思科752数据中心组网架构，以及ASA防火墙的透明配置案例

Posted 2021-03-14

1、案例拓扑图如下

2、n7k的主要配置

2.1、N7K1的vpc配置
vpc domain 100
peer-switch
role priority 1
peer-keepalive destination 1.1.1.2 source 1.1.1.1
peer-gateway

interface port-channel100
vpc peer-link

interface Ethernet1/1
switchport mode trunk
channel-group 100 mode active

interface Ethernet1/2
switchport mode trunk
channel-group 100 mode active
N7K2的vpc配置
vpc domain 100
role priority 100
peer-keepalive destination 1.1.1.1 source 1.1.1.2
peer-gateway

interface port-channel100
vpc peer-link

interface Ethernet1/1
switchport mode trunk
channel-group 100 mode active

interface Ethernet1/2
switchport mode trunk
channel-group 100 mode active

2.2、N7K和5K之间使用背对背的VPC
这种方式与普通的vpc的区别是，n7k的下联启用vpc功能。n5k的上联链路也启用vpc功能。所有的互联口加入相同的vpc接口中。配置略

3、N5K 配置
3.1、vpc配置

n5k1
feature vpc

vpc domain 100
peer-switch
role priority 1
peer-keepalive destination 1.1.1.4 source 1.1.1.3
peer-gateway

interface port-channel5
des TO_N7K
vpc 5

interface port-channel10
des vpc_peer
vpc peer-link

n5k2
vpc domain 100
peer-switch
role priority 100
peer-keepalive destination 1.1.1.3 source 1.1.1.4
peer-gateway

interface port-channel5
des TO_N7K
vpc 5

interface port-channel10
vpc peer-link

3.2、 N5K下挂2k 使用port-channel 的方式
n5k1

feature fex

fex 107
pinning max-links 1
description "FEX107"
fex 108
pinning max-links 1
description "FEX0108"

interface port-channel107
switchport mode fex-fabric
fex associate 107

interface port-channel108
switchport mode fex-fabric
fex associate 108

3.3、其中5k 和2k 的port-channel 聚合方式使用on 方式不能用lacp，

5k和2k的互联不推荐使用静态pinning 方式。这种方式缺陷明显。某一条上联链路down掉后，下挂的fex接口会掉一大片。

2k通电下载5k的镜像show fex 看到2k online 状态说明fex ok了
n5k1 下面show fex 会看到有两台fex。 fex 107 fex 108

4、2k下使用增强vpc连接服务器

配置如下

N5K1

interface e107/1/1
channel-group 11 mode active

interface P11
switch mode access
switch access vlan 11

N5K2

interface e108/1/1
channel-group 11 mode active

interface P11
switch mode access
switch access vlan 11

普通的链路聚合就可以和服务器对接，不需要vpc。

5、外联区防火墙ASA1-2 使用三层模式接入网络，使用主备模式

5.1、ASA1 failover配置
failover
failover lan unit primary
failover lan interface FO Port-channel1
failover interface ip FO 11.1.1.1 255.255.255.0 standby 11.1.1.2

failover 链路使用是两条物理链路聚合接口。

5.2、上联链路
interface Port-channel2
des TO_N7K
nameif inside
security-level 100
ip address 10.1.1.2 255.255.255.0

            下联链路

interface Ethernet4
des TO_cisco3750x
nameif outside
security-level 0
ip address 10.1.2.1 255.255.255.0

5.3、 路由
asa 1与N7K之间启用静态路由，下一跳指到7k的hsrp的虚拟地址

route inside 172.16.1.0 255.255.255.0 10.1.1.254 内网路由
route outside 100.1.1.0 255.255.255.0 10.1.2.2 1 外网路由

5.4放行inside 到outside 的流量

access-list in_acl extended permit icmp 172.16.1.0 255.255.255.0 100.1.1.0 255.255.255.0

access-group in_acl in interface outside

5.5、ASA2只需要配置上行以及asa1的互联的链路聚合口以及failover就可以

配置

failover配置
failover
failover lan unit secondary
failover lan interface FO Port-channel1
failover interface ip FO 11.1.1.1 255.255.255.0 standby 11.1.1.2

链路聚合配置省略

6、ASA3-4使用asa的透明模式
6.1、failover 以及链路聚合配置省略
6.2、bridge-group配置，使用子接口方式封装vlan

interface Port-channel3
no nameif
security-level 0
!
interface Port-channel3.10
des TO_N7K
vlan 10
nameif outside
bridge-group 10
security-level 0

interface Ethernet4.10
des TO_cisco_3750
vlan 11
nameif inside
bridge-group 10
security-level 100

bvi接口需要和业务网段在同一个网段

interface BVI10
des bvi_interface
ip address 10.1.10.254 255.255.255.0

查看bridge-group

ASA3# sho bridge-group
Static mac-address entries: 0 (in use), 65535 (max)
Dynamic mac-address entries: 1 (in use), 65535 (max)

Bridge Group: 10
Interfaces:
Ethernet4.10
Port-channel3.10

Management System IP Address: 10.1.10.254 255.255.255.0
Management Current IP Address: 10.1.10.254 255.255.255.0
Management IPv6 Global Unicast Address(es):
N/A
Static mac-address entries: 0
Dynamic mac-address entries: 1

上下行交换机，使用trunk 模式封装相应的VLAN id即可。

6.3、方向n7k 和下联交换机3750x的ospf 流量

access-list inside_acl extended permit icmp any any
access-list inside_acl extended permit ospf any any
access-list out_acl extended permit icmp any any
access-list out_acl extended permit ospf any any

access-group inside_acl in interface inside
access-group out_acl in interface outside