标签：ip add   use   隧道   int   with   out   终端   img   第二阶段测试   

组网及说明

组网说明：

本案例采用H3C HCL模拟器的F1060来模拟GRE ***典型组网配置。内网和外网在网络拓扑图中已经有了明确的标识。FW1与FW2分别为各自内网的出口设备，提供NAT地址转换的服务。为了内网1和内网2能穿越NAT及外网进行通信，因此采用GRE ***来实现。

配置步骤

按照网络拓扑图正确配置IP地址

FW1配置NAT，并配置默认路由指向ISP

FW2配置NAT，并配置默认路由指向ISP

FW1与FW2建立GRE ***隧道

配置关键点

第一阶段调试（基础网络配置）：

ISP：

<H3C>sys

System View: return to User View with Ctrl+Z.

[H3C]sysname ISP

[ISP]int gi 0/0

[ISP-GigabitEthernet0/0]des <connect to FW1>

[ISP-GigabitEthernet0/0]ip address 202.1.100.1 30

[ISP-GigabitEthernet0/0]quit

[ISP]int gi 0/1

[ISP-GigabitEthernet0/1]des <connect to FW2>

[ISP-GigabitEthernet0/1]ip address 202.2.100.1 30

[ISP-GigabitEthernet0/1]quit

FW1：

<H3C>sys

System View: return to User View with Ctrl+Z.

[H3C]sysname FW1

[FW1]int gi 1/0/3

[FW1-GigabitEthernet1/0/3]ip address 192.168.1.1 24

[FW1-GigabitEthernet1/0/3]quit

[FW1]acl basic 2000

[FW1-acl-ipv4-basic-2000]rule 0 permit source any

[FW1-acl-ipv4-basic-2000]quit

[FW1]int gi 1/0/2

[FW1-GigabitEthernet1/0/2]des <connect to ISP>

[FW1-GigabitEthernet1/0/2]ip address 202.1.100.2 30

[FW1-GigabitEthernet1/0/2]nat outbound 2000

[FW1-GigabitEthernet1/0/2]quit

[FW1]security-zone name Trust

[FW1-security-zone-Trust]import interface GigabitEthernet 1/0/3

[FW1-security-zone-Trust]quit

[FW1]security-zone name Untrust

[FW1-security-zone-Untrust]import interface GigabitEthernet 1/0/2

[FW1-security-zone-Untrust]quit

[FW1]ip route-static 0.0.0.0 0.0.0.0 202.1.100.1

[FW1]acl basic 2001

[FW1-acl-ipv4-basic-2001]rule 0 permit source any

[FW1-acl-ipv4-basic-2001]quit

[FW1]

[FW1]zone-pair security source trust destination untrust

[FW1-zone-pair-security-Trust-Untrust]packet-filter 2001

[FW1-zone-pair-security-Trust-Untrust]quit

[FW1]

[FW1]zone-pair security source untrust destination trust

[FW1-zone-pair-security-Untrust-Trust]packet-filter 2001

[FW1-zone-pair-security-Untrust-Trust]quit

[FW1]

[FW1]zone-pair security source trust destination local

[FW1-zone-pair-security-Trust-Local]packet-filter 2001

[FW1-zone-pair-security-Trust-Local]quit

[FW1]

[FW1]zone-pair security source local destination trust

[FW1-zone-pair-security-Local-Trust]packet-filter 2001

[FW1-zone-pair-security-Local-Trust]quit

[FW1]

[FW1]zone-pair security source untrust destination local

[FW1-zone-pair-security-Untrust-Local]packet-filter 2001

[FW1-zone-pair-security-Untrust-Local]quit

[FW1]

[FW1]zone-pair security source local destination untrust

[FW1-zone-pair-security-Local-Untrust]packet-filter 2001

[FW1-zone-pair-security-Local-Untrust]quit

FW2：

<H3C>sys

System View: return to User View with Ctrl+Z.

[H3C]sysname FW2

[FW2]int gi 1/0/3

[FW2-GigabitEthernet1/0/3]ip address 172.16.1.1 24

[FW2-GigabitEthernet1/0/3]quit

[FW2]acl basic 2000

[FW2-acl-ipv4-basic-2000]rule 0 permit source any

[FW2-acl-ipv4-basic-2000]quit

[FW2]int gi 1/0/2

[FW2-GigabitEthernet1/0/2]des <connect to ISP>

[FW2-GigabitEthernet1/0/2]ip address 202.2.100.2 30

[FW2-GigabitEthernet1/0/2]nat outbound 2000

[FW2-GigabitEthernet1/0/2]quit

[FW2]ip route-static 0.0.0.0 0.0.0.0 202.2.100.1

[FW2]security-zone name Trust

[FW2-security-zone-Trust]import interface GigabitEthernet 1/0/3

[FW2-security-zone-Trust]quit

[FW2]security-zone name Untrust

[FW2-security-zone-Untrust]import interface GigabitEthernet 1/0/2

[FW2-security-zone-Untrust]quit

[FW2]acl basic 2001

[FW2-acl-ipv4-basic-2001]rule 0 permit source any

[FW2-acl-ipv4-basic-2001]quit

[FW2]

[FW2]zone-pair security source trust destination untrust

[FW2-zone-pair-security-Trust-Untrust]packet-filter 2001

[FW2-zone-pair-security-Trust-Untrust]quit

[FW2]

[FW2]zone-pair security source untrust destination trust

[FW2-zone-pair-security-Untrust-Trust]packet-filter 2001

[FW2-zone-pair-security-Untrust-Trust]quit

[FW2]

[FW2]zone-pair security source trust destination local

[FW2-zone-pair-security-Trust-Local]packet-filter 2001

[FW2-zone-pair-security-Trust-Local]quit

[FW2]

[FW2]zone-pair security source local destination trust

[FW2-zone-pair-security-Local-Trust]packet-filter 2001

[FW2-zone-pair-security-Local-Trust]quit

[FW2]

[FW2]zone-pair security source untrust destination local

[FW2-zone-pair-security-Untrust-Local]packet-filter 2001

[FW2-zone-pair-security-Untrust-Local]quit

[FW2]

[FW2]zone-pair security source local destination untrust

[FW2-zone-pair-security-Local-Untrust]packet-filter 2001

[FW2-zone-pair-security-Local-Untrust]quit

第一阶段测试：

所有PC都填写IP地址：

内网1的终端仅能PING通内网2的外网地址，PING不通私网地址：

内网2的终端仅能PING通内网1的外网地址，PING不通私网地址：

第二阶段调试（GRE ***关键配置点：）

FW1：

[FW1]int Tunnel 0 mode gre

[FW1-Tunnel0]ip address 123.0.0.1 30

[FW1-Tunnel0]source 202.1.100.2

[FW1-Tunnel0]destination 202.2.100.2

[FW1-Tunnel0]quit

[FW1]ip route-static 172.16.1.0 255.255.255.0 123.0.0.2

[FW1]security-zone name Untrust

[FW1-security-zone-Untrust]import interface Tunnel 0

[FW1-security-zone-Untrust]quit

FW2：

[FW2]int Tunnel 0 mode gre

[FW2-Tunnel0]ip address 123.0.0.2 30

[FW2-Tunnel0]source GigabitEthernet 1/0/2

[FW2-Tunnel0]description 202.1.100.2

[FW2-Tunnel0]quit

[FW2]ip route-static 192.168.1.0 255.255.255.0 123.0.0.1

[FW2]security-zone name Untrust

[FW2-security-zone-Untrust]import interface Tunnel 0

[FW2-security-zone-Untrust]quit

第二阶段测试：

内网1和内网2的主机可以相互PING通

查看FW1和FW2的隧道状态均为UP：

查看FW1和FW2的路由表，均可看到隧道的路由：

至此，F1060 GRE ***典型组网配置案例已完成！

F1060 GRE ***典型组网配置案例

标签：ip add   use   隧道   int   with   out   终端   img   第二阶段测试   

原文地址：https://blog.51cto.com/15047492/2561220