MSR路由器策略路由配置

2018-11-27

  场景:MSR路由器双WAN口上网,一个接口采用静态地址,一个接口采用PPPoE拨号上网。两个接口的带宽相近,实现内网192.168.1.0网段IP最后为奇数的主机上网走一个WAN口,IP最后为偶数的主机上网走另一个WAN口。

  1. 定义访问控制列表,用来匹配内网数据报文

  system-view

  System View: return to User View with Ctrl+Z.

  [H3C]acl number 3000 //Comware V7平台路由器命令为acl advanced 3000,下同

  [H3C-acl-adv-3000]rule 0 permit ip source 192.168.1.1 0.0.0.254 //匹配IP地址最后一位为奇数的IP地址

  [H3C-acl-adv-3000]quit

  [H3C]acl number 3001

  [H3C-acl-adv-3001]rule 0 permit ip source 192.168.1.0 0.0.0.254 //匹配IP地址最后一位为偶数的IP地址

  [H3C-acl-adv-3001]quit

  2. 创建策略路由aaa,节点1

  [H3C]policy-based-route aaa permit node 1

  [H3C-pbr-aaa-1]if-match acl 3000

  [H3C-pbr-aaa-1]apply output-interface dialer 10 //如果要指定的出口是PPPoE拨号的,这里需要指定出接口为Dialer口

  3. 创建策略路由aaa,节点2

  [H3C]policy-based-route aaa permit node 2

  [H3C-pbr-aaa-2]if-match acl 3001

  [H3C-pbr-aaa-2] apply ip-address next-hop 100.0.0.2 //如果要指定的出口是静态地址的,这里指定下一跳地址

  4. 在内网口应用策略路由

  [H3C]interface Vlan-interface 1

  [H3C-Vlan-interface1]ip policy-based-route aaa

  [H3C-Vlan-interface1]quit

  魔力百聚配置:

  说明:新建了两个VLAN 10、20,vlan10走联通线路,vlan20走电信线路。

  配置:

  #

  version 5.20, Release 2514P14

  #

  sysname H3C

  #

  domain default enable system

  #

  dns proxy enable

  #

  telnet server enable

  #

  dar p2p signature-file flash:/p2p_default.mtd

  #

  ndp enable

  #

  ntdp enable

  #

  cluster enable

  #

  port-security enable

  #

  password-recovery enable

  #

  acl number 3010

  rule 0 permit ip source 172.16.10.0 0.0.0.255

  acl number 3020

  rule 0 permit ip source 172.16.20.0 0.0.0.255

  acl number 3970

  rule 0 permit ip source 0.0.0.1 172.16.10.254

  #

  vlan 1

  #

  vlan 10

  #

  vlan 20

  #

  domain system

  access-limit disable

  state active

  idle-cut disable

  self-service-url disable

  #

  traffic classifier AdvWeb3970 operator and

  if-match acl 3970

  #

  traffic behavior AdvWeb3970

  queue af bandwidth 10240

  #

  qos policy PolicyLimit-1048576

  classifier AdvWeb3970 behavior AdvWeb3970

  #

  dhcp server ip-pool vlan1 extended

  network ip range 172.16.1.1 172.16.1.254

  network mask 255.255.255.0

  gateway-list 172.16.1.1

  dns-list 172.16.1.1

  #

  dhcp server ip-pool vlan10 extended

  network ip range 172.16.10.1 172.16.10.254

  network mask 255.255.255.0

  gateway-list 172.16.10.1

  dns-list 172.16.10.1

  #

  dhcp server ip-pool vlan20 extended

  network ip range 172.16.20.50 172.16.20.254

  network mask 255.255.255.0

  gateway-list 172.16.20.1

  dns-list 172.16.20.1

  #

  policy-based-route dianxin permit node 0

  if-match acl 3020

  apply output-interface Dialer10

  #

  policy-based-route liantong permit node 1

  if-match acl 3010

  apply ip-address next-hop 101.207.125.1

  #

  user-group system

  group-attribute allow-guest

  #

  local-user admin

  password cipher $c$3$40gC1cxf/wIJNa1ufFPJsjKAof+QP5aV

  authorization-attribute level 3

  service-type telnet

  service-type web

  #

  cwmp

  undo cwmp enable

  #

  interface Aux0

  async mode flow

  link-protocol ppp

  #

  interface Cellular0/0

  async mode protocol

  link-protocol ppp

  tcp mss 1024

  #

  interface Dialer10

  nat outbound

  link-protocol ppp

  ppp chap user CD0283360438579

  ppp chap password cipher $c$3$CVlByK1jzIUy9CYQEhAeXHXwmG1tsYhK1jIl

  ppp pap local-user CD0283360438579 password cipher $c$3$g+hpGg+/PR8lh5+OVPOcc8wvo1zCaRRcn+JC

  ppp ipcp dns admit-any

  ppp ipcp dns request

  mtu 1492

  ip address ppp-negotiate

  tcp mss 1024

  dialer user username

  dialer-group 10

  dialer bundle 10

  #

  interface NULL0

  #

  interface Vlan-interface1

  ip address 172.16.1.1 255.255.255.0

  tcp mss 1024

  dhcp server apply ip-pool vlan1

  #

  interface Vlan-interface10

  ip address 172.16.10.1 255.255.255.0

  dhcp server apply ip-pool vlan10

  ip policy-based-route liantong

  #

  interface Vlan-interface20

  ip address 172.16.20.1 255.255.255.0

  dhcp server apply ip-pool vlan20

  ip policy-based-route dianxin

  #

  interface GigabitEthernet0/0

  port link-mode route

  nat outbound

  ip address 101.207.125.82 255.255.255.0

  tcp mss 1024

  qos apply policy PolicyLimit-1048576 outbound

  dns server 208.67.222.222

  dns server 208.67.222.220

  #

  interface GigabitEthernet0/1

  port link-mode route

  nat outbound

  pppoe-client dial-bundle-number 10

  #

  interface GigabitEthernet0/2

  port link-mode bridge

  port access vlan 10

  #

  interface GigabitEthernet0/3

  port link-mode bridge

  port access vlan 20

  #

  interface GigabitEthernet0/4

  port link-mode bridge

  port access vlan 20

  #

  interface GigabitEthernet0/5

  port link-mode bridge

  #

  interface GigabitEthernet0/6

  port link-mode bridge

  port access vlan 20

  #

  interface GigabitEthernet0/7

  port link-mode bridge

  port access vlan 20

  #

  interface GigabitEthernet0/8

  port link-mode bridge

  #

  interface GigabitEthernet0/9

  port link-mode bridge

  port access vlan 20

  #

  ip route-static 0.0.0.0 0.0.0.0 Dialer10

  ip route-static 0.0.0.0 0.0.0.0 GigabitEthernet0/0 101.207.125.1

  #

  dhcp enable

  #

  dialer-rule 10 ip permit

  #

  nms primary monitor-interface GigabitEthernet0/0

  #

  load xml-configuration

  #

  load tr069-configuration

  #

  user-interface tty 12

  user-interface aux 0

  user-interface vty 0 4

  authentication-mode scheme

  #

  return


分享到

CHINA'S LEADING IT SERVICE BRANDS

中国领先IT服务品牌企业

销售热线:400-017-5181
故障处理:400-617-5181
同创双子(北京)信息技术股份有限公司(英文简称“Gemini”)是一家IT服务公司。2016年新三板正式挂牌上市(股票代码:837868)。 联系我们 法律声明

微信客服

IT外包就扫我

Copyright© 同创双子(北京)信息技术股份有限公司 , 京ICP备16037308

网站地图

法律声明

未经本公司书面许可,任何单位及个人不得以任何方式或理由对上述产品、服务、信息、材料的任何部分进行使用、复制、修改、抄录、传播或与其它产品捆绑使用、销售。
凡侵犯本公司版权等知识产权的,本公司必依法追究其法律责任。
本公司法律事务部受本公司指示,特此郑重法律声明!