企业配置EIGRP默认路由

300阅读 0评论2014-01-23 wfeng
分类:系统运维

在中小型企业中,一般会考虑内网所有的电脑通过一台边界器(即公司与外网相连的那台器)来进行网上冲浪或是其它internet活动。

示例的拓扑图如下:


公司的三个点,内部路由器之间通过EIGRP共享路由信息。同时,R2为公司总部的路由器,所有R1和R3的用户都要通过R1来连接internet。只有R2配有一个公网IP:200.15.8.60.

目的:要使所有内网之间可以互相通讯,并可以通过R2路由器与外部通讯。本例中假如外部IP:100.100.100.100与200.200.200.200.

首先:

我们在公司之间EIGRP,并通告所有的网段。这个没有问题,经过之后,使内部网段之间可以互访。

R1中,我们可以使用EIGRP来通告网段:172.16.1.0/24  192.168.30.4/30 192.168.30.0/30,并将Fa1/0配置为被动接口。

R2中,通告网段172.16.2.0/24 192.168.30.8/24 192.168.30.0/24及网段200.15.8.60。

R3中,通告网段192.168.30.8/30  192.168.30.4/30  172.16.3.0/24,并钭Fa1/0配置为被动接口。

经过以上配置,主机之间互ping应该都可以通,同时,C1、C2、C3都可以ping通200.15.8.60/24这个公网IP。由于R2通告了200.15.8.0、24网段,三台主机也可ping通200.15.8.80/24。

但此时,并不能说明所有的内网主机可以通过R2上网。

于是,我们可以在R2上做个路由。

ip route 0.0.0.0 0.0.0.0.0 s2/0

则此时:C2可以ping通外网了。

VPCS[2]> ping 100.100.100.100
100.100.100.100 icmp_seq=1 ttl=254 time=52.000 ms
100.100.100.100 icmp_seq=2 ttl=254 time=30.000 ms
100.100.100.100 icmp_seq=3 ttl=254 time=10.000 ms
100.100.100.100 icmp_seq=4 ttl=254 time=15.000 ms
100.100.100.100 icmp_seq=5 ttl=254 time=81.000 ms

VPCS[2]> ping 200.200.200.200
200.200.200.200 icmp_seq=1 ttl=254 time=45.000 ms
200.200.200.200 icmp_seq=2 ttl=254 time=19.000 ms
200.200.200.200 icmp_seq=3 ttl=254 time=34.000 ms
200.200.200.200 icmp_seq=4 ttl=254 time=16.000 ms
200.200.200.200 icmp_seq=5 ttl=254 time=21.000 ms

可以查看R2的路由表:

R2#show ip route                                     
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - , IA - inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is 0.0.0.0 to network 0.0.0.0

     192.168.30.0/30 is subnetted, 3 subnets
D       192.168.30.4 [90/2681856] via 192.168.30.9, 00:41:28, Serial2/1
                     [90/2681856] via 192.168.30.2, 00:41:28, Serial2/0
C       192.168.30.0 is directly connected, Serial2/0
C       192.168.30.8 is directly connected, Serial2/1
     172.16.0.0/24 is subnetted, 3 subnets
D       172.16.1.0 [90/2172416] via 192.168.30.2, 00:41:28, Serial2/0
C       172.16.2.0 is directly connected, FastEthernet0/0
D       172.16.3.0 [90/2172416] via 192.168.30.9, 00:22:19, Serial2/1
C    200.15.8.0/24 is directly connected, Serial2/2
S*   0.0.0.0/0 is directly connected, Serial2/2

由于C2与R2直连,经过配置默认路由,则C2网段的电脑可以上外网。

但此时,在C1和C3网段上,试着ping外网。

C1上:

VPCS[1]> ping 200.200.200.200
200.200.200.200 icmp_seq=1 timeout
200.200.200.200 icmp_seq=2 timeout
200.200.200.200 icmp_seq=3 timeout
200.200.200.200 icmp_seq=4 timeout
200.200.200.200 icmp_seq=5 timeout

C3上:

VPCS[3]> ping 200.200.200.200
200.200.200.200 icmp_seq=1 timeout
200.200.200.200 icmp_seq=2 timeout
200.200.200.200 icmp_seq=3 timeout
200.200.200.200 icmp_seq=4 timeout
200.200.200.200 icmp_seq=5 timeout

都不通,我们查看R1与R3的路由表:

R1:

R1#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

     192.168.30.0/30 is subnetted, 3 subnets
C       192.168.30.4 is directly connected, Serial0/3
C       192.168.30.0 is directly connected, Serial0/0
D       192.168.30.8 [90/2681856] via 192.168.30.6, 00:44:23, Serial0/3
                     [90/2681856] via 192.168.30.1, 00:44:23, Serial0/0
     172.16.0.0/24 is subnetted, 3 subnets
C       172.16.1.0 is directly connected, FastEthernet1/0
D       172.16.2.0 [90/2172416] via 192.168.30.1, 00:44:21, Serial0/0
D       172.16.3.0 [90/2172416] via 192.168.30.6, 00:25:13, Serial0/3
D    200.15.8.0/24 [90/2681856] via 192.168.30.1, 00:21:32, Serial0/0

R3:

R3#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

     192.168.30.0/30 is subnetted, 3 subnets
C       192.168.30.4 is directly connected, Serial3/1
D       192.168.30.0 [90/2681856] via 192.168.30.10, 00:44:46, Serial3/0
                     [90/2681856] via 192.168.30.5, 00:44:46, Serial3/1
C       192.168.30.8 is directly connected, Serial3/0
     172.16.0.0/24 is subnetted, 3 subnets
D       172.16.1.0 [90/2172416] via 192.168.30.5, 00:44:46, Serial3/1
D       172.16.2.0 [90/2172416] via 192.168.30.10, 00:44:46, Serial3/0
C       172.16.3.0 is directly connected, FastEthernet1/0
D    200.15.8.0/24 [90/2681856] via 192.168.30.10, 00:21:57, Serial3/0

均没有默认路由,则不在路由表中的目标,数据包则无法到达。

在EIGRP中,通告默认路由的方法有两种:

第一种是:在边界路由器上声明一条默认路由:ip route 0.0.0.0 0.0.0.0 interface。然后在EIGRP中,用命令network 0.0.0.0来通告它。

这样,所有其它邻接路由器将收到默认路由。

R2路由器上的配置:

router eigrp 100
 passive-interface FastEthernet0/0
 network 172.16.0.0
 network 192.168.30.0 0.0.0.3
 network 192.168.30.8 0.0.0.3
 network 200.15.8.0
 network 0.0.0.0
 no auto-summary
!        
ip http server
!        
ip route 0.0.0.0 0.0.0.0 Serial2/2

此时,通告了0.0.0.0。刚查看R1与R3的路由表。

R1:

R1#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is 192.168.30.1 to network 0.0.0.0

     192.168.30.0/30 is subnetted, 3 subnets
C       192.168.30.4 is directly connected, Serial0/3
C       192.168.30.0 is directly connected, Serial0/0
D       192.168.30.8 [90/2681856] via 192.168.30.6, 01:04:45, Serial0/3
                     [90/2681856] via 192.168.30.1, 01:04:45, Serial0/0
     172.16.0.0/24 is subnetted, 3 subnets
C       172.16.1.0 is directly connected, FastEthernet1/0
D       172.16.2.0 [90/2172416] via 192.168.30.1, 01:04:44, Serial0/0
D       172.16.3.0 [90/2172416] via 192.168.30.6, 00:45:36, Serial0/3
D    200.15.8.0/24 [90/2681856] via 192.168.30.1, 00:41:55, Serial0/0
D*   0.0.0.0/0 [90/2681856] via 192.168.30.1, 00:00:11, Serial0/0

R3的路由表:

R3#show run
*Mar  1 01:08:03.791: %SYS-5-CONFIG_I: Configured from console by console
R3#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is 192.168.30.10 to network 0.0.0.0

     192.168.30.0/30 is subnetted, 3 subnets
C       192.168.30.4 is directly connected, Serial3/1
D       192.168.30.0 [90/2681856] via 192.168.30.10, 01:07:46, Serial3/0
                     [90/2681856] via 192.168.30.5, 01:07:46, Serial3/1
C       192.168.30.8 is directly connected, Serial3/0
     172.16.0.0/24 is subnetted, 3 subnets
D       172.16.1.0 [90/2172416] via 192.168.30.5, 01:07:46, Serial3/1
D       172.16.2.0 [90/2172416] via 192.168.30.10, 01:07:46, Serial3/0
C       172.16.3.0 is directly connected, FastEthernet1/0
D    200.15.8.0/24 [90/2681856] via 192.168.30.10, 00:44:57, Serial3/0
D*   0.0.0.0/0 [90/2681856] via 192.168.30.10, 00:03:13, Serial3/0

从路由表中可以看到,R1、R3都得到了默认路由,并指定出默认路由的出口,这样,

所有不在路由表中的目的地,都将经过这些出口转发到R2中,然后R2将它们由出口接口转发到internet上。

我们再在C1与C3上ping外网:

C1:

VPCS[1]> ping 200.200.200.200
200.200.200.200 icmp_seq=1 ttl=253 time=57.000 ms
200.200.200.200 icmp_seq=2 ttl=253 time=21.000 ms
200.200.200.200 icmp_seq=3 ttl=253 time=30.000 ms
200.200.200.200 icmp_seq=4 ttl=253 time=62.000 ms
200.200.200.200 icmp_seq=5 ttl=253 time=15.000 ms

C3:
VPCS[3]> ping 200.200.200.200
200.200.200.200 icmp_seq=1 ttl=253 time=52.000 ms
200.200.200.200 icmp_seq=2 ttl=253 time=90.000 ms
200.200.200.200 icmp_seq=3 ttl=253 time=25.000 ms
200.200.200.200 icmp_seq=4 ttl=253 time=49.000 ms
200.200.200.200 icmp_seq=5 ttl=253 time=83.000 ms

都可以通,这样就达成目的了,不过这样通告路由,外部的EIGRP路由器将会收到EIGRP包。对安全可能会有影响。

第二种是:在边界路由器上,使用命令ip default-network +出口的那个网段。来通告此网段作为默认出口。

见R2的配置:

 router eigrp 100
 passive-interface FastEthernet0/0
 network 172.16.0.0
 network 192.168.30.0 0.0.0.3
 network 192.168.30.8 0.0.0.3
 network 200.15.8.0
 no auto-summary
!        
ip http server
!        
ip default-network 200.15.8.0
ip route 0.0.0.0 0.0.0.0 Serial2/2

EIGRP一定要通告200.15.8.0,即ip defualt-network通告的这个网段

 接着,我们再看R1与R3的路由表:

R1:

R1#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is 192.168.30.1 to network 200.15.8.0

     192.168.30.0/30 is subnetted, 3 subnets
C       192.168.30.4 is directly connected, Serial0/3
C       192.168.30.0 is directly connected, Serial0/0
D       192.168.30.8 [90/2681856] via 192.168.30.6, 00:00:49, Serial0/3
                     [90/2681856] via 192.168.30.1, 00:00:49, Serial0/0
     172.16.0.0/24 is subnetted, 2 subnets
C       172.16.1.0 is directly connected, FastEthernet1/0
D       172.16.2.0 [90/2172416] via 192.168.30.1, 00:00:48, Serial0/0
D*   200.15.8.0/24 [90/2681856] via 192.168.30.1, 00:00:14, Serial0/0

 R3:

R3#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is 192.168.30.10 to network 200.15.8.0

     192.168.30.0/30 is subnetted, 3 subnets
C       192.168.30.4 is directly connected, Serial3/1
D       192.168.30.0 [90/2681856] via 192.168.30.10, 00:03:56, Serial3/0
                     [90/2681856] via 192.168.30.5, 00:03:56, Serial3/1
C       192.168.30.8 is directly connected, Serial3/0
     172.16.0.0/24 is subnetted, 3 subnets
D       172.16.1.0 [90/2172416] via 192.168.30.5, 00:03:56, Serial3/1
D       172.16.2.0 [90/2172416] via 192.168.30.10, 00:03:56, Serial3/0
C       172.16.3.0 is directly connected, FastEthernet1/0
D*   200.15.8.0/24 [90/2681856] via 192.168.30.10, 00:03:23, Serial3/0

这样,R1与R3都收到了默认路由。

再在C1与C3上ping外网:

C1:

VPCS[1]> ping 200.200.200.200
200.200.200.200 icmp_seq=1 ttl=253 time=57.000 ms
200.200.200.200 icmp_seq=2 ttl=253 time=21.000 ms
200.200.200.200 icmp_seq=3 ttl=253 time=30.000 ms
200.200.200.200 icmp_seq=4 ttl=253 time=62.000 ms
200.200.200.200 icmp_seq=5 ttl=253 time=15.000 ms

C3:
VPCS[3]> ping 200.200.200.200
200.200.200.200 icmp_seq=1 ttl=253 time=52.000 ms
200.200.200.200 icmp_seq=2 ttl=253 time=90.000 ms
200.200.200.200 icmp_seq=3 ttl=253 time=25.000 ms
200.200.200.200 icmp_seq=4 ttl=253 time=49.000 ms
200.200.200.200 icmp_seq=5 ttl=253 time=83.000 ms

至此,所有内部网段能互相通讯,并都能通过R2上网。

 
    
上一篇:linux 安装tomcat
下一篇:Juniper 防火墙的网络防攻击设置