双ISP基于目的地址的策略路由（各位老大帮忙看看，谢谢！）

双ISP基于目的地址的策略路由（各位老大帮忙看看，谢谢！）

---

0、单路由器，双ISP接入，要实现内网访问外网自动选择网通或电信，外网访问内网服务器电信走电信，网通走网通。配置是在网上查了半天综合的，没有实践或实验呢还，帮我看看吧大家，谢谢！
1、内网用户访问外网：使用基于目的地址的策略路由可以实现访问网通站点走网通线路，访问电信站点走电信线路，可以实现分流。
2、外网用户访问内网的服务器：
邮件服务器上单网卡配置两个ip地址；路由器上对两个地址做NAT映射，
一个网通地址，一个电信地址，同时对www.**.org这个域名绑定两个公网IP地址，这样网通用户会找到网通地址，电信用户会找到电信地址。
例如外网电信用户访问时，直接找到邮件服务器的电信地址，邮件服务器回包时到路由器时会根据目的地址选择从电信线路出去。
3、如果电信链路损坏（这里指电信提供的互联地址不可达），则出去的数据从网通线路走，可以实现互为备份。
int g0/0 电信接口
ip add 219.142.*.*
ip nat outside

int g0/1 网通接口
ip add ***.***.***.**
ip nat outside

int g0/2
ip add 172.16.1.2
ip nat inside
ip policy route-map ctc

access-list 110 permit ip any **.*.0 0.255.255.255 "定义名字为110的ACL列表为电信地址段"
。。。
。。。
。。。
access-list 110 permit ip any **.*.0.0 0.255.255.255

route-map ctc permit 10
match ip address 110
set ip next-hop 219.142.*.*
set ip next-hop ***.***.***.**

route-map ctc permit 20
set ip next-hop ***.***.***.** “不符合目的地址为电信地址段的访问从网通出口出去"
set ip next-hop 219.142.*.*

ip nat inside source static 192.168.0.253 219.143.*.*（映射为电信地址）
ip nat inside source static 192.168.0.53 ***.***.***.**(映射为网通地址)
ip nat inside source list 1 interface FastEthernet0/0 overload
ip nat inside source list 2 interface FastEthernet0/1 overload

ip classless
ip route 0.0.0.0 0.0.0.0 219.143.18.109
ip route 0.0.0.0 0.0.0.0 ***.***.***.**
no ip http server

 

 

 

 

我在7206上的配置，测试情况暂时还可以，内网上网正常，外网访问内部服务器也正常，用trace跟踪出口的包，在route-map中的目的地址走电信，其它走网通也正常，因为还牵扯到别的设备测试也还没有完成，大家也帮我看看这个配置，是否还存在什么隐患，
谢谢~~
interface GigabitEthernet0/1接内网
ip address 172.16.2.2 255.255.255.0
ip nat inside
ip virtual-reassembly
ip policy route-map ctc
duplex auto
speed auto
media-type rj45
negotiation auto
!
interface FastEthernet0/2
no ip address
duplex auto
speed auto
!
interface GigabitEthernet0/2接电信
ip address A**.***.***.110 255.255.255.252
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
media-type rj45
negotiation auto
!
interface GigabitEthernet0/3接网通
ip address B**.***.***.14 255.255.255.252
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
media-type rj45
negotiation auto
!
ip route 0.0.0.0 0.0.0.0 B**.***.***.13
ip route 0.0.0.0 0.0.0.0 A**.***.***.109
ip route 172.16.1.0 255.255.255.0 172.16.2.1
ip route 192.168.0.0 255.255.0.0 172.16.2.1
ip route A**.***.***.0 255.255.255.224 172.16.2.1
no ip http server
no ip http secure-server
!
ip nat inside source route-map NAT_CNC interface GigabitEthernet0/2 overload
ip nat inside source route-map NAT_CTC interface GigabitEthernet0/3 overload
ip nat inside source static 192.168.0.1 A**.***.***.1
ip nat inside source static 192.168.0.2 A**.***.***.2
ip nat inside source static 192.168.0.3 A**.***.***.3
!
logging alarm informational
access-list 110 permit ip any 58.32.0.0 0.31.255.255
access-list 110 permit ip any 58.208.0.0 0.5.255.255
access-list 110 permit ip any 59.32.0.0 0.7.255.255
access-list 110 permit ip any 59.40.0.0 0.1.255.255
access-list 110 permit ip any 59.42.0.0 0.0.255.255
access-list 110 permit ip any 59.44.0.0 0.3.255.255
access-list 110 permit ip any 59.48.0.0 0.15.255.255
access-list 110 permit ip any 60.160.0.0 0.31.255.255
access-list 110 permit ip any 61.128.0.0 0.3.255.255
access-list 110 permit ip any 61.132.0.0 0.0.255.255
access-list 110 permit ip any 61.133.128.0 0.0.127.255
access-list 110 permit ip any 61.134.0.0 0.0.63.255
access-list 110 permit ip any 61.134.64.0 0.0.31.255
access-list 110 permit ip any 61.134.128.0 0.0.127.255
access-list 110 permit ip any 61.136.0.0 0.0.255.255
access-list 110 permit ip any 61.137.0.0 0.0.127.255
access-list 110 permit ip any 61.138.0.0 0.0.127.255
access-list 110 permit ip any 61.138.128.0 0.0.63.255
access-list 110 permit ip any 61.139.0.0 0.0.127.255
access-list 110 permit ip any 61.138.192.0 0.0.63.255
access-list 110 permit ip any 61.140.0.0 0.3.255.255
access-list 110 permit ip any 61.144.0.0 0.3.255.255
access-list 110 permit ip any 61.150.0.0 0.1.255.255
access-list 110 permit ip any 61.152.0.0 0.3.255.255
access-list 110 permit ip any 61.157.0.0 0.0.255.255
access-list 110 permit ip any 61.158.0.0 0.0.255.255
access-list 110 permit ip any 61.159.64.0 0.0.63.255
access-list 110 permit ip any 61.159.128.0 0.0.127.255
access-list 110 permit ip any 61.160.0.0 0.0.255.255
access-list 110 permit ip any 61.161.64.0 0.0.63.255
access-list 110 permit ip any 61.164.0.0 0.1.255.255
access-list 110 permit ip any 61.166.0.0 0.0.255.255
access-list 110 permit ip any 61.169.0.0 0.0.255.255
access-list 110 permit ip any 61.170.0.0 0.1.255.255
access-list 110 permit ip any 61.172.0.0 0.3.255.255
access-list 110 permit ip any 61.177.0.0 0.0.255.255
access-list 110 permit ip any 61.178.0.0 0.0.255.255
access-list 110 permit ip any 61.180.0.0 0.0.127.255
access-list 110 permit ip any 61.183.0.0 0.0.255.255
access-list 110 permit ip any 61.184.0.0 0.3.255.255
access-list 110 permit ip any 61.188.0.0 0.0.255.255
access-list 110 permit ip any 61.189.128.0 0.0.127.255
access-list 110 permit ip any 61.190.0.0 0.1.255.255
access-list 110 permit ip any 125.64.0.0 0.7.255.255
access-list 110 permit ip any 125.76.0.0 0.0.127.255
access-list 110 permit ip any 125.80.0.0 0.15.255.255
access-list 110 permit ip any 125.104.0.0 0.7.255.255
access-list 110 permit ip any 125.112.0.0 0.15.255.255
access-list 110 permit ip any 202.96.96.0 0.0.31.255
access-list 110 permit ip any 202.96.128.0 0.0.127.255
access-list 110 permit ip any 202.97.0.0 0.0.63.255
access-list 110 permit ip any 202.97.96.0 0.0.31.255
access-list 110 permit ip any 202.98.32.0 0.0.31.255
access-list 110 permit ip any 202.98.64.0 0.0.63.255
access-list 110 permit ip any 202.98.128.0 0.0.127.255
access-list 110 permit ip any 202.100.16.0 0.0.15.255
access-list 110 permit ip any 202.100.32.0 0.0.31.255
access-list 110 permit ip any 202.100.64.0 0.0.63.255
access-list 110 permit ip any 202.100.128.0 0.0.127.255
access-list 110 permit ip any 202.101.0.0 0.0.127.255
access-list 110 permit ip any 202.101.192.0 0.0.63.255
access-list 110 permit ip any 202.102.0.0 0.0.127.255
access-list 110 permit ip any 202.102.192.0 0.0.31.255
access-list 110 permit ip any 202.103.0.0 0.0.255.255
access-list 110 permit ip any 202.110.128.0 0.0.63.255
access-list 110 permit ip any 202.111.0.0 0.0.127.255
access-list 110 permit ip any 203.130.32.0 0.0.31.255
access-list 110 permit ip any 203.212.0.0 0.0.15.255
access-list 110 permit ip any 210.192.96.0 0.0.31.255
access-list 110 permit ip any 218.0.0.0 0.3.255.255
access-list 110 permit ip any 218.4.0.0 0.1.255.255
access-list 110 permit ip any 218.6.0.0 0.0.255.255
access-list 110 permit ip any 218.13.0.0 0.0.255.255
access-list 110 permit ip any 218.14.0.0 0.1.255.255
access-list 110 permit ip any 218.16.0.0 0.3.255.255
access-list 110 permit ip any 218.20.0.0 0.0.255.255
access-list 110 permit ip any 218.21.0.0 0.0.127.255
access-list 110 permit ip any 218.22.0.0 0.1.255.255
access-list 110 permit ip any 218.30.0.0 0.1.255.255
access-list 110 permit ip any 218.62.128.0 0.0.127.255
access-list 110 permit ip any 218.63.0.0 0.0.255.255
access-list 110 permit ip any 218.64.0.0 0.1.255.255
access-list 110 permit ip any 218.66.0.0 0.0.255.255
access-list 110 permit ip any 218.67.0.0 0.0.127.255
access-list 110 permit ip any 218.70.0.0 0.1.255.255
access-list 110 permit ip any 218.72.0.0 0.7.255.255
access-list 110 permit ip any 218.80.0.0 0.15.255.255
access-list 110 permit ip any 219.128.0.0 0.15.255.255
access-list 110 permit ip any 219.144.0.0 0.7.255.255
access-list 110 permit ip any 219.152.0.0 0.1.255.255
access-list 110 permit ip any 219.159.64.0 0.0.63.255
access-list 110 permit ip any 219.159.128.0 0.0.127.255
access-list 110 permit ip any 220.160.0.0 0.31.255.255
access-list 110 permit ip any 221.224.0.0 0.15.255.255
access-list 110 permit ip any 222.64.0.0 0.31.255.255
access-list 110 permit ip any 222.168.0.0 0.7.255.255
access-list 110 permit ip any 222.176.0.0 0.15.255.255
access-list 110 permit ip any 222.208.0.0 0.15.255.255
access-list 110 permit ip any 222.240.0.0 0.7.255.255
access-list 130 permit ip any any
!
route-map NAT_CNC permit 10
match interface GigabitEthernet0/2
!
route-map NAT_CTC permit 10
match interface GigabitEthernet0/3
!
route-map ctc permit 10
match ip address 110
set interface GigabitEthernet0/3 GigabitEthernet0/2
!
route-map ctc permit 20
match ip address 130
set interface GigabitEthernet0/2 GigabitEthernet0/3
!
end