H3C网络学院路由互换第四卷实验指导书.docx
《H3C网络学院路由互换第四卷实验指导书.docx》由会员分享,可在线阅读,更多相关《H3C网络学院路由互换第四卷实验指导书.docx(99页珍藏版)》请在冰豆网上搜索。
![H3C网络学院路由互换第四卷实验指导书.docx](https://file1.bdocx.com/fileroot1/2022-11/26/405f549e-50b0-4b60-b281-bc067ca96e61/405f549e-50b0-4b60-b281-bc067ca96e611.gif)
H3C网络学院路由互换第四卷实验指导书
实验1配置GREVPN
实验任务一:
GREVPN大体配置
步骤一:
搭建实验环境
在SWA上配置VLAN2,将接口E1/0/2加入VLAN2:
[SWA]vlan2
[SWA-vlan2]portEthernet1/0/2
步骤二:
检测公网连通性
查看SWA的路由表和端口状态,确认其工作正常。
[SWA]displayipinterfacebrief
*down:
administrativelydown
(s):
spoofing
InterfacePhysicalProtocolIPAddressDescription
Vlan-interface1upup.2Vlan-inte...
Vlan-interface2upup.2Vlan-inte...
[SWA]displayiprouting-table
RoutingTables:
Public
Destinations:
6Routes:
6
Destination/MaskProtoPreCostNextHopInterface
.0/24Direct00.2Vlan1
.2/32Direct00InLoop0
.0/24Direct00.2Vlan2
.2/32Direct00InLoop0
Direct00InLoop0
Direct00InLoop0
也能够利用displayinterface命令。
在RTA和RTB上配置公网接口互通所需的静态路由。
[RTA]interfaceGigabitEthernet0/0
[RTA-GigabitEthernet0/0]ipaddressGigabitEthernet0/1
[RTA-GigabitEthernet0/1]ipaddress.1route-static.0GigabitEthernet0/0
[RTB-GigabitEthernet0/0]ipaddressGigabitEthernet0/1
步骤三:
[RTB-GigabitEthernet0/1]ipaddress.1route-static.0配置GRE隧道接口
[RTA]interfaceTunnel0
[RTA-Tunnel0]ipaddresssource.1
[RTA-Tunnel0]destination.1
[RTB]interfaceTunnel0
[RTB-Tunnel0]ipaddresssource.1
[RTB-Tunnel0]destination.1
步骤四:
为私网配置静态路由
[RTA]iproute-staticTunnel0
[RTB]iproute-staticTunnel0
配置时也能够用下一跳地址。
步骤五:
查验隧道工作状况
查看RTA与RTB的路由表,可见公网、私网路由均存在于路由表中:
[RTB]displayiprouting-table
RoutingTables:
Public
Destinations:
10Routes:
10
Destination/MaskProtoPreCostNextHopInterface
.0/24Static600.2GE0/1
.0/24Direct00.1GE0/1
.1/32Direct00InLoop0
Direct00InLoop0
Direct00InLoop0
Static600Tun0
Direct00GE0/0
Direct00InLoop0
Direct00Tun0
Direct00InLoop0
查看RTA和RTB的隧道接口状态,可见其利用GRE封装,状态为UP:
[RTB]displayinterfaceTunnel0
Tunnel0currentstate:
UP
Lineprotocolcurrentstate:
UP
Description:
Tunnel0Interface
TheMaximumTransmitUnitis1476
InternetAddressisPrimary
EncapsulationisTUNNEL,service-loopback-groupIDnotset.
Tunnelsource.1,destinationkeepalivedisable
Tunnelprotocol/transportGRE/IP
GREkeydisabled
ChecksummingofGREpacketsdisabled
Outputqueue:
(Urgentqueuing:
Size/Length/Discards)0/100/0
Outputqueue:
(Protocolqueuing:
Size/Length/Discards)0/500/0
Outputqueue:
(FIFOqueuing:
Size/Length/Discards)0/75/0
Last300secondsinput:
15bytes/sec,0packets/sec
Last300secondsoutput:
21bytes/sec,0packets/sec
133packetsinput,5701bytes
0inputerror
124packetsoutput,7469bytes
0outputerror
在RTA上打开GRE协议调试开关用debugging命令查验路由器实际收发的报文,说明其地址已经改变。
terminalmonitor
terminaldebugging
debugginggrepacket
在PCA上对RTB运行ping命令,但只发送一个ICMP包:
C:
\DocumentsandSettings\User>ping-n1with32bytesofdata:
Replyfrombytes=32time<1msTTL=254
PingstatisticsforPackets:
Sent=1,Received=1,Lost=0(0%loss),
Approximateroundtriptimesinmilli-seconds:
Minimum=0ms,Maximum=0ms,Average=0ms
观看RTA上的输出信息:
*Jun2616:
15:
30:
4432020RTAGRE/7/debug:
Tunnel0packet:
Afterencapsulation,
Outgoingpacketheader.1->=84)
*Jun2616:
15:
30:
4432020RTAGRE/7/debug:
Output:
Grepackethasbeenfast-switc
hedsuccessfully,interfaceindexis0x2f0000.
可见RTA从Tunnel0接口发出了一个包,源地址为.1,目的地址为。
因为发送的包已经被GRE封装后在公网发送了。
步骤六:
清除静态路由
用undoiproute-static命令。
步骤七:
为公网配置动态路由
[RTA]ospf1
[RTA-ospf-1]
[]network1
[RTB-ospf-1]
[]network1
[SWA-ospf-1]
步骤八:
[]network为私网配置动态路由
[RTA]rip1
[RTA-rip-1]version2
[RTA-rip-1]network2
步骤九:
[RTB-rip-1]network再次查验隧道工作状况
查看RTA与RTB的路由表:
displayiprouting-table
RoutingTables:
Public
Destinations:
10Routes:
10
Destination/MaskProtoPreCostNextHopInterface
.0/24OSPF102.2GE0/1
.0/24Direct00.1GE0/1
.1/32Direct00InLoop0
Direct00InLoop0
Direct00InLoop0
RIP1001Tun0
Direct00GE0/0
Direct00InLoop0
Direct00Tun0
Direct00InLoop0
转入下一实验任务。
实验任务二:
GREVPN隧道验证
步骤一:
单方配置隧道验证
第一在RTA上单方启动隧道验证:
[RTA-Tunnel0]grekey1234
步骤二:
查验隧道连通性
用ping命令验证PCA与PCB之间的连通性。
由于仅单方配置了隧道验证,现在应该无法连通。
C:
\DocumentsandSettings\User>pingwith32bytesofdata:
Requesttimedout.
Requesttimedout.
Requesttimedout.
Requesttimedout.
PingstatisticsforPackets:
Sent=4,Received=0,Lost=4(100%loss),
步骤三:
配置错误的隧道验证
在RTB上也启动隧道验证,但验证值配置与RTA不同:
[RTB-Tunnel0]grekey12345
步骤四:
查验隧道连通性
用ping命令验证PCA与PCB之间的连通性。
由于配置的隧道验证值错误,现在应该无法连通。
C:
\DocumentsandSettings\User>pingwith32bytesofdata:
Requesttimedout.
Requesttimedout.
Requesttimedout.
Requesttimedout.
PingstatisticsforPackets:
Sent=4,Received=0,Lost=4(100%loss),
步骤五:
正确配置隧道验证
在RTB上配置与RTA相同的验证值:
[RTB-Tunnel0]grekey1234
步骤六:
查验隧道连通性
用ping命令验证PCA与PCB之间的连通性。
由于配置的隧道验证正确,现在应该能够连通。
C:
\DocumentsandSettings\User>pingwith32bytesofdata:
Replyfrombytes=32time=1msTTL=254
Replyfrombytes=32time<1msTTL=254
Replyfrombytes=32time<1msTTL=254
Replyfrombytes=32time<1msTTL=254
PingstatisticsforPackets:
Sent=4,Received=4,Lost=0(0%loss),
Approximateroundtriptimesinmilli-seconds:
Minimum=0ms,Maximum=1ms,Average=0ms
注意:
由于RTA和RTB上配置了RIP路由,若是隧道验证值长时刻不匹配,RIP会删除来自对方的私网路由。
在这种情形下,配置了正确的隧道验证值后需要等待RIP从头学习路由。
实验任务三:
GREVPN隧道Keepalive
步骤一:
恢复静态路由配置
[RTA]undorip
Warning:
UndoRIPprocess?
[Y/N]:
y
[RTA]undoospf
Warning:
UndoOSPFprocess?
[Y/N]:
y
[RTA]iproute-staticTunnel0
[RTA]iproute-static.0rip
Warning:
UndoRIPprocess?
[Y/N]:
y
[RTB]undoospf
Warning:
UndoOSPFprocess?
[Y/N]:
y
[RTB]iproute-staticTunnel0
步骤二:
[RTB]iproute-static.0模拟网络故障
[SWA-Vlan-interface2]shutdown
步骤三:
检查RTA上的隧道接口状态
在RTA上检查隧道接口状态,发觉隧道接口状态仍然正常:
[RTA]displayinterfaceTunnel0
Tunnel0currentstate:
UP
Lineprotocolcurrentstate:
UP
Description:
Tunnel0Interface
TheMaximumTransmitUnitis1472
InternetAddressisPrimary
EncapsulationisTUNNEL,service-loopback-groupIDnotset.
Tunnelsource.1,destinationkeepalivedisable
Tunnelprotocol/transportGRE/IP
GREkeyvalueis1234
ChecksummingofGREpacketsdisabled
Outputqueue:
(Urgentqueuing:
Size/Length/Discards)0/100/0
Outputqueue:
(Protocolqueuing:
Size/Length/Discards)0/500/0
Outputqueue:
(FIFOqueuing:
Size/Length/Discards)0/75/0
Last300secondsinput:
0bytes/sec,0packets/sec
Last300secondsoutput:
0bytes/sec,0packets/sec
1016packetsinput,100223bytes
10inputerror
981packetsoutput,41128bytes
0outputerror
这说明其无法了解对端转变情形。
这是因为在RTA上,隧道源地址所属接口正常,隧道目的地址所需的路由仍然存在。
步骤四:
恢复网络故障
[SWA-Vlan-interface2]undoshutdown
步骤五:
配置隧道Keepalive
[RTA]interfaceTunnel0
[RTA-Tunnel0]keepalive
[RTB]interfaceTunnel0
[RTB-Tunnel0]keepalive
步骤六:
模拟网络故障
在RTA上启动debugging开关:
terminalmonitor
terminaldebugging
debugginggreall
debuggingtunnelall
关闭SWA的VLAN2接口,模拟公网路由突然发生故障。
[SWA-Vlan-interface2]shutdown
步骤七:
观看成效,查验隧道连通性
在RTA上观看debugging信息。
输出信息形如:
*Jun2617:
31:
54:
7942020RTATUNNEL/7/debug:
Tunnel0linkstateisUP,nochange.
*Jun2617:
31:
55:
5082020RTATUNNEL/7/debug:
Beforeencapsulation,thepacket'sulLoopTimesis0.
......
......
*Jun2617:
32:
55:
9682020RTATUNNEL/7/debug:
Beforeencapsulation,thepacket'sulLoopTimesis0.
*Jun2617:
33:
00:
2932020RTATUNNEL/7/debug:
Tunnel0linkstateisUP,nochange.
*Jun2617:
33:
05:
3322020RTATUNNEL/7/debug:
Tunnel0linkstateisUP,nochange.
*Jun2617:
33:
06:
452020RTATUNNEL/7/debug:
Beforeencapsulation,thepacket'sulLoopTimesis0.
*Jun2617:
33:
10:
3692020RTATUNNEL/7/debug:
Tunnel0linkstateisUP,nochange.
*Jun2617:
33:
15:
4082020RTATUNNEL/7/debug:
Tunnel0linkstateisUP,nochange.
%Jun2617:
33:
16:
1682020RTATUNNEL/4/LINKUPDOWN:
Tunnel0:
linkstatusisDOWN
%Jun2617:
33:
16:
1682020RTAIFNET/4/UPDOWN:
LineprotocolontheinterfaceTunnel0isDOWN
*Jun2617:
33:
16:
1682020RTATUNNEL/7/debug:
Tunnel0down,becausekeepaliveisnotreached.
*Jun2617:
33:
16:
1692020RTATUNNEL/7/debug:
CannotgettunnelIDwhentunnel(index=0x2f0000)stateisdown.
*Jun2617:
33:
16:
1692020RTATUNNEL/7/debug:
Tunnel_DelTunnInUpTunnTbl:
Thetunnel(0x2f0000)stateisdown.
*Jun2617:
33:
16:
1692020RTATUNNEL/7/debug:
Beforeencapsulation,thepacket'sulLoopTimesis0.
*Jun2617:
33:
20:
4512020RTATUNNEL/7/debug:
Tunnel0down,becausekeepaliveisnotreached.
*Jun2617:
33:
20:
4512020RTATUNNEL/7/debug:
Tunnel0linkstateisDOWN,nochange.
*Jun2617:
33:
25:
4902020RTATUNNEL/7/debug:
Tunnel0down,becausekeepaliveisnotreached.
*Jun2617:
33:
25:
4902020RTATUNNEL/7/debug:
Tunnel0linkstateisDOWN,nochange.
*Jun2617:
33:
26:
2032020RTATUNNEL/7/debug:
可见通过一段时刻后,Tunnel0接口状态变成DOWN,依照debugging信息,缘故是keepalive消息丢失。
关闭debugging开关,查看Tunnel0接口信息:
undodebuggingall
Allpossibledebugginghasbeenturnedoff
displayinterfacetunnel0
Tunnel0currentstate:
DOWN
Lineprotocolcurrentstate:
DOWN
Description:
Tunnel0Interface
TheMaximumTransmitUnitis1472
InternetAddressisPrimary
EncapsulationisTUNNEL,service-loopback-groupIDnotset.
Tunnelsource.1,destinationkeepaliveenable,Period(10s),Retries(3)
Tunnelprotocol/transportGRE/IP
GREkeyvalueis1234
ChecksummingofGREpacketsdisabled
Outputqueue:
(Urgentqueuing:
Size/Length/Discards)0/100/0
Outputqueue:
(Protocolqueuing:
Size/Length/Discards)0/500/0
Outputqueue:
(FIFOqueuing:
Size/Length/Discards)0/75/0
Last300secondsinput:
2bytes/sec,0packets/sec
Last300secondsoutput:
2bytes/sec,0packets/sec
1115packetsinput,101679bytes
10inputerror
1084packetsoutput,44012bytes
0outputerror
可见Tunnel0接口状态确实已经变成DOWN。
在SWA上从头打开VLAN2接口,过一段时刻以后,Tunnel0接口状态和PCA与PCB之间的连通性能够恢复正常。
实验2配置L2TPVPN
实验任务一:
配置独立LAC模式
步骤一:
搭建实验环境
连接设备。
在SWA上配置VLAN2,将接口E1/0/2加入VLAN2。
[SWA]vlan2
[SWA-vlan2]portEthernet1/0/2
步骤二:
检测公网连通性
查看SWA的路由表和端口状态,确认其工作正常。
[SWA]displayipinterfacebrief
*down:
administrativelydown
(s):
spoofing
Interfa