如何實(shí)現(xiàn)Cisco雙出口策略
思科公司是全球領(lǐng)先的網(wǎng)絡(luò)解決方案供應(yīng)商，他的功能也是全球領(lǐng)先的，那么你知道如何實(shí)現(xiàn)Cisco雙出口策略嗎?下面是學(xué)習(xí)啦小編整理的一些關(guān)于如何實(shí)現(xiàn)Cisco雙出口策略的相關(guān)資料，供你參考。
什么是策略路由?
策略路由，是一種比基于目標(biāo)網(wǎng)絡(luò)進(jìn)行路由更加靈活的數(shù)據(jù)包路由轉(zhuǎn)發(fā)機(jī)制。路由器將通過(guò)路由圖決定如何對(duì)需要路由的數(shù)據(jù)包進(jìn)行處理，路由圖決定了一個(gè)數(shù)據(jù)包的下一跳轉(zhuǎn)發(fā)路由器。
實(shí)現(xiàn)Cisco雙出口策略的方法：
代碼如下: ROUTER>EN
ROUTER#CONFIG T
Router(Config)>int fa 0/0
Router(Config-if)>ip addr 192.168.0.1 255.255.255.0
Router(Config-if)>ip nat inside
Router(Config-if)>ip policy route-map dual_isp
Router(Config-if)>int fa 0/1
Router(Config-if)>ip addr 電信分配的地址
Router(Config-if)>no shut
Router(Config-if)>ip nat outside
Router(Config-if)>int fa 1/0
Router(Config-if)>ip addr 網(wǎng)通分配的地址
Router(Config-if)>no shut
Router(Config-if)>ip nat outside
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 202.102.128.0 255.255.192.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 218.11.0.0 255.254.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 218.21.128.0 255.255.128.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 218.24.0.0 255.254.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 218.26.0.0 255.255.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 218.27.0.0 255.255.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 218.28.0.0 255.254.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 218.56.0.0 255.252.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 218.60.0.0 255.254.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 218.62.0.0 255.255.128.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 218.67.128.0 255.255.128.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 218.68.0.0 255.254.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 218.7.0.0 255.252.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 219.141.128.0 255.255.128.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 219.142.0.0 255.254.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 219.154.0.0 255.254.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 219.156.0.0 255.254.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 219.158.0.0 255.255.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 219.159.0.0 255.255.192.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 202.102.224.0 255.255.224.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 202.106.0.0 255.255.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 202.107.0.0 255.255.128.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 202.108.0.0 255.255.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 202.110.0.0 255.255.128.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 202.110.192.0 255.255.192.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 202.111.128.0 255.255.192.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 202.96.0.0 255.255.192.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 202.96.64.0 255.255.224.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 202.97.128.0 255.255.128.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 202.98.0.0 255.255.224.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 202.99.0.0 255.255.255.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 221.0.0.0 255.252.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 221.10.0.0 255.255.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 221.11.0.0 255.255.128.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 221.11.128.0 255.255.192.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 221.11.192.0 255.255.224.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 221.12.0.0 255.255.128.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 221.12.128.0 255.255.192.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 221.13.0.0 255.255.192.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 221.13.64.0 255.255.224.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 221.13.128.0 255.255.128.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 221.192.0.0 255.255.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 221.196.0.0 255.255.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 221.199.0.0 255.255.224.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 221.199.32.0 255.255.240.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 221.199.128.0 255.255.192.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 221.199.192.0 255.255.240.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 221.200.0.0 255.255.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 221.204.0.0 255.255.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 221.207.0.0 255.255.192.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 221.208.0.0 255.255.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 221.4.0.0 255.255.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 221.6.0.0 255.255.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 221.7.0.0 255.255.192.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 221.7.64.0 255.255.224.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 221.7.128.0 255.255.128.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 221.8.0.0 255.254.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 222.128.0.0 255.240.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 222.160.0.0 255.252.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 222.163.0.0 255.255.224.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 60.0.0.0 255.248.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 60.8.0.0 255.252.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 60.10.0.0 255.252.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 60.12.0.0 255.255.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 60.13.0.0 255.255.192.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 60.13.128.0 255.255.128.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 60.16.0.0 255.240.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 60.208.0.0 255.248.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 60.220.0.0 255.252.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 61.133.0.0 255.255.128.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 61.134.96.0 255.255.224.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 61.134.128.0 255.255.128.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 61.135.0.0 255.255.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 61.136.0.0 255.255.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 61.138.0.0 255.255.128.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 61.138.128.0 255.255.192.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 61.139.128.0 255.255.192.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 61.148.0.0 255.255.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 61.149.0.0 255.255.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 61.156.0.0 255.255.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 61.158.0.0 255.255.0.0
Router(Config)>Access-list 101 permit Ip 192.168.0.0 0.0.0.255 61.159.0.0 255.255.192.0
Router(Config)>Access-list 102 permit Ip any any
Router(Config)>Ip Nat Inside Source Route-map CT_NAT int fa 0/1 overload
Router(Config)>Ip Nat Inside Source Route-map CNC_NAT int fa 1/0 overload
Router(Config)>Route-map CT_NAT Permit 10
Router(Config-route-map)>Match Int Fa 0/1 (這里不會(huì)匹配外面發(fā)給它的包，因?yàn)镈NAT優(yōu)先于路由選擇)
Router(Config)>Route-map CNC_NAT Permit 10
Router(Config-route-map)>Match Int fa1/0 (指這個(gè)接口所收到的所有包除了DNAT匹配的，會(huì)先進(jìn)行目標(biāo)轉(zhuǎn)換,這樣目標(biāo)并不會(huì)是FA1/0,而是內(nèi)部的一個(gè)IP，這里其實(shí)可以寫(xiě)next-hop 便于理解，也便于檢測(cè)對(duì)方的存在)
Router(Config)>Route-map dual_isp Permit 10
Router(Config-route-map)>Match Ip address 101
Router(Config-route-map)>set ip next-hop 網(wǎng)通網(wǎng)關(guān) 電信網(wǎng)關(guān)(這里恰好把包發(fā)給了NAT所需要的接口，注意這里只是改變了包的下一跳而不是目標(biāo)。還要注意這里并不是把包扔給了next-hop而是改變了 尋路方式，轉(zhuǎn)發(fā)將在此之后進(jìn)行尋路,之后便是源地址轉(zhuǎn)換：路由器2大功能尋路，轉(zhuǎn)發(fā)是分開(kāi)的，由此可以看出，如果策略NAT里匹配的是對(duì)方ISP的地址為 下一跳，那可以檢測(cè)對(duì)方的存在與否)
Router(Config)>Route-map dual_isp Permit 20
Router(Config-route-map)>Match Ip address 102
Router(Config-route-map)>set ip next-hop 電信網(wǎng)關(guān) 網(wǎng)通網(wǎng)關(guān)
Router(Config)>Ip Route 0.0.0.0 0.0.0.0 電信網(wǎng)關(guān)
Router(Config)>Ip Route 0.0.0.0 0.0.0.0 網(wǎng)通網(wǎng)關(guān)
(注意 PBR優(yōu)先于路由，而源地址轉(zhuǎn)換路由又優(yōu)先于NAT,那PBR會(huì)比NAT先進(jìn)行，所以首先因該是進(jìn)行PBR把包分類，扔給2個(gè)出口，之后再做路由選擇路由 是默認(rèn)的沒(méi)什么，之后就是NAT了，策略一看在2出口上收到的包分別進(jìn)行自己的策略NAT，當(dāng)回來(lái)的時(shí)候，2個(gè)出口上收到的包并不會(huì)進(jìn)行源轉(zhuǎn)換為什么?因 為DNAT優(yōu)先于路由，SNAT比路由還慢,所以DNAT是最先進(jìn)行的。還有match next hop 匹配多個(gè)下一跳是與的關(guān)系,也就是說(shuō)要滿足全部的match才會(huì)用動(dòng)作,所以前面不能match多個(gè)nexthop，否則一定砸了，只能match一個(gè) nexthop,當(dāng)然set可以set多個(gè)。 )
此策略路由和策略nat說(shuō)明：目的地址為網(wǎng)通地址的包全部發(fā)給網(wǎng)通網(wǎng)關(guān)，其他一律發(fā)給電信，由于網(wǎng)通地址段較少，所以選擇了做網(wǎng)通的acl條目，減輕工作 量。
以上就是用Cisco路由器雙出口策略實(shí)現(xiàn)的步驟與方法，策略nat部分也可以用match acl的方式，但是發(fā)現(xiàn)實(shí)際速度很慢，不知道原因，可能是需要逐條匹配吧。但是最好用match interface的方式，因?yàn)橹挥羞@樣才能實(shí)現(xiàn)備份，如果接口down掉，就不會(huì)在match接口，但是如果用acl，則會(huì)因?yàn)橛肋h(yuǎn)match而pat 成已經(jīng)down掉接口的地址，但是路由會(huì)從另一接口走掉，同樣很慢了就。地址段在今后逐漸補(bǔ)全。trace分析表明：基本上包都走對(duì)路了。而且速度比原來(lái) 單接口時(shí)訪問(wèn)其他isp網(wǎng)明顯加快了。
看過(guò)文章“如何實(shí)現(xiàn)Cisco雙出口策略"的人還看了：