原文链接：http://support.huawei.com/enterprise/docinforeader!loadDocument1.action?contentId=DOC1000098180&partNo=10012#dc_cfg_campus_002

1 中小型园区/分支出口综合配置举例

园区网出口简介

园区网出口一般位于企业网内部网络与外部网络的连接处，是内部网络与外部网络之间数据流的唯一出入口。对于中小型企业来说，考虑到企业网络建设的初期投资与长期运维成本，一般希望将多种业务部署在同一设备上。企业网络用户一般同时需要访问Internet和私网VPN，而对于中小型企业来说考虑到建设及维护成本问题，一般租用运营商Internet网络组建私网VPN。对于部分可靠性要求较高的园区网络，一般考虑部署两台出口路由器做冗余备份实现设备级可靠性，同时应用链路聚合、VRRP、主备路由等技术保证园区出口的可靠性。华为AR系列路由器配合华为S系列交换机是中小型园区网出口设备的理想解决方案。

园区出口设备需要具备NAT Outbound及NAT Server的功能，实现私网地址和公网地址之间的转换，以满足用户访问Internet或者Internet用户访问内网服务器的需求。
园区出口设备需要具备通过Internet构建私网VPN的功能，以满足企业用户各个机构之间私网VPN互通的需求
园区出口设备需要具备数据加密传输的功能，以保证数据的完整性和机密性，保障用户业务传输的安全
中小型园区出口需要具备可靠性、安全性、低成本、易维护等特点。

配置注意事项

本配置案例适用于中小型企业园区/分支出口解决方案。
本配置案例仅涉及企业网络出口相关配置，涉及企业内网的相关配置请参见华为S系列园区交换机快速配置中的“中小园区组网场景”。

组网需求

某企业总部和分支分别位于不同的城市，地域跨度较远，总部存在A、B两个不同的部门，分支只有一个部门。现在需要建设跨地域的企业园区网络，需要实现的需求如下：

总部和分支都需要实现用户访问Internet的需求。总部划分为A、B两个部门，其中A部门的用户可以访问Internet，但是B部门的用户不能访问Internet；分支所有用户都可以访问Internet。
总部有Web服务器，对外提供WWW服务，外网用户可以访问内网服务器。
总部和分支之间需要通过Internet进行私网VPN互通，通信内容需要有安全保护。
总部园区出口可靠性要求较高，需要考虑链路级的可靠性和设备级的可靠性。
分支可以适当降低可靠性要求。

方案介绍

根据用户需求，可以给出如图1-1所示的综合配置解决方案，该方案具备层次化、模块化、冗余性、安全性的特点，适用于中小型企业/分支的园区网络部署。

图1-1 中小型园区/分支出口综合配置组网图

在网络的接入层部署华为S2700&S3700交换机（ACC1、ACC2、SwitchA），在网络的核心部署华为S5700交换机（CORE），在园区出口部署华为AR3200路由器（RouterA、RouterB、RouterC）。
总部采用双AR出口冗余备份方式，保证设备级的可靠性。分支部署一台AR路由器做出口。
总部核心交换机采用两台S5700交换机做堆叠，保证设备级的可靠性。
总部接入交换机与核心交换机之间以及核心交换机与出口路由器之间采用Eth-Trunk方式组网，保证链路级的可靠性。
总部每个部门业务划分到一个VLAN中，部门间的业务在核心交换机CORE上通过VLANIF三层互通。
总部核心交换机作为用户及服务器网关，部署DHCP Server为用户分配IP地址。
分支用户的网关直接部署在出口路由器上。
总部两个出口路由器之间部署VRRP，保证可靠性。
总部和分支之间通过Internet构建IPSec VPN进行私网互通，同时保证数据传输的安全性。
总部两台出口路由器和核心交换机之间部署OSPF，用于发布用户路由，便于后期扩容及维护。

配置思路

采用如下思路部署中小型园区/分支出口综合配置举例：

部署总部及分支园区内网

总部：部署堆叠、链路聚合，配置各VLAN及IP地址、部署DHCP Server，实现园区内网互通。部门内部通过接入层交换机进行二层互通，部门间通过核心交换机CORE上的VLANIF进行三层互通。

分支：配置接入层交换机及出口路由器的各接口VLAN及IP地址，部署DHCP Server，实现分支园区内网互通。
部署VRRP

为了保证总部核心交换机与两个出口路由器之间的可靠性，在两个出口路由器之间部署VRRP，VRRP的心跳报文经过核心交换机进行交互。RouterA为Master设备，RouterB为Backup设备。

为了防止总部RouterA上行链路故障的时候业务断流，将VRRP状态与RouterA的上行口进行联动，保证上行链路故障时VRRP进行快速倒换。
部署路由

为了引导各设备的上行流量，在总部核心交换机上配置一条缺省路由，下一跳指向VRRP的虚地址，在总部及分支的出口路由器上各配置一条缺省路由，下一跳指向运营商网络设备的对接地址（公网网关）。

为了引导总部两个出口路由器的回程流量，在两个出口路由器和核心交换机之间部署OSPF，核心交换机上将所有用户网段发布到OSPF里面，通告给两个出口路由器。

为了引导外网用户访问Web服务器的流量，需要在总部的运营商路由器上配置两条目的地址为服务器公网地址的静态路由，下一跳分别指向两个出口路由器的上行口IP地址。并且为了保证路由和VRRP同步切换，设置下一跳为RouterA的这条路由优先，当这条路由失效的时候下一跳指向RouterB的路由生效。
部署NAT Outbound

为了使内网用户访问Internet，在两台出口路由器的上行口配置NAT，实现私网地址和公网地址之间的转换。通过ACL匹配A部门的源IP地址，从而实现A部门的用户可以访问Internet，而B部门的用户不能访问Internet。
NAT Server

为了实现外网用户访问内网Web服务器，在两个出口路由器的上行口上配置NAT Server，实现服务器公网地址和私网地址之间的映射。
部署IPSec VPN

为了实现总部和分支之间进行私网VPN互通，在总部出口路由器和分支出口路由器之间部署IPSec VPN，通过Internet构建IPSec VPN，实现总部和分支之间的安全通信。

说明：

部署总部及分支园区内网所涉及的配置不在本例中给出，请参见华为S系列园区交换机快速配置中的“中小园区组网场景”。

数据规划

详细的数据规划如表1-1、表1-2、表1-3所示。

表1-1 链路聚合接口规划

设备	聚合接口	物理接口
RouterA	Eth-trunk1	GE2/0/0GE2/0/1
RouterB	Eth-trunk1	GE2/0/0GE2/0/1
CORE	Eth-trunk1	GE0/0/1GE1/0/1
Eth-trunk2	GE0/0/2GE1/0/2
Eth-trunk3	GE0/0/3GE1/0/3
Eth-trunk4	GE0/0/4GE1/0/4
ACC1	Eth-trunk1	GE0/0/1GE0/0/2
ACC2	Eth-trunk1	GE0/0/1GE0/0/2

说明：

所有链路聚合采用LACP模式。

表1-2 VLAN规划

设备	数据项	备注
RouterA	Eth-trunk1.100：配置Dot1q终结子接口，终结VLAN100	用于和总部核心交换机CORE对接
RouterB	Eth-trunk1.100：配置Dot1q终结子接口，终结VLAN100	用于和总部核心交换机CORE对接
CORE	Eth-trunk1：Trunk类型，透传VLAN10	用于和总部部门A对接
Eth-trunk2：Trunk类型，透传VLAN20	用于和总部部门B对接
GE0/0/5：Access类型，缺省VLAN为VLAN30	用于连接总部Web服务器
Eth-trunk3：Trunk类型，透传VLAN100	用于和总部出口路由器RouterA对接
Eth-trunk4：Trunk类型，透传VLAN100	用于和总部出口路由器RouterB对接
ACC1	Eth-trunk1：Trunk类型，透传VLAN10	用于和总部CORE对接
Ethernet0/0/2：Access类型，缺省VLAN为VLAN10	用于连接总部A部门的PC1
ACC2	Eth-trunk1：Trunk类型，透传VLAN20	用于和总部CORE对接
Ethernet0/0/2：Access类型，缺省VLAN为VLAN20	用于连接总部B部门的PC3
RouterC	GE2/0/0.200：配置Dot1q终结子接口，终结VLAN200	用于连接分支接入交换机SwitchA
SwitchA	GE0/0/1：Trunk类型，透传VLAN200	用于连接分支出口路由器RouterC
Ethernet0/0/2：Access类型，缺省VLAN为VLAN200	用于连接分支PC5

表1-3 IP地址规划

设备	数据项	备注
RouterA	GE1/0/0：202.10.1.2/24Eth-trunk1.100：10.10.100.2/24	GE1/0/0用于和运营商网络对接Eth-trunk1.100用于和总部核心交换机CORE对接
RouterB	GE1/0/0：202.10.2.2/24Eth-trunk1.100：10.10.100.3/24	-
CORE	VLANIF10：10.10.10.1/24VLANIF20：10.10.20.1/24VLANIF30：10.10.30.1/24VLANIF100：10.10.100.4/24	VLANIF10作为A部门的用户网关VLANIF20作为B部门的用户网关VLANIF30作为Web服务器的网关VLANIF100用于和出口路由器互联
Web服务器	IP地址：10.10.30.2/24默认网关：10.10.30.1	通过NAT Server 映射后的公网IP地址：202.10.100.3
PC1	IP地址：10.10.10.2/24默认网关：10.10.10.1	假设通过DHCP获取到的IP地址就是10.10.10.2/24
PC3	IP地址：10.10.20.2/24默认网关：10.10.20.1	假设通过DHCP获取到的IP地址就是10.10.20.2/24
RouterD	接口B，编号：GigabitEthernet1/0/0，IP地址：202.10.1.1/24接口C，编号：GigabitEthernet2/0/0，IP地址：202.10.2.1/24	该设备为运营商网络的设备，此处接口编号为假设，请以实际设备为准
RouterE	接口A，编号：GigabitEthernet1/0/0，IP地址：203.10.1.1/24	该设备为运营商网络的设备，此处接口编号为假设，请以实际设备为准
RouterC	GE1/0/0：203.10.1.2/24GE2/0/0.200：10.10.200.1/24	-
PC5	IP地址：10.10.200.2/24默认网关：10.10.200.1	假设通过DHCP获取到的IP地址就是10.10.200.2/24

操作步骤

配置总部核心交换机CORE和两个出口路由器之间互联的Eth-Trunk

# 配置核心交换机CORE。

<HUAWEI> system-view
[HUAWEI] sysname CORE
[CORE] interface eth-trunk 3
[CORE-Eth-Trunk3] mode lacp
[CORE-Eth-Trunk3] quit
[CORE] interface eth-trunk 4
[CORE-Eth-Trunk4] mode lacp
[CORE-Eth-Trunk4] quit
[CORE] interface gigabitethernet 0/0/3
[CORE-GigabitEthernet0/0/3] eth-trunk 3
[CORE-GigabitEthernet0/0/3] quit
[CORE] interface gigabitethernet 1/0/3
[CORE-GigabitEthernet1/0/3] eth-trunk 3
[CORE-GigabitEthernet1/0/3] quit
[CORE] interface gigabitethernet 0/0/4
[CORE-GigabitEthernet0/0/4] eth-trunk 4
[CORE-GigabitEthernet0/0/4] quit
[CORE] interface gigabitethernet 1/0/4
[CORE-GigabitEthernet1/0/4] eth-trunk 4
[CORE-GigabitEthernet1/0/4] quit

# 配置总部出口路由器RouterA。RouterB的配置与RouterA类似。

<Huawei> system-view
[Huawei] sysname RouterA
[RouterA] interface eth-trunk 1
[RouterA-Eth-Trunk1] undo portswitch
[RouterA-Eth-Trunk1] mode lacp-static
[RouterA-Eth-Trunk1] quit
[RouterA] interface gigabitethernet 2/0/0
[RouterA-GigabitEthernet2/0/0] eth-trunk 1
[RouterA-GigabitEthernet2/0/0] quit
[RouterA] interface gigabitethernet 2/0/1
[RouterA-GigabitEthernet2/0/1] eth-trunk 1
[RouterA-GigabitEthernet2/0/1] quit

配置各接口的所属VLAN及IP地址

# 配置核心交换机CORE。

[CORE] vlan 100
[CORE] quit
[CORE] interface Eth-Trunk 3
[CORE-Eth-Trunk3] port link-type trunk
[CORE-Eth-Trunk3] port trunk allow-pass vlan 100
[CORE-Eth-Trunk3] quit
[CORE] interface Eth-Trunk 4
[CORE-Eth-Trunk4] port link-type trunk
[CORE-Eth-Trunk4] port trunk allow-pass vlan 100
[CORE-Eth-Trunk4] quit
[CORE] interface vlanif 100
[CORE-Vlanif100] ip address 10.10.100.4 24
[CORE-Vlanif100] quit

# 配置总部出口路由器RouterA。RouterB的配置与RouterA类似。

[RouterA] interface Eth-Trunk 1.100
[RouterA-Eth-Trunk1.100] ip address 10.10.100.2 24
[RouterA-Eth-Trunk1.100] dot1q termination vid 100
[RouterA-Eth-Trunk1.100] arp broadcast enable     //使能接口可以处理ARP广播报文功能；AR3200系列路由器V200R003C01及之后的版本默认已经使能了该功能，无需配置。
[RouterA-Eth-Trunk1.100] quit
[RouterA] interface gigabitethernet 1/0/0
[RouterA-GigabitEthernet1/0/0] ip address 202.10.1.2 24
[RouterA-GigabitEthernet1/0/0] quit

# 配置分支出口路由器RouterC。

<Huawei> system-view
[Huawei] sysname RouterC
[RouterC] interface gigabitethernet 1/0/0
[RouterC-GigabitEthernet1/0/0] ip address 203.10.1.2 24
[RouterC-GigabitEthernet1/0/0] quit

部署VRRP。在总部两个出口路由器RouterA和RouterB之间配置VRRP，RouterA为VRRP的Master，RouterB为VRRP的Backup

# 配置RouterA。

[RouterA] interface Eth-Trunk 1.100
[RouterA-Eth-Trunk1.100] vrrp vrid 1 virtual-ip 10.10.100.1
[RouterA-Eth-Trunk1.100] vrrp vrid 1 priority 120
[RouterA-Eth-Trunk1.100] vrrp vrid 1 track interface GigabitEthernet1/0/0 reduced 40
[RouterA-Eth-Trunk1.100] quit
 //为了防止RouterA的上行链路中断的时候数据流发送至VRRP的Master以后不能继续上行，配置VRRP的状态和RouterA的上行口进行联动，保证RouterA上行链路中断的时候VRRP状态迅速倒换。

# 配置RouterB。

1
2
3

[RouterB] interface Eth-Trunk 1.100
[RouterB-Eth-Trunk1.100] vrrp vrid 1 virtual-ip 10.10.100.1
[RouterB-Eth-Trunk1.100] quit

配置完成后，RouterA和RouterB之间应该能建立VRRP的主备份关系，执行display vrrp命令可以看到RouterA和RouterB的VRRP状态。

# 查看RouterA的VRRP状态为Master。

[RouterA] display vrrp
  Eth-Trunk1.100 | Virtual Router 1
    State : Master
    Virtual IP : 10.10.100.1
    Master IP : 10.10.100.2
    PriorityRun : 120
    PriorityConfig : 120
    MasterPriority : 120
    Preempt : YES   Delay Time : 0 s
    TimerRun : 1 s
    TimerConfig : 1 s
    Auth type : NONE
    Virtual MAC : 0000-5e00-0101
    Check TTL : YES
    Config type : normal-vrrp
    Backup-forward : disabled
    Track IF : GigabitEthernet1/0/0   Priority reduced : 40
    IF state : UP
    Create time : 2015-05-18 06:53:47 UTC-05:13
    Last change time : 2015-05-18 06:54:14 UTC-05:13

# 查看RouterB的VRRP状态为Backup。

[RouterB] display vrrp
  Eth-Trunk1.100 | Virtual Router 1
    State : Backup
    Virtual IP : 10.10.100.1
    Master IP : 10.10.100.2
    PriorityRun : 100
    PriorityConfig : 100
    MasterPriority : 120
    Preempt : YES   Delay Time : 0 s
    TimerRun : 1 s
    TimerConfig : 1 s
    Auth type : NONE
    Virtual MAC : 0000-5e00-0101
    Check TTL : YES
    Config type : normal-vrrp
    Backup-forward : disabled
    Create time : 2015-05-18 06:53:52 UTC-05:13
    Last change time : 2015-05-18 06:57:12 UTC-05:13

部署路由
1. 部署缺省路由，用于引导各个设备的上行流量

  \# 在核心交换机CORE上配置一条缺省路由，下一跳指向VRRP的虚地址。

  <!--hexoPostRenderEscape:<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">[CORE] ip route-static 0.0.0.0 0.0.0.0 10.10.100.1</span><br></pre></td></tr></table></figure>:hexoPostRenderEscape-->

  \# 在总部及分支出口路由器上各配置一条缺省路由，下一跳指向运行商网络设备的对接地址（公网网关）。

  <!--hexoPostRenderEscape:<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">[RouterA] ip route-static 0.0.0.0 0.0.0.0 202.10.1.1</span><br></pre></td></tr></table></figure>:hexoPostRenderEscape-->

  <!--hexoPostRenderEscape:<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">[RouterB] ip route-static 0.0.0.0 0.0.0.0 202.10.2.1</span><br></pre></td></tr></table></figure>:hexoPostRenderEscape-->

  <!--hexoPostRenderEscape:<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">[RouterC] ip route-static 0.0.0.0 0.0.0.0 203.10.1.1</span><br></pre></td></tr></table></figure>:hexoPostRenderEscape-->

部署OSPF。在总部两个出口路由器RouterA、RouterB以及总部核心交换机CORE之间部署OSPF，用于两个出口路由器RouterA和RouterB学习用户网段的回程路由

  \# 配置总部出口路由器RouterA。

  <!--hexoPostRenderEscape:<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">[RouterA] ospf 1 router-id 10.1.1.1</span><br><span class="line">[RouterA-ospf-1] area 0</span><br><span class="line">[RouterA-ospf-1-area-0.0.0.0] network 10.10.100.0 0.0.0.255</span><br><span class="line">[RouterA-ospf-1-area-0.0.0.0] quit</span><br></pre></td></tr></table></figure>:hexoPostRenderEscape-->

  \# 配置总部出口路由器RouterB。

  <!--hexoPostRenderEscape:<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">[RouterB] ospf 1 router-id 10.2.2.2</span><br><span class="line">[RouterB-ospf-1] area 0</span><br><span class="line">[RouterB-ospf-1-area-0.0.0.0] network 10.10.100.0 0.0.0.255</span><br><span class="line">[RouterB-ospf-1-area-0.0.0.0] quit</span><br></pre></td></tr></table></figure>:hexoPostRenderEscape-->

  \# 配置总部核心交换机CORE。

  <!--hexoPostRenderEscape:<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">[CORE] ospf 1 router-id 10.3.3.3</span><br><span class="line">[CORE-ospf-1] area 0</span><br><span class="line">[CORE-ospf-1-area-0.0.0.0] network 10.10.100.0 0.0.0.255</span><br><span class="line">[CORE-ospf-1-area-0.0.0.0] network 10.10.10.0 0.0.0.255      &#x2F;&#x2F;将用户网段发布到OSPF里面</span><br><span class="line">[CORE-ospf-1-area-0.0.0.0] network 10.10.20.0 0.0.0.255      &#x2F;&#x2F;将用户网段发布到OSPF里面</span><br><span class="line">[CORE-ospf-1-area-0.0.0.0] network 10.10.30.0 0.0.0.255     &#x2F;&#x2F;将Web服务器网段发布到OSPF里面</span><br><span class="line">[CORE-ospf-1-area-0.0.0.0] quit</span><br></pre></td></tr></table></figure>:hexoPostRenderEscape-->

  \# 配置完成后，RouterA、RouterB和Core之间应该建立OSPF邻居关系，执行**display ospf peer**命令可以查看OSPF邻居状态为Full，以CORE为例，OSPF邻居状态如下。

  <!--hexoPostRenderEscape:<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br></pre></td><td class="code"><pre><span class="line">[CORE] display ospf peer</span><br><span class="line"></span><br><span class="line">   OSPF Process 1 with Router ID 10.3.3.3</span><br><span class="line">     Neighbors </span><br><span class="line"></span><br><span class="line"> Area 0.0.0.0 interface 10.10.100.4(Vlanif100)&#39;s neighbors</span><br><span class="line"> Router ID: 10.1.1.1         Address: 10.10.100.2     </span><br><span class="line">   State: Full  Mode:Nbr is  Slave  Priority: 1</span><br><span class="line">   DR: 10.10.100.4  BDR: 10.10.100.3  MTU: 0    </span><br><span class="line">   Dead timer due in 40  sec </span><br><span class="line">   Retrans timer interval: 5 </span><br><span class="line">   Neighbor is up for 00:26:37     </span><br><span class="line">   Authentication Sequence: [ 0 ] </span><br><span class="line"></span><br><span class="line"> Router ID: 10.2.2.2         Address: 10.10.100.3     </span><br><span class="line">   State: Full  Mode:Nbr is  Slave  Priority: 1</span><br><span class="line">   DR: 10.10.100.4  BDR: 10.10.100.3  MTU: 0    </span><br><span class="line">   Dead timer due in 36  sec </span><br><span class="line">   Retrans timer interval: 5 </span><br><span class="line">   Neighbor is up for 00:26:37     </span><br><span class="line">   Authentication Sequence: [ 0 ] </span><br></pre></td></tr></table></figure>:hexoPostRenderEscape-->

配置外网到内网服务器公网地址的静态路由（回程路由）

  \# 在和总部出口对接的运营商路由器RouterD上配置两条目的地址为服务器公网地址的静态路由，下一跳分别指向两个出口路由器RouterA、RouterB的上行口IP地址。为了保证路由和VRRP同步切换，设置下一跳为RouterA的这条路由优先，当这条路由失效的时候下一跳指向RouterB的路由生效。

  <!--hexoPostRenderEscape:<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">[RouterD] ip route-static 202.10.100.0 255.255.255.0 202.10.1.2 preference 40     &#x2F;&#x2F;下一跳为RouterA的这条路由优先</span><br><span class="line">[RouterD] ip route-static 202.10.100.0 255.255.255.0 202.10.2.2</span><br></pre></td></tr></table></figure>:hexoPostRenderEscape-->

  当总部出口路由器RouterA的上行链路中断的时候会触发两个动作：

  1. 两台总部出口路由器VRRP主备切换，这个通过VRRP状态联动总部出口路由器上行口状态来实现。
  2. 和总部出口对接的运营商路由器RouterD到达内网服务器的路由进行主备切换，这个通过RouterD配置主备路由实现。

  这两个动作保证了当出口路由器RouterA的上行链路中断的时候内网VRRP状态和公网回程主备路由同时切换，保证了来回路径双向可靠性。

部署NAT Outbound
1. 在总部及分支出口路由器上定义需要进行NAT转换的数据流

  总部仅部门A允许访问Internet，源IP地址是10.10.10.0/24；分支所有用户都允许访问Internet，源IP地址是10.10.200.0/24。

  \# 配置总部出口路由器RouterA。RouterB的配置和RouterA类似。

  <!--hexoPostRenderEscape:<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">[RouterA] acl 3000</span><br><span class="line">[RouterA-acl-adv-3000] rule 5 deny ip source 10.10.10.0 0.0.0.255 destination 10.10.200.0 0.0.0.255       &#x2F;&#x2F;需要IPSec保护的数据流</span><br><span class="line">[RouterA-acl-adv-3000] rule 10 deny ip source 10.10.20.0 0.0.0.255 destination 10.10.200.0 0.0.0.255      &#x2F;&#x2F;需要IPSec保护的数据流</span><br><span class="line">[RouterA-acl-adv-3000] rule 15 permit ip source 10.10.10.0 0.0.0.255       &#x2F;&#x2F;需要进行NAT转换的数据流</span><br><span class="line">[RouterA-acl-adv-3000] quit</span><br><span class="line"> &#x2F;&#x2F;对于华为AR3200系列路由器，如果接口上同时配置了IPSec和NAT，则先执行NAT。所以为了避免把IPSec保护的数据流进行NAT转换，需要NAT引用的ACL规则deny掉需要IPSec保护的数据流，即对“IPSec感兴趣的数据流”做NAT豁免。</span><br></pre></td></tr></table></figure>:hexoPostRenderEscape-->

  \# 配置分支出口路由器RouterC。

  <!--hexoPostRenderEscape:<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">[RouterC] acl 3000</span><br><span class="line">[RouterC-acl-adv-3000] rule 5 deny ip source 10.10.200.0 0.0.0.255 destination 10.10.10.0 0.0.0.255</span><br><span class="line">[RouterC-acl-adv-3000] rule 10 deny ip source 10.10.200.0 0.0.0.255 destination 10.10.20.0 0.0.0.255</span><br><span class="line">[RouterC-acl-adv-3000] rule 15 permit ip source 10.10.200.0 0.0.0.255</span><br><span class="line">[RouterC-acl-adv-3000] quit</span><br><span class="line"> &#x2F;&#x2F;同样需要配置对“IPSec感兴趣的数据流”做NAT豁免</span><br></pre></td></tr></table></figure>:hexoPostRenderEscape-->

在总部及分支出口路由器的上行口上配置NAT转换

  \# 配置RouterA。RouterB及RouterC的配置与RouterA类似。

  <!--hexoPostRenderEscape:<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">[RouterA] interface GigabitEthernet1&#x2F;0&#x2F;0</span><br><span class="line">[RouterA-GigabitEthernet1&#x2F;0&#x2F;0] nat outbound 3000</span><br><span class="line">[RouterA-GigabitEthernet1&#x2F;0&#x2F;0] quit</span><br></pre></td></tr></table></figure>:hexoPostRenderEscape-->

检查配置结果

  \# 配置完成后可以通过**display nat outbound**命令查看NAT转换的配置信息，以RouterA为例详细信息如下。

  <!--hexoPostRenderEscape:<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">[RouterA] display nat outbound</span><br><span class="line"> NAT Outbound Information:</span><br><span class="line"> --------------------------------------------------------------------------</span><br><span class="line"> Interface                     Acl     Address-group&#x2F;IP&#x2F;Interface      Type</span><br><span class="line"> --------------------------------------------------------------------------</span><br><span class="line"> GigabitEthernet1&#x2F;0&#x2F;0         3000                     202.10.1.2    easyip  </span><br><span class="line"> --------------------------------------------------------------------------</span><br><span class="line">  Total : 1</span><br></pre></td></tr></table></figure>:hexoPostRenderEscape-->

部署NAT Server

总部有Web服务器，需在两个出口路由器RouterA和RouterB上都配置NAT Server，实现外网用户访问内网Web服务器。

# 配置RouterA。

1
2
3

[RouterA] interface GigabitEthernet1/0/0
[RouterA-GigabitEthernet1/0/0] nat server protocol tcp global 202.10.100.3 www inside 10.10.30.2 8080
[RouterA-GigabitEthernet1/0/0] quit

# 配置RouterB。

1
2
3

[RouterB] interface GigabitEthernet1/0/0
[RouterB-GigabitEthernet1/0/0] nat server protocol tcp global 202.10.100.3 www inside 10.10.30.2 8080
[RouterB-GigabitEthernet1/0/0] quit

# 配置完成后可以通过display nat server命令查看NAT Server的配置信息，以RouterA为例详细信息如下。

[RouterA] display nat server

  Nat Server Information:
  Interface  : GigabitEthernet1/0/0
    Global IP/Port     : 202.10.100.3/80(www) 
    Inside IP/Port     : 10.10.30.2/8080
    Protocol : 6(tcp)   
    VPN instance-name  : ----                            
    Acl number         : ----
    Description : ----

  Total :    1

部署IPSec VPN，实现总部和分支之间通过Internet实现私网互通，并且数据通信具有安全保护
1. 配置ACL，定义需要IPSec保护的数据流

  \# 配置总部出口路由器RouterA。

  <!--hexoPostRenderEscape:<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">[RouterA] acl 3001</span><br><span class="line">[RouterA-acl-adv-3001] rule 5 permit ip source 10.10.10.0 0.0.0.255 destination 10.10.200.0 0.0.0.255       &#x2F;&#x2F;需要IPSec保护的数据流</span><br><span class="line">[RouterA-acl-adv-3001] rule 10 permit ip source 10.10.20.0 0.0.0.255 destination 10.10.200.0 0.0.0.255       &#x2F;&#x2F;需要IPSec保护的数据流</span><br><span class="line">[RouterA-acl-adv-3001] quit</span><br></pre></td></tr></table></figure>:hexoPostRenderEscape-->

  \# 配置总部出口路由器RouterB。

  <!--hexoPostRenderEscape:<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">[RouterB] acl 3001</span><br><span class="line">[RouterB-acl-adv-3001] rule 5 permit ip source 10.10.10.0 0.0.0.255 destination 10.10.200.0 0.0.0.255</span><br><span class="line">[RouterB-acl-adv-3001] rule 10 permit ip source 10.10.20.0 0.0.0.255 destination 10.10.200.0 0.0.0.255</span><br><span class="line">[RouterB-acl-adv-3001] quit</span><br></pre></td></tr></table></figure>:hexoPostRenderEscape-->

  \# 配置分支出口路由器RouterC。

  <!--hexoPostRenderEscape:<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">[RouterC] acl 3001</span><br><span class="line">[RouterC-acl-adv-3001] rule 5 permit ip source 10.10.200.0 0.0.0.255 destination 10.10.10.0 0.0.0.255</span><br><span class="line">[RouterC-acl-adv-3001] rule 10 permit ip source 10.10.200.0 0.0.0.255 destination 10.10.20.0 0.0.0.255</span><br><span class="line">[RouterC-acl-adv-3001] quit</span><br></pre></td></tr></table></figure>:hexoPostRenderEscape-->

配置IPSec安全提议

  \# 配置总部出口路由器RouterA。总部出口路由器RouterB以及分支出口路由器RouterC的配置和RouterA类似。

  <!--hexoPostRenderEscape:<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">[RouterA] ipsec proposal tran1</span><br><span class="line">[RouterA-ipsec-proposal-tran1] esp authentication-algorithm sha2-256      &#x2F;&#x2F;设置ESP协议采用的认证算法</span><br><span class="line">[RouterA-ipsec-proposal-tran1] esp encryption-algorithm aes-128      &#x2F;&#x2F;设置ESP协议采用的加密算法</span><br><span class="line">[RouterA-ipsec-proposal-tran1] quit</span><br></pre></td></tr></table></figure>:hexoPostRenderEscape-->

配置IKE安全提议

  \# 配置总部出口路由器RouterA。总部出口路由器RouterB以及分支出口路由器RouterC的配置和RouterA类似。

  <!--hexoPostRenderEscape:<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">[RouterA] ike proposal 5</span><br><span class="line">[RouterA-ike-proposal-5] encryption-algorithm aes-cbc-128</span><br><span class="line">[RouterA-ike-proposal-5] quit</span><br></pre></td></tr></table></figure>:hexoPostRenderEscape-->

配置IKE对等体

  \# 配置总部出口路由器RouterA。

  <!--hexoPostRenderEscape:<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">[RouterA] ike peer vpn v1</span><br><span class="line">[RouterA-ike-peer-vpn] pre-shared-key cipher huawei123</span><br><span class="line">[RouterA-ike-peer-vpn] ike-proposal 5</span><br><span class="line">[RouterA-ike-peer-vpn] dpd type periodic     &#x2F;&#x2F;配置周期性对等体存活检测</span><br><span class="line">[RouterA-ike-peer-vpn] dpd idle-time 10     &#x2F;&#x2F;设置对等体存活检测空闲时间为10秒</span><br><span class="line">[RouterA-ike-peer-vpn] remote-address 203.10.1.2</span><br><span class="line">[RouterA-ike-peer-vpn] quit</span><br></pre></td></tr></table></figure>:hexoPostRenderEscape-->

  \# 配置总部出口路由器RouterB。

  <!--hexoPostRenderEscape:<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">[RouterB] ike peer vpn v1</span><br><span class="line">[RouterB-ike-peer-vpn] pre-shared-key cipher huawei123</span><br><span class="line">[RouterB-ike-peer-vpn] ike-proposal 5</span><br><span class="line">[RouterB-ike-peer-vpn] dpd type periodic</span><br><span class="line">[RouterB-ike-peer-vpn] dpd idle-time 10</span><br><span class="line">[RouterB-ike-peer-vpn] remote-address 203.10.1.2</span><br><span class="line">[RouterB-ike-peer-vpn] quit</span><br></pre></td></tr></table></figure>:hexoPostRenderEscape-->

  \# 配置分支出口路由器RouterC。

  <!--hexoPostRenderEscape:<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br></pre></td><td class="code"><pre><span class="line">[RouterC] ike peer vpnr1 v1</span><br><span class="line">[RouterC-ike-peer-vpnr1] pre-shared-key cipher huawei123</span><br><span class="line">[RouterC-ike-peer-vpnr1] ike-proposal 5</span><br><span class="line">[RouterC-ike-peer-vpnr1] dpd type periodic</span><br><span class="line">[RouterC-ike-peer-vpnr1] dpd idle-time 10</span><br><span class="line">[RouterC-ike-peer-vpnr1] remote-address 202.10.1.2</span><br><span class="line">[RouterC-ike-peer-vpnr1] quit</span><br><span class="line">[RouterC] ike peer vpnr2 v1</span><br><span class="line">[RouterC-ike-peer-vpnr2] pre-shared-key cipher huawei123</span><br><span class="line">[RouterC-ike-peer-vpnr2] ike-proposal 5</span><br><span class="line">[RouterC-ike-peer-vpnr2] dpd type periodic</span><br><span class="line">[RouterC-ike-peer-vpnr2] dpd idle-time 10</span><br><span class="line">[RouterC-ike-peer-vpnr2] remote-address 202.10.2.2</span><br><span class="line">[RouterC-ike-peer-vpnr2] quit</span><br></pre></td></tr></table></figure>:hexoPostRenderEscape-->

配置安全策略

  \# 配置总部出口路由器RouterA。

  <!--hexoPostRenderEscape:<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">[RouterA] ipsec policy ipsec_vpn 10 isakmp</span><br><span class="line">[RouterA-ipsec-policy-isakmp-ipsec_vpn-10] security acl 3001</span><br><span class="line">[RouterA-ipsec-policy-isakmp-ipsec_vpn-10] ike-peer vpn</span><br><span class="line">[RouterA-ipsec-policy-isakmp-ipsec_vpn-10] proposal tran1</span><br><span class="line">[RouterA-ipsec-policy-isakmp-ipsec_vpn-10] quit</span><br></pre></td></tr></table></figure>:hexoPostRenderEscape-->

  \# 配置总部出口路由器RouterB。

  <!--hexoPostRenderEscape:<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">[RouterB] ipsec policy ipsec_vpn 10 isakmp</span><br><span class="line">[RouterB-ipsec-policy-isakmp-ipsec_vpn-10] security acl 3001</span><br><span class="line">[RouterB-ipsec-policy-isakmp-ipsec_vpn-10] ike-peer vpn</span><br><span class="line">[RouterB-ipsec-policy-isakmp-ipsec_vpn-10] proposal tran1</span><br><span class="line">[RouterB-ipsec-policy-isakmp-ipsec_vpn-10] quit</span><br></pre></td></tr></table></figure>:hexoPostRenderEscape-->

  \# 配置分支出口路由器RouterC。

  <!--hexoPostRenderEscape:<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line">[RouterC] ipsec policy ipsec_vpn 10 isakmp</span><br><span class="line">[RouterC-ipsec-policy-isakmp-ipsec_vpn-10] security acl 3001</span><br><span class="line">[RouterC-ipsec-policy-isakmp-ipsec_vpn-10] ike-peer vpnr1</span><br><span class="line">[RouterC-ipsec-policy-isakmp-ipsec_vpn-10] proposal tran1</span><br><span class="line">[RouterC-ipsec-policy-isakmp-ipsec_vpn-10] quit</span><br><span class="line">[RouterC] ipsec policy ipsec_vpn 20 isakmp</span><br><span class="line">[RouterC-ipsec-policy-isakmp-ipsec_vpn-20] security acl 3001</span><br><span class="line">[RouterC-ipsec-policy-isakmp-ipsec_vpn-20] ike-peer vpnr2</span><br><span class="line">[RouterC-ipsec-policy-isakmp-ipsec_vpn-20] proposal tran1</span><br><span class="line">[RouterC-ipsec-policy-isakmp-ipsec_vpn-20] quit</span><br></pre></td></tr></table></figure>:hexoPostRenderEscape-->

接口上引用安全策略组

  \# 在总部出口路由器RouterA的接口上引用安全策略组。

  <!--hexoPostRenderEscape:<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">[RouterA] interface GigabitEthernet1&#x2F;0&#x2F;0</span><br><span class="line">[RouterA-GigabitEthernet1&#x2F;0&#x2F;0] ipsec policy ipsec_vpn</span><br><span class="line">[RouterA-GigabitEthernet1&#x2F;0&#x2F;0] quit</span><br></pre></td></tr></table></figure>:hexoPostRenderEscape-->

  \# 在总部出口路由器RouterB的接口上引用安全策略组。

  <!--hexoPostRenderEscape:<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">[RouterB] interface GigabitEthernet1&#x2F;0&#x2F;0</span><br><span class="line">[RouterB-GigabitEthernet1&#x2F;0&#x2F;0] ipsec policy ipsec_vpn</span><br><span class="line">[RouterB-GigabitEthernet1&#x2F;0&#x2F;0] quit</span><br></pre></td></tr></table></figure>:hexoPostRenderEscape-->

  \# 在分支出口路由器RouterC的接口上引用安全策略组。

  <!--hexoPostRenderEscape:<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">[RouterC] interface GigabitEthernet1&#x2F;0&#x2F;0</span><br><span class="line">[RouterC-GigabitEthernet1&#x2F;0&#x2F;0] ipsec policy ipsec_vpn</span><br><span class="line">[RouterC-GigabitEthernet1&#x2F;0&#x2F;0] quit</span><br></pre></td></tr></table></figure>:hexoPostRenderEscape-->

检查配置结果

  \# 配置完成后，可以执行**display ike sa**命令查看由IKE建立的安全联盟信息，以RouterC为例，由IKE建立的安全联盟信息如下。

  <!--hexoPostRenderEscape:<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line">[RouterC] display ike sa</span><br><span class="line">    Conn-ID  Peer            VPN   Flag(s)                Phase  </span><br><span class="line">  ---------------------------------------------------------------</span><br><span class="line">        7    202.10.2.2      0     RD|ST                  2     </span><br><span class="line">        4    202.10.2.2      0     RD                     2     </span><br><span class="line">        2    202.10.2.2      0     RD                     1     </span><br><span class="line">        6    202.10.1.2      0     RD|ST                  2     </span><br><span class="line">        5    202.10.1.2      0     RD                     2     </span><br><span class="line">        3    202.10.1.2      0     RD                     1     </span><br><span class="line"></span><br><span class="line">  Flag Description:</span><br><span class="line">  RD--READY   ST--STAYALIVE   RL--REPLACED   FD--FADING   TO--TIMEOUT</span><br><span class="line">  HRT--HEARTBEAT   LKG--LAST KNOWN GOOD SEQ NO.   BCK--BACKED UP</span><br></pre></td></tr></table></figure>:hexoPostRenderEscape-->

  \# 配置完成后，可以执行**display ipsec sa**命令查看安全联盟的相关信息，以RouterC为例，安全联盟信息如下。

  <!--hexoPostRenderEscape:<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br><span class="line">79</span><br><span class="line">80</span><br><span class="line">81</span><br><span class="line">82</span><br><span class="line">83</span><br><span class="line">84</span><br><span class="line">85</span><br><span class="line">86</span><br><span class="line">87</span><br><span class="line">88</span><br><span class="line">89</span><br><span class="line">90</span><br><span class="line">91</span><br><span class="line">92</span><br><span class="line">93</span><br><span class="line">94</span><br><span class="line">95</span><br><span class="line">96</span><br><span class="line">97</span><br><span class="line">98</span><br><span class="line">99</span><br><span class="line">100</span><br><span class="line">101</span><br><span class="line">102</span><br><span class="line">103</span><br><span class="line">104</span><br><span class="line">105</span><br><span class="line">106</span><br><span class="line">107</span><br><span class="line">108</span><br><span class="line">109</span><br><span class="line">110</span><br><span class="line">111</span><br><span class="line">112</span><br><span class="line">113</span><br><span class="line">114</span><br><span class="line">115</span><br><span class="line">116</span><br><span class="line">117</span><br><span class="line">118</span><br><span class="line">119</span><br><span class="line">120</span><br><span class="line">121</span><br><span class="line">122</span><br><span class="line">123</span><br><span class="line">124</span><br><span class="line">125</span><br><span class="line">126</span><br></pre></td><td class="code"><pre><span class="line">[RouterC] display ipsec sa</span><br><span class="line"></span><br><span class="line">&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;</span><br><span class="line">Interface: GigabitEthernet1&#x2F;0&#x2F;0</span><br><span class="line"> Path MTU: 1500</span><br><span class="line">&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D;</span><br><span class="line"></span><br><span class="line">  -----------------------------</span><br><span class="line">  IPSec policy name: &quot;ipsec_vpn&quot;</span><br><span class="line">  Sequence number  : 10</span><br><span class="line">  Acl Group        : 3001</span><br><span class="line">  Acl rule         : 5</span><br><span class="line">  Mode             : ISAKMP</span><br><span class="line">  -----------------------------</span><br><span class="line">    Connection ID     : 5</span><br><span class="line">    Encapsulation mode: Tunnel</span><br><span class="line">    Tunnel local      : 203.10.1.2</span><br><span class="line">    Tunnel remote     : 202.10.1.2</span><br><span class="line">    Flow source       : 10.10.200.0&#x2F;255.255.255.0 0&#x2F;0</span><br><span class="line">    Flow destination  : 10.10.10.0&#x2F;255.255.255.0 0&#x2F;0</span><br><span class="line">    Qos pre-classify  : Disable</span><br><span class="line"></span><br><span class="line">    [Outbound ESP SAs] </span><br><span class="line">      SPI: 969156085 (0x39c425f5)</span><br><span class="line">      Proposal: ESP-ENCRYPT-AES-128 SHA2-256-128</span><br><span class="line">      SA remaining key duration (bytes&#x2F;sec): 1887313920&#x2F;1521</span><br><span class="line">      Max sent sequence-number: 8</span><br><span class="line">      UDP encapsulation used for NAT traversal: N</span><br><span class="line"></span><br><span class="line">    [Inbound ESP SAs] </span><br><span class="line">      SPI: 1258341975 (0x4b00c657)</span><br><span class="line">      Proposal: ESP-ENCRYPT-AES-128 SHA2-256-128</span><br><span class="line">      SA remaining key duration (bytes&#x2F;sec): 1887436080&#x2F;1521</span><br><span class="line">      Max received sequence-number: 10</span><br><span class="line">      Anti-replay window size: 32</span><br><span class="line">      UDP encapsulation used for NAT traversal: N</span><br><span class="line"></span><br><span class="line">  -----------------------------</span><br><span class="line">  IPSec policy name: &quot;ipsec_vpn&quot;</span><br><span class="line">  Sequence number  : 10</span><br><span class="line">  Acl Group        : 3001</span><br><span class="line">  Acl rule         : 10</span><br><span class="line">  Mode             : ISAKMP</span><br><span class="line">  -----------------------------</span><br><span class="line">    Connection ID     : 6</span><br><span class="line">    Encapsulation mode: Tunnel</span><br><span class="line">    Tunnel local      : 203.10.1.2</span><br><span class="line">    Tunnel remote     : 202.10.1.2</span><br><span class="line">    Flow source       : 10.10.200.0&#x2F;255.255.255.0 0&#x2F;0</span><br><span class="line">    Flow destination  : 10.10.20.0&#x2F;255.255.255.0 0&#x2F;0</span><br><span class="line">    Qos pre-classify  : Disable</span><br><span class="line"></span><br><span class="line">    [Outbound ESP SAs] </span><br><span class="line">      SPI: 4217384908 (0xfb602fcc)</span><br><span class="line">      Proposal: ESP-ENCRYPT-AES-128 SHA2-256-128</span><br><span class="line">      SA remaining key duration (bytes&#x2F;sec): 1887283200&#x2F;1522</span><br><span class="line">      Max sent sequence-number: 10</span><br><span class="line">      UDP encapsulation used for NAT traversal: N</span><br><span class="line"></span><br><span class="line">    [Inbound ESP SAs] </span><br><span class="line">      SPI: 654720480 (0x27063de0)</span><br><span class="line">      Proposal: ESP-ENCRYPT-AES-128 SHA2-256-128</span><br><span class="line">      SA remaining key duration (bytes&#x2F;sec): 1887436080&#x2F;1522</span><br><span class="line">      Max received sequence-number: 10</span><br><span class="line">      Anti-replay window size: 32</span><br><span class="line">      UDP encapsulation used for NAT traversal: N</span><br><span class="line"></span><br><span class="line">  -----------------------------</span><br><span class="line">  IPSec policy name: &quot;ipsec_vpn&quot;</span><br><span class="line">  Sequence number  : 20</span><br><span class="line">  Acl Group        : 3001</span><br><span class="line">  Acl rule         : 5</span><br><span class="line">  Mode             : ISAKMP</span><br><span class="line">  -----------------------------</span><br><span class="line">    Connection ID     : 4</span><br><span class="line">    Encapsulation mode: Tunnel</span><br><span class="line">    Tunnel local      : 203.10.1.2</span><br><span class="line">    Tunnel remote     : 202.10.2.2</span><br><span class="line">    Flow source       : 10.10.200.0&#x2F;255.255.255.0 0&#x2F;0</span><br><span class="line">    Flow destination  : 10.10.10.0&#x2F;255.255.255.0 0&#x2F;0</span><br><span class="line">    Qos pre-classify  : Disable</span><br><span class="line"></span><br><span class="line">    [Outbound ESP SAs] </span><br><span class="line">      SPI: 240759500 (0xe59b2cc)</span><br><span class="line">      Proposal: ESP-ENCRYPT-AES-128 SHA2-256-128</span><br><span class="line">      SA remaining key duration (bytes&#x2F;sec): 1887436800&#x2F;1521</span><br><span class="line">      Max sent sequence-number: 0</span><br><span class="line">      UDP encapsulation used for NAT traversal: N</span><br><span class="line"></span><br><span class="line">    [Inbound ESP SAs] </span><br><span class="line">      SPI: 3888073495 (0xe7bf4b17)</span><br><span class="line">      Proposal: ESP-ENCRYPT-AES-128 SHA2-256-128</span><br><span class="line">      SA remaining key duration (bytes&#x2F;sec): 1887436800&#x2F;1521</span><br><span class="line">      Max received sequence-number: 0</span><br><span class="line">      Anti-replay window size: 32</span><br><span class="line">      UDP encapsulation used for NAT traversal: N</span><br><span class="line"></span><br><span class="line">  -----------------------------</span><br><span class="line">  IPSec policy name: &quot;ipsec_vpn&quot;</span><br><span class="line">  Sequence number  : 20</span><br><span class="line">  Acl Group        : 3001</span><br><span class="line">  Acl rule         : 10</span><br><span class="line">  Mode             : ISAKMP</span><br><span class="line">  -----------------------------</span><br><span class="line">    Connection ID     : 7</span><br><span class="line">    Encapsulation mode: Tunnel</span><br><span class="line">    Tunnel local      : 203.10.1.2</span><br><span class="line">    Tunnel remote     : 202.10.2.2</span><br><span class="line">    Flow source       : 10.10.200.0&#x2F;255.255.255.0 0&#x2F;0</span><br><span class="line">    Flow destination  : 10.10.20.0&#x2F;255.255.255.0 0&#x2F;0</span><br><span class="line">    Qos pre-classify  : Disable</span><br><span class="line"></span><br><span class="line">    [Outbound ESP SAs] </span><br><span class="line">      SPI: 2751917383 (0xa406ed47)</span><br><span class="line">      Proposal: ESP-ENCRYPT-AES-128 SHA2-256-128</span><br><span class="line">      SA remaining key duration (bytes&#x2F;sec): 1887436800&#x2F;1522</span><br><span class="line">      Max sent sequence-number: 0</span><br><span class="line">      UDP encapsulation used for NAT traversal: N</span><br><span class="line"></span><br><span class="line">    [Inbound ESP SAs] </span><br><span class="line">      SPI: 739146604 (0x2c0e7b6c)</span><br><span class="line">      Proposal: ESP-ENCRYPT-AES-128 SHA2-256-128</span><br><span class="line">      SA remaining key duration (bytes&#x2F;sec): 1887436800&#x2F;1522</span><br><span class="line">      Max received sequence-number: 0</span><br><span class="line">      Anti-replay window size: 32</span><br><span class="line">      UDP encapsulation used for NAT traversal: N</span><br></pre></td></tr></table></figure>:hexoPostRenderEscape-->

检查配置结果

# 通过ping命令验证总部和分支之间的连通性。

PC1>ping 10.10.200.2

Ping 10.10.200.2: 32 data bytes, Press Ctrl_C to break
From 10.10.200.2: bytes=32 seq=1 ttl=126 time=140 ms
From 10.10.200.2: bytes=32 seq=2 ttl=126 time=235 ms
From 10.10.200.2: bytes=32 seq=3 ttl=126 time=266 ms
From 10.10.200.2: bytes=32 seq=4 ttl=126 time=140 ms
From 10.10.200.2: bytes=32 seq=5 ttl=126 time=141 ms

--- 10.10.200.2 ping statistics ---
  5 packet(s) transmitted
  5 packet(s) received
  0.00% packet loss
  round-trip min/avg/max = 140/184/266 ms

PC3>ping 10.10.200.2

Ping 10.10.200.2: 32 data bytes, Press Ctrl_C to break
From 10.10.200.2: bytes=32 seq=1 ttl=126 time=156 ms
From 10.10.200.2: bytes=32 seq=2 ttl=126 time=297 ms
From 10.10.200.2: bytes=32 seq=3 ttl=126 time=156 ms
From 10.10.200.2: bytes=32 seq=4 ttl=126 time=141 ms
From 10.10.200.2: bytes=32 seq=5 ttl=126 time=109 ms

--- 10.10.200.2 ping statistics ---
  5 packet(s) transmitted
  5 packet(s) received
  0.00% packet loss
  round-trip min/avg/max = 109/171/297 ms

可以看到，PC1和PC5、PC3和PC5之间都是可以互通的，公司总部和分支之间可以通过运营商网络组建的私网VPN进行互通。

# 验证企业总部各部门与公网之间的连通性，以企业总部的公网网关202.10.1.1作为测试地址。

PC1>ping 202.10.1.1

Ping 202.10.1.1: 32 data bytes, Press Ctrl_C to break
From 202.10.1.1: bytes=32 seq=1 ttl=253 time=235 ms
From 202.10.1.1: bytes=32 seq=2 ttl=253 time=109 ms
From 202.10.1.1: bytes=32 seq=3 ttl=253 time=79 ms
From 202.10.1.1: bytes=32 seq=4 ttl=253 time=63 ms
From 202.10.1.1: bytes=32 seq=5 ttl=253 time=63 ms

--- 202.10.1.1 ping statistics ---
  5 packet(s) transmitted
  5 packet(s) received
  0.00% packet loss
  round-trip min/avg/max = 63/109/235 ms

PC3>ping 202.10.1.1

Ping 202.10.1.1: 32 data bytes, Press Ctrl_C to break
Request timeout!
Request timeout!
Request timeout!
Request timeout!
Request timeout!

--- 202.10.1.1 ping statistics ---
  5 packet(s) transmitted
  0 packet(s) received
  100.00% packet loss

可以看到，部门A（PC1）的用户可以访问公网，部门B（PC3）的用户不能访问公网。

配置文件

总部核心交换机CORE的配置文件

#
sysname CORE
#
vlan batch 100
#
interface Vlanif100
 ip address 10.10.100.4 255.255.255.0
#
interface Eth-Trunk3
 port link-type trunk
 port trunk allow-pass vlan 100
 mode lacp

#
interface Eth-Trunk4
 port link-type trunk
 port trunk allow-pass vlan 100
 mode lacp

#
interface GigabitEthernet0/0/3
 eth-trunk 3
#
interface GigabitEthernet0/0/4
 eth-trunk 4
#
interface GigabitEthernet1/0/3
 eth-trunk 3
#
interface GigabitEthernet1/0/4
 eth-trunk 4
#
ospf 1 router-id 10.3.3.3
 area 0.0.0.0
  network 10.10.100.0 0.0.0.255
  network 10.10.10.0 0.0.0.255
  network 10.10.20.0 0.0.0.255
  network 10.10.30.0 0.0.0.255
#
ip route-static 0.0.0.0 0.0.0.0 10.10.100.1
#
return

总部出口路由器RouterA的配置文件

#
 sysname RouterA
#
acl number 3000  
 rule 5 deny ip source 10.10.10.0 0.0.0.255 destination 10.10.200.0 0.0.0.255 
 rule 10 deny ip source 10.10.20.0 0.0.0.255 destination 10.10.200.0 0.0.0.255 
 rule 15 permit ip source 10.10.10.0 0.0.0.255 
acl number 3001  
 rule 5 permit ip source 10.10.10.0 0.0.0.255 destination 10.10.200.0 0.0.0.255 
 rule 10 permit ip source 10.10.20.0 0.0.0.255 destination 10.10.200.0 0.0.0.255 
#
ipsec proposal tran1
 esp authentication-algorithm sha2-256 
 esp encryption-algorithm aes-128
#
ike proposal 5
 encryption-algorithm aes-cbc-128
#
ike peer vpn v1
 pre-shared-key cipher "@J*U2S*(7F,YWX*NZ55OA!!
 ike-proposal 5
 dpd type periodic
 dpd idle-time 10
 remote-address 203.10.1.2
#
ipsec policy ipsec_vpn 10 isakmp
 security acl 3001
 ike-peer vpn
 proposal tran1
#
interface Eth-Trunk1
 undo portswitch
 mode lacp-static
#
interface Eth-Trunk1.100
 dot1q termination vid 100
 ip address 10.10.100.2 255.255.255.0 
 vrrp vrid 1 virtual-ip 10.10.100.1
 vrrp vrid 1 priority 120
 vrrp vrid 1 track interface GigabitEthernet1/0/0 reduced 40
 arp broadcast enable
#
interface GigabitEthernet1/0/0
 ip address 202.10.1.2 255.255.255.0 
 ipsec policy ipsec_vpn
 nat server protocol tcp global 202.10.100.3 www inside 10.10.30.2 8080
 nat outbound 3000
#
interface GigabitEthernet2/0/0
 eth-trunk 1
#
interface GigabitEthernet2/0/1
 eth-trunk 1
#
ospf 1 router-id 10.1.1.1 
 area 0.0.0.0 
  network 10.10.100.0 0.0.0.255 
#
ip route-static 0.0.0.0 0.0.0.0 202.10.1.1
#
return

总部出口路由器RouterB的配置文件

#
 sysname RouterB
#
acl number 3000  
 rule 5 deny ip source 10.10.10.0 0.0.0.255 destination 10.10.200.0 0.0.0.255 
 rule 10 deny ip source 10.10.20.0 0.0.0.255 destination 10.10.200.0 0.0.0.255 
 rule 15 permit ip source 10.10.10.0 0.0.0.255 
acl number 3001  
 rule 5 permit ip source 10.10.10.0 0.0.0.255 destination 10.10.200.0 0.0.0.255 
 rule 10 permit ip source 10.10.20.0 0.0.0.255 destination 10.10.200.0 0.0.0.255 
#
ipsec proposal tran1
 esp authentication-algorithm sha2-256 
 esp encryption-algorithm aes-128
#
ike proposal 5
 encryption-algorithm aes-cbc-128
#
ike peer vpn v1
 pre-shared-key cipher "@J*U2S*(7F,YWX*NZ55OA!!
 ike-proposal 5
 dpd type periodic
 dpd idle-time 10
 remote-address 203.10.1.2
#
ipsec policy ipsec_vpn 10 isakmp
 security acl 3001
 ike-peer vpn
 proposal tran1
#
interface Eth-Trunk1
 undo portswitch
 mode lacp-static
#
interface Eth-Trunk1.100
 dot1q termination vid 100
 ip address 10.10.100.3 255.255.255.0 
 vrrp vrid 1 virtual-ip 10.10.100.1
 arp broadcast enable
#
interface GigabitEthernet1/0/0
 ip address 202.10.2.2 255.255.255.0 
 ipsec policy ipsec_vpn
 nat server protocol tcp global 202.10.100.3 www inside 10.10.30.2 8080
 nat outbound 3000
#
interface GigabitEthernet2/0/0
 eth-trunk 1
#
interface GigabitEthernet2/0/1
 eth-trunk 1
#
ospf 1 router-id 10.2.2.2 
 area 0.0.0.0 
  network 10.10.100.0 0.0.0.255 
#
ip route-static 0.0.0.0 0.0.0.0 202.10.2.1
#
return

分支出口路由器RouterC的配置文件

#
 sysname RouterC
#
acl number 3000  
 rule 5 deny ip source 10.10.200.0 0.0.0.255 destination 10.10.10.0 0.0.0.255 
 rule 10 deny ip source 10.10.200.0 0.0.0.255 destination 10.10.20.0 0.0.0.255 
 rule 15 permit ip source 10.10.200.0 0.0.0.255 
acl number 3001  
 rule 5 permit ip source 10.10.200.0 0.0.0.255 destination 10.10.10.0 0.0.0.255 
 rule 10 permit ip source 10.10.200.0 0.0.0.255 destination 10.10.20.0 0.0.0.255 
#
ipsec proposal tran1
 esp authentication-algorithm sha2-256 
 esp encryption-algorithm aes-128
#
ike proposal 5
 encryption-algorithm aes-cbc-128
#
ike peer vpnr1 v1
 pre-shared-key cipher "@J*U2S*(7F,YWX*NZ55OA!!
 ike-proposal 5
 dpd type periodic
 dpd idle-time 10
 remote-address 202.10.1.2
#
ike peer vpnr2 v1
 pre-shared-key cipher "@J*U2S*(7F,YWX*NZ55OA!!
 ike-proposal 5
 dpd type periodic
 dpd idle-time 10
 remote-address 202.10.2.2
#
ipsec policy ipsec_vpn 10 isakmp
 security acl 3001
 ike-peer vpnr1
 proposal tran1
#
ipsec policy ipsec_vpn 20 isakmp
 security acl 3001
 ike-peer vpnr2
 proposal tran1
#
interface GigabitEthernet1/0/0
 ip address 203.10.1.2 255.255.255.0 
 ipsec policy ipsec_vpn
 nat outbound 3000
#
ip route-static 0.0.0.0 0.0.0.0 203.10.1.1
#
return

总部运营商路由器RouterD的配置文件

#
 sysname RouterD
#
interface GigabitEthernet1/0/0
 ip address 202.10.1.1 255.255.255.0 
#
interface GigabitEthernet2/0/0
 ip address 202.10.2.1 255.255.255.0 
#
ip route-static 202.10.100.0 255.255.255.0 202.10.1.2 preference 40
ip route-static 202.10.100.0 255.255.255.0 202.10.2.2
#
return

分支运营商路由器RouterE的配置文件

#
 sysname RouterE
#
interface GigabitEthernet1/0/0
 ip address 203.10.1.1 255.255.255.0 
#
return

如果帮助到了您，欢迎请我喝杯冰阔落~

本文作者：澈崽子
本文链接：https://zeozzz.github.com/2019/07/15/66/
版权声明：本博客所有文章除特别声明外，均默认采用许可协议。