OSPF综合实验

原创已于 2022-11-04 23:03:14 修改 · 466 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#大数据

于 2022-07-16 21:11:28 首次发布

hcip实验专栏收录该内容

9 篇文章

订阅专栏

该配置案例详细描述了一个OSPF网络的搭建，包括区域划分、MGRE环境、IP地址规划、静态路由、NAT配置、LSA更新优化、全网可达性及安全措施。R3作为中心站点，R4作为ISP，所有设备通过公有IP连接。使用了 stub、nssa区域减少LSA更新，并进行了路由汇总以加速收敛。同时，配置了区域认证确保网络安全性。最后，验证了全网互通性。

要求

1，R4为ISP，其上只能配置IP地址;R4与其他所有直连设备间均使用公有IP

2，R3-R5/6/7为MGRE环境，R3为中心站点;

3，整个OSPF环境IP基于172.16.0.0/16划分

4，所有设备均可访问R4的环回;

5，减少LSA的更新量，加快收敛，保障更新安全

;6，全网可达

拓扑

网段划分

一共6个区域基于172.16.0.0 16划分可分为

172.16.0.0 19 area0

172.16.32.0 19 area1

172.16.64.0 19 area2

172.16.96.0 19 area3

172.16.128.0 19 area4

172.16.160.0 19 rip

保留

172.16.192.0 19

172.16.224.0 19

区域内

172.16.0.0 19 --- A0

172.16.0.0/24

172.16.0.0/24 p2p 预留

172.16.0.0 30

172.16.4.0 30

.........

172.16.1.0 /24 --- MA

172.16.1.0 29-----虚拟

172.16.1.8 29

.............

172.16.2.0 24 -- R5环回

172.16.3.0 24 -- R6环回

172.16.4.0 24 -- R7环回

172.16.32.0 19 ---A1

172.16.32.0 24----p2p的骨干

172.16.32.0 30

172.16.32.4 30

172.16.32.8 30

..................... 共64

172.16.33.0 24 ---MA的骨干

172.16.33.0 29 选取

172.16.33.8 29

........

172.16.33.0 29

172.16.34.0 24 ---R1环回

172.16.35.0 24 ---R2环回

172.16.36.0 24---R3环回

172.16.64.0 19 --- A2

172.16.65.0 24 --- MA

172.16.65.0 29

172.16.65.8 29

...............

172 .16.67.1 24 --- R11环回

172.16.96.0 19 --- A3

172.16.96.0 24

172.16.97.0 24 ---MA

172.16.97.0 29

172.16.97.8 29

172.16.98.0 24 ---r8环回

172.16.128.0 19 --- A4

172.16.128.0 24---p2p预留

172.16.129.0 24 ---MA

172.14.129.0 29

172.16.130.0 24 -- r9环回

172.16.131.0 24 ---r10环回

172.16.160.0 19 ---rip

172.16.160.0 20

172.16.176.0 20 2个环回

基本IP配置

[r1-LoopBack0]ip a 172.16.34.1 24
[r1-LoopBack0]int g0/0/0
[r1-GigabitEthernet0/0/0]ip a 172.16.33.1 29

[r2]int l0
[r2-LoopBack0]ip a 172.16.35.1 24
[r2-LoopBack0]int g0/0/0
[r2-GigabitEthernet0/0/0]ip a 172.16.33.2 29

[r3]int l0
[r3-LoopBack0]ip a 172.16.36.1 24
[r3-LoopBack0]int g0/0/0
[r3-GigabitEthernet0/0/0]ip a 172.16.33.3 29
[r3-GigabitEthernet0/0/0]int s4/0/0
[r3-Serial4/0/0]ip a 34.0.0.1 24

[r4]int l0 
[r4-LoopBack0]ip a 4.4.4.4 24
[r4-LoopBack0]int s4/0/0 
[r4-Serial4/0/0]ip a 34.0.0.2 24
[r4-Serial4/0/0]int s4/0/1
[r4-Serial4/0/1]ip a 54.0.0.2 24
[r4-Serial4/0/1]int s3/0/0 
[r4-Serial3/0/0]ip a 64.0.0.2 24
[r4-Serial3/0/0]int g0/0/0
[r4-GigabitEthernet0/0/0]ip a 74.0.0.2 24

[r5]int l0 
[r5-LoopBack0]ip a 172.16.2.1 24
[r5-LoopBack0]int s4/0/0
[r5-Serial4/0/0]ip a 54.0.0.1 24

[r6]int l0
[r6-LoopBack0] ip a 172.16.3.1 24
[r6-LoopBack0]int s4/0/0
[r6-Serial4/0/0]ip a 64.0.0.1 24
[r6]int g0/0/0
[r6-GigabitEthernet0/0/0]ip a 172.16.65.1 29

[r7]int l0
[r7-LoopBack0]ip a 172.16.4.1 24
[r7-LoopBack0]int g0/0/0 
[r7-GigabitEthernet0/0/0]ip a 74.0.0.1 24
[r7-GigabitEthernet0/0/0]int g0/0/1
[r7-GigabitEthernet0/0/1]ip a 172.16.97.1 29


[r8]int l0
[r8-LoopBack0]ip a 172.16.98.1 24
[r8-LoopBack0]int g0/0/0
[r8-GigabitEthernet0/0/0]ip a 172.16.97.2 29
[r8-GigabitEthernet0/0/0]int g0/0/1
[r8-GigabitEthernet0/0/1]ip a 172.16.97.9 29


[r9]int l0
[r9-LoopBack0]ip a 172.16.130.1 24
[r9-LoopBack0]int g0/0/0
[r9-GigabitEthernet0/0/0]ip a 172.16.97.10 29
[r9-GigabitEthernet0/0/0]int g0/0/1
[r9-GigabitEthernet0/0/1]ip a 172.16.129.1 29

[r10]int l0
[r10-LoopBack0] ip a 172.16.131.1 24
[r10-LoopBack0]int g0/0/0
[r10-GigabitEthernet0/0/0]ip a 172.16.129.2  29

[r11]int l0
[r11-LoopBack0]ip a 172.16.67.1 24
[r11-LoopBack0]int g0/0/0
[r11-GigabitEthernet0/0/0]ip a 172.16.65.2 29
[r11-GigabitEthernet0/0/0]int g0/0/1
[r11-GigabitEthernet0/0/1]ip a 172.16.65.9 29

r12]int l0
[r12-LoopBack0]ip a 172.16.160.1 20
[r12-LoopBack0]int l1
[r12-LoopBack1]ip a 172.16.176.1 20
[r12-LoopBack1]int g0/0/0
[r12-GigabitEthernet0/0/0]ip a 172.16.65.10 29

注意r 3 5 6 7 各写一条到ISP的静态路由

[r3]ip route-static 0.0.0.0 0 34.0.0.2
r5 6 7 同上

R3-R5/6/7为MGRE环境，R3为中心站点;

配置

r3中心

[r3]int t 0/0/0
[r3-Tunnel0/0/0]ip a 172.16.1.1 29
[r3-Tunnel0/0/0]tunnel-protocol gre p2mp 
[r3-Tunnel0/0/0]source 34.0.0.1
[r3-Tunnel0/0/0]nhrp network-id 100
[r3-Tunnel0/0/0]nhrp entry multicast dynamic

[r5]int t0/0/0
[r5-Tunnel0/0/0]ip a 172.16.1.2 29
[r5-Tunnel0/0/0]tunnel-protocol gre p2mp 
[r5-Tunnel0/0/0]source s4/0/0
[r5-Tunnel0/0/0]nhrp network-id 100
[r5-Tunnel0/0/0]nhrp entry 172.16.1.1 34.0.0.1 register   汇报

[r6]int t0/0/0
[r6-Tunnel0/0/0]ip a 172.16.1.3 29
[r6-Tunnel0/0/0]tunnel-protocol gre p2mp 
[r6-Tunnel0/0/0]source  s4/0/0 
[r6-Tunnel0/0/0]nhrp entry 172.16.1.1 34.0.0.1 register 
[r6-Tunnel0/0/0]nhrp network-id 100

[r7]int t0/0/0
[r7-Tunnel0/0/0]ip a 172.16.1.4 29
[r7-Tunnel0/0/0]tunnel-protocol  gre p2mp 
[r7-Tunnel0/0/0]nhrp network-id 100
[r7-Tunnel0/0/0]nhrp entry 172.16.1.1 34.0.0.1 register
[r7-Tunnel0/0/0]source g0/0/0

display nhrp peer all

所有设备开启ospf并区域宣告

修改r 3 5 6 7 tunnel接口类型保证互通

router-id规则都为1.1.1.1~12.12.12.12


[r1]ospf 1 router-id 1.1.1.1
[r1-ospf-1]area 1
[r1-ospf-1-area-0.0.0.1]network 172.16.0.0 0.0.255.255

[r2]ospf 1 router-id 2.2.2.2
[r2-ospf-1]area 1
[r2-ospf-1-area-0.0.0.1]network 172.16.0.0 0.0.255.255

[r3]ospf 1 router-id 3.3.3.3
[r3-ospf-1]area 1
[r3-ospf-1-area-0.0.0.1]network 172.16.32.0 0.0.7.255
[r3-ospf-1-area-0.0.0.1]area 0
[r3-ospf-1-area-0.0.0.0]network 172.16.1.1 0.0.0.0
[r3]int t0/0/0
[r3-Tunnel0/0/0]ospf network-type p2mp

[r5]ospf 1 router-id 5.5.5.5
[r5-ospf-1]area 0  
[r5-ospf-1-area-0.0.0.0]network 172.16.0.0 0.0.255.255

[r5]int t0/0/0
[r5-Tunnel0/0/0]ospf  network-type p2mp

[r6]ospf 1 router-id 6.6.6.6
[r6-ospf-1]area 0
[r6-ospf-1-area-0.0.0.0]network 172.16.0.0 0.0.3.255
[r6-ospf-1-area-0.0.0.0]area 2
[r6-ospf-1-area-0.0.0.2]network 172.16.65.1 0.0.0.0

[r6]int t0/0/0
[r6-Tunnel0/0/0]
[r6-Tunnel0/0/0]ospf network-type p2mp

[r7]ospf 1 router-id 7.7.7.7
[r7-ospf-1]area 0   
[r7-ospf-1-area-0.0.0.0]network 172.16.0.0 0.0.7.255
[r7-ospf-1-area-0.0.0.0]area 3
[r7-ospf-1-area-0.0.0.3]network 172.16.97.1 0.0.0.0
[r7]int t0/0/0
[r7-Tunnel0/0/0]ospf network-type  p2mp
[r7-Tunnel0/0/0]q

[r8]ospf 1 router-id 8.8.8.8
[r8-ospf-1]area 3
[r8-ospf-1-area-0.0.0.3]network 172.16.0.0 0.0.255.255

[r9]ospf 1 router-id 9.9.9.9
[r9-ospf-1]area 3
[r9-ospf-1-area-0.0.0.3]network 172.16.97.10 0.0.0.0
[r9-ospf-1-area-0.0.0.3]area 4
[r9-ospf-1-area-0.0.0.4]network 172.16.128.0 0.0.3.255

r10

[r10]ospf 1 router-id 10.10.10.10
[r10-ospf-1]a 4 
[r10-ospf-1-area-0.0.0.4]network 172.16.0.0 0.0.255.255

r11

[r11]ospf 1 router-id 11.11.11.11
[r11-ospf-1]a 2
[r11-ospf-1-area-0.0.0.2]network 172.16.0.0 0.0.255.255

r12 ospf配置和rip协议运行并将rip重发布到ospf

[r12]ospf 1 router-id 12.12.12.12
[r12-ospf-1]a 2 
[r12-ospf-1-area-0.0.0.2]network 172.16.65.10 0.0.0.0
[r12]rip 1
[r12-rip-1]v 2
[r12-rip-1]network 172.16.0.0


[r12-ospf-1]import-route  rip  1   重发布

r11已经学习到rip路由信息

把area4做成域外路由以减少lsa的更新量需做重发布

此处做单向重发布，原因是保证lsa的更新量，只要在写一条缺省路由就可以保证连通

配置



[r9]undo ospf 1
Warning: The OSPF process will be deleted. Continue? [Y/N]:y
[r9]ospf 1 router-id  9.9.9.9
[r9-ospf-1]a 3
[r9-ospf-1-area-0.0.0.3]network 172.16.97.10 0.0.0.0


[r9-ospf-1-area-0.0.0.3]ospf 2
[r9-ospf-2]area 4
[r9-ospf-2-area-0.0.0.4]network 172.16.128.0 0.0.31.255


[r9-ospf-2-area-0.0.0.4]ospf 1
[r9-ospf-1]import-route  ospf 2  重发布
[r9-ospf-1]q
[r9]ospf 2
[r9-ospf-2]default-route-advertise  来将缺省路由通告到普通OSPF区域。

abr设备做路由汇总注意写一条静态null 0 防环

并做特殊区域 area1 末梢区域 area2 nssa area3 nssa

a1和a2同样

[r1-ospf-1]a 1
[r1-ospf-1-area-0.0.0.1]stub

[r3-ospf-1]a 1
[r3-ospf-1-area-0.0.0.1]abr-summary  172.16.32.0 255.255.224.0 路由汇总
[r3-ospf-1-area-0.0.0.1]stub no-summary  abr设备配置stub区域
[r3]IP route-static 172.16.32.0 19 nuLL 0   防环


[r6-ospf-1]a 2
[r6-ospf-1-area-0.0.0.2]abr-summary 172.16.64.0 255.255.224.0
[r6-ospf-1-area-0.0.0.2]nssa  no-summary  abr设备nssa配置
[r6]IP route-static 172.16.64.0 19 nuLL 0

R11 R12

[r11-ospf-1-area-0.0.0.2]nssa




[r12-ospf-1]asbr-summary  172.16.160.0 255.255.224.0
            
[r12-ospf-1-area-0.0.0.2] nssa
[r12]IP route-static 172.16.160.0 19 nuLL 0  防环

[r7-ospf-1]a 3
[r7-ospf-1-area-0.0.0.3]abr-summary  172.16.96.0 255.255.224.0
[r7-ospf-1-area-0.0.0.3]nssa no-summary
[r7]IP route-static 172.16.96.0 19 nuLL 0  防环

R8 &r9



[r8-ospf-1-area-0.0.0.3]nssa


[r9]ospf 1
[r9-ospf-1]asbr-summary 172.16.128.0 255.255.224.0
[r9-ospf-1-area-0.0.0.3]nssa
[r9]IP route-static 172.16.128.0 19 nuLL 0  防环

加快收敛

[r3-Tunnel0/0/0]ospf timer hello 10
[r5-Tunnel0/0/0]ospf timer hello 10
[r6-Tunnel0/0/0]ospf timer hello 10
[r7-Tunnel0/0/0]ospf timer hello 10

访问公网配置

[r3]acl 2000
[r3-acl-basic-2000]rule permit source 172.16.0.0 0.0.255.255
[r3-acl-basic-2000]int s 4/0/0
[r3-Serial4/0/0]nat outbound 2000

[r5]acl 2000
[r5-acl-basic-2000]rule permit  source 172.16.0.0 0.0.255.255
[r5-acl-basic-2000]int s 4/0/0
[r5-Serial4/0/0]nat outbound 2000

r6 r7同上注意接口即可

[r6]acl 2000
[r6-acl-basic-2000]rule  permit  source  172.16.0.0 0.0.255.255
[r6-acl-basic-2000]int s4/0/0
[r6-Serial4/0/0]nat  outbound 2000

[r7]acl  2000
[r7-acl-basic-2000]rule permit source 172.16.0.0 0.0.255.255
[r7-acl-basic-2000]int g0/0/0
[r7-GigabitEthernet0/0/0]nat outbound 2000

为保证安全所以做区域认证、
以area1 为例

[r1-ospf-1-area-0.0.0.1] authentication-mode md5 1 cipher nishishei

[r2-ospf-1-area-0.0.0.1] authentication-mode md5 1 cipher nishishei

[r3-ospf-1-area-0.0.0.1] authentication-mode md5 1 cipher nishishei

其余区域相同

结果验证

显示OSPF的链路状态数据库（LSDB）信息