不知道正常该怎么做- -|| 这么也能实现

 

效果：双线路，R1模拟内网交换机，R2模拟网关，其中内网1.1走一根，其余走另一根，有一根断了自动切换到另一根，恢复了再自动切换回来。

主要配置都在R2上。

r2(config)#do sh run
Building configuration...

Current configuration : 2464 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname r2
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
!
!
ip cef
no ip domain lookup
!
!
ip sla monitor 1
 type echo protocol ipIcmpEcho 29.29.23.3 source-interface Ethernet0/0
 frequency 10
ip sla monitor schedule 1 life forever start-time now
ip sla monitor 2
 type echo protocol ipIcmpEcho 29.29.24.4 source-interface Ethernet0/2
 frequency 10
ip sla monitor schedule 2 life forever start-time now
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!        
track 101 rtr 1 reachability
!
track 102 rtr 2 reachability
!
!
!
!
!
interface Loopback0
 ip address 29.29.2.2 255.255.255.0
!
interface Ethernet0/0
 ip address 29.29.23.2 255.255.255.0
 ip nat outside
 ip virtual-reassembly
 half-duplex
!
interface Ethernet0/1
 ip address 29.29.12.2 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 ip policy route-map POLICE
 half-duplex
!
interface Ethernet0/2
 ip address 29.29.24.2 255.255.255.0
 ip nat outside
 ip virtual-reassembly
 half-duplex
!
interface Ethernet0/3
 ip address 29.29.25.2 255.255.255.0
 shutdown
 half-duplex
!
interface Serial1/0
 ip address 29.29.32.2 255.255.255.0
 shutdown
 serial restart-delay 0
!
interface Serial1/1
 ip address 29.29.21.2 255.255.255.0
 shutdown
 serial restart-delay 0
!
interface Serial1/2
 ip address 29.29.42.2 255.255.255.0
 shutdown
 serial restart-delay 0
!
interface Serial1/3
 ip address 29.29.52.2 255.255.255.0
 shutdown
 serial restart-delay 0
!
ip http server
no ip http secure-server
ip route 0.0.0.0 0.0.0.0 29.29.23.3
ip route 0.0.0.0 0.0.0.0 29.29.24.4
ip route 29.29.1.0 255.255.255.0 29.29.12.1
!
!
ip nat inside source route-map DX interface Ethernet0/2 overload
ip nat inside source route-map WT interface Ethernet0/0 overload
!
!
ip access-list extended toDX
 permit ip any any
ip access-list extended toWT
 permit ip host 29.29.1.1 any
!
route-map WT permit 10
 match interface Ethernet0/0
!
route-map DX permit 10
 match interface Ethernet0/2
!
route-map POLICE permit 10
 match ip address toWT
 set ip next-hop verify-availability 29.29.23.3 10 track 101
 set interface Ethernet0/2
!
route-map POLICE permit 20
 match ip address toDX
 set ip next-hop verify-availability 29.29.24.4 20 track 102
 set interface Ethernet0/0
!
!
!
control-plane
!
!        
!
!
!
!
!
!
!
!
line con 0
 exec-timeout 0 0
 logging synchronous
line aux 0
line vty 0 4
 login
!
!
end

 

配完后R2的公网地址没法telnet了，实际配的时候时间紧暂时用两条线另外两个公网地址跟R2的两个LOOP口做映射解决的telnet

如果还附带VPN，VPN里不做NAT的感兴趣数据流比如"deny ip 29.29.1.0 0.0.0.255 29.29.5.0 0.0.0.255" 这种，要match在WT或者DX的route-map里，不能加在“toWT”/“toDX”的ACL里