交换路由CCIE之路――业务隔离实验2

1、实验 数据分流一实验拓扑二 实验需求：1生产业务流量走奇数设备，办公流量走偶数设备。2生产与办公流量必须相互隔离。三 实验分析要让流量隔离，那么先就必须把两个流量区分开来，这里通过团体属性完全可以做到。在OSPF重发布到BGP是设置团体值，然后在对方通过BGP重发布到OSPF时匹配团体值来区分路由。要做到分流，可以通过BGP属性中的MED或本地优先级达到。在OSPF发布进BGP时改MED使生产通过奇数设备发出来的较小，办公从偶数设备发出来的MED较小。然后在两个EBGP对接的设备中，奇数设备从EBGP学到的生产网段本地优先级改大（大于100），偶数设备从EBGP学到的办公网段本地优先级改大。四

2、实验验证按照上面的要求作如下配置SW3ip community-list 1 permit 11ip community-list 2 permit 12 /用于匹配团体值时的团体列表access-list 2 permit 10.4.12.1 /用于后面OSPF 发布进BGP时只允许这个网段出去，避免链路网段的发布access-list 3 permit 10.5.12.1route-map sw4-sw3 deny 10match tag 4 /用于双点双向重发布时将外部重发布过来的路由拒绝掉，从而不干扰自己的路由表!route-map sw4-sw3 permit 20 /这条必须有，不

3、然默认拒绝所有，将使得其学不到内部的任何OSPF路由!route-map bgp-ospf200 permit 10match community 2 /设置团体值，为对方匹配相应的团体set metric 200 /改MEDset tag 3 /打标记!route-map ospf200-bgp permit 10match ip address 3set metric 200set community 2!route-map bgp-ospf100 permit 10match community 1set metric 100set tag 3!route-map ospf100-bgp

4、 permit 10match ip address 2set metric 100set community 1SW4ip community-list 1 permit 11ip community-list 2 permit 12!access-list 2 permit 10.4.12.1access-list 3 permit 10.5.12.1route-map sw4-sw3 deny 10match tag 3!route-map sw4-sw3 permit 20!route-map bgp-ospf200 permit 10match community 2set metr

5、ic 100set tag 4!route-map ospf200-bgp permit 10match ip address 3set metric 100set community 2!route-map bgp-ospf100 permit 10match community 1set metric 200set tag 4!route-map ospf100-bgp permit 10match ip address 2set metric 200set community 1RT5access-list 1 permit 10.4.0.0 0.0.255.255route-map f

6、uckjiuge permit 10match ip address 1set local-preference 200!route-map fuckjiuge permit 20RT6access-list 1 permit 10.5.0.0 0.0.255.255route-map fuckjiuge permit 10match ip address 1set local-preference 200!route-map fuckjiuge permit 20RT7access-list 1 permit 10.4.0.0 0.0.255.255route-map fuckjiuge p

7、ermit 10match ip address 1set local-preference 200!route-map fuckjiuge permit 20RT8access-list 1 permit 10.5.0.0 0.0.255.255route-map fuckjiuge permit 10match ip address 1set local-preference 200!route-map fuckjiuge permit 20SW9ip community-list 1 permit 1ip community-list 2 permit 2!access-list 2 p

8、ermit 10.4.28.1access-list 3 permit 10.5.28.1route-map sw10-sw9 deny 10match tag 10!route-map sw10-sw9 permit 20!route-map bgp-ospf200 permit 10match community 2set metric 200set tag 9!route-map ospf200-bgp permit 10match ip address 3set metric 200set community 12!route-map bgp-ospf100 permit 10matc

9、h community 1set metric 100set tag 9!route-map ospf100-bgp permit 10match ip address 2set metric 100set community 11SW10ip community-list 1 permit 1ip community-list 2 permit 2!access-list 2 permit 10.4.28.1access-list 3 permit 10.5.28.1route-map sw9-sw10 deny 10match tag 9!route-map sw9-sw10 permit

10、 20!route-map bgp-ospf200 permit 10match community 2set metric 100set tag 10!route-map ospf200-bgp permit 10match ip address 3set metric 100set community 12!route-map bgp-ospf100 permit 10match community 1set metric 200set tag 10!route-map ospf100-bgp permit 10match ip address 2set metric 200set com

11、munity 11重发布时通过匹配这些映射表，得出最终结果sw1#show ip routeO E2 10.4.28.1/32 110/100 via 10.4.13.2, 00:20:59, FastEthernet1/1sw2#show ip routeO E2 10.5.28.1/32 110/100 via 10.5.24.2, 00:21:14, FastEthernet1/2sw11#show ip routeO E2 10.4.12.1/32 110/100 via 10.4.90.113, 00:33:32, FastEthernet1/1sw12#show ip routeO

12、 E2 10.5.12.1/32 110/100 via 10.5.100.121, 00:33:51, FastEthernet1/2实现生产网段只有到生产网段的路由，办公网段只有到办公网段的路由。数据流测试sw1#traceroute 10.4.28.1 sou 10.4.12.1Type escape sequence to abort.Tracing the route to 10.4.28.11 10.4.13.2 52 msec 140 msec 48 msec2 10.0.35.2 92 msec 308 msec 1064 msec3 10.0.57.2 1028 msec 4

13、76 msec 216 msec4 10.2.79.2 356 msec 284 msec 284 msec5 10.4.90.114 288 msec 260 msec *sw2#traceroute 10.5.28.1 sou 10.5.12.1Type escape sequence to abort.Tracing the route to 10.5.28.11 10.5.24.2 28 msec 92 msec 80 msec2 10.0.46.2 168 msec 272 msec 168 msec3 10.0.68.2 260 msec 236 msec 216 msec4 10

14、.2.80.102 740 msec 236 msec 288 msec5 10.5.100.122 260 msec * 404 msecsw11# traceroute 10.4.12.1 sou 10.4.28.1Type escape sequence to abort.Tracing the route to 10.4.12.11 10.4.90.113 40 msec 184 msec 80 msec2 10.2.79.1 68 msec 288 msec 68 msec3 10.0.57.1 200 msec 372 msec 416 msec4 10.0.35.1 180 msec 420 msec 504 msec5 10.4.13.1 296 msec * 468 msecsw12#traceroute 10.5.12.1 sou 10.5.28.1Type escape sequence to abort.Tracing the