0/0/3]int e0/0/1
[Huawei-Ethernet0/0/1]p l t
[Huawei-Ethernet0/0/1]p t a v a 
[Huawei-Ethernet0/0/1]int e0/0/1
[Huawei-Ethernet0/0/21]p l t
[Huawei-Ethernet0/0/2]p t a v a 

SW2

[Huawei]INT E0/0/3
[Huawei-Ethernet0/0/3]P L A 
[Huawei-Ethernet0/0/3]p d v 100
[Huawei]INT E0/0/4
[Huawei-Ethernet0/0/4P L A 
[Huawei-Ethernet0/0/4]p d v 200
[Huawei-Ethernet0/0/3]int e0/0/1
[Huawei-Ethernet0/0/1]p l t
[Huawei-Ethernet0/0/1]p t a v a 
[Huawei-Ethernet0/0/1]int e0/0/1
[Huawei-Ethernet0/0/21]p l t
[Huawei-Ethernet0/0/2]p t a v a 

SW3

[Huawei]VLAN B 100 200
[Huawei]INT G0/0/2
[Huawei-GigabitEthernet0/0/2] p l t
[Huawei-GigabitEthernet0/0/2] p t a v a 
[Huawei]INT G0/0/3
[Huawei-GigabitEthernet0/0/3] p l t
[Huawei-GigabitEthernet0/0/3] p t a v a 
[Huawei]INT G0/0/6
[Huawei-GigabitEthernet0/0/6]p l a
[Huawei-GigabitEthernet0/0/6]p d v 2
[Huawei]int vlan 2
[Huawei-Vlanif2]ip address 192.168.13.1 24
[Huawei]int vlan 100
[Huawei-Vlanif100]ip add 192.168.10.252 24
[Huawei]int vlan 200
[Huawei-Vlanif100]ip add 192.168.20.252 24

SW4

[Huawei]VLAN B 100 200
[Huawei]INT G0/0/2
[Huawei-GigabitEthernet0/0/2] p l t
[Huawei-GigabitEthernet0/0/2] p t a v a 
[Huawei]INT G0/0/3
[Huawei-GigabitEthernet0/0/3] p l t
[Huawei-GigabitEthernet0/0/3] p t a v a 
[Huawei]INT G0/0/6
[Huawei-GigabitEthernet0/0/6]p l a
[Huawei-GigabitEthernet0/0/6]p d v 2
[Huawei]int vlan 2
[Huawei-Vlanif2]ip address 192.168.14.1 24
[Huawei]int vlan 100
[Huawei-Vlanif100]ip add 192.168.10.253 24
[Huawei]int vlan 200
[Huawei-Vlanif100]ip add 192.168.20.253 24

3. SW3和SW4的互連接口啟用eth-trunk,最大帶寬為2G

SW3

[Huawei]int Eth-Trunk 1
[Huawei-Eth-Trunk1]trunkport GigabitEthernet 0/0/1
[Huawei-Eth-Trunk1]trunkport GigabitEthernet 0/0/4
[Huawei-Eth-Trunk1]trunkport GigabitEthernet 0/0/5
[Huawei-Eth-Trunk1] port link-type trunk
[Huawei-Eth-Trunk1] port trunk allow-pass vlan all
[Huawei-Eth-Trunk1] max bandwidth-affected-linknumber 2  //最大帶寬 2G

SW4

[Huawei]int Eth-Trunk 1
[Huawei-Eth-Trunk1]trunkport GigabitEthernet 0/0/1
[Huawei-Eth-Trunk1]trunkport GigabitEthernet 0/0/4
[Huawei-Eth-Trunk1]trunkport GigabitEthernet 0/0/6
[Huawei-Eth-Trunk1] port link-type trunk
[Huawei-Eth-Trunk1] port trunk allow-pass vlan all
[Huawei-Eth-Trunk1] max bandwidth-affected-linknumber 2

4. SW1、SW2、SW3、和SW4運行MSTP,SW1為VLAN10的Root,SW2為VLAN20的Root

SW1

[Huawei]stp mode mstp 
[Huawei]stp region-configuration 1
[Huawei-mst-region]instance 1 vlan 100
[Huawei-mst-region] instance 2 vlan 200
[Huawei-mst-region] active region-configuration //激活配置

SW2

[Huawei]stp mode mstp 
[Huawei]stp region-configuration 1
[Huawei-mst-region]instance 1 vlan 100
[Huawei-mst-region] instance 2 vlan 200
[Huawei-mst-region] active region-configuration

SW3

[Huawei]stp mode mstp 
[Huawei]stp region-configuration 1
[Huawei-mst-region]instance 1 vlan 100
[Huawei-mst-region] instance 2 vlan 200
[Huawei-mst-region] active region-configuration

[Huawei]stp instance 1 root primary   // VLAN 100 為主根
[Huawei]stp instance 2 root secondary

SW4

[Huawei]stp mode mstp 
[Huawei]stp region-configuration 1
[Huawei-mst-region]instance 1 vlan 100
[Huawei-mst-region] instance 2 vlan 200
[Huawei-mst-region] active region-configuration

[Huawei]stp instance 2 root primary   // VLAN 200 為主根
[Huawei]stp instance 1 root secondary

5. PC1-PC4需要提供網關冗余,為了提高安全性,需要做認證,並使用BFD動態檢查上行鏈路狀態,實現自動切換

SW3

[Huawei]int vlan 100
[Huawei-Vlanif100]vrrp vrid 100 virtual-ip 192.168.10.254
[Huawei-Vlanif100] vrrp vrid 100 priority 150
[Huawei-Vlanif100]vrrp vrid 100 track interface g0/0/6 reduced 200
[Huawei-Vlanif100]vrrp vrid 100 authentication-mode md5 123

[Huawei]int vlan 200
[Huawei-Vlanif200]vrrp vrid 200 virtual-ip 192.168.20.254
[Huawei-Vlanif200]vrrp vrid 200 authentication-mode md5 123

SW4

[Huawei]int vlan 100
[Huawei-Vlanif100]vrrp vrid 100 virtual-ip 192.168.10.254
[Huawei-Vlanif100]vrrp vrid 100 authentication-mode md5 123

[Huawei]int vlan 200
[Huawei-Vlanif200]vrrp vrid 200 virtual-ip 192.168.20.254
[Huawei-Vlanif200] vrrp vrid 200 priority 150
[Huawei-Vlanif200]vrrp vrid 200 authentication-mode md5 123
5-1. 查看VRRP
[Huawei-Vlanif100]dis vrrp brief
VRID  State        Interface                Type     Virtual IP     
----------------------------------------------------------------
100   Master       Vlanif100                Normal   192.168.10.254 
200   Backup       Vlanif200                Normal   192.168.20.254 
----------------------------------------------------------------
Total:2     Master:1     Backup:1     Non-active:0     

6. 配置BFD 聯動

在SW3上配置

[Huawei]bfd
[Huawei]bfd 123 bind peer-ip 192.168.13.2 source-ip 192.168.13.1 auto  
[Huawei-bfd-session-123]commit

SW4

[Huawei]bfd
[Huawei]bfd 456 bind peer-ip 192.168.14.2 source-ip 192.168.14.1 auto 
[Huawei-bfd-session-456]commit

R1

[Huawei]bfd 	
[Huawei]bfd 123 bind peer-ip 192.168.13.1 vpn-instance vpn1 source-ip 192.168.13.2 auto
[Huawei-bfd-session-123]commit

[Huawei]bfd 456 bind peer-ip 192.168.14.1 vpn-instance vpn1 source-ip 192.168.14.2 auto
[Huawei-bfd-session-456]commit

6-1. 在R1上查看BFID 的會話信息
[Huawei]dis bfd session all 
--------------------------------------------------------------------------------
Local Remote     PeerIpAddr      State     Type        InterfaceName            
--------------------------------------------------------------------------------

8192  8192       192.168.13.1    Up        S_AUTO_PEER       -                  
8194  8192       192.168.14.1    Up        S_AUTO_PEER       -                  
--------------------------------------------------------------------------------
     Total UP/DOWN Session Number : 2/0

7. R1-R4配置ISIS

 環回口一定要開啟ISIS

R1

[Huawei] isis 1
[Huawei-isis-1] network-entity 49.0010.0000.0001.00
[Huawei-isis-1] is-level level-2

[Huawei-LoopBack0] isis enable 1
[Huawei-GigabitEthernet0/0/2]isis enable 1
[Huawei-GigabitEthernet4/0/0]isis enable 1

R2

[Huawei] isis 1
[Huawei-isis-1] network-entity 49.0010.0000.0002.00
[Huawei-isis-1] is-level level-2

[Huawei-LoopBack0] isis enable 1
[Huawei-GigabitEthernet0/0/0]isis enable 1
[Huawei-GigabitEthernet0/0/1]isis enable 1

R3

[Huawei] isis 1
[Huawei-isis-1] network-entity 49.0010.0000.0003.00
[Huawei-isis-1] is-level level-2

[Huawei-LoopBack0] isis enable 1
[Huawei-GigabitEthernet0/0/0]isis enable 1
[Huawei-GigabitEthernet0/0/1]isis enable 1


R4

[Huawei] isis 1
[Huawei-isis-1] network-entity 49.0010.0000.0003.00
[Huawei-isis-1] is-level level-2

[Huawei-LoopBack0] isis enable 1   
[Huawei-GigabitEthernet0/0/0]isis enable 1
[Huawei-GigabitEthernet0/0/1]isis enable 1

8. 配置MPLS

R1

[Huawei]mpls lsr-id 1.1.1.1
[Huawei]mpls
[Huawei]mpls ldp
[Huawei]int g0/0/2
[Huawei-GigabitEthernet0/0/2]mpls 
[Huawei-GigabitEthernet0/0/2]mpls ldp
[Huawei-GigabitEthernet0/0/2]int g4/0/0
[Huawei-GigabitEthernet4/0/0]mpls 
[Huawei-GigabitEthernet4/0/0]mpls ldp

R2

[Huawei]mpls lsr-id 2.2.2.2
[Huawei]mpls
[Huawei]mpls ldp
[Huawei]int g0/0/0
[Huawei-GigabitEthernet0/0/0]mpls 
[Huawei-GigabitEthernet0/0/0]mpls ldp
[Huawei]int g0/0/1
[Huawei-GigabitEthernet0/0/1]mpls 
[Huawei-GigabitEthernet0/0/1]mpls ldp

R3

[Huawei]mpls lsr-id 3.3.3.3
[Huawei]mpls
[Huawei]mpls ldp
[Huawei]int g0/0/0
[Huawei-GigabitEthernet0/0/0]mpls 
[Huawei-GigabitEthernet0/0/0]mpls ldp
[Huawei]int g0/0/1
[Huawei-GigabitEthernet0/0/1]mpls 
[Huawei-GigabitEthernet0/0/1]mpls ldp

R4

[Huawei]mpls lsr-id 4.4.4.4
[Huawei]mpls
[Huawei]mpls ldp
[Huawei]int g0/0/0
[Huawei-GigabitEthernet0/0/0]mpls 
[Huawei-GigabitEthernet0/0/0]mpls ldp
[Huawei]int g0/0/1
[Huawei-GigabitEthernet0/0/1]mpls 
[Huawei-GigabitEthernet0/0/1]mpls ldp

9. 配置VPN實例

R1

[Huawei]ip vpn-instance vpn1
[Huawei-vpn-instance-vpn1]vpn-target 2:1 export-extcommunity 
[Huawei-vpn-instance-vpn1]vpn-target 1:2 import-extcommunity 

[Huawei-GigabitEthernet0/0/0]ip binding vpn-instance vpn1  
[Huawei-GigabitEthernet0/0/0]ip address 192.168.13.2 24
[Huawei-GigabitEthernet0/0/1]ip binding vpn-instance vpn1
[Huawei-GigabitEthernet0/0/1]ip address 192.168.14.2 24

R4

[Huawei]ip vpn-instance vpn2
[Huawei-vpn-instance-vpn2]route-distinguisher 2:2
[Huawei-vpn-instance-vpn2]vpn-target 1:2 export-extcommunity 
[Huawei-vpn-instance-vpn2]vpn-target 2:1 import-extcommunity 

[Huawei]ip vpn-instance vpn3
[Huawei-vpn-instance-vpn3]route-distinguisher 3:3
[Huawei-vpn-instance-vpn3-af-ipv4]vpn-target 1:2 export-extcommunity 
[Huawei-vpn-instance-vpn3-af-ipv4]vpn-target 2:1 import-extcommunity 

[Huawei-GigabitEthernet4/0/0]ip binding vpn-instance vpn2
[Huawei-GigabitEthernet4/0/0]ip address 10.1.46.2 24

[Huawei-GigabitEthernet0/0/2]ip binding vpn-instance vpn3
[Huawei-GigabitEthernet0/0/2]ip address 10.1.45.2 24

10. R1和R4建立BGP鄰居

[Huawei]bgp 100
[Huawei-bgp]peer 4.4.4.4 as-number 100  //建立普通的BGP鄰居
[Huawei-bgp]peer 4.4.4.4 connect-interface LoopBack 0 
[Huawei-bgp]ipv4 vpnv4	  //進入到VPNV4視圖
[Huawei-bgp-af-vpnv4]peer 4.4.4.4 enable  //建立與開啟mp-bgp鄰居

[Huawei]bgp 100
[Huawei-bgp]peer 1.1.1.1 as-number 100
[Huawei-bgp]peer 1.1.1.1 connect-interface LoopBack 0 
[Huawei-bgp]ipv4 vpnv4	
[Huawei-bgp-af-vpnv4]peer 1.1.1.1 enable 

11. R1和SW3、SW4之間運行OSPF協議

R1

[Huawei]ospf 1 vpn-instance vpn1
[Huawei-ospf-1]a 0
[Huawei-ospf-1-area-0.0.0.0]192.168.13.0 0.0.0.255
[Huawei-ospf-1-area-0.0.0.0]192.168.14.0 0.0.0.255

SW3

[Huawei]OSPF 
[Huawei-ospf-1]A 0
[Huawei-ospf-1]network 192.168.13.0 0.0.0.255
[Huawei-ospf-1]network 192.168.10.0 0.0.0.255
[Huawei-ospf-1]network 192.168.20.0 0.0.0.255

SW4

[Huawei]OSPF 
[Huawei-ospf-1]A 0
[Huawei-ospf-1]network 192.168.13.0 0.0.0.255
[Huawei-ospf-1]network 192.168.10.0 0.0.0.255
[Huawei-ospf-1]network 192.168.20.0 0.0.0.255

12. R4和R5之間運行BGP協議

在R4上建立EBGP 鄰居

[Huawei]BGP 100
[Huawei-bgp]ipv4-family vpn-instance vpn3
[Huawei-bgp-vpn3] peer 10.1.45.1 as-number 200

R5

[Huawei]bgp 200
[Huawei-bgp]peer 10.1.45.2 as-number 100 
[Huawei-bgp]network 10.1.45.0 24

13. 在R4上查看BGP VPN4 鄰居關系

[Huawei]dis bgp vpnv4 all peer

 BGP local router ID : 10.1.24.2
 Local AS number : 100
 Total number of peers : 2		  Peers in established state : 2

  Peer            V          AS  MsgRcvd  MsgSent  OutQ  Up/Down       State Pre
fRcv

  1.1.1.1         4         100      315      311     0 04:49:05 Established    
   6

  Peer of IPv4-family for vpn instance :

 VPN-Instance vpn3, Router ID 10.1.24.2:
  10.1.45.1       4         200      134      136     0 02:11:36 Established    
   1



15. R4和R6之間運行OSPF協議

R4

[Huawei]ospf 1 vpn-instance vpn2
[Huawei-ospf-1]a 0
[Huawei-ospf-1-area-0.0.0.0]network 10.1.46.0 0.0.0.255

R6

[Huawei]ospf 1
[Huawei-ospf-1]a 0
[Huawei-ospf-1]network 10.1.46.0 0.0.0.255 
[Huawei-ospf-1]network 192.168.67.0 0.0.0.255 

16. 雙向引入操作

R1

[Huawei]bgp 100
[Huawei-bgp]ipv4 vpn-instance vpn1
[Huawei-bgp-vpn1]import-route ospf 1

R4

[Huawei]bgp 100
[Huawei-bgp]ipv4 vpn-instance vpn2
[Huawei-bgp-vpn1]import-route ospf 1

R1

[Huawei]ospf 1 vpn-instance vpn1
[Huawei-ospf-1]import-route bgp

R4

[Huawei]ospf 1 vpn-instance vpn2
[Huawei-ospf-1]import-route bgp

分公司1需求:

17. SW5為二層交換機,PC5與PC6配置不同VLAN(屬於不同網段),確保兩台PC能互訪

SW5

[Huawei]vlan b 10 20
[Huawei]int e0/0/2
[Huawei-Ethernet0/0/2]p l a
[Huawei-Ethernet0/0/2]p d v 10
[Huawei-Ethernet0/0/2]int  e0/0/3
[Huawei-Ethernet0/0/3]p l a 
[Huawei-Ethernet0/0/3]p d v 20
[Huawei-Ethernet0/0/3]int e0/0/1
[Huawei-Ethernet0/0/1]p l t 
[Huawei-Ethernet0/0/1]p t a v 10 20

R5

[Huawei]int g0/0/1.1
[Huawei-GigabitEthernet0/0/1.1]dot1q termination vid 10
[Huawei-GigabitEthernet0/0/1.1]int g0/0/1.2
[Huawei-GigabitEthernet0/0/1.2]dot1q termination vid 20
[Huawei-GigabitEthernet0/0/1.2]ip address 10.1.26.254 24

[Huawei-GigabitEthernet0/0/1.1]arp broadcast enable 
[Huawei-GigabitEthernet0/0/1.1]int g0/0/1.2
[Huawei-GigabitEthernet0/0/1.2]arp broadcast enable 


分公司2需求:

18. PC8與PC7屬於不同VLAN(相同網段),通過VLANIF技術讓兩台PC正常訪問總公司,但是不能互訪

19. 內部IGP運行OSPF協議,為了加快收斂速度,每網段不允許存在DR

   在SW7上配置super vlan  

[Huawei]vlan batch 10 20 30 40
[Huawei-GigabitEthernet0/0/3]port link-type access
[Huawei-GigabitEthernet0/0/3]port default vlan 10
[Huawei-GigabitEthernet0/0/2]port link-type access
[Huawei-GigabitEthernet0/0/2]port default vlan 20

[Huawei-GigabitEthernet0/0/1]port link-type access 
[Huawei-GigabitEthernet0/0/1]port default vlan 40    

[Huawei]vlan 30
[Huawei-vlan30]aggregate-vlan      //super vlan
[Huawei-vlan30]access-vlan 10 20   //從vlan
[Huawei-Vlanif30]ip address 192.168.68.254 24  /網關
[Huawei-Vlanif30]int vlan 40
[Huawei-Vlanif40]ip address 192.168.67.2 24

SW7

[Huawei]ospf 
[Huawei-ospf-1]a 0
[Huawei-ospf-1] network 192.168.67.0 0.0.0.255
[Huawei-ospf-1] network 192.168.68.0 0.0.0.255
[Huawei]INT VLAN 30
[Huawei-Vlanif30]ospf network-type p2p  //接口改成點到點網絡類型
[Huawei]INT VLAN 40
[Huawei-Vlanif40]ospf network-type p2p  //接口改成點到點網絡類型

R6

[Huawei]int g0/0/1
[Huawei-GigabitEthernet0/0/1]ospf network-type p2p  //接口改成點到點網絡類型

驗證階段

分公司1上沒有分公司2的私網路由條目

[Huawei-bgp]dis ip routing-table protocol bgp 
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Public routing table : BGP
         Destinations : 6        Routes : 6        

BGP routing table status : <Active>
         Destinations : 6        Routes : 6

Destination/Mask    Proto   Pre  Cost      Flags NextHop         Interface

   192.168.10.0/24  EBGP    255  0           D   10.1.45.2       GigabitEthernet
0/0/0
 192.168.10.254/32  EBGP    255  0           D   10.1.45.2       GigabitEthernet
0/0/0
   192.168.13.0/24  EBGP    255  0           D   10.1.45.2       GigabitEthernet
0/0/0
   192.168.14.0/24  EBGP    255  0           D   10.1.45.2       GigabitEthernet
0/0/0
   192.168.20.0/24  EBGP    255  0           D   10.1.45.2       GigabitEthernet
0/0/0
 192.168.20.254/32  EBGP    255  0           D   10.1.45.2       GigabitEthernet
0/0/0

2.分公司1 不能訪問分公司2

PC>ping 192.168.67.3

Ping 192.168.67.3: 32 data bytes, Press Ctrl_C to break
Request timeout!
Request timeout!
Request timeout!
Request timeout!
Request timeout!

--- 192.168.67.3 ping statistics ---
  5 packet(s) transmitted
  0 packet(s) received
  100.00% packet loss


3.總公司可以訪問分公司 1

PC>ping 10.1.25.1

Ping 10.1.25.1: 32 data bytes, Press Ctrl_C to break
From 10.1.25.1: bytes=32 seq=1 ttl=123 time=110 ms
From 10.1.25.1: bytes=32 seq=2 ttl=123 time=94 ms
From 10.1.25.1: bytes=32 seq=3 ttl=123 time=93 ms
From 10.1.25.1: bytes=32 seq=4 ttl=123 time=110 ms
From 10.1.25.1: bytes=32 seq=5 ttl=123 time=93 ms

--- 10.1.25.1 ping statistics ---
  5 packet(s) transmitted
  5 packet(s) received
  0.00% packet loss
  round-trip min/avg/max = 93/100/110 ms

4.總公司可以訪問分公司 2

PC>ping 192.168.68.3

Ping 192.168.68.3: 32 data bytes, Press Ctrl_C to break
From 192.168.68.3: bytes=32 seq=1 ttl=122 time=141 ms
From 192.168.68.3: bytes=32 seq=2 ttl=122 time=94 ms
From 192.168.68.3: bytes=32 seq=3 ttl=122 time=109 ms
From 192.168.68.3: bytes=32 seq=4 ttl=122 time=109 ms
From 192.168.68.3: bytes=32 seq=5 ttl=122 time=110 ms

--- 192.168.68.3 ping statistics ---
  5 packet(s) transmitted
  5 packet(s) received
  0.00% packet loss
  round-trip min/avg/max = 94/112/141 ms


免責聲明!

本站轉載的文章為個人學習借鑒使用,本站對版權不負任何法律責任。如果侵犯了您的隱私權益,請聯系本站郵箱yoyou2525@163.com刪除。



 
粵ICP備18138465號   © 2018-2025 CODEPRJ.COM