ÖÐÎÄ
Äú¶©ÔĵIJúÆ·ÓиüР£¬Çëʵʱ²éÔÄ
Éó²éÏêÇé
ÖÐÎÄ
Äú¶©ÔĵIJúÆ·ÓиüР£¬Çëʵʱ²éÔÄ
Éó²éÏêÇé
Ðû²¼Ê±¼ä£º2013-09-12
µã»÷Á¿£º5042¹¦Ð§ÏÈÈÝ£º
MPLS VPN(ºóÃæ¼ò³ÆVPN)ÇéÐÎÖÐ £¬MCE½ÓÈëÊÇͨ¹ýVRFÀ´Çø·Ö²î±ðµÄVPNËíµÀ £¬¸÷¸öÍøÂçͨ¹ý²î±ðµÄVPNËíµÀ»¥·Ã £¬µÖ´ïÍøÂ绥·ÃµÄЧ¹û¡£
Ëæ×ÅMPLSÍøÂçÉú³¤ £¬²î±ðµÄÍøÂ绥·ÃµÄÐèÇó·ºÆð¡£ÓÉÓÚÔÚÍøÂçÍýÏë³õÆÚ £¬²¢·Çƾ֤ȫ¾Ö˼Á¿ÍýÏëÍøÂç £¬Ðí¶àÍøÂçÖб£´æIPµØÖ·³åÍ»¡£µ±ÕâЩÓû§ÐèÒª»á¼û¹«¹²×ÊÔ´µÄʱ¼ä»òÕßÏ໥»á¼ûµÄʱ¼ä¾Í»á·ºÆðµØÖ·³åÍ»¡£ÔÚ²»¸Ä±äÔÓÐÍøÂçÍýÏëµÄÌõ¼þÏ £¬ÒªÊµÏÖÍøÂ绥·Ã £¬ÌṩÊÖÒÕ½â¾ö¼Æ»®À´½â¾öµØÖ·³åÍ»µÄÎÊ¡£NATÊǽâ¾öµØÖ·³åÍ»µÄ×î¼òÆÓ·½·¨¡£
VRFϵÄNATÏÂÁîÚ¹ÊÍ£º
ip nat inside [vrf vrf_name] source list access-list-number pool address-pool [vrf vrf_name]
//Ç°Ò»¸öVRFÊÇÖ¸¶¨¸ÃÌõת»»ÏÂÁîÔÚÄĸöVRFÄÚÉúЧ £»ÈôÊDz»ÉèÖà £¬ËµÃ÷È«¾ÖÉúЧ £¬¼´¶ÔËùÓÐVRF¶¼ÉúЧ¡£
//ºóÒ»¸öVRFÊÇÖ¸¶¨¸ÃÌõת»»ÏÂÁî¾ÙÐеØַת»»ºó £¬ÊôÓÚËÈËVRF £¬¼´Ìøתµ½¸ÃVRF £¬°´¸ÃVRF·Óɱí·ÓÉ¡£
Ò»¡¢×éÍøÐèÇó
ʵÑéVRF NATÇ° £¬ÇëÏÈÔĶÁ”¿çVRF·ÓÉ“Õ½ڡ££¨µä·¶ÉèÖÃ--->IP·ÓÉ--->¿çVRF·ÓÉ£©
ÔÚ”¿çVRF·ÓÉ“°¸Àý»ù´¡ÉÏ £¬ÐÂÔöÌíÐèÇó £¬ÔÚPE1×°±¸ÉÏÍê³ÉNATת»»
¶þ¡¢×éÍøÍØÆË
Èý¡¢ÉèÖÃÒªµã
Êý¾Ý´«ÊäÊÇË«ÏòµÄ £¬ÎÒÃÇÐèҪͬʱ˼Á¿PC1µ½INTERNET¡¢INTERNETµ½PC1Ë«ÏòµÄ·ÓÉÁªÍ¨ÐÔ
PC1µ½INTERNETÆ«Ïò£º
ÐèÇóÊÇ£ºPC1ÐèÒª»á¼ûINTERNET £¬µ«³ýPC1ÒÔÍâµÄ·ÇVPNÓªÒµ²»¿É»á¼ûINTERNET¡£Òò´ËÐèÒªÔÚPE1µÄGI3/1/0Èë¿ÚÆ«ÏòʵÑé¿çVRFµÄÕ½ÂÔ·ÓÉ¡£Ö»ÔÊÐíPC1Íø¶Î¿çVRFת·¢ £¬ÆäËûÍø¶ÎÆÁÕÏ¡£
ͬʱÐèÒªÔÚPE1ÉÏÈ«¾Ö·ÓɱíÒýÈëĬÈÏ·ÓÉ £¬Ê¹µÃ¹«Íø·ÇVPNӪҵ·ÓÉÆ÷ÄÜѧµ½È¥ÍùINTERNETµÄĬÈÏ·ÓÉ¡£
INTERNETµ½PC1Æ«Ïò£º
²»ÐèÒªÌØÁíÍâ·ÓÉÉèÖà £¬ÓÉÓÚRSR·ÓÉÆ÷»ùÓÚÁ÷±í»úÖÆ £¬ÔÚÕýÏòNATת»»Á÷±íÐÎ³Éºó £¬×Ô¶¯ÊµÏÖVRFÌøת
ËÄ¡¢ÉèÖð취
¿çVRF·ÓÉÒ»Ñùƽ³£Ó¦ÓÃÔÚMPLS-VPNÍøÂçµÄPE×°±¸ÉÏ £¬µ«ÆäʵÖÊÊÇVRF¼äµÄÌøת £¬ºÍMPLSÎ޹ء£Òò´Ë±¾°¸ÀýÖв»Éæ¼°MPLS-VPNÉèÖá£
PE1ÉèÖãº
1¡¢»ù±¾Â·ÓÉÁ¬Í¨ÐÔÉèÖãº
ip vrf vpn1
interface GigabitEthernet 3/1/0
ip address 12.0.0.2 255.255.255.0
interface GigabitEthernet 3/1/1
ip vrf forwarding vpn1
ip address 23.0.0.2 255.255.255.0
interface Loopback 0
ip address 2.2.2.2 255.255.255.255
router ospf 1
network 2.2.2.2 0.0.0.0 area 0
network 12.0.0.2 0.0.0.0 area 0
default-information originate always
router ospf 10 vrf vpn1
redistribute static subnets
network 23.0.0.2 0.0.0.0 area 0
2¡¢PC1µ½INTERNETÆ«Ïò·ÓÉÕ½ÂÔ£¨Ê¹ÓÃÕ½ÂÔ·ÓÉ£©£º
route-map internet permit 10
match ip address 100
set vrf vpn1
ip access-list extended 100
10 permit ip 10.0.0.0 0.255.255.255 any
interface GigabitEthernet 3/1/0
ip policy route-map internet
3¡¢¿çVRF NAT£º
access-list 1 permit host 10.0.0.1
ip nat inside source list 1 interface gigabitEthernet 3/1/1 vrf vpn1
PE2ÉèÖãº
interface GigabitEthernet 0/0
ip ref
ip address 12.0.0.1 255.255.255.0
interface GigabitEthernet 0/1
ip ref
ip address 10.0.0.254 255.255.255.0
interface Loopback 0
ip ref
ip address 1.1.1.1 255.255.255.255
router ospf 1
network 1.1.1.1 0.0.0.0 area 0
network 10.0.0.0 0.0.0.255 area 0
network 12.0.0.1 0.0.0.0 area 0
INTERNET³ö¿Ú·ÓÉÆ÷ÉèÖãº
interface GigabitEthernet 0/0
ip ref
ip address 23.0.0.3 255.255.255.0
interface Loopback 0
ip ref
ip address 3.3.3.3 255.255.255.255
router ospf 1
redistribute static subnets
network 23.0.0.3 0.0.0.0 area 0
default-information originate
ip route 0.0.0.0 0.0.0.0 Loopback 0
Îå¡¢ÉèÖÃÑéÖ¤
1¡¢PC1¿ÉÒÔPINGͨINTERNET³ö¿Ú·ÓÉÆ÷3.3.3.3
PC1#ping 3.3.3.3
Sending 5, 100-byte ICMP Echoes to 3.3.3.3, timeout is 2 seconds:
< press Ctrl+C to break >
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/12/20 ms
2¡¢Í¨¹ýshow ip nat translationsÈ·ÈÏNATÓ³ÉäÊÇ·ñÀֳɡ£
ÎĵµÆÀ¼Û
