75E的IRF2+多插卡配置案例-MQC方式(2)

逻辑拓扑：

172.16.1.177/28172.16.1.190/28Vlan1103上联SR6675E上的vpn实例75Evpn下联FW地址172.16.1.174/28 vlan1102流量从下往上依次经过ACG、IPSVrrp虚地址172.16.1.163/28FW2上联地址172.16.1.162/28Vlan1102FW1上联地址172.16.1.161/28FW2下联地址172.16.1.146/28Vrrp虚地址172.16.1.147/28Vlan1101 FW1下联地址172.16.1.145/28内网网关在75E上比如10.10.70.254/2475E上联FW地址172.16.1.158/28vlan1101

四．配置：

在75E上接口、路由配置（聚合配置省略） vlan101

interface Vlan-interface101 //内网网段的网关 ip address 192.168.1.254 24 #

vlan102

interface Vlan-interface102 //内网网段的网关 ip address 192.168.2.254 24 #

vlan103 //内网DMZ区域，网关在FW上 #

vlan1101

interface Vlan-interface1101 //75E上行和FW互联 ip address 172.16.1.158 28 #

ip route-static 0.0.0.0 0.0.0.0 192.168.138.147 //指到FW的vrrp虚地址

FW1上配置（三层接口、路由和vrrp配置），FW2类似： #

interface Ten-GigabitEthernet0/0.1101 vlan-type dot1q vid 1101

ip address 172.16.1.145 255.255.255.240 vrrp vrid 10 virtual-ip 172.16.1.147 vrrp vrid 10 priority 120 #

interface Ten-GigabitEthernet0/0.1102 vlan-type dot1q vid 1102

ip address 172.16.1.161 255.255.255.240 vrrp vrid 20 virtual-ip 172.16.1.163 vrrp vrid 20 priority 120 #

interface Ten-GigabitEthernet0/0.103 vlan-type dot1q vid 103

ip address 192.168.3.252 255.255.255.0 vrrp vrid 30 virtual-ip 192.168.3.254 vrrp vrid 30 priority 120 #

ip route-static 0.0.0.0 0.0.0.0 172.16.1.174 ip route-static 192.168.1.0 255.255.255.0 172.16.1.158 ip route-static 192.168.2.0 255.255.255.0 172.16.1.158

75E_vpn及vpn路由配置： #

ip vpn-instance vpn_IPSACG //vpn实例 route-distinguisher 65535:1 #

interface LoopBack2 //绑定到vpn实例 ip binding vpn-instance vpn_IPSACG #

interface Vlan-interface1102 //FW和75E的vpn实例互联vlan ip binding vpn-instance vpn_IPSACG

ip address 172.16.1.174 255.255.255.240 #

interface Vlan-interface1103 //75E的vpn实例和SR66互联vlan ip binding vpn-instance vpn_IPSACG

ip address 172.16.1.177 255.255.255.240 #

ip route-static vpn-instance vpn_IPSACG 0.0.0.0 0.0.0.0 172.16.1.190

ip route-static vpn-instance vpn_IPSACG 192.168.0.0 255.255.0.0 172.16.1.163

75E上，MQC引流配置

以下是定义引流所用的ACL

acl number 3501 //部分上行流量 description UP_stream1

rule 0 permit ip source 192.168.1.0 0.0.0.255 rule 5 permit ip source 192.168.3.0 0.0.0.255 acl number 3502

description UP_stream2 //另部分上行流量 rule 0 permit ip source 192.168.2.0 0.0.0.255

acl number 3503 //所有上行流量，可以根据需要把掩码做的更精确 description UP_stream_all

rule 0 permit ip source 192.168.0.0 0.0.255.255

acl number 3511 //部分下行流量 description down_stream1

rule 0 permit ip destination 192.168.1.0 0.0.0.255 rule 5 permit ip destination 192.168.3.0 0.0.0.255 acl number 3512 // 另部分下行流量

description down_stream2

rule 0 permit ip destination 192.168.2.0 0.0.0.255

acl number 3513 //所有下行流量，可以根据需要把掩码做的更精确 description down_stream_all

rule 0 permit ip destination 192.168.0.0 0.0.255.255 #

acl number 4000 //广播组播流量 description B_M_ARP

rule 5 permit type 0806 ffff

rule 10 permit dest-mac ffff-ffff-ffff ffff-ffff-ffff

rule 15 permit dest-mac 0100-0000-0000 ff00-0000-0000 rule 20 permit dest-mac 3300-0000-0000 ff00-0000-0000

百度搜索“77cn”或“免费范文网”即可找到本站免费阅读全部范文。收藏本站方便下次阅读，免费范文网，提供经典小说综合文库75E的IRF2+多插卡配置案例-MQC方式(2)在线全文阅读。