华为策略路由配置实例.docx
《华为策略路由配置实例.docx》由会员分享,可在线阅读,更多相关《华为策略路由配置实例.docx(9页珍藏版)》请在冰豆网上搜索。
![华为策略路由配置实例.docx](https://file1.bdocx.com/fileroot1/2023-4/20/a4f286c0-2531-4f36-befa-f65b97faac26/a4f286c0-2531-4f36-befa-f65b97faac261.gif)
华为策略路由配置实例
华为策略路由配置实例
1、组网需求
20.1.20.1/24
贷司20.1.30JZ24
图1策略路由组网示例图
如上图1所示,公司用户通过Switch双归属到外部网络设备。
其中,一条是
低速链路,网关为10.1.20.1/24;另外一条是高速链路,网关为10.1.30.1/24。
公司希望上送外部网络的报文中,IP优先级为4、5、6、7的报文通过高速
链路传输,而IP优先级为0、1、2、3的报文则通过低速链路传输。
2、配置思路
1、创建VLAN并配置各接口,实现公司和外部网络设备互连。
2、配置ACL规则,分别匹配IP优先级4、5、6、7,以及IP优先级0、1、2、
3、
3、配置流分类,匹配规则为上述ACL规则,使设备可以对报文进行区分。
4、配置流行为,使满足不同规则的报文分别被重定向到10.1.20.1/24和
10.1.30.1/24。
5、配置流策略,绑定上述流分类和流行为,并应用到接口GE2/0/1的入方向上,实现策略路由。
3、操作步骤
3.1、创建VLAN并配置各接口
#在Switch上创建VLAN100和VLAN200。
system-view
[HUAWEI]sysnameSwitch
[Switch]vianbatch100200
#配置Switch上接口GE1/0/1、GE1/0/2和GE2/0/1的接口类型为Trunk,并加入VLAN100和VLAN200。
[Switch]interfacegigabitethernet1/0/1
[Switch-GigabitEthernet1/0/1]
portlink-typetrunk
[Switch-GigabitEthernet1/0/1]
porttrunkallow-passvlan100200
[Switch-GigabitEthernet1/0/1]
quit
[Switch]interfacegigabitethernet1/0/2
[Switch-GigabitEthernet1/0/2]
portlink-typetrunk
[Switch-GigabitEthernet1/0/2]
porttrunkallow-passvlan100200
[Switch-GigabitEthernet1/0/2]
quit
[Switch]interfacegigabitethernet2/0/1
[Switch-GigabitEthernet2/0/1]
portlink-typetrunk
[Switch-GigabitEthernet2/0/1]
porttrunkallow-passvlan100200
[Switch-GigabitEthernet2/0/1]
quit
配置LSW与Switch对接的接口为Trunk类型接口,并加入VLAN100和
VLAN200。
#创建VLANIF100和VLANIF200,并配置各虚拟接口IP地址
[Switch]interfacevianif100
[Switch-Vianif100]ipaddress10.1.20.224
[Switch-Vianif100]quit
[Switch]interfacevianif200
[Switch-Vianif200]ipaddress10.1.30.224
[Switch-Vianif200]quit
3.2、配置ACL规贝U
IP优先
#在Switch上创建编码为3001、3002的高级ACL,规则分别为允许
级0、1、2、3和允许IP优先级4、5、6、7的报文通过
[Switch]aci3001
[Switch-aci-adv-3001]
[Switch-aci-adv-3001]
[Switch-aci-adv-3001]
[Switch-aci-adv-3001]
[Switch-aci-adv-3001]
[Switch]aci3002
[Switch-aci-adv-3002]
ruiepermitipprecedenee0
ruiepermitipprecedenee1
ruiepermitipprecedenee2
ruiepermitipprecedenee3quit
ruiepermitipprecedenee4
[Switch-acl-adv-3002]
rulepermitipprecedenee5
[Switch-acl-adv-3002]
rulepermitipprecedenee6
[Switch-acl-adv-3002]
rulepermitipprecedenee7
[Switch-acl-adv-3002]
quit
3.3、配置流分类
在Switch上创建流分类cl、c2,匹配规则分别为ACL3001
和ACL3002。
[Switch]trafficclassifierc1operatorand
[Switch-classifier-c1]
if-matchacl3001
[Switch-classifier-c1]
quit
[Switch]trafficclassifierc2operatorand
[Switch-classifier-c2]
if-matchacl3002
[Switch-classifier-c2]
quit
3.4、配置流行为
#在Switch上创建流行为b1、b2,并分别指疋重疋向到网段
10.1.20.1/24和
10.1.30.1/24的动作。
[Switch]trafficbehaviorb1
[Switch-behavior-b1]
redirectip-nexthop10.1.20.1
[Switch-behavior-b1]
quit
[Switch]trafficbehaviorb2
[Switch-behavior-b2]
redirectip-nexthop10.1.30.1
[Switch-behavior-b2]quit
3.5、配置流策略并应用到接口上
[Switch]trafficpolicypl
[Switch]interfacegigabitethernet2/0/1
traffic-policyp1inbound
return
[Switch-GigabitEthernet2/0/1][Switch-GigabitEthernet2/0/1]
3.6、验证配置结果#查看ACL规则的配置信息。
displayacl3001
AdvaneedACL3001,4rules
Acl'sstepis5
rule5permitipprecedeneeroutine(match-counter0)
rule10permitipprecedeneepriority(match-counter0)
rule15permitipprecedeneeimmediate(match-counter0)
rule20permitipprecedeneeflash(match-counter0)
displayacl3002
AdvaneedACL3002,4rules
Acl'sstepis5
rule5permitipprecedeneeflash-override(match-counter0)
rule10permitipprecedeneecritical(match-counter0)
rule15permitipprecedeneeinternet(match-counter0)
rule20permitipprecedeneenetwork(match-counter0)
#查看流分类的配置信息。
displaytrafficclassifieruser-defined
UserDefinedClassifierInformation:
Classifier:
cl
Precedenee:
5
Operator:
AND
Rule(s):
if-matchacl3001
Classifier:
c2
Precedenee:
10
Operator:
AND
Rule(s):
if-matchacl3002
Totalclassifiernumberis2
#查看流策略的配置信息。
displaytrafficpolicyuser-definedpl
UserDefinedTrafficPolicyInformation:
Policy:
p1
Classifier:
c1
Operator:
AND
Behavior:
b1
Redirect:
noforced
Redirectip-nexthop
10.1.20.1
Classifier:
c2
Operator:
AND
Behavior:
b2
Redirect:
noforced
Redirectip-nexthop
10.1.30.1
4、配置文件
Switch的配置文件
sysnameSwitch
#
vlanbatch100200
#
aclnumber3001
rule5permitipprecedeneeroutine
rule10permitipprecedeneepriority
rule15permitipprecedeneeimmediate
rule20permitipprecedeneeflash
#
aclnumber3002
rule5permitipprecedeneeflash-override
rule10permitipprecedeneecritical
rule15permitipprecedeneeinternet
rule20permitipprecedeneenetwork
#
trafficclassifierc1operatorandprecedenee5
if-matchacl3001
trafficclassifierc2operatorandprecedenee10
if-matchacl3002
#
trafficbehaviorbl
redirectip-nexthop10.1.20.1
trafficbehaviorb2
redirectip-nexthop10.1.30.1
#
trafficpolicyp1match-orderconfig
classifierc1behaviorb1
classifierc2behaviorb2
#
interfaceVianif100
ipaddress10.1.20.2255.255.255.0
#
interfaceVianif200
ipaddress10.1.30.2255.255.255.0
#
interfaceGigabitEthernet1/0/1
portlink-typetrunk
porttrunkaiiow-passvian100200
#
interfaceGigabitEthernet1/0/2
portlink-typetrunk
porttrunkaiiow-passvian100200
interfaceGigabitEthernet2/0/1
portlink-typetrunk
porttrunkallow-passvlan100200
traffic-policyp1inbound
#
return
[此文档可自行编辑修改,如有侵权请告知删除,感谢您的支持,我们会努力把内容做得更
好]