上次试验没有完全成功,因为默认路由的问题导致ROUTE-MAP匹配有时会错乱。详细描述见:
这次试验利用了PBR,来控制精确的选择出口.思路:
利用PBR优先使用第一个可用接口,给每个PBR故意设置不同顺序
配置:
hostname r4
!
!
ip subnet-zero
!
!
!
!
!
!
interface Ethernet0/0
ip address 192.168.1.4 255.255.255.0
ip nat inside
ip policy route-map isp1-nextif
half-duplex
!
interface Ethernet0/1
ip address 192.168.2.4 255.255.255.0
ip nat inside
ip policy route-map isp2-nextif
half-duplex!
interface Ethernet0/2
no ip address
shutdown
half-duplex
!
interface Ethernet0/3
no ip address
shutdown
half-duplex
!
interface Serial1/0
ip address 10.0.0.1 255.255.255.0
no shu
ip nat outside
serial restart-delay 0
!
interface Serial1/1
ip address 20.0.0.1 255.255.255.0
no shu
ip nat outside
serial restart-delay 0
!
interface Serial1/2
no ip address
shutdown
serial restart-delay 0
!
interface Serial1/3
no ip address
shutdown
serial restart-delay 0
!
ip nat pool isp1 10.0.0.1 10.0.0.1 prefix-length 24
ip nat pool isp2 20.0.0.1 20.0.0.1 prefix-length 24
ip nat inside source route-map toisp1 pool isp1 overload
ip nat inside source route-map toisp1-2 pool isp2 overload
ip nat inside source route-map toisp2 pool isp2 overload
ip nat inside source route-map toisp2-1 pool isp1 overload
!这里需要注意,试验证明采用POOL时候,工作起来不是很正常
当我关闭ISP1所连的S1/0接口后
这个时候1网段的应该走ISP2接口,调试表明确实走了ISP2那个口
但是
这个时候NAT表里只容许1网段的转成ISP2的地址
2网段的数据包 报NAT失败 包被丢弃
NAT配置中将POOL改成使用接口,则无此问题
所以这里不要使用地址池,只能使用接口做NAT。
ip classless
ip route 0.0.0.0 0.0.0.0 10.0.0.3
ip route 0.0.0.0 0.0.0.0 20.0.0.5
!这个默认路由已经可以省略了,PBR优先于它。
ip http server
!
access-list 100 permit ip 192.168.1.0 0.0.0.255 any
access-list 101 permit ip 192.168.2.0 0.0.0.255 any
route-map toisp1 permit 10
match ip address 100
match interface Serial1/0
!
route-map toisp2 permit 10
match ip address 101
match interface Serial1/1
!
route-map toisp1-2 permit 10
match ip address 100
match interface Serial1/1
!
route-map toisp2-1 permit 10
match ip address 101
match interface Serial1/0
!
route-map isp2-nextif permit 10
match ip address 101
set interface s1/0 s1/1
!
route-map isp1-nextif permit 10
match ip address 100
set interface s1/1 s1/0
!利用PBR优先使用第一个可用接口的特性
!
!
!
line con 0
logging synchronous
line aux 0
line vty 0 4
login
!
end
测试中没发现其他什么问题,如有问题请留言,感谢。