CISCO 策略路由(PBR)配置实例
策略路由配置详解
38策略路由配置理解策略路由策略路由概述策略路由〔PBR：Policy-Based Routing〕提供了一种比基于目的地址进展路由转发更加灵敏的数据包路由转发机制。
策略路由可以根据IP/IPv6报文源地址、目的地址、端口、报文长度等内容灵敏地进展路由选择。
现有用户网络，常常会出现使用到多个ISP〔Internet Server Provider，Internet效劳提供商〕资源的情形，不同ISP申请到的带宽不一；同时，同一用户环境中需要对重点用户资源保证等目的，对这局部用户不可以再根据普通路由表进展转发，需要有选择的进展数据报文的转发控制，因此，策略路由技术即可以保证ISP资源的充分利用，又可以很好的满足这种灵敏、多样的应用。
IP/IPv6策略路由只会对接口接收的报文进展策略路由，而对于从该接口转发出去的报文不受策略路由的控制；一个接口应用策略路由后，将对该接口接收到的所有包进展检查，不符合路由图任何策略的数据包将按照普通的路由转发进展处理，符合路由图中某个策略的数据包就按照该策略中定义的操作进展转发。
一般情况下，策略路由的优先级高于普通路由，可以对IP/IPv6报文根据定义的策略转发；即数据报文先按照IP/IPv6策略路由进展转发，假如没有匹配任意一个的策略路由条件，那么再按照普通路由进展转发。
用户也可以配置策略路由的优先级比普通路由低，接口上收到的IP/IPv6报文那么先进展普通路由的转发，假如无法匹配普通路由，再进展策略路由转发。
用户可以根据实际情况配置设备转发形式，如选择负载平衡或者冗余备份形式，前者设置的多个下一跳会进展负载平衡，还可以设定负载分担的比重；后者是应用多个下一跳处于冗余形式，即前面优先生效，只有前面的下一跳无效时，后面次优的下一跳才会生效。
用户可以同时配置多个下一跳信息。
策略路由可以分为两种类型：一、对接口收到的IP报文进展策略路由。
该类型的策略路由只会对从接口接收的报文进展策略路由，而对于从该接口转发出去的报文不受策略路由的控制；二、对本设备发出的IP报文进展策略路由。
Cisco基于策略路由的配置实例
问题描述您可以定义自己的规则来进行数据包的路由而不仅仅由目的地地址所决定。
在这里您可以学到怎么使用基于策略路由的办法来解决这一问题。
在具体的应用中，基于策略的路由有：☆基于源IP地址的策略路由☆基于数据包大小的策略路由☆基于应用的策略路由☆通过缺省路由平衡负载这里，讲述了第一种情况的路由策略。
举例在这个例子中，防火墙的作用是：把10.0.0.0/8内部网地址翻译成可路由的172.16 .255.0/24子网地址。
下面的防火墙配置是为了完整性而加进去的，它不是策略路由配置所必需的。
在这里的防火墙可以被其它类似的产品代替，如PIX或其它类似防火墙设备。
这里的防火墙的配置如下：!ip nat pool net-10 172.16.255.1 172.16.255.254 prefix-length 24ip nat inside source list 1 pool net-10!interface Ethernet0ip address 172.16.20.2 255.255.255.0ip nat outside!interface Ethernet1ip address 172.16.39.2 255.255.255.0ip nat inside!router eigrp 1redistribute staticnetwork 172.16.0.0default-metric 10000 100 255 1 1500!ip route 172.16.255.0 255.255.255.0 Null0access-list 1 permit 10.0.0.0 0.255.255.255!end在我们的例子中，Cisco WAN路由器上运行策略路由来保证从10.0.0.0/8网络来的P数据包被发送到防火墙去。
配置中定义了两条net-10策略规则。
第一条策略就定义了从10.0.0.0/8网络来的IP数据包被发送到防火墙去（我们很快会看到这里的配置有问题）。
策略路由(PBR).
R1(config)#route-map PBR permit 10 R1(config-route-map)#match length 64 100 R1(config-route-map)#set interface Serial0/0/0 R1(config)#route-map PBR permit 20 R1(config-route-map)#match length 101 1000 R1(config-route-map)#set interface Serial0/0/1 R1(config)#interface GigabitEthernet0/0 R1(config-if)#ip policy route-map PBR R1(config)#ip local policy route-map PBR R1# show ip policy Interface Route map local PBR Gi0/0 PBR
5
谢谢！
6
•
路由器不仅能够根据目的地址而且能够根据协议类型、数据包大
小、应用或IP源Biblioteka 址来转发数据包。•策略路由的策略由路由映射图来定义。
2
PBR逻辑操作流程
进入数据包
入接口有应用 route map?
No
Yes
匹配route map陈述后， 行为是deny ？ No
Yes
正常转发数据包
R1
匹配route map陈述后， 行为是 permit?
Yes
执行相应的set命 令
3
route-map 定义策略和应用策略
Router(config)#
route-map map-tag [permit | deny] [sequence-number]
24实验二十四 策略路由(PBR)配置
实训三十九、策略路由（PBR）配置一、实验目的1. 掌握策略路由的配置2. 理解策略路由的原理二、应用环境PBR 使得用户可以依据饿来进行路由，而不是路由协议，目前支持的策略是：ip 报文大小、源IP 地址。
三、实验设备1. DCR-2611 两台2. PC 机两台四、实验拓扑五、实验要求配置要求六、实验步骤第一步：参照实验三，配置所有接口地址和PC 地址，并测试连通性第二步：配置路由器ARouter-A_config#ip access-list standard net1 ！定义ACLRouter-A_config_std_nacl#permit 192.168.0.10 255.255.255.255！设置需要进行策略路由的源地址Router-A_config_std_nacl#exitRouter-A_config#route-map pbr 10 permit ！定义route-mapRouter-A_config_route_map#match ip address net1 ！设定源地址Router-A_config_route_map#set ip next-hop 192.168.1.2 ！设置下一跳地址Router-A_config_route_map#exitRouter-A_config#int f0/0 ！进入源地址的路由器接口Router-A_config_f0/0#ip policy route-map pbr ！绑定route-map第三步：配置路由器B 的路由表Router-B#confRouter-B_config#ip route 192.168.0.0 255.255.255.0 192.168.1.1第四步：查看路由器A、B 的路由表Router-A#show ip routeCodes: C - connected, S - static, R - RIP, B - BGP, BC - BGP connectedD - BEIGRP, DEX - external BEIGRP, O - OSPF, OIA - OSPF inter areaON1 - OSPF NSSA external type 1, ON2 - OSPF NSSA external type 2OE1 - OSPF external type 1, OE2 - OSPF external type 2DHCP - DHCP type, L1 - IS-IS level-1, L2 - IS-IS level-2VRF ID: 0C 192.168.0.0/24 is directly connected, FastEthernet0/0C 192.168.1.0/24 is directly connected, Serial0/3！注意到没有192.168.2.0 的路由Router-B#show ip routeCodes: C - connected, S - static, R - RIP, B - BGP, BC - BGP connectedD - BEIGRP, DEX - external BEIGRP, O - OSPF, OIA - OSPF inter areaON1 - OSPF NSSA external type 1, ON2 - OSPF NSSA external type 2OE1 - OSPF external type 1, OE2 - OSPF external type 2DHCP - DHCP type, L1 - IS-IS level-1, L2 - IS-IS level-2VRF ID: 0S 192.168.0.0/24 [1,0] via 192.168.1.1(on Serial0/3) ！返回的数据包的路由C 192.168.1.0/24 is directly connected, Serial0/3C 192.168.2.0/24 is directly connected, FastEthernet0/0第五步：测试第六步：查看配置Router-A#show ip policyInterface Route-mapFastEthernet0/0 pbrRouter-A#show route-mapRoute-map pbr, permit, sequence 10Match clauses:match ip address net1Set clauses:set ip next-hop 192.168.1.2Exit policy:Policy routing matches: 142 packets, 10366 bytes七、注意事项和排错1. 注意是源地址匹配的路由2. 绑定在源数据包的接口上八、共同思考1. 策略路由与路由协议进行的路由有什么区别？2. 为什么在路由器B 上要配置静态路由？3. 如果源地址是192.168.0.2/24，那么策略还有效吗？九、课后练习请将源地址改为192.168.0.2/24 重复以上实验。
思科Cisco策略路由与路由策略实例详解
思科Cisco策略路由与路由策略实例详解本⽂讲述了思科Cisco策略路由与路由策略。
分享给⼤家供⼤家参考，具体如下：⼀、策略路由1. 路由策略与策略路由2. 策略路由的特点3.策略路由的配置3.1 接⼝下配置3.2 全局配置3.3 策略路由的冗余设置3.4 default语句3.5 为流量打ToS标记⼆、路由策略1.抓取流量的列表1.1 ACL访问控制列表1.2 prefix-list前缀列表2. 路由策略⼯具2.1 distribute-list分发列表2.2 route-map路由镜像2.3 OSPF filter-list⼀、策略路由1. 路由策略与策略路由路由策略是对路由信息本⾝的参数进⾏修改、控制等，最终影响路由表的⽣成，说⽩了路由策略就是告诉设备怎么学，⼀般与BGP结合使⽤⽐较多。
策略路由PBR，策略基于路由重点在路由，就是通过策略控制数据包的转发⽅向。
也有⼈把策略路由称之为⼀个复杂的静态路由。
⼀般来讲，策略路由是先于路由表执⾏的。
即设备在转发报⽂时，⾸先将报⽂与策略路由的匹配规则进⾏⽐较。
若符合匹配条件，则按策略路由进⾏转发；如果报⽂⽆法匹配策略路由的条件，再按照普通路由进⾏转发。
策略路由在转化层⾯不如路由表。
原因是匹配的东西过多，底层芯⽚处理⽀持有限。
使⽤原则是能不⽤就不⽤。
如果出现⾮⽬的地址的转发策略，果断⽤。
2. 策略路由的特点传统的路由表转发只能通过数据的⽬标地址做决策；策略路由可以根据源地址、⽬的地址、源端⼝、⽬的端⼝、协议、TOS等流量特征来做策略提供路由，灵活性⾼。
为QoS服务。
使⽤route-map及策略路由可以根据数据包的特征修改其相关QoS项，进⾏为QoS服务。
负载均衡。
使⽤策略路由可以设置数据包的⾏为，⽐如下⼀跳、下⼀接⼝等，这样在存在多条链路的情况下，可以根据数据包的应⽤不同⽽使⽤不同的链路，进⽽提供⾼效的负载均衡能⼒。
策略路由PBR默认只对穿越流量⽣效，不能处理本路由器产⽣流量3.策略路由的配置3.1 接⼝下配置接⼝下只能捕获该接⼝的⼊接⼝流量做策略（不能处理本路由器产⽣流量）R1(config)#access-list 100 permit ip host 1.1.1.1 any //⽤ACL捕获流量R1(config)#route-map pbr permit 10 //定义route-mapR1(config-route-map)#match ip add 100 //调⽤被ACL捕获的流量R1(config-route-map)#set ip next-hop 10.1.1.1 //设置下⼀跳R1(config-route-map)#exitR1(config)#int f0/0R1(config-if)#ip policy route-map pbr //接⼝下调⽤3.2 全局配置能够捕获所有⼊接⼝流量以及本路由器产⽣的流量（源地址是本路由器流量）R1(config)#access-list 100 permit ip host 1.1.1.1 any //⽤ACL捕获流量R1(config)#route-map pbr permit 10 //定义route-mapR1(config-route-map)#match ip add 100 //调⽤被ACL捕获的流量R1(config-route-map)#set ip next-hop 10.1.1.1 //设置下⼀跳R1(config-route-map)#exitR1(config)#ip local policy route-map pbr //全局下调⽤3.3 策略路由的冗余设置R1(config)#route-map PBR permit 10R1(config-route-map)#set ip next-hop verify-availability 10.1.24.2 1 track 1 //设置track监控，若track监控成功，执⾏该语句；若失败，则转为执⾏下条语句R1(config-route-map)#set ip next-hop 10.1.34.3R1(config-route-map)#exitR1(config)#ip local policy route-map PBRR1(config)#track 1 ip sla 1 //定义⼀个track监控 sla的探测结果R1(config-track)#ip sla 1 //定义⼀个slaR1(config-ip-sla)#icmp-echo 10.1.12.1 source-ip 10.4.4.4 //设置其探针R1(config)#ip sla schedule 1 life forever start-time now //设置sla 1的执⾏时间3.4 default语句在route-map的set ip default这个位置输⼊，定义为被捕获的流量先查路由表，如果能精确匹配（如果抓的为10.5.5.5，路由表中有10.5.5.5/24这不叫精确匹配；如果10.5.5.5/32则叫精确匹配）就执⾏路由表；如果不能则执⾏策略路由。
PBR(基于策略的路由)
PBR(基于策略的路由)通常我们在路由器上启用动态路由协议动态地学习网络拓扑，这样我们可能会遇到这样的安全问题，当一台非授权的网络设备接入网络，并发布路由协议更新时，有可能会使网络内的设备动态的产生错误的路由条目，从而造成数据包的丢失或者被路由到了错误的地方。
本文就来为大家介绍基于策略的路由(PBR)PBR(基于策略的路由)概述基于策略的路由(PBR)是一种灵活的数据包路由转发机制。
通过在路由器上应用策略路由，使路由器根据路由映射（route-map）决定经过路由器的数据包如何处理。
路由映射决定了一个数据包的下一跳转发路由器。
在路由器上应用策略路由，必须要指定策略路由使用的路由映射（route-map），并且要创建路由映射。
一个路由映射由很多条策略组成，每个策略都定义了1个或多个匹配规则和对应操作。
一个接口应用策略路由后，将对该接口收到的所有包进行检查，不符合路由映射中所定义的数据包将会被按照正常路由转发进行处理，符合路由映射中的策略的数据包，就按照策略中定义的操作进行处理。
策略路由主要应用在企业路由表复杂或者需要对路由进行控制的情况下，特别是当企业网络出口有两条，需要对不同服务和应用或者不同客户端的路由进行控制时，当然企业内部运行两个网络或者更多的网络时也经常要用到路由策略；另外，策略路由除了应用在非正常的路由选路之外，它还可以用来防止病毒或黑客的攻击，使用条件语句将病毒或攻击的特征码匹配出来，然后再指定一个安全策略（如使用黑洞路由）将攻击阻断.黑洞路由是对动态路由选择协议的一个补充。
黑洞路由可以将不想要的流量转发到一个称为null0的接口中去。
我们可以建立一条或一些静态路由，将精确匹配这些路由的流量丢弃。
和ACL不同的是，Cisco IOS的所有交换过程，包括CEF，都能处理黑洞路由，而不降低性能。
需要注意的是，PBR技术不支持配置了PBR的路由器始发流量和到达该路由器的流量。
PBR(基于策略的路由)实例解析下面我们就以一个试验来描述策略路由的阻断流量的功能。
LAB配置策略路由PBR
05
lab配置策略路由pbr总结
实验收获
深入理解了策略路由PBR的实现原理
01
通过配置策略路由，可以实现数据包根据特定规则进行路由，
提升了网络的灵活性和可扩展性。
学会了Lab配置方法
02
在实验中采用Lab配置方式，可以更加直观地展示网络设备的
配置过程，提高配置效率。
掌握VPC的配置和调试技巧
03
通过实验，熟悉了VPC的配置和调试技巧，可以更好地应对复
杂网络场景。
实验不足之处
实验过程中没有考虑到负载均衡的问题
在实验过程中，没有对负载均衡进行详细的研究和配置，导致网络设备在高负载 时可能出现性能瓶颈。
实验环境与实际场景的差异
由于实验环境的限制，实验中使用的网络拓扑和设备型号可能与实际场景存在差 异，影响实验结果的可推广性。
交换机
02
Cisco 3750，具备高性能、灵活性和可扩展性，支持二层和三
层功能。
PC机
03
运行Windows或Linux操作系统的计算机，用于网络配置和测
试。
02
策略路由基本概念
什么是策略路由
策略路由是一种网络路由技术，它可以根据不同的路由策略 将数据包从一个网络转发到另一个网络。
策略路由可以根据数据包的目的地址、源地址、传输协议等 因素来选择不同的路由路径，从而实现更加灵活和智能的路 由控制。
未来改进方向
完善负载均衡的配置
在未来的实验中，可以深入研究负载均衡的配置方法，实现网络设备的负载均衡，提高网 络设备的性能表现。
丰富实验环境和拓扑
可以尝试使用更多种类的网络设备和应用场景，丰富实验环境和拓扑，提高实验结果的可 推广性。
双线路Cisco路由器配置pppoe拨号上网
公司原有的20M城域网光纤不能满足现在的需求了，公司决定购买中国电信的ADSL 100M光纤线路，所以路由器变成了，双线连接互联，有某些业务需要使用20M线路固定公网IP，公司内部员工默认使用100M光纤上网。
此配置适合两条ADSL线路上网，只需要把固定IP的换成ADSL配置
ip nat inside
exit
#固定IP地址
interface GigabitEthernet0/1
ip address 113.106.x.x 255.255.255.240 secondary
ip address 113.106.x.y 255.255.255.240 secondary
match interface g0/1
exit
#NAT上网（PAT配置）
ip nat inside source route-map LANTo100Nat int dia 1 overload
ip nat inside source route-map LANTo20Nat int g0/1 overload
route-map lantointernetacl permit 10
match ip address lanto100adsl-acl
set ip next-hop verify-availability #因为不是固定IP，所以用这个参数
exit
route-map lantointernetacl permit 20
match ip add adsl100-nat-acl
match interface dia 1
exit
no route-map LANTo20Nat permit 20
基于VRF的PBR
配置如下： Hostname R1 ip vrf vpn1
rd 1:1 route-target export 1:1 route-target import 1:1 ! ip vrf vpn2
access-list 110 permit ip host 3.3.3.3 host 2.2.2.2
! route-map test permit 10
match ip address 100
以下两条策略路由是为了保证来回双向的数据包都 能够在 global 与 VRF 或（VRF 与 VRF）之间通信
Hostname R1 ip vrf vpn1
rd 1:1 route-target export 1:1 route-target import 1:1 !
interface Loopback0 ip vrf forwarding vpn1 ip address 1.1.1.1 255.255.255.255
该情况下无法使用 verify-availability Verify if nexthop is reachable
场景二：相同VRF的PBR配置
环境说明： 如下图：路由器 R1 作为 MCE 使用，通过 VRF VPN1 接口 F1/0 与 R3 互联，通过 VRF
VPN1 接口 F0/0 与 R1 互联。 1、在 R1 上配置 ip route vrf vpn1 2.2.2.2 255.255.255.255 10.1.1.6 路由让去往 2.2.2.2 的
PBR(策略路由)的几种使用方式
【简介】PBR（策略路由）以前是CISCO用来丢弃报文的一个主要手段。
比如：设置set interface null 0，按CISCO说法这样会比ACL的deny要节省一些开销。
注:PBR（策略路由）以前是CISCO用来丢弃报文的一个主要手段。
比如：设置set interface null 0，按CISCO说法这样会比ACL的deny要节省一些开销。
这里我提醒：interface null 0no ip unreachable//加入这个命令这样避免因为丢弃大量的报文而导致很多ICMP的不可达消息返回。
三层设备在转发数据包时一般都基于数据包的目的地址（目的网络进行转发），那么策略路由有什么特点呢？1、可以不仅仅依据目的地址转发数据包，它可以基于源地址、数据应用、数据包长度等。
这样转发数据包更灵活。
2、为QoS服务。
使用route-map及策略路由可以根据数据包的特征修改其相关QoS项，进行为QoS服务。
3、负载平衡。
使用策略路由可以设置数据包的行为，比如下一跳、下一接口等，这样在存在多条链路的情况下，可以根据数据包的应用不同而使用不同的链路，进而提供高效的负载平衡能力。
策略路由影响的只是本地的行为，所以可能会引起“不对称路由”形式的流量。
比如一个单位有两条上行链路A与B，该单位想把所有HTTP流量分担到A链路，FTP流量分担到Ｂ链路，这是没有问题的，但在其上行设备上，无法保证下行的HTTP流量分担到Ａ链路，FTP流量分担到Ｂ链路。
策略路由一般针对的是接口入(in)方向的数据包，但也可在启用相关配置的情况下对本地所发出的数据包也进行策略路由。
本文就策略路由的以下四个方面做相关讲解：１、启用策略路由２、启用Fast-Switched PBR３、启用Local PBR４、启用CEF-Switched PBR启用策略路由：开始配置route-map。
使用route-map map-tag [permit deny] [sequence-number]进入route-map的配置模式。
策略路由（PBR）配置
策略路由（PBR）配置原理：PBR依据策略进行路由，而不是路由协议，目前支持的策略有：IP报文大小，源IP 地址，本例使用源IP地址过程：路由器R1只配置策略不配置路由，R2配置路由目的:PC1可以PING通PC2，PC2也可以PING通PC1，但PC2却PING不通R1的S1/1端口和F0/0端口，路由器R1没有192.168.2.0路由配置好各接口IP定义ACLR1(config)#ip access-list standard net1设置需要进行策略路由的源地址R1(config-std-nacl)#permit 192.168.0.10 255.255.255.255定义route-map，名为pbrR1(config)#route-map pbr permit 10设定源地址R1(config-route-map)#match ip address net1设置下一跳地址R1(config-route-map)#set ip next-hop 192.168.1.2进入源地址的路由器接口R1(config)#interface fastEthernet 0/0绑定route-mapR1(config-if)#ip policy route-map pbr路由器R2的配置添加静态路由R2(config)#ip route 192.168.0.0 255.255.255.0 192.168.1.1测试：查看路由R1#show ip routeC 192.168.0.0/24 is directly connected, FastEthernet0/0 C 192.168.1.0/24 is directly connected, Serial1/1没有到192.168.2.0的路由R2#show ip routeS 192.168.0.0/24 [1/0] via 192.168.1.1C 192.168.1.0/24 is directly connected, Serial1/0C 192.168.2.0/24 is directly connected, FastEthernet0/0检查所应用的策略路由R1#show ip policyInterface Route mapFa0/0 pbrR1#show route-maproute-map pbr, permit, sequence 10Match clauses:ip address (access-lists): net1Set clauses:ip next-hop 192.168.1.2Policy routing matches: 35 packets, 4180 bytes。
策略路由PBR命令详解
策略路由PBR命令详解1 命令汇总1. set ip next-hop{ ip-address [...ip-address] | recursive ip-address }允许写多个下一跳IP，但这些IP必须是直连路由器的接口IP如果定义了多个下一跳IP，则当第一个下一跳关联的本地出接口DOWN掉，则自动切换到下一个next-hop recursive next-hop（递归下一跳）特性突破了传统下一跳必须是直连路由器下一跳接口IP的限制。
Recursive next-hop可以不是直连网络，只要路由表中有相关的路由可达即可。
一般recursive next-hop不可达，数据将交由路由处理（一般就被默认路由匹配走了）如果在一个route-map列表的同一个序列中同时使用ip next-hop及ip next-hop recursive，则ip next-hop 有效。
如果ip next-hop 挂了，则启用ip next-hop recursive，如果ip next-hop recursive和ip next-hop 都挂了，则丢给路由表处理。
注意：一个route-map序列，只允许配置一个ip next-hop recursive2. set ip next-hop verify-availability [ next-hop-address sequence track object ]检测下一跳的可达性，默认是关闭的Sequence of next hops. The acceptable range is from 1 to 65535.此条命令可以下列方式使用：●在PBR环境下使用CDP检测下一跳IP可达性（不加后面的可选参数）使用该特性可能会一定程度上降低设备性能，另外必须保证自己以及邻居路由器接口CDP都是开启的，最后过程交换及CEF都支持该特性，但dCEF不支持。
该特性借助设备的CDP表来判断下一跳的可达性，如果本端开启了该特性，next-hop设备不支持CDP，则切换至下一个next-hop，如果没，则跳过PBR如果本端没开启该特性，那么数据包要么被成功策略路由，要么永远无法正常路由出去（被丢弃）如果仅仅想检测部分next-hop设备的可达性，则可以配置不同的route-map条目，来选择性的使用该特性（同一个route-map）。
Cisco路由器配置实例(经典)
实训报告实训一路由基本配置1、实验目的：路由器基本配置及ip设置2、拓扑结构图Router0 fa0/0: 192.168.11.1Fa0/1:192.168.1.1Router1 fa0/0: 192.168.11.2Fa0/1:192.168.2.1Znn1:192.168.1.2Znn2:192.168.2.23、实验步骤Router1Router>en 用户模式进入特权模式Router#conf t 特权模式进入全局模式Enter configuration commands, one per line. End with CNTL/Z.Router(config)#host rznn1 改名字为rznn1rznn1(config)#int fa0/0 进入fa0/0端口rznn1(config-if)#ip add 192.168.11.1 255.255.255.0 设置ip地址rznn1(config-if)#no sh 激活rznn1(config)#int fa0/1rznn1(config-if)#ip add 192.168.1.1 255.255.255.0rznn1(config-if)#no shrznn1(config-if)#exitrznn1(config)#exitrznn1#copy running-config startup-config 保存Destination filename [startup-config]? startup-configrznn1#conf trznn1(config)#enable secret password 222 设置密文rznn1#show ip interface b 显示Interface IP-Address OK? Method Status Protocol FastEthernet0/0 192.168.11.1 YES manual up up FastEthernet0/1 192.168.1.1 YES manual up upVlan1 unassigned YES manual administratively down downrouter 2outer>enRouter#conf tEnter configuration commands, one per line. End with CNTL/Z.Router(config)#host rznn2rznn2(config)#int fa0/0rznn2(config-if)#ip add 192.168.11.2 255.255.255.0rznn2(config-if)#no shrznn2(config)#int fa0/1rznn2(config-if)#ip add 192.168.2.1 255.255.255.0rznn2(config-if)#no shRznn2#copy running-config startup-config 保存Destination filename [startup-config]? startup-configrznn2(config-if)#exitrznn2(config)#exitrznn2#conf trznn2(config)#enable secret 222rznn2#show ip interface bInterface IP-Address OK? Method Status Protocol FastEthernet0/0 192.168.11.2 YES manual up up FastEthernet0/1 192.168.2.1 YES manual up upVlan1 unassigned YES manual administratively down down实训二1、远程登录、密码设置及验证为路由器开设telnet端口，PC机可以远程登陆到Rznn3(Router 1)拓扑结构图Router0:192.168.1.1Pc:192.168.1.2步骤rznn3>rznn3>enrznn3#conf tEnter configuration commands, one per line. End with CNTL/Z.rznn3(config)#no ip domain lookuprznn3(config)#line cons 0rznn3(config-line)#password znnrznn3(config-line)#loginrznn3(config-line)#no exec-trznn3(config-line)#logg syncrznn3(config-line)#exitrznn3(config)#int fa0/0rznn3(config-if)#ip add 192.168.1.1 255.255.255.0rznn3(config-if)#no shrznn3(config-if)#exitrznn3(config)#line vty 0 4 打通五个端口rznn3(config-line)#password cisco 设置密码rznn3(config-line)#login 保存rznn3(config-line)#exit4、测试：实训三命令组1、目的：八条命令（no ip domain lookup\line cons 0\password\login\no exec-t\logg sync\show version\reload\copy running-config startup-config）\show cdp neighbors)2、拓扑结构图Router0 fa0/0: 192.168.11.1Router1 fa0/0: 192.168.11.23、步骤rznn1#conf tEnter configuration commands, one per line. End with CNTL/Z.1、rznn1(config)#no ip domain lookup 取消域名查找转换2、rznn1(config)#line cons 0 打开cons 0端口3、rznn1(config-line)#password znn 设置密码为znnrznn1(config-line)#login 保存rznn1(config-line)#no exec-t 设置永不超时4、rznn1(config-line)#logg sync 产生日志5、rznn1#show version 显示思科路由系统版本信息Cisco IOS Software, 2800 Software (C2800NM-ADVIPSERVICESK9-M), Version 12.4(15)T1, RELEASE SOFTWARE (fc2)Technical Support: /techsupportCopyright (c) 1986-2007 by Cisco Systems, Inc.Compiled Wed 18-Jul-07 06:21 by pt_rel_team6、rznn1#show cdp neighbors 查看路由器连接的相邻路由器的相关信息Capability Codes: R - Router, T - Trans Bridge, B - Source Route BridgeS - Switch, H - Host, I - IGMP, r - Repeater, P - PhoneDevice ID Local Intrfce Holdtme Capability Platform Port IDrznn2 Fas 0/0 139 R C2800 Fas 0/07、rznn1#copy running-config startup-config 保存刚才指令Destination filename [startup-config]? startup-configBuilding configuration...[OK]8、rznn1#reload 重启路由器Proceed with reload? [confirm]System Bootstrap, Version 12.1(3r)T2, RELEASE SOFTWARE (fc1)Copyright (c) 2000 by cisco Systems, Inc.cisco 2811 (MPC860) processor (revision 0x200) with 60416K/5120K bytes of memorySelf decompressing the image :########################################################################## [OK] Restricted Rights Legendrznn1#show ip interface bInterface IP-Address OK? Method Status Protocol FastEthernet0/0 192.168.11.1 YES manual up up FastEthernet0/1 192.168.1.1 YES manual up upVlan1 unassigned YES manual administratively down down9、rznn1(config-if)#ip add 192.168.3.1 255.255.255.0 重置ip地址rznn1#show ip interface bInterface IP-Address OK? Method Status Protocol FastEthernet0/0 192.168.3.1 YES manual up up FastEthernet0/1 192.168.1.1 YES manual up up Vlan1 unassigned YES manual administratively down down实训四发现协议1、实训目的通过发现协议显示路由器相邻路由的端口信息2、拓扑结构Router0:192.168.11.1Router1:fa0/0 192.168.11.2Fa0/1 192.168.12.1Router2:192.168.12.23、步骤R1路由器Router>enRouter#conf tEnter configuration commands, one per line. End with CNTL/Z.Router(config)#host r1r1(config)#int fa0/0r1(config-if)#ip add 192.168.11.1 255.255.255.0r1(config-if)#no sh%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to upr1(config-if)#r1(config-if)#exitr1(config)#exitr1#%SYS-5-CONFIG_I: Configured from console by consoler1#show ip interface bInterface IP-Address OK? Method Status Protocol FastEthernet0/0 192.168.11.1 YES manual up down FastEthernet0/1 unassigned YES manual administratively down downVlan1 unassigned YES manual administratively down downR2 路由器Router>enRouter#conf tEnter configuration commands, one per line. End with CNTL/Z.Router(config)#host r2r2(config)#int fa0/0r2(config-if)#ip add 192.168.11.2 255.255.255.0r2(config-if)#no sh%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up r2(config-if)#exitr2(config)#exitr2#%SYS-5-CONFIG_I: Configured from console by consoler2#conf tEnter configuration commands, one per line. End with CNTL/Z.r2(config)#int fa0/0r2(config-if)#int fa0/1r2(config-if)#ip add 192.168.12.1 255.255.255.0r2(config-if)#no sh%LINK-5-CHANGED: Interface FastEthernet0/1, changed state to upr2(config-if)#exitr2(config)#exitr2#%SYS-5-CONFIG_I: Configured from console by consoler2#show ip interface bInterface IP-Address OK? Method Status Protocol FastEthernet0/0 192.168.11.2 YES manual up upFastEthernet0/1 192.168.12.1 YES manual up down Vlan1 unassigned YES manual administratively down downR3路由器Router>enRouter#conf tEnter configuration commands, one per line. End with CNTL/Z.Router(config)#host r3r3(config)#int fa0/0r3(config-if)#ip add 192.168.12.2 255.255.255.0r3(config-if)#no sh%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up r3(config-if)#exitr3(config)#exitr3#%SYS-5-CONFIG_I: Configured from console by consoler3#show ip interface bInterface IP-Address OK? Method Status Protocol FastEthernet0/0 192.168.12.2 YES manual up up FastEthernet0/1 unassigned YES manual administratively down downVlan1 unassigned YES manual administratively down downR1发现邻居r1#show cdp neighborsCapability Codes: R - Router, T - Trans Bridge, B - Source Route BridgeS - Switch, H - Host, I - IGMP, r - Repeater, P - PhoneDevice ID Local Intrfce Holdtme Capability Platform Port IDr2 Fas 0/0 165 R C2800 Fas 0/0R2发现邻居r2#show cdp neighborsCapability Codes: R - Router, T - Trans Bridge, B - Source Route BridgeS - Switch, H - Host, I - IGMP, r - Repeater, P - PhoneDevice ID Local Intrfce Holdtme Capability Platform Port IDr1 Fas 0/0 176 R C1841 Fas 0/0r3 Fas 0/1 130 R C1841 Fas 0/0R3发现邻居r3#show cdp neighborsCapability Codes: R - Router, T - Trans Bridge, B - Source Route BridgeS - Switch, H - Host, I - IGMP, r - Repeater, P - PhoneDevice ID Local Intrfce Holdtme Capability Platform Port IDr2 Fas 0/0 166 R C2800 Fas 0/14、总结show 命令（1）show ip interface b (显示端口ip信息)（2）show version （显示ios版本信息）（3）show running-config （显示刚才使用的命令配置信息）（4）show cdp neighbors （显示发现邻居直连设备信息）（5）show interface （显示所有端口详细信息）实训五静态路由1、实验目的：将不同网段的网络配通（ip route）Ip route语法：ip route 目标地址子网掩码相邻路由器接口地址Show ip route2、试验拓扑：Router0:192.168.11.1Router1:fa0/0 192.168.11.2Fa0/1 192.168.12.1Router2:192.168.12.23、实验步骤：Router1Router>enRouter#conf tRouter(config)#host r1r1(config)#int fa0/0r1(config-if)#ip add 192.168.11.1 255.255.255.0r1(config-if)#no sh%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to upr1(config-if)#exitr1(config)#exitr1#show ip interface bInterface IP-Address OK? Method Status ProtocolFastEthernet0/0 192.168.11.1 YES manual up downFastEthernet0/1 unassigned YES manual administratively down downVlan1 unassigned YES manual administratively down downr1#%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up r1#ping 192.168.12.1Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 192.168.12.1, timeout is 2 seconds:.....Success rate is 0 percent (0/5)r1#conf tEnter configuration commands, one per line. End with CNTL/Z.r1(config)#ip route 192.168.12.0 255.255.255.0 192.168.11.2r1(config)#exitr1#ping 192.168.12.1Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 192.168.12.1, timeout is 2 seconds:Success rate is 100 percent (5/5), round-trip min/avg/max = 31/31/32 msr1#ping 192.168.12.2Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 192.168.12.2, timeout is 2 seconds:.....Success rate is 0 percent (0/5)r1#ping 192.168.12.2Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 192.168.12.2, timeout is 2 seconds:Success rate is 100 percent (5/5), round-trip min/avg/max = 47/62/78 msr1#show ip routeCodes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGPD - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter areaN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGPi - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area* - candidate default, U - per-user static route, o - ODRP - periodic downloaded static routeGateway of last resort is not setC 192.168.11.0/24 is directly connected, FastEthernet0/0S 192.168.12.0/24 [1/0] via 192.168.11.2Router3Router>enRouter#conf tEnter configuration commands, one per line. End with CNTL/Z.Router(config)#host r3r3(config)#int fa0/0r3(config-if)#ip add 192.168.12.2 255.255.255.0r3(config-if)#no sh%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up r3(config-if)#exitr3(config)#exitr3#%SYS-5-CONFIG_I: Configured from console by consoler3#show ip interface bInterface IP-Address OK? Method Status Protocol FastEthernet0/0 192.168.12.2 YES manual up up FastEthernet0/1 unassigned YES manual administratively down downVlan1 unassigned YES manual administratively down downr3#conf tEnter configuration commands, one per line. End with CNTL/Z.r3(config)#ip route 192.168.11.0 255.255.255.0 192.168.12.1r3(config)#exitr3#ping 192.168.11.2Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 192.168.11.2, timeout is 2 seconds:Success rate is 100 percent (5/5), round-trip min/avg/max = 31/31/32 msr3#ping 192.168.11.1Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 192.168.11.1, timeout is 2 seconds:Success rate is 100 percent (5/5), round-trip min/avg/max = 62/62/63 msr3#show ip routeCodes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGPD - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter areaN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area* - candidate default, U - per-user static route, o - ODRP - periodic downloaded static routeGateway of last resort is not setS 192.168.11.0/24 [1/0] via 192.168.12.1C 192.168.12.0/24 is directly connected, FastEthernet0/04、默认路由Route 1r1>enr1#conf tEnter configuration commands, one per line. End with CNTL/Z.r1(config)#no ip route 192.168.12.0 255.255.255.0 192.168.11.2%No matching route to deleter1(config)#exitr1#%SYS-5-CONFIG_I: Configured from console by consoler1#show ip routeCodes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGPD - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter areaN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGPi - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area* - candidate default, U - per-user static route, o - ODRP - periodic downloaded static routeGateway of last resort is not setC 192.168.11.0/24 is directly connected, FastEthernet0/0r1#conf tEnter configuration commands, one per line. End with CNTL/Z.r1(config)#ip route 0.0.0.0 0.0.0.0 192.168.11.2r1(config)#exitr1#%SYS-5-CONFIG_I: Configured from console by consoler1#show ip routeCodes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGPD - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter areaN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area* - candidate default, U - per-user static route, o - ODRP - periodic downloaded static routeGateway of last resort is 192.168.11.2 to network 0.0.0.0C 192.168.11.0/24 is directly connected, FastEthernet0/0S* 0.0.0.0/0 [1/0] via 192.168.11.2r1#ping 192.168.12.1Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 192.168.12.1, timeout is 2 seconds:Success rate is 100 percent (5/5), round-trip min/avg/max = 16/28/31 msr1#ping 192.168.12.2Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 192.168.12.2, timeout is 2 seconds: Success rate is 100 percent (5/5), round-trip min/avg/max = 62/62/63 msRoute 3r1>enr1#conf tEnter configuration commands, one per line. End with CNTL/Z.r1(config)#no ip route 192.168.12.0 255.255.255.0 192.168.11.2%No matching route to deleter1(config)#exitr1#%SYS-5-CONFIG_I: Configured from console by consoler1#show ip routeCodes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGPD - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter areaN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGPi - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area* - candidate default, U - per-user static route, o - ODRP - periodic downloaded static routeGateway of last resort is not setC 192.168.11.0/24 is directly connected, FastEthernet0/0r1#conf tEnter configuration commands, one per line. End with CNTL/Z.r1(config)#ip route 0.0.0.0 0.0.0.0 192.168.11.2r1(config)#exitr1#%SYS-5-CONFIG_I: Configured from console by consoler1#show ip routeCodes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGPD - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter areaN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGPi - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area* - candidate default, U - per-user static route, o - ODRP - periodic downloaded static routeGateway of last resort is 192.168.11.2 to network 0.0.0.0C 192.168.11.0/24 is directly connected, FastEthernet0/0S* 0.0.0.0/0 [1/0] via 192.168.11.2r3#ping 192.168.11.1Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 192.168.11.1, timeout is 2 seconds: Success rate is 100 percent (5/5), round-trip min/avg/max = 62/62/63 ms实训六动态路由RIP 协议1、实验目的使用配置动态路由启动Rip协议使用到的命令（router rip/network/show ip protocols/show ip route）2、实验拓扑R1 fa0/0 192.168.11.1R2 fa0/0 192.168.11.2fa0/1 192.168.12.1R3 fa0/0 192.168.12.23、实验步骤R1Router>enRouter#conf tEnter configuration commands, one per line. End with CNTL/Z. Router(config)#host r1r1(config)#int fa0/0r1(config-if)#ip add 192.168.11.1 255.255.255.0r1(config-if)#no shr1(config-if)#exitr1(config)#router ripr1(config-router)#network 192.168.11.0r1(config-router)#exitr1(config)#exitr1#%SYS-5-CONFIG_I: Configured from console by consoleR2Router>enRouter#conf tEnter configuration commands, one per line. End with CNTL/Z. Router(config)#host r2r2(config)#int fa0/0r2(config-if)#ip add 192.168.11.2 255.255.255.0r2(config-if)#no shr2(config-if)#exitr2(config)#int fa0/1r2(config-if)#ip add 192.168.12.1 255.255.255.0r2(config-if)#no shr2(config-if)#exitr2(config)#router ripr2(config-router)#network 192.168.11.0r2(config-router)#network 192.168.12.0r2(config-router)#exitr2(config)#exitr2#R3Router>enRouter#conf tEnter configuration commands, one per line. End with CNTL/Z. Router(config)#host r3r3(config)#int fa0/0r3(config-if)#ip add 192.168.12.2 255.255.255.0r3(config-if)#no shr3(config-if)#exitr3(config)#router ripr3(config-router)#network 192.168.12.0r3(config-router)#exitr3(config)#exitr3#%SYS-5-CONFIG_I: Configured from console by console4、实验测试R1r1#show ip protocolsRouting Protocol is "rip"Sending updates every 30 seconds, next due in 10 secondsInvalid after 180 seconds, hold down 180, flushed after 240 Outgoing update filter list for all interfaces is not setIncoming update filter list for all interfaces is not set Redistributing: ripDefault version control: send version 1, receive any version Interface Send Recv Triggered RIP Key-chain FastEthernet0/0 1 2 1Automatic network summarization is in effectMaximum path: 4Routing for Networks:192.168.11.0Passive Interface(s):Routing Information Sources:Gateway Distance Last UpdateDistance: (default is 120)r1#show ip routeCodes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGPD - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter areaN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGPi - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area* - candidate default, U - per-user static route, o - ODRP - periodic downloaded static routeGateway of last resort is not setC 192.168.11.0/24 is directly connected, FastEthernet0/0R 192.168.12.0/24 [120/1] via 192.168.11.2, 00:00:24, FastEthernet0/0 r1#ping 192.168.12.0Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 192.168.12.0, timeout is 2 seconds: Success rate is 100 percent (5/5), round-trip min/avg/max = 31/31/32 msR2r2#show ip protocolsRouting Protocol is "rip"Sending updates every 30 seconds, next due in 21 secondsInvalid after 180 seconds, hold down 180, flushed after 240Outgoing update filter list for all interfaces is not setIncoming update filter list for all interfaces is not setRedistributing: ripDefault version control: send version 1, receive any versionInterface Send Recv Triggered RIP Key-chain FastEthernet0/0 1 2 1FastEthernet0/1 1 2 1Automatic network summarization is in effectMaximum path: 4Routing for Networks:192.168.11.0192.168.12.0Passive Interface(s):Routing Information Sources:Gateway Distance Last UpdateDistance: (default is 120)r2#show ip routeCodes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGPD - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter areaN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGPi - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area* - candidate default, U - per-user static route, o - ODRP - periodic downloaded static routeGateway of last resort is not setC 192.168.11.0/24 is directly connected, FastEthernet0/0C 192.168.12.0/24 is directly connected, FastEthernet0/1R3r3#show ip protocolsRouting Protocol is "rip"Sending updates every 30 seconds, next due in 15 secondsInvalid after 180 seconds, hold down 180, flushed after 240Outgoing update filter list for all interfaces is not setIncoming update filter list for all interfaces is not setRedistributing: ripDefault version control: send version 1, receive any versionInterface Send Recv Triggered RIP Key-chain FastEthernet0/0 1 2 1Automatic network summarization is in effectMaximum path: 4Routing for Networks:192.168.12.0Passive Interface(s):Routing Information Sources:Gateway Distance Last UpdateDistance: (default is 120)r3#show ip routeCodes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGPD - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter areaN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGPi - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area* - candidate default, U - per-user static route, o - ODRP - periodic downloaded static routeGateway of last resort is not setR 192.168.11.0/24 [120/1] via 192.168.12.1, 00:00:04, FastEthernet0/0 C 192.168.12.0/24 is directly connected, FastEthernet0/0r3#ping 192.168.11.0Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 192.168.11.0, timeout is 2 seconds: Success rate is 100 percent (5/5), round-trip min/avg/max = 31/31/32 ms实训七负载平衡试训目的实现负载平衡实训拓扑R1 fa0/0 192.168.11.1R2 eth0/0/0 192.168.11.2Fa0/0 192.168.12.1Fa0/0 192.168.13.1R3 fa0/0 192.168.12.2Fa0/1 192.168.14.1R4 fa0/0 192.168.13.2Fa0/1 192.168.15.1R5 fa0/0 192.168.14.2Fa0/1 192.168.15.2实训步骤（R1 ）r1>enR1#conf tR1(config)#ip route 0.0.0.0 0.0.0.0 192.168.11.2R1(config)#exitr1#show ip routeCodes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGPD - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter areaN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGPi - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area* - candidate default, U - per-user static route, o - ODRP - periodic downloaded static routeGateway of last resort is 192.168.11.2 to network 0.0.0.0C 192.168.11.0/24 is directly connected, FastEthernet0/0S* 0.0.0.0/0 [1/0] via 192.168.11.2(R2)r2>enr2(config)#ip route 0.0.0.0 0.0.0.0 192.168.12.2r2(config)#ip route 0.0.0.0 0.0.0.0 192.168.13.2r2(config)#exitr2#%SYS-5-CONFIG_I: Configured from console by consoles% Ambiguous command: "s"r2#show ip routeCodes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGPD - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter areaN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGPi - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area* - candidate default, U - per-user static route, o - ODRP - periodic downloaded static routeGateway of last resort is 192.168.12.2 to network 0.0.0.0C 192.168.11.0/24 is directly connected, Ethernet0/0/0C 192.168.12.0/24 is directly connected, FastEthernet0/0C 192.168.13.0/24 is directly connected, FastEthernet0/1S* 0.0.0.0/0 [1/0] via 192.168.12.2[1/0] via 192.168.13.2(R3)r3>enr3#conf tEnter configuration commands, one per line. End with CNTL/Z.r3(config)#ip route 0.0.0.0 0.0.0.0 192.168.12.1r3(config)#exitr3#%SYS-5-CONFIG_I: Configured from console by consoler3#show ip routeCodes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGPD - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter areaN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGPi - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area* - candidate default, U - per-user static route, o - ODRP - periodic downloaded static routeGateway of last resort is 192.168.12.1 to network 0.0.0.0C 192.168.12.0/24 is directly connected, FastEthernet0/0C 192.168.14.0/24 is directly connected, FastEthernet0/1S* 0.0.0.0/0 [1/0] via 192.168.12.1(R4)r4>enr4#conf tEnter configuration commands, one per line. End with CNTL/Z.r4(config)#ip route 0.0.0.0 0.0.0.0 192.168.13.1r4(config)#exitr4#%SYS-5-CONFIG_I: Configured from console by consoler4#show ip routeCodes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGPD - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter areaN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGPi - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area* - candidate default, U - per-user static route, o - ODRP - periodic downloaded static routeGateway of last resort is 192.168.13.1 to network 0.0.0.0C 192.168.13.0/24 is directly connected, FastEthernet0/0C 192.168.15.0/24 is directly connected, FastEthernet0/1S* 0.0.0.0/0 [1/0] via 192.168.13.1(R5)r5>enr5#conf tEnter configuration commands, one per line. End with CNTL/Z.r5(config)#ip route 0.0.0.0 0.0.0.0 192.168.14.1r5(config)#ip route 0.0.0.0 0.0.0.0 192.168.15.1r5(config)#exitr5#%SYS-5-CONFIG_I: Configured from console by consoler5#show ip routeCodes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGPD - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter areaN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGPi - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area* - candidate default, U - per-user static route, o - ODRP - periodic downloaded static routeGateway of last resort is 192.168.14.1 to network 0.0.0.0C 192.168.14.0/24 is directly connected, FastEthernet0/0C 192.168.15.0/24 is directly connected, FastEthernet0/1S* 0.0.0.0/0 [1/0] via 192.168.14.1[1/0] via 192.168.15.1实训测试（R1）r1#ping 192.168.14.1Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 192.168.14.1, timeout is 2 seconds:Success rate is 100 percent (5/5), round-trip min/avg/max = 62/84/94 ms （R5）r5#ping 192.168.11.1Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 192.168.11.1, timeout is 2 seconds: Success rate is 100 percent (5/5), round-trip min/avg/max = 79/91/94 ms实训八DHCP 协议配置实训目的全网配通实训拓扑Fa0/0 192.168.11.1Fa0/1 192.168.12.1实训步骤Router>enRouter#conf tEnter configuration commands, one per line. End with CNTL/Z.Router(config)#host r1r1(config)#int fa0/0r1(config-if)#ip add 192.168.11.1 255.255.255.0r1(config-if)#no shr1(config-if)#exitr1(config)#int fa0/1r1(config-if)#ip add 192.168.12.1 255.255.255.0r1(config-if)#no shr1(config-if)#exitr1(config)#ip dhcp pool znn //配置一个根地址池znnr1(dhcp-config)#network 192.168.11.0 255.255.255.0 //为所有客户机动态分配的地址段r1(dhcp-config)#default-router 192.168.11.1 //为客户机配置默认的网关r1(dhcp-config)#dns-server 192.168.11.1 //为客户机配置DNS服务器r1(dhcp-config)#exitr1(config)#ip dhcp pool znn1r1(dhcp-config)#network 192.168.12.0 255.255.255.0r1(dhcp-config)#default-router 192.168.12.1r1(dhcp-config)#dns-server 192.168.12.1r1(dhcp-config)#exit。
策略路由的配置详解和实例
策略路由的配置详解和实例Routemap和ACL很类似,它可以用于路由的再发布和策略路由,还经常使用在BGP中.策略路由(policyroute)实际上是复杂的静态路由,静态路由是基于数据包的目标地址并转发到指定的下一跳路由器,策略路由还利用和扩展IPACL链接,这样就可以提供更多功能的过滤和分类。
策略路由配置实例：ROUTEA:Verion11.2Noerviceudp-mall-erverNoervicetcp-mall-erverHotnamerouterAInterfaceethernet0Ipaddre192.1.1.1255.255.255.0econdaryIpaddre192.1.1.2255.255.255.0econdaryIpaddre192.1.1.3255.255.255.0econdaryIpaddre192.1.1.10255.255.255.0Ippolicyroute-maplab1//策略路由应用于E0口interfaceerial0ipaddr150.1.1.1255.255.255.0interfaceerial1ipaddr151.1.1.1255.255.255.0routerripnetwork192.1.1.0network150.1.0.0network151.1.0.0iplocalpolicyroute-maplab1//使路由器策略路由本地产生报文noipclaleacce-lit1permit192.1.1.1acce-lit2permit192.1.1.2route-maplab1permit10//定义策略路由图名称：LAB1，10为序号，用来标明被匹配的路由顺序。
Matchipaddre1//匹配地址为访问列表1Setinterfaceerial0//匹配下一跳为S0Route-maplab1permit20Matchipaddre2Setinterfaceerial1Linecon0Lineau某0Linevty04LoginEnd路由器B为标准配置略。
CISCO交换机策略路由配置说明
Configuring Policy-Based RoutingYou can use policy-based routing (PBR) to configure a defined policy for traffic flows. By using PBR, you can have more control over routing by reducing the reliance on routes derived from routing protocols. PBR can specify and implement routing policies that allow or deny paths based on:•Identity of a particular end system•Application•ProtocolYou can use PBR to provide equal-access and source-sensitive routing, routing based on interactive versus batch traffic, or routing based on dedicated links. For example, you could transfer stock records to a corporate office on a high-bandwidth, high-cost link for a short time while transmitting routine application data such as e-mail over a low-bandwidth, low-cost link.With PBR, you classif y traffic using access control lists (ACLs) and then make traffic go through a different path. PBR is applied to incoming packets. All packets received on an interface with PBR enabled are passed through route maps. Based on the criteria defined in the route maps, packets are forwarded (routed) to the appropriate next hop.•If packets do not match any route map statements, all set clauses are applied.•If a statement is marked as permit and the packets do not match any route-map statements, the packets are sent through the normal forwarding channels, and destination-based routing is performed.•For PBR, route-map statements marked as deny are not supported.For more information about configuring route maps, see the "Using Route Maps to Redistribute Routing Information" section.You can use standard IP ACLs to specify match criteria for a source address or extended IP ACLs to specify match criteria based on an application, a protocol type, or an end station. The process proceeds through the route map until a match is found. If no match is found, normaldestination-based routing occurs. There is an implicit deny at the end of the list of match statements.If match clauses are satisfied, you can use a set clause to specify the IP addresses identifying the next hop router in the path.For details about PBR commands and keywords, see the Cisco IOS IP Command Reference, Volume 2 of 3: Routing Protocols, Release 12.2. For a list of PBR commands that are visible but not supported by the switch, see Appendix C, "Unsupported Commands inCisco IOS Release 12.2(35)SE,"Note This software release does not support PBR when processing IPv4 and IPv6 traffic.PBR Configuration GuidelinesBefore configuring PBR, you should be aware of this information:•To use PBR, you must have the IP services image installed on the switch.•Multicast traffic is not policy-routed. PBR applies to only to unicast traffic.•You can enable PBR on a routed port or an SVI.•The switch does not support route-map deny statements for PBR.•You can apply a policy route map to an EtherChannel port channel in Layer 3 mode, but you cannot apply a policy route map to a physical interface that is a member of the EtherChannel. If you try to do so, the command is rejected. When a policy route map is applied to a physical interface, that interface cannot become a member of an EtherChannel.•You can define a maximum of 246 IP policy route maps on the switch.•You can define a maximum of 512 access control entries (ACEs) for PBR on the switch.•When configuring match criteria in a route map, follow these guidelines:–Do not match ACLs that permit packets destined for a local address. PBR would forward these packets, which could cause ping or Telnet failure or route protocol flapping.–Do not match ACLs with deny ACEs. Packets that match a deny ACE are sent to the CPU, which could cause high CPU utilization.•To use PBR, you must first enable the routing template by using the sdm prefer routing global configuration command. PBR is not supported with the VLAN or default template. For more information on the SDM templates, see Chapter 7, "Configuring SDM Templates."•VRF and PBR are mutually exclusive on a switch interface. You cannot enable VRF when PBR is enabled on an interface. In contrast, you cannot enable PBR when VRF is enabled on an interface.•The number of TCAM entries used by PBR depends on the route map itself, the ACLs used, and the order of the ACLs and route-map entries.•Policy-based routing based on packet length, TOS, set interface, set default next hop, or set default interface are not supported. Policy maps with no valid set actions or with set action set to Don't Fragment are not supported.•Beginning with Cisco IOS Release 12.2(35)SE, the switch supports quality of service (QoS) DSCP and IP precedence matching in PBR route maps with these limitations:–You cannot apply QoS DSCP mutation maps and PBR route maps to the same interface.–You cannot configure DSCP transparency and PBR DSCP route maps on the same switch.–When you configure PBR with QoS DSCP, you can set QoS to be enabled (by entering the mls qos global configuration command) or disabled (by entering the no mls qos command). When QoS is enabled, to ensure that the DSCP value of the traffic is unchanged, you should configure DSCP trust state on the port where traffic enters the switch by entering the mls qos trust dscp interface configuration command. If the trust state is not DSCP, by default all nontrusted traffic would have the DSCP value marked to 0.Enabling PBRBy default, PBR is disabled on the switch. To enable PBR, you must create a route map that specifies the match criteria and the resulting action if all of the match clauses are met. Then, you must enable PBR for that route map on an interface. All packets arriving on the specified interface matching the match clauses are subject to PBR.PBR can be fast-switched or implemented at speeds that do not slow down the switch.Fast-switched PBR supports most match and set commands. PBR must be enabled before you enable fast-switched PBR. Fast-switched PBR is disabled by default.Packets that are generated by the switch, or local packets, are not normally policy-routed. When you globally enable local PBR on the switch, all packets that originate on the switch are subject to local PBR. Local PBR is disabled by default.Note To enable PBR, the switch must be running the IP services image.Beginning in privileged EX EC mode, follow these steps to configure PBR:•••Use the no route-map map-tag global configuration command or the no match or no setroute-map configuration commands to delete an entry. Use the no ip policy route-map map-tag interface configuration command to disable PBR on an interface. Use the no ip route-cache policyinterface configuration command to disable fast-switching PBR. Use the no ip local policy route-map map-tag global configuration command to disable policy-based routing on packets originating on the switch.。
策略路由典型配置案例
apply ip-address next-hop 30.1.1.1/指定下一跳地址/
#
ip route-static0.0.0.0 0.0.0.0 20.1.1.1 preference 60
ip route-static0.0.0.0 0.0.0.0 30.1.1.1 preference 60
#
user-interface con 0
user-interface vty 0 4
#
return
#
interface Serial1/0
link-protocol ppp
ip address20.1.1.2 255.255.255.252
#
interface Serial1/1
link-protocol ppp
ip address 30.1.1.2 255.255.255.252
#
interface NULL0
#
sysname RouterA
#
radius scheme system
#
domain system
#
acl number 2001/定义acl 2001/
rule 0 permit source 40.1.1.00.0.0.127/允许40.1.1.0/25源地址网段/
acl number 2002/定义acl 2002/
rule 0 permit source 41.1.1.1280.0.0.127/允许40.1.1.128/25源地址网段t0/0
ip address 40.1.1.1 255.255.255.0
ip policypolicy-based-routeaaa/在内网接口应用aaa策略/
- 1、下载文档前请自行甄别文档内容的完整性，平台不提供额外的编辑、内容补充、找答案等附加服务。
- 2、"仅部分预览"的文档,不可在线预览部分如存在完整性等问题,可反馈申请退款(可完整预览的文档不适用该条件!)。
- 3、如文档侵犯您的权益，请联系客服反馈,我们会尽快为您处理(人工客服工作时间：9:00-18:30)。
CISCO 策略路由（PBR）配置实例
时间:2010-02-17 22:56来源:未知作者:admin 点击: 142次
策略路由选择可以选择修改下一跳地址以及标记数据包来提供不通的网络服务。
PBR一般用于修改基于源地址的下一跳地址。
推荐实现方式：PBR给于外发IP数据包标记IP优先位，这样方便了实施QoS策略。
一般来说，PBR是通过路由映射来配置的。
看个详细配置实例，你
策略路由选择可以选择修改下一跳地址以及标记数据包来提供不通的网络服务。
PBR一般用于修改基于源地址的下一跳地址。
推荐实现方式：PBR给于外发IP数据包标记IP优先位，这样方便了实施QoS策略。
一般来说，PBR是通过路由映射来配置的。
看个详细配置实例，你会更加明白：
定义了两个访问列表：10和20，经过配置使来自网络192.168.1.0/24的数据包的下一跳地址改为192.168.100.1；使来自 192.168.2.0/24的数据包的下一跳地址改为192.168.100.2.其他源始发的数据包正常路由。
命令如下：
My3377(config)#access-list 10 permit 192.168.1.0 //用访问控制列表先抓取路由
My3377(config)#access-list 20 permit 192.168.2.0
My3377(config)#route-map nexthop permit 10 //起个名字
My3377(config-route-map)#match ip address 10 //匹配一个列表
My3377(config-route-map)#set ip next-hop 192.168.100.1 //设置一个策略
My3377(config-route-map)#exit
My3377(config)#route-map nexthop permit 20
My3377(config-route-map)#match ip address 20
My3377(config-route-map)#set ip next-hop 192.168.100.2
My3377(config-route-map)#exit
My3377(config)#route-map nexthop permit 30
My3377(config)#int s2/1
My3377(config-if)#ip policy route-map nexthop //接口下调用My3377(config-if)#exit。