其他分享
首页 > 其他分享> > 多区域 OSPF 综合实验

多区域 OSPF 综合实验

作者:互联网

实验目标:

理解 OSPF 工作原理

掌握 OSPF 多区域的规划和配置

掌握 OSPF 各项性能优化技术

实验拓扑和需求:

3.25.png


配置 ip 地址包括 loopback 地址,底下路由器至少有两个用户网段, 用于测试汇总


进行多区域设计,宣告 ospf(完成的标志是各路由器邻接关系形成)


. 在出口设备注入默认路由(完成的标志是每台路由器学习到默认路由)


ABR 上对用户网段进行汇总,精简核心设备路由表(汇总前核心及出口 能看到明细用户路由,汇总后则只看到汇总用户路由)


将末梢区域设置为完全 stub 区域,精简边缘设备路由表(设置前边缘 路由器能看到区间路由信息及 E2 的默认路由,设置后看不到区间路由, 默认路由变成 IA)


修改 cost 值,实现数据合理分流,来回路径一致(修改前两条线路等 价负载均衡,修改后只走主线路,且宿舍 1 区和宿舍 2 区的主线路分 开)


修改接口网络类型为点到点,加快收敛速度(修改前建立邻居后要选举 dr,花费 40s 时间,修改后不用选举 dr 快速收敛)


配置出口 NAT


配置安全增强策略(可选)。

9.1 将连接用户的接口配置为被动接口(设置前,用户接口连接路由设 备开启 ospf 可以建立邻居,设置后无法建立)

9.2 开启 ospf 验证,并采用 md5 算法对密码进行加密


配置步骤:

1、配置 IP 地址(略)

2、宣告 OSPF


[AR1]router id 1.1.1.1

[AR1]ospf 1

[AR1-ospf-1]area 0

[AR1-ospf-1-area-0.0.0.0]net 10.0.0.0 0.255.255.255


[AR2]router id 2.2.2.2 [AR2]ospf 1

[AR2-ospf-1]area 0

[AR2-ospf-1-area-0.0.0.0]network 10.0.0.0 0.255.255.255


[AR3]router id 3.3.3.3 [AR3]ospf 1

[AR3-ospf-1]area 0

[AR3-ospf-1-area-0.0.0.0]network 10.0.0.0 0.255.255.255


[AR4]router id 4.4.4.4 [AR4]ospf 1

[AR4-ospf-1]area 0

[AR4-ospf-1-area-0.0.0.0]network 10.0.0.0 0.255.255.255 [AR4-ospf-1-area-0.0.0.0]area 10

[AR4-ospf-1-area-0.0.0.10]network 11.0.0.0 0.255.255.255


[AR5]router id 5.5.5.5 [AR5]ospf 1

[AR5-ospf-1]area 0

[AR5-ospf-1-area-0.0.0.0]network 10.0.0.0 0.255.255.255 [AR5-ospf-1-area-0.0.0.0]area 20

[AR5-ospf-1-area-0.0.0.10]network 12.0.0.0 0.255.255.255


[AR6]router id 6.6.6.6 [AR6]ospf 1

[AR6-ospf-1]area 10

[AR6-ospf-1-area-0.0.0.10]network 0.0.0.0 0.0.0.0


[AR7]router id 7.7.7.7 [AR7]ospf 1

[AR7-ospf-1]area 20

[AR7-ospf-1-area-0.0.0.10]network 0.0.0.0 0.0.0.0


验证: 查看邻居关系,以下为 AR1 的输出结果,其他设备略

[AR1]display ospf peer brief

Area Id Interface Neighbor id State

0.0.0.0 GigabitEthernet0/0/1 2.2.2.2 Full

0.0.0.0 GigabitEthernet0/0/2 3.3.3.3 Full


查看路由,以下为 AR1 的路由表,其他设备略

[AR1]display ip routing-table protocol ospf Route Flags: R - relay, D - download to fib

Public routing table : OSPF

Destinations : 11 Routes : 18


OSPF routing table status :

Destinations : 11 Routes : 18


Destination/Mask Proto Pre Cost Flags NextHop Interface


 10.10.23.0/24  OSPF    10  2          D 10.10.12.2 GigabitEthernet 

1

0/0/1

OSPF 10 2 D 10.10.13.3 GigabitEthernet 0/0/2

10.10.24.0/24 OSPF 10 2 D 10.10.12.2 GigabitEthernet 0/0/1


3、引入默认路由


[AR1-ospf-1]default-route-advertise always


验证(各设备均可看到默认路由)

[AR3]display ip routing-table

Route Flags: R - relay, D download to fib


Routing Tables: Public

Destinations : 26 Routes : 29


Destination/Mask Proto Pre Cost Flags NextHop Interface


    0.0.0.0/0 O_ASE 150 1 D 10.10.13.1 GigabitEthernet 

1

0/0/2


4、路由汇总


[AR4]ospf 1

[AR4-ospf-1]area 10

[AR4-ospf-1-area-0.0.0.10]abr-summary 192.168.0.0 255.255.0.0


验证:

[AR1]dis ip routing-table 192.168.0.1


Route Flags: R - relay, D - download to fib

------------------------------------------------------------------------------

Routing Table : Public Summary Count : 2

Destination/Mask Proto Pre Cost Flags NextHop Interface


192.168.0.0/16  OSPF    10  3          D 10.10.12.2 GigabitEthernet 

1

0/0/1

OSPF 10 3 D 10.10.13.3 GigabitEthernet

0/0/2


5、配置完全 stub 区域


[AR4]ospf 1

[AR4-ospf-1]area 10

[AR4-ospf-1-area-0.0.0.10]stub no-summary


[AR6]ospf 1

[AR6-ospf-1]area 10

[AR6-ospf-1-area-0.0.0.10]stub no-summary


验证:

[AR6]dis ip routing-table protocol ospf Route Flags: R - relay, D download to fib

------------------------------------------------------------------------------

Public routing table : OSPF

Destinations : 1 Routes : 1


OSPF routing table status :

Destinations : 1 Routes : 1


Destination/Mask Proto Pre Cost Flags NextHop Interface


    0.0.0.0/0   OSPF    10   2       D   11.10.46.4      GigabitEthernet 0/0/2 

1

6、修改接口 cost 实现合理分流,且来回路径一致’


[AR4]int gi0/0/1

[AR4-GigabitEthernet0/0/1]ospf cost 1000


[AR5]int gi0/0/2

[AR5-GigabitEthernet0/0/2]ospf cost 1000


[AR2]int gi0/0/2

[AR2-GigabitEthernet0/0/2]ospf cost 1000


[AR3]int gi0/0/1

[AR3-GigabitEthernet0/0/1]ospf cost 1000


验证: 访问外网的路径,AR4 和 AR5 分别走不同路径


[AR4]dis ip routing-table 8.8.8.8

Route Flags: R - relay, D - download to fib

------------------------------------------------------------------------------

Routing Table : Public Summary Count : 1

Destination/Mask Proto Pre Cost Flags NextHop Interface


    0.0.0.0/0   O_ASE   150 1          D 10.10.24.2 GigabitEthernet 

1

0/0/0


[AR5]dis ip routing-table 8.8.8.8

Route Flags: R - relay, D download to fib

------------------------------------------------------------------------------

Routing Table : Public Summary Count : 1

Destination/Mask Proto Pre Cost Flags NextHop Interface


    0.0.0.0/0   O_ASE   150  1       D   10.10.35.3      GigabitEthernet 0/0/0 

1

回包路径,给 192 和 172 网段走不同路径


[AR1]dis ip routing-table 192.168.0.1 Route Flags: R - relay, D download to fib

------------------------------------------------------------------------------

Routing Table : Public Summary Count : 1

Destination/Mask Proto Pre Cost Flags NextHop Interface


192.168.0.0/16  OSPF    10  3          D 10.10.12.2 GigabitEthernet 

1

0/0/1

[AR1]dis ip routing-table 172.16.0.1

Route Flags: R - relay, D - download to fib

------------------------------------------------------------------------------

Routing Table : Public Summary Count : 1

Destination/Mask Proto Pre Cost Flags NextHop Interface


 172.16.0.0/16  OSPF    10  3          D 10.10.13.3 GigabitEthernet 

1

0/0/2


7、修改网络类型,加快收敛


[AR1]int gi0/0/1

[AR1-GigabitEthernet0/0/1]ospf network-type p2p


[AR2]int gi0/0/1

[AR2-GigabitEthernet0/0/1]ospf network-type p2p


验证:

[AR1]display ospf peer | include DR


 OSPF Process 1 with Router ID 1.1.1.1 

  Neighbors  

1

2

Area 0.0.0.0 interface 10.10.12.1(GigabitEthernet0/0/1)'s neighbors

DR: None BDR: None


8、配置出口 NAT,实现外网连通性


acl number 2000

rule 5 permit source 192.168.0.0 0.0.255.255

rule 10 permit source 172.16.0.0 0.0.255.255

rule 15 deny


nat address-group 1 64.1.1.2 64.1.1.3 interface GigabitEthernet0/0/0

ip address 64.1.1.1 255.255.255.0

nat outbound 2000 address-group 1


ip route-static 0.0.0.0 0.0.0.0 64.1.1.6


验证:


[AR6]ping -a 192.168.0.1 8.8.8.8

PING 8.8.8.8: 56 data bytes, press CTRL_C to break

Reply from 8.8.8.8: bytes=56 Sequence=1 ttl=252 time=30 ms

Reply from 8.8.8.8: bytes=56 Sequence=2 ttl=252 time=30 ms

Reply from 8.8.8.8: bytes=56 Sequence=3 ttl=252 time=30 ms

Reply from 8.8.8.8: bytes=56 Sequence=4 ttl=252 time=30 ms

Reply from 8.8.8.8: bytes=56 Sequence=5 ttl=252 time=40 ms


— 8.8.8.8 ping statistics —

5 packet(s) transmitted

5 packet(s) received

0.00% packet loss

round-trip min/avg/max = 30/32/40 ms


9、安全性增强

被动接口

[AR6-ospf-1]silent-interface gi0/0/0


邻居验证

[AR4-GigabitEthernet0/0/2]ospf authentication-mode md5 1 zhynet

[AR6-GigabitEthernet0/0/2]ospf authentication-mode md5 1 zhynet

标签:10,AR4,area,ospf,区域,实验,0.0,OSPF,8.8
来源: https://blog.51cto.com/14841124/2672182