网络工程师Day9--GRE配置

忘是亡心i 2024-04-17 16:57 30阅读 0赞

\#网络工程师Day8–实验3-5 GRE隧道配置

## 学习目标 ##

### 掌握GRE隧道封装的配置方法 ###

### 掌握GRE隧道接口的配置方法 ###

### 理解GRE keepalive功能的实现原理 ###

## 拓扑图 ##

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM2ODEzODU3_size_16_color_FFFFFF_t_70]

## 场景 ##

当企业总部和分支机构间需要互相发布加密的路由信息时，仅通过IPSEC VPN方案是无法实现的，由于IPSEC VPN无法承载使用组播发送的路由协议数据包，因此还需要在现有的IPSEC网络中配置GRE隧道解决此问题

## 操作步骤 ##

开始本实验前，必须先完成实验3-4

### 步骤一 创建GRE隧道 ###

创建隧道接口并为该接口配置一个公网IP地址，然后指定接口封装类型为GRE,并配置隧道的实际源地址以及实际目的地址。

[r1]interface Tunnel 0/0/1
    [r1-Tunnel0/0/1]ip add 100.1.1.1 24
    [r1-Tunnel0/0/1]tu	
    [r1-Tunnel0/0/1]tunnel-protocol GRE
    Info: Relevant configurations on this interface are deleted.
    [r1-Tunnel0/0/1]source 10.0.12.1
    [r1-Tunnel0/0/1]destination 10.0.23.3
    [r1-Tunnel0/0/1]

[r3]INT TUNNEL 0/0/1
    [r3-Tunnel0/0/1]ip add 100.1.1.2 24
    [r3-Tunnel0/0/1]tunnel-protocol gre
    Info: Relevant configurations on this interface are deleted.
    [r3-Tunnel0/0/1]source 10.0.23.3
    [r3-Tunnel0/0/1]destination 10.0.12.1

### 步骤二 配置OSPF进程2用于隧道路由 ###

将隧道接口所在的网络通告在OSPF进程1，从OSPF进程1中删除网络10.0.12.0/24和10.0.23.0/24.创建链OSPF进程2，并将网络10.0.12.0/24和10.0.23.0/24通告到OSPF进程2。

[r1]ospf 1
    [r1-ospf-1]area 0
    [r1-ospf-1-area-0.0.0.0]network 100.1.1.0 0.0.0.255
    [r1-ospf-1-area-0.0.0.0]undo network 10.0.12.0 0.0.0.255
    [r1-ospf-1-area-0.0.0.0]ospf 2 router-id 10.0.1.1
    [r1-ospf-2]area 0
    [r1-ospf-2-area-0.0.0.0]network 10.0.12.0 0.0.0.255
    [r1-ospf-2-area-0.0.0.0]quit

[r3]ospf 1
    [r3-ospf-1]area 0
    [r3-ospf-1-area-0.0.0.0]network 100.1.1.0 0.0.0.255
    [r3-ospf-1-area-0.0.0.0]ne	
    [r3-ospf-1-area-0.0.0.0]undo network 10.0.23.0 0.0.0.255
    [r3-ospf-1-area-0.0.0.0]quit
    [r3-ospf-1]quit
    [r3]ospf 2 router-id 10.0.3.3
    [r3-ospf-2]area 0
    [r3-ospf-2-area-0.0.0.0]network 10.0.23.0 0.0.0.255
    [r3-ospf-2-area-0.0.0.0]quit

路由器会为不同的OSPF进程创建不同的LSDB,R1和R3中分别有LSDB 1 和LSDB 2,两个数据库彼此独立，不会同步路由信息，因此R2学习不到R1和R3通告在进程2中  
的路由

display int t 0/0/1
    
    [r1]dis int t0/0/1
    Tunnel0/0/1 current state : UP
    Line protocol current state : UP
    Last line protocol up time : 2019-08-28 15:06:58 UTC-08:00
    Description:
    Route Port,The Maximum Transmit Unit is 1500
    Internet Address is 100.1.1.1/24
    Encapsulation is TUNNEL, loopback not set
    Tunnel source 10.0.12.1 (Serial0/0/1), destination 10.0.23.3
    Tunnel protocol/transport GRE/IP, key disabled
    keepalive disabled
    Checksumming of packets disabled
    Current system time: 2019-08-28 15:12:14-08:00
    300 seconds input rate 344 bits/sec, 0 packets/sec
    300 seconds output rate 360 bits/sec, 0 packets/sec
    0 seconds input rate 0 bits/sec, 0 packets/sec
    0 seconds output rate 0 bits/sec, 0 packets/sec
    55 packets input,  14940 bytes
    0 input error
    66 packets output,  15300 bytes
    5 output error
    Input:
      Unicast: 0 packets, Multicast: 0 packets
    Output:
      Unicast: 10 packets, Multicast: 56 packets
    Input bandwidth utilization  : --
    Output bandwidth utilization : --

[r3]dis ospf 1 peer 
    
    	 OSPF Process 1 with Router ID 10.0.3.3
    		 Neighbors 
    
     Area 0.0.0.0 interface 100.1.1.2(Tunnel0/0/1)'s neighbors
     Router ID: 10.0.1.1 Address: 100.1.1.1   
       State: Full  Mode:Nbr is  Slave  Priority: 1
       DR: None   BDR: None   MTU: 0
       Dead timer due in 40  sec 
       Retrans timer interval: 5 
       Neighbor is up for 00:00:24 
       Authentication Sequence: [ 0 ]

### 步骤三 将GRE流量定义为感兴趣流量 ###

重新配置ACL定义感兴趣流量

[r1]acl 3001
    [r1-acl-adv-3001]rule 5 per gre source 10.0.12.1 0 destination 10.0.23.3 0

[r3]acl 3001
    [r3-acl-adv-3001]rule per gre source 10.0.23.3 0 destination 10.0.12.1 0

### 步骤四 验证路由信息通过GRE封装后可由IPSEC VPN传输 ###

[r1]dis ip routing-table 
    Route Flags: R - relay, D - download to fib
    ------------------------------------------------------------------------------
    Routing Tables: Public
     Destinations : 15   Routes : 15   
    
    Destination/MaskProto   Pre  Cost  Flags NextHop Interface
    
       10.0.1.0/24  Direct  00   D   10.0.1.1LoopBack0
       10.0.1.1/32  Direct  00   D   127.0.0.1   LoopBack0
       10.0.2.2/32  OSPF10   1562D   10.0.12.2   Serial0/0/1
       10.0.3.3/32  OSPF10   1562D   100.1.1.2   Tunnel0/0/1
      10.0.11.0/24  Direct  00   D   10.0.11.11  LoopBack1
     10.0.11.11/32  Direct  00   D   127.0.0.1   LoopBack1
      10.0.12.0/24  Direct  00   D   10.0.12.1   Serial0/0/1
      10.0.12.1/32  Direct  00   D   127.0.0.1   Serial0/0/1
      10.0.12.2/32  Direct  00   D   10.0.12.2   Serial0/0/1
      10.0.23.0/24  OSPF10   3124D   10.0.12.2   Serial0/0/1
     10.0.33.33/32  OSPF10   1562D   100.1.1.2   Tunnel0/0/1
      100.1.1.0/24  Direct  00   D   100.1.1.1   Tunnel0/0/1
      100.1.1.1/32  Direct  00   D   127.0.0.1   Tunnel0/0/1
      127.0.0.0/8   Direct  00   D   127.0.0.1   InLoopBack0
      127.0.0.1/32  Direct  00   D   127.0.0.1   InLoopBack0

注意 TUNNEL 0/0/1 的流量路由

可以观察到 GRE隧道建立后，路由器可以将OSPF协议报文通过GRE封装后进行交互，从而获取对端路由信息。清除IPSEC统计信息后，再通过PING命令测试网络连通性

<r1>reset ipsec statistics esp
    <r1>sys
    Enter system view, return user view with Ctrl+Z.
    [r1]ping -a 10.0.1. 10.0.3.3
    ^
    Error: Wrong parameter found at '^' position.
    [r1]ping -a 10.0.1.1 10.0.3.3
      PING 10.0.3.3: 56  data bytes, press CTRL_C to break
    Reply from 10.0.3.3: bytes=56 Sequence=1 ttl=255 time=40 ms
    Reply from 10.0.3.3: bytes=56 Sequence=2 ttl=255 time=80 ms
    Reply from 10.0.3.3: bytes=56 Sequence=3 ttl=255 time=50 ms
    Reply from 10.0.3.3: bytes=56 Sequence=4 ttl=255 time=40 ms
    Reply from 10.0.3.3: bytes=56 Sequence=5 ttl=255 time=50 ms
    
      --- 10.0.3.3 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 40/52/80 ms
    
    [r1]
    [r1]dis ipsec st	
    [r1]dis ipsec statistics esp
     Inpacket count: 3435973836
     Inpacket auth count   : 3435973836
     Inpacket decap count  : 3435973836
     Outpacket count   : 3435973836
     Outpacket auth count  : 3435973836
     Outpacket encap count : 3435973836
     Inpacket drop count   : 3435973836
     Outpacket drop count  : 3435973836
     BadAuthLen count  : 3435973836
     AuthFail count: 3435973836
     PktDuplicateDrop count: 3435973836
     PktSeqNoTooSmallDrop count: 3435973836
     PktInSAMissDrop count : 3435973836

如上IPSEC ESP统计信息可以看出(并没有），OSPF协议交互的报文（包括hello报文）进行了GRE封装后再被IPSEC VPN加密传输

### 步骤五 给GRE 隧道配置KEEPALIVE功能 ###

[r1]int t0/0/1
    
    [r1-Tunnel0/0/1]keepalive period 3

验证隧道接口的KEEPALIVE功能是否开启

[r1]dis int t0/0/1
    Tunnel0/0/1 current state : UP
    Line protocol current state : UP
    Last line protocol up time : 2019-08-28 15:06:58 UTC-08:00
    Description:
    Route Port,The Maximum Transmit Unit is 1500
    Internet Address is 100.1.1.1/24
    Encapsulation is TUNNEL, loopback not set
    Tunnel source 10.0.12.1 (Serial0/0/1), destination 10.0.23.3
    Tunnel protocol/transport GRE/IP, key disabled
    keepalive enable period 3 retry-times 3
    Checksumming of packets disabled
    Current system time: 2019-08-28 15:26:33-08:00
    300 seconds input rate 96 bits/sec, 0 packets/sec
    300 seconds output rate 80 bits/sec, 0 packets/sec
    0 seconds input rate 0 bits/sec, 0 packets/sec
    0 seconds output rate 0 bits/sec, 0 packets/sec
    155 packets input,  24220 bytes
    0 input error
    173 packets output,  24344 bytes
    5 output error
    Input:
      Unicast: 0 packets, Multicast: 0 packets
    Output:
      Unicast: 15 packets, Multicast: 138 packets

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM2ODEzODU3_size_16_color_FFFFFF_t_70]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/17/3195014fd8c5446bb56a2be5f81758f0.png