网络安全高级工程师证书 网络安全工程师 高级

目录

实验要求

实验思路

实验步骤及配置

1、骨干链路IP地址及环回接口的配置

2、启动IGP协议OSPF

3、启动MPLS，搭建MPLS域

4、在R2、R4两个边界路由器上配置两个不同站点的通道

5、给私网设备配置IP地址及环回接口

6、静态配置路由

7、动态路由配置

8、R2与R4建立BGP关系

9、发布路由

10、在R7上配置缺省路由

实验结果接验证

1、A站点R1的路由信息查看

2、B站点R6的路由信息查看 

3、隧道A的路由信息

4、隧道B的路由信息

5、R1pingR5的环回接口

6、R7pingR2、R3、R4的环回接口

---

实验要求

1、R1和R5是客户A两个站点的CE设备，R6和R7是客户B两个站点的CE设备。设备MPLS VPN骨干网络分别连接不同客户的不同站点。

2、R1和R5采用静态路由的方式传递私网路由；R6通过RIP将私网路由传递给PE设备；R7通过OSPF将私网路由传递给PE设备。

3、R1与R2私网之间使用静态路由；R4与R5私网之间使用静态路由；R2与R6私网之间使用RIP；R4与R7私网之间使用OSPF。

3、R7单独拉一根网线保证可以访问公网，R7可以访问R2、R3、R4环回。

实验思路

1、首先配置骨干链路的IP地址及环回接口，启动IGP协议OSPF和激活MPLS通道。

2、配置客户站点的IP地址及环回接口，并划分不同通道，配置相关的路由协议。

3、中间骨干链路启动MP-BGP协议使得路由信息可以传递。

4、在R7上配置缺省路由，使得R7可以访问R2、R3、R4环回。

实验步骤及配置

1、骨干链路IP地址及环回接口的配置

R2
[r2]int g0/0/2
 [r2-GigabitEthernet0/0/2]ip a 23.0.0.1 24
 [r2-GigabitEthernet0/0/2]int lo0
 [r2-LoopBack0]ip a 2.2.2.2 24R3
[r3]int g0/0/0
 [r3-GigabitEthernet0/0/0]ip a 23.0.0.2 24
 [r3-GigabitEthernet0/0/0]int g0/0/1
 [r3-GigabitEthernet0/0/1]ip a 34.0.0.1 24
 [r3-GigabitEthernet0/0/1]int lo0
 [r3-LoopBack0]ip a 3.3.3.3 24R4
[r4]int g0/0/0
 [r4-GigabitEthernet0/0/0]ip a 34.0.0.2 24
 [r4-GigabitEthernet0/0/0]int g4/0/0
 [r4-GigabitEthernet4/0/0]ip a 47.0.0.2 24
 [r4-GigabitEthernet4/0/0]int lo0
 [r4-LoopBack0]ip a 4.4.4.4 24R7
[r7]int g0/0/1
 [r7-GigabitEthernet0/0/1]ip a 47.0.0.1 242、启动IGP协议OSPF
R2
[r2]ospf 1 router-id 2.2.2.2
 [r2-ospf-1]a 0
 [r2-ospf-1-area-0.0.0.0]network 23.0.0.0 0.0.0.255R3   
 [r3]ospf 1 router-id 3.3.3.3
 [r3-ospf-1]a 0
 [r3-ospf-1-area-0.0.0.0]network 23.0.0.0 0.0.0.255
 [r3-ospf-1-area-0.0.0.0]network 34.0.0.0 0.0.0.255 
 [r3-ospf-1-area-0.0.0.0]network 3.3.3.3 0.0.0.0R4
[r4]ospf 1 router-id 4.4.4.4
 [r4-ospf-1]a 0  
 [r4-ospf-1-area-0.0.0.0]network 34.0.0.0 0.0.0.255
 [r4-ospf-1-area-0.0.0.0]network 47.0.0.0 0.0.0.255
 [r4-ospf-1-area-0.0.0.0]network 4.4.4.4 0.0.0.03、启动MPLS，搭建MPLS域
R2
[r2]mpls lsr-id 2.2.2.2
 [r2]mpls 
 Info: Mpls starting, please wait... OK!
 [r2]mpls ldp 
 [r2]int g0/0/2
 [r2-GigabitEthernet0/0/2]mpls 
 [r2-GigabitEthernet0/0/2]mpls ldp R3
[r3]mpls lsr-id 3.3.3.3   
 [r3]mpls 
 Info: Mpls starting, please wait... OK!
 [r3]mpls ldp 
 [r3]int g0/0/0  
 [r3-GigabitEthernet0/0/0]mpls   
 [r3-GigabitEthernet0/0/0]mpls ldp 
 [r3]int g0/0/1  
 [r3-GigabitEthernet0/0/1]mpls 
 [r3-GigabitEthernet0/0/1]mpls ldp R4
[r4]mpls lsr-id 4.4.4.4 
 [r4]mpls 
 Info: Mpls starting, please wait... OK!  
 [r4]mpls ldp 
 [r4]int g0/0/0
 [r4-GigabitEthernet0/0/0]mpls  
 [r4-GigabitEthernet0/0/0]mpls ldp 4、在R2、R4两个边界路由器上配置两个不同站点的通道
R2
[r2]ip vpn-instance a                                                        客户A流量的通道
 [r2-vpn-instance-a]route-distinguisher 100:100 
 [r2-vpn-instance-a-af-ipv4]vpn-target 100:1 both 
  IVT Assignment result: 
 Info: VPN-Target assignment is successful.
  EVT Assignment result: 
 Info: VPN-Target assignment is successful.
 [r2]int g0/0/0 
 [r2-GigabitEthernet0/0/0]ip binding vpn-instance a
 Info: All IPv4 related configurations on this interface are removed!
 Info: All IPv6 related configurations on this interface are removed!

   
 [r2]ip vpn-instance b                                                         客户B流量的通道
 [r2-vpn-instance-b]route-distinguisher 200:200  
 [r2-vpn-instance-b-af-ipv4]vpn-target 200:1 both 
  IVT Assignment result: 
 Info: VPN-Target assignment is successful.
  EVT Assignment result: 
 Info: VPN-Target assignment is successful.
 [r2]int g0/0/1  
 [r2-GigabitEthernet0/0/1]ip binding vpn-instance b
 Info: All IPv4 related configurations on this interface are removed!
 Info: All IPv6 related configurations on this interface are removed!

 [r2]int g0/0/0
 [r2-GigabitEthernet0/0/0]ip a 192.168.2.2 24
 [r2-GigabitEthernet0/0/0]int g0/0/1
 [r2-GigabitEthernet0/0/1]ip a 172.16.2.2 24 R4
[r4]ip vpn-instance a                                                        客户A流量的通道
 [r4-vpn-instance-a]route-distinguisher 100:100
 [r4-vpn-instance-a-af-ipv4]vpn-target 100:1 both 
  IVT Assignment result: 
 Info: VPN-Target assignment is successful.
  EVT Assignment result: 
 Info: VPN-Target assignment is successful.
 [r4]int g0/0/1
 [r4-GigabitEthernet0/0/1]ip binding vpn-instance a
 Info: All IPv4 related configurations on this interface are removed!
 Info: All IPv6 related configurations on this interface are removed!

 [r4]ip vpn-instance b                                                        客户B流量的通道
 [r4-vpn-instance-b]route-distinguisher 200:200    
 [r4-vpn-instance-b-af-ipv4]vpn-target 200:1 both 
  IVT Assignment result: 
 Info: VPN-Target assignment is successful.
  EVT Assignment result: 
 Info: VPN-Target assignment is successful.
 [r4]int g0/0/2  
 [r4-GigabitEthernet0/0/2]ip binding vpn-instance b
 Info: All IPv4 related configurations on this interface are removed!
 Info: All IPv6 related configurations on this interface are removed!


 [r4]int g0/0/1
 [r4-GigabitEthernet0/0/1]ip a 192.168.3.2 24
 [r4]int g0/0/2
 [r4-GigabitEthernet0/0/2]ip a 172.16.3.2 245、给私网设备配置IP地址及环回接口
R1
[r1]int g0/0/0
 [r1-GigabitEthernet0/0/0]ip a 192.168.2.1 24
 [r1-GigabitEthernet0/0/0]int lo0
 [r1-LoopBack0]ip a 192.168.1.1 24R6
[r6-GigabitEthernet0/0/0]ip a 172.16.2.1 24
 [r6-GigabitEthernet0/0/0]int lo0
 [r6-LoopBack0]ip a 172.16.1.1 24R5
[r5-GigabitEthernet0/0/0]ip a 192.168.3.1 24
 [r5-GigabitEthernet0/0/0]int lo0
 [r5-LoopBack0]ip a 192.168.4.1 24 R7
[r7-GigabitEthernet0/0/0]ip a 172.168.3.1 24
 [r7-GigabitEthernet0/0/0]int lo0
 [r7-LoopBack0]ip a 172.16.4.1 246、静态配置路由
R1
[r1]ip route-static 192.168.3.0 24 192.168.2.2
 [r1]ip route-static 192.168.4.0 24 192.168.2.2R2
[r2]ip route-static vpn-instance a 192.168.1.0 24 192.168.2.1
R5
[r5]ip route-static 192.168.1.0 24 192.168.3.2   
 [r5]ip route-static 192.168.2.0 24 192.168.3.2R4
[r4]ip route-static vpn-instance a 192.168.4.0 24 192.168.3.1
7、动态路由配置
R6
[r6]rip 1
 [r6-rip-1]v 2
 [r6-rip-1]network 172.16.0.0R2
[r2]rip 1 vpn-instance b
 [r2-rip-1]v 2   
 [r2-rip-1]network 172.16.0.0R7
[r7]ospf 1 router-id 7.7.7.7
 [r7-ospf-1]a 0
 [r7-ospf-1-area-0.0.0.0]network 172.16.0.0 0.0.255.255R4
[r4]ospf 2 vpn-instance b router-id 4.4.4.4
 [r4-ospf-2]a 0    
 [r4-ospf-2-area-0.0.0.0]network 172.16.0.0 0.0.255.2558、R2与R4建立BGP关系
R2
[r2]bgp 1
 [r2-bgp]router-id 2.2.2.2
 [r2-bgp]peer 4.4.4.4 as 1  
 [r2-bgp]peer 4.4.4.4 connect-interface LoopBack 0  
 [r2-bgp]ipv4-family vpnv4   
 [r2-bgp-af-vpnv4]peer 4.4.4.4 enable R4
[r4]bgp 1 
 [r4-bgp]router-id 4.4.4.4    
 [r4-bgp]peer 2.2.2.2 as 1   
 [r4-bgp]peer 2.2.2.2 connect-interface LoopBack 0
 [r4-bgp]ipv4-family vpnv4
 [r4-bgp-af-vpnv4]peer 2.2.2.2 enable 9、发布路由
R2
[r2-bgp]ipv4-family vpn-instance a                 将R1静态与直连重发布
 [r2-bgp-a]import-route static 
 [r2-bgp-a]import-route direct R4
[r4-bgp]ipv4-family vpn-instance a                 将R5静态与直连重发布
 [r4-bgp-a]import-route static 
 [r4-bgp-a]import-route direct R2
[r2-bgp]ipv4-family vpn-instance b                 将RIP与BGP进行双向重发布
 [r2-bgp-b]import-route rip 1
 [r2]rip   
 [r2-rip-1]import-route bgp R4
[r4-bgp]ipv4-family vpn-instance b                 将BGP与OSPF进行双向重发布
 [r4-bgp-b]import-route ospf 2
 [r4]ospf 2
 [r4-ospf-2]import-route bgp 10、在R7上配置缺省路由
[r7]ip route-static 0.0.0.0 0 47.0.0.2

实验结果接验证

1、A站点R1的路由信息查看

2、B站点R6的路由信息查看 

3、隧道A的路由信息

 

4、隧道B的路由信息

 5、R1pingR5的环回接口

6、R7pingR2、R3、R4的环回接口