总结:BGP和静态路由并存,达到故障自动倒换的目的。-创新互联
总体结论:
在上云的场景中,客户需要本地数据中心到云上VPC,出现网络故障时做到自动倒换,保证业务不中断。
在隆尧等地区,都构建了全面的区域性战略布局,加强发展的系统性、市场前瞻性、产品创新能力,以专注、极致的服务理念,为客户提供成都网站建设、成都做网站 网站设计制作定制网站建设,公司网站建设,企业网站建设,品牌网站设计,全网整合营销推广,成都外贸网站制作,隆尧网站建设费用合理。一、客户需求
1、客户有总厂、分厂、总厂是通过专线和VPN连接上云,分厂是通过专线先连接到总厂,分厂也有VPN连接上云。
2、客户要求,无论是总厂的专线故障,还是分厂的专线故障,都需要进行网络链路自动倒换,切换到VPN连接,从而保证业务快速恢复。
二、组网图:
说明:1、在总厂和分厂的路由器上,分别使用loopback口模拟客户总厂和分厂的网络。
2、AR5作为VPN网关,此处只配置了静态路由,IPSEC VPN的配置忽略。
三、配置思路与关键点
1、专线OK时,优选专线。
CE1设备要求:到达总厂、分厂的网段,可以从AR5(VPN网关)得到,也可以从AR2(总厂路由器)得到,为了优选从AR2得到,需要配置与AR2(总厂路由器)的BGP邻居的本地优先级更高。
#
bgp 65001
timer keepalive 20 hold 60
peer 10.0.0.2 as-number 65002
peer 20.0.0.2 as-number 65004
#
ipv4-family unicast
network 10.0.0.0 255.255.255.0
network 20.0.0.0 255.255.255.0
network 169.254.195.0 255.255.255.0
network 192.168.0.0 255.255.255.0
peer 10.0.0.2 enable
peer 10.0.0.2 preferred-value 10 peer 20.0.0.2 enable
#
对于总厂设备AR2,到达VPC网段也有两个路径,一个是从CE1通过BGP交互得到,一个是通过本地静态路由,下一跳是VPN网关AR5,为了确保专线的优先级更高,需要配置BGP的外部优先级比静态路由的外部优先级更高。不过,这里有两种方法达到此效果,见另外一篇博客。
总厂路由器关键配置:
#
bgp 65002
timer keepalive 20 hold 60
peer 10.0.0.1 as-number 65001
peer 40.0.0.2 as-number 65003
#
ipv4-family unicast
undo synchronization
preference 50 50 50 network 10.0.0.0 255.255.255.0
network 40.0.0.0 255.255.255.0
network 60.0.0.0 255.255.255.0
peer 10.0.0.1 enable
peer 40.0.0.2 enable
#
对于分厂设备而言,到达VPC网段也有与总厂相同的诉求,专线优先级高于VPN,所以,分厂路由器也有提高BGP优先级的相同配置。
分厂路由器配置:
#
bgp 65003
timer keepalive 20 hold 60
peer 40.0.0.1 as-number 65002
#
ipv4-family unicast
undo synchronization
preference 50 50 50 network 40.0.0.0 255.255.255.0
network 70.0.0.0 255.255.255.0
peer 40.0.0.1 enable
#
2、修改BGP心跳报文间隔为更短,以便尽早检测到网络故障。全部调整为20秒,也就是BGP邻居在1分钟后可以感知到网络故障。
配置见上面的BGP配置上的timer.
四、实测效果
1、专线OK时,流量优选专线。
云上VPC --- > 总厂:
AR4 (默认路由) ---> AR1 (默认路由) ---> CE1 (BGP路由) ---> AR2
云上VPC --- > 总厂(回程):
AR2(BGP路由) ---> CE1 (静态路由) ---> AR1 (直连路由) ---> AR4
云上VPC ---> 分厂:
AR4 (默认路由) ---> AR1 (默认路由) ---> CE1 (BGP路由) ---> AR2(BGP路由) ---> AR3
云上VPC ---> 分厂(回程):
AR3(BGP路由) ---> AR2(BGP路由) ---> CE1 (静态路由) ---> AR1 (直连路由) ---> AR4
2、总厂专线故障 (总厂AR2 shutdown GE0/0/0端口, 等待1分钟后)
云上VPC --- > 总厂:
AR4 (默认路由) ---> AR1 (默认路由) ---> CE1 (BGP路由) ---> AR5(静态路由)---> AR2
云上VPC --- > 总厂(回程):
AR2(静态路由) ---> AR5(BGP路由)---> CE1 (静态路由) ---> AR1 (直连路由) ---> AR4
云上VPC ---> 分厂:
AR4 (默认路由) ---> AR1 (默认路由) ---> CE1 (BGP路由) ---> AR5(静态路由)---> AR3
云上VPC ---> 分厂(回程):
AR3(静态路由) ---> AR5(BGP路由)---> CE1 (静态路由) ---> AR1 (直连路由) ---> AR4
总厂专线故障恢复后,可以看到流量正常回切走总厂专线。
实测效果,同“1、专线OK时,流量优选专线。”
3、分厂专线故障(分厂AR3 shutdown GE0/0/0端口, 等待1分钟后)
云上VPC --- > 总厂:
AR4 (默认路由) ---> AR1 (默认路由) ---> CE1 (BGP路由) ---> AR2
云上VPC --- > 总厂(回程):
AR2(BGP路由) ---> CE1 (静态路由) ---> AR1 (直连路由) ---> AR4
云上VPC ---> 分厂:
AR4 (默认路由) ---> AR1 (默认路由) ---> CE1 (BGP路由) ---> AR5(静态路由)---> AR3
云上VPC ---> 分厂(回程):
AR3(静态路由) ---> AR5(BGP路由)---> CE1 (静态路由) ---> AR1 (直连路由) ---> AR4
分厂专线故障恢复后,可以看到流量正常回切走分厂专线。
实测效果,同“1、专线OK时,流量优选专线。”
五、所有设备的配置
云上VPC
AR4配置
[V200R003C00]
#
snmp-agent local-engineid 800007DB03000000000000
snmp-agent
#
clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load portalpage.zip
#
drop illegal-mac alarm
#
set cpu-usage threshold 80 restore 75
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
local-user admin service-type http
#
firewall zone Local
priority 15
#
interface GigabitEthernet0/0/0
ip address 192.168.0.1 255.255.255.0
#
interface GigabitEthernet0/0/1
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
ip route-static 0.0.0.0 0.0.0.0 192.168.0.2
#
user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return
AR1配置
[V200R003C00]
#
snmp-agent local-engineid 800007DB03000000000000
snmp-agent
#
clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
drop illegal-mac alarm
#
wlan ac-global carrier id other ac id 0
#
set cpu-usage threshold 80 restore 75
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
local-user admin service-type http
#
firewall zone Local
priority 15
#
interface GigabitEthernet0/0/0
ip address 192.168.0.2 255.255.255.0
#
interface GigabitEthernet0/0/1
#
interface GigabitEthernet0/0/2
ip address 169.254.195.201 255.255.255.0
#
interface NULL0
#
ip route-static 0.0.0.0 0.0.0.0 169.254.195.1
#
user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return
专线网关CE1交换机
!CfgFileCrc:1b29a473
!Software Version V800R013C00SPC560B560
!Last configuration was updated at 2018-05-06 11:32:22 UTC
!Last configuration was saved at 2018-05-06 11:41:11 UTC
!MKHash 0000000000000000
#
sysname HUAWEI
#
device board 1 board-type CE-MPUB
#
aaa
#
authentication-scheme default
#
authorization-scheme default
#
accounting-scheme default
#
domain default
#
domain default_admin
#
interface MEth0/0/0
undo shutdown
#
interface GE1/0/0
undo portswitch
undo shutdown
ip address 20.0.0.1 255.255.255.0
#
interface GE1/0/1
shutdown
#
interface GE1/0/2
undo portswitch
undo shutdown
ip address 169.254.195.1 255.255.255.0
#
interface GE1/0/3
undo portswitch
undo shutdown
ip address 10.0.0.1 255.255.255.0
#
interface GE1/0/4
shutdown
#
interface GE1/0/5
shutdown
#
interface GE1/0/6
shutdown
#
interface GE1/0/7
shutdown
#
interface GE1/0/8
shutdown
#
interface GE1/0/9
shutdown
#
interface GE1/0/10
shutdown
#
interface GE1/0/11
shutdown
#
interface GE1/0/12
shutdown
#
interface GE1/0/13
shutdown
#
interface GE1/0/14
shutdown
#
interface GE1/0/15
shutdown
#
interface GE1/0/16
shutdown
#
interface GE1/0/17
shutdown
#
interface GE1/0/18
shutdown
#
interface GE1/0/19
shutdown
#
interface GE1/0/20
shutdown
#
interface GE1/0/21
shutdown
#
interface GE1/0/22
shutdown
#
interface GE1/0/23
shutdown
#
interface GE1/0/24
shutdown
#
interface GE1/0/25
shutdown
#
interface GE1/0/26
shutdown
#
interface GE1/0/27
shutdown
#
interface GE1/0/28
shutdown
#
interface GE1/0/29
shutdown
#
interface GE1/0/30
shutdown
#
interface GE1/0/31
shutdown
#
interface GE1/0/32
shutdown
#
interface GE1/0/33
shutdown
#
interface GE1/0/34
shutdown
#
interface GE1/0/35
shutdown
#
interface GE1/0/36
shutdown
#
interface GE1/0/37
shutdown
#
interface GE1/0/38
shutdown
#
interface GE1/0/39
shutdown
#
interface GE1/0/40
shutdown
#
interface GE1/0/41
shutdown
#
interface GE1/0/42
shutdown
#
interface GE1/0/43
shutdown
#
interface GE1/0/44
shutdown
#
interface GE1/0/45
shutdown
#
interface GE1/0/46
shutdown
#
interface GE1/0/47
shutdown
#
interface NULL0
#
bgp 65001
timer keepalive 20 hold 60
peer 10.0.0.2 as-number 65002
peer 20.0.0.2 as-number 65004
#
ipv4-family unicast
network 10.0.0.0 255.255.255.0
network 20.0.0.0 255.255.255.0
network 169.254.195.0 255.255.255.0
network 192.168.0.0 255.255.255.0
peer 10.0.0.2 enable
peer 10.0.0.2 preferred-value 10
peer 20.0.0.2 enable
#
ip route-static 192.168.0.0 255.255.255.0 169.254.195.201
#
ssh authorization-type default aaa
#
user-interface con 0
#
vm-manager
#
return
VPN网关AR5
[V200R003C00]
#
snmp-agent local-engineid 800007DB03000000000000
snmp-agent
#
clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load portalpage.zip
#
drop illegal-mac alarm
#
set cpu-usage threshold 80 restore 75
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
local-user admin service-type http
#
firewall zone Local
priority 15
#
interface GigabitEthernet0/0/0
ip address 20.0.0.2 255.255.255.0
#
interface GigabitEthernet0/0/1
ip address 30.0.0.2 255.255.255.0
#
interface GigabitEthernet0/0/2
ip address 50.0.0.2 255.255.255.0
#
interface NULL0
#
bgp 65004
peer 20.0.0.1 as-number 65001
#
ipv4-family unicast
undo synchronization
network 20.0.0.0 255.255.255.0
import-route static
peer 20.0.0.1 enable
#
ip route-static 60.0.0.0 255.255.255.0 30.0.0.1
ip route-static 70.0.0.0 255.255.255.0 50.0.0.1
#
user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return
总厂AR2配置
[V200R003C00]
#
snmp-agent local-engineid 800007DB03000000000000
snmp-agent
#
clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
drop illegal-mac alarm
#
wlan ac-global carrier id other ac id 0
#
set cpu-usage threshold 80 restore 75
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
local-user admin service-type http
#
firewall zone Local
priority 15
#
interface GigabitEthernet0/0/0
ip address 10.0.0.2 255.255.255.0
#
interface GigabitEthernet0/0/1
ip address 30.0.0.1 255.255.255.0
#
interface GigabitEthernet0/0/2
ip address 40.0.0.1 255.255.255.0
#
interface NULL0
#
interface LoopBack1
ip address 60.0.0.1 255.255.255.0
#
bgp 65002
timer keepalive 20 hold 60
peer 10.0.0.1 as-number 65001
peer 40.0.0.2 as-number 65003
#
ipv4-family unicast
undo synchronization
preference 50 50 50
network 10.0.0.0 255.255.255.0
network 40.0.0.0 255.255.255.0
network 60.0.0.0 255.255.255.0
peer 10.0.0.1 enable
peer 40.0.0.2 enable
#
ip route-static 192.168.0.0 255.255.255.0 30.0.0.2
#
user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return
分厂AR3配置
[V200R003C00]
#
sysname branch
#
snmp-agent local-engineid 800007DB03000000000000
snmp-agent
#
clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
drop illegal-mac alarm
#
wlan ac-global carrier id other ac id 0
#
set cpu-usage threshold 80 restore 75
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
local-user admin service-type http
#
firewall zone Local
priority 15
#
interface GigabitEthernet0/0/0
ip address 40.0.0.2 255.255.255.0
#
interface GigabitEthernet0/0/1
#
interface GigabitEthernet0/0/2
ip address 50.0.0.1 255.255.255.0
#
interface NULL0
#
interface LoopBack0
ip address 70.0.0.1 255.255.255.0
#
bgp 65003
timer keepalive 20 hold 60
peer 40.0.0.1 as-number 65002
#
ipv4-family unicast
undo synchronization
preference 50 50 50
network 40.0.0.0 255.255.255.0
network 70.0.0.0 255.255.255.0
peer 40.0.0.1 enable
#
ip route-static 192.168.0.0 255.255.255.0 50.0.0.2
#
user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return
分享文章:总结:BGP和静态路由并存,达到故障自动倒换的目的。-创新互联
当前路径:http://myzitong.com/article/jcsgi.html