2 双出口链路备份典型配置
双出口进行主备备份在一般出现在到一个ISP有两条链路,一条带宽比较宽,一条带宽比较低的情况下。下面就两种常见的组网给出配置实例。
2.1 两条链路都是以太网链路的情况
网络拓扑图如图3所示,AR18-22-24有两条到ISP的链路,E1/0为主用链路,网络地址为142.1.1.0/30,E2/0为备用链路,网络地址为162.1.1.0/30。正常工作时所有的流量通过主用链路E1/0发送,当主用链路出现异常时设备会自动切换到备用链路,主用链路恢复后会自动重新启用。
[Quidway]display current-configuration
#
sysname Quidway
#
clock summer-time BJ repeating 00:00:00 06/01/2000 23:59:59 08/31/2000 01:00:00
#
clock timezone Peking add 08:00:00
#
FTP server enable
#
firewall enable
#
flow-interval 5
#
web set-package force flash:/http.zip
#
radius scheme system
#
domain system
#
local-user admin
password cipher .]@USE=B,53Q=^Q`MAF4<1!!
service-type telnet terminal
level 3
service-type ftp
# # 配置自动侦测组1,侦测主用链路的对端地址是否可达,侦测间隔为5s。 detect-group 1
detect-list 1 ip address 142.1.1.1
timer loop 5
# # 配置接口应用NAT时引用的ACL。 acl number 2001
rule 10 permit source 192.168.1.0 0.0.0.255
# # 配置在接口上应用的过滤规则,主要用于攻击防范,强烈建议配置。 acl number 3001
rule 10 deny tcp destination-port eq 445
rule 11 deny udp destination-port eq 445
rule 20 deny tcp destination-port eq 135
rule 21 deny udp destination-port eq 135
rule 30 deny tcp destination-port eq 137
rule 31 deny udp destination-port eq netbios-ns
rule 40 deny tcp destination-port eq 138
rule 41 deny udp destination-port eq netbios-dgm
rule 50 deny tcp destination-port eq 139
rule 51 deny udp destination-port eq netbios-ssn
rule 61 deny udp destination-port eq tftp
rule 70 deny tcp destination-port eq 593
rule 80 deny tcp destination-port eq 4444
rule 90 deny tcp destination-port eq 707
rule 100 deny tcp destination-port eq 1433
rule 101 deny udp destination-port eq 1433
rule 110 deny tcp destination-port eq 1434
rule 111 deny udp destination-port eq 1434
rule 120 deny tcp destination-port eq 5554
rule 130 deny tcp destination-port eq 9996
rule 141 deny udp source-port eq bootps
rule 160 permit icmp icmp-type echo
rule 161 permit icmp icmp-type echo-reply
rule 162 permit icmp icmp-type ttl-exceeded
rule 165 deny icmp
rule 2002 permit ip destination 142.1.1.2 0
rule 3000 deny ip
acl number 3002
rule 10 deny tcp destination-port eq 445
rule 11 deny udp destination-port eq 445
rule 20 deny tcp destination-port eq 135
rule 21 deny udp destination-port eq 135
rule 30 deny tcp destination-port eq 137
rule 31 deny udp destination-port eq netbios-ns
rule 40 deny tcp destination-port eq 138
rule 41 deny udp destination-port eq netbios-dgm
rule 50 deny tcp destination-port eq 139
rule 51 deny udp destination-port eq netbios-ssn
rule 61 deny udp destination-port eq tftp
rule 70 deny tcp destination-port eq 593
rule 80 deny tcp destination-port eq 4444
rule 90 deny tcp destination-port eq 707
rule 100 deny tcp destination-port eq 1433
rule 101 deny udp destination-port eq 1433
rule 110 deny tcp destination-port eq 1434
rule 111 deny udp destination-port eq 1434
rule 120 deny tcp destination-port eq 5554
rule 130 deny tcp destination-port eq 9996
rule 141 deny udp source-port eq bootps
rule 160 permit icmp icmp-type echo
rule 161 permit icmp icmp-type echo-reply
rule 162 permit icmp icmp-type ttl-exceeded
rule 165 deny icmp
rule 2002 permit ip destination 162.1.1.2 0
rule 3000 deny ip
acl number 3003
rule 10 deny tcp destination-port eq 445
rule 11 deny udp destination-port eq 445
rule 20 deny tcp destination-port eq 135
rule 21 deny udp destination-port eq 135
rule 30 deny tcp destination-port eq 137
rule 31 deny udp destination-port eq netbios-ns
rule 40 deny tcp destination-port eq 138
rule 41 deny udp destination-port eq netbios-dgm
rule 50 deny tcp destination-port eq 139
rule 51 deny udp destination-port eq netbios-ssn
rule 61 deny udp destination-port eq tftp
rule 70 deny tcp destination-port eq 593
rule 80 deny tcp destination-port eq 4444
rule 90 deny tcp destination-port eq 707
rule 100 deny tcp destination-port eq 1433
rule 101 deny udp destination-port eq 1433
rule 110 deny tcp destination-port eq 1434
rule 111 deny udp destination-port eq 1434
rule 120 deny tcp destination-port eq 5554
rule 130 deny tcp destination-port eq 9996
rule 141 deny udp source-port eq bootps
rule 160 permit icmp icmp-type echo
rule 161 permit icmp icmp-type echo-reply
rule 162 permit icmp icmp-type ttl-exceeded
rule 165 deny icmp
rule 2010 deny ip source 192.168.1.1 0
rule 2030 permit ip source 192.168.1.0 0.0.0.255
rule 3000 deny ip
# # 配置广域网接口E1/0,对入报文进行过滤(所有出报文均需要做NAT时可以不对入报文进行过滤),对出报文进行NAT。 interface Ethernet1/0
ip address 142.1.1.2 255.255.255.252
firewall packet-filter 3001 inbound
nat outbound 2001
# # 配置广域网接口E2/0,做为主接口E1/0的备份,对入报文进行过滤(所有出报文均需要做NAT时可以不对入报文进行过滤),对出报文进行NAT。 interface Ethernet2/0
standby detect-group 1
ip address 162.1.1.2 255.255.255.252
firewall packet-filter 3002 inbound
nat outbound 2001
# # 配置局域网接口E3/0,对入报文进行过滤。 interface Ethernet3/0
ip address 192.168.1.1 255.255.255.0
firewall packet-filter 3003 inbound
#
interface Ethernet3/1
#
interface Ethernet3/2
#
interface Ethernet3/3
#
interface Ethernet3/4
#
interface Ethernet3/5
#
interface Ethernet3/6
#
interface Ethernet3/7
#
interface Ethernet3/8
#
interface Ethernet3/9
#
interface Ethernet3/10
#
interface Ethernet3/11
#
interface Ethernet3/12
#
interface Ethernet3/13
#
interface Ethernet3/14
#
interface Ethernet3/15
#
interface Ethernet3/16
#
interface Ethernet3/17
#
interface Ethernet3/18
#
interface Ethernet3/19
#
interface Ethernet3/20
#
interface Ethernet3/21
#
interface Ethernet3/22
#
interface Ethernet3/23
#
interface Ethernet3/24
#
interface NULL0
# # 配置缺省路由和黑洞路由。通过主接口的缺省路由和自动侦测组1相关联。当自动侦测组# 1可达时,备份接口down,主接口的缺省路由生效,当自动侦测组1不可达时,主接口# 的缺省路由失效,备份接口启用,备份接口的缺省路由生效。 ip route-static 0.0.0.0 0.0.0.0 162.1.1.1 preference 60
ip route-static 0.0.0.0 0.0.0.0 142.1.1.1 preference 60 detect-group 1
ip route-static 10.0.0.0 255.0.0.0 NULL 0 preference 60
ip route-static 169.254.0.0 255.255.0.0 NULL 0 preference 60
ip route-static 172.16.0.0 255.240.0.0 NULL 0 preference 60
ip route-static 192.168.0.0 255.255.0.0 NULL 0 preference 60
ip route-static 198.18.0.0 255.254.0.0 NULL 0 preference 60 #
user-interface con 0
user-interface vty 0 4
authentication-mode scheme
#
return
------------------------- 上面是华为AR路由的双出口配置,应该能解决你的问题~
|