實驗一：DM***基本Hub-Spoke實驗
步驟一：配置底層
R1：
!
interface Loopback0
ip address 10.1.1.1 255.255.255.0
!
interface FastEthernet0/0
ip address dhcp
!
ip route 0.0.0.0 0.0.0.0 61.128.1.10
!
R2：
!
interface Loopback0
ip address 10.1.2.1 255.255.255.0
!
interface FastEthernet0/0
ip address dhcp
!
ip route 0.0.0.0 0.0.0.0 172.9.1.10
!
R3:
!
interface Loopback0
ip address 10.1.3.1 255.255.255.0
!
interface FastEthernet0/0
ip address 202.100.1.1 255.255.255.0
!
ip route 0.0.0.0 0.0.0.0 202.100.1.10
!
Internet:
ip dhcp excluded-address 61.128.1.1 61.128.1.99
ip dhcp excluded-address 172.9.1.1 172.9.1.99
!
ip dhcp pool VLAN128
network 61.128.1.0 255.255.255.0
default-router 61.128.1.10
!
ip dhcp pool VLAN172
network 172.9.1.0 255.255.255.0
default-router 172.9.1.10
!
no spanning-tree vlan 100
no spanning-tree vlan 128
no spanning-tree vlan 172
!
interface FastEthernet1/1
switchport access vlan 128
!
interface FastEthernet1/2
switchport access vlan 172
!
interface FastEthernet1/3
switchport access vlan 100
!
interface Vlan100
ip address 202.100.1.10 255.255.255.0
!
interface Vlan128
ip address 61.128.1.10 255.255.255.0
!
interface Vlan172
ip address 172.9.1.10 255.255.255.0
!
步驟二：GRE與NHRP配置
R1：
!
interface Tunnel0
ip address 10.1.123.1 255.255.255.0
ip nhrp network-id 123
ip nhrp nhs 10.1.123.3 nbma 202.100.1.1 // 啓用NHRP
tunnel source FastEthernet0/0
tunnel destination 202.100.1.1
R2：
!
interface Tunnel0
ip address 10.1.123.2 255.255.255.0
ip nhrp network-id 123
ip nhrp nhs 10.1.123.3 nbma 202.100.1.1 // NHC要指NHS
tunnel source FastEthernet0/0
tunnel destination 202.100.1.1
R3:
!
interface Tunnel0
ip address 10.1.123.3 255.255.255.0
no ip redirects
ip nhrp network-id 123
tunnel source 202.100.1.1
tunnel mode gre multipoint // Hub起mGRE
步驟三：測試與檢查
R3：
R3#sh ip nhrp // 查看映射表
10.1.123.1/32 via 10.1.123.1
Tunnel0 created 00:21:06, expire 01:38:53
Type: dynamic, Flags: unique registered used
NBMA address: 61.128.1.100
10.1.123.2/32 via 10.1.123.2
Tunnel0 created 00:21:58, expire 01:38:01
Type: dynamic, Flags: unique registered used
NBMA address: 172.9.1.100
實驗二：DM***中的EIGRP
1、本實驗接實驗一，配置略
2、在Hub和Spoke路由器上寫靜態路由，使三個站點之間可以互通
3、刪除需求2的靜態，在三個站點之間啓用EIGRP，思考存在的問題及解決方法
4、理解Hub-Spoke模式中數據流的轉發路徑
5、配置IPsec，DM***中的數據進行保護
需求一：寫靜態路由
R1：ip route 10.1.3.0 255.255.255.0 10.1.123.3
R3：ip route 10.1.1.0 255.255.255.0 10.1.123.1
需求二：配置EIGRP
R1：
!
router eigrp 90
no auto-summary
network 10.1.1.0 0.0.0.255
network 10.1.123.0 0.0.0.255
!
R2：
!
router eigrp 90
no auto-summary
network 10.1.2.0 0.0.0.255
network 10.1.123.0 0.0.0.255
!
R3：
!
interface Tunnel0
ip nhrp map multicast dynamic
no ip split-horizon eigrp 90
!
router eigrp 90
no auto-summary
network 10.1.1.0 0.0.0.255
network 10.1.123.0 0.0.0.255
!
R2#sh ip ei nei
EIGRP-IPv4 Neighbors for AS(90)
H Address Interface Hold Uptime SRTT RTO Q Seq
(sec) (ms) Cnt Num
0 10.1.123.3 Tu0 14 00:00:06 216 1470 0 192
R3#sh ip ei nei
EIGRP-IPv4 Neighbors for AS(90)
H Address Interface Hold Uptime SRTT RTO Q Seq
(sec) (ms) Cnt Num
1 10.1.123.2 Tu0 14 00:01:08 270 1620 0 3
0 10.1.123.1 Tu0 13 01:25:05 259 1554 0 10
DM***發展一階段：
1、組播映射問題：mGRE默認不支持組播、廣播的，點到點的支持，除非ip nhrp map multicast dynamic誰向我發註冊，我向誰發組播；show ip nhrp multicast查看映射表
2、HUB要關閉水平分割
3、Spoke去往其他Spoke路由，下一跳在HUB上
4、HUB起mGRE，Spoke起點到點GRE，Spoke只跟HUB建立IGP鄰居關係，Spoke之間互訪一定走HUB
需求三：配置IPsec
R1、R2：
!
crypto isakmp policy 10
authentication pre-share
crypto isakmp key cisco address 202.100.1.1
!
crypto ipsec transform-set TS esp-3des esp-sha-hmac
!
crypto ipsec profile IPSEC-P
set transform-set TS
!
inter Tunnel0
tunnel protection ipsec profile IPSEC-P
!
R3：
!
crypto isakmp policy 10
authentication pre-share
crypto isakmp key cisco address 0.0.0.0 0.0.0.0 // Spoke端DHCP獲得IP，不確定
!
crypto ipsec transform-set TS esp-3des esp-sha-hmac
!
crypto ipsec profile IPSEC-P
set transform-set TS
!
inter Tunnel0
tunnel protection ipsec profile IPSEC-P
!
R3#sh cryp sess
Crypto session current status
Interface: Tunnel0
Session status: UP-ACTIVE
Peer: 172.9.1.100 port 500
IKEv1 SA: local 202.100.1.1/500 remote 172.9.1.100/500 Active
IKEv1 SA: local 202.100.1.1/500 remote 172.9.1.100/500 Active
IPSEC FLOW: permit 47 host 202.100.1.1 host 172.9.1.100
Active SAs: 6, origin: crypto map
Interface: Tunnel0
Session status: UP-ACTIVE
Peer: 61.128.1.100 port 500
IKEv1 SA: local 202.100.1.1/500 remote 61.128.1.100/500 Active
IKEv1 SA: local 202.100.1.1/500 remote 61.128.1.100/500 Active
IPSEC FLOW: permit 47 host 202.100.1.1 host 61.128.1.100
Active SAs: 6, origin: crypto map
需求四：第二階段的DM***
R1：
!
interface Tunnel0
tunnel source FastEthernet0/0
tunnel mode gre multipoint
ip nhrp map multicast 202.100.1.1 // 解決組播映射問題
R2：
!
interface Tunnel0
tunnel source FastEthernet0/0
tunnel mode gre multipoint
ip nhrp map multicast 202.100.1.1 // 解決組播映射問題
R3:
!
interface Tunnel0
ip address 10.1.123.3 255.255.255.0
no ip redirects
ip nhrp network-id 123
tunnel source 202.100.1.1
tunnel mode gre multipoint // Hub起mGRE
ip nhrp map multicast dynamic // 動態形成組播映射表，誰發註冊
no ip split-horizon eigrp 90 // 解決水平分割
no ip next-hop-self eigrp 90 // 解決第三方下一跳問題
!
第三方下一跳（DV路由協議都有當路由器在從某一個接口更新時，如果發現出接口和這個路由條目在本地路由表中的下一跳在同一網絡，那麼發出更新時，下一跳不變；rip缺省啓用，EIGRP缺省關閉
R3#show ip nhrp
10.1.123.1/32 via 10.1.123.1
Tunnel0 created 00:00:01, expire 01:59:58
Type: dynamic, Flags: unique registered used
NBMA address: 61.128.1.1
10.1.123.2/32 via 10.1.123.2
Tunnel0 created 00:00:39, expire 01:59:21
Type: dynamic, Flags: unique registered
NBMA address: 172.9.1.1
注意點:
1.R2 ping 10.1.123.3, 然後show ip nhrp會發現R2會產生一條去往10.1.123.3的NHRP映射表項.這是通過NHRP Request/NHRP Reply學習到的,可以抓包或者debug來觀察這個過程
2.因爲R2可以從R1學到去往10.1.123.3的映射表項,此時,R2可以直接去往R3,不需要HUB中轉.可以traceroute檢查.
需求五：第三階段的DM***中的OSPF
R1：
!
interface Tunnel0
tunnel source FastEthernet0/0
tunnel mode gre multipoint
ip nhrp map multicast 202.100.1.1 // 解決組播映射問題
ip ospf network point-to-multipoint // tunnel接口ospf缺省類型是ptp，如果改成broadcast，要退出選舉DR
ip nhrp shortcut // 啓用shortcut數據優化
R2：
!
interface Tunnel0
tunnel source FastEthernet0/0
tunnel mode gre multipoint
ip nhrp map multicast 202.100.1.1 // 解決組播映射問題
ip ospf network point-to-multipoint
ip nhrp shortcut
R3:
!
interface Tunnel0
ip address 10.1.123.3 255.255.255.0
ip nhrp network-id 123
tunnel source 202.100.1.1
tunnel mode gre multipoint // Hub起mGRE
ip nhrp map multicast dynamic // 動態形成組播映射表，誰發註冊
ip ospf network point-to-multipoint
ip nhrp redirect
!
DM***三階段發展：
1、Hub起mGRE，Spoke端起mGRE
2、通過NHRP來解決Spoke到Spoke之間的次優路徑問題，NHRP Redirect缺省關閉（ICMP redirect：網關如果發現數據包的入口和出口是同一個接口，就告訴主機重定向消息把網關設置爲最優網關）
3、HUB端啓用NHRP Redirect，Spoke端啓用NHRP shortcut捷徑
