拨号VPN运行动态路由

组网需求

某公司总部内部有一台OA服务器,其余分2个支机构都需要通过vpn拨入总部内网对OA服务器进行访问,为了方便配置,总部不想有太多的配置,总部只建立一条vpn隧道,实现所有分支机构和总部的通讯。同时需要运行动态路由协议将总部和分支的路由全部打通,SPOKE之间的流量通过HUB进行中转。

网络拓扑

HUB and SPOKE通过动态路由学习到整网的业务网段路由,SPOKE之间相互的流量通过HUB进行中转。

image-20240102143844149

VPN Tunnel IP地址分配,以及BGP的规划:

角色 公网IP 私网网段 VPN隧道IP BGP信息
HUB 100.1.1.2 192.168.0.1/24 10.10.10.1 AS 65001 RR
SPOKE1 200.1.1.2 192.168.1.1/24 10.10.10.2 AS 65001 RR Client
SPOKE2 201.1.1.2 192.168.2.1/24 10.10.10.3 AS 65001 RR Client
SPOKE3 ... ... ... ...
SPOKEX ... ... ... ...

配置步骤

HUB端配置

  1. 基本配置

    配置接口IP和路由

    image-20221208113336372

    image-20221208113353399

  2. 配置IPSEC VPN

    创建IPSEC VPN。

    image-20221213194104003

    IPSEC VPN阶段一配置。

    由于HUB和SPOKE之间是通过动态路由学习,因此“添加路由”选项禁用,不用HUB自动学习SPOKE的路由;Exchange接口IP打开,需要交换HUB和SPOKE之间VPN接口的IP。

    image-20221215100101646

    image-20221215100138945

    IPSEC VPN阶段二配置。

    image-20221215095427842

    创建完成。

    image-20221215095903924

    对应的命令行

    config vpn ipsec phase1-interface
        edit "HUB"
            set type dynamic
            set interface "port2"
            set peertype any
            set net-device disable
            set exchange-interface-ip enable
            set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
            set add-route disable
            set dpd on-idle
            set psksecret ENC m9c6Qk4uhwWLRTRDI2EzYQym02Uma0709h07KB2pmS0Ek+8ZUOpRTH6OZdFEZPdlZktXajf/KRkR6SNO7UwW27pYAWoRygwcWhvJrO67tIWl5AksoOX3uy2YTjFX+kVbrw5WTVoLogqtJ4yPk7coZpMKUvqJkAv8flqIIi3EfY4TgY2avzSOkBVm8ZLgokTkmt3PMQ==
            set dpd-retryinterval 10
        next
    end
    config vpn ipsec phase2-interface
        edit "HUB"
            set phase1name "HUB"
            set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
            set keepalive enable
        next
    end
    
  3. 配置VPN接口IP

    HUB端的”对端网关IP“ 10.10.10.254是不被Spoke所使用的预留IP,IPsec Tunnel是一个点对点的隧道,但是ADVPN中这条隧道需要同时对应多个SPOKE,因此不能将Remote IP写成一个存在的SPOKE端IP。

    image-20221215101720253

  4. 配置策略

    创建3条策略,从上到下分别是:分支到总部的放通策略;总部到分支的放通策略;分支到分支的放通策略。

    image-20221214160517503

SPOKE1配置

  1. 基本配置

    image-20221214162213946

    image-20221214162239707

  2. 配置IPSEC VPN

    创建IPSEC VPN。

    image-20221214165632599

    IPSEC VPN阶段一配置。

    由于HUB和SPOKE之间是通过动态路由学习,因此Exchange接口IP打开,需要交换HUB和SPOKE之间VPN接口的IP;SPOKE1是静态IPSEC,所以“添加路由”选项对SPOKE1没有意义,不用关注。

    image-20221215103408813

    image-20221215104602390

    IPSEC VPN阶段二配置。

    第二阶段感兴趣流配置为0.0.0.0/0.0.0.0,后续通过动态路由将流量指向VPN隧道。

    image-20221215104808931

    VPN创建完成。

    image-20221215110332396

    对应的命令行

    config vpn ipsec phase1-interface
        edit "SPOKE1"
            set interface "port2"
            set peertype any
            set net-device disable
            set exchange-interface-ip enable
            set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
            set remote-gw 100.1.1.2
            set psksecret ENC SasMccP3qWqglxEV1I2Z8ESNcmdXyPqkxyIoMpEM3haEKdLyi6qcOoc9WtdukEH2zXuV/bcVW6HyYqi8rh+KZ533z7cH6zqNpXCrOicxBYDXrEPVU6NXtp4UgL+bqiG6Vm1FzA62V+YN4Rfchkuk49CuipVrer1xFqqIgXQVxM5GVuq+5wFvtWf5VBeuFbw+GHJlPQ==
            set dpd-retryinterval 10
        next
    end
    config vpn ipsec phase2-interface
        edit "SPOKE1"
            set phase1name "SPOKE1"
            set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
            set auto-negotiate enable
        next
    end
    
  3. 配置VPN接口IP

    SPOKE1的“对端网关IP”是指向HUB的。

    image-20221215111253498

  4. 配置策略

    由于SPOKE1开启了自动连接,当配置策略后,就会主动与HUB协商,策略中的接口已经是绿色的,说明VPN接口已经UP。

    image-20221215110642482

SPOKE2配置

  1. 基本配置

    image-20221220162634189

    image-20221220162733153

  2. 配置IPSEC VPN

    创建IPSEC VPN。

    image-20221214172654235

    IPSEC VPN阶段一配置。

    由于HUB和SPOKE之间是通过动态路由学习,因此Exchange接口IP打开,需要交换HUB和SPOKE之间VPN接口的IP;SPOKE2是静态IPSEC,所以“添加路由”选项对SPOKE2没有意义,不用关注。

    image-20221215113835201

    image-20221215104602390

    IPSEC VPN阶段二配置。

    第二阶段感兴趣流配置为0.0.0.0/0.0.0.0,后续通过动态路由将流量指向VPN隧道。

    image-20221215104808931

    VPN创建完成。

    image-20221215114107200

    对应的命令行

    config vpn ipsec phase1-interface
        edit "SPOKE2"
            set interface "port2"
            set peertype any
            set net-device disable
            set exchange-interface-ip enable
            set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
            set remote-gw 100.1.1.2
            set psksecret ENC H3nAayIN5AWs3FomZpZri+tl6IAqg3iVu66h3qNXTjw1oSkiHauyAa/IUNw4xeJxD5dmiLfcAd/zzDb6BVai19ekg0Qvejqy39Mxr9UaRniPKE4dvoaoVLWy4OvamxRzf82+JAUYKlF0NvVlMQ/+0JUYOunFeUlLLtht4dW69X9VTXfEBdwav496AzfYgI4gRTFFSg==
            set dpd-retryinterval 10
        next
    end
    config vpn ipsec phase2-interface
        edit "SPOKE2"
            set phase1name "SPOKE2"
            set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
            set auto-negotiate enable
        next
    end
    
  3. 配置VPN接口IP

    SPOKE2的“对端网关IP”是指向HUB的。

    image-20221215114535418

  4. 配置策略

    由于SPOKE2开启了自动连接,当配置策略后,就会主动与HUB协商,策略中的接口已经是绿色的,说明VPN接口已经UP。

    image-20221214174424648

查看VPN状态和路由表

  1. HUB端VPN状态和路由表

    image-20221220165510277

    # diagnose vpn ike gateway  list 
    
    vd: root/0
    name: HUB_0
    version: 1
    interface: port2 10
    addr: 100.1.1.2:500 -> 200.1.1.2:500
    tun_id: 200.1.1.2/::10.0.0.4
    remote_location: 0.0.0.0
    network-id: 0
    virtual-interface-addr: 10.10.10.1 -> 0.0.0.0
    created: 33s ago
    IKE SA: created 1/1  established 1/1  time 0/0/0 ms
    IPsec SA: created 1/1  established 1/1  time 0/0/0 ms
    
      id/spi: 2 b114b317daa486b7/29ede80ef4398500
      direction: responder
      status: established 33-33s ago = 0ms
      proposal: aes128-sha256
      key: 770b2cdeba34d096-8edcf542d0c07ef5
      lifetime/rekey: 86400/86096
      DPD sent/recv: 00000004/00000000
    
    vd: root/0
    name: HUB_1
    version: 1
    interface: port2 10
    addr: 100.1.1.2:500 -> 201.1.1.2:500
    tun_id: 201.1.1.2/::10.0.0.5
    remote_location: 0.0.0.0
    network-id: 0
    virtual-interface-addr: 10.10.10.1 -> 0.0.0.0
    created: 22s ago
    IKE SA: created 1/1  established 1/1  time 0/0/0 ms
    IPsec SA: created 1/1  established 1/1  time 0/0/0 ms
    
      id/spi: 3 a0d49273057cb2d8/146f94f98305de8d
      direction: responder
      status: established 22-22s ago = 0ms
      proposal: aes128-sha256
      key: 4dc2b68b5795fd1c-0a400a810f439a19
      lifetime/rekey: 86400/86107
      DPD sent/recv: 00000000/00000008
    
    FGT-wangxiang-used # diagnose vpn  tunnel list 
    list all ipsec tunnel in vd 0
    ------------------------------------------------------
    name=HUB_0 ver=1 serial=4 100.1.1.2:0->200.1.1.2:0 tun_id=200.1.1.2 tun_id6=::10.0.0.4 dst_mtu=1500 dpd-link=on weight=1
    bound_if=10 lgwy=static/1 tun=intf mode=dial_inst/3 encap=none/8872 options[22a8]=npu rgwy-chg frag-rfc  run_state=0 role=primary accept_traffic=1 overlay_id=0
    
    parent=HUB index=0
    proxyid_num=1 child_num=0 refcnt=5 ilast=5 olast=5 ad=/0
    stat: rxp=0 txp=0 rxb=0 txb=0
    dpd: mode=on-idle on=1 idle=10000ms retry=3 count=0 seqno=4
    natt: mode=none draft=0 interval=0 remote_port=0
    proxyid=HUB proto=0 sa=1 ref=2 serial=1
      src: 0:0.0.0.0-255.255.255.255:0
      dst: 0:0.0.0.0-255.255.255.255:0
      SA:  ref=3 options=226 type=00 soft=0 mtu=1438 expire=43155/0B replaywin=2048
           seqno=1 esn=0 replaywin_lastseq=00000000 qat=0 rekey=0 hash_search_len=1
      life: type=01 bytes=0/0 timeout=43191/43200
      dec: spi=d87e91b4 esp=aes key=16 f598636b2f6feb532e32f883300f4595
           ah=sha1 key=20 663bcb60b48c072daebdc011e27c35836e2f45eb
      enc: spi=d56f5619 esp=aes key=16 f3059875bf7c1915eb711a5355a603a8
           ah=sha1 key=20 f8d348a6abdb169781f2e1b3aae099c70d16ea92
      dec:pkts/bytes=0/0, enc:pkts/bytes=0/0
      npu_flag=00 npu_rgwy=200.1.1.2 npu_lgwy=100.1.1.2 npu_selid=2 dec_npuid=0 enc_npuid=0
    ------------------------------------------------------
    name=HUB_1 ver=1 serial=5 100.1.1.2:0->201.1.1.2:0 tun_id=201.1.1.2 tun_id6=::10.0.0.5 dst_mtu=1500 dpd-link=on weight=1
    bound_if=10 lgwy=static/1 tun=intf mode=dial_inst/3 encap=none/8872 options[22a8]=npu rgwy-chg frag-rfc  run_state=0 role=primary accept_traffic=1 overlay_id=0
    
    parent=HUB index=1
    proxyid_num=1 child_num=0 refcnt=5 ilast=4 olast=4 ad=/0
    stat: rxp=1 txp=0 rxb=60 txb=0
    dpd: mode=on-idle on=1 idle=10000ms retry=3 count=0 seqno=2
    natt: mode=none draft=0 interval=0 remote_port=0
    proxyid=HUB proto=0 sa=1 ref=2 serial=1
      src: 0:0.0.0.0-255.255.255.255:0
      dst: 0:0.0.0.0-255.255.255.255:0
      SA:  ref=4 options=226 type=00 soft=0 mtu=1438 expire=43162/0B replaywin=2048
           seqno=1 esn=0 replaywin_lastseq=00000002 qat=0 rekey=0 hash_search_len=1
      life: type=01 bytes=0/0 timeout=43187/43200
      dec: spi=d87e91b5 esp=aes key=16 f7229ae8b4fe965ea7346f41ffae201a
           ah=sha1 key=20 8ada15a3ef8a71fdb3037ee1f7014ca930009cdb
      enc: spi=c7b86106 esp=aes key=16 a6346a22cf40fba236f0cfaacc720261
           ah=sha1 key=20 e093aed38364b32892da5ae4f99413be54a7c635
      dec:pkts/bytes=2/120, enc:pkts/bytes=0/0
      npu_flag=02 npu_rgwy=201.1.1.2 npu_lgwy=100.1.1.2 npu_selid=3 dec_npuid=1 enc_npuid=0
    ------------------------------------------------------
    name=HUB ver=1 serial=1 100.1.1.2:0->0.0.0.0:0 tun_id=10.0.0.1 tun_id6=::10.0.0.1 dst_mtu=0 dpd-link=on weight=1
    bound_if=10 lgwy=static/1 tun=intf mode=dialup/2 encap=none/552 options[0228]=npu frag-rfc  role=primary accept_traffic=1 overlay_id=0
    
    proxyid_num=0 child_num=2 refcnt=4 ilast=42949600 olast=42949600 ad=/0
    stat: rxp=3 txp=0 rxb=180 txb=0
    dpd: mode=on-idle on=0 idle=10000ms retry=3 count=0 seqno=0
    natt: mode=none draft=0 interval=0 remote_port=0
    run_tally=0
    

    查看路由表

    # get router info routing-table  all 
    Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
           O - OSPF, IA - OSPF inter area
           N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
           E1 - OSPF external type 1, E2 - OSPF external type 2
           i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
           * - candidate default
    
    Routing table for VRF=0
    S*      0.0.0.0/0 [10/0] via 100.1.1.1, port2, [1/0]
    C       10.10.10.0/24 is directly connected, HUB
    C       10.10.10.1/32 is directly connected, HUB
    C       100.1.1.0/24 is directly connected, port2
    C       192.168.0.0/24 is directly connected, port5
    

    从HUB端分别ping SPOKE1和SPOKE2的隧道接口地址。

    # execute ping-options source 10.10.10.1
    # execute ping 10.10.10.2
    PING 10.10.10.2 (10.10.10.2): 56 data bytes
    64 bytes from 10.10.10.2: icmp_seq=0 ttl=255 time=0.7 ms
    64 bytes from 10.10.10.2: icmp_seq=1 ttl=255 time=0.4 ms
    64 bytes from 10.10.10.2: icmp_seq=2 ttl=255 time=0.3 ms
    64 bytes from 10.10.10.2: icmp_seq=3 ttl=255 time=0.3 ms
    64 bytes from 10.10.10.2: icmp_seq=4 ttl=255 time=0.4 ms
    
    --- 10.10.10.2 ping statistics ---
    5 packets transmitted, 5 packets received, 0% packet loss
    round-trip min/avg/max = 0.3/0.4/0.7 ms
    
    # execute ping 10.10.10.3
    PING 10.10.10.3 (10.10.10.3): 56 data bytes
    64 bytes from 10.10.10.3: icmp_seq=0 ttl=255 time=0.4 ms
    64 bytes from 10.10.10.3: icmp_seq=1 ttl=255 time=0.4 ms
    64 bytes from 10.10.10.3: icmp_seq=2 ttl=255 time=0.4 ms
    64 bytes from 10.10.10.3: icmp_seq=3 ttl=255 time=0.5 ms
    64 bytes from 10.10.10.3: icmp_seq=4 ttl=255 time=0.2 ms
    
    --- 10.10.10.3 ping statistics ---
    5 packets transmitted, 5 packets received, 0% packet loss
    round-trip min/avg/max = 0.2/0.3/0.5 ms
    
  2. SPOKE1端VPN状态

    image-20221215115321200

    # diagnose vpn  ike gateway  list 
    
    vd: root/0
    name: SPOKE1
    version: 1
    interface: port2 10
    addr: 200.1.1.2:500 -> 100.1.1.2:500
    tun_id: 100.1.1.2/::100.1.1.2
    remote_location: 0.0.0.0
    network-id: 0
    virtual-interface-addr: 10.10.10.2 -> 10.10.10.1
    created: 139s ago
    IKE SA: created 1/1  established 1/1  time 0/0/0 ms
    IPsec SA: created 1/1  established 1/1  time 0/0/0 ms
    
      id/spi: 0 33b5335c7174437e/c89906c6196f3cd7
      direction: initiator
      status: established 139-139s ago = 0ms
      proposal: aes128-sha256
      key: ad3e41d87eb3b8b8-c97c621b25fe9a48
      lifetime/rekey: 86400/85960
      DPD sent/recv: 00000004/0000000a
    
    # diagnose vpn  tunnel list 
    list all ipsec tunnel in vd 0
    ------------------------------------------------------
    name=SPOKE1 ver=1 serial=1 200.1.1.2:0->100.1.1.2:0 tun_id=100.1.1.2 tun_id6=::100.1.1.2 dst_mtu=1500 dpd-link=on weight=1
    bound_if=10 lgwy=static/1 tun=intf mode=auto/1 encap=none/552 options[0228]=npu frag-rfc  run_state=0 role=primary accept_traffic=1 overlay_id=0
    
    proxyid_num=1 child_num=0 refcnt=4 ilast=12 olast=12 ad=/0
    stat: rxp=0 txp=6 rxb=0 txb=360
    dpd: mode=on-demand on=1 idle=10000ms retry=3 count=0 seqno=4
    natt: mode=none draft=0 interval=0 remote_port=0
    proxyid=SPOKE1 proto=0 sa=1 ref=2 serial=1 auto-negotiate
      src: 0:0.0.0.0-255.255.255.255:0
      dst: 0:0.0.0.0-255.255.255.255:0
      SA:  ref=5 options=18227 type=00 soft=0 mtu=1438 expire=42762/0B replaywin=2048
           seqno=7 esn=0 replaywin_lastseq=00000000 qat=0 rekey=0 hash_search_len=1
      life: type=01 bytes=0/0 timeout=42903/43200
      dec: spi=1a45fdb4 esp=aes key=16 373c729e4164750638f8ff0d37dbdd12
           ah=sha1 key=20 323ffd35fb089657505202639ad92371df146881
      enc: spi=a7d1cc77 esp=aes key=16 6da00eca8e15572377040c982e206526
           ah=sha1 key=20 3ea0959e65417277e75bdc5f52bdbc768f33d9b0
      dec:pkts/bytes=0/0, enc:pkts/bytes=12/1080
      npu_flag=01 npu_rgwy=100.1.1.2 npu_lgwy=200.1.1.2 npu_selid=0 dec_npuid=0 enc_npuid=1
    run_tally=0
    

    查看路由表

    # get router info routing-table all 
    Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
           O - OSPF, IA - OSPF inter area
           N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
           E1 - OSPF external type 1, E2 - OSPF external type 2
           i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
           * - candidate default
    
    Routing table for VRF=0
    S*      0.0.0.0/0 [5/0] via 200.1.1.1, port2, [1/0]
    S       10.10.10.0/24 [5/0] via SPOKE1 tunnel 100.1.1.2, [1/0]
    S       10.10.10.1/32 [15/0] via SPOKE1 tunnel 100.1.1.2, [1/0]
    C       10.10.10.2/32 is directly connected, SPOKE1
    C       192.168.1.0/24 is directly connected, port5
    C       200.1.1.0/24 is directly connected, port2
    

    从SPOKE1端ping HUB的隧道地址。

    # execute ping-options source 10.10.10.2
    # execute ping 10.10.10.1
    PING 10.10.10.1 (10.10.10.1): 56 data bytes
    64 bytes from 10.10.10.1: icmp_seq=0 ttl=255 time=0.7 ms
    64 bytes from 10.10.10.1: icmp_seq=1 ttl=255 time=0.4 ms
    64 bytes from 10.10.10.1: icmp_seq=2 ttl=255 time=0.6 ms
    64 bytes from 10.10.10.1: icmp_seq=3 ttl=255 time=0.4 ms
    64 bytes from 10.10.10.1: icmp_seq=4 ttl=255 time=0.6 ms
    
    --- 10.10.10.1 ping statistics ---
    5 packets transmitted, 5 packets received, 0% packet loss
    round-trip min/avg/max = 0.4/0.5/0.7 ms
    
  3. SPOKE2端VPN状态

    image-20221215115459557

    # diagnose vpn ike gateway list 
    
    vd: root/0
    name: SPOKE2
    version: 1
    interface: port2 6
    addr: 201.1.1.2:500 -> 100.1.1.2:500
    tun_id: 100.1.1.2/::100.1.1.2
    remote_location: 0.0.0.0
    network-id: 0
    virtual-interface-addr: 10.10.10.3 -> 10.10.10.1
    created: 166s ago
    IKE SA: created 1/1  established 1/1  time 10/10/10 ms
    IPsec SA: created 1/1  established 1/1  time 0/0/0 ms
    
      id/spi: 0 712a042d8d25877d/437eb372be68f67e
      direction: initiator
      status: established 166-166s ago = 10ms
      proposal: aes128-sha256
      key: 48fb4b35b9a67aa3-f2f62d8949523c2d
      lifetime/rekey: 86400/85933
      DPD sent/recv: 0000000f/00000004
    
    # diagnose vpn  tunnel list 
    list all ipsec tunnel in vd 0
    ------------------------------------------------------
    name=SPOKE2 ver=1 serial=1 201.1.1.2:0->100.1.1.2:0 tun_id=100.1.1.2 tun_id6=::100.1.1.2 dst_mtu=1500 dpd-link=on weight=1
    bound_if=6 lgwy=static/1 tun=intf mode=auto/1 encap=none/552 options[0228]=npu frag-rfc  run_state=0 role=primary accept_traffic=1 overlay_id=0
    
    proxyid_num=1 child_num=0 refcnt=4 ilast=8 olast=8 ad=/0
    stat: rxp=0 txp=0 rxb=0 txb=0
    dpd: mode=on-idle on=1 idle=10000ms retry=3 count=0 seqno=15
    natt: mode=none draft=0 interval=0 remote_port=0
    proxyid=SPOKE2 proto=0 sa=1 ref=2 serial=1 auto-negotiate
      src: 0:0.0.0.0-255.255.255.255:0
      dst: 0:0.0.0.0-255.255.255.255:0
      SA:  ref=3 options=18203 type=00 soft=0 mtu=1438 expire=42730/0B replaywin=2048
           seqno=1 esn=0 replaywin_lastseq=00000000 qat=0 rekey=0 hash_search_len=1
      life: type=01 bytes=0/0 timeout=42899/43200
      dec: spi=99b97fa0 esp=aes key=16 6da0cd14244e96c9224fdfc526104c88
           ah=sha1 key=20 c15decb70b3de9678d1313b564ec2e6e912b9540
      enc: spi=a7d1cc78 esp=aes key=16 023a05cc8cd9224c781ca640b044c5b3
           ah=sha1 key=20 96da3fa1c8207a267200aac94db3718944574a1b
      dec:pkts/bytes=0/0, enc:pkts/bytes=0/0
      npu_flag=00 npu_rgwy=100.1.1.2 npu_lgwy=201.1.1.2 npu_selid=0 dec_npuid=0 enc_npuid=0
    run_tally=0
    

    查看路由表

    # get router info routing-table  all 
    Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
           O - OSPF, IA - OSPF inter area
           N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
           E1 - OSPF external type 1, E2 - OSPF external type 2
           i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
           * - candidate default
    
    Routing table for VRF=0
    S*      0.0.0.0/0 [5/0] via 201.1.1.1, port2, [1/0]
    S       10.10.10.0/24 [5/0] via SPOKE2 tunnel 100.1.1.2, [1/0]
    S       10.10.10.1/32 [15/0] via SPOKE2 tunnel 100.1.1.2, [1/0]
    C       10.10.10.3/32 is directly connected, SPOKE2
    C       192.168.2.0/24 is directly connected, port3
    C       201.1.1.0/24 is directly connected, port2
    

    从SPOKE2端ping HUB隧道接口地址。

    # execute ping-options source 10.10.10.3
    # execute ping 10.10.10.1
    PING 10.10.10.1 (10.10.10.1): 56 data bytes
    64 bytes from 10.10.10.1: icmp_seq=0 ttl=255 time=0.5 ms
    64 bytes from 10.10.10.1: icmp_seq=1 ttl=255 time=0.6 ms
    64 bytes from 10.10.10.1: icmp_seq=2 ttl=255 time=0.6 ms
    64 bytes from 10.10.10.1: icmp_seq=3 ttl=255 time=0.6 ms
    64 bytes from 10.10.10.1: icmp_seq=4 ttl=255 time=0.4 ms
    
    --- 10.10.10.1 ping statistics ---
    5 packets transmitted, 5 packets received, 0% packet loss
    round-trip min/avg/max = 0.4/0.5/0.6 ms
    

配置动态路由

  1. HUB端BGP配置

    利用BGP neighbor-group特性,只要匹配前缀列表10.10.10.0/24的BGP-Peer均可以和HUB建立BGP邻居。

    将邻居设置为Route-Reflector-Client,自己即为路由反射器(Route-Reflector),通过路由反射器原理实时同步整网路由。

    config router bgp
        set as 65001
        set router-id 100.1.1.2
        config neighbor-group
            edit "group1"
                set next-hop-self enable
                set soft-reconfiguration enable
                set interface "HUB"
                set remote-as 65001
                set route-reflector-client enable
            next
        end
        config neighbor-range
            edit 1
                set prefix 10.10.10.0 255.255.255.0
                set neighbor-group "group1"
            next
        end
        config network
            edit 1
                set prefix 192.168.0.0 255.255.255.0
            next
        end
    end
    
  2. SPOKE1端BGP配置

    与HUB端建立BGP邻居

    config router bgp
        set as 65001
        set router-id 200.1.1.2
        config neighbor
            edit "10.10.10.1"
                set next-hop-self enable
                set soft-reconfiguration enable
                set interface "SPOKE1"
                set remote-as 65001
            next
        end
        config network
            edit 1
                set prefix 192.168.1.0 255.255.255.0
            next
        end
    end
    
  3. SPOKE2端BGP配置

    与HUB端建立BGP邻居

    config router bgp
        set as 65001
        set router-id 201.1.1.2
        config neighbor
            edit "10.10.10.1"
                set next-hop-self enable
                set soft-reconfiguration enable
                set interface "SPOKE2"
                set remote-as 65001
            next
        end
        config network
            edit 1
                set prefix 192.168.2.0 255.255.255.0
            next
        end
        config network6
            edit 1
                set prefix6 ::/128
            next
        end
    end
    

查看路由表

  1. HUB端路由表

    FGT-wangxiang-used # get router info routing-table  all 
    Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
           O - OSPF, IA - OSPF inter area
           N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
           E1 - OSPF external type 1, E2 - OSPF external type 2
           i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
           * - candidate default
    
    Routing table for VRF=0
    S*      0.0.0.0/0 [10/0] via 100.1.1.1, port2, [1/0]
    C       10.10.10.0/24 is directly connected, HUB
    C       10.10.10.1/32 is directly connected, HUB
    C       100.1.1.0/24 is directly connected, port2
    C       192.168.0.0/24 is directly connected, port5
    B       192.168.1.0/24 [200/0] via 10.10.10.2 (recursive is directly connected, HUB), 00:21:21
    B       192.168.2.0/24 [200/0] via 10.10.10.3 (recursive is directly connected, HUB), 00:21:21
    
  2. SPOKE1端路由表

    FGT-wangxiang-used # get router info routing-table  all 
    Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
           O - OSPF, IA - OSPF inter area
           N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
           E1 - OSPF external type 1, E2 - OSPF external type 2
           i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
           * - candidate default
    
    Routing table for VRF=0
    S*      0.0.0.0/0 [5/0] via 200.1.1.1, port2, [1/0]
    S       10.10.10.0/24 [5/0] via SPOKE1 tunnel 100.1.1.2, [1/0]
    S       10.10.10.1/32 [15/0] via SPOKE1 tunnel 100.1.1.2, [1/0]
    C       10.10.10.2/32 is directly connected, SPOKE1
    C       200.1.1.0/24 is directly connected, port2
    C       192.168.1.0/24 is directly connected, port5
    B       192.168.0.0/24 [200/0] via 10.10.10.1 (recursive via SPOKE1 tunnel 100.1.1.2), 00:21:41
    B       192.168.2.0/24 [200/0] via 10.10.10.3 (recursive via SPOKE1 tunnel 100.1.1.2), 00:21:18
    
  3. SPOKE2端路由表

    # get router info routing-table  all 
    Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
           O - OSPF, IA - OSPF inter area
           N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
           E1 - OSPF external type 1, E2 - OSPF external type 2
           i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
           * - candidate default
    
    Routing table for VRF=0
    S*      0.0.0.0/0 [5/0] via 200.1.1.1, port2, [1/0]
    S       10.10.10.0/24 [5/0] via SPOKE2 tunnel 100.1.1.2, [1/0]
    S       10.10.10.1/32 [15/0] via SPOKE2 tunnel 100.1.1.2, [1/0]
    C       10.10.10.3/32 is directly connected, SPOKE2
    C       192.168.2.0/24 is directly connected, port3
    C       201.1.1.0/24 is directly connected, port2
    B       192.168.0.0/24 [200/0] via 10.10.10.1 (recursive via SPOKE2 tunnel 100.1.1.2), 00:22:27
    B       192.168.1.0/24 [200/0] via 10.10.10.2 (recursive via SPOKE2 tunnel 100.1.1.2), 00:22:27
    

业务测试

  1. HUB端业务测试

    PC1# ifconfig ens224
    ens224: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
            inet 192.168.0.10  netmask 255.255.255.0  broadcast 192.168.0.255
            inet6 fe80::82c8:edfd:199d:70b0  prefixlen 64  scopeid 0x20<link>
            ether 00:0c:29:e8:ad:a9  txqueuelen 1000  (Ethernet)
            RX packets 6140132  bytes 1760274153 (1.6 GiB)
            RX errors 0  dropped 3749603  overruns 0  frame 0
            TX packets 51686  bytes 3833219 (3.6 MiB)
            TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
    
    访问SPOKE1
    PC1# ping 192.168.1.10 -c 4
    PING 192.168.1.10 (192.168.1.10) 56(84) bytes of data.
    64 bytes from 192.168.1.10: icmp_seq=1 ttl=62 time=1.42 ms
    64 bytes from 192.168.1.10: icmp_seq=2 ttl=62 time=0.788 ms
    64 bytes from 192.168.1.10: icmp_seq=3 ttl=62 time=0.751 ms
    64 bytes from 192.168.1.10: icmp_seq=4 ttl=62 time=0.688 ms
    
    --- 192.168.1.10 ping statistics ---
    4 packets transmitted, 4 received, 0% packet loss, time 3001ms
    rtt min/avg/max/mdev = 0.688/0.913/1.427/0.300 ms
    
    访问SPOKE2
    PC1# ping 192.168.2.10 -c 4
    PING 192.168.2.10 (192.168.2.10) 56(84) bytes of data.
    64 bytes from 192.168.2.10: icmp_seq=1 ttl=62 time=1.09 ms
    64 bytes from 192.168.2.10: icmp_seq=2 ttl=62 time=0.935 ms
    64 bytes from 192.168.2.10: icmp_seq=3 ttl=62 time=0.991 ms
    64 bytes from 192.168.2.10: icmp_seq=4 ttl=62 time=1.06 ms
    
    --- 192.168.2.10 ping statistics ---
    4 packets transmitted, 4 received, 0% packet loss, time 3003ms
    rtt min/avg/max/mdev = 0.935/1.021/1.098/0.070 ms
    
  2. SPOKE1端业务测试

    PC2# ifconfig ens224
    ens224: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
            inet 192.168.1.10  netmask 255.255.255.0  broadcast 192.168.1.255
            inet6 fe80::1a6c:e61:d2b9:a415  prefixlen 64  scopeid 0x20<link>
            inet6 2001::2  prefixlen 64  scopeid 0x0<global>
            ether 00:0c:29:0e:4e:c5  txqueuelen 1000  (Ethernet)
            RX packets 5904889  bytes 459674552 (438.3 MiB)
            RX errors 0  dropped 58  overruns 0  frame 0
            TX packets 3224540  bytes 205411564402 (191.3 GiB)
            TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
    
    访问HUB
    PC2# ping 192.168.0.10 -c 4
    PING 192.168.0.10 (192.168.0.10) 56(84) bytes of data.
    64 bytes from 192.168.0.10: icmp_seq=1 ttl=62 time=0.746 ms
    64 bytes from 192.168.0.10: icmp_seq=2 ttl=62 time=0.765 ms
    64 bytes from 192.168.0.10: icmp_seq=3 ttl=62 time=0.862 ms
    64 bytes from 192.168.0.10: icmp_seq=4 ttl=62 time=0.677 ms
    
    --- 192.168.0.10 ping statistics ---
    4 packets transmitted, 4 received, 0% packet loss, time 2999ms
    rtt min/avg/max/mdev = 0.677/0.762/0.862/0.071 ms
    
    访问SPOKE2
    PC2# ping 192.168.2.10 -c 4
    PING 192.168.2.10 (192.168.2.10) 56(84) bytes of data.
    64 bytes from 192.168.2.10: icmp_seq=1 ttl=61 time=1.14 ms
    64 bytes from 192.168.2.10: icmp_seq=2 ttl=61 time=0.952 ms
    64 bytes from 192.168.2.10: icmp_seq=3 ttl=61 time=1.51 ms
    64 bytes from 192.168.2.10: icmp_seq=4 ttl=61 time=0.886 ms
    
    --- 192.168.2.10 ping statistics ---
    4 packets transmitted, 4 received, 0% packet loss, time 3004ms
    rtt min/avg/max/mdev = 0.886/1.124/1.519/0.248 ms
    
  3. SPOKE2端业务测试

    PC3# ifconfig ens224
    ens224: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
            inet 192.168.2.10  netmask 255.255.255.0  broadcast 192.168.2.255
            inet6 fe80::2652:4dd7:5d0e:941d  prefixlen 64  scopeid 0x20<link>
            inet6 240e:604:109:39::216  prefixlen 64  scopeid 0x0<global>
            ether 00:0c:29:37:f0:ac  txqueuelen 1000  (Ethernet)
            RX packets 9638867  bytes 205844622412 (191.7 GiB)
            RX errors 0  dropped 118  overruns 0  frame 0
            TX packets 5737914  bytes 378901312 (361.3 MiB)
            TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
    
    访问HUB
    PC3# ping 192.168.0.10 -c 4
    PING 192.168.0.10 (192.168.0.10) 56(84) bytes of data.
    64 bytes from 192.168.0.10: icmp_seq=1 ttl=62 time=0.848 ms
    64 bytes from 192.168.0.10: icmp_seq=2 ttl=62 time=0.935 ms
    64 bytes from 192.168.0.10: icmp_seq=3 ttl=62 time=0.899 ms
    64 bytes from 192.168.0.10: icmp_seq=4 ttl=62 time=1.04 ms
    --- 192.168.0.10 ping statistics ---
    4 packets transmitted, 4 received, 0% packet loss, time 3002ms
    rtt min/avg/max/mdev = 0.848/0.931/1.045/0.081 ms
    
    访问SPOKE1
    PC3# ping 192.168.1.10 -c 4
    PING 192.168.1.10 (192.168.1.10) 56(84) bytes of data.
    64 bytes from 192.168.1.10: icmp_seq=1 ttl=61 time=1.13 ms
    64 bytes from 192.168.1.10: icmp_seq=2 ttl=61 time=1.22 ms
    64 bytes from 192.168.1.10: icmp_seq=3 ttl=61 time=1.21 ms
    64 bytes from 192.168.1.10: icmp_seq=4 ttl=61 time=1.04 ms
    --- 192.168.1.10 ping statistics ---
    4 packets transmitted, 4 received, 0% packet loss, time 3004ms
    rtt min/avg/max/mdev = 1.043/1.151/1.220/0.075 ms
    

Copyright © 2024 Fortinet Inc. All rights reserved. Powered by Fortinet TAC Team.
📲扫描下方二维码分享此页面👇
该页面修订于: 2024-02-02 10:09:48

results matching ""

    No results matching ""