雙上行鏈路的熱備份閘道器冗餘
雙上行的熱備份閘道器冗餘
如上圖，r9為isp，8.8.8.8為r9的一個環回，模擬為外網網站，r1和r8為公司的內網核心層路由器，配置有nat轉換。
r1的公網ip為19.1.1.1/24 r8的公網ip為89.1.1.8 相當於r1連結電信寬頻，r8連結聯通寬頻。在做了熱備份以後，可以由r1和r8模擬出2個預設路由指向的地址，即相當於閘道器的存在，然後公司的匯聚層交換機sw2和sw3寫一條預設路由指向虛擬閘道器ip，可實現對虛擬閘道器的備份，具體可使用hsrp。
sw2為vlan2的樹根和閘道器，vlan3的備份
sw3為vlan3的樹根和閘道器，vlan2的備份
vpc6為vlan2的使用者
vpc7為vlan3的使用者
R9:
hostname r9
interface Loopback0
ip address 8.8.8.8 255.255.255.0 環回介面
interface Ethernet0/0
ip address 19.1.1.9 255.255.255.0
interface Ethernet0/1
ip address 89.1.1.9 255.255.255.0
line con 0
exec-timeout 0 0
logging synchronous
line aux 0
line vty 0 4
login
R1:
interface Loopback0
ip address 172.16.5.1 255.255.255.0
!
interface Ethernet0/0
ip address 172.16.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
standby 1 ip 172.16.1.254 作為sw2的預設路由地址
standby 1 priority 101 修改優先順序為101，並對上行鏈路e0/2口追蹤
standby 1 preempt 開啟搶佔性
standby 1 track 1 decrement 10 當e0/2口的線路協議down後，優先順序下降10，降為91，可被r8的100把虛閘道器的活動狀態搶走。
!
interface Ethernet0/1
ip address 172.16.4.1 255.255.255.0
ip nat inside 定義為內網區域
standby 2 ip 172.16.4.254 虛擬為sw3的預設ip172.16.4.254
standby 2 preempt 開啟搶佔性 （優先順序預設100）
!
interface Ethernet0/2
ip address 19.1.1.1 255.255.255.0
ip nat outside 定義為外網區域
track 1 interface Ethernet0/2 line-protocol 對e0/2口進行上行鏈路追蹤
router ospf 1 起路由保證內網連同性
router-id 1.1.1.1
network 172.16.0.0 0.0.255.255 area 0
access-list 1 permit 172.16.0.0 0.0.255.255 寫nat需要轉換的acl列表
ip nat inside source list 1 interface Ethernet0/2 overload 埠對映 將內網的ip轉化為公網ip
R8:
interface Loopback0
ip address 172.16.8.8 255.255.255.0
interface Ethernet0/0
ip address 172.16.1.8 255.255.255.0
ip nat inside
standby 1 ip 172.16.1.254 作為sw2的備份虛閘道器
standby 1 preempt
interface Ethernet0/1
ip address 172.16.4.8 255.255.255.0
ip nat inside 定義內網區域
standby 2 ip 172.16.4.254 作為sw3的主（活動）虛閘道器
standby 2 priority 101 修改優先順序為101
standby 2 preempt 開啟搶佔性
standby 2 track 1 decrement 10 對e0/2口上行鏈路追蹤
interface Ethernet0/2
ip address 89.1.1.8 255.255.255.0
ip nat outside 定義外網區域
router ospf 1 起路由保證內網連通性
router-id 8.8.8.8
network 172.16.0.0 0.0.255.255 area 0
track 1 interface Ethernet0/2 line-protocol 定義追蹤列表
access-list 1 permit 172.16.0.0 0.0.255.255 定義轉換的acl列表
ip nat inside source list 1 interface Ethernet0/2 overload 埠對映
sw2:
spanning-tree mode mst 執行mst生成樹協議
spanning-tree extend system-id
spanning-tree mst configuration
instance 1 vlan 2
instance 2 vlan 3
spanning-tree mst 1 priority 24576
spanning-tree mst 2 priority 28672
定義2個上行追蹤列表，可實現斷一個鏈路不切換vlan2的閘道器，2條鏈路都斷才將閘道器切到sw3
track 1 interface Ethernet1/1 line-protocol
track 2 interface Ethernet0/0 line-protocol
interface Port-channel1
switchport trunk encapsulation dot1q 修改封裝型別為dot1q
switchport mode trunk 建立trunk
將連線r1的e0/0口劃分為access介面化為vlan4同時將e1/1口也劃分為vlan4，r1可與r8在二層下通訊，為hsrp熱備份建立同一衝突域的條件。
interface Ethernet0/0
switchport access vlan 4
switchport mode access
interface Ethernet1/1
switchport access vlan 4
switchport mode access
與sw3連線的e0/1和e0/2口開啟trunk 並聚合為channel介面
interface Ethernet0/1
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 1 mode on
!
interface Ethernet0/2
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 1 mode on
向下用dtp協議建立trunk
interface Ethernet0/3
switchport trunk encapsulation dot1q
switchport mode dynamic desirable
interface Ethernet1/0
switchport trunk encapsulation dot1q
switchport mode dynamic desirable
interface Vlan2
ip address 172.16.2.1 255.255.255.0
standby 1 ip 172.16.2.254 虛擬vlan2的閘道器172.16.2.254
standby 1 priority 111 修改優先順序為111，一條鏈路斷後降為101，2條都斷後降為91，2條都斷才會被sw3把vlan2的閘道器搶去
standby 1 preempt
standby 1 track 1 decrement 10
standby 1 track 2 decrement 10
!
interface Vlan3
ip address 172.16.3.2 255.255.255.0
standby 2 ip 172.16.3.254 虛擬vlan3的閘道器172.16.3.254 並作為備份
standby 2 preempt
interface Vlan4
ip address 172.16.1.100 255.255.255.0
啟動ospf路由，在內網通訊時，不同vlan通訊需要三層通訊，必須有路由條目
router ospf 1
router-id 2.2.2.2
network 172.16.0.0 0.0.255.255 area 0
ip route 0.0.0.0 0.0.0.0 172.16.1.254 ！！！將預設路由指向172.16.1.254，r1和r8虛擬出的內外網閘道器，r1為172.16.1.254的主
sw3:
spanning-tree mode mst
spanning-tree extend system-id
!
spanning-tree mst configuration
instance 1 vlan 2
instance 2 vlan 3
!
spanning-tree mst 1 priority 28672
spanning-tree mst 2 priority 24576
track 1 interface Ethernet0/0 line-protocol
track 2 interface Ethernet1/1 line-protocol
interface Port-channel1
switchport trunk encapsulation dot1q
switchport mode trunk
interface Ethernet0/0
switchport access vlan 4
switchport mode access
!
interface Ethernet0/1
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 1 mode on
!
interface Ethernet0/2
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 1 mode on
!
interface Ethernet0/3
switchport trunk encapsulation dot1q
switchport mode dynamic desirable
!
interface Ethernet1/0
switchport trunk encapsulation dot1q
switchport mode dynamic desirable
!
interface Ethernet1/1
switchport access vlan 4
switchport mode access
interface Vlan2
ip address 172.16.2.2 255.255.255.0
standby 1 ip 172.16.2.254 虛擬vlan2的閘道器偉172.16.2.254，sw3為備份，sw2為主
standby 1 preempt
interface Vlan3
ip address 172.16.3.1 255.255.255.0
standby 2 ip 172.16.3.254 虛擬vlan3的閘道器為172.16.3.254
standby 2 priority 111 修改優先順序為111，一條鏈路斷後降為101，2條都斷後降為91，2條都斷才會被sw2把vlan3的閘道器搶去
standby 2 preempt
standby 2 track 1 decrement 10
standby 2 track 2 decrement 10
!
interface Vlan4
ip address 172.16.4.100 255.255.255.0
router ospf 1
router-id 3.3.3.3
network 172.16.0.0 0.0.255.255 area 0
ip route 0.0.0.0 0.0.0.0 172.16.4.254 ！！！將預設路由指向172.16.4.254，r1和r8虛擬出的內外網閘道器，r8為172.16.4.254的主
sw4:
spanning-tree mode mst
spanning-tree extend system-id
!
spanning-tree mst configuration
instance 1 vlan 2
instance 2 vlan 3
interface Ethernet0/2 將vpc6劃入vlan2
switchport access vlan 2
switchport mode access
sw5:
spanning-tree mode mst
spanning-tree extend system-id
!
spanning-tree mst configuration
instance 1 vlan 2
instance 2 vlan 3
interface Ethernet0/2 將vpc7劃入vlan3
switchport access vlan 3
switchport mode access
vpc6：
NAME : VPCS[1]
IP/MASK : 172.16.2.5/24
GATEWAY : 172.16.2.254
DNS :
MAC : 00:50:79:66:68:06
LPORT : 20000
RHOST:PORT : 127.0.0.1:30000
MTU : 1500
vpc7:
VPCS> show ip
NAME : VPCS[1]
IP/MASK : 172.16.3.5/24
GATEWAY : 172.16.3.254
DNS :
MAC : 00:50:79:66:68:07
LPORT : 20000
RHOST:PORT : 127.0.0.1:30000
MTU : 1500
測試：先用vpc6 ping 8.8.8.8 然後關閉sw2的e0/0口 然後關閉sw2的e1/1口 然後關閉sw3的e1/1口以檢測vlan2的備份情況：
84 bytes from 8.8.8.8 icmp_seq=1 ttl=253 time=2.491 ms
84 bytes from 8.8.8.8 icmp_seq=2 ttl=253 time=11.634 ms
84 bytes from 8.8.8.8 icmp_seq=3 ttl=253 time=5.541 ms
84 bytes from 8.8.8.8 icmp_seq=4 ttl=253 time=11.073 ms 正常情況下可以ping通
84 bytes from 8.8.8.8 icmp_seq=8 ttl=253 time=9.661 ms
84 bytes from 8.8.8.8 icmp_seq=9 ttl=253 time=2.930 ms
8.8.8.8 icmp_seq=10 timeout sw2的e0/0口關閉 切換中
8.8.8.8 icmp_seq=11 timeout
8.8.8.8 icmp_seq=12 timeout
8.8.8.8 icmp_seq=13 timeout
8.8.8.8 icmp_seq=14 timeout
84 bytes from 8.8.8.8 icmp_seq=15 ttl=253 time=3.743 ms 切換到sw2的e1/1口
84 bytes from 8.8.8.8 icmp_seq=16 ttl=253 time=3.320 mss
84 bytes from 8.8.8.8 icmp_seq=18 ttl=253 time=9.783 ms
84 bytes from 8.8.8.8 icmp_seq=19 ttl=253 time=8.727 ms
8.8.8.8 icmp_seq=20 timeout sw2的e1/1口關閉 切換vlan2的閘道器到sw3
84 bytes from 8.8.8.8 icmp_seq=21 ttl=253 time=3.583 ms
84 bytes from 8.8.8.8 icmp_seq=22 ttl=253 time=4.622 ms
84 bytes from 8.8.8.8 icmp_seq=28 ttl=253 time=3.579 ms 切換成功 閘道器為sw3
84 bytes from 8.8.8.8 icmp_seq=30 ttl=253 time=9.523 ms
84 bytes from 8.8.8.8 icmp_seq=31 ttl=253 time=9.445 ms
8.8.8.8 icmp_seq=32 timeout 關閉sw3的e1/1口 切換到e0/0口
8.8.8.8 icmp_seq=33 timeout
8.8.8.8 icmp_seq=34 timeout
8.8.8.8 icmp_seq=35 timeout
8.8.8.8 icmp_seq=36 timeout
84 bytes from 8.8.8.8 icmp_seq=37 ttl=253 time=5.043 ms
84 bytes from 8.8.8.8 icmp_seq=38 ttl=253 time=9.316 ms
84 bytes from 8.8.8.8 icmp_seq=39 ttl=253 time=6.617 ms 切換成功
84 bytes from 8.8.8.8 icmp_seq=40 ttl=253 time=3.890 ms
84 bytes from 8.8.8.8 icmp_seq=41 ttl=253 time=6.340 ms
先用vpc7 ping 8.8.8.8 然後關閉sw3的e1/1口 然後關閉sw3的e0/0口 然後關閉sw2的e0/0口以檢測vlan3的備份情況：
vpc7:
84 bytes from 8.8.8.8 icmp_seq=2 ttl=253 time=2.901 ms
84 bytes from 8.8.8.8 icmp_seq=4 ttl=253 time=7.527 ms 正常情況下可以ping通
84 bytes from 8.8.8.8 icmp_seq=5 ttl=253 time=7.845 ms
84 bytes from 8.8.8.8 icmp_seq=6 ttl=253 time=4.367 ms
84 bytes from 8.8.8.8 icmp_seq=7 ttl=253 time=2.544 ms
84 bytes from 8.8.8.8 icmp_seq=8 ttl=253 time=7.339 ms
84 bytes from 8.8.8.8 icmp_seq=9 ttl=253 time=8.954 ms
84 bytes from 8.8.8.8 icmp_seq=10 ttl=253 time=8.961 ms
84 bytes from 8.8.8.8 icmp_seq=11 ttl=253 time=3.850 ms
84 bytes from 8.8.8.8 icmp_seq=12 ttl=253 time=4.344 ms
84 bytes from 8.8.8.8 icmp_seq=13 ttl=253 time=3.215 ms
84 bytes from 8.8.8.8 icmp_seq=14 ttl=253 time=5.376 ms
8.8.8.8 icmp_seq=15 timeout
8.8.8.8 icmp_seq=16 timeout sw3的e1/1口關閉 切換中
8.8.8.8 icmp_seq=17 timeout
8.8.8.8 icmp_seq=18 timeout
84 bytes from 8.8.8.8 icmp_seq=19 ttl=253 time=3.335 ms 切換到sw3的e0/0口
84 bytes from 8.8.8.8 icmp_seq=20 ttl=253 time=7.560 ms
84 bytes from 8.8.8.8 icmp_seq=21 ttl=253 time=13.036 ms
84 bytes from 8.8.8.8 icmp_seq=22 ttl=253 time=3.071 ms
84 bytes from 8.8.8.8 icmp_seq=23 ttl=253 time=6.625 ms
84 bytes from 8.8.8.8 icmp_seq=25 ttl=253 time=7.870 ms
8.8.8.8 icmp_seq=26 timeout sw3的e0/0口關閉 切換vlan3的閘道器到sw2
8.8.8.8 icmp_seq=27 timeout
8.8.8.8 icmp_seq=28 timeout
8.8.8.8 icmp_seq=29 timeout
8.8.8.8 icmp_seq=30 timeout
8.8.8.8 icmp_seq=31 timeout
8.8.8.8 icmp_seq=32 timeout
8.8.8.8 icmp_seq=42 timeout
8.8.8.8 icmp_seq=43 timeout
84 bytes from 8.8.8.8 icmp_seq=44 ttl=253 time=9.832 ms 切換成功 閘道器為sw2
84 bytes from 8.8.8.8 icmp_seq=45 ttl=253 time=7.751 ms
84 bytes from 8.8.8.8 icmp_seq=46 ttl=253 time=5.898 ms
84 bytes from 8.8.8.8 icmp_seq=47 ttl=253 time=4.153 ms
84 bytes from 8.8.8.8 icmp_seq=49 ttl=253 time=3.697 ms
84 bytes from 8.8.8.8 icmp_seq=50 ttl=253 time=4.934 ms
84 bytes from 8.8.8.8 icmp_seq=51 ttl=253 time=8.375 ms
8.8.8.8 icmp_seq=52 timeout 關閉sw2的e0/0口 切換到e1/1口
8.8.8.8 icmp_seq=53 timeout
8.8.8.8 icmp_seq=54 timeout
8.8.8.8 icmp_seq=55 timeout
8.8.8.8 icmp_seq=56 timeout
8.8.8.8 icmp_seq=57 timeout
8.8.8.8 icmp_seq=58 timeout
84 bytes from 8.8.8.8 icmp_seq=59 ttl=253 time=4.356 ms 切換成功
84 bytes from 8.8.8.8 icmp_seq=63 ttl=253 time=12.860 ms
84 bytes from 8.8.8.8 icmp_seq=64 ttl=253 time=15.578 ms
84 bytes from 8.8.8.8 icmp_seq=67 ttl=253 time=6.494 ms
84 bytes from 8.8.8.8 icmp_seq=68 ttl=253 time=10.027 ms
測試：用vpc6ping8.8.8.8 中間關閉r1的e0/2口 看能否切換sw2閘道器為r8:
84 bytes from 8.8.8.8 icmp_seq=1 ttl=253 time=3.659 ms
84 bytes from 8.8.8.8 icmp_seq=16 ttl=253 time=6.953 ms
*172.16.1.1 icmp_seq=17 ttl=254 time=2.462 ms (ICMP type:3, code:1, Destination host unreachable)
*172.16.1.1 icmp_seq=18 ttl=254 time=7.438 ms (ICMP type:3, code:1, Destination host unreachable) nat閘道器由r1切換到r8
*172.16.1.1 icmp_seq=19 ttl=254 time=4.389 ms (ICMP type:3, code:1, Destination host unreachable)
84 bytes from 8.8.8.8 icmp_seq=20 ttl=253 time=3.958 ms
84 bytes from 8.8.8.8 icmp_seq=21 ttl=253 time=8.083 ms
84 bytes from 8.8.8.8 icmp_seq=22 ttl=253 time=3.387 ms
用vpc7ping 8.8.8.8 中間關閉r8的e0/2口 看能否切換sw3閘道器為r1:
84 bytes from 8.8.8.8 icmp_seq=1 ttl=253 time=3.110 ms
84 bytes from 8.8.8.8 icmp_seq=6 ttl=253 time=3.120 ms
84 bytes from 8.8.8.8 icmp_seq=7 ttl=253 time=6.918 ms
84 bytes from 8.8.8.8 icmp_seq=8 ttl=253 time=4.089 ms
*172.16.4.8 icmp_seq=9 ttl=254 time=2.206 ms (ICMP type:3, code:1, Destination host unreachable)
*172.16.4.8 icmp_seq=10 ttl=254 time=12.947 ms (ICMP type:3, code:1, Destination host unreachable)
*172.16.4.8 icmp_seq=11 ttl=254 time=2.560 ms (ICMP type:3, code:1, Destination host unreachable)
84 bytes from 8.8.8.8 icmp_seq=12 ttl=253 time=4.803 ms
84 bytes from 8.8.8.8 icmp_seq=13 ttl=253 time=3.181 ms
84 bytes from 8.8.8.8 icmp_seq=14 ttl=253 time=3.582 ms
可以看到兩個位置的熱備份冗餘都成功實現。