防火墙旁挂拓扑，采用策略路由引流

防火墙旁挂拓扑，采用策略路由引流

在上面的拓扑中为了来回路径相同，需要在AR1的G0/0/0和G0/0/2两个端口上采用策略重定向
策略路由配置如下：
acl number 2000
rule 5 permit source 192.168.1.0 0.0.0.255

acl number 3001
rule 5 permit ip destination 192.168.1.0 0.0.0.255

traffic classifier tan operator or
if-match acl 3001
traffic classifier liu operator or
if-match acl 2000

traffic behavior tan
redirect ip-nexthop 2.1.1.2
traffic behavior liu
redirect ip-nexthop 2.1.1.6

traffic policy tan
classifier tan behavior tan
traffic policy liu
classifier liu behavior liu
策略应用到端口的配置：

interface GigabitEthernet0/0/0
ip address 1.1.1.5 255.255.255.252
traffic-policy liu inbound

interface GigabitEthernet0/0/2
ip address 1.1.1.1 255.255.255.252
traffic-policy tan inbound
防火墙上做了策略放行：
security-policy
rule name s_d
source-zone trust
destination-zone untrust
source-address 192.168.1.0 mask 255.255.255.0
destination-address 10.1.1.0 mask 255.255.255.0
action permit
其他的配置是ospf基础配置，然后在防火墙上做ospf双向引入即可。