實戰華為動態智能虛擬私有網絡,同時實現業務數據通信
1.基礎概念
即動態智能×××,是指在Hub-Spoke網絡模型中,分支與總部、分支與分支間動態建立×××的一種技術。
為了充分利用公共網絡資源,降低網絡構建成本,越來越多的企業希望通過公共網絡將總部機構(Hub)與地理位置不同的多個分支機構(Spoke)相連,並在分支機構與總部機構間、分支機構與分支機構間建立×××。
在Hub-Spoke網絡中,總部與分支間建立Hub-Spoke隧道,分支到分支的數據流經由總部傳輸。按圖1進行網絡規劃和部署後,會帶來如下問題:
當新接入一個分支之後,總部Hub需要針對其進行×××配置和維護。在大量分支接入時,總部Hub的配置會變得非常復雜,而且每次網絡調整時,都需要調整總部的配置。
如果分支之間不通過總部中轉而直接進行通信,此時如果分支出口采用的是動態地址,則分支之間無法事先獲知對端的地址,因此無法在分支之間直接建立隧道。
DS×××通過NHRP(Next Hop Resolution Protocol)收集、維護各站點動態變化的公網地址等信息,解決了無法事先獲得通信對端公網地址的問題
DS×××節點
DS×××節點為部署DS×××的設備,包括Spoke和Hub兩種形態。
Spoke
Spoke通常是企業分支機構的網關設備。一般情況下,Spoke使用動態的公網地址。
Hub
Hub通常是企業總部,是DS×××網絡的中心設備,接收Spoke向其註冊的信息。DS×××網絡中,Hub既可使用固定的公網地址,也可使用域名。
2.實施組件
1.MGRE(Multipoint GRE),多點GRE。
2.NHRP協議(Next Hop Resolution Protocol ),下一跳地址解析協議。
3.路由協議
4.可選的IPSec封裝,實現數據的安全傳輸。
註意DS×××使用限制
DS×××網絡中只支持兩種路由協議:靜態路由和OSPF路由協議。(已經支持BGP和RIP協議)
DS×××特性不支持虛擬系統
mGRE和mGRE隧道接口
mGRE是在GRE基礎上發展而來的一種點到多點GRE技術。mGRE隧道接口是為實現DS×××而提供的一種點到多點類型的邏輯接口。
mGRE隧道接口包含以下元素:
隧道源地址:報文傳輸協議中的源地址。隧道源地址就是GRE封裝後的報文源地址,即圖1中的公網地址(NBMA地址)。
隧道目的地址:報文傳輸協議中的目的地址。隧道目的地址就是GRE封裝後的報文目的地址。
隧道接口IP地址:隧道接口地址和其他物理接口上的IP地址一樣,用於設備之間的通信(例如獲取路由信息等),即圖中的Tunnel地址(Protocol地址)
3.實施拓撲
4.實施步驟
4.1 前提:解決公網地址(NBMA地址)的路由問題,現網中,NBMA地址的可達性大部分時候由運營商來負責
<R1-HUB>dis ip rou pro static
Route Flags: R - relay, D - download to fib
Public routing table : Static
Destinations : 1 Routes : 1 Configured Routes : 1
Static routing table status : <Active>
Destinations : 1 Routes : 1
Destination/Mask Proto Pre Cost Flags NextHop Interface
0.0.0.0/0 Static 60 0 RD 202.10.1.2 GigabitEthernet0/0/0
Static routing table status : <Inactive>
Destinations : 0 Routes : 0
<R1-HUB>
<R1-HUB>
<R1-HUB>ping 202.100.1.1
PING 202.100.1.1: 56 data bytes, press CTRL_C to break
Reply from 202.100.1.1: bytes=56 Sequence=1 ttl=254 time=590 ms
Reply from 202.100.1.1: bytes=56 Sequence=2 ttl=254 time=240 ms
Reply from 202.100.1.1: bytes=56 Sequence=3 ttl=254 time=100 ms
Reply from 202.100.1.1: bytes=56 Sequence=4 ttl=254 time=70 ms
Reply from 202.100.1.1: bytes=56 Sequence=5 ttl=254 time=40 ms
--- 202.100.1.1 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 40/208/590 ms
<R1-HUB>ping 202.100.1.2
PING 202.100.1.2: 56 data bytes, press CTRL_C to break
Reply from 202.100.1.2: bytes=56 Sequence=1 ttl=254 time=230 ms
Reply from 202.100.1.2: bytes=56 Sequence=2 ttl=254 time=100 ms
Reply from 202.100.1.2: bytes=56 Sequence=3 ttl=254 time=100 ms
Reply from 202.100.1.2: bytes=56 Sequence=4 ttl=254 time=50 ms
Reply from 202.100.1.2: bytes=56 Sequence=5 ttl=254 time=40 ms
<R2-Spoke1>dis cu | i ip route-s
ip route-static 0.0.0.0 0.0.0.0 202.100.1.254
<R3-Spoke2>dis cu | i ip route
ip route-static 0.0.0.0 0.0.0.0 202.100.1.254
<R1-HUB>dis cu | i ip route-s
ip route-static 0.0.0.0 0.0.0.0 202.10.1.2
4.2 組件1.多點GRE隧道
僅僅有源地址,沒有目標地址
兩種隧道:靜態隧道和動態隧道
interface Tunnel0/0/0
ip address 172.16.1.1 255.255.255.0
tunnel-protocol gre p2mp
source GigabitEthernet0/0/0
[R2-Spoke1-Tunnel0/0/0]dis th
[V200R003C00]
#
interface Tunnel0/0/0
ip address 172.16.1.2 255.255.255.0
tunnel-protocol gre p2mp
source GigabitEthernet0/0/0
[R3-Spoke2-Tunnel0/0/0]dis th
[V200R003C00]
#
interface Tunnel0/0/0
ip address 172.16.1.3 255.255.255.0
tunnel-protocol gre p2mp
source GigabitEthernet0/0/0
隧道是一個邏輯接口,沒有MAC地址,意味著沒有arp解析,同時又不是點到點的網絡,那數據怎麽完成封裝呢?
4.3 組件2 NHRP(下一跳解析協議)
可以借助前邊的公網地址使得死亡完成通信
把私網地址(172.16.1.2)解析成公網可達地址(202.100.1.2)
NHRP的動態(分支到分支間的臨時映射)和靜態(總部到分支的固定映射)對等體
[R1-HUB-Tunnel0/0/0]nhrp entry multicast dynamic
[R2-Spoke1-Tunnel0/0/0]nhrp entry 172.16.1.1 202.10.1.1 register
[R3-Spoke2-Tunnel0/0/0]nhrp entry 172.16.1.1 202.10.1.1 register //把私網地址手工映射為公網地址,即NBMA地址
[R1-HUB-Tunnel0/0/0]display nhrp peer all
-------------------------------------------------------------------------------
Protocol-addr Mask NBMA-addr NextHop-addr Type Flag
-------------------------------------------------------------------------------
172.16.1.2 32 202.100.1.1 172.16.1.2 dynamic route tunnel
-------------------------------------------------------------------------------
Tunnel interface: Tunnel0/0/0
Created time : 00:02:33
Expire time : 01:57:27
-------------------------------------------------------------------------------
Protocol-addr Mask NBMA-addr NextHop-addr Type Flag
-------------------------------------------------------------------------------
172.16.1.3 32 202.100.1.2 172.16.1.3 dynamic route tunnel
-------------------------------------------------------------------------------
[R2-Spoke1-Tunnel0/0/0]disp nhrp peer all
-------------------------------------------------------------------------------
Protocol-addr Mask NBMA-addr NextHop-addr Type Flag
-------------------------------------------------------------------------------
172.16.1.1 32 202.10.1.1 172.16.1.1 static hub
-------------------------------------------------------------------------------
[R3-Spoke2-Tunnel0/0/0]disp nhrp peer all
-------------------------------------------------------------------------------
Protocol-addr Mask NBMA-addr NextHop-addr Type Flag
-------------------------------------------------------------------------------
172.16.1.1 32 202.10.1.1 172.16.1.1 static hub
-------------------------------------------------------------------------------
直連通信:
[R1-HUB-Tunnel0/0/0]ping 172.16.1.2
PING 172.16.1.2: 56 data bytes, press CTRL_C to break
Reply from 172.16.1.2: bytes=56 Sequence=1 ttl=255 time=140 ms
Reply from 172.16.1.2: bytes=56 Sequence=2 ttl=255 time=90 ms
Reply from 172.16.1.2: bytes=56 Sequence=3 ttl=255 time=60 ms
Reply from 172.16.1.2: bytes=56 Sequence=4 ttl=255 time=100 ms
Reply from 172.16.1.2: bytes=56 Sequence=5 ttl=255 time=80 ms
--- 172.16.1.2 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 60/94/140 ms
[R1-HUB-Tunnel0/0/0]ping 172.16.1.3
PING 172.16.1.3: 56 data bytes, press CTRL_C to break
Reply from 172.16.1.3: bytes=56 Sequence=1 ttl=255 time=140 ms
Reply from 172.16.1.3: bytes=56 Sequence=2 ttl=255 time=60 ms
Reply from 172.16.1.3: bytes=56 Sequence=3 ttl=255 time=60 ms
Reply from 172.16.1.3: bytes=56 Sequence=4 ttl=255 time=70 ms
Reply from 172.16.1.3: bytes=56 Sequence=5 ttl=255 time=130 ms
4.4 組件3.動態路由協議需要調整
OSPF案例
[R1-HUB-Tunnel0/0/0]dis cu conf ospf
[V200R003C00]
#
ospf 1 router-id 1.1.1.1
area 0.0.0.0
[R1-HUB-ospf-1-area-0.0.0.0]int lo0
[R1-HUB-LoopBack0]description YEWU
[R1-HUB-LoopBack0]ip address 10.1.1.1 32
[R1-HUB-LoopBack0]ospf en a 0
[R1-HUB-LoopBack0]int tun 0/0/0
[R1-HUB-Tunnel0/0/0]ospf en a 0
0 不能
1 能
此時網絡中有3臺設備,必須是一個多點接入網絡,可是OSPF網絡類型是點到點(p2p不適合這個多點接入網絡)
廣播方式:
[R1-HUB-Tunnel0/0/0]ospf network-type broadcast
[R2-Spoke1-Tunnel0/0/0]ospf dr-priority 0
[R2-Spoke1-Tunnel0/0/0]ospf network-type broadcast
[R3-Spoke2-Tunnel0/0/0]ospf dr-priority 0
[R3-Spoke2-Tunnel0/0/0]ospf network-type broadcast
[R1-HUB]dis ospf peer brief //分支僅僅和總部有鄰居關系,分支間是不存在路由協議的鄰居關系
OSPF Process 1 with Router ID 1.1.1.1
Peer Statistic Information
Area Id Interface Neighbor id State
0.0.0.0 Tunnel0/0/0 2.2.2.2 Full
0.0.0.0 Tunnel0/0/0 3.3.3.3 Full
[R1-HUB]dis ospf int tun 0/0/0
OSPF Process 1 with Router ID 1.1.1.1
Interfaces
Interface: 172.16.1.1 (Tunnel0/0/0)
Cost: 1562 State: DR Type: Broadcast MTU: 1500
Priority: 1
Designated Router: 172.16.1.1
Backup Designated Router: 0.0.0.0
Timers: Hello 10 , Dead 40 , Poll 120 , Retransmit 5 , Transmit Delay 1
[R2-Spoke1]dis ip rou pro ospf
Route Flags: R - relay, D - download to fib
Public routing table : OSPF
Destinations : 2 Routes : 2
OSPF routing table status : <Active>
Destinations : 2 Routes : 2
Destination/Mask Proto Pre Cost Flags NextHop Interface
10.1.1.1/32 OSPF 10 1562 D 172.16.1.1 Tunnel0/0/0
10.1.1.3/32 OSPF 10 1562 D 172.16.1.3 Tunnel0/0/0 //這是OSPF廣播類型的特點,問題在於必須存在到172.16.1.3的NHRP映射,NHRP可以完成動態映射的,參考下面表象
[R2-Spoke1]dis nhrp peer all
Protocol-addr Mask NBMA-addr NextHop-addr Type Flag
16.1.1 32 202.10.1.1 172.16.1.1 static hub
Tunnel interface: Tunnel0/0/0
Created time : 00:21:37
Expire time : --
Protocol-addr Mask NBMA-addr NextHop-addr Type Flag
172.16.1.3 32 202.100.1.2 172.16.1.3 dynamic route tunnel
DS×××環境下實施RIP
rip 1
version 2
network 172.16.0.0
network 10.0.0.0
[R1-HUB-rip-1]dis rip 1 neighbor
---------------------------------------------------------------------
IP Address Interface Type Last-Heard-Time
---------------------------------------------------------------------
172.16.1.2 Tunnel0/0/0 RIP 0:0:17
Number of RIP routes : 1
172.16.1.3 Tunnel0/0/0 RIP 0:0:15
Number of RIP routes : 1
[R1-HUB-rip-1]dis ip rou protocol rip //總部完整無缺
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Public routing table : RIP
Destinations : 2 Routes : 2
RIP routing table status : <Active>
Destinations : 2 Routes : 2
Destination/Mask Proto Pre Cost Flags NextHop Interface
10.1.1.2/32 RIP 100 1 D 172.16.1.2 Tunnel0/0/0
10.1.1.3/32 RIP 100 1 D 172.16.1.3 Tunnel0/0/0
[R3-Spoke2-rip-1]dis ip rou pro rip
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Public routing table : RIP
Destinations : 1 Routes : 1
RIP routing table status : <Active>
Destinations : 1 Routes : 1
Destination/Mask Proto Pre Cost Flags NextHop Interface
10.1.1.1/32 RIP 100 1 D 172.16.1.1 Tunnel0/0/0
RIP routing table status : <Inactive>
Destinations : 0 Routes : 0
[R2-Spoke1-rip-1]dis ip rou pro rip
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Public routing table : RIP
Destinations : 1 Routes : 1
RIP routing table status : <Active>
Destinations : 1 Routes : 1
Destination/Mask Proto Pre Cost Flags NextHop Interface
10.1.1.1/32 RIP 100 1 D 172.16.1.1 Tunnel0/0/0
解決方案:
關閉HUB的隧道的RIP的水平分割
**[R1-HUB-Tunnel0/0/0]undo rip split-horizon**
[R2-Spoke1]dis ip routing-table protocol rip
Route Flags: R - relay, D - download to fib
Public routing table : RIP
Destinations : 2 Routes : 2
RIP routing table status : <Active>
Destinations : 2 Routes : 2
Destination/Mask Proto Pre Cost Flags NextHop Interface
10.0.0.0/8 RIP 100 1 D 172.16.1.1 Tunnel0/0/0
172.16.0.0/16 RIP 100 1 D 172.16.1.1 Tunnel0/0/0
4.1 采用SHORTCUT方式實施大型的DS×××
改進主要有2點:1 NHRP解析 2 路由可以實施匯總
最適合NBMA的OSPF網絡類型是P2MP
ospf network-type p2mp
[R2-Spoke1]dis ip routing-table protocol ospf
Route Flags: R - relay, D - download to fib
Public routing table : OSPF
Destinations : 4 Routes : 4
OSPF routing table status : <Active>
Destinations : 4 Routes : 4
Destination/Mask Proto Pre Cost Flags NextHop Interface
10.1.1.1/32 OSPF 10 1562 D 172.16.1.1 Tunnel0/0/0
10.1.1.3/32 OSPF 10 3124 D 172.16.1.1 Tunnel0/0/0 //分支到其他分支路由的下一跳是總部
172.16.1.1/32 OSPF 10 1562 D 172.16.1.1 Tunnel0/0/0
172.16.1.3/32 OSPF 10 3124 D 172.16.1.1 Tunnel0/0/0
[R1-HUB-Tunnel0/0/0]nhrp redirect
[R2-Spoke1-Tunnel0/0/0]nhrp shortcut
[R3-Spoke2-Tunnel0/0/0]nhrp shortcut
[R3-Spoke2]dis nhrp peer all
Protocol-addr Mask NBMA-addr NextHop-addr Type Flag
1.2 32 202.100.1.1 172.16.1.2 dynamic route network //去往目標地址直接映射到NBMA地址
4.5 組件4.IPSEC保護隧道
不需要指定remote peer,另外一點策略匯總會采用IPSEC profile(模版)
三臺設備配置相同
ipsec proposal QYT
#
ike proposal 1
#
ike peer DS××× v1
pre-shared-key simple qytang
ike-proposal 1
#
ipsec profile DS×××
ike-peer DS×××
proposal QYT
interface Tunnel0/0/0
ip address 172.16.1.2 255.255.255.0
ipsec profile DS××× //接口調用策略
<R2-Spoke1>ping 3.3.3.3
PING 3.3.3.3: 56 data bytes, press CTRL_C to break
Reply from 3.3.3.3: bytes=56 Sequence=1 ttl=255 time=60 ms
Reply from 3.3.3.3: bytes=56 Sequence=2 ttl=255 time=40 ms
Reply from 3.3.3.3: bytes=56 Sequence=3 ttl=255 time=60 ms
Reply from 3.3.3.3: bytes=56 Sequence=4 ttl=255 time=50 ms
Reply from 3.3.3.3: bytes=56 Sequence=5 ttl=255 time=70 ms
--- 3.3.3.3 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 40/56/70 ms
<R2-Spoke1>ping 10.1.1.1 //數據可以正常通過加密處理
PING 10.1.1.1: 56 data bytes, press CTRL_C to break
Reply from 10.1.1.1: bytes=56 Sequence=1 ttl=255 time=70 ms
Reply from 10.1.1.1: bytes=56 Sequence=2 ttl=255 time=140 ms
Reply from 10.1.1.1: bytes=56 Sequence=3 ttl=255 time=50 ms
Reply from 10.1.1.1: bytes=56 Sequence=4 ttl=255 time=300 ms
Reply from 10.1.1.1: bytes=56 Sequence=5 ttl=255 time=50 ms
--- 10.1.1.1 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 50/122/300 ms
HCNP
<R1-HUB>dis ipsec sa brief
Number of SAs:4
Src address Dst address SPI ××× Protocol Algorithm
202.100.1.1 202.10.1.1 3838815387 0 ESP E:DES A:MD5-96
202.100.1.2 202.10.1.1 2091020973 0 ESP E:DES A:MD5-96
202.10.1.1 202.100.1.1 2870251216 0 ESP E:DES A:MD5-96
202.10.1.1 202.100.1.2 1159615265 0 ESP E:DES A:MD5-96
<R1-HUB>dis ike sa
Conn-ID Peer ××× Flag(s) Phase
4 202.100.1.2 0 RD 2
3 202.100.1.2 0 RD 1
2 202.100.1.1 0 RD 2
1 202.100.1.1 0 RD 1
乾頤堂安德HCIEv3.0 作業:完成shortcut方式的DS×××
實戰華為動態智能虛擬私有網絡,同時實現業務數據通信