华为AR路由器策略路由根据源地址筛选分流+ACL

posted @   du-z  阅读(719)  评论(0)  编辑  收藏  举报
undefined
undefined

1 方案背景

  1. 公司接入两条宽带，一条为5口一条为9口；
  2. 公司内网有103、106、107三个c的网段需要访问外网
  3. 现希望源地址为192.168.103.0/24 和192.168.106.0/24两个网段的数据包统一走9口；源地址为192.168.107.0/24网段的数据包可以走5口和9口，优先走5口。

2 配置方案

策略路由分流参考链接：https://forum.huawei.com/enterprise/zh/thread/580912190884560896
NQA示例配置参考链接：https://support.huawei.com/hedex/hdx.do?docid=EDOC1100021764&id=destination-address
策略路由绑定NQA参考链接：https://support.huawei.com/hedex/hdx.do?docid=EDOC1100021764&id=redirect_ip-nexthop

2.1 原配置查询

2.1.1、查询原配置默认路由

现环境两条宽带都是可以正常上网的

<luyou>display ip routing-table 
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: Public
         Destinations : 14       Routes : 14       

Destination/Mask    Proto   Pre  Cost      Flags NextHop         Interface

        0.0.0.0/0   Static  60   0          RD   221.219.208.241 GigabitEthernet0/0/5
     10.10.11.0/24  Direct  0    0           D   10.10.11.1      GigabitEthernet0/0/6   //注意回指6口的路由
     10.10.11.1/32  Direct  0    0           D   127.0.0.1       GigabitEthernet0/0/6
   10.10.11.255/32  Direct  0    0           D   127.0.0.1       GigabitEthernet0/0/6
      127.0.0.0/8   Direct  0    0           D   127.0.0.1       InLoopBack0
      127.0.0.1/32  Direct  0    0           D   127.0.0.1       InLoopBack0
127.255.255.255/32  Direct  0    0           D   127.0.0.1       InLoopBack0
   192.168.99.0/24  Direct  0    0           D   192.168.99.2    GigabitEthernet0/0/9
   192.168.99.2/32  Direct  0    0           D   127.0.0.1       GigabitEthernet0/0/9
 192.168.99.255/32  Direct  0    0           D   127.0.0.1       GigabitEthernet0/0/9
221.219.208.240/30  Direct  0    0           D   221.219.208.242 GigabitEthernet0/0/5
221.219.208.242/32  Direct  0    0           D   127.0.0.1       GigabitEthernet0/0/5
221.219.208.243/32  Direct  0    0           D   127.0.0.1       GigabitEthernet0/0/5
255.255.255.255/32  Direct  0    0           D   127.0.0.1       InLoopBack0

<luyou>
<luyou>

<luyou>display current-configuration 
...
ip route-static 0.0.0.0 0.0.0.0 221.219.208.241    #华为AR设备默认preference为60，优先级数字越小优先级越高
ip route-static 0.0.0.0 0.0.0.0 192.168.99.1 preference 101  
...

##注释：
#1、221.219.208.242为GigabitEthernet0/0/5口的IP地址。
#2、192.168.99.2为GigabitEthernet0/0/9口的IP地址，9口对端链接的是光猫。

2.2 变更配置方案

2.2.1 创建ACL指定匹配规则

<luyou>	
<luyou>system-view 
Enter system view, return user view with Ctrl+Z.
[luyou]acl number 3999
[luyou-acl-adv-3999]rule 5 permit ip source 192.168.103.0 0.0.0.255
[luyou-acl-adv-3999]rule 10 permit ip source 192.168.106.0 0.0.0.255
[luyou-acl-adv-3999]quit
[luyou]
[luyou]display acl all
 Total quantity of nonempty ACL number is 1 

Advanced ACL 3999, 2 rules
Acl's step is 5
 rule 5 permit ip source 192.168.103.0 0.0.0.255 
 rule 10 permit ip source 192.168.106.0 0.0.0.255 

[luyou]

2.2.2 配置流量分类

[luyou]
[luyou]traffic classifier fenliu1
[luyou-classifier-fenliu1]if-match acl 3999
[luyou-classifier-fenliu1]quit
[luyou]
[luyou]
[luyou]display traffic classifier user-defined
  User Defined Classifier Information:
   Classifier: fenliu1
    Operator: OR
    Rule(s) : 
     if-match acl 3999
[luyou]
[luyou]

2.2.3 配置nqa

[luyou]
[luyou]nqa test-instance fenliu fenliu1
[luyou-nqa-fenliu-fenliu1]test-type icmp
[luyou-nqa-fenliu-fenliu1]destination-address ipv4 192.168.99.1
[luyou-nqa-fenliu-fenliu1]frequency 15
[luyou-nqa-fenliu-fenliu1]
[luyou-nqa-fenliu-fenliu1]display this
[V200R009C00SPC500]
#
nqa test-instance fenliu fenliu1
 test-type icmp
 destination-address ipv4 192.168.99.1
 frequency 15
#
return	
[luyou-nqa-fenliu-fenliu1]start now    
[luyou-nqa-fenliu-fenliu1]	
[luyou-nqa-fenliu-fenliu1]quit 
[luyou]

##注意：
# frequency 15 测试例连续两次执行的时间间隔,整数形式，单位是秒。缺省情况下，没有配置自动测试间隔，即只进行一次测试。
# start now  启动测试；如果没有配置结束时间，测试不能自动停止，必须通过手动停止（stop）。不能更改正在运行的测试例的测试周期。

2.2.4 配置流行为

[luyou]	
[luyou]traffic behavior fenliu1	
[luyou-behavior-fenliu1]redirect ip-nexthop 192.168.99.1 track nqa fenliu fenliu1
[luyou-behavior-fenliu1]quit   
[luyou] 
[luyou]display traffic behavior user-defined
  User Defined Behavior Information:
    Behavior: fenliu1 
      Redirect: 
        Redirect ip-nexthop 192.168.99.1 track nqa fenliu fenliu1
[luyou]
[luyou]

2.2.5 配置流策略

[luyou]
[luyou]traffic policy fenliu
[luyou-trafficpolicy-fenliu]
[luyou-trafficpolicy-fenliu]classifier fenliu1 behavior fenliu1 
[luyou-trafficpolicy-fenliu]quit
[luyou]
[luyou]display traffic policy user-defined
  User Defined Traffic Policy Information:
  Policy: fenliu
   Classifier: fenliu1
    Operator: OR
     Behavior: fenliu1
      Redirect: 
        Redirect ip-nexthop 192.168.99.1 track nqa fenliu fenliu1
     Precedence: 5
[luyou]

2.2.6 应用流策略

[luyou]
[luyou]interface GigabitEthernet 0/0/6	
[luyou-GigabitEthernet0/0/6]display this 
[V200R009C00SPC500]
#
interface GigabitEthernet0/0/6
 ip address 10.10.11.1 255.255.255.0
#
return
	
[luyou-GigabitEthernet0/0/6]traffic-policy fenliu inbound 	
[luyou-GigabitEthernet0/0/6]display this 
[V200R009C00SPC500]
#
interface GigabitEthernet0/0/6
 ip address 10.10.11.1 255.255.255.0
 traffic-policy fenliu inbound
#
return
[luyou-GigabitEthernet0/0/6]

2.2.7 保存配置

save

2.2.8 问题排查配置流行为包统计

[luyou]traffic behavior fenliu1
[luyou-behavior-fenliu1]disp	
[luyou-behavior-fenliu1]display this
[V200R009C00SPC500]
#
traffic behavior fenliu1
 redirect ip-nexthop 192.168.99.1 track nqa fenliu fenliu1
 statistic enable      //做统计用的配置
#
return
[luyou-behavior-fenliu1]
[luyou-behavior-fenliu1]quit   
[luyou] 
[luyou]display traffic policy statistics interface GigabitEthernet0/0/6    inbound verbose rule-base

Interface: GigabitEthernet0/0/6
Traffic policy inbound: fenliu
 Rule number: 2
 Current status: OK!
 Classifier: fenliu1 operator or
 Behavior: fenliu1
 rule 5 permit ip source 192.168.103.0 0.0.0.255 
  Passed Packet                     1,201,Passed Bytes                   139,027
  Dropped Packet                        0,Dropped Bytes                        0
 rule 10 permit ip source 192.168.106.0 0.0.0.255 
  Passed Packet                     4,289,Passed Bytes                   691,169
  Dropped Packet                        0,Dropped Bytes                        0
[luyou]

2.2.9查看NQA（Network Quality Analyzer，网络质量分析器）的测试结果

[luyou]display nqa results test-instance fenliu fenliu1
 
 NQA entry(fenliu, fenliu1) :testflag is active ,testtype is icmp 
  1 . Test 5864 result   The test is finished
   Send operation times: 3              Receive response times: 3          
   Completion:success                   RTD OverThresholds number: 0       
   Attempts number:1                    Drop operation number:0            
   Disconnect operation number:0        Operation timeout number:0         
   System busy operation number:0       Connection fail number:0           
   Operation sequence errors number:0   RTT Status errors number:0         
   Destination ip address:192.168.99.1                                   
   Min/Max/Average Completion Time: 1/1/1                                
   Sum/Square-Sum  Completion Time: 3/3                                  
   Last Good Probe Time: 2024-03-05 11:20:24.4                           
   Lost packet ratio: 0 %                                                
  2 . Test 5865 result   The test is finished
   Send operation times: 3              Receive response times: 3          
   Completion:success                   RTD OverThresholds number: 0       
   Attempts number:1                    Drop operation number:0            
   Disconnect operation number:0        Operation timeout number:0         
   System busy operation number:0       Connection fail number:0           
   Operation sequence errors number:0   RTT Status errors number:0         
   Destination ip address:192.168.99.1                                   
   Min/Max/Average Completion Time: 1/1/1                                
   Sum/Square-Sum  Completion Time: 3/3                                  
   Last Good Probe Time: 2024-03-05 11:20:39.4                           
   Lost packet ratio: 0 %                                                
  3 . Test 5866 result   The test is finished
   Send operation times: 3              Receive response times: 3          
   Completion:success                   RTD OverThresholds number: 0       
   Attempts number:1                    Drop operation number:0            
   Disconnect operation number:0        Operation timeout number:0         
   System busy operation number:0       Connection fail number:0           
   Operation sequence errors number:0   RTT Status errors number:0         
   Destination ip address:192.168.99.1                                   
   Min/Max/Average Completion Time: 1/1/1                                
   Sum/Square-Sum  Completion Time: 3/3                                  
   Last Good Probe Time: 2024-03-05 11:20:54.4                           
   Lost packet ratio: 0 %                                                
  4 . Test 5867 result   The test is finished
   Send operation times: 3              Receive response times: 3          
   Completion:success                   RTD OverThresholds number: 0       
   Attempts number:1                    Drop operation number:0            
   Disconnect operation number:0        Operation timeout number:0         
   System busy operation number:0       Connection fail number:0           
   Operation sequence errors number:0   RTT Status errors number:0         
   Destination ip address:192.168.99.1                                   
   Min/Max/Average Completion Time: 1/1/1                                
   Sum/Square-Sum  Completion Time: 3/3                                  
   Last Good Probe Time: 2024-03-05 11:21:09.4                           
   Lost packet ratio: 0 %                                                
  5 . Test 5868 result   The test is finished
   Send operation times: 3              Receive response times: 3          
   Completion:success                   RTD OverThresholds number: 0       
   Attempts number:1                    Drop operation number:0            
   Disconnect operation number:0        Operation timeout number:0         
   System busy operation number:0       Connection fail number:0           
   Operation sequence errors number:0   RTT Status errors number:0         
   Destination ip address:192.168.99.1                                   
   Min/Max/Average Completion Time: 1/1/1                                
   Sum/Square-Sum  Completion Time: 3/3                                  
   Last Good Probe Time: 2024-03-05 11:21:24.4                           
   Lost packet ratio: 0 %                                                
[luyou]

##这里有三个测试实例（Test 5864, Test 5865, Test 5866），每个测试实例都执行了三次操作（Send operation times: 3），并且每次操作都成功接收到了响应（Receive response times: 3）。测试结果显示所有操作都成功完成（Completion:success），没有数据包丢失（Lost packet ratio: 0 %），并且没有超时、连接失败或其他错误。

2.3 结果

  1. 配置是成功的，这个方法是可用的；
  2. 但是我们在测试的时候会发现，我们还是走5口；
  3. 因为我们查看路由可以看到，我们回指6口的路由中只有10.10.11.0/24 是走向6口的；
  4. 所以推断，外网数据包在进入6口之前是有做过源地址转换映射的、所以我们通过acl源地址匹配是匹配不上的；
  5. 所以我们在选用这个方法的时候需要先检查路由，看组网中是否有做源地址转换的地方；
  6. 那为什么acl匹配结果是有被匹配的数据包呢？
posted @   du-z  阅读(719)  评论(0)  编辑  收藏  举报
相关博文：
·  华为AR路由器常用配置命令
·  消息队列的技术选型
·  华为路由策略实验
·  HUAWEI-基于流策略实现策略路由+NAT44
·  华为--汇总文章
阅读排行：
· 25岁的心里话
· 闲置电脑爆改个人服务器（超详细） #公网映射 #Vmware虚拟网络编辑器
· 零经验选手，Compose 一天开发一款小游戏！
· 通过 API 将Deepseek响应流式内容输出到前端
· 因为Apifox不支持离线，我果断选择了Apipost！
1 方案背景2 配置方案2.1 原配置查询2.1.1、查询原配置默认路由2.2 变更配置方案2.2.1 创建ACL指定匹配规则2.2.2 配置流量分类2.2.3 配置nqa2.2.4 配置流行为2.2.5 配置流策略2.2.6 应用流策略2.2.7 保存配置2.2.8 问题排查配置流行为包统计2.2.9查看NQA（Network Quality Analyzer，网络质量分析器）的测试结果2.3 结果
点击右上角即可分享
微信分享提示