当前位置： 首页 > news >正文

PIX8.0双链路***和上互联网流量分开且线路冗余测试

news 来源：原创 2024/5/9 21:15:56

一.概述：

   总部和分部两端都为PIX8.0，都为双链路，比如一个电信的线路，一个移动的线路，要求电信的线路走各自内网上互联网的流量，移动的线路走***流量，但是如果电信线路故障，或者移动线路故障，不能中断互联网和***的连接。

二.基本思路：

A.设置两条默认网关，移动线路metric值为254；电信线路metric值为1，并且sla监控电信线路的网关

----这样就保证默认互联网流量走电信线路，当电信线路故障时，走移动线路

B.设置两条到达对方内网的***流量的路由，电信线路metric值为254；移动线路metric值为1，并且用sla监控对方PIX的移动线路的接口地址

----这样就保证***流量默认走移动线路，当移动线路出现故障时，两边***流量都走电信线路

三.测试拓扑：

233507360.jpg

四.基本配置：

A.R1：

interface FastEthernet0/0
ip address 172.16.1.2 255.255.255.0
no shut
ip route 0.0.0.0 0.0.0.0 172.16.1.1

B.PIX1：

interface Ethernet0
nameif inside
security-level 100
ip address 172.16.1.1 255.255.255.0
no shut
interface Ethernet1
nameif Outside
security-level 0
ip address 202.100.1.1 255.255.255.0
no shut

interface Ethernet2
nameif Backup
security-level 0
ip address 61.1.1.1 255.255.255.0
no shut

C.R2：

interface FastEthernet0/0
ip address 202.100.1.10 255.255.255.0
no shut
interface FastEthernet0/1
ip address 202.100.2.10 255.255.255.0
no shut

D.R3：

interface FastEthernet0/0
ip address 61.1.1.10 255.255.255.0
no shut

interface FastEthernet0/1
ip address 61.1.2.10 255.255.255.0
no shut

E.PIX2：

interface Ethernet0
nameif Inside
security-level 100
ip address 192.168.1.1 255.255.255.0
no shut

interface Ethernet1
nameif Outside
security-level 0
ip address 202.100.2.1 255.255.255.0
no shut

interface Ethernet2
nameif Backup
security-level 0
ip address 61.1.2.1 255.255.255.0
 no shut

F.R4：

interface FastEthernet0/0
ip address 192.168.1.2 255.255.255.0
 no shut

ip route 0.0.0.0 0.0.0.0 192.168.1.1

五.防火墙配置：

A.PIX1：

①sla配置：

sla monitor 1
type echo protocol ipIcmpEcho 202.100.1.10 interface Outside
frequency 10
sla monitor schedule 1 life forever start-time now
sla monitor 2
type echo protocol ipIcmpEcho 61.1.2.1 interface Backup
num-packets 3
frequency 10

②track配置：

track 1 rtr 1 reachability
track 2 rtr 2 reachability

③默认路由配置：

route Outside 0.0.0.0 0.0.0.0 202.100.1.10 1 track 1
route Backup 0.0.0.0 0.0.0.0 61.1.1.10 10

④静态路由配置：

route Backup 61.1.2.1 255.255.255.255 61.1.1.10 1 （为track2服务）
route Backup 192.168.1.0 255.255.255.0 61.1.1.10 1 track 2
route Outside 192.168.1.0 255.255.255.0 202.100.1.10 254
---***不要配置反向路由注入

⑤PAT及NAT免除配置：

access-list PAT extended permit ip 172.16.1.0 255.255.255.0 any
nat (inside) 1 access-list PAT
global (Outside) 1 interface
global (Backup) 1 interface
access-list NONAT extended permit ip 172.16.1.0 255.255.255.0 192.168.1.0 255.255.255.0
nat (inside) 0 access-list NONAT

⑥策略配置：

access-list OUTSIDE extended permit icmp any any
access-list BACKUP extended permit icmp any any
access-group OUTSIDE in interface Outside
access-group BACKUP in interface Backup

⑦L2L***配置：

---第一阶段策略：
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash md5
group 2
tunnel-group 202.100.2.1 type ipsec-l2l
tunnel-group 202.100.2.1 ipsec-attributes
pre-shared-key cisco
isakmp keepalive threshold 20 retry 3
tunnel-group 61.1.2.1 type ipsec-l2l
tunnel-group 61.1.2.1 ipsec-attributes
pre-shared-key cisco
isakmp keepalive threshold 20 retry 3
---第二阶段转换集：
crypto ipsec transform-set transet esp-des esp-md5-hmac
---感兴趣流：
access-list *** extended permit ip 172.16.1.0 255.255.255.0 192.168.1.0 255.255.255.0
---配置crypto map并在接口应该，接口启用isakmp：
crypto map crymap 10 match address ***
crypto map crymap 10 set peer 202.100.2.1
crypto map crymap 10 set transform-set transet
crypto map crymap interface Outside
crypto map crymap-backup 10 match address ***
crypto map crymap-backup 10 set peer 61.1.2.1
crypto map crymap-backup 10 set transform-set transet
crypto map crymap-backup interface Backup
crypto isakmp enable Outside
crypto isakmp enable Backup

B.PIX2：

①sla配置：

sla monitor 1
type echo protocol ipIcmpEcho 202.100.2.10 interface Outside
frequency 10
sla monitor schedule 1 life forever start-time now
sla monitor 2
type echo protocol ipIcmpEcho 61.1.1.1 interface Backup
num-packets 3
frequency 10

②track配置：

track 1 rtr 1 reachability
track 2 rtr 2 reachability

③默认路由配置：

route Outside 0.0.0.0 0.0.0.0 202.100.2.10 1 track 1
route Backup 0.0.0.0 0.0.0.0 61.1.2.10 10

④静态路由配置：

route Backup 61.1.1.1 255.255.255.255 61.1.2.10 1 （为track2服务）
route Backup 172.16.1.0 255.255.255.0 61.1.2.10 1 track 2
route Outside 172.16.1.0 255.255.255.0 202.100.2.10 254
---***不要配置反向路由注入

⑤PAT及NAT免除配置：

access-list PAT extended permit ip 192.168.1.0 255.255.255.0 any
nat (inside) 1 access-list PAT
global (Outside) 1 interface
global (Backup) 1 interface
access-list NONAT extended permit ip 192.168.1.0 255.255.255.0 172.16.1.0 255.255.255.0  
nat (inside) 0 access-list NONAT

⑥策略配置：

access-list OUTSIDE extended permit icmp any any
access-list BACKUP extended permit icmp any any
access-group OUTSIDE in interface Outside
access-group BACKUP in interface Backup

⑦L2L***配置：

---第一阶段策略：
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash md5
group 2
tunnel-group 202.100.1.1 type ipsec-l2l
tunnel-group 202.100.1.1 ipsec-attributes
pre-shared-key cisco
isakmp keepalive threshold 20 retry 3
tunnel-group 61.1.1.1 type ipsec-l2l
tunnel-group 61.1.1.1 ipsec-attributes
pre-shared-key cisco
isakmp keepalive threshold 20 retry 3
---第二阶段转换集：
crypto ipsec transform-set transet esp-des esp-md5-hmac
---感兴趣流：
access-list *** extended permit ip 192.168.1.0 255.255.255.0 172.16.1.0 255.255.255.0
---配置crypto map并在接口应该，接口启用isakmp：
crypto map crymap 10 match address ***
crypto map crymap 10 set peer 202.100.1.1
crypto map crymap 10 set transform-set transet
crypto map crymap interface Outside
crypto map crymap-backup 10 match address ***
crypto map crymap-backup 10 set peer 61.1.1.1
crypto map crymap-backup 10 set transform-set transet
crypto map crymap-backup interface Backup
crypto isakmp enable Outside
crypto isakmp enable Backup

六.验证：

A.双链路都正常情况下：

---互联网流量走Outside接口，***流量走Backup接口

---从下面的路由情况可以看出

PIX1# sho route

Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
      D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
      N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
      E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
      i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
      * - candidate default, U - per-user static route, o - ODR
      P - periodic downloaded static route

Gateway of last resort is 202.100.1.10 to network 0.0.0.0

C    172.16.1.0 255.255.255.0 is directly connected, inside
C    202.100.1.0 255.255.255.0 is directly connected, Outside
S    192.168.1.0 255.255.255.0 [1/0] via 61.1.1.10, Backup
C    61.1.1.0 255.255.255.0 is directly connected, Backup
S    61.1.2.1 255.255.255.255 [1/0] via 61.1.1.10, Backup
S*   0.0.0.0 0.0.0.0 [1/0] via 202.100.1.10, Outside

PIX2# show route

Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
      D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
      N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
      E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
      i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
      * - candidate default, U - per-user static route, o - ODR
      P - periodic downloaded static route

Gateway of last resort is 202.100.2.10 to network 0.0.0.0

C    202.100.2.0 255.255.255.0 is directly connected, Outside
S    172.16.1.0 255.255.255.0 [1/0] via 61.1.2.10, Backup
C    192.168.1.0 255.255.255.0 is directly connected, Inside
S    61.1.1.1 255.255.255.255 [1/0] via 61.1.2.10, Backup
C    61.1.2.0 255.255.255.0 is directly connected, Backup
S*   0.0.0.0 0.0.0.0 [1/0] via 202.100.2.10, Outside

B.PIX1/PIX2只是Outside链路出现故障：

---手工将R2连接PIX1/PIX2的Outside接口shutdown

---这时只影响PIX1/PIX2的默认路由，上互联网的流量，不影响***的流量

PIX1# show route

Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
      D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
      N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
      E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
      i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
      * - candidate default, U - per-user static route, o - ODR
      P - periodic downloaded static route

Gateway of last resort is 61.1.1.10 to network 0.0.0.0

C    172.16.1.0 255.255.255.0 is directly connected, inside
C    202.100.1.0 255.255.255.0 is directly connected, Outside
S    192.168.1.0 255.255.255.0 [1/0] via 61.1.1.10, Backup
C    61.1.1.0 255.255.255.0 is directly connected, Backup
S    61.1.2.1 255.255.255.255 [1/0] via 61.1.1.10, Backup
S*   0.0.0.0 0.0.0.0 [10/0] via 61.1.1.10, Backup

PIX2# show route

Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
      D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
      N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
      E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
      i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
      * - candidate default, U - per-user static route, o - ODR
      P - periodic downloaded static route

Gateway of last resort is 61.1.2.10 to network 0.0.0.0

C    202.100.2.0 255.255.255.0 is directly connected, Outside
S    172.16.1.0 255.255.255.0 [1/0] via 61.1.2.10, Backup
C    192.168.1.0 255.255.255.0 is directly connected, Inside
S    61.1.1.1 255.255.255.255 [1/0] via 61.1.2.10, Backup
C    61.1.2.0 255.255.255.0 is directly connected, Backup
S*   0.0.0.0 0.0.0.0 [10/0] via 61.1.2.10, Backup

---如果Outside链路恢复正常，SLA监控到后，默认路由会切换回去，互联网流量仍然走Outside接口

C.PIX1/PIX2只是Backup链路出现故障：

---因为***流量是监控对方Backup接口地址，所以只需任何一方Backup链路出现故障，***流量就会发生切换，这样可避免如果两家运营商地址互相不通，用Outside接口去与对方的Backup接口，导致***无法建立的情况

PIX1# show route

Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
      D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
      N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
      E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
      i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
      * - candidate default, U - per-user static route, o - ODR
      P - periodic downloaded static route

Gateway of last resort is 202.100.1.10 to network 0.0.0.0

C    172.16.1.0 255.255.255.0 is directly connected, inside
C    202.100.1.0 255.255.255.0 is directly connected, Outside
S    192.168.1.0 255.255.255.0 [254/0] via 202.100.1.10, Outside
C    61.1.1.0 255.255.255.0 is directly connected, Backup
S    61.1.2.1 255.255.255.255 [1/0] via 61.1.1.10, Backup
S*   0.0.0.0 0.0.0.0 [1/0] via 202.100.1.10, Outside

PIX2# show route

Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
      D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
      N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
      E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
      i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
      * - candidate default, U - per-user static route, o - ODR
      P - periodic downloaded static route

Gateway of last resort is 202.100.2.10 to network 0.0.0.0

C    202.100.2.0 255.255.255.0 is directly connected, Outside
S    172.16.1.0 255.255.255.0 [254/0] via 202.100.2.10, Outside
C    192.168.1.0 255.255.255.0 is directly connected, Inside
S    61.1.1.1 255.255.255.255 [1/0] via 61.1.2.10, Backup
C    61.1.2.0 255.255.255.0 is directly connected, Backup
S*   0.0.0.0 0.0.0.0 [1/0] via 202.100.2.10, Outside

---如果Backup链路恢复正常，即SLA监控到互相能ping通对方的Backup接口地址后，到达对方内网的路由会切换回去，***流量仍然走Backup接口

相关文章：

  • ie，你还能再浪一点不
  • C# params参数的应用
  • SSH2实现数据库和界面的分页
  • 总结2
  • 单点登录-利用HttpModuler实现WEB程序同一时间只让一个用户实例登陆(修改)
  • Spring IOC 和 DI 理解
  • SQL Server 2008数据备份与还原（操作篇）
  • jQuery EasyUI学习资料汇总
  • lync 2010 批量启用用户
  • mysqldump学习
  • Silverlight 结合ArcGis 在地图画点
  • 摇摆的立场
  • sed 单行操作快速参考
  • 淘宝SEO珍贵笔记
  • Hadoop中HDFS和MapReduce节点基本简介
  • ［分享］iOS开发 － 实现UITableView Plain SectionView和table不停留一起滑动
  • 【402天】跃迁之路——程序员高效学习方法论探索系列（实验阶段159-2018.03.14）...
  • Android Studio：GIT提交项目到远程仓库
  • Android路由框架AnnoRouter：使用Java接口来定义路由跳转
  • css布局，左右固定中间自适应实现
  • Electron入门介绍
  • HashMap剖析之内部结构
  • HTTP 简介
  • IndexedDB
  • Logstash 参考指南（目录）
  • react-native 安卓真机环境搭建
  • Service Worker
  • storm drpc实例
  • 初识 webpack
  • 给github项目添加CI badge
  • 工程优化暨babel升级小记
  • 基于Mobx的多页面小程序的全局共享状态管理实践
  • 实战｜智能家居行业移动应用性能分析
  • 腾讯大梁：DevOps最后一棒，有效构建海量运营的持续反馈能力
  • 学习JavaScript数据结构与算法 — 树
  • 用 vue 组件自定义 v-model， 实现一个 Tab 组件。
  • 用简单代码看卷积组块发展
  • 阿里云服务器购买完整流程
  • #{} 和 ${}区别
  • $.ajax()
  • （1）虚拟机的安装与使用,linux系统安装
  • (html转换)StringEscapeUtils类的转义与反转义方法
  • (使用vite搭建vue3项目（vite + vue3 + vue router + pinia + element plus）)
  • .java 9 找不到符号_java找不到符号
  • .NET/C# 使窗口永不获得焦点
  • .NET6 开发一个检查某些状态持续多长时间的类
  • .NET建议使用的大小写命名原则
  • // an array of int
  • /dev下添加设备节点的方法步骤（通过device_create）
  • @EnableWebMvc介绍和使用详细demo
  • @基于大模型的旅游路线推荐方案
  • [20161101]rman备份与数据文件变化7.txt
  • [28期] lamp兄弟连28期学员手册，请大家务必看一下
  • [ABC294Ex] K-Coloring
  • [Android] Implementation vs API dependency