分类： 系统运维
2008-05-25 00:00:58
SPAN>12.2(4)T以后路由器开始支持配置为移动终端
24.5. 反向隧道转发（Reverse-Tunnel Forwarding）
提问 强制所有数据包都通过隧道转发来避免网络中为了防止地址欺骗所定义的控制列表
回答
RouterMobile#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
RouterMobile(config)#ip mobile router
RouterMobile(mobile-router)#reverse-tunnel
RouterMobile(mobile-router)#exit
RouterMobile(config)#end
RouterMobile#
注释 由移动终端回程的数据包到了访问地代理后可能会通过本地路由而不是通过隧道转发回归属地代理，这样可能回违反访问地代理的安全策略，因此启用此特性来强制回程数据包也必须通过隧道转发，不过这个特性需要协商，验证：
RouterForeign#show ip mobile tunnel
Mobile Tunnels:
Tunnel0:
src 192.168.110.1, dest 192.168.9.1
encap IP/IP, mode reverse-allowed, tunnel-users 1
IP MTU 1480 bytes
Path MTU Discovery, mtu: 0, ager: 10 mins, expires: never
outbound interface Serial0/0
FA created, fast switching enabled, ICMP unreachable enabled
105 packets input, 8462 bytes, 0 drops
0 packets output, 0 bytes
RouterForeign#
24.6. 配置归属地代理HSRP支持来增加冗余性
提问 通过配置多个归属地代理来增加冗余
回答
RouterHome1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
RouterHome1(config)#interface FastEthernet0/0
RouterHome1(config-if)#ip address 192.168.9.2 255.255.255.0
RouterHome1(config-if)#standby 1 ip 192.168.9.1
RouterHome1(config-if)#standby 1 name HA-GROUP
RouterHome1(config-if)#exit
RouterHome1(config)#router mobile
RouterHome1(config-router)#exit
RouterHome1(config)#router eigrp 99
RouterHome1(config-router)#redistribute mobile
RouterHome1(config-router)#network 192.168.9.0
RouterHome1(config-router)#network 192.168.10.0
RouterHome1(config-router)#default-metric 10000 10 255 1 1500
RouterHome1(config-router)#no auto-summary
RouterHome1(config-router)#exit
RouterHome1(config)#ip mobile home-agent address 192.168.9.1
RouterHome1(config)#ip mobile home-agent redundancy HA-GROUP virtual-network
RouterHome1(config)#ip mobile virtual-network 192.168.10.0 255.255.255.0
RouterHome1(config)#ip mobile host 192.168.10.1 192.168.10.254 virtual-network 192.168.10.0 255.255.255.0
RouterHome1(config)#ip mobile secure home-agent 192.168.9.3 spi 100 key ascii cisco
RouterHome1(config)#ip mobile secure host 192.168.10.110 spi 100 key ascii cookbook
RouterHome1(config)#ip mobile secure host 192.168.10.111 spi 100 key ascii cookbook
RouterHome1(config)#ip mobile secure host 192.168.10.112 spi 100 key ascii cookbook
RouterHome1(config)#ip mobile secure host 192.168.10.113 spi 100 key ascii cookbook
RouterHome1(config)#ip mobile secure host 192.168.10.114 spi 100 key ascii cookbook
RouterHome1(config)#ip mobile secure host 192.168.10.115 spi 100 key ascii cookbook
RouterHome1(config)#end
RouterHome1#
RouterHome2#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
RouterHome2(config)#interface FastEthernet0/0
RouterHome2(config-if)#ip address 192.168.9.3 255.255.255.0
RouterHome2(config-if)#standby 1 ip 192.168.9.1
RouterHome2(config-if)#standby 1 name HA-GROUP
RouterHome2(config-if)#exit
RouterHome2(config)#router mobile
RouterHome2(config-router)#exit
RouterHome2(config)#router eigrp 99
RouterHome2(config-router)#redistribute mobile
RouterHome2(config-router)#network 192.168.9.0
RouterHome2(config-router)#network 192.168.10.0
RouterHome2(config-router)#default-metric 10000 10 255 1 1500
RouterHome2(config-router)#no auto-summary
RouterHome2(config-router)#exit
RouterHome2(config)#ip mobile home-agent address 192.168.9.1
RouterHome2(config)#ip mobile home-agent redundancy HA-GROUP virtual-network
RouterHome2(config)#ip mobile virtual-network 192.168.10.0 255.255.255.0
RouterHome2(config)#ip mobile host 192.168.10.1 192.168.10.254 virtual-network 192.168.10.0 255.255.255.0
RouterHome2(config)#ip mobile secure home-agent 192.168.9.2 spi 100 key ascii cisco
RouterHome2(config)#ip mobile secure host 192.168.10.110 spi 100 key ascii cookbook
RouterHome2(config)#ip mobile secure host 192.168.10.111 spi 100 key ascii cookbook
RouterHome2(config)#ip mobile secure host 192.168.10.112 spi 100 key ascii cookbook
RouterHome2(config)#ip mobile secure host 192.168.10.113 spi 100 key ascii cookbook
RouterHome2(config)#ip mobile secure host 192.168.10.114 spi 100 key ascii cookbook>RouterHome2(config)#ip mobile secure host 192.168.10.115 spi 100 key ascii cookbook
RouterHome2(config)#end
RouterHome2#
注释 使用HSRP的虚拟地址来作为归属地地址来增加冗余，另外多了ip mobile home-agent redundancy HA-GROUP virtual-network 命令来关联相应的HSRP组，同时需要配置两个归属地代理之间的认证来同步信息ip mobile secure home-agent 192.168.9.3 spi 100 key ascii cisco
