北京wolf林ipv ccnp实验手册26icw

1、实验一：MPLS 配置实验环境：三台要求：在三台互通。器 Ethernet 接口相连，接口配置如图器相连的接口分别启用 MPLS,查看相应的结果，在启用前使其在 OSPF 下步骤一：接口配置连通性，启用 OSPFR1(config-if)#int e0/1协议R1(config-if)#ip add 10.1.1.1 255.255.255.0 R1(config-if)#no shutdownR1(config)#int e0/0R1(config-if)#ip add 20.1.1.1 255.255.255.0 R1(config-if)#no shR1(config)#router o

2、spf 100 启用协议，发布接口R1(config-router)#net 10.1.1.0 0.0.0.255 areaR1(config-router)#net 20.1.1.0 0.0.0.255 area00R2(config)#int e0/1R2(config-if)#ip add 20.1.1.2 255.255.255.0 R2(config-if)#no shR2(config-if)#int e0/0R2(config-if)#ip add 30.1.1.1 255.255.255.0 R2(config-if)#no shR2(config)#router ospf 1

3、00R2(config-router)#net 20.1.1.0 0.0.0.255 areaR2(config-router)#net 30.1.1.0 0.0.0.255 area00R3(config)#int e0/1R3(config-if)#ip add 30.1.1.2 255.255.255.0 R3(config-if)#no shR3(config-if)#int e0/0R3(config-if)#ip add 40.1.1.1 255.255.255.0 R3(config-if)#no shR3(config-if)#exit R3(config)#router os

4、pf 100R3(config-router)#net 30.1.1.0 0.0.0.255 area 0R3(config-router)#net 30.1.1.0 0.0.0.255 area 0步骤二：查看，并测试连通性R1#show ip route查看表20.0.0.0/2420.1.1.040.0.0.0/2440.1.1.010.0.0.0/2410.1.1.030.0.0.0/2430.1.1.0is isissubnetted, 1 subnets directly connected,subnetted, 1 subnetsCEthernet0/0O110/30 via 2

5、0.1.1.2,00:00:15, Ethernet0/0is isissubnetted, 1 subnets directly connected,subnetted, 1 subnetsCEthernet0/1O110/20 via 20.1.1.2,00:00:15, Ethernet0/0R2#show ip route20.0.0.0/2420.1.1.040.0.0.0/2440.1.1.010.0.0.0/2410.1.1.030.0.0.0/2430.1.1.0is isissubnetted, 1 subnets directly connected,subnetted,

6、1 subnetsCEthernet0/1O110/20 via 30.1.1.2,is subnetted, 1 subnets 110/20 via 20.1.1.1,is subnetted, 1 subnetsis directly connected,00:00:23, Ethernet0/0O00:00:23, Ethernet0/1CEthernet0/0查看R3#show ip route表，学到相关20.0.0.0/2420.1.1.040.0.0.0/2440.1.1.010.0.0.0/2410.1.1.0is subnetted, 1 subnets110/20 via

7、 30.1.1.1, 00:00:06, Ethernet0/1Oisis issubnetted, 1 subnetsdirectly connected, Ethernet0/0 subnetted, 1 subnetsCO110/30 via 30.1.1.1, 00:00:06, Ethernet0/130.0.0.0/24 is subnetted, 1 subnetsC30.1.1.0 is directly connected, Ethernet0/140.1.1.1 测试连通性R1#Typeescape sequence to abort.Sending!Success5, 1

8、00-byte ICMP Echos to 40.1.1.1, timeout is 2 seconds:rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4msR3#10.1.1.1Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:!Success rate is 100 percent (5/5), round-tripmin/avg/max=4/4/4ms步骤三：启用相关接口的 MPLS,

9、及快速转发功能R1(config)#ip cef 启用快速转发功能R1(config)#int e0/0R1(config-if)#mpls ip 接口启用 MPLSR2(config)#ip cef R2(config)#int e0/1 R2(config-if)#mpls ip R2(config-if)#int e0/0R2(config-if)#mpls ipR3(config)#ip cef R3(config)#int e0/1R3(config-if)#mpls ip步骤四：查看 MPLS 状态R1#show mpls forwarding-table 查看 MPLS 转发表L

10、ocal tag 1617OutgoingPrefixor Tunnel Id 40.1.1.0/2430.1.1.0/24Bytes tag switched 00Outgoing interface Et0/0Et0/0Next Hoptag 16Popor VC20.1.1.220.1.1.2tagR2#show mpls forwarding-tableLocal tag16Outgoing tag or VCPop tagPrefixor Tunnel Id 40.1.1.0/24BytestagOutgoing interfaceEt0/0Next Hopswitched030.1

11、.1.217Pop tag10.1.1.0/240Et0/120.1.1.1R3#show mpls forwarding-tableLocal tag 1617OutgoingPrefixor Tunnel Id 20.1.1.0/2410.1.1.0/24Bytes tag switched 00Outgoing interface Et0/1Et0/1Next Hoptag Pop17or VCtag30.1.1.130.1.1.1R1#show ipcefsummary 查看 CEF 转发汇总及标记IP CEF with switching (Table Version 16), fl

12、ags=0x016 routes, 0 reresolve, 0 unresolved (0 old, 0 new),peak 016 leaves, 18 nodes, 20896 bytes, 21 inserts, 5 invalidations 0 load sharing elements, 0 bytes, 0 referencesuniversal per-destination load sharing algorithm, id 86C8F0BF 3(0) CEF resets, 0 revisions of existing leavesResolution Timer:

13、Exponential (currently 1s, peak 1s) 0 in-place/0 aborted modificationsrefcounts:4877 leaf, 4864 nodeTable epoch: 0 (16 entries at this epoch)Adjacency Table has 2 adjacenciesR2#show ip cef summaryIP CEF with switching (Table Version 17), flags=0x017 routes, 0 reresolve, 0 unresolved (0 old, 0 new),

14、peak 017 leaves, 18 nodes, 21032 bytes, 22 inserts, 5 invalidations 0 load sharing elements, 0 bytes, 0 referencesuniversal per-destination load sharing algorithm, id FCD3DE86 3(0) CEF resets, 0 revisions of existing leavesResolution Timer: Exponential (currently 1s, peak 1s) 0 in-place/0 aborted mo

15、dificationsrefcounts:4879 leaf, 4864 nodeTable epoch: 0 (17 entries at this epoch)Adjacency Table has 4 adjacenciesR3#show ip cef summaryIP CEF with switching (Table Version 16), flags=0x016 routes, 0 reresolve, 0 unresolved (0 old, 0 new), peak 016 leaves, 18 nodes, 20896 bytes, 21 inserts, 5 inval

16、idations 0 load sharing elements, 0 bytes, 0 referencesuniversal per-destination load sharing algorithm, id 86B9347C3(0) CEF resets, 0 revisions of existing leaves Resolution Timer: Exponential (currently 1s, peak 0 in-place/0 aborted modificationsrefcounts:4877 leaf, 4864 node1s)Table epoch: 0 (16

17、entries at this epoch)Adjacency Table has 2 adjacencies注：也可用 show ip cef这条命令来查看详细R1#!40.1.1.1 测试连通性R3#!10.1.1.1步骤五：显示当前配置R1#show run hostname R1 ip cef!interface Ethernet0/0ip address 20.1.1.1 255.255.255.0 half-duplextag-switching ip!interface Ethernet0/1ip address 10.1.1.1 255.255.255.0 half-duple

18、x!router ospf 100network 10.1.1.0 0.0.0.255 area 0network 20.1.1.0 0.0.0.255 area 0!endR2#show run hostname R2!ip cef!interface Ethernet0/0ip address 30.1.1.1 255.255.255.0 half-duplextag-switching ip!interface Ethernet0/1ip address 20.1.1.2 255.255.255.0 half-duplextag-switching ip!router ospf 100n

19、etwork 20.1.1.0 0.0.0.255 area 0network 30.1.1.0 0.0.0.255 area 0!endR3#show run hostname R3!ip cef!interface Ethernet0/0ip address 40.1.1.1 255.255.255.0 half-duplex!interface Ethernet0/1ip address 30.1.1.2 255.255.255.0 half-duplextag-switching ip!router ospf 100network 30.1.1.0 0.0.0.255 area 0ne

20、twork 40.1.1.0 0.0.0.255 area 0!end实验二：ipsec site-to-site配置环境：两台器串口相连，接口配置如图要求：用两个 LOOP 口模拟感流来建立 IPSEC,IKE1 阶段用预共享密钥，IKE2阶段算法用 sha,加密算法用 DES.步骤一：接口基本配置，并测试连通性R1(config)#int s0R1(config-if)#ip add 10.1.1.1 255.255.255.0R1(config-if)#clock rate 64000 R1(config-if)#no sh R1(config)#int loop 0R1(config-

21、if)#ip add 1.1.1.1 255.255.255.0R2(config)#int s1R2(config-if)#ip add 10.1.1.2 255.255.255.0 R2(config-if)#no shR2(config)#int loop 0R2(config-if)#ip add 1.1.2.1 255.255.255.0R1#!Success10.1.1.2 测试连通性，再做 IPSECrate is 100 percent (5/5), round-tripmin/avg/max = 28/31/32 msR2#!Success10.1.1.1rate is 10

22、0 percent (5/5), round-tripmin/avg/max = 32/32/32 ms配置二：配置 IKE1 和 IKE2 两个阶段，并应用到接口R1(config)#crypto isakmp R1(config-isakmp)#authenR1(config)#crypto isakmppolicy 10 pre-sharekey ciscoIKE1 阶段策略将验证修改为预共享address 10.1.1.2 定义预共享密钥R1(config)#crypto ipsec transform myset esp-sha-hmac esp-des定义 2 阶段的转换集R1(c

23、onfig)#access-list 100 permit ip 1.1.1.0 0.0.0.255 1.1.2.0 0.0.0.255定义加密感流R1(config)#crypto map mymap 10 ipsec-isakmp定义 2 阶段加密图% NOTE: This new crypto map will remain disabled until a peer and a valid access list have been configured.R1(config-crypto-map)#match address 100 将列表应用到加密图R1(config-crypto-

24、map)#set peer 10.1.1.2指定对等体R1(config-crypto-map)#set transform-set myset 将转换集R1(config)#int s0R1(config-if)#crypto map mymap 将加密图应用到接口R1(config)#ip route 1.1.2.0 255.255.255.0 20.1.1.2到加密图指定隧道感流的R2(config)#crypto isakmp policy 10 R2 与 R1 端策略要匹配R2(config-isakmp)#authentication pre-share R2(config-isa

25、kmp)#exitR2(config)#crypto isakmp key cisco address 10.1.1.1 密钥一致，地址相互指R2(config)#crypto ipsec transform-set myset esp-des esp-sha-hmacR2(cfg-crypto-trans)#exit两端必须匹配，默认即为 tunnel 模式R2(config)#access-list 102 permit ip 1.1.2.0 0.0.0.255感R2(config)#crypto map mymap 10 ipsec-isakmp加密图% NOTE: This new c

26、rypto map will remain disabled until and a valid access list have been configured.1.1.1.0 0.0.0.255流，两端互指a peerR2(config-crypto-map)#set peer 10.1.1.1 对端的物理地址R2(config-crypto-map)#set transform-set myset R2(config-crypto-map)#match address 102 R2(config-crypto-map)#exitR2(config)#ip route 1.1.1.0 25

27、5.255.255.0 10.1.1.1 加密图感R2(config)#int s1R2(config-if)#crypto map mymap 加密应用到接口下流的步骤三：测试流是否加密，直接用接口出R1#!Success R2#!Success1.1.2.1rate is 100 percent (5/5), round-trip min/avg/max = 32/33/36 ms1.1.1.1rate is 100 percent (5/5), round-trip min/avg/max = 32/33/36 ms分别在 R1 和R2 上查看两个阶段的关联R1#show crypto

28、isakmp sa 没有任何关联dstsrcstateconn-idslotR2#show cryptodstisakmp sasrcstateconn-idslotR1#show cryptoipsec sa 没有任何加密包，关联也没有建立interface: Serial0Crypto map tag: mymap, local addr.10.1.1.1local ident (addr/mask/prot/port): remote ident (addr/mask/prot/port): current_peer: 10.1.1.2PERMIT, flags=origin_is_ac

29、l,(1.1.1.0/255.255.255.0/0/0)(1.1.2.0/255.255.255.0/0/0)#pk #pkts #pkts #pkts#sendcaps: 0, #pkcrypt: 0,#pkts#pktsdigest 0verify 00decaps: 0, #pkts decrypt: 0,compressed: 0, #pkts decompressed:not compressed:errors 0, #recv0, #pkts compr. failed:errors 00, #pkts decompressfailed:0local crypto endpt.:

30、path mtu 1500, media10.1.1.1,remotecryptoendpt.:10.1.1.2mtu1500currentoutbound spi:0inboundesp sas:inboundah sas:inboundpcp sas:outboundesp sas:outboundah sas:outboundpcp sas:R2#show crypto ipsec sainterface: Serial1Crypto map tag: mymap,localaddr.10.1.1.2local ident (addr/mask/prot/port): remote id

31、ent (addr/mask/prot/port): current_peer: 10.1.1.1PERMIT, flags=origin_is_acl,(1.1.2.0/255.255.255.0/0/0)(1.1.1.0/255.255.255.0/0/0)#pkcaps: 0, #pkcrypt: 0,#pkts digest 0#pkts #pkts #pkts#senddecaps: 0, #pkts decrypt: 0, #pkts verify 0compressed: 0, #pkts decompressed: 0not compressed:errors 0, #recv

32、0, #pkts compr. failed:errors 00, #pkts decompressfailed:0local crypto endpt.:path mtu 1500, media10.1.1.2,remotecryptoendpt.:10.1.1.1mtu1500currentoutbound spi: 0inboundesp sas:inboundah sas:inboundpcp sas:outboundesp sas:outboundah sas:outboundpcp sas:步骤四：用扩展来触发感流量R1#Target RepeatipIP address: 1.1

33、.2.110 将包调为 10 个，否则一个n: yinterface: 1.1.1.1count 5:看不到效果ExtendeddsSource address orSending 10, 100-byte ICMP Echos to 1.1.2.1, timeoutis 2 seconds:.!已经触发了感流，并且通Success rate is 60 percent (6/10), round-trip min/avg/max = 84/84/84ms步骤五：再次查看两个阶段的关联，以及加密情况R1#show crypto dst10.1.1.2isa sa IKE1 阶段关联已建立为快速

34、模式src10.1.1.1stateQM_IDLEconn-id1slot0R1#show cryptoipsec saIKE2 阶段关联建立，并interface: Serial0流量，隧道也已建立Crypto map tag: mymap, local addr. 10.1.1.1localident (addr/mask/prot/port): (1.1.1.0/255.255.255.0/0/0)remote ident (addr/mask/prot/port): current_peer: 10.1.1.2PERMIT, flags=origin_is_acl,(1.1.2.0/2

35、55.255.255.0/0/0)#pk #pkts #pkts #pkts#sendcaps: 6, #pkcrypt: 6,#pkts#pktsdigest 6verify 60decaps: 6, #pkts decrypt: 6,compressed: 0, #pkts decompressed:not compressed: 0, #pkts compr. failed: 0, #pkts decompresserrors 14, #recv errors 0failed:0local crypto endpt.: 10.1.1.1, remote crypto endpt.: 10

36、.1.1.2 path mtu 1500, media mtu 1500current outbound spi: 84AEB2E6inbound esp sas:spi: 0x1E44AB1D(507816733)transform: esp-des esp-sha-hmac , in use settings =Tunnel, slot: 0, saIV size:conn id: 2000, flow_id: 1, crypto: remaining key lifetime (k/sec): 8 bytesmap: mymap(4607999/3520)replay detection

37、 support: Yinbound ah sas:inbound pcp sas:outbound esp sas:spi: 0x84AEB2E6(2226041574)transform: esp-des esp-sha-hmac , in use settings =Tunnel, slot: 0, saIV size:conn id: 2001, flow_id: 2, cryptomap: mymap(4607999/3520): remaining key lifetime8 bytes(k/sec):replay detectionsupport: Youtbound ah sa

38、s:outbound pcp sas:R2#show crypto dst10.1.1.2isa sasrc 10.1.1.1stateQM_IDLEconn-id1slot0R2#show crypto ipsec sainterface: Serial1Crypto map tag: mymap, local addr.10.1.1.2local ident (addr/mask/prot/port): remote ident (addr/mask/prot/port): current_peer: 10.1.1.1PERMIT, flags=origin_is_acl,(1.1.2.0

39、/255.255.255.0/0/0)(1.1.1.0/255.255.255.0/0/0)#pk #pkts #pkts #pkts#sendcaps: 6, #pkcrypt: 6,#pkts#pktsdigest 6verify 60decaps: 6, #pkts decrypt: 6,compressed: 0, #pkts decompressed:not compressed:errors 0, #recv0, #pkts compr. failed: 0, #pkts decompresserrors 0failed:0local crypto endpt.:path mtu

40、1500, media10.1.1.2, remote crypto endpt.: 10.1.1.1mtu 1500current outbound spi: 1E44AB1Dinbound esp sas: 进站流已经产生spi: 0x84AEB2E6(2226041574)transform: esp-des esp-sha-hmac , in use settings =Tunnel, slot: 0, saIV size:conn id: 2000, flow_id: 1, crypto: remaining key lifetime (k/sec): 8 bytesmap: mym

41、ap(4607999/3502)replay detection support: Yinbound ah sas:inbound pcp sas:outbound esp sas: 出站流已经产生spi: 0x1E44AB1D(507816733)transform: esp-des esp-sha-hmac , in use settings =Tunnel, slot: 0, saIV size:conn id: 2001, flow_id: 2, crypto: remaining key lifetime (k/sec): 8 bytesmap: mymap(4607999/3502

42、)replay detection support: Youtbound ah sas:outbound pcp sas:配置五：查看当前的配置R1#show run hostname R1!crypto isakmp policy 10 authentication pre-sharecrypto!crypto!cryptoisakmp key cisco address 10.1.1.2ipsec transform-set myset esp-desesp-sha-hmacmap mymap 10 ipsec-isakmpset peer 10.1.1.2set transform-se

43、t myset match address 102!interface Loopback0ip address 1.1.1.1 255.255.255.0!interface Serial0ip address 10.1.1.1 255.255.255.0clockrate 64000 crypto map mymap!ip route 1.1.2.0 255.255.255.0 10.1.1.2!access-list 102 permit ip 1.1.1.0 0.0.0.255!end1.1.2.0 0.0.0.255R2#show run hostname R2!crypto isak

44、mp policy 10 authentication pre-sharecrypto!crypto!cryptoisakmp key cisco address 10.1.1.1ipsec transform-set myset esp-des esp-sha-hmacmap mymap 10 ipsec-isakmpset peer 10.1.1.1set transform-set myset match address 102!interface Loopback0ip address 1.1.2.1 255.255.255.0!interface Serial1ip address

45、10.1.1.2 255.255.255.0 crypto map mymap!ip route 1.1.1.0 255.255.255.0 10.1.1.1!access-list 102 permit ip 1.1.2.0 0.0.0.255 1.1.1.0 0.0.0.255!end实验三：GRE的配置环境：三台器串口相连，接口配置如图要求：在 R1 和 R3 之间建立 GRE 隧道，地址如图步骤一：接口配置连通性，R1(config)#int s0R1(config-if)#ip add 20.1.1.1 255.255.255.0 R1(config-if)#no shR1(conf

46、ig-if)#int lo0R1(config-if)#ip add 10.1.1.1 255.255.255.0R1(config)#ip route 0.0.0.0 0.0.0.0 20.1.1.2虚拟私有网络上互联网的缺省ISP(config)#int s0ISP器虚拟互联网ISP(config-if)#ip ISP(config-if)#clISP(config-if)#noadd 30.1.1.1 255.255.255.0ra 64000shISP(config-if)#int s1ISP(config-if)#ip ISP(config-if)#clISP(config-if)#

47、noadd 20.1.1.2 255.255.255.0ra 64000shR3(config)#int s1R3(config-if)#ip add 30.1.1.2 255.255.255.0 R3(config-if)#no shR3(config-if)#int loo 0R3(config-if)#ip add 40.1.1.1 255.255.255.0 R3(config-if)#exitR3(config)#ip route 0.0.0.0 0.0.0.0 30.1.1.2虚拟私有网络上互联网的缺省步骤二：测试哪些可达，哪些不可达10.1.1.1 由于 ISP 没有私网的R3#

48、Type escape sequence to abort.Sending U.U.USuccessR3#5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:rate is 0 percent (0/5)20.1.1.1 合法地址是能够通讯的Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 20.1.1.1, timeout is 2 seconds:!Success rate is 100 percent (5/5), round-trip min/av

49、g/max = 56/60/64 ms步骤三：实施 GRE 隧道技术R1(config)#int tunnel 0进入隧道接口R1(config-if)#ip add R1(config-if)#tunnel R1(config-if)#tunnelR1(config-if)#no sh100.1.1.1 255.255.255.0 指定 IP 地址，两端要在一个网段source s0 指定承载隧道的源和目的接口destination 30.1.1.2R1(config)#ip route 40.1.1.0 255.255.255.0 tunnel0 为私有网络指接口R3(config)#in

50、t tunnel 0走tunnelR3(config-if)#ip add R3(config-if)#tunnel R3(config-if)#tunnel R3(config-if)#no shR3(config-if)#exit100.1.1.2 255.255.255.0source s1 互指源和目的destination 20.1.1.1R3(config)#ip route 10.1.1.0 255.255.255.0 tunnel 0 指对端的私有网络步骤四：做测试R1#40.1.1.1 通，证明 GRE 隧道已建立Type escape sequence to abort.S

51、ending!Success5, 100-byte ICMP Echos to 40.1.1.1, timeout is 2 seconds:rate is 100 percent (5/5), round-trip min/avg/max = 72/72/76 msR1#10.1.1.1Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:!Success rate is 100 percent (5/5), round-trip min/avg/max =

52、 72/72/76 ms步骤五：验证结果R1#show int tunnel 0Tunnel0 isHardware Internetup, line protocol is up tunnel 接口已经 UP is Tunneladdress is 100.1.1.1/24R3#show int tunnel 0Tunnel0 isHardware Internetup, line protocol is up is Tunneladdress is 100.1.1.2/24R1#show int tunnel 0 Tunnel0ProtocolIPing tunnel 接口的统计，包的统计

53、PktsIn10Chars In1000PktsOut10Chars Out1000R3#show int tunnel 0 Tunnel0ProtocolIPingPktsIn10Chars In1000PktsOut10Chars Out1000步骤六：显示当前配置R1#show run hostname R1!interface Loopback0ip address 10.1.1.1 255.255.255.0!interface Tunnel0ip address 100.1.1.1 255.255.255.0tunnel source Serial0 tunnel destination 30.1.1.2!interface Serial0ip address 20.1.1.1 255.255.255.0!ip route 0.0.0.0 0.0.0.0 20.1.1.2ip route 40.1.1.0 255.255.255.0 Tunnel0!EndISP#show run hostname ISP!interface Serial0 ip address 30.1.1.1clockr