一、实验拓扑二、实验要求1、R4为ISP其上只配置IP地址R4与其他所直连设备间均使用公有IP2、R3-R5、R6、R7为MGRE环境R3为中心站点3、整个OSPF环境IP基于172.16.0.0/16划分除了R12有两个环回其他路由器均有一个环回IP4、所有设备均可访问R4的环回5、减少LSA的更新量加快收敛保障更新安全6、全网可达三、实验思路1、划分 IP 地址基于 172.16.0.0/16纵观整个网络拓扑包括环回网段考虑汇总将 172.16.0.0/16 按区域划分为 5 个大的网段每个区域一个 /24便于 ABR 做路由汇总。表格区域用途网段具体分配Area 0MGRE Tunnel172.16.0.0/29R3:.1 / R5:.2 / R6:.3 / R7:.4Area 0环回地址172.16.0.8/32 ~ 172.16.0.11/32R3:.8 / R5:.9 / R6:.10 / R7:.11Area 1骨干链路172.16.16.0/29R3:.1 / AR1:.2 / AR2:.3Area 1环回地址172.16.16.16/32 ~ 172.16.16.17/32AR1:.16 / AR2:.17Area 2骨干链路172.16.32.0/30R6:.1 / R11:.2Area 2骨干链路172.16.32.4/30R11:.5 / R12:.6Area 2环回地址172.16.32.16/32 ~ 172.16.32.18/32R11:.16 / R12:.17 / R12:.18Area 2RIP 域172.16.128.0/24R12 连接Area 3骨干链路172.16.48.0/30R7:.1 / R8:.2Area 3环回地址172.16.48.16/32R8:.16Area 4骨干链路172.16.64.0/30R8:.1 / R9:.2Area 4骨干链路172.16.64.4/30R9:.5 / AR10:.6Area 4环回地址172.16.64.16/32 ~ 172.16.64.17/32R9:.16 / AR10:.17公网地址R4 及直连表格链路网段R3-R434.0.0.0/24R4-R545.0.0.0/24R4-R646.0.0.0/24R4-R747.0.0.0/24R4 环回4.4.4.4/322、配置 MGRE 环境R3 为中心站点R3、R5、R6、R7 通过公网链路连接到 ISPR4在公网之上建立 MGRE 隧道实现多点 GRE 互联。R3 作为 NHRP ServerR5/R6/R7 作为 NHRP Client 向 R3 注册。3、配置 OSPF 多区域路由协议在 MGRE Tunnel 接口上运行 OSPF网络类型修改为 BroadcastR3 优先级最高作为 DR各路由器按区域宣告对应网段Area 4 未直接连接 Area 0需在 R7-R8 之间穿过 Area 3 建立虚链路使 Area 4 逻辑上接入骨干4、减少 LSA 更新量特殊区域Area 1 配置为Totally Stubby Area完全末梢区域R3 只向 Area 1 下发缺省路由Area 2 配置为NSSA过滤 Type-5 LSARIP 路由以 Type-7 LSA 进入Area 4 配置为Totally Stubby AreaR8 只向 Area 4 下发缺省路由路由汇总ABR 汇总R3Area 1、R6Area 2、R7Area 3、R8Area 4分别做区域间路由汇总ASBR 汇总R12 对引入的 RIP 路由做外部汇总5、加快收敛与保障更新安全加快收敛将 OSPF Hello/Dead 间隔由 10s/40s 修改为5s/20s保障安全所有区域配置OSPF MD5 认证Loopback 接口配置silent-interface减少无用报文6、配置缺省路由与 NAT实现访问 R4 环回R3/R5/R6/R7 各自配置缺省路由指向 R4各边界路由器在连接 R4 的接口上配置Easy IPNAT Outbound将内网 172.16.0.0/16 地址转换为公网地址R3/R6/R7 通过 OSPF 向各自区域发布缺省路由7、配置 RIP 及路由引入R12 配置 RIP v2宣告自身环回及 RIP 域R12 将 RIP 路由引入 OSPF由于 Area 2 为 NSSA外部路由以 Type-7 LSA 进入经 R6 转换为 Type-5 LSA 进入 Area 0四、实验步骤步骤 1配置 IP 地址分析R4 作为 ISP 只配置 IP 地址不参与任何路由协议。其他所有路由器基于 172.16.0.0/16 按区域划分配置 IP。【R4 - ISP】只配置 IP 地址[R4]interface Serial4/0/0 [R4-Serial4/0/0]ip address 34.0.0.4 255.255.255.0 [R4-Serial4/0/0]quit [R4]interface Serial4/0/1 [R4-Serial4/0/1]ip address 45.0.0.4 255.255.255.0 [R4-Serial4/0/1]quit [R4]interface Serial3/0/0 [R4-Serial3/0/0]ip address 46.0.0.4 255.255.255.0 [R4-Serial3/0/0]quit [R4]interface GigabitEthernet0/0/0 [R4-GigabitEthernet0/0/0]ip address 47.0.0.4 255.255.255.0 [R4-GigabitEthernet0/0/0]quit [R4]interface LoopBack0 [R4-LoopBack0]ip address 4.4.4.4 255.255.255.255 [R4-LoopBack0]quit【R3】[R3]interface Serial4/0/0 [R3-Serial4/0/0]ip address 34.0.0.3 255.255.255.0 [R3-Serial4/0/0]quit [R3]interface GigabitEthernet0/0/0 [R3-GigabitEthernet0/0/0]ip address 172.16.16.1 255.255.255.248 [R3-GigabitEthernet0/0/0]quit [R3]interface LoopBack0 [R3-LoopBack0]ip address 172.16.0.8 255.255.255.255 [R3-LoopBack0]quit【R5】[R5]interface Serial4/0/0 [R5-Serial4/0/0]ip address 45.0.0.5 255.255.255.0 [R5-Serial4/0/0]quit [R5]interface LoopBack0 [R5-LoopBack0]ip address 172.16.0.9 255.255.255.255 [R5-LoopBack0]quit【R6】[R6]interface Serial4/0/0 [R6-Serial4/0/0]ip address 46.0.0.6 255.255.255.0 [R6-Serial4/0/0]quit [R6]interface GigabitEthernet0/0/0 [R6-GigabitEthernet0/0/0]ip address 172.16.32.1 255.255.255.252 [R6-GigabitEthernet0/0/0]quit [R6]interface LoopBack0 [R6-LoopBack0]ip address 172.16.0.10 255.255.255.255 [R6-LoopBack0]quit【R7】[R7]interface GigabitEthernet0/0/0 [R7-GigabitEthernet0/0/0]ip address 47.0.0.7 255.255.255.0 [R7-GigabitEthernet0/0/0]quit [R7]interface GigabitEthernet0/0/1 [R7-GigabitEthernet0/0/1]ip address 172.16.48.1 255.255.255.252 [R7-GigabitEthernet0/0/1]quit [R7]interface LoopBack0 [R7-LoopBack0]ip address 172.16.0.11 255.255.255.255 [R7-LoopBack0]quit【R1】[AR1]interface GigabitEthernet0/0/0 [AR1-GigabitEthernet0/0/0]ip address 172.16.16.2 255.255.255.248 [AR1-GigabitEthernet0/0/0]quit [AR1]interface LoopBack0 [AR1-LoopBack0]ip address 172.16.16.16 255.255.255.255 [AR1-LoopBack0]quit【R2】[AR2]interface GigabitEthernet0/0/0 [AR2-GigabitEthernet0/0/0]ip address 172.16.16.3 255.255.255.248 [AR2-GigabitEthernet0/0/0]quit [AR2]interface LoopBack0 [AR2-LoopBack0]ip address 172.16.16.17 255.255.255.255 [AR2-LoopBack0]quit【R11】[R11]interface GigabitEthernet0/0/0 [R11-GigabitEthernet0/0/0]ip address 172.16.32.2 255.255.255.252 [R11-GigabitEthernet0/0/0]quit [R11]interface GigabitEthernet0/0/1 [R11-GigabitEthernet0/0/1]ip address 172.16.32.5 255.255.255.252 [R11-GigabitEthernet0/0/1]quit [R11]interface LoopBack0 [R11-LoopBack0]ip address 172.16.32.16 255.255.255.255 [R11-LoopBack0]quit【R12】[R12]interface GigabitEthernet0/0/0 [R12-GigabitEthernet0/0/0]ip address 172.16.32.6 255.255.255.252 [R12-GigabitEthernet0/0/0]quit [R12]interface LoopBack0 [R12-LoopBack0]ip address 172.16.32.17 255.255.255.255 [R12-LoopBack0]quit [R12]interface LoopBack1 [R12-LoopBack1]ip address 172.16.32.18 255.255.255.255 [R12-LoopBack1]quit【R8】[R8]interface GigabitEthernet0/0/0 [R8-GigabitEthernet0/0/0]ip address 172.16.48.2 255.255.255.252 [R8-GigabitEthernet0/0/0]quit [R8]interface GigabitEthernet0/0/1 [R8-GigabitEthernet0/0/1]ip address 172.16.64.1 255.255.255.252 [R8-GigabitEthernet0/0/1]quit [R8]interface LoopBack0 [R8-LoopBack0]ip address 172.16.48.16 255.255.255.255 [R8-LoopBack0]quit【R9】[R9]interface GigabitEthernet0/0/0 [R9-GigabitEthernet0/0/0]ip address 172.16.64.2 255.255.255.252 [R9-GigabitEthernet0/0/0]quit [R9]interface GigabitEthernet0/0/1 [R9-GigabitEthernet0/0/1]ip address 172.16.64.5 255.255.255.252 [R9-GigabitEthernet0/0/1]quit [R9]interface LoopBack0 [R9-LoopBack0]ip address 172.16.64.16 255.255.255.255 [R9-LoopBack0]quit【AR10】[AR10]interface GigabitEthernet0/0/0 [AR10-GigabitEthernet0/0/0]ip address 172.16.64.6 255.255.255.252 [AR10-GigabitEthernet0/0/0]quit [AR10]interface LoopBack0 [AR10-LoopBack0]ip address 172.16.64.17 255.255.255.255 [AR10-LoopBack0]quit步骤 2配置 MGRE 环境R3 为中心站点【R3 - Hub】[R3]interface Tunnel0/0/0 [R3-Tunnel0/0/0]tunnel-protocol gre p2mp [R3-Tunnel0/0/0]source Serial4/0/0 [R3-Tunnel0/0/0]nhrp entry multicast dynamic [R3-Tunnel0/0/0]nhrp network-id 100 [R3-Tunnel0/0/0]ip address 172.16.0.1 255.255.255.248 [R3-Tunnel0/0/0]quit【R5 - Spoke】[R5]interface Tunnel0/0/0 [R5-Tunnel0/0/0]tunnel-protocol gre p2mp [R5-Tunnel0/0/0]source Serial4/0/0 [R5-Tunnel0/0/0]nhrp network-id 100 [R5-Tunnel0/0/0]nhrp entry 172.16.0.1 34.0.0.3 register [R5-Tunnel0/0/0]ip address 172.16.0.2 255.255.255.248 [R5-Tunnel0/0/0]quit【R6 - Spoke】[R6]interface Tunnel0/0/0 [R6-Tunnel0/0/0]tunnel-protocol gre p2mp [R6-Tunnel0/0/0]source Serial4/0/0 [R6-Tunnel0/0/0]nhrp network-id 100 [R6-Tunnel0/0/0]nhrp entry 172.16.0.1 34.0.0.3 register [R6-Tunnel0/0/0]ip address 172.16.0.3 255.255.255.248 [R6-Tunnel0/0/0]quit【R7 - Spoke】[R7]interface Tunnel0/0/0 [R7-Tunnel0/0/0]tunnel-protocol gre p2mp [R7-Tunnel0/0/0]source GigabitEthernet0/0/0 [R7-Tunnel0/0/0]nhrp network-id 100 [R7-Tunnel0/0/0]nhrp entry 172.16.0.1 34.0.0.3 register [R7-Tunnel0/0/0]ip address 172.16.0.4 255.255.255.248 [R7-Tunnel0/0/0]quit验证 MGRE[R3]display nhrp peer all # 查看分支注册情况 R5ping 172.16.0.1 # 测试隧道连通性步骤 3配置 OSPF 多区域路由协议【R3】Area 0 Area 1 的 ABR[R3]ospf 1 router-id 3.3.3.3 [R3-ospf-1]area 0 [R3-ospf-1-area-0.0.0.0]network 172.16.0.0 0.0.0.7 [R3-ospf-1-area-0.0.0.0]network 172.16.0.8 0.0.0.0 [R3-ospf-1-area-0.0.0.0]quit [R3-ospf-1]area 1 [R3-ospf-1-area-0.0.0.1]network 172.16.16.0 0.0.0.7 [R3-ospf-1-area-0.0.0.1]quit [R3-ospf-1]quit【R5】Area 0[R5]ospf 1 router-id 5.5.5.5 [R5-ospf-1]area 0 [R5-ospf-1-area-0.0.0.0]network 172.16.0.0 0.0.0.7 [R5-ospf-1-area-0.0.0.0]network 172.16.0.9 0.0.0.0 [R5-ospf-1-area-0.0.0.0]quit [R5-ospf-1]quit【R6】Area 0 Area 2 的 ABR[R6]ospf 1 router-id 6.6.6.6 [R6-ospf-1]area 0 [R6-ospf-1-area-0.0.0.0]network 172.16.0.0 0.0.0.7 [R6-ospf-1-area-0.0.0.0]network 172.16.0.10 0.0.0.0 [R6-ospf-1-area-0.0.0.0]quit [R6-ospf-1]area 2 [R6-ospf-1-area-0.0.0.2]network 172.16.32.0 0.0.0.3 [R6-ospf-1-area-0.0.0.2]quit [R6-ospf-1]quit【R7】Area 0 Area 3 的 ABR[R7]ospf 1 router-id 7.7.7.7 [R7-ospf-1]area 0 [R7-ospf-1-area-0.0.0.0]network 172.16.0.0 0.0.0.7 [R7-ospf-1-area-0.0.0.0]network 172.16.0.11 0.0.0.0 [R7-ospf-1-area-0.0.0.0]quit [R7-ospf-1]area 3 [R7-ospf-1-area-0.0.0.3]network 172.16.48.0 0.0.0.3 [R7-ospf-1-area-0.0.0.3]quit [R7-ospf-1]quit【R1】Area 1[AR1]ospf 1 router-id 1.1.1.1 [AR1-ospf-1]area 1 [AR1-ospf-1-area-0.0.0.1]network 172.16.16.0 0.0.0.7 [AR1-ospf-1-area-0.0.0.1]network 172.16.16.16 0.0.0.0 [AR1-ospf-1-area-0.0.0.1]quit [AR1-ospf-1]quit【AR2】Area 1[AR2]ospf 1 router-id 2.2.2.2 [AR2-ospf-1]area 1 [AR2-ospf-1-area-0.0.0.1]network 172.16.16.0 0.0.0.7 [AR2-ospf-1-area-0.0.0.1]network 172.16.16.17 0.0.0.0 [AR2-ospf-1-area-0.0.0.1]quit [AR2-ospf-1]quit【R11】Area 2[R11]ospf 1 router-id 11.11.11.11 [R11-ospf-1]area 2 [R11-ospf-1-area-0.0.0.2]network 172.16.32.0 0.0.0.3 [R11-ospf-1-area-0.0.0.2]network 172.16.32.4 0.0.0.3 [R11-ospf-1-area-0.0.0.2]network 172.16.32.16 0.0.0.0 [R11-ospf-1-area-0.0.0.2]quit [R11-ospf-1]quit【R8】Area 3 Area 4 的 ABR[R8]ospf 1 router-id 8.8.8.8 [R8-ospf-1]area 3 [R8-ospf-1-area-0.0.0.3]network 172.16.48.0 0.0.0.3 [R8-ospf-1-area-0.0.0.3]network 172.16.48.16 0.0.0.0 [R8-ospf-1-area-0.0.0.3]quit [R8-ospf-1]area 4 [R8-ospf-1-area-0.0.0.4]network 172.16.64.0 0.0.0.3 [R8-ospf-1-area-0.0.0.4]quit [R8-ospf-1]quit【R9】Area 4[R9]ospf 1 router-id 9.9.9.9 [R9-ospf-1]area 4 [R9-ospf-1-area-0.0.0.4]network 172.16.64.0 0.0.0.3 [R9-ospf-1-area-0.0.0.4]network 172.16.64.4 0.0.0.3 [R9-ospf-1-area-0.0.0.4]network 172.16.64.16 0.0.0.0 [R9-ospf-1-area-0.0.0.4]quit [R9-ospf-1]quit【R10】Area 4[AR10]ospf 1 router-id 10.10.10.10 [AR10-ospf-1]area 4 [AR10-ospf-1-area-0.0.0.4]network 172.16.64.4 0.0.0.3 [AR10-ospf-1-area-0.0.0.4]network 172.16.64.17 0.0.0.0 [AR10-ospf-1-area-0.0.0.4]quit [AR10-ospf-1]quit【R12】Area 2 RIP[R12]ospf 1 router-id 12.12.12.12 [R12-ospf-1]area 2 [R12-ospf-1-area-0.0.0.2]network 172.16.32.4 0.0.0.3 [R12-ospf-1-area-0.0.0.2]network 172.16.32.17 0.0.0.0 [R12-ospf-1-area-0.0.0.2]network 172.16.32.18 0.0.0.0 [R12-ospf-1-area-0.0.0.2]quit [R12-ospf-1]quit步骤 4修改 Tunnel 网络类型确保 OSPF 邻居正常建立# R3 [R3]interface Tunnel0/0/0 [R3-Tunnel0/0/0]ospf network-type broadcast [R3-Tunnel0/0/0]ospf dr-priority 255 [R3-Tunnel0/0/0]quit # R5 [R5]interface Tunnel0/0/0 [R5-Tunnel0/0/0]ospf network-type broadcast [R5-Tunnel0/0/0]ospf dr-priority 0 [R5-Tunnel0/0/0]quit # R6 [R6]interface Tunnel0/0/0 [R6-Tunnel0/0/0]ospf network-type broadcast [R6-Tunnel0/0/0]ospf dr-priority 0 [R6-Tunnel0/0/0]quit # R7 [R7]interface Tunnel0/0/0 [R7-Tunnel0/0/0]ospf network-type broadcast [R7-Tunnel0/0/0]ospf dr-priority 0 [R7-Tunnel0/0/0]quit验证 OSPF 邻居步骤 5配置特殊区域减少 LSA 更新量5.1 Area 1 配置为 Totally Stubby Area# R3 [R3]ospf 1 [R3-ospf-1]area 1 [R3-ospf-1-area-0.0.0.1]stub no-summary [R3-ospf-1-area-0.0.0.1]quit [R3-ospf-1]quit # AR1 [AR1]ospf 1 [AR1-ospf-1]area 1 [AR1-ospf-1-area-0.0.0.1]stub [AR1-ospf-1-area-0.0.0.1]quit [AR1-ospf-1]quit # AR2 [AR2]ospf 1 [AR2-ospf-1]area 1 [AR2-ospf-1-area-0.0.0.1]stub [AR2-ospf-1-area-0.0.0.1]quit [AR2-ospf-1]quit5.2 Area 2 配置为 NSSA# R6 [R6]ospf 1 [R6-ospf-1]area 2 [R6-ospf-1-area-0.0.0.2]nssa [R6-ospf-1-area-0.0.0.2]quit [R6-ospf-1]quit # R11 [R11]ospf 1 [R11-ospf-1]area 2 [R11-ospf-1-area-0.0.0.2]nssa [R11-ospf-1-area-0.0.0.2]quit [R11-ospf-1]quit # R12 [R12]ospf 1 [R12-ospf-1]area 2 [R12-ospf-1-area-0.0.0.2]nssa [R12-ospf-1-area-0.0.0.2]quit [R12-ospf-1]quit5.3 Area 4 配置为 Totally Stubby Area# R8 [R8]ospf 1 [R8-ospf-1]area 4 [R8-ospf-1-area-0.0.0.4]stub no-summary [R8-ospf-1-area-0.0.0.4]quit [R8-ospf-1]quit # R9 [R9]ospf 1 [R9-ospf-1]area 4 [R9-ospf-1-area-0.0.0.4]stub [R9-ospf-1-area-0.0.0.4]quit [R9-ospf-1]quit # AR10 [AR10]ospf 1 [AR10-ospf-1]area 4 [AR10-ospf-1-area-0.0.0.4]stub [AR10-ospf-1-area-0.0.0.4]quit [AR10-ospf-1]quit步骤 6配置虚链路使 Area 4 接入 Area 0# R7 [R7]ospf 1 [R7-ospf-1]area 3 [R7-ospf-1-area-0.0.0.3]vlink-peer 8.8.8.8 [R7-ospf-1-area-0.0.0.3]quit [R7-ospf-1]quit # R8 [R8]ospf 1 [R8-ospf-1]area 3 [R8-ospf-1-area-0.0.0.3]vlink-peer 7.7.7.7 [R8-ospf-1-area-0.0.0.3]quit [R8-ospf-1]quit验证虚链路步骤 7配置路由汇总进一步减少路由条目7.1 ABR 区域间路由汇总bash# R3 汇总 Area 1 [R3]ospf 1 [R3-ospf-1]area 1 [R3-ospf-1-area-0.0.0.1]abr-summary 172.16.16.0 255.255.255.0 [R3-ospf-1-area-0.0.0.1]quit [R3-ospf-1]quit # R6 汇总 Area 2 [R6]ospf 1 [R6-ospf-1]area 2 [R6-ospf-1-area-0.0.0.2]abr-summary 172.16.32.0 255.255.255.0 [R6-ospf-1-area-0.0.0.2]quit [R6-ospf-1]quit # R7 汇总 Area 3 [R7]ospf 1 [R7-ospf-1]area 3 [R7-ospf-1-area-0.0.0.3]abr-summary 172.16.48.0 255.255.255.0 [R7-ospf-1-area-0.0.0.3]quit [R7-ospf-1]quit # R8 汇总 Area 4 [R8]ospf 1 [R8-ospf-1]area 4 [R8-ospf-1-area-0.0.0.4]abr-summary 172.16.64.0 255.255.255.0 [R8-ospf-1-area-0.0.0.4]quit [R8-ospf-1]quit7.2 ASBR 外部路由汇总bash# R12 汇总引入的 RIP 路由 [R12]ospf 1 [R12-ospf-1]asbr-summary 172.16.128.0 255.255.255.0 [R12-ospf-1]quit步骤 8加快收敛与保障更新安全8.1 修改 OSPF 计时器加快收敛bash# 以 R3 为例其他设备所有运行 OSPF 的接口均需同样配置 [R3]interface Tunnel0/0/0 [R3-Tunnel0/0/0]ospf timer hello 5 [R3-Tunnel0/0/0]ospf timer dead 20 [R3-Tunnel0/0/0]quit [R3]interface GigabitEthernet0/0/0 [R3-GigabitEthernet0/0/0]ospf timer hello 5 [R3-GigabitEthernet0/0/0]ospf timer dead 20 [R3-GigabitEthernet0/0/0]quit注意同一网段内所有路由器的 Hello/Dead 时间必须一致。8.2 配置 OSPF 区域认证# R3Area 0 和 Area 1 [R3]ospf 1 [R3-ospf-1]area 0 [R3-ospf-1-area-0.0.0.0]authentication-mode md5 1 cipher huawei [R3-ospf-1-area-0.0.0.0]quit [R3-ospf-1]area 1 [R3-ospf-1-area-0.0.0.1]authentication-mode md5 1 cipher huawei [R3-ospf-1-area-0.0.0.1]quit [R3-ospf-1]quit # R5Area 0 [R5]ospf 1 [R5-ospf-1]area 0 [R5-ospf-1-area-0.0.0.0]authentication-mode md5 1 cipher huawei [R5-ospf-1-area-0.0.0.0]quit [R5-ospf-1]quit # R6Area 0 和 Area 2 [R6]ospf 1 [R6-ospf-1]area 0 [R6-ospf-1-area-0.0.0.0]authentication-mode md5 1 cipher huawei [R6-ospf-1-area-0.0.0.0]quit [R6-ospf-1]area 2 [R6-ospf-1-area-0.0.0.2]authentication-mode md5 1 cipher huawei [R6-ospf-1-area-0.0.0.2]quit [R6-ospf-1]quit # R7Area 0 和 Area 3 [R7]ospf 1 [R7-ospf-1]area 0 [R7-ospf-1-area-0.0.0.0]authentication-mode md5 1 cipher huawei [R7-ospf-1-area-0.0.0.0]quit [R7-ospf-1]area 3 [R7-ospf-1-area-0.0.0.3]authentication-mode md5 1 cipher huawei [R7-ospf-1-area-0.0.0.3]quit [R7-ospf-1]quit # R8Area 3 和 Area 4 [R8]ospf 1 [R8-ospf-1]area 3 [R8-ospf-1-area-0.0.0.3]authentication-mode md5 1 cipher huawei [R8-ospf-1-area-0.0.0.3]quit [R8-ospf-1]area 4 [R8-ospf-1-area-0.0.0.4]authentication-mode md5 1 cipher huawei [R8-ospf-1-area-0.0.0.4]quit [R8-ospf-1]quit # AR1、AR2Area 1 [AR1]ospf 1 [AR1-ospf-1]area 1 [AR1-ospf-1-area-0.0.0.1]authentication-mode md5 1 cipher huawei [AR1-ospf-1-area-0.0.0.1]quit [AR1-ospf-1]quit # R11、R12Area 2 [R11]ospf 1 [R11-ospf-1]area 2 [R11-ospf-1-area-0.0.0.2]authentication-mode md5 1 cipher huawei [R11-ospf-1-area-0.0.0.2]quit [R11-ospf-1]quit # R9、AR10Area 4 [R9]ospf 1 [R9-ospf-1]area 4 [R9-ospf-1-area-0.0.0.4]authentication-mode md5 1 cipher huawei [R9-ospf-1-area-0.0.0.4]quit [R9-ospf-1]quit8.3 配置 Silent-Interfacebash# 以 R3 为例所有设备均需将 LoopBack0 配置为静默接口 [R3]ospf 1 [R3-ospf-1]silent-interface LoopBack0 [R3-ospf-1]quit步骤 9配置缺省路由与 NAT实现所有设备访问 R4 环回9.1 配置缺省路由指向 ISPbash[R3]ip route-static 0.0.0.0 0.0.0.0 34.0.0.4 [R5]ip route-static 0.0.0.0 0.0.0.0 45.0.0.4 [R6]ip route-static 0.0.0.0 0.0.0.0 46.0.0.4 [R7]ip route-static 0.0.0.0 0.0.0.0 47.0.0.49.2 在 OSPF 中发布缺省路由bash[R3]ospf 1 [R3-ospf-1]default-route-advertise always [R3-ospf-1]quit [R6]ospf 1 [R6-ospf-1]default-route-advertise always [R6-ospf-1]quit [R7]ospf 1 [R7-ospf-1]default-route-advertise always [R7-ospf-1]quit9.3 配置 Easy IPNAT Outboundbash# R3 [R3]acl 2000 [R3-acl-basic-2000]rule permit source 172.16.0.0 0.0.255.255 [R3-acl-basic-2000]quit [R3]interface Serial4/0/0 [R3-Serial4/0/0]nat outbound 2000 [R3-Serial4/0/0]quit # R5 [R5]acl 2000 [R5-acl-basic-2000]rule permit source 172.16.0.0 0.0.255.255 [R5-acl-basic-2000]quit [R5]interface Serial4/0/0 [R5-Serial4/0/0]nat outbound 2000 [R5-Serial4/0/0]quit # R6 [R6]acl 2000 [R6-acl-basic-2000]rule permit source 172.16.0.0 0.0.255.255 [R6-acl-basic-2000]quit [R6]interface Serial4/0/0 [R6-Serial4/0/0]nat outbound 2000 [R6-Serial4/0/0]quit # R7 [R7]acl 2000 [R7-acl-basic-2000]rule permit source 172.16.0.0 0.0.255.255 [R7-acl-basic-2000]quit [R7]interface GigabitEthernet0/0/0 [R7-GigabitEthernet0/0/0]nat outbound 2000 [R7-GigabitEthernet0/0/0]quit注意R4 作为 ISP 只配置了 IP 地址没有回程路由。在实验环境中需要在 R4 上手动添加一条汇总静态路由bash[R4]ip route-static 172.16.0.0 255.255.0.0 34.0.0.3或者分别配置指向 R5、R6、R7 的明细路由。在真实 ISP 环境中ISP 拥有完整公网路由表此处为实验模拟。步骤 10配置 RIP 及路由引入10.1 配置 RIP v2bash[R12]rip 1 [R12-rip-1]version 2 [R12-rip-1]undo summary [R12-rip-1]network 172.16.0.0 [R12-rip-1]quit10.2 将 RIP 路由引入 OSPFbash[R12]ospf 1 [R12-ospf-1]import-route rip 1 type 2 [R12-ospf-1]quit由于 Area 2 是 NSSA外部路由以 Type-7 LSA 进入 Area 2经 R6 转换为 Type-5 LSA 进入 Area 0全网可达。步骤 11配置黑洞路由防止环路bash[R3]ip route-static 172.16.16.0 24 NULL 0 [R6]ip route-static 172.16.32.0 24 NULL 0 [R7]ip route-static 172.16.48.0 24 NULL 0 [R8]ip route-static 172.16.64.0 24 NULL 0 [R12]ip route-static 172.16.128.0 24 NULL 0五、测试验证1、验证 OSPF 邻居关系结果R3 与 R1、R2、R5、R6、R7 建立 Full 邻居。2、验证 OSPF 路由表[R3]display ospf routing [R1]display ip routing-table protocol ospf结果AR1 路由表中只有一条缺省路由Totally Stubby 生效R3 路由表中有各区域的汇总路由。3、验证虚链路4、验证全网连通性5、验证访问 R4 环回4.4.4.4bashAR1ping 4.4.4.4 R11ping 4.4.4.4结果所有设备均能 ping 通 4.4.4.4。6、验证 LSA 减少效果bash[AR1]display ospf lsdb结果AR1 的 LSDB 中没有 Type-5 LSA只有 Type-1、Type-2 和一条 Type-3 缺省路由。bash[R6]display ospf lsdb结果Area 2 的 LSDB 中没有 Type-5 LSA外部路由以 Type-7 LSA 存在。7、验证 NAT 转换bash[R3]display nat session all结果能看到内网地址 172.16.x.x 被转换为 34.0.0.3 的会话记录。
第四章 OSPF综合实验（IP课）
一、实验拓扑二、实验要求1、R4为ISP其上只配置IP地址R4与其他所直连设备间均使用公有IP2、R3-R5、R6、R7为MGRE环境R3为中心站点3、整个OSPF环境IP基于172.16.0.0/16划分除了R12有两个环回其他路由器均有一个环回IP4、所有设备均可访问R4的环回5、减少LSA的更新量加快收敛保障更新安全6、全网可达三、实验思路1、划分 IP 地址基于 172.16.0.0/16纵观整个网络拓扑包括环回网段考虑汇总将 172.16.0.0/16 按区域划分为 5 个大的网段每个区域一个 /24便于 ABR 做路由汇总。表格区域用途网段具体分配Area 0MGRE Tunnel172.16.0.0/29R3:.1 / R5:.2 / R6:.3 / R7:.4Area 0环回地址172.16.0.8/32 ~ 172.16.0.11/32R3:.8 / R5:.9 / R6:.10 / R7:.11Area 1骨干链路172.16.16.0/29R3:.1 / AR1:.2 / AR2:.3Area 1环回地址172.16.16.16/32 ~ 172.16.16.17/32AR1:.16 / AR2:.17Area 2骨干链路172.16.32.0/30R6:.1 / R11:.2Area 2骨干链路172.16.32.4/30R11:.5 / R12:.6Area 2环回地址172.16.32.16/32 ~ 172.16.32.18/32R11:.16 / R12:.17 / R12:.18Area 2RIP 域172.16.128.0/24R12 连接Area 3骨干链路172.16.48.0/30R7:.1 / R8:.2Area 3环回地址172.16.48.16/32R8:.16Area 4骨干链路172.16.64.0/30R8:.1 / R9:.2Area 4骨干链路172.16.64.4/30R9:.5 / AR10:.6Area 4环回地址172.16.64.16/32 ~ 172.16.64.17/32R9:.16 / AR10:.17公网地址R4 及直连表格链路网段R3-R434.0.0.0/24R4-R545.0.0.0/24R4-R646.0.0.0/24R4-R747.0.0.0/24R4 环回4.4.4.4/322、配置 MGRE 环境R3 为中心站点R3、R5、R6、R7 通过公网链路连接到 ISPR4在公网之上建立 MGRE 隧道实现多点 GRE 互联。R3 作为 NHRP ServerR5/R6/R7 作为 NHRP Client 向 R3 注册。3、配置 OSPF 多区域路由协议在 MGRE Tunnel 接口上运行 OSPF网络类型修改为 BroadcastR3 优先级最高作为 DR各路由器按区域宣告对应网段Area 4 未直接连接 Area 0需在 R7-R8 之间穿过 Area 3 建立虚链路使 Area 4 逻辑上接入骨干4、减少 LSA 更新量特殊区域Area 1 配置为Totally Stubby Area完全末梢区域R3 只向 Area 1 下发缺省路由Area 2 配置为NSSA过滤 Type-5 LSARIP 路由以 Type-7 LSA 进入Area 4 配置为Totally Stubby AreaR8 只向 Area 4 下发缺省路由路由汇总ABR 汇总R3Area 1、R6Area 2、R7Area 3、R8Area 4分别做区域间路由汇总ASBR 汇总R12 对引入的 RIP 路由做外部汇总5、加快收敛与保障更新安全加快收敛将 OSPF Hello/Dead 间隔由 10s/40s 修改为5s/20s保障安全所有区域配置OSPF MD5 认证Loopback 接口配置silent-interface减少无用报文6、配置缺省路由与 NAT实现访问 R4 环回R3/R5/R6/R7 各自配置缺省路由指向 R4各边界路由器在连接 R4 的接口上配置Easy IPNAT Outbound将内网 172.16.0.0/16 地址转换为公网地址R3/R6/R7 通过 OSPF 向各自区域发布缺省路由7、配置 RIP 及路由引入R12 配置 RIP v2宣告自身环回及 RIP 域R12 将 RIP 路由引入 OSPF由于 Area 2 为 NSSA外部路由以 Type-7 LSA 进入经 R6 转换为 Type-5 LSA 进入 Area 0四、实验步骤步骤 1配置 IP 地址分析R4 作为 ISP 只配置 IP 地址不参与任何路由协议。其他所有路由器基于 172.16.0.0/16 按区域划分配置 IP。【R4 - ISP】只配置 IP 地址[R4]interface Serial4/0/0 [R4-Serial4/0/0]ip address 34.0.0.4 255.255.255.0 [R4-Serial4/0/0]quit [R4]interface Serial4/0/1 [R4-Serial4/0/1]ip address 45.0.0.4 255.255.255.0 [R4-Serial4/0/1]quit [R4]interface Serial3/0/0 [R4-Serial3/0/0]ip address 46.0.0.4 255.255.255.0 [R4-Serial3/0/0]quit [R4]interface GigabitEthernet0/0/0 [R4-GigabitEthernet0/0/0]ip address 47.0.0.4 255.255.255.0 [R4-GigabitEthernet0/0/0]quit [R4]interface LoopBack0 [R4-LoopBack0]ip address 4.4.4.4 255.255.255.255 [R4-LoopBack0]quit【R3】[R3]interface Serial4/0/0 [R3-Serial4/0/0]ip address 34.0.0.3 255.255.255.0 [R3-Serial4/0/0]quit [R3]interface GigabitEthernet0/0/0 [R3-GigabitEthernet0/0/0]ip address 172.16.16.1 255.255.255.248 [R3-GigabitEthernet0/0/0]quit [R3]interface LoopBack0 [R3-LoopBack0]ip address 172.16.0.8 255.255.255.255 [R3-LoopBack0]quit【R5】[R5]interface Serial4/0/0 [R5-Serial4/0/0]ip address 45.0.0.5 255.255.255.0 [R5-Serial4/0/0]quit [R5]interface LoopBack0 [R5-LoopBack0]ip address 172.16.0.9 255.255.255.255 [R5-LoopBack0]quit【R6】[R6]interface Serial4/0/0 [R6-Serial4/0/0]ip address 46.0.0.6 255.255.255.0 [R6-Serial4/0/0]quit [R6]interface GigabitEthernet0/0/0 [R6-GigabitEthernet0/0/0]ip address 172.16.32.1 255.255.255.252 [R6-GigabitEthernet0/0/0]quit [R6]interface LoopBack0 [R6-LoopBack0]ip address 172.16.0.10 255.255.255.255 [R6-LoopBack0]quit【R7】[R7]interface GigabitEthernet0/0/0 [R7-GigabitEthernet0/0/0]ip address 47.0.0.7 255.255.255.0 [R7-GigabitEthernet0/0/0]quit [R7]interface GigabitEthernet0/0/1 [R7-GigabitEthernet0/0/1]ip address 172.16.48.1 255.255.255.252 [R7-GigabitEthernet0/0/1]quit [R7]interface LoopBack0 [R7-LoopBack0]ip address 172.16.0.11 255.255.255.255 [R7-LoopBack0]quit【R1】[AR1]interface GigabitEthernet0/0/0 [AR1-GigabitEthernet0/0/0]ip address 172.16.16.2 255.255.255.248 [AR1-GigabitEthernet0/0/0]quit [AR1]interface LoopBack0 [AR1-LoopBack0]ip address 172.16.16.16 255.255.255.255 [AR1-LoopBack0]quit【R2】[AR2]interface GigabitEthernet0/0/0 [AR2-GigabitEthernet0/0/0]ip address 172.16.16.3 255.255.255.248 [AR2-GigabitEthernet0/0/0]quit [AR2]interface LoopBack0 [AR2-LoopBack0]ip address 172.16.16.17 255.255.255.255 [AR2-LoopBack0]quit【R11】[R11]interface GigabitEthernet0/0/0 [R11-GigabitEthernet0/0/0]ip address 172.16.32.2 255.255.255.252 [R11-GigabitEthernet0/0/0]quit [R11]interface GigabitEthernet0/0/1 [R11-GigabitEthernet0/0/1]ip address 172.16.32.5 255.255.255.252 [R11-GigabitEthernet0/0/1]quit [R11]interface LoopBack0 [R11-LoopBack0]ip address 172.16.32.16 255.255.255.255 [R11-LoopBack0]quit【R12】[R12]interface GigabitEthernet0/0/0 [R12-GigabitEthernet0/0/0]ip address 172.16.32.6 255.255.255.252 [R12-GigabitEthernet0/0/0]quit [R12]interface LoopBack0 [R12-LoopBack0]ip address 172.16.32.17 255.255.255.255 [R12-LoopBack0]quit [R12]interface LoopBack1 [R12-LoopBack1]ip address 172.16.32.18 255.255.255.255 [R12-LoopBack1]quit【R8】[R8]interface GigabitEthernet0/0/0 [R8-GigabitEthernet0/0/0]ip address 172.16.48.2 255.255.255.252 [R8-GigabitEthernet0/0/0]quit [R8]interface GigabitEthernet0/0/1 [R8-GigabitEthernet0/0/1]ip address 172.16.64.1 255.255.255.252 [R8-GigabitEthernet0/0/1]quit [R8]interface LoopBack0 [R8-LoopBack0]ip address 172.16.48.16 255.255.255.255 [R8-LoopBack0]quit【R9】[R9]interface GigabitEthernet0/0/0 [R9-GigabitEthernet0/0/0]ip address 172.16.64.2 255.255.255.252 [R9-GigabitEthernet0/0/0]quit [R9]interface GigabitEthernet0/0/1 [R9-GigabitEthernet0/0/1]ip address 172.16.64.5 255.255.255.252 [R9-GigabitEthernet0/0/1]quit [R9]interface LoopBack0 [R9-LoopBack0]ip address 172.16.64.16 255.255.255.255 [R9-LoopBack0]quit【AR10】[AR10]interface GigabitEthernet0/0/0 [AR10-GigabitEthernet0/0/0]ip address 172.16.64.6 255.255.255.252 [AR10-GigabitEthernet0/0/0]quit [AR10]interface LoopBack0 [AR10-LoopBack0]ip address 172.16.64.17 255.255.255.255 [AR10-LoopBack0]quit步骤 2配置 MGRE 环境R3 为中心站点【R3 - Hub】[R3]interface Tunnel0/0/0 [R3-Tunnel0/0/0]tunnel-protocol gre p2mp [R3-Tunnel0/0/0]source Serial4/0/0 [R3-Tunnel0/0/0]nhrp entry multicast dynamic [R3-Tunnel0/0/0]nhrp network-id 100 [R3-Tunnel0/0/0]ip address 172.16.0.1 255.255.255.248 [R3-Tunnel0/0/0]quit【R5 - Spoke】[R5]interface Tunnel0/0/0 [R5-Tunnel0/0/0]tunnel-protocol gre p2mp [R5-Tunnel0/0/0]source Serial4/0/0 [R5-Tunnel0/0/0]nhrp network-id 100 [R5-Tunnel0/0/0]nhrp entry 172.16.0.1 34.0.0.3 register [R5-Tunnel0/0/0]ip address 172.16.0.2 255.255.255.248 [R5-Tunnel0/0/0]quit【R6 - Spoke】[R6]interface Tunnel0/0/0 [R6-Tunnel0/0/0]tunnel-protocol gre p2mp [R6-Tunnel0/0/0]source Serial4/0/0 [R6-Tunnel0/0/0]nhrp network-id 100 [R6-Tunnel0/0/0]nhrp entry 172.16.0.1 34.0.0.3 register [R6-Tunnel0/0/0]ip address 172.16.0.3 255.255.255.248 [R6-Tunnel0/0/0]quit【R7 - Spoke】[R7]interface Tunnel0/0/0 [R7-Tunnel0/0/0]tunnel-protocol gre p2mp [R7-Tunnel0/0/0]source GigabitEthernet0/0/0 [R7-Tunnel0/0/0]nhrp network-id 100 [R7-Tunnel0/0/0]nhrp entry 172.16.0.1 34.0.0.3 register [R7-Tunnel0/0/0]ip address 172.16.0.4 255.255.255.248 [R7-Tunnel0/0/0]quit验证 MGRE[R3]display nhrp peer all # 查看分支注册情况 R5ping 172.16.0.1 # 测试隧道连通性步骤 3配置 OSPF 多区域路由协议【R3】Area 0 Area 1 的 ABR[R3]ospf 1 router-id 3.3.3.3 [R3-ospf-1]area 0 [R3-ospf-1-area-0.0.0.0]network 172.16.0.0 0.0.0.7 [R3-ospf-1-area-0.0.0.0]network 172.16.0.8 0.0.0.0 [R3-ospf-1-area-0.0.0.0]quit [R3-ospf-1]area 1 [R3-ospf-1-area-0.0.0.1]network 172.16.16.0 0.0.0.7 [R3-ospf-1-area-0.0.0.1]quit [R3-ospf-1]quit【R5】Area 0[R5]ospf 1 router-id 5.5.5.5 [R5-ospf-1]area 0 [R5-ospf-1-area-0.0.0.0]network 172.16.0.0 0.0.0.7 [R5-ospf-1-area-0.0.0.0]network 172.16.0.9 0.0.0.0 [R5-ospf-1-area-0.0.0.0]quit [R5-ospf-1]quit【R6】Area 0 Area 2 的 ABR[R6]ospf 1 router-id 6.6.6.6 [R6-ospf-1]area 0 [R6-ospf-1-area-0.0.0.0]network 172.16.0.0 0.0.0.7 [R6-ospf-1-area-0.0.0.0]network 172.16.0.10 0.0.0.0 [R6-ospf-1-area-0.0.0.0]quit [R6-ospf-1]area 2 [R6-ospf-1-area-0.0.0.2]network 172.16.32.0 0.0.0.3 [R6-ospf-1-area-0.0.0.2]quit [R6-ospf-1]quit【R7】Area 0 Area 3 的 ABR[R7]ospf 1 router-id 7.7.7.7 [R7-ospf-1]area 0 [R7-ospf-1-area-0.0.0.0]network 172.16.0.0 0.0.0.7 [R7-ospf-1-area-0.0.0.0]network 172.16.0.11 0.0.0.0 [R7-ospf-1-area-0.0.0.0]quit [R7-ospf-1]area 3 [R7-ospf-1-area-0.0.0.3]network 172.16.48.0 0.0.0.3 [R7-ospf-1-area-0.0.0.3]quit [R7-ospf-1]quit【R1】Area 1[AR1]ospf 1 router-id 1.1.1.1 [AR1-ospf-1]area 1 [AR1-ospf-1-area-0.0.0.1]network 172.16.16.0 0.0.0.7 [AR1-ospf-1-area-0.0.0.1]network 172.16.16.16 0.0.0.0 [AR1-ospf-1-area-0.0.0.1]quit [AR1-ospf-1]quit【AR2】Area 1[AR2]ospf 1 router-id 2.2.2.2 [AR2-ospf-1]area 1 [AR2-ospf-1-area-0.0.0.1]network 172.16.16.0 0.0.0.7 [AR2-ospf-1-area-0.0.0.1]network 172.16.16.17 0.0.0.0 [AR2-ospf-1-area-0.0.0.1]quit [AR2-ospf-1]quit【R11】Area 2[R11]ospf 1 router-id 11.11.11.11 [R11-ospf-1]area 2 [R11-ospf-1-area-0.0.0.2]network 172.16.32.0 0.0.0.3 [R11-ospf-1-area-0.0.0.2]network 172.16.32.4 0.0.0.3 [R11-ospf-1-area-0.0.0.2]network 172.16.32.16 0.0.0.0 [R11-ospf-1-area-0.0.0.2]quit [R11-ospf-1]quit【R8】Area 3 Area 4 的 ABR[R8]ospf 1 router-id 8.8.8.8 [R8-ospf-1]area 3 [R8-ospf-1-area-0.0.0.3]network 172.16.48.0 0.0.0.3 [R8-ospf-1-area-0.0.0.3]network 172.16.48.16 0.0.0.0 [R8-ospf-1-area-0.0.0.3]quit [R8-ospf-1]area 4 [R8-ospf-1-area-0.0.0.4]network 172.16.64.0 0.0.0.3 [R8-ospf-1-area-0.0.0.4]quit [R8-ospf-1]quit【R9】Area 4[R9]ospf 1 router-id 9.9.9.9 [R9-ospf-1]area 4 [R9-ospf-1-area-0.0.0.4]network 172.16.64.0 0.0.0.3 [R9-ospf-1-area-0.0.0.4]network 172.16.64.4 0.0.0.3 [R9-ospf-1-area-0.0.0.4]network 172.16.64.16 0.0.0.0 [R9-ospf-1-area-0.0.0.4]quit [R9-ospf-1]quit【R10】Area 4[AR10]ospf 1 router-id 10.10.10.10 [AR10-ospf-1]area 4 [AR10-ospf-1-area-0.0.0.4]network 172.16.64.4 0.0.0.3 [AR10-ospf-1-area-0.0.0.4]network 172.16.64.17 0.0.0.0 [AR10-ospf-1-area-0.0.0.4]quit [AR10-ospf-1]quit【R12】Area 2 RIP[R12]ospf 1 router-id 12.12.12.12 [R12-ospf-1]area 2 [R12-ospf-1-area-0.0.0.2]network 172.16.32.4 0.0.0.3 [R12-ospf-1-area-0.0.0.2]network 172.16.32.17 0.0.0.0 [R12-ospf-1-area-0.0.0.2]network 172.16.32.18 0.0.0.0 [R12-ospf-1-area-0.0.0.2]quit [R12-ospf-1]quit步骤 4修改 Tunnel 网络类型确保 OSPF 邻居正常建立# R3 [R3]interface Tunnel0/0/0 [R3-Tunnel0/0/0]ospf network-type broadcast [R3-Tunnel0/0/0]ospf dr-priority 255 [R3-Tunnel0/0/0]quit # R5 [R5]interface Tunnel0/0/0 [R5-Tunnel0/0/0]ospf network-type broadcast [R5-Tunnel0/0/0]ospf dr-priority 0 [R5-Tunnel0/0/0]quit # R6 [R6]interface Tunnel0/0/0 [R6-Tunnel0/0/0]ospf network-type broadcast [R6-Tunnel0/0/0]ospf dr-priority 0 [R6-Tunnel0/0/0]quit # R7 [R7]interface Tunnel0/0/0 [R7-Tunnel0/0/0]ospf network-type broadcast [R7-Tunnel0/0/0]ospf dr-priority 0 [R7-Tunnel0/0/0]quit验证 OSPF 邻居步骤 5配置特殊区域减少 LSA 更新量5.1 Area 1 配置为 Totally Stubby Area# R3 [R3]ospf 1 [R3-ospf-1]area 1 [R3-ospf-1-area-0.0.0.1]stub no-summary [R3-ospf-1-area-0.0.0.1]quit [R3-ospf-1]quit # AR1 [AR1]ospf 1 [AR1-ospf-1]area 1 [AR1-ospf-1-area-0.0.0.1]stub [AR1-ospf-1-area-0.0.0.1]quit [AR1-ospf-1]quit # AR2 [AR2]ospf 1 [AR2-ospf-1]area 1 [AR2-ospf-1-area-0.0.0.1]stub [AR2-ospf-1-area-0.0.0.1]quit [AR2-ospf-1]quit5.2 Area 2 配置为 NSSA# R6 [R6]ospf 1 [R6-ospf-1]area 2 [R6-ospf-1-area-0.0.0.2]nssa [R6-ospf-1-area-0.0.0.2]quit [R6-ospf-1]quit # R11 [R11]ospf 1 [R11-ospf-1]area 2 [R11-ospf-1-area-0.0.0.2]nssa [R11-ospf-1-area-0.0.0.2]quit [R11-ospf-1]quit # R12 [R12]ospf 1 [R12-ospf-1]area 2 [R12-ospf-1-area-0.0.0.2]nssa [R12-ospf-1-area-0.0.0.2]quit [R12-ospf-1]quit5.3 Area 4 配置为 Totally Stubby Area# R8 [R8]ospf 1 [R8-ospf-1]area 4 [R8-ospf-1-area-0.0.0.4]stub no-summary [R8-ospf-1-area-0.0.0.4]quit [R8-ospf-1]quit # R9 [R9]ospf 1 [R9-ospf-1]area 4 [R9-ospf-1-area-0.0.0.4]stub [R9-ospf-1-area-0.0.0.4]quit [R9-ospf-1]quit # AR10 [AR10]ospf 1 [AR10-ospf-1]area 4 [AR10-ospf-1-area-0.0.0.4]stub [AR10-ospf-1-area-0.0.0.4]quit [AR10-ospf-1]quit步骤 6配置虚链路使 Area 4 接入 Area 0# R7 [R7]ospf 1 [R7-ospf-1]area 3 [R7-ospf-1-area-0.0.0.3]vlink-peer 8.8.8.8 [R7-ospf-1-area-0.0.0.3]quit [R7-ospf-1]quit # R8 [R8]ospf 1 [R8-ospf-1]area 3 [R8-ospf-1-area-0.0.0.3]vlink-peer 7.7.7.7 [R8-ospf-1-area-0.0.0.3]quit [R8-ospf-1]quit验证虚链路步骤 7配置路由汇总进一步减少路由条目7.1 ABR 区域间路由汇总bash# R3 汇总 Area 1 [R3]ospf 1 [R3-ospf-1]area 1 [R3-ospf-1-area-0.0.0.1]abr-summary 172.16.16.0 255.255.255.0 [R3-ospf-1-area-0.0.0.1]quit [R3-ospf-1]quit # R6 汇总 Area 2 [R6]ospf 1 [R6-ospf-1]area 2 [R6-ospf-1-area-0.0.0.2]abr-summary 172.16.32.0 255.255.255.0 [R6-ospf-1-area-0.0.0.2]quit [R6-ospf-1]quit # R7 汇总 Area 3 [R7]ospf 1 [R7-ospf-1]area 3 [R7-ospf-1-area-0.0.0.3]abr-summary 172.16.48.0 255.255.255.0 [R7-ospf-1-area-0.0.0.3]quit [R7-ospf-1]quit # R8 汇总 Area 4 [R8]ospf 1 [R8-ospf-1]area 4 [R8-ospf-1-area-0.0.0.4]abr-summary 172.16.64.0 255.255.255.0 [R8-ospf-1-area-0.0.0.4]quit [R8-ospf-1]quit7.2 ASBR 外部路由汇总bash# R12 汇总引入的 RIP 路由 [R12]ospf 1 [R12-ospf-1]asbr-summary 172.16.128.0 255.255.255.0 [R12-ospf-1]quit步骤 8加快收敛与保障更新安全8.1 修改 OSPF 计时器加快收敛bash# 以 R3 为例其他设备所有运行 OSPF 的接口均需同样配置 [R3]interface Tunnel0/0/0 [R3-Tunnel0/0/0]ospf timer hello 5 [R3-Tunnel0/0/0]ospf timer dead 20 [R3-Tunnel0/0/0]quit [R3]interface GigabitEthernet0/0/0 [R3-GigabitEthernet0/0/0]ospf timer hello 5 [R3-GigabitEthernet0/0/0]ospf timer dead 20 [R3-GigabitEthernet0/0/0]quit注意同一网段内所有路由器的 Hello/Dead 时间必须一致。8.2 配置 OSPF 区域认证# R3Area 0 和 Area 1 [R3]ospf 1 [R3-ospf-1]area 0 [R3-ospf-1-area-0.0.0.0]authentication-mode md5 1 cipher huawei [R3-ospf-1-area-0.0.0.0]quit [R3-ospf-1]area 1 [R3-ospf-1-area-0.0.0.1]authentication-mode md5 1 cipher huawei [R3-ospf-1-area-0.0.0.1]quit [R3-ospf-1]quit # R5Area 0 [R5]ospf 1 [R5-ospf-1]area 0 [R5-ospf-1-area-0.0.0.0]authentication-mode md5 1 cipher huawei [R5-ospf-1-area-0.0.0.0]quit [R5-ospf-1]quit # R6Area 0 和 Area 2 [R6]ospf 1 [R6-ospf-1]area 0 [R6-ospf-1-area-0.0.0.0]authentication-mode md5 1 cipher huawei [R6-ospf-1-area-0.0.0.0]quit [R6-ospf-1]area 2 [R6-ospf-1-area-0.0.0.2]authentication-mode md5 1 cipher huawei [R6-ospf-1-area-0.0.0.2]quit [R6-ospf-1]quit # R7Area 0 和 Area 3 [R7]ospf 1 [R7-ospf-1]area 0 [R7-ospf-1-area-0.0.0.0]authentication-mode md5 1 cipher huawei [R7-ospf-1-area-0.0.0.0]quit [R7-ospf-1]area 3 [R7-ospf-1-area-0.0.0.3]authentication-mode md5 1 cipher huawei [R7-ospf-1-area-0.0.0.3]quit [R7-ospf-1]quit # R8Area 3 和 Area 4 [R8]ospf 1 [R8-ospf-1]area 3 [R8-ospf-1-area-0.0.0.3]authentication-mode md5 1 cipher huawei [R8-ospf-1-area-0.0.0.3]quit [R8-ospf-1]area 4 [R8-ospf-1-area-0.0.0.4]authentication-mode md5 1 cipher huawei [R8-ospf-1-area-0.0.0.4]quit [R8-ospf-1]quit # AR1、AR2Area 1 [AR1]ospf 1 [AR1-ospf-1]area 1 [AR1-ospf-1-area-0.0.0.1]authentication-mode md5 1 cipher huawei [AR1-ospf-1-area-0.0.0.1]quit [AR1-ospf-1]quit # R11、R12Area 2 [R11]ospf 1 [R11-ospf-1]area 2 [R11-ospf-1-area-0.0.0.2]authentication-mode md5 1 cipher huawei [R11-ospf-1-area-0.0.0.2]quit [R11-ospf-1]quit # R9、AR10Area 4 [R9]ospf 1 [R9-ospf-1]area 4 [R9-ospf-1-area-0.0.0.4]authentication-mode md5 1 cipher huawei [R9-ospf-1-area-0.0.0.4]quit [R9-ospf-1]quit8.3 配置 Silent-Interfacebash# 以 R3 为例所有设备均需将 LoopBack0 配置为静默接口 [R3]ospf 1 [R3-ospf-1]silent-interface LoopBack0 [R3-ospf-1]quit步骤 9配置缺省路由与 NAT实现所有设备访问 R4 环回9.1 配置缺省路由指向 ISPbash[R3]ip route-static 0.0.0.0 0.0.0.0 34.0.0.4 [R5]ip route-static 0.0.0.0 0.0.0.0 45.0.0.4 [R6]ip route-static 0.0.0.0 0.0.0.0 46.0.0.4 [R7]ip route-static 0.0.0.0 0.0.0.0 47.0.0.49.2 在 OSPF 中发布缺省路由bash[R3]ospf 1 [R3-ospf-1]default-route-advertise always [R3-ospf-1]quit [R6]ospf 1 [R6-ospf-1]default-route-advertise always [R6-ospf-1]quit [R7]ospf 1 [R7-ospf-1]default-route-advertise always [R7-ospf-1]quit9.3 配置 Easy IPNAT Outboundbash# R3 [R3]acl 2000 [R3-acl-basic-2000]rule permit source 172.16.0.0 0.0.255.255 [R3-acl-basic-2000]quit [R3]interface Serial4/0/0 [R3-Serial4/0/0]nat outbound 2000 [R3-Serial4/0/0]quit # R5 [R5]acl 2000 [R5-acl-basic-2000]rule permit source 172.16.0.0 0.0.255.255 [R5-acl-basic-2000]quit [R5]interface Serial4/0/0 [R5-Serial4/0/0]nat outbound 2000 [R5-Serial4/0/0]quit # R6 [R6]acl 2000 [R6-acl-basic-2000]rule permit source 172.16.0.0 0.0.255.255 [R6-acl-basic-2000]quit [R6]interface Serial4/0/0 [R6-Serial4/0/0]nat outbound 2000 [R6-Serial4/0/0]quit # R7 [R7]acl 2000 [R7-acl-basic-2000]rule permit source 172.16.0.0 0.0.255.255 [R7-acl-basic-2000]quit [R7]interface GigabitEthernet0/0/0 [R7-GigabitEthernet0/0/0]nat outbound 2000 [R7-GigabitEthernet0/0/0]quit注意R4 作为 ISP 只配置了 IP 地址没有回程路由。在实验环境中需要在 R4 上手动添加一条汇总静态路由bash[R4]ip route-static 172.16.0.0 255.255.0.0 34.0.0.3或者分别配置指向 R5、R6、R7 的明细路由。在真实 ISP 环境中ISP 拥有完整公网路由表此处为实验模拟。步骤 10配置 RIP 及路由引入10.1 配置 RIP v2bash[R12]rip 1 [R12-rip-1]version 2 [R12-rip-1]undo summary [R12-rip-1]network 172.16.0.0 [R12-rip-1]quit10.2 将 RIP 路由引入 OSPFbash[R12]ospf 1 [R12-ospf-1]import-route rip 1 type 2 [R12-ospf-1]quit由于 Area 2 是 NSSA外部路由以 Type-7 LSA 进入 Area 2经 R6 转换为 Type-5 LSA 进入 Area 0全网可达。步骤 11配置黑洞路由防止环路bash[R3]ip route-static 172.16.16.0 24 NULL 0 [R6]ip route-static 172.16.32.0 24 NULL 0 [R7]ip route-static 172.16.48.0 24 NULL 0 [R8]ip route-static 172.16.64.0 24 NULL 0 [R12]ip route-static 172.16.128.0 24 NULL 0五、测试验证1、验证 OSPF 邻居关系结果R3 与 R1、R2、R5、R6、R7 建立 Full 邻居。2、验证 OSPF 路由表[R3]display ospf routing [R1]display ip routing-table protocol ospf结果AR1 路由表中只有一条缺省路由Totally Stubby 生效R3 路由表中有各区域的汇总路由。3、验证虚链路4、验证全网连通性5、验证访问 R4 环回4.4.4.4bashAR1ping 4.4.4.4 R11ping 4.4.4.4结果所有设备均能 ping 通 4.4.4.4。6、验证 LSA 减少效果bash[AR1]display ospf lsdb结果AR1 的 LSDB 中没有 Type-5 LSA只有 Type-1、Type-2 和一条 Type-3 缺省路由。bash[R6]display ospf lsdb结果Area 2 的 LSDB 中没有 Type-5 LSA外部路由以 Type-7 LSA 存在。7、验证 NAT 转换bash[R3]display nat session all结果能看到内网地址 172.16.x.x 被转换为 34.0.0.3 的会话记录。