华为策略路由加等价路由_华为——防火墙——策略路由配置及思路

华为——策略路由(校园网配置)

作用：通过分析数据报的源地址和目标地址，按照策略规则选择不同的网关，进行数据转发。提供冗余，负载，但是还是单线路的速度。只是提供了不同的方向，并没有进行合并线路。

拓扑图如下：

配置思路：

配置命令：

1.LSW1配置：

[Huawei]vlan 10

[Huawei-vlan10]vlan 20

[Huawei-vlan20]quit

[Huawei]int e0/0/2

[Huawei-GigabitEthernet0/0/2]port link-type access

[Huawei]int e0/0/3

[Huawei-Ethernet0/0/3]port link-type access      //将接口类型定义为接入模式

[Huawei-Ethernet0/0/3]port default vlan 20         //将接口划分vlan 20

[Huawei]int e0/0/1

[Huawei-Ethernet0/0/1]port link-type trunk        //将该接口定义为Trunk中继模式

[Huawei-Ethernet0/0/1]port trunk allow-pass vlan all   //允许所有vlan通过

2.AR1配置：

sys

Enter system view, return user view with Ctrl+Z.

[Huawei]int g0/0/0

[Huawei-GigabitEthernet0/0/0]ip add 1.0.0.1 255.255.255.0

[Huawei-GigabitEthernet0/0/0]undo shutdown

[Huawei-GigabitEthernet0/0/0]quit

[Huawei]int g0/0/1

[Huawei-GigabitEthernet0/0/1]ip add 4.0.0.2 255.255.255.0

[Huawei-GigabitEthernet0/0/1]undo shutdown

[Huawei]int g0/0/2

[Huawei-GigabitEthernet0/0/2]ip add 3.0.0.1 255.255.255.0

[Huawei-GigabitEthernet0/0/2]undo shutdown

[Huawei-GigabitEthernet0/0/2]quit

配置OSPF，定义为area 0区域

[Huawei]ospf 1

[Huawei-ospf-1]area 0

[Huawei-ospf-1-area-0.0.0.0]network 1.0.0.0 0.0.0.255

[Huawei-ospf-1-area-0.0.0.0]network 3.0.0.0 0.0.0.255

[Huawei-ospf-1-area-0.0.0.0]network 4.0.0.0 0.0.0.255

3. AR3配置：

sys

Enter system view, return user view with Ctrl+Z.

[Huawei]undo info-center enable        //关闭consolo端接入设备信息中心发送的 调试/报警/日志消息

Info: Information center is disabled.

[Huawei]int g0/0/0

[Huawei-GigabitEthernet0/0/0]ip add 3.0.0.2 255.255.255.0

[Huawei-GigabitEthernet0/0/0]undo shutdown

[Huawei-GigabitEthernet0/0/0]quit

[Huawei]int g0/0/1

[Huawei-GigabitEthernet0/0/1]ip add 2.0.0.1 255.255.255.0

[Huawei-GigabitEthernet0/0/1]undo shutdown

[Huawei-GigabitEthernet0/0/1]quit

[Huawei]int g0/0/2

[Huawei-GigabitEthernet0/0/2]ip add 5.0.0.2 255.255.255.0

[Huawei-GigabitEthernet0/0/2]undo shutdown

[Huawei-GigabitEthernet0/0/2]quit

配置OSPF，定义区域为area 0

[Huawei]ospf 1

[Huawei-ospf-1]area 0

[Huawei-ospf-1-area-0.0.0.0]network 3.0.0.0 0.0.0.255

[Huawei-ospf-1-area-0.0.0.0]network 5.0.0.0 0.0.0.255

[Huawei-ospf-1-area-0.0.0.0]network 2.0.0.0 0.0.0.255

[Huawei-ospf-1-area-0.0.0.0]quit

4.(USG5500)FW1配置：

SYS

11:46:33  2020/03/03

Enter system view, return user view with Ctrl+Z.

[SRG]undo info-center enable            //关闭consolo端接入设备信息中心发送的 调试/报警/日志消息

[SRG]int g0/0/2

[SRG-GigabitEthernet0/0/2]ip add 4.0.0.1 255.255.255.0

[SRG-GigabitEthernet0/0/2]undo shutdown

[SRG]int g0/0/3

[SRG-GigabitEthernet0/0/3]ip add 5.0.0.1 255.255.255.0

[SRG-GigabitEthernet0/0/3]undo shutdown

[SRG]int g0/0/1.10

[SRG-GigabitEthernet0/0/1.10]description vlan 10        //划分该子接口为vlan 10

[SRG-GigabitEthernet0/0/1.10]vlan-type dot1q 10       //vlan的封装模式为802.1q

[SRG-GigabitEthernet0/0/1.10]ip add 192.168.1.1 255.255.255.0

[SRG-GigabitEthernet0/0/1.10]undo shutdown

[SRG]int g0/0/1.20

[SRG-GigabitEthernet0/0/1.20]description vlan 20        //划分该子接口为vlan 20

[SRG-GigabitEthernet0/0/1.20]vlan-type dot1q 20       //vlan的封装模式为802.1q

[SRG-GigabitEthernet0/0/1.20]ip add 192.168.2.1 255.255.255.0

[SRG-GigabitEthernet0/0/1.20]undo shutdown

[SRG]firewall zone trust      //划分信任区域

[SRG-zone-trust]add interface GigabitEthernet 0/0/1.10      //add将其添加进入trust(内网)

[SRG-zone-trust]add interface GigabitEthernet 0/0/1.20

[SRG]firewall zone untrust          //划分非信任区域

[SRG-zone-untrust]add interface GigabitEthernet 0/0/2       //add将其添加进入untrust(外网)

[SRG-zone-untrust]add interface GigabitEthernet 0/0/3

1) 策略规则

[SRG]policy interzone trust untrust outbound      //定义信任区域到非信任区域的输出规则

[SRG-policy-interzone-trust-untrust-outbound]policy 1      //定义规则序号1的

[SRG-policy-interzone-trust-untrust-outbound-1]policy source 192.168.1.0 0.0.0.255   //定义源地址

[SRG-policy-interzone-trust-untrust-outbound-1]action permit //动作为允许

[SRG-policy-interzone-trust-untrust-outbound-1]quit

[SRG-policy-interzone-trust-untrust-outbound]policy 2      //定义规则序号2的

[SRG-policy-interzone-trust-untrust-outbound-2]policy source 192.168.2.0 0.0.0.255  //定义源地址

[SRG-policy-interzone-trust-untrust-outbound-2]action permit //动作为允许

[SRG-policy-interzone-trust-untrust-outbound-2]quit

2) NAT转换

[SRG]nat-policy interzone trust untrust outbound        //定义nat的转换区域为信任区域转到非信任区域

[SRG-nat-policy-interzone-trust-untrust-outbound]policy 1        //策略规则序号为1

[SRG-nat-policy-interzone-trust-untrust-outbound-1]policy source 192.168.1.0 0.0.0.255     //定义受规则的源地址

[SRG-nat-policy-interzone-trust-untrust-outbound-1]action source-nat     //动作为允许nat转换

[SRG-nat-policy-interzone-trust-untrust-outbound-1]easy-ip g0/0/2 //配置PAT，简单IP转换

[SRG-nat-policy-interzone-trust-untrust-outbound-1]quit

[SRG-nat-policy-interzone-trust-untrust-outbound]policy 2        //策略规则序号为2

[SRG-nat-policy-interzone-trust-untrust-outbound-2]policy source 192.168.2.0 0.0.0.255     //定义源地址

[SRG-nat-policy-interzone-trust-untrust-outbound-2]action source-nat     //动作定义为允许nat转换

[SRG-nat-policy-interzone-trust-untrust-outbound-2]easy-ip g0/0/3 //配置PAT

3) 创建访问控制列表，添加内网地址池

[SRG]acl number 2000        //acl的序号定义为2000

[SRG-acl-basic-2000]rule 10 permit source 192.168.1.0 0.0.0.255 //序号为10的规则允许192.168.1.0

[SRG-acl-basic-2000]quit

[SRG]acl number 2001        //acl的序号定义为2001

[SRG-acl-basic-2001]rule 10 permit source 192.168.2.0 0.0.0.255 //序号为10的规则允许192.168.2.0

[SRG-acl-basic-2001]quit

4) 创建策略路由

[SRG]policy-based-route clly permit node 5         //定义策略路由的名字为clly，路由点为5

[SRG-policy-based-route-clly-5]if-match acl 2000      //绑定内网地址池为192.168.1.0的acl

[SRG-policy-based-route-clly-5]apply ip-address next-hop 4.0.0.2      //指定下一条地址为4.0.0.2

[SRG-policy-based-route-clly-5]quit

[SRG]policy-based-route clly permit node 20       //定义策略路由的名字为clly，路由点为20

[SRG-policy-based-route-clly-20]if-match acl 2001    //绑定内网地址池为192.168.2.0的acl

[SRG-policy-based-route-clly-20]apply ip-address next-hop 5.0.0.2    //指定下一跳地址为5.0.0.2

[SRG-policy-based-route-clly-20]quit

5) 创建端接口检查，网关检查

[SRG]ip-link check enable //开启链路检查

12:17:59  2020/03/03

[SRG]ip-link 1 destination 4.0.0.2 interface g0/0/2        //定义序号为1，绑定目标地址为4.0.0.2的要从g0/0/2端口出发

[SRG]ip-link 2 destination 5.0.0.2 interface g0/0/3        //定义序号为1，绑定目标地址为5.0.0.2的要从g0/0/3端口出发

[SRG]display ip-link    //查看链路绑定表

num state timer vpn-instance     ip-address      interface-name  mode  vgmp  nex

t-hop

1   up    3                      4.0.0.2         GE0/0/2         icmp  none

2   up    3                      5.0.0.2         GE0/0/3         icmp  none

6) 设置静态路由

[SRG]ip route-static 0.0.0.0 0.0.0.0 4.0.0.2 track ip-link 1       //将该绑定策略应用到这条默认路由条目上

[SRG]ip route-static 0.0.0.0 0.0.0.0 5.0.0.2 track ip-link 2

7) 验证

使用Clinet 2访问Server 1、Server 2的web，并对AB两处进行抓包

1)   访问Server 1时

a)        A点抓包没有发现Clinet 2的数据包

b)        B点抓包发现Clinet 2的数据包，并且IP已经替换为5.0.0.1

2)   访问Server 2时

a)        A点抓包没有发现Clinet 2的数据包

b)        B点抓包发现Clinet 2的数据包，并且已经替换为5.0.0.1