基于策略的双出口NAT负载均衡和备份_第1张图片

实验环境:

 

  • GNS3 1.0 + i86bi-linux-l3-adventerprisek9-15.4.1T拓扑中

  • R4、R5分别模拟不同运营商(ISP_A和ISP_B)的两台路由,经过运营商的链路到达因特网中的R2,R2的lo0端口模拟网站服务器

  • R3模拟本地PC,其中e0/0口和lo0口分别模拟两台不同网段的pc

  • R1为本地边界路由,需要在此路由上做双出口的策略及NAT,默认adventerprisek9-15.4.1T 设备的内存较小,实验中会报错,所以请先更改R1的内存

基于策略的双出口NAT负载均衡和备份_第2张图片

实验目的:

 

通过策略路由后对不同原地址数据流量进行分流,使得不同原地址主机通过不同ISP接口访问Internet,并为不同原地址主机同不同NAT地址进行转换。

当网络链接正常时,网段1(172.16.1.0/24)通过ISP_A到达2.2.2.2,,网段2(172.16.2.0/24)通过 ISP_B到达2.2.2.2 ,达到负载均衡的目的。当ISP_A或ISP_B其中一条链路出现故障时,能实现自动切换达到备份目的。

 

知识点:
思科路由器一般不用作nat,因为CPU利用率太高。但如果小型企业在内网用户数不多的情况下,防火墙成本较高,如果以现有路由器作上网设备,也是一个经济的选择。在适当的配置下,还能实现灵活的路由策略及nat策略。以下介绍相关的配置命令及实现方法。
NAT相关的配置命令工具介绍。
1、ACL
ACL是用来定义内网上网用户的工具,可以是标准ACL,也可以是扩展ACL;当需要使用到route-map时,它是定义地位范围的工具。
2、route-map
route-map是灵活控制路由策略及NAT策略的有力工具。
3、NAT配置策略
接口命令:ip nat inside、ip nat outside
全局命令:ip nat inside source route-map interface int_name overlaod
4、路由配置策略
接口命令:ip policy route-map name

 

实验步骤:

 

一  、按照拓扑配置各路由接口IP和路由协议,其中R4、R5、R2运行OSPF area0 ,R2的回环地址2.2.2.2作为internet的服务器做测试使用。

 

配置R3:

 

R3(config)#interface e0/0

R3(config-if)#ip address 172.16.1.3 255.255.255.0

R3(config-if)#no sh

R3(config-if)#interface lo0

R3(config-if)#ip address 172.16.2.3 255.255.255.0

R3(config-if)#

R3(config)#ip route 0.0.0.0 0.0.0.0 172.16.1.1

 

配置R1:

 

R1(config)#interface e0/0

R1(config-if)#description to LAN

R1(config-if)#ip address 172.16.1.1 255.255.255.0

R1(config-if)#no sh

R1(config-if)#interface s1/0

R1(config-if)#description to ISP_B

R1(config-if)#ip address 15.1.1.1 255.255.255.0

R1(config-if)#no sh

R1(config-if)#interface s1/1

R1(config-if)#description to ISP_A

R1(config-if)#ip address 14.1.1.1 255.255.255.0

R1(config-if)#no sh

R1(config-if)#exit

R1(config)#ip route 0.0.0.0 0.0.0.0 14.1.1.4

R1(config)#ip route 0.0.0.0 0.0.0.0 15.1.1.5

R1(config)#ip route 172.16.2.0 255.255.255.0 172.16.1.3   ###到达LAN 172.16.2.0的回程路由

R1(config)#

 

配置R4:

 

R4(config)#interface s1/1

R4(config-if)#ip address 24.1.1.4 255.255.255.0

R4(config-if)#no sh

R4(config-if)#interface s1/0

R4(config-if)#ip address 14.1.1.4 255.255.255.0

R4(config-if)#no sh

R4(config-if)#exit

R4(configf)#router ospf 4

R4(config-router)#network 0.0.0.0 255.255.255.255 area 0

 

配置R5:

 

R5(config)#interface s1/0

R5(config-if)#ip address 25.1.1.5 255.255.255.0

R5(config-if)#no sh

R5(config-if)#interface s1/1

R5(config-if)#ip address 15.1.1.5 255.255.255.0

R5(config-if)#no sh

R5(config-if)#exit

R5(config)#router ospf 5

R5(config-router)#network 0.0.0.0 255.255.255.255 area 0

 

配置R2:

 

R2(config)#interface lo0

R2(config-if)#ip address 2.2.2.2 255.255.255.255

R2(config-if)#interface s1/0

R2(config-if)#ip address 24.1.1.2 255.255.255.0

R2(config-if)#no sh

R2(config-if)#interface s1/1

R2(config-if)#ip address 25.1.1.2 255.255.255.0

R2(config-if)#no sh

R2(config-if)#exit

R2(config)#router ospf 2

R2(config-router)#network 0.0.0.0 255.255.255.255 area 0

R2(config-router)#

*Aug 13 10:58:47.840: %OSPF-5-ADJCHG: Process 2, Nbr 25.1.1.5 on Serial1/1 from LOADING to FULL, Loading Done

*Aug 13 10:58:47.841: %OSPF-5-ADJCHG: Process 2, Nbr 24.1.1.4 on Serial1/0 from LOADING to FULL, Loading Done

 

二  、验证基本配置

 

R3:

 

R3#show ip interface br

R3#show ip interface brief

Interface                  IP-Address      OK? Method Status                Protocol

Ethernet0/0                172.16.1.3      YES manual up                    up

Ethernet0/1                unassigned      YES unset  administratively down down

Ethernet0/2                unassigned      YES unset  administratively down down

Ethernet0/3                unassigned      YES unset  administratively down down

Loopback0                  172.16.2.3      YES manual up                    up

 

R3#show ip route

Gateway of last resort is 172.16.1.1 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 172.16.1.1

172.16.0.0/16 is variably subnetted, 4 subnets, 2 masks

C        172.16.1.0/24 is directly connected, Ethernet0/0

L        172.16.1.3/32 is directly connected, Ethernet0/0

C        172.16.2.0/24 is directly connected, Loopback0

L        172.16.2.3/32 is directly connected, Loopback0

R3#

 

 

R1:

 

R1#show ip interface brief

Interface                  IP-Address      OK? Method Status                Protocol

Ethernet0/0                172.16.1.1      YES manual up                    up

Ethernet0/1                unassigned      YES unset  administratively down down

Ethernet0/2                unassigned      YES unset  administratively down down

Ethernet0/3                unassigned      YES unset  administratively down down

Serial1/0                  15.1.1.1        YES manual up                    up

Serial1/1                  14.1.1.1        YES manual up                    up

Serial1/2                  unassigned      YES unset  administratively down down

Serial1/3                  unassigned      YES unset  administratively down down

 

R1#show ip route

Gateway of last resort is 15.1.1.5 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 15.1.1.5

[1/0] via 14.1.1.4

14.0.0.0/8 is variably subnetted, 2 subnets, 2 masks

C        14.1.1.0/24 is directly connected, Serial1/1

L        14.1.1.1/32 is directly connected, Serial1/1

15.0.0.0/8 is variably subnetted, 2 subnets, 2 masks

C        15.1.1.0/24 is directly connected, Serial1/0

L        15.1.1.1/32 is directly connected, Serial1/0

172.16.0.0/16 is variably subnetted, 3 subnets, 2 masks

C        172.16.1.0/24 is directly connected, Ethernet0/0

L        172.16.1.1/32 is directly connected, Ethernet0/0

S        172.16.2.0/24 [1/0] via 172.16.1.3

R1#

 

R4:

 

R4#show ip ospf neighbor

 

Neighbor ID     Pri   State           Dead Time   Address         Interface

2.2.2.2           0   FULL/  -        00:00:38    24.1.1.2        Serial1/1

 

R4#show ip route

Gateway of last resort is not set

2.0.0.0/32 is subnetted, 1 subnets

O        2.2.2.2 [110/65] via 24.1.1.2, 00:09:27, Serial1/1

14.0.0.0/8 is variably subnetted, 2 subnets, 2 masks

C        14.1.1.0/24 is directly connected, Serial1/0

L        14.1.1.4/32 is directly connected, Serial1/0

15.0.0.0/24 is subnetted, 1 subnets

O        15.1.1.0 [110/192] via 24.1.1.2, 00:09:17, Serial1/1

24.0.0.0/8 is variably subnetted, 2 subnets, 2 masks

C        24.1.1.0/24 is directly connected, Serial1/1

L        24.1.1.4/32 is directly connected, Serial1/1

25.0.0.0/24 is subnetted, 1 subnets

O        25.1.1.0 [110/128] via 24.1.1.2, 00:09:27, Serial1/1

 

R5:

 

R5#show ip ospf neighbor

 

Neighbor ID     Pri   State           Dead Time   Address         Interface

2.2.2.2           0   FULL/  -        00:00:39    25.1.1.2        Serial1/0

 

R5#show ip route

Gateway of last resort is not set

2.0.0.0/32 is subnetted, 1 subnets

O        2.2.2.2 [110/65] via 25.1.1.2, 00:12:50, Serial1/0

14.0.0.0/24 is subnetted, 1 subnets

O        14.1.1.0 [110/192] via 25.1.1.2, 00:12:40, Serial1/0

15.0.0.0/8 is variably subnetted, 2 subnets, 2 masks

C        15.1.1.0/24 is directly connected, Serial1/1

L        15.1.1.5/32 is directly connected, Serial1/1

24.0.0.0/24 is subnetted, 1 subnets

O        24.1.1.0 [110/128] via 25.1.1.2, 00:12:50, Serial1/0

25.0.0.0/8 is variably subnetted, 2 subnets, 2 masks

C        25.1.1.0/24 is directly connected, Serial1/0

L        25.1.1.5/32 is directly connected, Serial1/0

 

R2:

 

R2#show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface

25.1.1.5          0   FULL/  -        00:00:38    25.1.1.5        Serial1/1

24.1.1.4          0   FULL/  -        00:00:32    24.1.1.4        Serial1/0

 

R2#show ip interface brief

Interface                  IP-Address      OK? Method Status                Protocol

Serial0/0                  unassigned      YES unset  administratively down down

Serial0/1                  unassigned      YES unset  administratively down down

Serial0/2                  unassigned      YES unset  administratively down down

Serial0/3                  unassigned      YES unset  administratively down down

Serial1/0                  24.1.1.2        YES manual up                    up

Serial1/1                  25.1.1.2        YES manual up                    up

Serial1/2                  unassigned      YES unset  administratively down down

Serial1/3                  unassigned      YES unset  administratively down down

Loopback0                  2.2.2.2         YES manual up                    up

R2#

 

连通性测试:

 

R1#ping 2.2.2.2

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 59/61/63 ms

 

三  、在R1上配置NAT协议

 

1、配置ACL,定义允许NAT转换的流量:

 

R1(config)#access-list 1 permit 172.16.1.0 0.0.0.255

R1(config)#access-list 2 permit 172.16.2.0 0.0.0.255

R1(config)#

 

2、指定内部、外部接口:

 

R1(config)#interface e0/0

R1(config-if)#ip nat inside

R1(config-if)#interface s1/1

R1(config-if)#ip nat outside

R1(config-if)#interface s1/0

R1(config-if)#ip nat outside

 

使用IOU设备配置nat时,此时如果报错如下错误,是因为默认存储空间不足,WR保存当前配置后,停止R1,增加设备内存即可:

Regex parse error, please reconfigure!

% NBAR Error: Activation failed due to insufficient Dynamic Memory

% NBAR Error: Stile could not add protocol node

%NAT: Error activating CNBAR on the interface Ethernet0/0

 

3、配置route-map:

 

R1(config)#route-map bearmr1 permit 10

R1(config-route-map)#match ip address 1

R1(config-route-map)#match interface s1/1

R1(config-route-map)#exit

####定义route-map bearmr1的两个匹配条件,其中match interface s1/1意思为接口s1/1 up或down的情况,up为匹配,当两个条件都匹配时执行下列转换:ip nat insde source route-map bearmr1 interface  s1/1 overload

 

R1(config)#route-map bearmr2 permit 10

R1(config-route-map)#match ip address 1

R1(config-route-map)#exit

####定义route-map bearmr2的匹配条件,匹配时执行下列转换:ip nat insde source route-map bearmr2 interface  s1/1 overload

 

R1(config)#route-map bearmr3 permit 10

R1(config-route-map)#match ip address 2

R1(config-route-map)#match interface s1/0

R1(config-route-map)#exit

####定义route-map bearmr3的两个匹配条件,其中match interface s1/0意思为接口s1/0 up或down的情况,up为匹配,当两个条件都匹配时执行下列转换:ip nat insde source route-map bearmr3 interface  s1/0 overload

 

 

R1(config)#route-map bearmr4 permit 10

R1(config-route-map)#match ip address 2

R1(config-route-map)#exit

####定义route-map bearmr4的匹配条件,匹配时执行下列转换:ip nat insde source route-map bearmr4 interface  s1/1 overload

 

4、配置NAT关联,调用以上配置的router-map

 

R1(config)#ip nat inside source route-map bearmr1 interface s1/1 overload

### route-map bearmr1应用到NAT里,如果匹配条件,流量(172.16.1.0/24)从s1/1接口出去,通过ISP_A到达internet,如果s1/1接口down,则流量从s1/0接口出去,通过ISP_B到达internet

R1(config)#ip nat inside source route-map bearmr2 interface s1/0 overload

###如果s1/1接口down,流量(172.16.1.0/24)从s1/0出去,通过ISP_B到达internet

R1(config)#ip nat inside source route-map bearmr3 interface s1/0 overload

### route-map bearmr3应用到NAT里,如果匹配条件,流量(172.16.2.0/24)从s1/0接口出去,通过ISP_B到达internet,如果s1/0接口down,则流量从s1/1接口出去,通过ISP_A到达internet

R1(config)#ip nat inside source route-map bearmr4 interface s1/1 overload

###如果s1/0接口down,流量(172.16.2.0/24)从s1/1出去,通过ISP_A到达internet

 

5、配置PBR(基于策略的路由)

 

R1(config)#route-map bearmr permit 10

R1(config-route-map)#match ip address 1

R1(config-route-map)#matnterface s1/1

R1(config-route-map)#match interface s1/1

R1(config-route-map)#set interface s1/1

R1(config-route-map)#exit

###定义route-map bearmr,当两个match的条件成立时执行set的动作

 

R1(config)#route-map bearmr permit 20

R1(config-route-map)#match ip address 2

R1(config-route-map)#match interface s1/0

R1(config-route-map)#set interface s1/0

R1(config-route-map)#exit

###定义route-map bearmr,当两个match的条件成立时执行set的动作

 

6、在R1的s0/0入方向应用PBR

 

R1(config)#interface e0/0

R1(config-if)#ip policy route-map bearmr

R1(config-if)#end

R1#

 

再来查看一些基本信息:

R1#show ip nat statistics

Total active translations: 0 (0 static, 0 dynamic; 0 extended)

Peak translations: 18, occurred 00:23:35 ago

Outside interfaces:

Serial1/0, Serial1/1

Inside interfaces:

Ethernet0/0

Hits: 146  Misses: 0

CEF Translated packets: 116, CEF Punted packets: 30

Expired translations: 44

Dynamic mappings:

– Inside Source

[Id: 1] route-map bearmr1 interface Serial1/1 refcount 0

[Id: 2] route-map bearmr2 interface Serial1/0 refcount 0

[Id: 5] route-map bearmr3 interface Serial1/0 refcount 0

[Id: 4] route-map bearmr4 interface Serial1/1 refcount 0

 

Total doors: 0

Appl doors: 0

Normal doors: 0

Queued Packets: 0

 

四、测试

 

1、在R1上打开debug

 

R1#debug ip nat

IP NAT debugging is on

 

2、在R3上ping  internet,源地址为172.16.2.3

 

R3#ping 2.2.2.2  source 172.16.1.3

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 16/18/20 ms

 

在R1上查看NAT转换信息:

 

R1#

*Aug 13 14:54:16.887: NAT*: s=172.16.1.3->15.1.1.1, d=2.2.2.2 [0]  ###源地址被转换成S1/1的接口地址

*Aug 13 14:54:16.908: NAT*: s=2.2.2.2, d=15.1.1.1->172.16.1.3 [0]

*Aug 13 14:54:16.909: NAT*: s=172.16.1.3->15.1.1.1, d=2.2.2.2 [1]

*Aug 13 14:54:16.928: NAT*: s=2.2.2.2, d=15.1.1.1->172.16.1.3 [1]

*Aug 13 14:54:16.928: NAT*: s=172.16.1.3->15.1.1.1, d=2.2.2.2 [2]

*Aug 13 14:54:16.947: NAT*: s=2.2.2.2, d=15.1.1.1->172.16.1.3 [2]

*Aug 13 14:54:16.948: NAT*: s=172.16.1.3->15.1.1.1, d=2.2.2.2 [3]

*Aug 13 14:54:16.967: NAT*: s=2.2.2.2, d=15.1.1.1->172.16.1.3 [3]

*Aug 13 14:54:16.967: NAT*: s=172.16.1.3->15.1.1.1, d=2.2.2.2 [4]

*Aug 13 14:54:16.987: NAT*: s=2.2.2.2, d=15.1.1.1->172.16.1.3 [4]

 

3、在R3上ping  internet,源地址为172.16.2.3

 

R3#ping 2.2.2.2 source 172.16.2.3

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:

Packet sent with a source address of 172.16.2.3

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 19/25/48 ms

 

在R1上查看NAT转换信息:

 

R1#

*Aug 13 15:30:54.631: NAT*: s=172.16.2.3->14.1.1.1, d=2.2.2.2 [20]  ###源地址被转换成S1/1的接口地址

*Aug 13 15:30:54.652: NAT*: s=2.2.2.2, d=14.1.1.1->172.16.2.3 [20]

*Aug 13 15:30:54.653: NAT*: s=172.16.2.3->14.1.1.1, d=2.2.2.2 [21]

*Aug 13 15:30:54.673: NAT*: s=2.2.2.2, d=14.1.1.1->172.16.2.3 [21]

*Aug 13 15:30:54.674: NAT*: s=172.16.2.3->14.1.1.1, d=2.2.2.2 [22]

*Aug 13 15:30:54.693: NAT*: s=2.2.2.2, d=14.1.1.1->172.16.2.3 [22]

*Aug 13 15:30:54.694: NAT*: s=172.16.2.3->14.1.1.1, d=2.2.2.2 [23]

*Aug 13 15:30:54.714: NAT*: s=2.2.2.2, d=14.1.1.1->172.16.2.3 [23]

*Aug 13 15:30:54.714: NAT*: s=172.16.2.3->14.1.1.1, d=2.2.2.2 [24]

*Aug 13 15:30:54.733: NAT*: s=2.2.2.2, d=14.1.1.1->172.16.2.3 [24]

 

4、通过traceroute命令跟踪到达2.2.2.2所经过的路径信息

 

R R3#traceroute 2.2.2.2 source 172.16.1.3  ###源地址172.16.1.3

Type escape sequence to abort.

Tracing the route to 2.2.2.2

VRF info: (vrf in name/id, vrf out name/id)

1 172.16.1.1 7 msec 1 msec 1 msec

2 15.1.1.5 11 msec 11 msec 11 msec   ####通过ISP_B到达

3 25.1.1.2 21 msec 17 msec *

 

R3#traceroute 2.2.2.2 source 172.16.2.3  ###源地址172.16.2.3

Type escape sequence to abort.

Tracing the route to 2.2.2.2

VRF info: (vrf in name/id, vrf out name/id)

1 172.16.1.1 1 msec 2 msec 6 msec

2 14.1.1.4 10 msec 6 msec 11 msec    ####通过ISP_A到达

3 24.1.1.2 18 msec 20 msec *

 

通过以上测试可以得到结果:网段172.16.2.0/24通过ISP_A到达2.2.2.2

网段172.16.1.0/24通过ISP_B到达2.2.2.2

不指定源地址在测试一次:

 

R3#traceroute 2.2.2.2

Type escape sequence to abort.

Tracing the route to 2.2.2.2

VRF info: (vrf in name/id, vrf out name/id)

1 172.16.1.1 2 msec 1 msec 6 msec

2 15.1.1.5 11 msec 11 msec 11 msec  ###默认情况下通过ISP_B

3 25.1.1.2 20 msec 22 msec *

 

五  、手工关闭R1的s1/1接口,模拟链路故障

 

R1(config)#interface s1/1

R1(config-if)#shutdown

 

1、在R3上ping 2.2.2.2,使用源地址172.16.1.2

 

R3#ping 2.2.2.2 source 172.16.1.3

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:

Packet sent with a source address of 172.16.1.3

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 20/21/27 ms

 

在R1上查看NAT转换信息:

 

R1#

*Aug 13 15:46:26.979: %SYS-5-CONFIG_I: Configured from console by console

R1#

*Aug 13 15:47:50.944: NAT*: s=172.16.1.3->15.1.1.1, d=2.2.2.2 [30]  ###源地址被转换成S1/0的接口地址

*Aug 13 15:47:50.965: NAT*: s=2.2.2.2, d=15.1.1.1->172.16.1.3 [30]

*Aug 13 15:47:50.965: NAT*: s=172.16.1.3->15.1.1.1, d=2.2.2.2 [31]

*Aug 13 15:47:50.985: NAT*: s=2.2.2.2, d=15.1.1.1->172.16.1.3 [31]

*Aug 13 15:47:50.985: NAT*: s=172.16.1.3->15.1.1.1, d=2.2.2.2 [32]

*Aug 13 15:47:51.006: NAT*: s=2.2.2.2, d=15.1.1.1->172.16.1.3 [32]

*Aug 13 15:47:51.006: NAT*: s=172.16.1.3->15.1.1.1, d=2.2.2.2 [33]

*Aug 13 15:47:51.026: NAT*: s=2.2.2.2, d=15.1.1.1->172.16.1.3 [33]

*Aug 13 15:47:51.026: NAT*: s=172.16.1.3->15.1.1.1, d=2.2.2.2 [34]

*Aug 13 15:47:51.047: NAT*: s=2.2.2.2, d=15.1.1.1->172.16.1.3 [34]

*Aug 13 15:48:51.978: NAT: expiring 15.1.1.1 (172.16.1.3) icmp 6 (6)

 

2、在R3上ping 2.2.2.2,使用源地址172.16.2.2

 

R3#ping 2.2.2.2 source 172.16.2.3

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:

Packet sent with a source address of 172.16.2.3

!!!!!

 

在R1上查看NAT转换信息:

 

R1#

*Aug 13 15:50:14.814: NAT*: s=172.16.2.3->15.1.1.1, d=2.2.2.2 [35]  ###源地址被转换成S1/0的接口地址

*Aug 13 15:50:14.834: NAT*: s=2.2.2.2, d=15.1.1.1->172.16.2.3 [35]

*Aug 13 15:50:14.834: NAT*: s=172.16.2.3->15.1.1.1, d=2.2.2.2 [36]

*Aug 13 15:50:14.854: NAT*: s=2.2.2.2, d=15.1.1.1->172.16.2.3 [36]

*Aug 13 15:50:14.854: NAT*: s=172.16.2.3->15.1.1.1, d=2.2.2.2 [37]

*Aug 13 15:50:14.874: NAT*: s=2.2.2.2, d=15.1.1.1->172.16.2.3 [37]

*Aug 13 15:50:14.874: NAT*: s=172.16.2.3->15.1.1.1, d=2.2.2.2 [38]

*Aug 13 15:50:14.894: NAT*: s=2.2.2.2, d=15.1.1.1->172.16.2.3 [38]

*Aug 13 15:50:14.895: NAT*: s=172.16.2.3->15.1.1.1, d=2.2.2.2 [39]

*Aug 13 15:50:14.914: NAT*: s=2.2.2.2, d=15.1.1.1->172.16.2.3 [39]

*Aug 13 15:51:15.649: NAT: expiring 15.1.1.1 (172.16.2.3) icmp 7 (7)

 

3、通过traceroute命令跟踪到达2.2.2.2所经过的路径信息

 

R3#traceroute 2.2.2.2 source 172.16.1.3

Type escape sequence to abort.

Tracing the route to 2.2.2.2

VRF info: (vrf in name/id, vrf out name/id)

1 172.16.1.1 1 msec 1 msec 9 msec

2 15.1.1.5 6 msec 10 msec 10 msec   ####通过ISP_B到达

3 25.1.1.2 20 msec 16 msec *

 

R3#traceroute 2.2.2.2 source 172.16.2.3

Type escape sequence to abort.

Tracing the route to 2.2.2.2

VRF info: (vrf in name/id, vrf out name/id)

1 172.16.1.1 4 msec 2 msec 1 msec

2 15.1.1.5 11 msec 11 msec 10 msec  ####通过ISP_B到达

3 25.1.1.2 21 msec 21 msec *

 

通过以上测试可以得到结果:网段172.16.2.0/24通过ISP_B到达2.2.2.2

网段172.16.1.0/24通过ISP_B到达2.2.2.2

 

R1#clear access-list counters

 

R3#ping 2.2.2.2 so e0/0 re 1
Type escape sequence to abort.
Sending 1, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:
Packet sent with a source address of 172.16.1.3
!
Success rate is 100 percent (1/1), round-trip min/avg/max = 20/20/20 ms
R3#ping 2.2.2.2 so l0 re 1
Type escape sequence to abort.
Sending 1, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:
Packet sent with a source address of 172.16.2.3
!
Success rate is 100 percent (1/1), round-trip min/avg/max = 20/20/20 ms

 

R1#sh access-l
Standard IP access list 1
10 permit 172.16.1.0, wildcard bits 0.0.0.255 (3 matches)
Standard IP access list 2
10 permit 172.16.2.0, wildcard bits 0.0.0.255 (2 matches)

 

access list 1 命中了3次,是一次策略路由、一次ICMP 请求时的NAT,一次ICMP回应的NAT。
access list 2 命中了2次,是走的默认路由,一次ICMP 请求时的NAT,一次ICMP回应的NAT。
结果证明,虽然ISP_A的链路发生了故障,但是流量可以通过ISP_B到达2.2.2.2internet,实现链路切换和备份功能。

 

六  、实验完成

 

打开ISP_A的链路接口

 

R1(config)#inter s1/1

R1(config-if)#no sh

 

附详细配置:

链接:http://pan.baidu.com/s/1sj1542T 密码:pfuj