RTR/SLA 在多ISP环境下下的应用--已经更新，切换后线路恢复时，已能自动恢复

如上图所示，我朋友一个项目，核心路由器是7206，然后接三个PIX535，分别用与移动、电信、网通的互联，业主要求选路优化、自动切换，我搭建了上图来模拟实际环境，其中，R7与R4，5，6之间放置一个交换机用于模拟由于光电收发器引起的以太网终结性。具体思路采用电信网络写静态路由，默认走移动，并在用RTR/SLA检测网络的可达性。对于IP规划，用172.16.xy.0/30来进行Rx与Ry互联，其中172.16.xy.1用于x.y里2个数字较小的路由器上，即：R3和R6的互联，R3端：172.16.36.1/30,R6端是172.16.36.2/30。另外：

172.16.14.0/30----模拟移动网络
172.16.25.0/30----模拟电信网络
172.16.36.0/30----模拟网通网络

------------实际情况里因为不知道移动的IP地址段，所以具体路由写电信和网通的，默认的写移动的。下面是一些关键步骤的讲解：
R4，R5，R6上的配置（以R4为例）
1、 配置NAT和路由
ip route 0.0.0.0 0.0.0.0 172.16.14.1---------指向移动端的IP
ip route 10.0.0.0 255.0.0.0 172.16.47.2---------回指，通信是双向的
int s1/0
ip nat out
int e0/0
ip nat in
access-list 1 permit 10.0.0.0 0.255.255.255
ip nat inside source list 1 inter s1/0 overload
2、 配置ACL-------------------------为什么要这样配置呢？实际情况中也是必须的，你猜猜
no access-list 100
access-list 100 deny icmp any host 172.16.25.1 log
access-list 100 deny icmp any host 172.16.36.1 log---log参数不需要，此处是为了观察实验效果
access-list 100 permit icmp any any 
int e0/0
ip access-group 100 in

R7上的配置
1、配置SLA
ip sla monitor 1--------建立监视组--监视移动端的IP
type echo protocol ipIcmpEcho 172.16.14.1 source-interface Loopback0---采用icmp协议来监视，即发出icmp echo包来探测对端的可达性，source-interface,指定探测数据的源IP，
timeout 999----999ms,不能大于frequency的值
frequency 1--------1s,即1s 发送一个
exit----------------下同
ip sla monitor 2--------建立监视组--监视电信端的IP
type echo protocol ipIcmpEcho 172.16.25.1 source-interface Loopback0
timeout 999
frequency 1
exit
ip sla monitor 3--------建立监视组--监视网通端的IP
type echo protocol ipIcmpEcho 172.16.36.1 source-interface Loopback0
timeout 999
frequency 1
exit
ip sla monitor schedule 1 life forever start-time now
ip sla monitor schedule 2 life forever start-time now
ip sla monitor schedule 3 life forever start-time now--------定义sla监视组的schedule,life ,forever,开始时间，now,看的懂的吧。
2、定义track组
track 111 rtr 1 reachability 
track 222 rtr 2 reachability 
track 333 rtr 3 reachability 
3、 写路由
ip route 0.0.0.0 0.0.0.0 172.16.47.1 name to_cmobile track 111---------------------------------①
ip route 0.0.0.0 0.0.0.0 172.16.57.1 name to_telecom track 222 22-----------------------------②
ip route 0.0.0.0 0.0.0.0 172.16.67.1 name to_cnc track 333 33----------------------------------③
ip route 172.16.25.0 255.255.255.252 172.16.57.1 name to_telecom track 222---------------④
ip route 172.16.36.0 255.255.255.252 172.16.67.1 name to_cnc track 333--------------------⑤
这里的路由是关键，路由写的好坏决定RTR/SLA能否真正发挥作用，下面对5条路由进行详细点评：
第①条：主默认路由，在网络正常的情况下，除电信网通的具体路由之外，都走移动这一条线路，Ad值是默认的1，并根据track组111的情况来决定是否将此路由放入到路由表中，即当移动端IP可达时，放入7206的路由表里。
第②条：指向电信的默认路由，AD为22，当移动链路失效时，TRACK111 time out,路由①消失，此时，路由②出现在7206的路由表里，保证网络的畅通并无路由黑洞。
第③条：和第二条一样，不同的是AD为33。
第④条：此条其实应该代表了一批静态路由，汇总后的CHINANET的路由大概有250条左右，并根据track组的状态来决定此一批静态路由是否出现在7206的路由表里。
第⑤条：和第四条一样，代表了大概160条网通路由。

4、 RTR跨三层监测的逻辑死循环
由于此case中，RTR监测组监测的是目标已经跨了三层，所以存在一个逻辑死循环，以R7--SW----R4---R1，为例，R7跨了R4在监测R1上与R4互连的端口，当检测到那个端口down掉之后，相关路由按计划的消失，但问题出现了，但移动的这根线路恢复时，
一方面：不考虑RTR/SLA，R7本身需要一条路由指向移动端的互联端口，或者静态，或者动态，此处为默认路由，没有这一条默认路由，就无法到达被监测的互联端口。
另一方面：移动的线路down掉之后，TRACK111监测组还一直在工作：他不断的还以R7的 L0的IP为源IP，向被监测的互联端口发送ICMP ECHO 探测包，只要结果是time out，路由器就不会把R4上的默认路由放入到路由表里。OK，逻辑死循环出现，路由器无法在物理线路回复后将流量回归。

5、 一个CISCO隐藏命令 RTR RESET
RTR RESET这里介绍一个关于RTR的隐藏命令：RTR RESET（CONFIG模式下），此命令的作用是讲SLA/RTR功能重置，并在将配置文件里关于SLA的配置去掉，用了此命令后，路由恢复、流量逐渐回归
6、 使用RESET之后的配置恢复
这个。。。好象没什么好讲的，最简单的是在特权模式下：config mem,将内存中的配置信息重新写入到NVRAM里的配置文件里。一切正常

对于死循环的解决方案：

对于此死循环的解决方案：在原配置中，为了ICMP ECHO REQUEST包到达被探测目的IP，是采用了默认路由或者与模拟ISP网段的几个路由，经鸟人小灰狼的提醒，把达到被探测目的IP写几条专门的路由，并且不track（的确也没track的必要），这样一但线路恢复，也不会因为死循环而致使探测包无法到达目的，相关配置就是增加以下三条路由：
ip route 172.16.14.1 255.255.255.255 172.16.47.1 name rtr-cnc 
ip route 172.16.25.1 255.255.255.255 172.16.57.1 name rtr-cm
ip route 172.16.36.1 255.255.255.255 172.16.67.1 name rtr-telecom

7、 上面R4，R5，R6上的那些ACL是干什么的？
ISP之间是互联互通的，如果不用这些ACL deny掉相关的ICMP包，将会引起网络的不端的震荡。
我们还是以R4为例来说明，假设移动的线路断掉了，那原来的默认路由消失，去电信的AD为22的静态路由出现在路由表里，此时，SLA MONITOR 1的ICMP ECHO包通过此条默认路由，跨越ISP，到达了移动端的IP，这样一来，TRACK 111 返回的给路由器的信息就是OK,那么原先AD为1的路由取代了AD为22的默认路由出现在了路由表里，接着，SLA在路由收敛完成，CEF表重写完毕后，SLA MOTITOR 1 发出的ICMP ECHO包又time out了，因为实际上移动进来的线路是断开着的…………于是网络开始大震荡,震荡的比西门大官人的床还要厉害。

附配置：

R1(config-if)#do sh ru 
Building configuration...

Current configuration : 1063 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip subnet-zero
!
!
no ip domain lookup
!
!
!
!
! 
interface Loopback0
ip address 11.11.11.1 255.255.255.255
!
interface Serial1/0
ip address 172.16.14.1 255.255.255.252
serial restart-delay 0
no fair-queue
!
interface Serial1/1
ip address 172.16.12.1 255.255.255.252
serial restart-delay 0
!
interface Serial1/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/3
no ip address
shutdown
serial restart-delay 0
!
router ospf 100
log-adjacency-changes
network 11.11.11.1 0.0.0.0 area 0
network 172.16.12.0 0.0.0.3 area 0
network 172.16.14.0 0.0.0.3 area 0
!
ip http server
ip classless
!
!
!
line con 0
exec-timeout 0 0
line aux 0
line vty 0 4
login
!
!
! 
end

===================================================

R2#do sh run 
^
% Invalid input detected at '^' marker.

R2#sh run 
Building configuration...

Current configuration : 1078 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R2
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip subnet-zero
!
!
no ip domain lookup
!
!
!
!
! 
interface Loopback0
ip address 22.22.22.1 255.255.255.255
!
interface Serial1/0
ip address 172.16.12.2 255.255.255.252
serial restart-delay 0
no fair-queue
!
interface Serial1/1
ip address 172.16.23.1 255.255.255.252
serial restart-delay 0
!
interface Serial1/2
ip address 172.16.25.1 255.255.255.252
serial restart-delay 0
!
interface Serial1/3
no ip address
shutdown
serial restart-delay 0
!
router ospf 100
log-adjacency-changes
network 22.22.22.1 0.0.0.0 area 0
network 172.16.12.0 0.0.0.3 area 0
network 172.16.23.0 0.0.0.3 area 0
network 172.16.25.0 0.0.0.3 area 0
!
ip http server
ip classless
!
!
!
line con 0
exec-timeout 0 0
line aux 0
line vty 0 4
login
!
!
!
end 
=========================================================

r3#sh run 
Building configuration...

Current configuration : 1063 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R3
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip subnet-zero
!
!
no ip domain lookup
!
!
!
!
! 
interface Loopback0
ip address 33.33.33.1 255.255.255.255
!
interface Serial1/0
ip address 172.16.23.2 255.255.255.252
serial restart-delay 0
no fair-queue
!
interface Serial1/1
ip address 172.16.36.1 255.255.255.252
serial restart-delay 0
!
interface Serial1/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/3
no ip address
shutdown
serial restart-delay 0
!
router ospf 100
log-adjacency-changes
network 33.33.33.1 0.0.0.0 area 0
network 172.16.23.0 0.0.0.3 area 0
network 172.16.36.0 0.0.0.3 area 0
!
ip http server
ip classless
!
!
!
line con 0
exec-timeout 0 0
line aux 0
line vty 0 4
login
!
!
! 
end
===========================================================

R4(config-if)#do sh run 
Building configuration...

Current configuration : 1360 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R4
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip subnet-zero
!
!
no ip domain lookup
!
!
!
!
! 
interface Loopback0
ip address 44.44.44.1 255.255.255.255
!
interface Ethernet0/0
ip address 172.16.47.1 255.255.255.252
ip access-group 100 in
ip nat inside
full-duplex
!
interface Ethernet0/1
no ip address
shutdown
half-duplex
!
interface Ethernet0/2
no ip address
shutdown
half-duplex
!
interface Ethernet0/3
no ip address
shutdown
half-duplex
!
interface Serial1/0
ip address 172.16.14.2 255.255.255.252
ip nat outside
serial restart-delay 0
no fair-queue
!
interface Serial1/1
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/3
no ip address
shutdown
serial restart-delay 0
!
ip nat inside source list 1 interface Serial1/0 overload
ip http server
ip classless
ip route 0.0.0.0 0.0.0.0 172.16.14.1
ip route 10.0.0.0 255.0.0.0 172.16.47.2
!
!
access-list 1 permit 10.0.0.0 0.255.255.255
access-list 100 deny icmp any host 172.16.25.1 log
access-list 100 deny icmp any host 172.16.36.1 log
access-list 100 permit icmp any any
!
line con 0
exec-timeout 0 0
line aux 0
line vty 0 4
login
!
!
!
end

===========================================================

R5(config-if)#do sh run 
Building configuration...

Current configuration : 1385 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R5
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip subnet-zero
!
!
no ip domain lookup
!
!
!
!
! 
interface Loopback0
ip address 55.55.55.1 255.255.255.255
!
interface Ethernet0/0
ip address 172.16.57.1 255.255.255.252
ip access-group 100 in
ip access-group 100 out
ip nat inside
full-duplex
!
interface Ethernet0/1
no ip address
shutdown
half-duplex
!
interface Ethernet0/2
no ip address
shutdown
half-duplex
!
interface Ethernet0/3
no ip address
shutdown 
half-duplex
!
interface Serial1/0
no ip address
shutdown
serial restart-delay 0
no fair-queue
!
interface Serial1/1
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/2
ip address 172.16.25.2 255.255.255.252
ip nat outside
serial restart-delay 0
!
interface Serial1/3
no ip address
shutdown
serial restart-delay 0
! 
ip nat inside source list 1 interface Serial1/2 overload
ip http server
ip classless
ip route 0.0.0.0 0.0.0.0 172.16.25.1
ip route 10.0.0.0 255.0.0.0 172.16.57.2
!
!
access-list 1 permit 10.0.0.0 0.255.255.255
access-list 100 deny icmp any host 172.16.14.1 log
access-list 100 deny icmp any host 172.16.36.1 log
access-list 100 permit icmp any any
!
line con 0
exec-timeout 0 0
line aux 0
line vty 0 4
login
!
!
!
end

===================================================================

R6(config-if)#do sh run 
Building configuration...

Current configuration : 1396 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R6
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip subnet-zero
!
!
no ip domain lookup
!
!
!
!
! 
interface Loopback0
ip address 66.66.66.1 255.255.255.255
!
interface Ethernet0/0
ip address 172.16.67.1 255.255.255.252
ip access-group 100 in
ip nat inside
full-duplex
!
interface Ethernet0/1
no ip address
shutdown
half-duplex
!
interface Ethernet0/2
no ip address
shutdown
half-duplex
!
interface Ethernet0/3
no ip address
shutdown
half-duplex
!
interface Serial1/0
no ip address
ip nat outside
shutdown
serial restart-delay 0
no fair-queue
!
interface Serial1/1
ip address 172.16.36.2 255.255.255.252
ip nat outside
serial restart-delay 0
!
interface Serial1/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/3
no ip address
shutdown
serial restart-delay 0
! 
ip nat inside source list 1 interface Serial1/1 overload
ip http server
ip classless
ip route 0.0.0.0 0.0.0.0 172.16.36.1
ip route 10.0.0.0 255.0.0.0 172.16.67.2
!
!
access-list 1 permit 10.0.0.0 0.255.255.255
access-list 100 deny icmp host 10.0.0.1 host 172.16.14.1 log
access-list 100 deny icmp host 10.0.0.1 host 172.16.25.1 log
access-list 100 permit icmp any any
!
line con 0
exec-timeout 0 0
line aux 0
line vty 0 4
login
!
!
!
end

=======================================================================

R7#sh run 
Building configuration...

Current configuration : 1752 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R7
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
!
!
ip cef
no ip domain lookup
7#sh run 
Building configuration...

Current configuration : 1752 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R7
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
!
!
ip cef
no ip domain lookup
!
!
ip sla monitor 1
type echo protocol ipIcmpEcho 172.16.14.1 source-interface Loopback0
timeout 999
frequency 1
ip sla monitor schedule 1 life forever start-time now
ip sla monitor 2
type echo protocol ipIcmpEcho 172.16.25.1 source-interface Loopback0
timeout 999
frequency 1
ip sla monitor schedule 2 life forever start-time now
ip sla monitor 3
type echo protocol ipIcmpEcho 172.16.36.1 source-interface Loopback0
timeout 999
frequency 1
ip sla monitor schedule 3 life forever start-time now
!
!
track 111 rtr 1 reachability
!
track 222 rtr 2 reachability
!
track 333 rtr 3 reachability
! 
!
!
!
!
interface Loopback0
ip address 10.0.0.1 255.255.255.0
!
interface Ethernet0/0
ip address 172.16.47.2 255.255.255.252
full-duplex
!
interface Ethernet0/1
ip address 172.16.57.2 255.255.255.252
full-duplex
!
interface Ethernet0/2
ip address 172.16.67.2 255.255.255.252
full-duplex
!
interface Ethernet0/3
no ip address
shutdown
half-duplex
!
ip http server
no ip http secure-server
ip route 0.0.0.0 0.0.0.0 172.16.47.1 name to_cmobile track 111
ip route 0.0.0.0 0.0.0.0 172.16.57.1 22 name to_telecom track 222
ip route 172.16.25.0 255.255.255.252 172.16.57.1 name to_telecom track 222
ip route 0.0.0.0 0.0.0.0 172.16.67.1 33 name to_cnc track 333
ip route 172.16.36.0 255.255.255.252 172.16.67.1 name to_cnc track 333
ip route 172.16.14.1 255.255.255.255 172.16.47.1 name rtr-cnc 
ip route 172.16.25.1 255.255.255.255 172.16.57.1 name rtr-cm
ip route 172.16.36.1 255.255.255.255 172.16.67.1 name rtr-telecom 
!
!
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
!
line con 0
exec-timeout 0 0
line aux 0
line vty 0 4
login
!
! 
end
 

本文转自q狼的诱惑 51CTO博客，原文链接：http://blog.51cto.com/liangrui/520517，如需转载请自行联系原作者