F1060 GRE ***典型组网配置案例

Posted

tags:

篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了F1060 GRE ***典型组网配置案例相关的知识，希望对你有一定的参考价值。

F1060 GRE ***典型组网配置案例

组网及说明

组网说明：

技术图片

本案例采用H3C HCL模拟器的F1060来模拟GRE ***典型组网配置。内网和外网在网络拓扑图中已经有了明确的标识。FW1与FW2分别为各自内网的出口设备，提供NAT地址转换的服务。为了内网1和内网2能穿越NAT及外网进行通信，因此采用GRE ***来实现。

配置步骤

按照网络拓扑图正确配置IP地址

FW1配置NAT，并配置默认路由指向ISP

FW2配置NAT，并配置默认路由指向ISP

FW1与FW2建立GRE ***隧道

配置关键点

第一阶段调试（基础网络配置）：

ISP：


<H3C>sys

System View: return to User View with Ctrl+Z.

[H3C]sysname ISP

[ISP]int gi 0/0

[ISP-GigabitEthernet0/0]des <connect to FW1>

[ISP-GigabitEthernet0/0]ip address 202.1.100.1 30

[ISP-GigabitEthernet0/0]quit

[ISP]int gi 0/1

[ISP-GigabitEthernet0/1]des <connect to FW2>

[ISP-GigabitEthernet0/1]ip address 202.2.100.1 30

[ISP-GigabitEthernet0/1]quit

FW1：


<H3C>sys

System View: return to User View with Ctrl+Z.

[H3C]sysname FW1

[FW1]int gi 1/0/3

[FW1-GigabitEthernet1/0/3]ip address 192.168.1.1 24

[FW1-GigabitEthernet1/0/3]quit

[FW1]acl basic 2000

[FW1-acl-ipv4-basic-2000]rule 0 permit source any

[FW1-acl-ipv4-basic-2000]quit

[FW1]int gi 1/0/2

[FW1-GigabitEthernet1/0/2]des <connect to ISP>

[FW1-GigabitEthernet1/0/2]ip address 202.1.100.2 30

[FW1-GigabitEthernet1/0/2]nat outbound 2000

[FW1-GigabitEthernet1/0/2]quit

[FW1]security-zone name Trust

[FW1-security-zone-Trust]import interface GigabitEthernet 1/0/3

[FW1-security-zone-Trust]quit

[FW1]security-zone name Untrust

[FW1-security-zone-Untrust]import interface GigabitEthernet 1/0/2

[FW1-security-zone-Untrust]quit

[FW1]ip route-static 0.0.0.0 0.0.0.0 202.1.100.1

[FW1]acl basic 2001

[FW1-acl-ipv4-basic-2001]rule 0 permit source any

[FW1-acl-ipv4-basic-2001]quit

[FW1]

[FW1]zone-pair security source trust destination untrust

[FW1-zone-pair-security-Trust-Untrust]packet-filter 2001

[FW1-zone-pair-security-Trust-Untrust]quit

[FW1]

[FW1]zone-pair security source untrust destination trust

[FW1-zone-pair-security-Untrust-Trust]packet-filter 2001

[FW1-zone-pair-security-Untrust-Trust]quit

[FW1]

[FW1]zone-pair security source trust destination local

[FW1-zone-pair-security-Trust-Local]packet-filter 2001

[FW1-zone-pair-security-Trust-Local]quit

[FW1]

[FW1]zone-pair security source local destination trust

[FW1-zone-pair-security-Local-Trust]packet-filter 2001

[FW1-zone-pair-security-Local-Trust]quit

[FW1]

[FW1]zone-pair security source untrust destination local

[FW1-zone-pair-security-Untrust-Local]packet-filter 2001

[FW1-zone-pair-security-Untrust-Local]quit

[FW1]

[FW1]zone-pair security source local destination untrust

[FW1-zone-pair-security-Local-Untrust]packet-filter 2001

[FW1-zone-pair-security-Local-Untrust]quit

FW2：


<H3C>sys

System View: return to User View with Ctrl+Z.

[H3C]sysname FW2

[FW2]int gi 1/0/3

[FW2-GigabitEthernet1/0/3]ip address 172.16.1.1 24

[FW2-GigabitEthernet1/0/3]quit

[FW2]acl basic 2000

[FW2-acl-ipv4-basic-2000]rule 0 permit source any

[FW2-acl-ipv4-basic-2000]quit

[FW2]int gi 1/0/2

[FW2-GigabitEthernet1/0/2]des <connect to ISP>

[FW2-GigabitEthernet1/0/2]ip address 202.2.100.2 30

[FW2-GigabitEthernet1/0/2]nat outbound 2000

[FW2-GigabitEthernet1/0/2]quit

[FW2]ip route-static 0.0.0.0 0.0.0.0 202.2.100.1

[FW2]security-zone name Trust

[FW2-security-zone-Trust]import interface GigabitEthernet 1/0/3

[FW2-security-zone-Trust]quit

[FW2]security-zone name Untrust

[FW2-security-zone-Untrust]import interface GigabitEthernet 1/0/2

[FW2-security-zone-Untrust]quit

[FW2]acl basic 2001

[FW2-acl-ipv4-basic-2001]rule 0 permit source any

[FW2-acl-ipv4-basic-2001]quit

[FW2]

[FW2]zone-pair security source trust destination untrust

[FW2-zone-pair-security-Trust-Untrust]packet-filter 2001

[FW2-zone-pair-security-Trust-Untrust]quit

[FW2]

[FW2]zone-pair security source untrust destination trust

[FW2-zone-pair-security-Untrust-Trust]packet-filter 2001

[FW2-zone-pair-security-Untrust-Trust]quit

[FW2]

[FW2]zone-pair security source trust destination local

[FW2-zone-pair-security-Trust-Local]packet-filter 2001

[FW2-zone-pair-security-Trust-Local]quit

[FW2]

[FW2]zone-pair security source local destination trust

[FW2-zone-pair-security-Local-Trust]packet-filter 2001

[FW2-zone-pair-security-Local-Trust]quit

[FW2]

[FW2]zone-pair security source untrust destination local

[FW2-zone-pair-security-Untrust-Local]packet-filter 2001

[FW2-zone-pair-security-Untrust-Local]quit

[FW2]

[FW2]zone-pair security source local destination untrust

[FW2-zone-pair-security-Local-Untrust]packet-filter 2001

[FW2-zone-pair-security-Local-Untrust]quit

第一阶段测试：

所有PC都填写IP地址：

技术图片

技术图片
内网1的终端仅能PING通内网2的外网地址，PING不通私网地址：
技术图片

内网2的终端仅能PING通内网1的外网地址，PING不通私网地址：
技术图片

第二阶段调试（GRE ***关键配置点：）

FW1：


[FW1]int Tunnel 0 mode gre

[FW1-Tunnel0]ip address 123.0.0.1 30

[FW1-Tunnel0]source 202.1.100.2

[FW1-Tunnel0]destination 202.2.100.2

[FW1-Tunnel0]quit

[FW1]ip route-static 172.16.1.0 255.255.255.0 123.0.0.2

[FW1]security-zone name Untrust

[FW1-security-zone-Untrust]import interface Tunnel 0

[FW1-security-zone-Untrust]quit

FW2：


[FW2]int Tunnel 0 mode gre

[FW2-Tunnel0]ip address 123.0.0.2 30

[FW2-Tunnel0]source GigabitEthernet 1/0/2

[FW2-Tunnel0]description 202.1.100.2

[FW2-Tunnel0]quit

[FW2]ip route-static 192.168.1.0 255.255.255.0 123.0.0.1

[FW2]security-zone name Untrust

[FW2-security-zone-Untrust]import interface Tunnel 0

[FW2-security-zone-Untrust]quit

第二阶段测试：

内网1和内网2的主机可以相互PING通
技术图片

技术图片

查看FW1和FW2的隧道状态均为UP：

技术图片
技术图片

查看FW1和FW2的路由表，均可看到隧道的路由：
技术图片

技术图片

至此，F1060 GRE ***典型组网配置案例已完成！

以上是关于F1060 GRE ***典型组网配置案例的主要内容，如果未能解决你的问题，请参考以下文章

云桌面场景的典型组网案例

云桌面场景的典型组网案例

山石网科如何利用GRE+IPSEC+BFD进行高可用组网-经验分享篇

HCIA-Datacom V1.0培训教材园区网典型组网架构及案例实践

组网图MSTP典型配置组网图：

交换机在江湖GRE隧道配置keepalive后隧道不up怎么办？