CCNP綜合實驗－
實驗top如下：
實驗需求：
1：R3，R4做NAT，R3 E0/1做出口，R4 E0/0做出口。
2：R3,R4,R5,R7,R8做OSPF，R3,R4,R5,R7做frame-relay，R7做FR交換機。
3：8.8.8.8達到1.1.1.1從R3出去，被轉換成公網地址3.3.3.3。
8.8.8.9達到1.1.1.1從R4出去，被轉換成公網地址4.4.4.4。
192.168.8.1達到1.1.1.1可以從R3也可以從R4出去。
4：R8到1.1.1.1的流量大於1000bytes從R4走，小於1000bytes從R3走。
5：OSPF內做區域認證。
本實驗完整配置：
R1# show run
hostname R1
no ip domain lookup
!
!
ip cef
interface Loopback0
ip address 1.1.1.1 255.255.255.0
!
interface Ethernet0/0
ip address 192.168.12.1 255.255.255.0
half-duplex
!
interface Ethernet0/1
ip address 192.168.16.1 255.255.255.0
half-duplex
router bgp 100
no synchronization關掉BGP同步，是BGP與IGP的同步，也是爲了避免路由黑洞
bgp router-id 1.1.1.1
bgp log-neighbor-changes
network 1.1.1.0 mask 255.255.255.0
neighbor 192.168.12.2 remote-as 200
neighbor 192.168.16.6 remote-as 400
maximum-paths 2//兩條路徑可以負載均衡，範圍１－６條
no auto-summary
R2：
R2#show run
hostname R2
no ip domain lookup
ip cef
interface Ethernet0/0
ip address 192.168.12.2 255.255.255.0
half-duplex
interface Ethernet0/1
ip address 192.168.23.2 255.255.255.0
half-duplex
router bgp 200
no synchronization
bgp router-id 2.2.2.2
bgp log-neighbor-changes
network 192.168.12.0
network 192.168.23.0
neighbor 192.168.12.1 remote-as 100
neighbor 192.168.23.3 remote-as 300
no auto-summary
R3：
R3#show run
hostname R3
!
no ip domain lookup
ip cef
interface Loopback0
ip address 3.3.3.3 255.255.255.0
ip virtual-reassembly
interface Ethernet0/1
ip address 192.168.23.3 255.255.255.0
ip nat outside
ip virtual-reassembly
half-duplex
interface Serial1/0
ip address 192.168.1.3 255.255.255.0
ip nat inside
ip virtual-reassembly
encapsulation frame-relay
ip ospf message-digest-key 1 md5 cisco/區域認證接口下啓用認證使用MD5加密。
ip ospf network broadcast/在NBMA網絡中，於接口下定義OSPF網絡類型爲廣播
serial restart-delay 0
frame-relay map ip 192.168.1.4 304 broadcast/定義FR PVC，支持廣播
frame-relay map ip 192.168.1.5 305 broadcast
no frame-relay inverse-arp/關掉FR反向ARP
router ospf 1
log-adjacency-changes
area 0 authentication message-digest/開啓區域驗證，加密模式爲散列哈希
network 3.3.3.0 0.0.0.255 area 0
network 192.168.1.0 0.0.0.255 area 0
default-information originate /ASBR發佈一條路認默認，如果不加always參數，必須要手工寫一條靜態默認路由才能在OSPF區域內自動發佈一條指向ASBR的默認路由
router bgp 300
no synchronization
bgp router-id 3.3.3.3
bgp log-neighbor-changes
network 3.3.3.0 mask 255.255.255.0/通告BGP路由，BGP必須手動通告路由並指定鄰居。
network 192.168.1.0
network 192.168.23.0
redistribute ospf 1
neighbor 192.168.1.4 remote-as 300
neighbor 192.168.1.4 next-hop-self/以於IBGP，下一跳就是自己，因爲共處同一個AS裏面，BGP是以AS爲跳，不同於RIP，因此也叫à路徑矢量路由協議
neighbor 192.168.23.2 remote-as 200
neighbor 192.168.23.2 route-map 3 out/關聯Route-map，對於向鄰居發送出去的BGP路由信息對屬性進行修改並過濾。
no auto-summary
ip nat inside source route-map map interface Ethernet0/1 overload/利用PBR來做PAT
ip nat inside source static 8.8.8.8 3.3.3.3/靜態NAT
access-list 1 permit 8.8.8.9
access-list 1 permit 192.168.8.1
access-list 3 permit 4.4.4.0 0.0.0.255
route-map 3 permit 10
match ip address 3
set as-path prepend 1000 10001/利用PBR修改BGP路由條目AS-PATH屬性
route-map 3 permit 20
route-map map permit 10
match ip address 1
R4：
hostname R4
no ip domain lookup
ip cef
interface Loopback0
ip address 4.4.4.4 255.255.255.0
ip virtual-reassembly
interface Ethernet0/0
ip address 192.168.46.4 255.255.255.0
ip nat outside
ip virtual-reassembly
interface Serial1/0
ip address 192.168.1.4 255.255.255.0
ip nat inside
ip virtual-reassembly
encapsulation frame-relay
ip ospf message-digest-key 1 md5 cisco
ip ospf network broadcast
serial restart-delay 0
frame-relay map ip 192.168.1.3 403 broadcast
frame-relay map ip 192.168.1.5 405 broadcast
no frame-relay inverse-arp
router ospf 1
log-adjacency-changes
area 0 authentication message-digest
redistribute bgp 300 subnets
network 4.4.4.0 0.0.0.255 area 0
network 192.168.1.0 0.0.0.255 area 0
default-information originate always/自動向OSPF域發佈一條靜態默認，不必手工生成。
如：O*E2 0.0.0.0/0 [110/1] via 192.168.1.4, 06:16:55, Serial1/0
router bgp 300
no synchronization
bgp router-id 4.4.4.4
bgp log-neighbor-changes
network 4.4.4.0 mask 255.255.255.0
network 192.168.1.0
network 192.168.46.0
redistribute ospf 1
neighbor 192.168.1.3 remote-as 300
neighbor 192.168.1.3 next-hop-self
neighbor 192.168.46.6 remote-as 400
neighbor 192.168.46.6 route-map 3 out
no auto-summary
ip nat inside source route-map map interface Ethernet0/0 overload
ip nat inside source static 8.8.8.9 4.4.4.4
access-list 1 permit 8.8.8.8
access-list 1 permit 192.168.8.1
access-list 3 permit 3.3.3.0 0.0.0.255
route-map 3 permit 10
match ip address 3
set as-path prepend 1000 1001
route-map 3 permit 20
route-map map permit 10
match ip address 1
R5：
R5#show run
hostname R5
no ip domain lookup
ip cef
interface Ethernet0/0
ip address 192.168.5.1 255.255.255.0
ip ospf message-digest-key 1 md5 cisco
ip policy route-map car/PBR策略路由在接口下應用，只能應用在入接口與本地路由全局
half-duplex
!
interface Serial1/0
ip address 192.168.1.5 255.255.255.0
encapsulation frame-relay
ip ospf message-digest-key 1 md5 cisco
ip ospf network broadcast
serial restart-delay 0
frame-relay map ip 192.168.1.3 503 broadcast
frame-relay map ip 192.168.1.4 504 broadcast
no frame-relay inverse-arp
router ospf 1
log-adjacency-changes
area 0 authentication message-digest
network 192.168.1.0 0.0.0.255 area 0
network 192.168.5.0 0.0.0.255 area 0
ip ospf name-lookup
access-list 101 permit ip host 8.8.8.8 host 1.1.1.1
access-list 101 permit ip host 8.8.8.9 host 1.1.1.1
access-list 101 permit ip 192.168.8.0 0.0.0.255 host 1.1.1.1
route-map car permit 10
match ip address 101
match length 0 1000/PBR來進行流量控制
set ip next-hop 192.168.1.3
route-map car permit 20
match ip address 101
match length 1000 1500
set ip next-hop 192.168.1.4
route-map car permit 30
R6：
R6#show run
hostname R6
no ip domain lookup
ip cef
interface Ethernet0/0
ip address 192.168.46.6 255.255.255.0
half-duplex
interface Ethernet0/1
ip address 192.168.16.6 255.255.255.0
half-duplex
router bgp 400
no synchronization
bgp router-id 6.6.6.6
bgp log-neighbor-changes
network 192.168.16.0
network 192.168.46.0
neighbor 192.168.16.1 remote-as 100
neighbor 192.168.46.4 remote-as 300
no auto-summary
R7（FR）：
FR#show run
hostname FR
no ip domain lookup
!
!
ip cef
ip ips po max-events 100
frame-relay switching
interface Serial0/0
no ip address
encapsulation frame-relay
serial restart-delay 0
clockrate 64000
no frame-relay inverse-arp
frame-relay intf-type dce
frame-relay route 304 interface Serial0/1 403 /PVC，FR路由，
frame-relay route 305 interface Serial0/2 503
!
interface Serial0/1
no ip address
encapsulation frame-relay
serial restart-delay 0
clockrate 64000
frame-relay intf-type dce
frame-relay route 403 interface Serial0/0 304
frame-relay route 405 interface Serial0/2 504
!
interface Serial0/2
no ip address
encapsulation frame-relay
serial restart-delay 0
clockrate 64000
frame-relay intf-type dce
frame-relay lmi-type cisco /lmi local management identifiled本地管理標識，對於接口地址的LMI需要在FR交換機與用戶路由器接口之間的類型要一致，cisco默認爲cisco,一共有三種lmi：
1，ansi,2,cisco,3,q933a.
frame-relay route 503 interface Serial0/0 305
frame-relay route 504 interface Serial0/1 405
R8：
R8#show run
hostname R8
no ip domain lookup
ip cef
interface Loopback0
ip address 8.8.8.9 255.255.255.0 secondary
ip address 192.168.8.1 255.255.255.0 secondary
ip address 8.8.8.8 255.255.255.0
interface Ethernet0/0
ip address 192.168.5.8 255.255.255.0
ip ospf message-digest-key 1 md5 cisco
router ospf 1
log-adjacency-changes
area 0 authentication message-digest
network 8.8.8.0 0.0.0.255 area 0
network 192.168.8.0 0.0.0.255 area 0
network 0.0.0.0 255.255.255.255 area 0
配置沒有問題之後，我們就可以測試一下，是否跟我們需求符合，主要有三個地方要測試，
１，全網互通測試，
２，NAT測試
３，“流量牽引”測試
４，PBR修改BGP屬性測試
不做優化時出現的問題：
R1對於R3,R4 lo 0，3.3.3.3,4.4.4.4的學習可能是從192.168.12.2或192.168.16.6，但是對於用於NAT轉換的靜態地址來說，這不是好徵兆，因爲當我們要實現上述幾個需求時，你會發現這樣總是會有一方PING不通1.1.1.1的地址，雖然他也滿足流量牽引策略，因爲他去包與回包路徑不一致，而我們這個環境卻不允許這樣NAT轉換。所以只能去做BGP路由優化，把NAT轉換後去包與回包的路徑固定（對於3.3.3.3來說，R1始終應走R2爲下一跳爲最優路徑，從R6走到了R4會被drop掉，因爲內網地址從R3以3.3.3.3轉換出去，而R4上其實是沒有相應3.3.3.3與內網NAT映射的）。故需要BGP選路進行控制，此處我做的是在R3，R4上控制相應路由的AS-PATH屬性來控制R1選路的。
全網是否互通：
R8#ping 1.1.1.1 source 8.8.8.8
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
Packet sent with a source address of 8.8.8.8
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 224/327/516 ms
顯然是通的。
NAT測試：
R8#ping 192.168.12.1 source lo 0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.12.1, timeout is 2 seconds:
Packet sent with a source address of 8.8.8.8
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 404/520/680 ms
R3#
*Mar 1 06:42:59.650: NAT: s=8.8.8.8->3.3.3.3, d=192.168.12.1 [669]
*Mar 1 06:42:59.826: NAT: s=192.168.12.1, d=3.3.3.3->8.8.8.8 [669]
*Mar 1 06:42:59.882: NAT: s=8.8.8.8->3.3.3.3, d=192.168.12.1 [670]
*Mar 1 06:43:00.174: NAT: s=192.168.12.1, d=3.3.3.3->8.8.8.8 [670]
*Mar 1 06:43:00.290: NAT: s=8.8.8.8->3.3.3.3, d=192.168.12.1 [671]
*Mar 1 06:43:00.526: NAT: s=192.168.12.1, d=3.3.3.3->8.8.8.8 [671]
R3#
*Mar 1 06:44:00.690: NAT: expiring 3.3.3.3 (8.8.8.8) icmp 138 (138)
R8#ping 192.168.46.6 source lo 0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.46.6, timeout is 2 seconds:
Packet sent with a source address of 8.8.8.8
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 72/215/380 ms
R8#
R4#
*Mar 1 06:50:59.902: NAT*: s=8.8.8.8->192.168.46.4, d=192.168.46.6 [687]
*Mar 1 06:51:00.026: NAT*: s=192.168.46.6, d=192.168.46.4->8.8.8.8 [687]
*Mar 1 06:51:00.238: NAT*: s=8.8.8.8->192.168.46.4, d=192.168.46.6 [688]
*Mar 1 06:51:00.246: NAT*: s=192.168.46.6, d=192.168.46.4->8.8.8.8 [688]
*Mar 1 06:51:00.366: NAT*: s=8.8.8.8->192.168.46.4, d=192.168.46.6 [689]
*Mar 1 06:51:00.514: NAT*: s=192.168.46.6, d=192.168.46.4->8.8.8.8 [689]
*Mar 1 06:51:00.518: NAT*: s=8.8.8.8->192.168.46.4, d=192.168.46.6 [690]
*Mar 1 06:51:00.582: NAT*: s=192.168.46.6, d=192.168.46.4->8.8.8.8 [690]
*Mar 1 06:51:00.902: NAT*: s=8.8.8.8->192.168.46.4, d=192.168.46.6 [691]
R4#
*Mar 1 06:51:00.938: NAT*: s=192.168.46.6, d=192.168.46.4->8.8.8.8 [691]
R4#
轉換成功
流量牽引測試：
當R8上去往公網地址1.1.1.1流量大於1000bites時，下一跳走R4
R8#ping 1.1.1.1 size 1001 source 8.8.8.8
Type escape sequence to abort.
Sending 5, 1001-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
Packet sent with a source address of 8.8.8.8
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 248/297/336 ms
R4#
*Mar 1 06:48:11.386: NAT*: s=8.8.8.8->192.168.46.4, d=1.1.1.1 [677]
*Mar 1 06:48:11.550: NAT*: s=1.1.1.1, d=192.168.46.4->8.8.8.8 [677]
*Mar 1 06:48:11.686: NAT*: s=8.8.8.8->192.168.46.4, d=1.1.1.1 [678]
*Mar 1 06:48:11.854: NAT*: s=1.1.1.1, d=192.168.46.4->8.8.8.8 [678]
*Mar 1 06:48:11.886: NAT*: s=8.8.8.8->192.168.46.4, d=1.1.1.1 [679]
*Mar 1 06:48:12.018: NAT*: s=1.1.1.1, d=192.168.46.4->8.8.8.8 [679]
*Mar 1 06:48:12.198: NAT*: s=8.8.8.8->192.168.46.4, d=1.1.1.1 [680]
*Mar 1 06:48:12.206: NAT*: s=1.1.1.1, d=192.168.46.4->8.8.8.8 [680]
R4#
*Mar 1 06:48:12.574: NAT*: s=8.8.8.8->192.168.46.4, d=1.1.1.1 [681]
*Mar 1 06:48:12.678: NAT*: s=1.1.1.1, d=192.168.46.4->8.8.8.8 [681]
R8#ping 1.1.1.1 size 1001 source 8.8.8.9
Type escape sequence to abort.
Sending 5, 1001-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
Packet sent with a source address of 8.8.8.9
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 172/222/312 ms
R4#
*Mar 1 06:49:43.506: NAT*: s=8.8.8.9->4.4.4.4, d=1.1.1.1 [682]
*Mar 1 06:49:43.750: NAT*: s=1.1.1.1, d=4.4.4.4->8.8.8.9 [682]
*Mar 1 06:49:43.874: NAT*: s=8.8.8.9->4.4.4.4, d=1.1.1.1 [683]
*Mar 1 06:49:43.930: NAT*: s=1.1.1.1, d=4.4.4.4->8.8.8.9 [683]
*Mar 1 06:49:44.002: NAT*: s=8.8.8.9->4.4.4.4, d=1.1.1.1 [684]
*Mar 1 06:49:44.106: NAT*: s=1.1.1.1, d=4.4.4.4->8.8.8.9 [684]
*Mar 1 06:49:44.202: NAT*: s=8.8.8.9->4.4.4.4, d=1.1.1.1 [685]
*Mar 1 06:49:44.330: NAT*: s=1.1.1.1, d=4.4.4.4->8.8.8.9 [685]
*Mar 1 06:49:44.414: NAT*: s=8.8.8.9->4.4.4.4, d=1.1.1.1 [686]
*Mar 1 06:49:44.454: NAT*: s=1.1.1.1, d=4.4.4.4->8.8.8.9 [686]
R4#
當流量小於1000bytes時，R8上的流量就需要改走R3爲下一跳了，
R8#ping 1.1.1.1 size 800 source 8.8.8.8
Type escape sequence to abort.
Sending 5, 800-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
Packet sent with a source address of 8.8.8.8
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 212/332/468 ms
R8#
R8#ping 1.1.1.1 size 800 source 8.8.8.9
Type escape sequence to abort.
Sending 5, 800-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
Packet sent with a source address of 8.8.8.9
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 192/273/492 ms
R8#
R3#
*Mar 1 06:54:00.522: NAT*: s=8.8.8.8->3.3.3.3, d=1.1.1.1 [692]
*Mar 1 06:54:00.734: NAT*: s=1.1.1.1, d=3.3.3.3->8.8.8.8 [692]
*Mar 1 06:54:00.958: NAT*: s=8.8.8.8->3.3.3.3, d=1.1.1.1 [693]
*Mar 1 06:54:01.118: NAT*: s=1.1.1.1, d=3.3.3.3->8.8.8.8 [693]
*Mar 1 06:54:01.158: NAT*: s=8.8.8.8->3.3.3.3, d=1.1.1.1 [694]
*Mar 1 06:54:01.226: NAT*: s=1.1.1.1, d=3.3.3.3->8.8.8.8 [694]
*Mar 1 06:54:01.350: NAT*: s=8.8.8.8->3.3.3.3, d=1.1.1.1 [695]
R3#
*Mar 1 06:54:01.598: NAT*: s=1.1.1.1, d=3.3.3.3->8.8.8.8 [695]
*Mar 1 06:54:01.746: NAT*: s=8.8.8.8->3.3.3.3, d=1.1.1.1 [696]
*Mar 1 06:54:01.886: NAT*: s=1.1.1.1, d=3.3.3.3->8.8.8.8 [696]
R3#
*Mar 1 06:54:09.982: NAT*: s=8.8.8.9->192.168.23.3, d=1.1.1.1 [697]
*Mar 1 06:54:10.238: NAT*: s=1.1.1.1, d=192.168.23.3->8.8.8.9 [697]
*Mar 1 06:54:10.514: NAT*: s=8.8.8.9->192.168.23.3, d=1.1.1.1 [698]
*Mar 1 06:54:10.638: NAT*: s=1.1.1.1, d=192.168.23.3->8.8.8.9 [698]
*Mar 1 06:54:10.734: NAT*: s=8.8.8.9->192.168.23.3, d=1.1.1.1 [699]
*Mar 1 06:54:10.834: NAT*: s=1.1.1.1, d=192.168.23.3->8.8.8.9 [699]
*Mar 1 06:54:10.874: NAT*: s=8.8.8.9->192.168.23.3, d=1.1.1.1 [700]
R3#
*Mar 1 06:54:11.050: NAT*: s=1.1.1.1, d=192.168.23.3->8.8.8.9 [700]
*Mar 1 06:54:11.078: NAT*: s=8.8.8.9->192.168.23.3, d=1.1.1.1 [701]
*Mar 1 06:54:11.198: NAT*: s=1.1.1.1, d=192.168.23.3->8.8.8.9 [701]
當然所有一切順得進行都是在BGP屬性修改之後進行的，怎樣修改BGP的AS-PATH來使R1走最優的路徑呢？首先來了解一下，AS-PATH有何作用：它可以修改被修改，而且是個“公認必尊”的屬性也就是每條路由通告給鄰居時都必需要攜帶這個屬性，它的作用可以用來選路也可以用來防環（當路由器收到一條攜帶自己AS號的路由時會drop掉這條可能造成路由環路的條目，保持BGP的穩定與健壯性。
做法：如R1對於去往3.3.3.3的路由從R2學到，4.4.4.4的路由在本實驗環境中是要讓他從R6學到的，但他卻是從R2學到的變成了最優放入路由表，而數據最終轉換看的只是路由表裏的條目，因此我們想讓從R3傳遞過去的4.4.4.4路由條目比從R4本身傳給R14.4.4.4路由條目的可靠性差，讓R1經過一番屬性優劣權衡之後選擇走R6去往４.４.４.４.這也是我們期望的。那R1爲什麼會相信呢，它通過比較AS-PATH得出的結果，因爲4.4.4.4從源通告之後再傳到BGP是需要經過許多AS的。而每經過一個AS，路由器都會把自己與之前的AS一起發給EBGP鄰居，這樣經過的AS越多，可靠性自然會降低，那麼我們就在R3上做PBR來控制4.4.4.4AS-PATH的通告，讓它劣於從R4àR6àR1的4.4.4.4的路由就可以了。
當然對R4傳給R1的3.3.3.3同樣也可以用類似做法。
router bgp 300
no synchronization
bgp router-id 3.3.3.3
bgp log-neighbor-changes
network 3.3.3.0 mask 255.255.255.0
network 192.168.1.0
network 192.168.23.0
redistribute ospf 1
neighbor 192.168.1.4 remote-as 300
neighbor 192.168.1.4 next-hop-self
neighbor 192.168.23.2 remote-as 400
neighbor 192.168.23.2 route-map 3 out
access-list 3 permit 4.4.4.0
route-map 3 permit 10
match ip address 3
set as-path 1000 1001
exit
route-map 3 permit 20
exit
這樣就做好了，可以在R1上去查看一下AS號是不是多追加了兩個？
*> 3.3.3.0/24 192.168.12.2 0 200 300 i
* 192.168.16.6 0 400 300 1000 1001 i
*> 3.3.3.3/32 192.168.12.2 0 200 300 ?
* 192.168.16.6 0 400 300 1000 1001 ?
好了，今天的實驗就說到這裏，歡迎各位指教，不勝榮幸。