Cisco双ISP双链路NAT接入案例-阿里云开发者社区

Cisco双ISP双链路NAT接入案例

2022-12-17 266

版权

本文内容由阿里云实名注册用户自发贡献，版权归原作者所有，阿里云开发者社区不拥有其著作权，亦不承担相应法律责任。具体规则请查看《阿里云开发者社区用户服务协议》和《阿里云开发者社区知识产权保护指引》。如果您发现本社区中有涉嫌抄袭的内容，填写侵权投诉表单进行举报，一经查实，本社区将立刻删除涉嫌侵权内容。

本文涉及的产品

公网NAT网关，每月750个小时 15CU

简介： Cisco双ISP双链路NAT接入案例

一、实验拓扑：

二、需求概述：

R1、R2作为本地网络12.0.0.0/24、21.0.0.0/24的网关，为连接远端R5上的网段5.0.0.0/24，分别向两个ISP（ISP1、ISP2）申请了1条Internet线路。R3、R4分别给R1、R2一个独立的公网地址（R3分配R1：13.0.0.1、分配R2：13.0.0.2；R4分配R1：14.0.0.1、分配R2：24.0.0.2）。由于R1、R2为Stub AS，故考虑使用浮动静态路由+负载均衡的方式对外访问。其中R1主路由下一跳指向R3 e0/0；R2主路由下一跳指向R4 e0/1。

三、实现方法：

双ISP双线接入时，网关所使用的nat内部全局地址应为所选线路对应的IP地址（或者该端口所对应的pool）。由于不同ISP有各自对应的出端口，NAT为使用不同的ISP地址段，内部本地地址池除了要判断本地Vlan的地址外，还要判断所选路由对应出接口。所以这里要使用到route-map针对源地址和出端口进行筛选。而判断出端口的任务，就交由带track的浮动静态路由实现。

四、配置过程：

R1:

track 3 ip sla 3
track 4 ip sla 4
track 50 ip route 5.0.0.0 255.255.255.0  reachability
interface e0/2
 ip address 13.0.0.1 255.255.255.0
 ip nat outside
interface e0/3
 ip address 14.0.0.1 255.255.255.0
 ip nat outside
interface e0/0
 ip address 12.0.0.1 255.255.255.0
 ip nat inside
 standby 12 ip 12.0.0.254
 standby 12 priority 150
 standby 12 preempt
 standby 12 track 50 decrement 100
interface e0/1
 ip address 21.0.0.1 255.255.255.0
 ip nat inside 
 standby 21 ip 21.0.0.254
 standby 21 preempt
 standby 21 track 50 decrement 100
ip nat inside source route-map TO_R3_NAT interface e0/2 overload
ip nat inside source route-map TO_R4_NAT interface e0/3 overload
ip route 5.0.0.0 255.255.255.0 13.0.0.3 50 track 3
ip route 5.0.0.0 255.255.255.0 14.0.0.4 100 track 4
ip access-list standard VLAN_12
permit 12.0.0.0 0.0.0.255
ip access-list standard VLAN_21
permit  21.0.0.0  0.0.0.255
ip sla 3
  icmp-echo 13.0.0.3
 exit
ip sla schedule 3 life forever start-time now
ip sla 4
  icmp-echo 14.0.0.4
  exit
ip sla schedule 4 life forever start-time now
route-map TO_R3_NAT permit 10
  match ip address  VLAN_12 VLAN_21
  match  interface  e0/2
route-map TO_R4_NAT permit 10
 match ip address VLAN_12 VLAN_21
  match interface e0/3

R2：

track 3 ip sla 3
track 4 ip sla 4
track 50 ip route 5.0.0.0 255.255.255.0 reachability
interface Loopback 0
 ip address 2.2.2.2  255.255.255.255
interface e0/2
  ip address  23.0.0.2  255.255.255.0
  ip  nat  outside
  no shut
interface  e0/3
  ip  address  24.0.0.2  255.255.255.0
  ip  nat  outside
  no shut
interface e0/1
  ip  address 12.0.0.2  255.255.255.0
  ip  nat  inside
  standby 12 preempt
  standby 12 ip  12.0.0.254
  standby 12  track  50  decrement  100
  no shut
interface e0/0
  ip  address  21.0.0.2  255.255.255.0
  ip  nat  inside
  standby  21  ip  21.0.0.254
  standby  21  priority  150
  standby  21  preempt
  standby  21  track  50  decrement  100
  no shut
ip nat  inside source route-map TO_R3_NAT interface e0/2 overload
ip nat  inside source route-map TO_R4_NAT interface e0/3 overload
ip route 5.0.0.0 255.255.255.0 23.0.0.3 100 track 3
ip route 5.0.0.0 255.255.255.0 24.0.0.4 50 track 4
ip access-list standard VLAN_12
 permit 12.0.0.0 0.0.0.255
 exit
ip access-list standard  VLAN_21 
 permit 21.0.0.0 0.0.0.255
ip sla 3
 icmp-echo 23.0.0.3
 exit
ip sla schedule 3 life forever start-time now
ip sla 4
icmp-echo 24.0.0.4
exit
ip sla schedule 4 life forever start-time now
route-map TO_R3_NAT permit 10
  match ip address VLAN_12 VLAN_21
  match interface e0/2
route-map TO_R4_NAT permit 10
 match ip address VLAN_12 VLAN_21
 match interface e0/3

R3:

interface Loopback 0
  ip  address  3.3.3.3  255.255.255.255
interface e0/0
  ip  address 13.0.0.3 255.255.255.0
  no shut
interface e0/1
  ip  address  23.0.0.3 255.255.255.0
  no shut
interface S1/0
  ip  address  35.0.0.3  255.255.255.0
  encapsulation  ppp
  no shut
  exit
router eigrp  12345
  passive-interface  e0/0
  passive-interface  e0/1
  passive-interface  Loopback 0
  network  3.3.3.3  0.0.0.0
  network  13.0.0.3  0.0.0.0
  network 23.0.0.3  0.0.0.0
  network 35.0.0.3  0.0.0.0
  eigrp  router-id  3.3.3.3

R4:

interface Loopback 0
 ip address 4.4.4.4 255.255.255.255
interface e0/0
 ip address 14.0.0.4 255.255.255.0
 no shut 
interface e0/1
 ip address 24.0.0.4 255.255.255.0
 no shut
interface S1/0
  ip address 45.0.0.4 255.255.255.0
  encapsulation ppp
  no shut
  exit 
router eigrp 12345 
 passive-interface e0/0
 passive-interface e0/1
 passive-interface Loopback 0
 network 4.4.4.4 0.0.0.0
 network 14.0.0.4 0.0.0.0
 network 24.0.0.4 0.0.0.0
 network 45.0.0.4 0.0.0.0
 eigrp router-id 4.4.4.4

R5:

interface Loopback 0
  ip address 5.5.5.5 255.255.255.255
interface Loopback 1
  ip address 5.0.0.1 255.255.255.0
interface Serial1/0
 ip address 35.0.0.5 255.255.255.0
 encapsulation ppp
 no shut
interface Serial1/1
  ip address 45.0.0.5 255.255.255.0
  encapsulation ppp
  no shut
  exit
router eigrp 12345
  passive-interface Loopback 0
  passive-interface Loopback 1
  network 5.0.0.1 0.0.0.0
  network 5.5.5.5 0.0.0.0
  network 35.0.0.5 0.0.0.0
  network 45.0.0.5 0.0.0.0
  eigrp router-id 5.5.5.5