江浙沪招生考试网

实验任务一：GRE VPN基本配置

步骤一：搭建实验环境

在SWA上配置VLAN2，将接口E1/0/2加入VLAN2：

[SWA]vlan 2

[SWA-vlan2]port Ethernet 1/0/2

步骤二：检测公网连通性

查看SWA的路由表和端口状态，确认其工作正常。

[SWA]display ip interface brief

*down: administratively down

(s): spoofing

Interface                     Physical Protocol IP Address      Description

Vlan-interface1               up       up       1.1.1.2         Vlan-inte...

Vlan-interface2               up       up       2.2.2.2         Vlan-inte...

 

[SWA]display ip routing-table

Routing Tables: Public

        Destinations : 6        Routes : 6

 

Destination/Mask    Proto  Pre  Cost         NextHop         Interface

 

1.1.1.0/24          Direct 0    0            1.1.1.2         Vlan1

1.1.1.2/32          Direct 0    0            127.0.0.1       InLoop0

2.2.2.0/24          Direct 0    0            2.2.2.2         Vlan2

2.2.2.2/32          Direct 0    0            127.0.0.1       InLoop0

127.0.0.0/8         Direct 0    0            127.0.0.1       InLoop0

127.0.0.1/32        Direct 0    0            127.0.0.1       InLoop0

也可以使用display interface命令。

在RTA和RTB上配置公网接口互通所需的静态路由。

[RTA]interface GigabitEthernet0/0

[RTA-GigabitEthernet0/0]ip address 192.168.1.1 255.255.255.0

[RTA-GigabitEthernet0/0]interface GigabitEthernet0/1

[RTA-GigabitEthernet0/1]ip address 1.1.1.1 255.255.255.0

[RTA-GigabitEthernet0/1]ip route-static 2.2.2.0 255.255.255.0 1.1.1.2

 

[RTB]interface GigabitEthernet0/0

[RTB-GigabitEthernet0/0]ip address 192.168.2.1 255.255.255.0

[RTB-GigabitEthernet0/0]interface GigabitEthernet0/1

[RTB-GigabitEthernet0/1]ip address 2.2.2.1 255.255.255.0

[RTB-GigabitEthernet0/1]ip route-static 1.1.1.0 255.255.255.0 2.2.2.2

步骤三：配置GRE隧道接口

[RTA] interface Tunnel0

[RTA-Tunnel0] ip address 192.168.3.1 255.255.255.252

[RTA-Tunnel0] source 1.1.1.1

[RTA-Tunnel0] destination 2.2.2.1

 

[RTB] interface Tunnel0

[RTB-Tunnel0] ip address 192.168.3.2 255.255.255.252

[RTB-Tunnel0] source 2.2.2.1

[RTB-Tunnel0] destination 1.1.1.1

步骤四：为私网配置静态路由

[RTA] ip route-static 192.168.2.0 255.255.255.0 Tunnel0

 

[RTB] ip route-static 192.168.1.0 255.255.255.0 Tunnel0

 

配置时也可以用下一跳地址。

步骤五：检验隧道工作状况

查看RTA与RTB的路由表，可见公网、私网路由均存在于路由表中：

[RTB]display ip routing-table

Routing Tables: Public

        Destinations : 10       Routes : 10

 

Destination/Mask    Proto  Pre  Cost         NextHop         Interface

 

1.1.1.0/24          Static 60   0            2.2.2.2         GE0/1

2.2.2.0/24          Direct 0    0            2.2.2.1         GE0/1

2.2.2.1/32          Direct 0    0            127.0.0.1       InLoop0

127.0.0.0/8         Direct 0    0            127.0.0.1       InLoop0

127.0.0.1/32        Direct 0    0            127.0.0.1       InLoop0

192.168.1.0/24      Static 60   0            192.168.3.2     Tun0

192.168.2.0/24      Direct 0    0            192.168.2.1     GE0/0

192.168.2.1/32      Direct 0    0            127.0.0.1       InLoop0

192.168.3.0/30      Direct 0    0            192.168.3.2     Tun0

192.168.3.2/32      Direct 0    0            127.0.0.1       InLoop0

查看RTA和RTB的隧道接口状态，可见其使用GRE封装，状态为UP：

[RTB]display interface Tunnel 0

Tunnel0 current state: UP

Line protocol current state: UP

Description: Tunnel0 Interface

The Maximum Transmit Unit is 1476

Internet Address is 192.168.3.2/30 Primary

Encapsulation is TUNNEL, service-loopback-group ID not set.

Tunnel source 2.2.2.1, destination 1.1.1.1

Tunnel keepalive disable

Tunnel protocol/transport GRE/IP

    GRE key disabled

    Checksumming of GRE packets disabled

Output queue : (Urgent queuing : Size/Length/Discards)  0/100/0

Output queue : (Protocol queuing : Size/Length/Discards)  0/500/0

Output queue : (FIFO queuing : Size/Length/Discards)  0/75/0

    Last 300 seconds input:  15 bytes/sec, 0 packets/sec

    Last 300 seconds output:  21 bytes/sec, 0 packets/sec

    133 packets input,  5701 bytes

    0 input error

    124 packets output,  7469 bytes

    0 output error

在RTA上打开GRE协议调试开关用debugging命令检验路由器实际收发的报文，说明其地址已经改变。

<RTA>terminal monitor

<RTA>terminal debugging

<RTA>debugging gre packet

在PCA上对RTB运行ping命令，但只发送一个ICMP包：

C:\Documents and Settings\User>ping -n 1 192.168.2.1

 

Pinging 192.168.2.1 with 32 bytes of data:

 

Reply from 192.168.2.1: bytes=32 time<1ms TTL=254

 

Ping statistics for 192.168.2.1:

    Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

    Minimum = 0ms, Maximum = 0ms, Average = 0ms

观察RTA上的输出信息：

<RTA>

*Jun 26 16:15:30:443 2009 RTA GRE/7/debug:

 Tunnel0 packet:After encapsulation,

     Outgoing packet header 1.1.1.1->2.2.2.1(length = 84)

*Jun 26 16:15:30:443 2009 RTA GRE/7/debug:Output: Gre packet has been fast-switc

hed successfully, interface index is 0x2f0000.

可见RTA从Tunnel0接口发出了一个包，源地址为1.1.1.1，目的地址为2.2.2.1。因为发送的包已经被GRE封装后在公网发送了。

步骤六：清除静态路由

用undo ip route-static命令。

步骤七：为公网配置动态路由

[RTA]ospf 1

[RTA-ospf-1]area 0.0.0.0

[RTA-ospf-1-area-0.0.0.0]network 1.0.0.0 0.255.255.255

 

[RTB]ospf 1

[RTB-ospf-1]area 0.0.0.0

[RTB-ospf-1-area-0.0.0.0]network 2.0.0.0 0.255.255.255

 

[SWA]ospf 1

[SWA-ospf-1]area 0.0.0.0

[SWA-ospf-1-area-0.0.0.0]network 1.0.0.0 0.255.255.255

[SWA-ospf-1-area-0.0.0.0]network 2.0.0.0 0.255.255.255

步骤八：为私网配置动态路由

[RTA]rip 1

[RTA-rip-1]version 2

[RTA-rip-1]network 192.168.1.0

[RTA-rip-1]network 192.168.3.0

 

[RTB]rip

[RTB-rip-1]version 2

[RTB-rip-1]network 192.168.2.0

[RTB-rip-1]network 192.168.3.0

步骤九：再次检验隧道工作状况

查看RTA与RTB的路由表：

<RTB>display ip routing-table

Routing Tables: Public

        Destinations : 10       Routes : 10

 

Destination/Mask    Proto  Pre  Cost         NextHop         Interface

 

1.1.1.0/24          OSPF   10   2            2.2.2.2         GE0/1

2.2.2.0/24          Direct 0    0            2.2.2.1         GE0/1

2.2.2.1/32          Direct 0    0            127.0.0.1       InLoop0

127.0.0.0/8         Direct 0    0            127.0.0.1       InLoop0

127.0.0.1/32        Direct 0    0            127.0.0.1       InLoop0

192.168.1.0/24      RIP    100  1            192.168.3.1     Tun0

192.168.2.0/24      Direct 0    0            192.168.2.1     GE0/0

192.168.2.1/32      Direct 0    0            127.0.0.1       InLoop0

192.168.3.0/30      Direct 0    0            192.168.3.2     Tun0

192.168.3.2/32      Direct 0    0            127.0.0.1       InLoop0

转入下一实验任务。

实验任务二：GRE VPN隧道验证

步骤一：单方配置隧道验证

首先在RTA上单方启动隧道验证：

[RTA-Tunnel0]gre key 1234

步骤二：检验隧道连通性

用ping命令验证PCA与PCB之间的连通性。由于仅单方配置了隧道验证，此时应该无法连通。

C:\Documents and Settings\User>ping 192.168.2.1

 

Pinging 192.168.2.1 with 32 bytes of data:

 

Request timed out.

Request timed out.

Request timed out.

Request timed out.

 

Ping statistics for 192.168.2.1:

    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

步骤三：配置错误的隧道验证

在RTB上也启动隧道验证，但验证值配置与RTA不同：

[RTB-Tunnel0]gre key 12345

步骤四：检验隧道连通性

用ping命令验证PCA与PCB之间的连通性。由于配置的隧道验证值错误，此时应该无法连通。

C:\Documents and Settings\User>ping 192.168.2.1

 

Pinging 192.168.2.1 with 32 bytes of data:

 

Request timed out.

Request timed out.

Request timed out.

Request timed out.

 

Ping statistics for 192.168.2.1:

    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

步骤五：正确配置隧道验证

在RTB上配置与RTA相同的验证值：

[RTB-Tunnel0]gre key 1234

步骤六：检验隧道连通性

用ping命令验证PCA与PCB之间的连通性。由于配置的隧道验证正确，此时应该可以连通。

C:\Documents and Settings\User>ping 192.168.2.1

 

Pinging 192.168.2.1 with 32 bytes of data:

 

Reply from 192.168.2.1: bytes=32 time=1ms TTL=254

Reply from 192.168.2.1: bytes=32 time<1ms TTL=254

Reply from 192.168.2.1: bytes=32 time<1ms TTL=254

Reply from 192.168.2.1: bytes=32 time<1ms TTL=254

 

Ping statistics for 192.168.2.1:

    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

    Minimum = 0ms, Maximum = 1ms, Average = 0ms

实验任务三：GRE VPN隧道Keepalive

步骤一：恢复静态路由配置

 [RTA]undo rip

Warning : Undo RIP process? [Y/N]:y

[RTA]undo ospf

Warning : Undo OSPF process? [Y/N]:y

[RTA]ip route-static 192.168.2.0 255.255.255.0 Tunnel0

[RTA]ip route-static 2.2.2.0 255.255.255.0 1.1.1.2

 

[RTB]undo rip

Warning : Undo RIP process? [Y/N]:y

[RTB]undo ospf

Warning : Undo OSPF process? [Y/N]:y

[RTB]ip route-static 192.168.1.0 255.255.255.0 Tunnel0

[RTB]ip route-static 1.1.1.0 255.255.255.0 2.2.2.2

步骤二：模拟网络故障

 [SWA-Vlan-interface2]shutdown

步骤三：检查RTA上的隧道接口状态

在RTA上检查隧道接口状态，发现隧道接口状态仍然正常：

[RTA]display interface Tunnel 0

Tunnel0 current state: UP

Line protocol current state: UP

Description: Tunnel0 Interface

The Maximum Transmit Unit is 1472

Internet Address is 192.168.3.1/30 Primary

Encapsulation is TUNNEL, service-loopback-group ID not set.

Tunnel source 1.1.1.1, destination 2.2.2.1

Tunnel keepalive disable

Tunnel protocol/transport GRE/IP

    GRE key value is 1234

    Checksumming of GRE packets disabled

Output queue : (Urgent queuing : Size/Length/Discards)  0/100/0

Output queue : (Protocol queuing : Size/Length/Discards)  0/500/0

Output queue : (FIFO queuing : Size/Length/Discards)  0/75/0

    Last 300 seconds input:  0 bytes/sec, 0 packets/sec

    Last 300 seconds output:  0 bytes/sec, 0 packets/sec

    1016 packets input,  100223 bytes

    10 input error

    981 packets output,  41128 bytes

    0 output error

这说明其无法了解对端变化情况。这是因为在RTA上，隧道源地址所属接口正常，隧道目的地址所需的路由仍然存在。

步骤四：恢复网络故障

[SWA-Vlan-interface2]undo shutdown

步骤五：配置隧道Keepalive

[RTA]interface Tunnel 0

[RTA-Tunnel0]keepalive

 

[RTB]interface Tunnel 0

[RTB-Tunnel0]keepalive

步骤六：模拟网络故障

在RTA上启动debugging开关：

<RTA>terminal monitor

<RTA>terminal debugging

<RTA>debugging gre all

<RTA>debugging tunnel all

关闭SWA的VLAN2接口，模拟公网路由突然发生故障。

[SWA-Vlan-interface2]shutdown

步骤七：观察效果，检验隧道连通性

在RTA上观察debugging信息。输出信息形如：

<RTA>

*Jun 26 17:31:54:794 2009 RTA TUNNEL/7/debug:

Tunnel0 link state is UP, no change.

*Jun 26 17:31:55:508 2009 RTA TUNNEL/7/debug:

 Before encapsulation, the packet's ulLoopTimes is 0.

......

......

*Jun 26 17:32:55:968 2009 RTA TUNNEL/7/debug:

 Before encapsulation, the packet's ulLoopTimes is 0.

*Jun 26 17:33:00:293 2009 RTA TUNNEL/7/debug:

Tunnel0 link state is UP, no change.

*Jun 26 17:33:05:332 2009 RTA TUNNEL/7/debug:

Tunnel0 link state is UP, no change.

*Jun 26 17:33:06:45 2009 RTA TUNNEL/7/debug:

 Before encapsulation, the packet's ulLoopTimes is 0.

*Jun 26 17:33:10:369 2009 RTA TUNNEL/7/debug:

Tunnel0 link state is UP, no change.

*Jun 26 17:33:15:408 2009 RTA TUNNEL/7/debug:

Tunnel0 link state is UP, no change.

%Jun 26 17:33:16:168 2009 RTA TUNNEL/4/LINK UPDOWN:

 Tunnel0: link status is DOWN

%Jun 26 17:33:16:168 2009 RTA IFNET/4/UPDOWN:

 Line protocol on the interface Tunnel0 is DOWN

*Jun 26 17:33:16:168 2009 RTA TUNNEL/7/debug:

Tunnel0 down, because keepalive is not reached.

*Jun 26 17:33:16:169 2009 RTA TUNNEL/7/debug:

Can not get tunnel ID when tunnel(index = 0x2f0000) state is down.

*Jun 26 17:33:16:169 2009 RTA TUNNEL/7/debug:

Tunnel_DelTunnInUpTunnTbl: The tunnel(0x2f0000) state is down.

*Jun 26 17:33:16:169 2009 RTA TUNNEL/7/debug:

 Before encapsulation, the packet's ulLoopTimes is 0.

*Jun 26 17:33:20:451 2009 RTA TUNNEL/7/debug:

Tunnel0 down, because keepalive is not reached.

*Jun 26 17:33:20:451 2009 RTA TUNNEL/7/debug:

Tunnel0 link state is DOWN, no change.

*Jun 26 17:33:25:490 2009 RTA TUNNEL/7/debug:

Tunnel0 down, because keepalive is not reached.

*Jun 26 17:33:25:490 2009 RTA TUNNEL/7/debug:

Tunnel0 link state is DOWN, no change.

*Jun 26 17:33:26:203 2009 RTA TUNNEL/7/debug:

可见经过一段时间后，Tunnel0接口状态变为DOWN，根据debugging信息，原因是keepalive消息丢失。

关闭debugging开关，查看Tunnel0接口信息：

<RTA>undo debugging all

All possible debugging has been turned off

<RTA>display interface tunnel 0

Tunnel0 current state: DOWN

Line protocol current state: DOWN

Description: Tunnel0 Interface

The Maximum Transmit Unit is 1472

Internet Address is 192.168.3.1/30 Primary

Encapsulation is TUNNEL, service-loopback-group ID not set.

Tunnel source 1.1.1.1, destination 2.2.2.1

Tunnel keepalive enable, Period(10 s), Retries(3)

Tunnel protocol/transport GRE/IP

    GRE key value is 1234

    Checksumming of GRE packets disabled

Output queue : (Urgent queuing : Size/Length/Discards)  0/100/0

Output queue : (Protocol queuing : Size/Length/Discards)  0/500/0

Output queue : (FIFO queuing : Size/Length/Discards)  0/75/0

    Last 300 seconds input:  2 bytes/sec, 0 packets/sec

    Last 300 seconds output:  2 bytes/sec, 0 packets/sec

    1115 packets input,  101679 bytes

    10 input error

    1084 packets output,  44012 bytes

    0 output error

可见Tunnel0接口状态确实已经变为DOWN。

在SWA上重新打开VLAN2接口，过一段时间之后， Tunnel0接口状态以及PCA与PCB之间的连通性可以恢复正常。