旁挂负载分担组网场景 作业

拓扑图

实验需求分析

实现负载分担双机热备组网

1、SW3的流量

正常情况下：SW1_VRF-->FW1--->SW1_Public--->R5

故障情况下：SW2_VRF-->FW2--->SW2_Public--->R6

2、SW4的流量

正常情况下：SW2_VRF-->FW2--->SW2_Public--->R6

故障情况下：SW1_VRF-->FW1--->SW1_Public--->R5

3、交换网络负载均衡

实验步骤

SW3配置

生成树

ip地址配置

抢占时延

监控

SW4

sw5

汇总路由

sw4

sw1

vpn-target 100:1 both

router-distinguisher 100:1

ip vpn-instance VRF

vlan batch 102 103 104
int g 0/0/5
port link-type access
port default vlan 103
undo stp enable
int g 0/0/4
port link-type trunk
undo port trunk allow-pass vlan 1
port trunk allow-pass vlan 102
undo stp enable
int g 0/0/6
port link-type access
port default vlan 104
undo stp enable

interface vlanif 102

ip banding vpn-instance vrf

ip add 10.10.2.1 24
interface vlanif 103
ip banding vpn-instance vrf
ip add 10.10.3.1 24
int v 104
ip banding vpn-instance vrf
ip add10.10.4.1 24

ospf 1 router-id 1.1.1.1 vpn-instance vrf

area 0

network 10.10.2.1 0.0.0.0

network 10.10.3.1 0.0.0.0

network 10.10.4.1 0.0.0.0

sw2

vpn-target 100:1 both

router-distinguisher 100:1

ip vpn-instance VRF

vlan batch 102 203 204

int g 0/0/4
port link-type trunk
undo port trunk allow-pass vlan 1
port trunk allow-pass vlan 102
undo stp enable
int g 0/0/5
port link-type access
port default vlan 204
undo stp enable
port link-type access
undo stp enable

interface vlanif 102

ip banding vpn-instance vrf

ip ad 10.10.2.2 24
interface vlanif 203
ip banding vpn-instance vrf
ip add 10.20.3.2 24
int v 204
ip banding vpn-instance vrf
ip add 10.20.4.2 24

ospf 1 router-id 2.2.2.2 vpn-instance vrf
area 0 
network 10.10.2.2 0.0.0.0
network  10.20.3.2 0.0.0.0
network 10.20.4.2 0.0.0.0
dis ospf peer brief

路由策略

sw3

interface vlanif 203

ospf cost 5

ospf 1

area 0

undo network 192.168.2.1 0.0.0.0

undo network 192.168.3.1 0.0.0.0

ip ip-prefix aa permit 192.168.3.0 24

ip ip-prefix bb permit 192.168.2.0 24

router-policy aa permit node 10

if-match ip-prefix aa

apply cost 5

router-policy aa permit node 20

if-match ip-prefx bb

ospf 1

import-route direct route-policy aa

sw4

interface vlanif 104

ospf cost 5

ospf 1

area 0

undo network 192.168.2.2 0.0.0.0

undo network 192.168.3.2 0.0.0.0

ip ip-prefix aa permit 192.168.2.0 24

ip ip-prefix bb permit 192.168.3.0 24

router-policy aa permit node 10

if-match ip-prefix aa

apply cost 5

router-policy aa permit node 20

if-match ip-prefx bb

ospf 1

import-route direct route-policy aa

VRF交换机与防火墙的路由交互

sw1

vlan batch 401 402
int g 0/0/3
port link-type trunk
port t all vlan 401 402
int g 0/0/4
port t all vlan 401 402
int v 401
ip banding vpn-instance vrf
ip add 10.40.1.1 24
vrrp vrid 1 virtual-ip 10.40.1.100
vrrp vrid 1 priority 120
vrrp vrid 1 preempt-mode timer delay 60
vrrp vrid 1 track int g 0/0/3 reduced 30
int v 402
ip banding vpn-instance vrf
ip add 10.40.2 .1 24
vrrp vrid 2 virtual-ip 10.40.2.100

vlan  batch 403 404
int g 0/0/1
 port link-type trunk
port t all vlan 403 404
 int g 0/0/2
port link-type trunk
po t all vlan 403 404
int v 403
ip ad 10.40.3.1 24
vrrp vrid 3 virtual-ip 10.40.3.100
vrrp vrid 3 priority  120
vrrp vrid 3 preempt-mode timer delay 60
int v 404
ip add 10.40.4.1 24
vrrp vrid 4 virtual-ip 10.40.4.100

ip route-static vpn-instance vrf  0.0.0.0 0 10.40.1.200
ip route-static vpn-instance vrf  0.0.0.0 0 10.40.2.200 preference 70
ip route-static 192.168.0.0  16 10.40.3.200
ip route-static 192.168.0.0 16 10.40.4.200 preference 70

sw2

vlan  batch 403 404
int g 0/0/1
po li t
po t all vlan 403 404
int g 0/0/2
po li t
po t all vlan 403 404
int v 403
ip ad 10.40.3.2 24
vrrp vrid 3 virtual-ip 10.40.3.100
int v 404
ip ad 10.40.4.2 24
vrrp vrid 4 virtual-ip 10.40.4.100
vrrp vrid 4 priority 120
vrrp vrid 4 preempt-mode timer delay 60
vrrp vrid 4 track interface g 0/0/1 reduced 30

vlan batch 401 402
int g 0/0/3
po li t 
po t all vlan 401 402
int g 0/0/4
po lin t
po t all vlan 401 402
int v 401
ip banding vpn-instance vrf
ip ad 10.40.1.2 24
vrrp vrid 1 virtual-ip 10.40.1.100
int v 402
ip banding vpn-instance vrf
ip ad 10.40.2 .2 24
vrrp vrid 2 virtual-ip 10.40.2.100
vrrp vrid 2 priority 120
vrrp vrid  2 preempt-mode timer delay 60
vrrp vrid 2 track interace g 0/0/3 reduced 30

ip route-static vpn-instance vrf  0.0.0.0 0 10.40.2.200
ip route-static vpn-instance vrf  0.0.0.0 0 10.40.1.200 preference 70
ip route-static 192.168.0.0  16 10.40.4.200
ip route-static 192.168.0.0 16 10.40.3.200 preference 70

fw1

vlan batch 401 402 403 404
    interface virtual-template
    int g 1/0/0
    ip ad 10.10.10.1 30
    interface g 1/0/2.401
    ip ad 10.40.1.10 24
    vlan-type dotlq 401
    int g 1/0/2 .402
    ip ad 10.40.2.10 24
    vlan-type dotlq 402
    int g 1/0/3.403
    ip ad 10.40.3.10 24
    vlan-type dotlq 403
    int g 1/0/3.404
    ip ad  10.40.4.10 24
    vlan-type dotlq 404
    firewall zone trust
    add int g 1/0/2.401
    add int g 1/0/2.402
    firewall zone untrust
    add int g 1/0/3.403
    add int g 1/0/3.404
    firewall zone dmz
    add int g 1/0/0
    双机热备
        int g 1/0/2.401
        vrrp vrid 5 virtual-ip 10.40.1.200 active
        int g 1/0/2.402
        vrrp vrid 6 virtual-ip 10.40.2.200 standby
        int g 1/0/3.403
        vrrp vrid 7 virtual-ip 10.40.3.200 active
        int g 1/0/3.404
        vrrrp vrid 8 virtual-ip 10.40.4.200 standby
        hrp mrror session enable
            快速备份
        hrp interface g 1/0/0 remote 10.10.10.2
            定义心跳线与对端IP
        hrp enable
    路由配置
        IP route-static 0.0.0.0  0 10.40.3.100
        IP route-static 0.0.0.0  0 10.40.4.100 preference 70
        ip route-static 192.168.0.0  16  10.40.1.100
        ip route-static 192.168.0.0  16  10.40.2.100 preference  70
    安全策略
        security-policy
        rule name t_to_u
        souce-zone trust
        destination-zone untrust
        souce-addess 192.168.0.0 16
        action permit
        dis security -policy rule all
            显示所有策略
    激活接口
        int g 1/0/2
        ip ad 1.1.1.1 24
        undo ip ad
        int g 1/0/3
        ip ad 1.1.1.1 24
        undo ip ad 

fw2

   vlan batch 401 402 403 404
    interface virtual-template

    int g 1/0/0
    ip ad 10.10.10.2 30
    interface g 1/0/2.401
    ip ad 10.40.1.20 24
    vlan-type dotlq 401
    int g 1/0/2 .402
    ip ad 10.40.2.20 24
    vlan-type dotlq 402
    int g 1/0/3.403
    ip ad 10.40.3.20 24
    vlan-type dotlq 403
    int g 1/0/3.404
    ip ad  10.40.4.20 24
    vlan-type dotlq 404
    firewall zone trust
    add int g 1/0/2.401
    add int g 1/0/2.402
    firewall zone untrust
    add int g 1/0/3.403
    add int g 1/0/3.404
    firewall zone dmz
    add int g 1/0/0
    双机热备
        int g 1/0/2.401
        vrrp vrid 5 virtual-ip 10.40.1.200  standby
        int g 1/0/2.402
        vrrp vrid 6 virtual-ip 10.40.2.200 avtive
        int g 1/0/3.403
        vrrp vrid 7 virtual-ip 10.40.3.200 standby
        int g 1/0/3.404
        vrrrp vrid 8 virtual-ip 10.40.4.200 active
        hrp mrror session enable

        hrp interface g 1/0/0 remote 10.10.10.1

        hrp enable
    路由配置
        IP route-static 0.0.0.0  0 10.40.4.100
        IP route-static 0.0.0.0  0 10.40.3.100 preference 70
        ip route-static 192.168.0.0  16  10.40.2.100
        ip route-static 192.168.0.0  16  10.40.1.100 preference  70
    激活接口
        int g 1/0/2
        ip ad 1.1.1.1 24
        undo ip ad
        int g 1/0/3
        ip ad 1.1.1.1 24
        undo ip ad 

核心到边界

sw1

vlan batch 201 105
    int g 0/0/7
    po lin acc
    po default vlan 105
    undo stp enable
    int g 0/0/2
    po t all vlan 201
    undo stp enable
    int  v  105
    ip ad 10.10.5.1 24
    int v 201 
    ip ad 10.20.1.1 24
    ospf 2 route-id 1.1.1.1
    area 0
    network 10.20.1.1 0.0.0.0
    network 10.10.5.1 0.0.0.0
    ospf 2
    import-route static

sw2

vlan batch 201 206
    int g 0/0/7
    po lin acc
    po default vlan 206
    undo stp enable
    int g 0/0/2
    po t all vlan 201
    undo stp enable
    int  v  206
    ip ad 10.20.6.2 24
    int v 201 
    ip ad 10.20.1.2 24
    ospf 2 route-id 2.2.2.2
    area 0
    network 10.20.1.2 0.0.0.0
    network 10.20.6.2 0.0.0.0
    ospf 1
    default-route-advertise
    ospf 2
    import-route static

r5

int g 0/0/0
    ip  ad  10.10.5.5 24
    int g 0/0/1
    ip ad 10.56.0.5 24
    ospf 1 route-id  5.5.5.5
    area 0
    network 10.56.0.5 0.0.0.0
    network 10.10.5.5 0.0.0.0
    int g 0/0/2
    ip ad 12.0.0.5 24
    ip route-static 0.0.0.0 0 12.0.0.100
    ospf 1
    default-route-advertise
    acl 2000
    rule permit souce 192.168.0.0 0.0.255.255
    int g 0/0/2
    nat outbound 2000

r6

int g  0/0/0
    ip ad 10.20.6.6 24
    int g 0/0/1
    ip ad 10.56.0.6 24
    ospf 1 route-id 6.6.6.6
    aera 0 
    nerwork 10.56.0.6 0.0.0.0
    network 10.20.6.6  0.0.0.0
    int g 0/0/2
    ip ad 13.0.0.6 24
    ip route-static 0.0.0.0 0 13.0.0.100
    ospf 1
    default-route-advertise
    acl 2000
    rule permit souce 192.168.0.0 0.0.255.255
    int g 0/0/2
    nat outbound 2000

isp

int g 0/0/0

ip ad 12.0.0.100 24

int g 0/0/1

ip ad 13.0.0.100 24

interface loopback 0

ip ad 100.1.1 24