单路由双出口配置实验

 

用户原来一条2M电信出口,现新开通一条10M网通线路,原2M做备份,当10M线路出故障自动切换到2M电信出口,

由于时间关系简单画了一下拓扑图,R1,模拟电信R2,模拟网通 出口一台3640路由,下联二层交换机,划分多VLAN 在3640上做子接口实现VLAN间互通,

 

 

 PC发出的数据包在3640的接口上进行策略路由处理，如果目标地址为本地的其它网段(172.16.0.0/16)，则进行的普通路由转发；对于访问Internet的数据包，则将下一跳设为172.16.2.1，将数据包转发给防火墙。 防火墙对照规则进行过滤，允许通过的数据包将被转发给3640。这里假设icmp包是被禁止的，其它的数据包都是允许的。 3640收到来自于防火墙的数据包之后，进行NAT处理，如果当前CNC线路是通的(路由器选择的下一跳为202.1.1.254)，则将源地址转换为202.1.1.2，从e0/0发送出去；否则转换为地址10.1.1.2,则端口s3/1发送到Internet上。

 

R1配置

hostname R1

!

interface Loopback0

 ip address 2.2.2.2 255.255.255.0

interface Serial2/0

 ip address 10.1.1.254 255.255.255.0

 no fair-queue

 serial restart-delay 0

 

ip route 0.0.0.0 0.0.0.0 10.1.1.1

  

control-plane

!

!

line con 0

 exec-timeout 0 0

 logging synchronous

line aux 0

line vty 0 4

 password cisco

 login

 

 

R2配置

hostname R2

interface Loopback0

 ip address 2.2.2.2 255.255.255.0

!

interface Ethernet0/0

 ip address 202.1.1.254 255.255.255.0

!

ip route 0.0.0.0 0.0.0.0 202.1.1.1

    

control-plane

!

!

line con 0

 exec-timeout 0 0

 logging synchronous

line aux 0

line vty 0 4

 password ccie

 login

R3配置

 

hostname R3

!

interface Ethernet0/0

 ip address 202.1.1.1 255.255.255.0

 ip nat outside

 ip virtual-reassembly

!

interface Ethernet0/1

 ip address 172.16.1.254 255.255.255.0

 ip policy route-map to_fw

!

interface Ethernet0/2

 ip address 172.16.2.254 255.255.255.0

!

interface Ethernet0/3

 ip address 192.168.1.254 255.255.255.0

 ip nat inside

 ip virtual-reassembly

interface Serial2/0

 ip address 10.1.1.1 255.255.255.0

 ip nat outside

 ip virtual-reassembly

 no fair-queue

 serial restart-delay 0

!

!

no ip http server

no ip http secure-server

ip nat pool cnc 202.1.1.2 202.1.1.2 prefix-length 24

ip nat pool cn 10.1.1.2 10.1.1.2 prefix-length 24

ip nat inside source route-map nat_cn pool cn overload

ip nat inside source route-map nat_cnc pool cnc overload

ip route 0.0.0.0 0.0.0.0 202.1.1.254

ip route 0.0.0.0 0.0.0.0 10.1.1.254 100

!

access-list 1 permit 172.16.0.0 0.0.255.255

access-list 2 permit 202.1.1.254

access-list 3 permit 10.1.1.254

access-list 100 deny   ip any 172.16.0.0 0.0.255.255

access-list 100 permit ip any any

route-map nat_cn permit 10

 match ip address 1

 match ip next-hop 3

!

route-map nat_cnc permit 10

 match ip address 1

 match ip next-hop 2

!

route-map to_fw permit 10

 match ip address 100

 set ip next-hop 172.16.2.1

!

!

!

control-plane

!        

!

line con 0

 exec-timeout 0 0

 logging synchronous

line aux 0

line vty 0 4

 login

FW配置

!

hostname FW

!

interface Ethernet0/0

 ip address 172.16.2.1 255.255.255.0

 ip access-group 100 in

!

interface Ethernet0/1

 ip address 192.168.1.1 255.255.255.0

!

!

no ip http server

no ip http secure-server

ip route 0.0.0.0 0.0.0.0 192.168.1.254

ip route 172.16.0.0 255.255.0.0 172.16.2.254

control-plane

!

!        

line con 0

 exec-timeout 0 0

 logging synchronous

line aux 0

line vty 0 4

 login

PC配置

!

hostname PC

!

!

interface Ethernet0/0

 ip address 172.16.1.1 255.255.255.0

 no ip route-cache

!

!         

ip default-gateway 172.16.1.254

!

line con 0

 exec-timeout 0 0

 logging synchronous

line aux 0

line vty 0 4

 login

                              ※※ 水平有限,如配置有问题 联系QQ:89296909 ※※