配置DSVPN双Hub主备备份示例
配置思路
由于分支是采用动态地址接入公网的,分支之间互相不知道对方的公网地址,因此必须采用DSVPN来实现分支之间的VPN互联。
由于分支数量较多,因此采用shortcut场景的DSVPN。
由于分支和总部的子网环境经常出现变动,为简化维护并根据企业网络规划,选择部署OSPF路由协议来实现分支/总部间的通信。
由于需要实现Hub2冗余备份,因此需要配置双Hub DSVPN实现该功能。
操作步骤
- 配置接口IP地址
在各设备上配置接口IP地址。
# 在Hub上配置接口IP地址。<HUAWEI> system-view [~HUAWEI] sysname Hub [*Hub] interface GigabitEthernet 1/0/0 [*Hub-GigabitEthernet1/0/0] ip address 10.1.1.10 255.255.255.0 [*Hub-GigabitEthernet1/0/0] binding tunnel gre [*Hub-GigabitEthernet1/0/0] quit [*Hub] interface tunnel 0 [*Hub-Tunnel0] ip address 172.16.1.1 255.255.255.0 [*Hub-Tunnel0] quit [*Hub] interface loopback 0 [*Hub-LoopBack0] ip address 192.168.0.1 255.255.255.255 [*Hub-LoopBack0] quit [*Hub] commit
按照图5-7配置Spoke1、Spoke2、Hub2各接口的IP地址,具体配置过程与配置Hub1相同(略)。
- 配置各设备之间公网路由可达
在各设备上配置OSPF路由协议,实现公网路由可达。
# 在Hub1上配置OSPF。
[~Hub1] ospf 2 router-id 10.1.1.10 [*Hub1-ospf-2] area 0.0.0.1 [*Hub1-ospf-2-area-0.0.0.1] network 10.1.1.0 0.0.0.255 [*Hub1-ospf-2-area-0.0.0.1] quit [*Hub1-ospf-2] quit [*Hub1] commit
# 在Hub2上配置OSPF。
[~Hub2] ospf 2 router-id 10.1.254.10 [*Hub2-ospf-2] area 0.0.0.1 [*Hub2-ospf-2-area-0.0.0.1] network 10.1.254.0 0.0.0.255 [*Hub2-ospf-2-area-0.0.0.1] quit [*Hub2-ospf-2] quit [*Hub2] commit
# 在Spoke1上配置OSPF。
[~Spoke1] ospf 2 router-id 10.1.2.10 [*Spoke1-ospf-2] area 0.0.0.1 [*Spoke1-ospf-2-area-0.0.0.1] network 10.1.2.0 0.0.0.255 [*Spoke1-ospf-2-area-0.0.0.1] quit [*Spoke1-ospf-2] quit [*Spoke1] commit
# 在Spoke2上配置OSPF。
[~Spoke2] ospf 2 router-id 10.1.3.10 [*Spoke2-ospf-2] area 0.0.0.1 [*Spoke2-ospf-2-area-0.0.0.1] network 10.1.3.0 0.0.0.255 [*Spoke2-ospf-2-area-0.0.0.1] quit [*Spoke2-ospf-2] quit [*Spoke2] commit
- 配置OSPF基本功能
# 配置Hub1。
[~Hub1] acl number 2000 [*Hub1-acl4-basic-2000] rule 5 permit source 192.168.0.0 0.0.0.255 [*Hub1-acl4-basic-2000] quit [*Hub1] route-policy 1 permit node 1 [*Hub1-route-policy] if-match acl 2000 [*Hub1-route-policy] quit [*Hub1] acl number 2001 [*Hub1-acl4-basic-2001] rule 5 permit source 192.168.1.0 0.0.0.255 [*Hub1-acl4-basic-2001] rule 10 permit source 192.168.2.0 0.0.0.255 [*Hub1-acl4-basic-2001] quit [*Hub1] route-policy 2 permit node 2 [*Hub1-route-policy] if-match acl 2001 [*Hub1-route-policy] quit [*Hub1] ospf 1 router-id 172.16.1.1 [*Hub1-ospf-1] import-route ospf 3 route-policy 1 [*Hub1-ospf-1] area 0.0.0.0 [*Hub1-ospf-1-area-0.0.0.0] network 172.16.1.0 0.0.0.255 [*Hub1-ospf-1-area-0.0.0.0] quit [*Hub1-ospf-1] quit [*Hub1] ospf 3 router-id 192.168.0.1 [*Hub1-ospf-3] import-route ospf 1 route-policy 2 [*Hub1-ospf-3] area 0.0.0.0 [*Hub1-ospf-3-area-0.0.0.0] network 192.168.0.0 0.0.0.255 [*Hub1-ospf-3-area-0.0.0.0] quit [*Hub1-ospf-3] quit [*Hub1] commit
# 配置Hub2。
[~Hub2] acl number 2000 [*Hub2-acl4-basic-2000] rule 5 permit source 192.168.0.0 0.0.0.255 [*Hub2-acl4-basic-2000] quit [*Hub2] route-policy 1 permit node 1 [*Hub2-route-policy] if-match acl 2000 [*Hub2-route-policy] quit [*Hub2] acl number 2001 [*Hub2-acl4-basic-2001] rule 5 permit source 192.168.1.0 0.0.0.255 [*Hub2-acl4-basic-2001] rule 10 permit source 192.168.2.0 0.0.0.255 [*Hub2-acl4-basic-2001] quit [*Hub2] route-policy 2 permit node 2 [*Hub2-route-policy] if-match acl 2001 [*Hub2-route-policy] quit [*Hub2] ospf 1 router-id 172.16.1.254 [*Hub2-ospf-1] import-route ospf 3 route-policy 1 [*Hub2-ospf-1] area 0.0.0.0 [*Hub2-ospf-1-area-0.0.0.0] network 172.16.1.0 0.0.0.255 [*Hub2-ospf-1-area-0.0.0.0] quit [*Hub2-ospf-1] quit [*Hub2] ospf 3 router-id 192.168.0.2 [*Hub2-ospf-3] import-route ospf 1 route-policy 2 [*Hub2-ospf-3] area 0.0.0.0 [*Hub2-ospf-3-area-0.0.0.0] network 192.168.0.0 0.0.0.255 [*Hub2-ospf-3-area-0.0.0.0] quit [*Hub2-ospf-3] quit [*Hub2] commit
# 配置Spoke1。
[~Spoke1] ospf 1 router-id 172.16.1.2 [*Spoke1-ospf-1] area 0.0.0.0 [*Spoke1-ospf-1-area-0.0.0.0] network 172.16.1.0 0.0.0.255 [*Spoke1-ospf-1-area-0.0.0.0] network 192.168.1.0 0.0.0.255 [*Spoke1-ospf-1-area-0.0.0.0] quit [*Spoke1-ospf-1] quit [*Spoke1] commit
# 配置Spoke2。
[~Spoke2] ospf 1 router-id 172.16.1.3 [*Spoke2-ospf-1] area 0.0.0.0 [*Spoke2-ospf-1-area-0.0.0.0] network 172.16.1.0 0.0.0.255 [*Spoke2-ospf-1-area-0.0.0.0] network 192.168.2.0 0.0.0.255 [*Spoke2-ospf-1-area-0.0.0.0] quit [*Spoke2-ospf-1] quit [*Spoke2] commit
- 配置使能全局的nhrp功能
# 配置Hub1。
[~Hub1] nhrp enable
Spoke1、Spoke2和Hub2上进行类似配置,此处不再复述。
- 配置Tunnel接口
在Hub和Spoke配置OSPF网络类型为p2mp以实现分支到总部的路由。在Hub1和Hub2使能NHRP Redirect功能,在Spoke1和Spoke2上分别配置Hub1和Hub2的静态NHRP peer表项并使能NHRP Shortcut功能。
# 在Hub1上配置Tunnel接口和OSPF相关属性,使能NHRP Redirect功能。[~Hub1] interface tunnel 0 [*Hub1-Tunnel0] tunnel-protocol gre p2mp [*Hub-Tunnel0] nhrp enable [*Hub1-Tunnel0] source gigabitethernet 1/0/0 [*Hub1-Tunnel0] nhrp entry multicast dynamic [*Hub1-Tunnel0] ospf network-type p2mp [*Hub1-Tunnel0] nhrp redirect [*Hub1-Tunnel0] quit [*Hub1] commit
# 在Hub2上配置Tunnel接口,OSPF相关属性,使能NHRP Redirect功能。[~Hub2] interface tunnel 0 [*Hub2-Tunnel0] tunnel-protocol gre p2mp [*Hub2-Tunnel0] nhrp enable [*Hub2-Tunnel0] source gigabitethernet 1/0/0 [*Hub2-Tunnel0] nhrp entry multicast dynamic [*Hub2-Tunnel0] ospf network-type p2mp [*Hub2-Tunnel0] nhrp redirect [*Hub2-Tunnel0] quit [*Hub2] commit
# 在Spoke1上配置Tunnel接口,OSPF路由相关属性以及Hub1和Hub2的静态NHRP peer表项,使能NHRP Shortcut功能。[~Spoke1] interface tunnel 0 [*Spoke1-Tunnel0] tunnel-protocol gre p2mp [*Spoke1-Tunnel0] nhrp enable [*Spoke1-Tunnel0] source gigabitethernet 1/0/0 [*Spoke1-Tunnel0] nhrp entry 172.16.1.1 10.1.1.10 register [*Spoke1-Tunnel0] nhrp entry 172.16.1.254 10.1.254.10 register [*Spoke1-Tunnel0] ospf network-type p2mp [*Spoke1-Tunnel0] nhrp shortcut [*Spoke1-Tunnel0] nhrp registration interval 300 [*Spoke1-Tunnel0] quit [*Spoke1] commit [~Spoke1] ospf 1 [*Spoke1-ospf-1] nexthop 172.16.1.1 weight 1 [*Spoke1] commit
# 在Spoke2上配置Tunnel接口,OSPF路由相关属性以及Hub1和Hub2的静态NHRP peer表项,使能NHRP Shortcut功能。[~Spoke2] interface tunnel 0 [*Spoke2-Tunnel0] tunnel-protocol gre p2mp [*Spoke2-Tunnel0] nhrp enable [*Spoke2-Tunnel0] source gigabitethernet 1/0/0 [*Spoke2-Tunnel0] nhrp entry 172.16.1.1 10.1.1.10 register [*Spoke2-Tunnel0] nhrp entry 172.16.1.254 10.1.254.10 register [*Spoke2-Tunnel0] ospf network-type p2mp [*Spoke2-Tunnel0] nhrp shortcut [*Spoke2-Tunnel0] nhrp registration interval 300 [*Spoke2-Tunnel0] quit [*Spoke2] commit [~Spoke2] ospf 1 [*Spoke2-ospf-1] nexthop 172.16.1.1 weight 1 [*Spoke2] commit
在Hub1和Hub2配置不同的ospf cost值是为了让Spoke优先选取Hub1作为路由的下一跳。
在Hub1从故障中恢复之后,只有等到Spoke向其进行注册之后,才能重新进行OSPF协议报文交互,Spoke在原有路由老化之后学习到Hub1的路由。为了让Spoke快速感知Hub1,可以将Spoke的注册间隔调整到合适的值(默认注册间隔为1800秒)。
- 检查DSVPN配置结果
配置完成后,检查Spoke和Hub上的NHRP peer信息。以Spoke1为例。
# 在Spoke1上执行display nhrp peer all操作,结果如下。
[~Spoke1] display nhrp peer all ------------------------------------------------------------------------------- Protocol-addr Mask NBMA-addr NextHop-addr Type Flag ------------------------------------------------------------------------------- 172.16.1.1 32 10.1.1.10 172.16.1.1 hub up ------------------------------------------------------------------------------- Tunnel interface: Tunnel0 Created time : 05:35:50 Expire time : -- ------------------------------------------------------------------------------- Protocol-addr Mask NBMA-addr NextHop-addr Type Flag ------------------------------------------------------------------------------- 172.16.1.254 32 10.1.254.10 172.16.1.254 hub up ------------------------------------------------------------------------------- Tunnel interface: Tunnel0 Created time : 04:32:49 Expire time : -- Number of nhrp peers: 2
完成上述配置后,执行display nhrp peer all命令,Spoke1和Spoke2上只能看到Hub的静态NHRP peer表项。
- 执行ping操作,查看配置结果
在Spoke1上ping分支Spoke2的子网地址192.168.2.1,然后在Spoke1和Spoke2上可以分别看到彼此的动态NHRP peer表项。
# 在Spoke1上执行ping -a 192.168.1.1 192.168.2.1操作,结果如下。
[~Spoke1] ping -a 192.168.1.1 192.168.2.1 PING 192.168.2.1: 56 data bytes, press CTRL_C to break Reply from 192.168.2.1: bytes=56 Sequence=1 ttl=254 time=3 ms Reply from 192.168.2.1: bytes=56 Sequence=2 ttl=255 time=2 ms Reply from 192.168.2.1: bytes=56 Sequence=3 ttl=255 time=2 ms Reply from 192.168.2.1: bytes=56 Sequence=4 ttl=255 time=2 ms Reply from 192.168.2.1: bytes=56 Sequence=5 ttl=255 time=2 ms --- 192.168.2.1 ping statistics --- 5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 2/2/3 ms
# 在Spoke上执行display nhrp peer all操作,以Spoke1为例,结果如下。
[~Spoke1] display nhrp peer all ------------------------------------------------------------------------------- Protocol-addr Mask NBMA-addr NextHop-addr Type Flag ------------------------------------------------------------------------------- 172.16.1.1 32 10.1.1.10 172.16.1.1 hub up ------------------------------------------------------------------------------- Tunnel interface: Tunnel0 Created time : 05:42:50 Expire time : -- ------------------------------------------------------------------------------- Protocol-addr Mask NBMA-addr NextHop-addr Type Flag ------------------------------------------------------------------------------- 172.16.1.254 32 10.1.254.10 172.16.1.254 hub up ------------------------------------------------------------------------------- Tunnel interface: Tunnel0 Created time : 04:39:49 Expire time : -- ------------------------------------------------------------------------------- Protocol-addr Mask NBMA-addr NextHop-addr Type Flag ------------------------------------------------------------------------------- 192.168.2.1 32 10.1.3.10 172.16.1.3 remote-network up ------------------------------------------------------------------------------- Tunnel interface: Tunnel0 Created time : 00:00:19 Expire time : 01:59:41 ------------------------------------------------------------------------------- Protocol-addr Mask NBMA-addr NextHop-addr Type Flag ------------------------------------------------------------------------------- 172.16.1.3 32 10.1.3.10 172.16.1.3 remote up ------------------------------------------------------------------------------- Tunnel interface: Tunnel0 Created time : 00:00:19 Expire time : 01:59:41 ------------------------------------------------------------------------------- Protocol-addr Mask NBMA-addr NextHop-addr Type Flag ------------------------------------------------------------------------------- 192.168.1.1 32 10.1.2.10 172.16.1.2 local up ------------------------------------------------------------------------------- Tunnel interface: Tunnel0 Created time : 00:00:19 Expire time : 01:59:41 Number of nhrp peers: 5
- Hub1故障,shutdown Hub1的公网物理接口GE1/0/0
# 在Hub1上shutdown接口GE1/0/0。
[~Hub1] interface GigabitEthernet 1/0/0 [~Hub1-GigabitEthernet1/0/0] shutdown [~Hub1-GigabitEthernet1/0/0] quit
- 再次执行ping操作,查看配置结果
在Spoke1上ping分支Spoke2的子网地址192.168.2.1,然后在Spoke1和Spoke2上可以分别看到彼此的动态NHRP peer表项。
执行ping操作前,需要确认本地没有到Hub1的默认路由,确保到Hub1不可达。
# 在Spoke1上执行ping -a 192.168.1.1 192.168.2.1操作,结果如下。
[~Spoke1] ping -a 192.168.1.1 192.168.2.1 PING 192.168.2.1: 56 data bytes, press CTRL_C to break Reply from 192.168.2.1: bytes=56 Sequence=1 ttl=254 time=2 ms Reply from 192.168.2.1: bytes=56 Sequence=2 ttl=255 time=2 ms Reply from 192.168.2.1: bytes=56 Sequence=3 ttl=255 time=2 ms Reply from 192.168.2.1: bytes=56 Sequence=4 ttl=255 time=2 ms Reply from 192.168.2.1: bytes=56 Sequence=5 ttl=255 time=2 ms --- 192.168.2.1 ping statistics --- 5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 2/2/2 ms
# 在Spoke上执行display nhrp peer all操作,以Spoke1为例,结果如下。
[~Spoke1] display nhrp peer all ------------------------------------------------------------------------------- Protocol-addr Mask NBMA-addr NextHop-addr Type Flag ------------------------------------------------------------------------------- 172.16.1.1 32 10.1.1.10 172.16.1.1 hub down ------------------------------------------------------------------------------- Tunnel interface: Tunnel0 Created time : 05:46:29 Expire time : -- ------------------------------------------------------------------------------- Protocol-addr Mask NBMA-addr NextHop-addr Type Flag ------------------------------------------------------------------------------- 172.16.1.254 32 10.1.254.10 172.16.1.254 hub up ------------------------------------------------------------------------------- Tunnel interface: Tunnel0 Created time : 04:43:28 Expire time : -- ------------------------------------------------------------------------------- Protocol-addr Mask NBMA-addr NextHop-addr Type Flag ------------------------------------------------------------------------------- 192.168.2.1 32 10.1.3.10 172.16.1.3 remote-network up ------------------------------------------------------------------------------- Tunnel interface: Tunnel0 Created time : 00:00:22 Expire time : 01:59:38 ------------------------------------------------------------------------------- Protocol-addr Mask NBMA-addr NextHop-addr Type Flag ------------------------------------------------------------------------------- 172.16.1.3 32 10.1.3.10 172.16.1.3 remote up ------------------------------------------------------------------------------- Tunnel interface: Tunnel0 Created time : 00:00:22 Expire time : 01:59:38 ------------------------------------------------------------------------------- Protocol-addr Mask NBMA-addr NextHop-addr Type Flag ------------------------------------------------------------------------------- 192.168.1.1 32 10.1.2.10 172.16.1.2 local up ------------------------------------------------------------------------------- Tunnel interface: Tunnel0 Created time : 00:00:22 Expire time : 01:59:38 Number of nhrp peers: 5
配置文件
Hub1的配置文件
# sysname Hub1 # acl number 2000 rule 5 permit source 192.168.0.0 0.0.0.255 # acl number 2001 rule 5 permit source 192.168.1.0 0.0.0.255 rule 10 permit source 192.168.2.0 0.0.0.255 # route-policy 1 permit node 1 if-match acl 2000 # route-policy 2 permit node 2 if-match acl 2001 # nhrp enable # interface GigabitEthernet1/0/0 ip address 10.1.1.10 255.255.255.0 binding tunnel gre # interface LoopBack0 ip address 192.168.0.1 255.255.255.255 # interface Tunnel0 ip address 172.16.1.1 255.255.255.0 tunnel-protocol gre p2mp source GigabitEthernet1/0/0 ospf network-type p2mp nhrp enable nhrp redirect nhrp entry multicast dynamic # ospf 1 router-id 172.16.1.1 import-route ospf 3 route-policy 1 area 0.0.0.0 network 172.16.1.0 0.0.0.255 # ospf 2 router-id 10.1.1.10 area 0.0.0.1 network 10.1.1.0 0.0.0.255 # ospf 3 router-id 192.168.0.1 import-route ospf 1 route-policy 2 area 0.0.0.0 network 192.168.0.0 0.0.0.255 # return
Hub2的配置文件
# sysname Hub2 # acl number 2000 rule 5 permit source 192.168.0.0 0.0.0.255 # acl number 2001 rule 5 permit source 192.168.1.0 0.0.0.255 rule 10 permit source 192.168.2.0 0.0.0.255 # route-policy 1 permit node 1 if-match acl 2000 # route-policy 2 permit node 2 if-match acl 2001 # nhrp enable # interface GigabitEthernet1/0/0 ip address 10.1.254.10 255.255.255.0 binding tunnel gre # interface LoopBack0 ip address 192.168.0.2 255.255.255.255 # interface Tunnel0 ip address 172.16.1.254 255.255.255.0 tunnel-protocol gre p2mp source GigabitEthernet1/0/0 ospf network-type p2mp nhrp enable nhrp redirect nhrp entry multicast dynamic # ospf 1 router-id 172.16.1.254 import-route ospf 3 route-policy 1 area 0.0.0.0 network 172.16.1.0 0.0.0.255 # ospf 2 router-id 10.1.254.10 area 0.0.0.1 network 10.1.254.0 0.0.0.255 # ospf 3 router-id 192.168.0.2 import-route ospf 1 route-policy 2 area 0.0.0.0 network 192.168.0.0 0.0.0.255 # return
Spoke1的配置文件
# sysname Spoke1 # nhrp enable # interface GigabitEthernet1/0/0 ip address 10.1.2.10 255.255.255.0 binding tunnel gre # interface LoopBack0 ip address 192.168.1.1 255.255.255.255 # interface Tunnel0 ip address 172.16.1.2 255.255.255.0 tunnel-protocol gre p2mp source GigabitEthernet1/0/0 ospf network-type p2mp nhrp enable nhrp shortcut nhrp registration interval 300 nhrp entry 172.16.1.254 10.1.254.10 register nhrp entry 172.16.1.1 10.1.1.10 register # ospf 1 router-id 172.16.1.2 area 0.0.0.0 network 172.16.1.0 0.0.0.255 network 192.168.1.0 0.0.0.255 nexthop 172.16.1.1 weight 1 # ospf 2 router-id 10.1.2.10 area 0.0.0.1 network 10.1.2.0 0.0.0.255 # return
Spoke2的配置文件
# sysname Spoke2 # nhrp enable # interface GigabitEthernet1/0/0 ip address 10.1.3.10 255.255.255.0 binding tunnel gre # interface LoopBack0 ip address 192.168.2.1 255.255.255.255 # interface Tunnel0 ip address 172.16.1.3 255.255.255.0 tunnel-protocol gre p2mp source GigabitEthernet1/0/0 ospf network-type p2mp nhrp enable nhrp shortcut nhrp registration interval 300 nhrp entry 172.16.1.254 10.1.254.10 register nhrp entry 172.16.1.1 10.1.1.10 register # ospf 1 router-id 172.16.1.3 area 0.0.0.0 network 172.16.1.0 0.0.0.255 network 192.168.2.0 0.0.0.255 nexthop 172.16.1.1 weight 1 # ospf 2 router-id 10.1.3.10 area 0.0.0.1 network 10.1.3.0 0.0.0.255 # return