HCIP学习18 静态路由跨公网互通实验

实验拓扑实验设备设备类型设备名称型号数量用途路由器AR1AR22201左侧私网出口路由器路由器ISPAR22201公网核心路由器路由器AR3AR22201右侧私网出口路由器拓扑结构拓扑链路与接口连接表本端设备本端接口对端设备对端接口链路网段所属网络AR1GE0/0/0ISPGE0/0/012.0.0.0/24公网ISPGE0/0/1AR3GE0/0/023.0.0.0/24公网AR1LoopBack0--192.168.1.0/24左侧私网AR3LoopBack0--192.168.2.0/24右侧私网IP 地址规划表设备接口IP 地址子网掩码备注AR1GE0/0/012.0.0.1255.255.255.0连接 ISPAR1LoopBack0192.168.1.1255.255.255.0模拟左侧私网网段ISPGE0/0/012.0.0.2255.255.255.0连接 AR1ISPGE0/0/123.0.0.1255.255.255.0连接 AR3AR3GE0/0/023.0.0.2255.255.255.0连接 ISPAR3LoopBack0192.168.2.1255.255.255.0模拟右侧私网网段实验需求基础配置完成所有路由器的设备命名、接口 IP 地址、环回接口配置静态路由配置在 AR1 上配置静态路由指向右侧私网 192.168.2.0/24在 AR3 上配置静态路由指向左侧私网 192.168.1.0/24在 ISP 上配置双向静态路由分别指向两个私网网段默认路由配置在 AR1 上配置默认路由下一跳指向 ISP12.0.0.2在 AR3 上配置默认路由下一跳指向 ISP23.0.0.1实验验证验证所有路由器的路由表验证左侧私网与右侧私网的互通性验证私网与公网网段的互通性实验原理与思路技术原理1静态路由静态路由是由管理员手动配置的路由条目优先级最高管理距离 60适用于小型、拓扑固定的网络。优点配置简单、开销小、安全性高缺点不能自动适应拓扑变化需要手动更新2默认路由默认路由是一种特殊的静态路由当路由表中没有匹配的条目时使用默认路由转发数据包。通常用于连接公网的出口路由器下一跳指向公网网关。格式ip route-static 0.0.0.0 0.0.0.0 下一跳IP3私网跨公网互通原理两个私网通过公网互通时需要在公网路由器上配置指向两个私网的静态路由同时在私网出口路由器上配置默认路由指向公网实现双向数据包转发。需求拆解需求技术实现命令AR1 访问右侧私网静态路由ip route-static 192.168.2.0 255.255.255.0 12.0.0.2AR3 访问左侧私网静态路由ip route-static 192.168.1.0 255.255.255.0 23.0.0.1ISP 访问左侧私网静态路由ip route-static 192.168.1.0 255.255.255.0 12.0.0.1ISP 访问右侧私网静态路由ip route-static 192.168.2.0 255.255.255.0 23.0.0.2AR1 访问公网默认路由ip route-static 0.0.0.0 0.0.0.0 12.0.0.2AR3 访问公网默认路由ip route-static 0.0.0.0 0.0.0.0 23.0.0.1设计说明双向静态路由必须在所有路由器上配置双向静态路由否则会出现单向通的问题默认路由优化私网出口路由器使用默认路由代替多条静态路由简化配置环回接口模拟使用环回接口模拟私网网段不需要额外的 PC 设备实验步骤与配置实验准备工作所有设备恢复出厂配置Huawei reset saved-configuration Warning: The action will delete the saved configuration in the device. Continue? [Y/N]: y Huawei reboot Warning: All the configuration will be saved to the next startup. Continue? [Y/N]: n System will reboot! Continue? [Y/N]: y等待所有设备启动完成约 2-3 分钟。基础配置1AR1 基础配置Huawei system-view [Huawei] sysname AR1 # 配置公网接口 [AR1] interface GigabitEthernet 0/0/0 [AR1-GigabitEthernet0/0/0] ip address 12.0.0.1 255.255.255.0 [AR1-GigabitEthernet0/0/0] undo shutdown [AR1-GigabitEthernet0/0/0] quit # 配置环回接口模拟左侧私网 [AR1] interface LoopBack 0 [AR1-LoopBack0] ip address 192.168.1.1 255.255.255.0 [AR1-LoopBack0] undo shutdown [AR1-LoopBack0] quit # 保存配置 [AR1] save [AR1] quit2ISP 基础配置Huawei system-view [Huawei] sysname ISP # 配置连接AR1的接口 [ISP] interface GigabitEthernet 0/0/0 [ISP-GigabitEthernet0/0/0] ip address 12.0.0.2 255.255.255.0 [ISP-GigabitEthernet0/0/0] undo shutdown [ISP-GigabitEthernet0/0/0] quit # 配置连接AR3的接口 [ISP] interface GigabitEthernet 0/0/1 [ISP-GigabitEthernet0/0/1] ip address 23.0.0.1 255.255.255.0 [ISP-GigabitEthernet0/0/1] undo shutdown [ISP-GigabitEthernet0/0/1] quit # 保存配置 [ISP] save [ISP] quit3AR3 基础配置Huawei system-view [Huawei] sysname AR3 # 配置公网接口 [AR3] interface GigabitEthernet 0/0/0 [AR3-GigabitEthernet0/0/0] ip address 23.0.0.2 255.255.255.0 [AR3-GigabitEthernet0/0/0] undo shutdown [AR3-GigabitEthernet0/0/0] quit # 配置环回接口模拟右侧私网 [AR3] interface LoopBack 0 [AR3-LoopBack0] ip address 192.168.2.1 255.255.255.0 [AR3-LoopBack0] undo shutdown [AR3-LoopBack0] quit # 保存配置 [AR3] save [AR3] quit静态路由配置1AR1 静态路由配置[AR1] ip route-static 192.168.2.0 255.255.255.0 12.0.0.2 # 指向右侧私网 [AR1] ip route-static 0.0.0.0 0.0.0.0 12.0.0.2 # 默认路由指向ISP2ISP 静态路由配置[ISP] ip route-static 192.168.1.0 255.255.255.0 12.0.0.1 # 指向左侧私网 [ISP] ip route-static 192.168.2.0 255.255.255.0 23.0.0.2 # 指向右侧私网3AR3 静态路由配置[AR3] ip route-static 192.168.1.0 255.255.255.0 23.0.0.1 # 指向左侧私网 [AR3] ip route-static 0.0.0.0 0.0.0.0 23.0.0.1 # 默认路由指向ISP保存所有配置所有路由器配置完成后执行以下命令保存配置Router save The current configuration will be written to the device. Are you sure to continue? [Y/N]: y Now saving the current configuration to the slot 0. Save the configuration successfully.实验结果验证AR1 路由表验证[AR1] display ip routing-table Route Flags: R - relay, D - download to fib ------------------------------------------------------------------------------ Public routing table : Destinations : 5 Routes : 5 Destination/Mask Proto Pre Cost Flags NextHop Interface 0.0.0.0/0 Static 60 0 D 12.0.0.2 GigabitEthernet0/0/0 12.0.0.0/24 Direct 0 0 D 12.0.0.1 GigabitEthernet0/0/0 12.0.0.1/32 Direct 0 0 D 127.0.0.1 GigabitEthernet0/0/0 192.168.1.0/24 Direct 0 0 D 192.168.1.1 LoopBack0 192.168.1.1/32 Direct 0 0 D 127.0.0.1 LoopBack0 192.168.2.0/24 Static 60 0 D 12.0.0.2 GigabitEthernet0/0/0验证结论AR1 的路由表包含默认路由和指向右侧私网的静态路由配置正确。ISP 路由表验证[ISP] display ip routing-table Route Flags: R - relay, D - download to fib ------------------------------------------------------------------------------ Public routing table : Destinations : 6 Routes : 6 Destination/Mask Proto Pre Cost Flags NextHop Interface 12.0.0.0/24 Direct 0 0 D 12.0.0.2 GigabitEthernet0/0/0 12.0.0.2/32 Direct 0 0 D 127.0.0.1 GigabitEthernet0/0/0 23.0.0.0/24 Direct 0 0 D 23.0.0.1 GigabitEthernet0/0/1 23.0.0.1/32 Direct 0 0 D 127.0.0.1 GigabitEthernet0/0/1 192.168.1.0/24 Static 60 0 D 12.0.0.1 GigabitEthernet0/0/0 192.168.2.0/24 Static 60 0 D 23.0.0.2 GigabitEthernet0/0/0验证结论ISP 的路由表包含指向两个私网的静态路由配置正确。AR3 路由表验证[AR3] display ip routing-table Route Flags: R - relay, D - download to fib ------------------------------------------------------------------------------ Public routing table : Destinations : 5 Routes : 5 Destination/Mask Proto Pre Cost Flags NextHop Interface 0.0.0.0/0 Static 60 0 D 23.0.0.1 GigabitEthernet0/0/0 23.0.0.0/24 Direct 0 0 D 23.0.0.2 GigabitEthernet0/0/0 23.0.0.2/32 Direct 0 0 D 127.0.0.1 GigabitEthernet0/0/0 192.168.1.0/24 Static 60 0 D 23.0.0.1 GigabitEthernet0/0/0 192.168.2.0/24 Direct 0 0 D 192.168.2.1 LoopBack0 192.168.2.1/32 Direct 0 0 D 127.0.0.1 LoopBack0验证结论AR3 的路由表包含默认路由和指向左侧私网的静态路由配置正确。全网连通性验证1左侧私网访问右侧私网[AR1] ping 192.168.2.1 PING 192.168.2.1: 56 data bytes, press CTRL_C to break Reply from 192.168.2.1: bytes56 Sequence1 ttl254 time10 ms Reply from 192.168.2.1: bytes56 Sequence2 ttl254 time10 ms Reply from 192.168.2.1: bytes56 Sequence3 ttl254 time10 ms Reply from 192.168.2.1: bytes56 Sequence4 ttl254 time10 ms Reply from 192.168.2.1: bytes56 Sequence5 ttl254 time10 ms --- 192.168.2.1 ping statistics --- 5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max 10/10/10 ms2右侧私网访问左侧私网[AR3] ping 192.168.1.1 PING 192.168.1.1: 56 data bytes, press CTRL_C to break Reply from 192.168.1.1: bytes56 Sequence1 ttl254 time10 ms Reply from 192.168.1.1: bytes56 Sequence2 ttl254 time10 ms Reply from 192.168.1.1: bytes56 Sequence3 ttl254 time10 ms Reply from 192.168.1.1: bytes56 Sequence4 ttl254 time10 ms Reply from 192.168.1.1: bytes56 Sequence5 ttl254 time10 ms --- 192.168.1.1 ping statistics --- 5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max 10/10/10 ms3私网访问公网网段[AR1] ping 23.0.0.2 PING 23.0.0.2: 56 data bytes, press CTRL_C to break Reply from 23.0.0.2: bytes56 Sequence1 ttl254 time10 ms Reply from 23.0.0.2: bytes56 Sequence2 ttl254 time10 ms Reply from 23.0.0.2: bytes56 Sequence3 ttl254 time10 ms Reply from 23.0.0.2: bytes56 Sequence4 ttl254 time10 ms Reply from 23.0.0.2: bytes56 Sequence5 ttl254 time10 ms --- 23.0.0.2 ping statistics --- 5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max 10/10/10 ms验证结论全网连通性正常两个私网可以通过公网互相访问。实验重难点分析难点 1双向静态路由配置问题原因静态路由是单向的只配置一个方向的路由会导致数据包能发出去但回不来出现单向通的问题解决方案必须在所有路由器上配置双向静态路由确保数据包能够往返本实验验证ISP 必须同时配置指向 AR1 和 AR3 的静态路由否则两个私网无法互通难点 2默认路由的使用问题原因如果私网出口路由器需要访问多个公网网段配置多条静态路由会非常繁琐解决方案使用默认路由代替多条静态路由简化配置本实验验证AR1 和 AR3 使用默认路由指向 ISP不需要配置指向所有公网网段的静态路由难点 3下一跳地址的选择问题原因静态路由的下一跳必须是直连网段的 IP 地址否则路由无法生效解决方案下一跳地址必须是对端设备的直连接口 IP 地址本实验验证AR1 的下一跳是 ISP 的 GE0/0/0 接口 IP12.0.0.2而不是 ISP 的其他接口 IP实验总结知识点总结静态路由手动配置的路由条目优先级最高适用于小型网络默认路由特殊的静态路由用于匹配所有未明确指定的路由私网跨公网互通需要在公网路由器上配置指向两个私网的静态路由双向路由静态路由是单向的必须配置双向路由才能实现互通下一跳地址静态路由的下一跳必须是直连网段的 IP 地址常见错误与排障错误现象原因解决方案单向通能 ping 出去但回不来只配置了一个方向的静态路由配置双向静态路由静态路由不生效下一跳地址错误或接口未 up检查下一跳地址确保接口已启用无法访问公网未配置默认路由或默认路由下一跳错误配置正确的默认路由路由表中没有静态路由静态路由配置错误或子网掩码错误检查静态路由命令修正子网掩码附录完整配置文件AR1配置# sysname AR1 # interface GigabitEthernet0/0/0 ip address 12.0.0.1 255.255.255.0 # interface LoopBack0 ip address 192.168.1.1 255.255.255.0 # ip route-static 0.0.0.0 0.0.0.0 12.0.0.2 ip route-static 192.168.2.0 255.255.255.0 12.0.0.2 # returnISP 配置# sysname ISP # interface GigabitEthernet0/0/0 ip address 12.0.0.2 255.255.255.0 # interface GigabitEthernet0/0/1 ip address 23.0.0.1 255.255.255.0 # ip route-static 192.168.1.0 255.255.255.0 12.0.0.1 ip route-static 192.168.2.0 255.255.255.0 23.0.0.2 # returnAR3 配置# sysname AR3 # interface GigabitEthernet0/0/0 ip address 23.0.0.2 255.255.255.0 # interface LoopBack0 ip address 192.168.2.1 255.255.255.0 # ip route-static 0.0.0.0 0.0.0.0 23.0.0.1 ip route-static 192.168.1.0 255.255.255.0 23.0.0.1 # return