Summary of the concept

This week, I watched an image of the sir's VPN video and decided to put all the knowledge points I saw into an experiment. So with the following topo, the original topo looked at 56cto and did not write the author. He deleted some of his requirements and added the requirements in the sir video.

650) this. width = 650; "onclick = 'window. open (" http://blog.51cto.com/viewpic.php? Refimg = "+ this. src) 'alt =" "border =" 0 "src =" http://www.bkjia.com/uploads/allimg/131227/033H23D0-0.jpg "/>

 

 

Requirement: configure the interface address and the OSPF 100 according to the following topology, and disable automatic summary.
R1 enables 172.16.0.1/24,172.16 .1.1/24,172.16 .2.1/24,172.16 .3.1/24;
R2 enables 2.2.2.2/24 Internet)
R3 enables 192.168.0.1/24,192.168 .1.1/24,192.168 .2.1/24,192.168 .3.1/24
R4 enabled 4.4.4/24
R5 enabled 5.5.5.5/24

1: DHCP service on R4 requires that the f0/0 addresses of R1 and R3 be automatically obtained.

2: R2, R4, and R5 can only receive a summary path of R1 and R3.

3: The bandwidth of S1/1 of R2 is changed to 700 K, and the hello-time of S1/0 interface of R2 is changed to 20 S. The Lo of R2 cannot send and receive any update of the OSPF route.

4: Make sure that the VPN of R2 can use a bandwidth of at least 70 KB at S1/1.

5

6: Both R1 and R3 release the default route to the loop. R2 also establishes the default route 0.0.0.0 on the Internet. At this time, there will be three default routes, with only one retained.

7: R5 is the Kerberos stub. Only direct connections are advertised.

8: It is required to telnet from r2to 5.5.5.5 of R5 and log on to R4.

9: Non-equivalent load balancing is required from R2 to R4

First, make the Initial Configuration:

Because each one is initial, too many, all are initial R1, and the rest are basically the same. Of course, if you need it, the following will attach all the configuration STEP Files

R1:

Router> en
Router # conf t
Router (config) # hoStname R1
R1 (config) # no ip domain lookup
R1 (config) # line console 0
R1 (config-line) # logging synchronous
R1 (config-line) # exec-timeout 0 0
R1 (config-line) # exit
R1 (config) # int s1/1
R1 (config-if) # ip address 12.1.1.2 255.255.255.252
R1 (config-if) # no shut
R1 (config-if) # int f0/0
R1 (config-if) # ip address dhcp
R1 (config-if) # no shut
R1 (config-if) # int lo 0
R1 (config-if) # ip address 172.16.0.1 255.255.255.0
R1 (config-if) # ip address 172.16.1.1 255.255.0 secondary
R1 (config-if) # ip address 172.16.2.1 255.255.255.0 secondary
R1 (config-if) # ip address 172.16.3.1 255.255.255.0 secondary
R1 (config-if) # exit
R1 (config) # router VPN 100
R1 (config-router) # network 12.1.1.0 0.0.3
R1 (config-router) # network 134.1.1.0 0.0.255
R1 (config-router) # network 172.16.0.0
R1 (config-router) # no auto-summary

R2 ~ R5

Then the first requirement:

1: DHCP service on R4 requires that the f0/0 addresses of R1 and R3 be automatically obtained:

R4 (config) # ip dhcp pool promisewell
R4 (dhcp-config) # network 134.1.1.0/24
R4 (dhcp-config) # dns-server 202.202.202.202
R4 (dhcp-config) # lease 1
R4 (dhcp-config) # exit
R4 (config) # ip dhcp excluded-address 134.1.1.4
R4 (config-if) # exit

R2 views the route table when the network is connected to the source node of the source node.

 

650) this. width = 650; "onclick = 'window. open (" http://blog.51cto.com/viewpic.php? Refimg = "+ this. src) 'alt =" "border =" 0 "src =" http://www.bkjia.com/uploads/allimg/131227/033H24315-1.jpg "/>

R5:

 

650) this. width = 650; "onclick = 'window. open (" http://blog.51cto.com/viewpic.php? Refimg = "+ this. src) 'alt =" "border =" 0 "src =" http://www.bkjia.com/uploads/allimg/131227/033H24035-2.jpg "/>

2: R2, R4, and R5 can only receive a summary path of R1 and R3.

R1 summarizes the two interfaces
R1 (config) # int s1/1
R1 (config-if) # ip summary-address VPN 100 172.16.0.1 255.255.252.0
R1 (config-if) # int f0/0
R1 (config-if) # ip summary-address VPN 100 172.16.0.1 255.255.252.0
R1 (config-if) # exit

R3 summarizes the two interfaces.
R3 (config) # int f0/0
R3 (config-if) # ip summary-address VPN 100 192.168.0.1 255.255.252.0
R3 (config-if) # int s1/0
R3 (config-if) # ip summary-address VPN 100 192.168.0.1 255.255.252.0
R3 (config-if) # exit

At this time, R2 will view the route table again.

650) this. width = 650; "onclick = 'window. open (" http://blog.51cto.com/viewpic.php? Refimg = "+ this. src) 'alt =" "border =" 0 "src =" http://www.bkjia.com/uploads/allimg/131227/033H23235-3.jpg "/>

The return addresses of R1 and R3 have been summarized.

Similarly, view the R5 route table:

650) this. width = 650; "onclick = 'window. open (" http://blog.51cto.com/viewpic.php? Refimg = "+ this. src) 'alt =" "border =" 0 "src =" http://www.bkjia.com/uploads/allimg/131227/033H23U9-4.jpg "/>

3: Change the S1/1 bandwidth of R2 to 700 K. Let's first look at the default bandwidth of s1/1:

650) this. width = 650; "onclick = 'window. open (" http://blog.51cto.com/viewpic.php? Refimg = "+ this. src) 'alt =" "border =" 0 "src =" http://www.bkjia.com/uploads/allimg/131227/033H21091-5.jpg "/>

Modify the BW value of s1/1
R2 # conf t
R2 (config) # int s1/1
R2. (config-if) # bandwidth 700

View the BW value of s1/1 again

 

650) this. width = 650; "onclick = 'window. open (" http://blog.51cto.com/viewpic.php? Refimg = "+ this. src) 'alt =" "border =" 0 "src =" http://www.bkjia.com/uploads/allimg/131227/033H2L21-6.jpg "/>

700 Kbit

At this time, check the R2 route table. The path to R5 is no longer loaded and there is only one route:

 

650) this. width = 650; "onclick = 'window. open (" http://blog.51cto.com/viewpic.php? Refimg = "+ this. src) 'alt =" "border =" 0 "src =" http://www.bkjia.com/uploads/allimg/131227/033H2GK-7.jpg "/>

Modify the hello-time of the S1/0 interface of R2 to 20 S. The Lo of R2 cannot send or receive any update of the OSPF route.

Modify the Hello-time. However, note that the Hello-time is modified here,
The hold-time must also be modified to maintain a three-fold relationship.
R2 (config) # int s1/0
R2 (config-if) # ip hello-interval Burundi 100 20
R2 (config-if) # ip hold-time glas100 60
R2 (config) # router VPN 100
R2 (config-router) # passive-interface loopback 0

4: Make sure that the VPN of R2 can use a bandwidth of at least 70 KB at S1/1.

R2 (config-if) # ip bandwidth-percent glas100 10
R2 (config-if) # exit

(By default, the traffic of the Protocol itself is only 50% of the reference bandwidth of the interface .)

5

Create R2 first:

Create a key string and apply it to the interface
R2 (config) # key chain cisco-r2
R2 (config-keychain) # key 1
R2 (config-keychain-key) # key-string 123456
R2 (config-keychain-key) # exit
R2 (config-keychain) # exit
R2 (config) # int s1/0
R2 (config-if) # ip authentication key-chain vintage 100 cisco-r2
R2 (config-if) # ip authentication mode Kerberos 100 md5
R2 (config-if) # exit

At this time, R1 has responded and the neighbor relationship has failed:

 

650) this. width = 650; "onclick = 'window. open (" http://blog.51cto.com/viewpic.php? Refimg = "+ this. src) 'alt =" "border =" 0 "src =" http://www.bkjia.com/uploads/allimg/131227/033H24S1-8.jpg "/>

R1 also creates a key ring:

R1: Create a key string and apply it to the interface
R1 (config) # key chain cisco-r1
R1 (config-keychain) # key 1
R1 (config-keychain-key) # key-string 123456
R1 (config-keychain-key) # exit
R1 (config-keychain) # exit
R1 (config) # int s1/1
R1 (config-if) # ip authentication key-chain vintage 100 cisco-r1
R1 (config-if) # ip authentication mode OSPF 100 md5

At this time, the relationship between R1 and R2 is restored.

 

650) this. width = 650; "onclick = 'window. open (" http://blog.51cto.com/viewpic.php? Refimg = "+ this. src) 'alt =" "border =" 0 "src =" http://www.bkjia.com/uploads/allimg/131227/033H23Z9-9.jpg "/>

Establish a neighbor between R1 and R2 without Multicast
R2 (config) # router VPN 100
R2 (config-router) # neighbor 12.1.1.2 s1/1 (peer address)

R1 (config) # router VPN 100
R1 (config-router) # neighbor 12.1.1.1 s1/1 (R2 address)

650) this. width = 650; "onclick = 'window. open (" http://blog.51cto.com/viewpic.php? Refimg = "+ this. src) 'alt =" "border =" 0 "src =" http://www.bkjia.com/uploads/allimg/131227/033H2G34-10.jpg "/>

 

6: Both R1 and R3 release the default route to the loop. R2 also establishes the default route 0.0.0.0 on the Internet. At this time, there will be three default routes, with only one retained.

First, use the default route of R3.

Note: There is only one way to publish the default route in the network. Unlike RIP, there are three methods.

R3 releases default routes
R3 (config) # ip default-network 192.168.0.0

R1 also creates a default route
R1 (config) # ip default-network 172.16.0.0
But the showR2 route does not appear.

 

650) this. width = 650; "onclick = 'window. open (" http://blog.51cto.com/viewpic.php? Refimg = "+ this. src) 'alt =" "border =" 0 "src =" http://www.bkjia.com/uploads/allimg/131227/033H25158-11.jpg "/>

Resummary
R1 (config) # int s1/1
R1 (config-if) # no ip summary-address VPN 100 172.16.0.1 255.255.252.0
R1 (config-if) # ip summary-address VPN 100 172.16.0.1 255.255.0.0
R1 (config-if) # int f0/0
R1 (config-if) # no ip summary-address VPN 100 172.16.0.1 255.255.252.0
R1 (config-if) # ip summary-address VPN 100 172.16.0.1 255.255.0.0
View the route of R2. Note: Because default-network can only publish master-class routes)

 

650) this. width = 650; "onclick = 'window. open (" http://blog.51cto.com/viewpic.php? Refimg = "+ this. src) 'alt =" "border =" 0 "src =" http://www.bkjia.com/uploads/allimg/131227/033H21X3-12.jpg "/>

R2 also establishes a default route to the Internet
R2 (config) # int s1/1
R2 (config-if) # ip summary-address VPN 100 0.0.0.0 0.0.0.0
R2 (config-if) # int s1/0
R2 (config-if) # ip summary-address VPN 100 0.0.0.0 0.0.0.0

Then, R5show ip ro will display three default routes.

 

650) this. width = 650; "onclick = 'window. open (" http://blog.51cto.com/viewpic.php? Refimg = "+ this. src) 'alt =" "border =" 0 "src =" http://www.bkjia.com/uploads/allimg/131227/033H215W-13.jpg "/>

This is definitely not the result of this network. Can a R5 router connect to 2.2.2.2 over the Internet?

 

650) this. width = 650; "onclick = 'window. open (" http://blog.51cto.com/viewpic.php? Refimg = "+ this. src) 'alt =" "border =" 0 "src =" http://www.bkjia.com/uploads/allimg/131227/033H26404-14.jpg "/>

I cannot get through it. In the case of Zhang sir, it's a failure...

At this time, create an access control on R4.
R4 (config) # access-list 1 permit 0.0.0.0 0.0.0.0
R4 (config) # router VPN 100
R4 (config-router) # default-information in 1

Note: After access control is established, You need to reset the neighbor relationship.

 

650) this. width = 650; "onclick = 'window. open (" http://blog.51cto.com/viewpic.php? Refimg = "+ this. src) 'alt =" "border =" 0 "src =" http://www.bkjia.com/uploads/allimg/131227/033H243P-15.jpg "/>

Then, view the R5 route table and ping 2.2.2.2 to test

650) this. width = 650; "onclick = 'window. open (" http://blog.51cto.com/viewpic.php? Refimg = "+ this. src) 'alt =" "border =" 0 "src =" http://www.bkjia.com/uploads/allimg/131227/033H24N8-16.jpg "/>

Yes, and there is only one default route, but you still need to perform access control on R2

R2 (config) # access-list 1 permit 0.0.0.0 0.0.0.0
R2 (config) # router VPN 100
R2 (config-router) # default-information in 1
R2 (config-router) # do cle ip eig nei
Check the R2 route. There is only one default route, and R5 does not need to be used.

7: R5 is the Kerberos stub. Only direct connections are advertised.

R5 stub
R5 (config) # router VPN 100
R5 (config-router) # Kerberos stub connected

Note: stub connected advertises direct connection routing)
Stub summary advertises a summary route. Only the summary route made locally can be transmitted.
Stub redistributed advertises the re-distribution route)
Stub static advertised static Routing)
Stub receive-only receives messages without notice)

8: It is required to telnet from r2to 5.5.5.5 of R5 and log on to R4.

Nat is used. It has nothing to do

R4 (config) # int s1/1
R4 (config-if) # ip nat inside
R4 (config-if) # int f0/0
R4 (config-if) # ip nat outside
R4 (config-if) # exit
R4 (config) # ip nat inside source static 4.4.4.4 5.5.5
 

Do not forget to enable telnet for R4. Otherwise, nat is useless if it is successful.
R4 (config) # line vty 0 4
R4 (config-line) # password 123
Test ......

 

650) this. width = 650; "onclick = 'window. open (" http://blog.51cto.com/viewpic.php? Refimg = "+ this. src) 'alt =" "border =" 0 "src =" http://www.bkjia.com/uploads/allimg/131227/033H220T-17.jpg "/>

9: Finally, EIRGP-specific non-equivalent load balancing

Although there is only one path in the routing table from R2 to R5, what about the topo table?

 

650) this. width = 650; "onclick = 'window. open (" http://blog.51cto.com/viewpic.php? Refimg = "+ this. src) 'alt =" "border =" 0 "src =" http://www.bkjia.com/uploads/allimg/131227/033H25Y6-18.jpg "/>

View the topo table of R2 and configure the variance value. For more information, see the theoretical section. You can also leave a message for me.
Roughly: FD of FS route <FD of best route (Successor) * Varince
R2 (config) # router VPN 100
R2 (config-router) # variance 2
R2 (config-router) # end
View the route table again:

 

650) this. width = 650; "onclick = 'window. open (" http://blog.51cto.com/viewpic.php? Refimg = "+ this. src) 'alt =" "border =" 0 "src =" http://www.bkjia.com/uploads/allimg/131227/033H2E38-19.jpg "/>

O (worker _ worker) O ~, Already appears

Look at the proportional relationship of non-equivalence

 

650) this. width = 650; "onclick = 'window. open (" http://blog.51cto.com/viewpic.php? Refimg = "+ this. src) 'alt =" "border =" 0 "src =" http://www.bkjia.com/uploads/allimg/131227/033H21529-20.jpg "/>

The ratio is 47: 80 700K chain hair 47 packages, 1.544M chain hair 80 packages, use debug to test

R2 (config) # access-list 100 permit icmp any
R2 # debug ip packet 100

Ping 5.5.5.5 ping 127 times,
Here, pay attention to whether R2 enables cef.

There are two types of Server Load balancer: fast switching and process switching ).

The destination-based switch between cef and ip route-cache is enabled.
Data Packet Exchange is not enabled between cef and ip route-cache.

Therefore, if you want to test the function, disable cef. Otherwise, debug will not work.

Finally, I would like to mention the following command for the kernel:

There is a default command for the Kerberos protocol.
R2 (config) # router VPN 100
R2 (config-router) # traffic-share balanced performs Load Balancing by default

If you change

R2 (config-router) # traffic-share min instances SS-interfaces
All paths are listed, but Server Load balancer is not performed.

650) this. width = 650; "onclick = 'window. open (" http://blog.51cto.com/viewpic.php? Refimg = "+ this. src) 'alt =" "border =" 0 "src =" http://www.bkjia.com/uploads/allimg/131227/033H22457-21.jpg "/>

Well, I can think of that much, but I 'd like to continue to improve the knowledge points of VPN in this experiment. If some friends can think of it, please help me add it. The following connections are available, attaches all the specific configuration of the R1-R5, as well as the GNS3 file. Of course, if you need it.

Http://down.51cto.com/data/152108

This article is from the "Recording learning" blog. For more information, contact the author!