华为5700三层交换机在生产场景中做策略路由

 

我们在工作中经常会遇到这样的问题，就是有两条线路，一条电信一条移动，一条ADSL一条光纤。诸如此类的。但由于有三层交换机，我们往往把默认路由就指向了某一个出口。

这样我们另外一条线路基本上是闲置的，或者另作它用。这样并没有把线路利用率达到最大。

所以这里我们就需要在三层交换机里做策略路由。

没有做策略的就走我们的默认路由，做了策略的，就走我们指定的吓一跳地址。

大概思路就是先做好ACL，设定好网段走的指向，然后把策略应用到接口上，或者应用到VLAN上。这样，我们指定的某一网段就可以走我们规定的下一跳地址了。

大概拓扑图如图所上。

这里我们就不介绍如何配置单臂路由和trunk了。直接上我在华为5700交换机上已经配置好的配置吧！

<S5720-L3>dis cu
!Software Version V200R010C00SPC600
#
sysname S5720-L3
#
FTP server enable
#
vcmp role server
vcmp domain yiyuan
vcmp authentication sha2-256 password %^%#Vt=*@hApLH5ceW4Bh':-RQ*IMG`'j+`E}uCLieQ%%^%#
#
vlan batch 3 to 13
#
stp instance 0 root primary
#
authentication-profile name default_authen_profile
authentication-profile name dot1x_authen_profile
authentication-profile name mac_authen_profile
authentication-profile name portal_authen_profile
authentication-profile name dot1xmac_authen_profile
authentication-profile name multi_authen_profile
#
lacp priority 100
#
telnet server enable
#                                         
dhcp enable                               
#                                         
diffserv domain default                   
#                                         
radius-server template default            
#                                         
acl number 3009                           
 rule 10 permit ip destination 192.168.0.0 0.0.255.255
acl number 3010                           
 rule 10 permit ip source 192.168.7.0 0.0.0.255
 rule 11 permit ip source 192.168.6.0 0.0.0.255
#                                         
traffic classifier ecnet operator or      
 if-match acl 3010                        
traffic classifier innernet operator or   
 if-match acl 3009                        
#                                         
traffic behavior redirect                 
 redirect ip-nexthop 192.168.3.18         
traffic behavior yunxu                    
 permit                                   
#                                         
traffic policy EcRouter match-order config
 classifier innernet behavior yunxu       
 classifier ecnet behavior redirect       
#                                         
free-rule-template name default_free_rule 
#                                         
portal-access-profile name portal_access_profile
#                                         
drop-profile default                      
#                                         
ip pool 3                                 
 gateway-list 192.168.3.253               
 network 192.168.3.0 mask 255.255.255.0   
 excluded-ip-address 192.168.3.1 192.168.3.5
 excluded-ip-address 192.168.3.100 192.168.3.130
 excluded-ip-address 192.168.3.252        
 excluded-ip-address 192.168.3.254        
 lease day 300 hour 0 minute 0            
 dns-list 192.168.3.1 192.168.3.254       
#                                         
ip pool 4                                 
 gateway-list 192.168.4.254               
 network 192.168.4.0 mask 255.255.255.0   
 excluded-ip-address 192.168.4.1          
 excluded-ip-address 192.168.4.253        
 lease day 300 hour 0 minute 0            
 dns-list 192.168.3.1 192.168.3.254       
#                                         
ip pool 5                                 
 gateway-list 192.168.5.254               
 network 192.168.5.0 mask 255.255.255.0   
 excluded-ip-address 192.168.5.1          
 excluded-ip-address 192.168.5.253        
 lease day 300 hour 0 minute 0            
 dns-list 192.168.3.1 192.168.3.254       
#                                         
ip pool 6                                 
 gateway-list 192.168.6.254               
 network 192.168.6.0 mask 255.255.255.0   
 excluded-ip-address 192.168.6.1          
 excluded-ip-address 192.168.6.253        
 lease day 300 hour 0 minute 0            
 dns-list 192.168.3.1 192.168.3.254       
#                                         
ip pool 7                                 
 gateway-list 192.168.7.254               
 network 192.168.7.0 mask 255.255.255.0   
 excluded-ip-address 192.168.7.1          
 excluded-ip-address 192.168.7.253        
 lease day 300 hour 0 minute 0            
 dns-list 192.168.3.1 192.168.3.254       
#                                         
ip pool 8                                 
 gateway-list 192.168.8.254               
 network 192.168.8.0 mask 255.255.255.0   
 excluded-ip-address 192.168.8.1          
 excluded-ip-address 192.168.8.253        
 lease day 300 hour 0 minute 0            
 dns-list 192.168.3.1 192.168.3.254       
#                                         
ip pool 9                                 
 gateway-list 192.168.9.254               
 network 192.168.9.0 mask 255.255.255.0   
 excluded-ip-address 192.168.9.1          
 excluded-ip-address 192.168.9.253        
 lease day 300 hour 0 minute 0            
 dns-list 192.168.3.1 192.168.3.254       
#                                         
ip pool 20                                
#                                         
ip pool 11                                
 gateway-list 192.168.11.254              
 network 192.168.11.0 mask 255.255.255.0  
 lease day 300 hour 0 minute 0            
 dns-list 192.168.3.1 192.168.3.254       
#                                         
ip pool 13                                
 gateway-list 192.168.13.254              
 network 192.168.13.0 mask 255.255.255.0  
 excluded-ip-address 192.168.13.1 192.168.13.2
 excluded-ip-address 192.168.13.252 192.168.13.253
 lease day 300 hour 0 minute 0            
 dns-list 192.168.3.1 192.168.3.254       
#                                         
aaa                                       
 authentication-scheme default            
 authentication-scheme radius             
  authentication-mode radius              
 authorization-scheme default             
 accounting-scheme default                
 local-aaa-user password policy administrator
  password expire 0                       
 domain default                           
  authentication-scheme radius            
  radius-server default                   
 domain default_admin                     
  authentication-scheme default           
 local-user admin password irreversible-cipher $1a$\0a<Ri;(DK$DeA@5{qo/#)v59SA455C^il`6jL&sF#N4/VTPb'U$
 local-user admin privilege level 3       
 local-user admin service-type telnet terminal
 local-user huawei password irreversible-cipher $1a$@vX7<1zJ`#$Oz<JS-rSj#3)P9G[2&y)~h'mE6&m:GCEU{!-.E{F$
 local-user huawei privilege level 3      
 local-user huawei ftp-directory flash:   
 local-user huawei service-type ftp       
#                                         
interface Vlanif1                         
#                                         
interface Vlanif3                         
 ip address 192.168.3.253 255.255.255.0   
 dhcp select global                       
#                                         
interface Vlanif4                         
 ip address 192.168.4.254 255.255.255.0   
 dhcp select global                       
#                                         
interface Vlanif5                         
 ip address 192.168.5.254 255.255.255.0   
 dhcp select global                       
#                                         
interface Vlanif6                         
 ip address 192.168.6.254 255.255.255.0   
 traffic-policy EcRouter inbound          
 dhcp select global                       
#                                         
interface Vlanif7                         
 ip address 192.168.7.254 255.255.255.0   
 traffic-policy EcRouter inbound          
 dhcp select global                       
#                                         
interface Vlanif8                         
 ip address 192.168.8.254 255.255.255.0   
 dhcp select global                       
#                                         
interface Vlanif9                         
 ip address 192.168.9.254 255.255.255.0   
 dhcp select global                       
#                                         
interface Vlanif10                        
#                                         
interface Vlanif11                        
 ip address 192.168.11.254 255.255.255.0  
 dhcp select global                       
#                                         
interface Vlanif12                        
 ip address 192.168.12.254 255.255.255.0  
#                                         
interface Vlanif13                        
 ip address 192.168.13.254 255.255.255.0  
 dhcp select global                       
#                                         
interface MEth0/0/1                       
#                                         
interface Eth-Trunk1                      
 port link-type trunk                     
 port trunk allow-pass vlan 2 to 4094     
 mode lacp                                
 max active-linknumber 2                  
#                                         
interface Eth-Trunk2                      
 port link-type trunk                     
 port trunk allow-pass vlan 2 to 4094     
 mode lacp                                
 max active-linknumber 2                  
#                                         
interface Eth-Trunk3                      
 port link-type trunk                     
 port trunk allow-pass vlan 2 to 4094     
 mode lacp                                
 max active-linknumber 2                  
#                                         
interface Eth-Trunk4                      
 port link-type trunk                     
 port trunk allow-pass vlan 2 to 4094     
 mode lacp                                
 max active-linknumber 2                  
#                                         
interface Eth-Trunk5                      
 port link-type trunk                     
 port trunk allow-pass vlan 2 to 4094     
 mode lacp                                
 max active-linknumber 2                  
#                                         
interface Eth-Trunk6                      
 port link-type trunk                     
 port trunk allow-pass vlan 2 to 4094     
 mode lacp                                
 max active-linknumber 2                  
#                                         
interface Eth-Trunk7                      
 port link-type trunk                     
 port trunk allow-pass vlan 2 to 4094     
 mode lacp                                
 max active-linknumber 2                  
#                                         
interface Eth-Trunk8                      
#                                         
interface GigabitEthernet0/0/1            
 eth-trunk 1                              
 lacp priority 100                        
#                                         
interface GigabitEthernet0/0/2            
 eth-trunk 1                              
 lacp priority 100                        
#                                         
interface GigabitEthernet0/0/3            
 eth-trunk 2                              
 lacp priority 100                        
#                                         
interface GigabitEthernet0/0/4            
 eth-trunk 2                              
 lacp priority 100                        
#                                         
interface GigabitEthernet0/0/5            
 eth-trunk 3                              
 lacp priority 100                        
#                                         
interface GigabitEthernet0/0/6            
 eth-trunk 3                              
 lacp priority 100                        
#                                         
interface GigabitEthernet0/0/7            
 eth-trunk 4                              
 lacp priority 100                        
#                                         
interface GigabitEthernet0/0/8            
 eth-trunk 4                              
 lacp priority 100                        
#                                         
interface GigabitEthernet0/0/9            
 eth-trunk 5                              
 lacp priority 100                        
#                                         
interface GigabitEthernet0/0/10           
 eth-trunk 5                              
 lacp priority 100                        
#                                         
interface GigabitEthernet0/0/11           
 eth-trunk 6                              
 lacp priority 100                        
#                                         
interface GigabitEthernet0/0/12           
 eth-trunk 6                              
 lacp priority 100                        
#                                         
interface GigabitEthernet0/0/13           
 shutdown                                 
 eth-trunk 7                              
 lacp priority 100                        
#                                         
interface GigabitEthernet0/0/14           
 shutdown                                 
 eth-trunk 7                              
 lacp priority 100                        
#                                         
interface GigabitEthernet0/0/15           
 port link-type access                    
 port default vlan 3                      
#                                         
interface GigabitEthernet0/0/16           
 port link-type access                    
 port default vlan 3                      
#                                         
interface GigabitEthernet0/0/17           
 port link-type access                    
 port default vlan 3                      
#                                         
interface GigabitEthernet0/0/18           
 port link-type access                    
 port default vlan 3                      
#                                         
interface GigabitEthernet0/0/19           
 port link-type access                    
 port default vlan 3                      
#                                         
interface GigabitEthernet0/0/20           
 port link-type access                    
 port default vlan 3                      
#                                         
interface GigabitEthernet0/0/21           
 port link-type access                    
 port default vlan 3                      
#                                         
interface GigabitEthernet0/0/22           
 port link-type access                    
 port default vlan 3                      
#                                         
interface GigabitEthernet0/0/23           
 port link-type access                    
 port default vlan 3                      
#                                         
interface GigabitEthernet0/0/24           
 port link-type access                    
 port default vlan 3                      
#                                         
interface GigabitEthernet0/0/25           
 port link-type access                    
 port default vlan 6                      
#                                         
interface GigabitEthernet0/0/26           
 port link-type access                    
 port default vlan 3                      
#                                         
interface GigabitEthernet0/0/27           
 port link-type access                    
 port default vlan 3                      
#                                         
interface GigabitEthernet0/0/28           
 port link-type access                    
 port default vlan 3                      
#                                         
interface GigabitEthernet0/0/29           
 port link-type access                    
 port default vlan 3                      
#                                         
interface GigabitEthernet0/0/30           
 port link-type access                    
 port default vlan 3                      
#                                         
interface GigabitEthernet0/0/31           
 port link-type access                    
 port default vlan 3                      
#                                         
interface GigabitEthernet0/0/32           
 port link-type access                    
 port default vlan 3                      
#                                         
interface GigabitEthernet0/0/33           
 port link-type access                    
 port default vlan 3                      
#                                         
interface GigabitEthernet0/0/34           
 port link-type access                    
 port default vlan 3                      
#                                         
interface GigabitEthernet0/0/35           
 port link-type access                    
 port default vlan 3                      
#                                         
interface GigabitEthernet0/0/36           
 port link-type access                    
 port default vlan 3                      
#                                         
interface GigabitEthernet0/0/37           
 port link-type access                    
 port default vlan 3                      
#                                         
interface GigabitEthernet0/0/38           
 port link-type access                    
 port default vlan 3                      
#                                         
interface GigabitEthernet0/0/39           
 port link-type access                    
 port default vlan 3                      
#                                         
interface GigabitEthernet0/0/40           
 port link-type access                    
 port default vlan 3                      
#                                         
interface GigabitEthernet0/0/41           
 port link-type access                    
 port default vlan 3                      
#                                         
interface GigabitEthernet0/0/42           
 port link-type access                    
 port default vlan 3                      
#                                         
interface GigabitEthernet0/0/43           
 port link-type access                    
 port default vlan 3                      
#                                         
interface GigabitEthernet0/0/44           
 port link-type access                    
 port default vlan 3                      
#                                         
interface GigabitEthernet0/0/45           
 port link-type access                    
 port default vlan 12                     
#                                         
interface GigabitEthernet0/0/46           
 port link-type access                    
 port default vlan 3                      
#                                         
interface GigabitEthernet0/0/47           
 port link-type access                    
 port default vlan 3                      
#                                         
interface GigabitEthernet0/0/48           
 port link-type access                    
 port default vlan 3                      
#                                         
interface GigabitEthernet0/0/49           
 port link-type access                    
 port default vlan 13                     
#                                         
interface GigabitEthernet0/0/50           
#                                         
interface GigabitEthernet0/0/51           
#                                         
interface GigabitEthernet0/0/52           
#                                         
interface NULL0                           
#                                         
ip route-static 0.0.0.0 0.0.0.0 192.168.3.18 preference 30
ip route-static 0.0.0.0 0.0.0.0 192.168.3.254 preference 20
ip route-static 10.0.0.0 255.255.255.0 192.168.3.250
ip route-static 172.0.10.0 255.255.255.252 192.168.3.250
ip route-static 192.168.0.0 255.255.255.0 192.168.3.250
ip route-static 192.168.10.0 255.255.255.0 192.168.3.250
ip route-static 192.168.20.0 255.255.255.0 192.168.3.250
ip route-static 192.168.50.0 255.255.255.0 192.168.3.250
#                                         
snmp-agent                                
snmp-agent local-engineid 800007DB03340A98CCA7A0
snmp-agent sys-info version v3            
#                                         
user-interface maximum-vty 8              
user-interface con 0                      
 authentication-mode aaa                  
user-interface vty 0 4                    
 authentication-mode aaa                  
 protocol inbound telnet                  
user-interface vty 5 7                    
user-interface vty 16 20                  
#                                         
port-group bangongshi                     
 group-member GigabitEthernet0/0/15       
 group-member GigabitEthernet0/0/16       
 group-member GigabitEthernet0/0/17       
 group-member GigabitEthernet0/0/18       
 group-member GigabitEthernet0/0/19       
 group-member GigabitEthernet0/0/20       
 group-member GigabitEthernet0/0/21       
 group-member GigabitEthernet0/0/22       
 group-member GigabitEthernet0/0/23       
 group-member GigabitEthernet0/0/24       
 group-member GigabitEthernet0/0/25       
 group-member GigabitEthernet0/0/26       
 group-member GigabitEthernet0/0/27       
 group-member GigabitEthernet0/0/28       
 group-member GigabitEthernet0/0/29       
 group-member GigabitEthernet0/0/30       
 group-member GigabitEthernet0/0/31       
 group-member GigabitEthernet0/0/32       
 group-member GigabitEthernet0/0/33       
 group-member GigabitEthernet0/0/34       
 group-member GigabitEthernet0/0/35       
 group-member GigabitEthernet0/0/36       
 group-member GigabitEthernet0/0/37       
 group-member GigabitEthernet0/0/38       
 group-member GigabitEthernet0/0/39       
 group-member GigabitEthernet0/0/40       
 group-member GigabitEthernet0/0/41       
 group-member GigabitEthernet0/0/42       
 group-member GigabitEthernet0/0/43       
 group-member GigabitEthernet0/0/44       
 group-member GigabitEthernet0/0/46       
 group-member GigabitEthernet0/0/47       
 group-member GigabitEthernet0/0/48       
#                                         
port-group chejian1                       
 group-member GigabitEthernet0/0/1        
 group-member GigabitEthernet0/0/2        
#                                         
port-group chejian2                       
 group-member GigabitEthernet0/0/3        
 group-member GigabitEthernet0/0/4        
#                                         
port-group chejian3                       
 group-member GigabitEthernet0/0/5        
 group-member GigabitEthernet0/0/6        
#                                         
port-group chejian4                       
 group-member GigabitEthernet0/0/7        
 group-member GigabitEthernet0/0/8        
#                                         
port-group chejian5                       
 group-member GigabitEthernet0/0/9        
 group-member GigabitEthernet0/0/10       
#                                         
port-group chejian6                       
 group-member GigabitEthernet0/0/11       
 group-member GigabitEthernet0/0/12       
#                                         
port-group chejian7                       
 group-member GigabitEthernet0/0/13       
 group-member GigabitEthernet0/0/14       
#                                         
port-group dachi8                         
 group-member GigabitEthernet0/0/49       
#                                         
dot1x-access-profile name dot1x_access_profile
#                                         
mac-access-profile name mac_access_profile
#                                         
return                                    
<S5720-L3>                                
<S5720-L3>
<S5720-L3>

这里着重指出看一下ACL的配置和策略的应用。

#                                         
acl number 3009                           
 rule 10 permit ip destination 192.168.0.0 0.0.255.255
acl number 3010                           
 rule 10 permit ip source 192.168.7.0 0.0.0.255
 rule 11 permit ip source 192.168.6.0 0.0.0.255
#                                         
traffic classifier ecnet operator or      
 if-match acl 3010                        
traffic classifier innernet operator or   
 if-match acl 3009                        
#                                         
traffic behavior redirect                 
 redirect ip-nexthop 192.168.3.18         
traffic behavior yunxu                    
 permit                                   
#                                         
traffic policy EcRouter match-order config
 classifier innernet behavior yunxu       
 classifier ecnet behavior redirect       
#   

#                                         
ip route-static 0.0.0.0 0.0.0.0 192.168.3.18 preference 30
ip route-static 0.0.0.0 0.0.0.0 192.168.3.254 preference 20
ip route-static 10.0.0.0 255.255.255.0 192.168.3.250
ip route-static 172.0.10.0 255.255.255.252 192.168.3.250
ip route-static 192.168.0.0 255.255.255.0 192.168.3.250
ip route-static 192.168.10.0 255.255.255.0 192.168.3.250
ip route-static 192.168.20.0 255.255.255.0 192.168.3.250
ip route-static 192.168.50.0 255.255.255.0 192.168.3.250
#     

#                                         
interface Vlanif6                         
 ip address 192.168.6.254 255.255.255.0   
 traffic-policy EcRouter inbound          
 dhcp select global                       
#                                         
interface Vlanif7                         
 ip address 192.168.7.254 255.255.255.0   
 traffic-policy EcRouter inbound          
 dhcp select global                       
#    

这里提一下华为ACL的分类

ACL的分类：

（1）：按照ACL过滤的报文类型和功能划分

基本acl（2000-2999）：只能匹配源ip地址。
高级acl（3000-3999）：可以匹配源ip、目标ip、源端口、目标端口等三层和四层的字段。

① 接口ACL（编号1000-----19999）
② 基本ACL（编号2000-----2999）
③ 高级ACL（编号3000-----3999）
④ 二层ACL（编号4000-----4999）
⑤ 自定义ACL（编号5000----5999）

参考一下这篇文章

https://www.q578.com/s-5-2432926-0/

华为交换机+双链路出口参考以下两篇文章

http://t.zoukankan.com/niewd-p-14174326.html

https://www.cnblogs.com/niewd/p/16020723.html

 

-------------------------------------------------------------------------------------------------

至此结束了！

附上最后的测试结果。

 

 

 

如果是思科的交换机，请参考下面。

https://blog.csdn.net/qq_33468857/article/details/94822669

Switch>en
Switch#conf t
Switch(config)#
Switch(config)#sdm prefer routing
Switch(config)#end
Switch#wri
Switch#reload

Switch(config)#access-list 101 permit ip any 172.30.218.0 0.0.0.255 //101以上是扩展访问控制列表 ；0.0.0.255是通配符 与子网掩码的通配符正好相反

Switch(config)#route-map Gaoxiong permit 10
Switch(config-route-map)#match ip address 101
Switch(config-route-map)#set ip next-hop 123.158.40.2 //符合策略的包转发到的下一跳地址
Switch(config)#interface vlan 1
[Switch(config)#interface gigabitEthernet 0/7 这是直接绑在物理接口上] //很重要！必须绑定在数据入口的接口上才能达到设想的要求。因为数据包在离开的接口上是已经路由过的，不会再走策略路由

[-- Switch(config)#interface vlan 1 -- 或者绑定在VLAN1虚拟接口上也可以]
Switch(config-if)#ip policy route-map GaoXiong

[--如果是绑定在VLAN1虚拟接口上 则要将真实接口放进来--]
Switch(config)#interface gigabitEthernet 1/0/10
Switch(config-if)#switchport mode access
Switch(config-if)#switchport access vlan 1
Switch(config-if)#end
————————————————
版权声明：本文为CSDN博主「neo_will_mvp」的原创文章，遵循CC 4.0 BY-SA版权协议，转载请附上原文出处链接及本声明。
原文链接：https://blog.csdn.net/qq_33468857/article/details/94822669

 

https://blog.csdn.net/a9254778/article/details/9125523

这里特别说明一下，因为我的机器的思科3560 交换机。单固件版本是BASE版本的，这个版本的功能有限，services这个版本功能多。services的版本才支持pbr，也就是策略路由。