×××-gre隧道H3C篇

2023-01-31 03:01:30

【实验拓扑】

【实验目的】

 ×××隧道技术,通过一个公用网络(通常是因特网)建立一个临时的、安全的连接,是一条穿过混乱的公用网络的安全、稳定的隧道.

有基于二层(pptp/l2tp/l2f)和三层(gre/ipsec)的×××隧道技术

今天在H3C防火墙上利用三层的gre协议,实现总公司和分公司的通信。

【实验设备】

 H3C防火墙两台(模拟总/分公司的出口路由器)

 H3C三层交换机(模拟Internet网络环境)

 测试PC两台(总、分公司内网主机)

【配置过程】

 Step1:进入三层交换机,划分两个Vlan(10、20),分别配以公网 

IP,分别作为Intetnet两个边界入口。 

 Step2:分别进入两台H3C防火墙的Eth0/0,配以地址,作为总、分公司的网关参数。 

 Step3:分别进入两台H3C防火墙的Eth0/4,配以公网IP地址,作为内网访问Inetnet的出口。

 Step4:在两台防火墙上分别创建隧道接口,隧道协议选择gre。

【配置参考】

FW-1

interface Ethernet0/0

ip address 192.168.101.254 255.255.255.0

interface Ethernet0/4    

ip address 61.130.130.1 255.255.255.252 

interface Tunnel10                                                                                          

ip address 192.168.4.1 255.255.255.0                                                                       

source 61.130.130.1                                                                                        

destination 61.130.132.1                                                                                

firewall zone trust                                                                                         

add interface Ethernet0/0                                                                                  

set priority 85

firewall zone untrust                                                                                       

add interface Ethernet0/4                                                                                  

add interface Tunnel10                                                                                     

set priority 5

rip                                                                                                         

network 192.168.101.0                                                                                      

network 192.168.4.0                                                                                   

ip route-static 0.0.0.0 0.0.0.0 61.130.130.2 preference 60                                                 

FW-2

interface Ethernet0/0

ip address 192.168.102.254 255.255.255.0 

interface Ethernet0/4    

ip address 61.130.132.1 255.255.255.252

interface Tunnel20                                                                                          

ip address 192.168.4.2 255.255.255.0                                                                       

source 61.130.130.1                                                                                        

destination 61.130.130.1                                                                             

firewall zone trust                                                                                         

add interface Ethernet0/0                                                                                  

set priority 85                                                                                      

firewall zone untrust                                                                                       

add interface Ethernet0/4                                               

add interface Tunnel10                                                                                     

set priority 5                                                                                       

rip                                                                                                         

network 192.168.102.0                                                                                      

network 192.168.4.0                                                                                        ip route-static 0.0.0.0 0.0.0.0 61.130.132.2 preference 60                                                 

SW(SIP)

sysname ISP                                                                 

vlan 1                                                                           

vlan 10                                                                       

vlan 20                                                               

interface Vlan-interface10 

ip address 61.130.130.2 255.255.255.252                     

interface Vlan-interface20

ip address 61.130.132.2 255.255.255.252                         

interface Ethernet0/1 

port access vlan 10                                            

interface Ethernet0/2 

port access vlan 20 

#                                                           

【验证分析】

FW-1路由表

FW-2路由表

FW-2上ping测试

分公司主机ping测试

相关文章