ps怎么做网站导航内嵌式广州seo工程师
网络运维与网络安全 学习笔记 第二十九天
 
今日目标
OSPF汇总之域间路由、OSPF汇总之外部路由、OSPF链路认证
 OSPF安全认证之区域认证、OSPF虚链路
OSPF汇总指域间路由
项目背景
企业内网运行多区域的OSPF网络,在R1 上存在多个不稳定的链路
 R1上的不稳定链路,会影响到骨干区域的稳定性
 希望通过技术方案,降低区域12的不稳定性对区域0的影响
项目分析
R1的每个接口通过OSPF进入区域0后,是以3类LSA的形式存在
 3类LSA,只能由ABR(R2)产生
 如果ABR不产生这些路由的LSA,就不会对区域0产生影响
解决方案
在R2上,对区域12中的路由,进行“路由汇总”
 路由汇总的本质就是“将很多的路由,变成很少的路由。只发汇总之后的路由,不发明细路由
 配置思路
 如图配置接口IP地址和OSPF区域
 在R1上,将Lookback接口,宣告进入到区域12
 在R2上,对区域12中的路由,进行汇总
 配置命令
 在区域12的ABR(R2)上配置
 ospf 1
 area 12
 abr-summary 10.10.0.0 255.255.0.0
 //将区域12发向区域0的路由,汇总成路由10.10.0.0/16
配置步骤

 ①配置OSPF - R1
 undo terminal monitor
 system-view
 [Huawei]sysname R1
 [R1]interface GigabitEthernet0/0/0
 [R1-GigabitEthernet0/0/0]ip address 192.168.12.1 24
 [R1-GigabitEthernet0/0/0]quit
[R1]interface LoopBack 1
 [R1-LoopBack1]ip address 10.10.1.1 24
 [R1-LoopBack1]quit
[R1]interface LoopBack 2
 [R1-LoopBack2]ip address 10.10.2.2 24
 [R1-LoopBack2]quit
[R1]interface LoopBack 3
 [R1-LoopBack3]ip address 10.10.3.3 24
 [R1-LoopBack3]quit
[R1]interface LoopBack 4
 [R1-LoopBack4]ip address 10.10.4.4 24
 [R1-LoopBack4]quit
[R1]ospf 1 router-id 1.1.1.1
 [R1-ospf-1]area 12
 [R1-ospf-1-area-0.0.0.12]network 10.10.1.0 0.0.0.255
 [R1-ospf-1-area-0.0.0.12]network 10.10.2.0 0.0.0.255
 [R1-ospf-1-area-0.0.0.12]network 10.10.3.0 0.0.0.255
 [R1-ospf-1-area-0.0.0.12]network 10.10.4.0 0.0.0.255
 [R1-ospf-1-area-0.0.0.12]network 192.168.12.0 0.0.0.255
 [R1-ospf-1-area-0.0.0.12]quit
 ②配置OSPF - R2
 undo terminal monitor
 system-view
 [Huawei]sysname R2
 [R2]interface GigabitEthernet0/0/1
 [R2-GigabitEthernet0/0/1]ip address 192.168.12.2 24
 [R2-GigabitEthernet0/0/1]quit
[R2]interface GigabirEthernet0/0/0
 [R2-GigabitEthernet0/0/0]ip address 192.168.23.2 24
 [R2-GigabitEthernet0/0/0]quit
[R2]ospf 1 router-id 2.2.2.2
 [R2-ospf-1]area 12
 [R2-ospf-1-area-0.0.0.12]network 192.168.12.0 0.0.0.255
 [R2-ospf-1-area-0.0.0.12]quit
 [R2-ospf-1]area 0
 [R2-ospf-1-area-0.0.0.0]network 192.168.23.0 0.0.0.255
 [R2-ospf-1-area-0.0.0.0]quit
 ③配置OSPF - R3
 undo terminal monitor
 system-view
 [Huawei]sysname R3
 [R3]interface GigabitEthernet0/0/1
 [R3-GigabitEthernet0/0/1]ip address 192.168.23.3 24
 [R3-GigabitEthernet0/0/1]quit
[R3]interface GigabirEthernet0/0/0
 [R3-GigabitEthernet0/0/0]ip address 192.168.34.3 24
 [R3-GigabitEthernet0/0/0]quit
[R3]ospf 1 router-id 3.3.3.3
 [R3-ospf-1]area 0
 [R3-ospf-1-area-0.0.0.0]network 192.168.34.0 0.0.0.255
 [R3-ospf-1-area-0.0.0.0]network 192.168.23.0 0.0.0.255
 [R3-ospf-1-area-0.0.0.0]quit
 ④配置OSPF - R4
 undo terminal monitor
 system-view
 [Huawei]sysname R4
 [R4]interface GigabitEthernet0/0/1
 [R4-GigabitEthernet0/0/1]ip address 192.168.34.4 24
 [R4-GigabitEthernet0/0/1]quit
[R4]interface GigabirEthernet0/0/0
 [R4-GigabitEthernet0/0/0]ip address 192.168.45.4 24
 [R4-GigabitEthernet0/0/0]quit
[R4]ospf 1 router-id 4.4.4.4
 [R4-ospf-1]area 0
 [R4-ospf-1-area-0.0.0.0]network 192.168.34.0 0.0.0.255
 [R4-ospf-1-area-0.0.0.0]network 192.168.45.0 0.0.0.255
 [R4-ospf-1-area-0.0.0.0]quit
 ⑤配置OSPF - R5
 undo terminal monitor
 system-view
 [Huawei]sysname R5
 [R5]interface GigabitEthernet0/0/1
 [R5-GigabitEthernet0/0/1]ip address 192.168.45.5 24
 [R5-GigabitEthernet0/0/1]quit
[R5]interface GigabirEthernet0/0/0
 [R5-GigabitEthernet0/0/0]ip address 192.168.56.5 24
 [R5-GigabitEthernet0/0/0]quit
[R5]ospf 1 router-id 5.5.5.5
 [R5-ospf-1]area 0
 [R5-ospf-1-area-0.0.0.0]network 192.168.45.0 0.0.0.255
 [R5-ospf-1-area-0.0.0.0]quit
 [R5-ospf-1]area 56
 [R5-ospf-1-area-0.0.0.56]network 192.168.56.0 0.0.0.255
 [R5-ospf-1-area-0.0.0.56]quit
 ⑥配置OSPF - R6
 undo terminal monitor
 system-view
 [Huawei]sysname R6
 [R6]interface GigabitEthernet0/0/1
 [R6-GigabitEthernet0/0/1]ip address 192.168.56.6 24
 [R6-GigabitEthernet0/0/1]quit
[R6]ospf 1 router-id 6.6.6.6
 [R6-ospf-1]area 56
 [R6-ospf-1-area-0.0.0.56]network 192.168.56.0 0.0.0.255
 [R6-ospf-1-area-0.0.0.56]quit
 ⑦配置R2的区域之间的路由汇总
 [R2]ospf 1
 [R2-ospf-1]area 12
 [R2-ospf-1-area-0.0.0.12]abr-summary 10.10.0.0 255.255.0.0
项目总结
在OSPF网络中,3类LSA表示的区域之间的路由
 在OSPF网络中,只有ABR可以产生3类LSA
 在OSPF网络中,只能在产生这些3类LSA的ABR上作路由汇总
 路由汇总,可以减少对方设备资源的占用,提高网络的稳定性
OSPF汇总之外部路由
项目背景
企业内网运行多区域的OSPF网络,在R6上存在多个外部链接
 R6上的不稳定链路,会影响到骨干区域的稳定性
 希望通过技术方案,降低外部链路的不稳定性对区域0的影响
 
项目分析
R6的LoopBack接口,通过“重分发”的方式引入
 R6引入的外部路由,在OSPF网络中,以External LSA形式存在
 只有ASBR可以产生External LSA,影响整个OSPF网络
解决方案
在R6上,对引入的外部路由,进行“路由汇总”
 路由汇总的本质就是:将很多的路由,变成很少的路由。只发汇总之后的路由,不发明细路由。
 配置思路
 如图配置接口IP地址和OSPF区域
 在R6上,将LoopBack接口,通过import-route宣告进入OSPF
 在R6上,对宣告的外部路由进行汇总
 配置命令
 在区域56的ASBR(R6)上配置
 ospf 1
 import-route direct
 asbr-summary 10.60.0.0 255.255.255.0
 //将产生的外部路由,汇总成路由 10.60.0.0/16
配置步骤

 ①配置OSPF - R1
 undo terminal monitor
 system-view
 [Huawei]sysname R1
 [R1]interface GigabitEthernet0/0/0
 [R1-GigabitEthernet0/0/0]ip address 192.168.12.1 24
 [R1-GigabitEthernet0/0/0]quit
[R1]interface LoopBack 1
 [R1-LoopBack1]ip address 10.10.1.1 24
 [R1-LoopBack1]quit
[R1]interface LoopBack 2
 [R1-LoopBack2]ip address 10.10.2.2 24
 [R1-LoopBack2]quit
[R1]interface LoopBack 3
 [R1-LoopBack3]ip address 10.10.3.3 24
 [R1-LoopBack3]quit
[R1]interface LoopBack 4
 [R1-LoopBack4]ip address 10.10.4.4 24
 [R1-LoopBack4]quit
[R1]ospf 1 router-id 1.1.1.1
 [R1-ospf-1]area 12
 [R1-ospf-1-area-0.0.0.12]network 10.10.1.0 0.0.0.255
 [R1-ospf-1-area-0.0.0.12]network 10.10.2.0 0.0.0.255
 [R1-ospf-1-area-0.0.0.12]network 10.10.3.0 0.0.0.255
 [R1-ospf-1-area-0.0.0.12]network 10.10.4.0 0.0.0.255
 [R1-ospf-1-area-0.0.0.12]network 192.168.12.0 0.0.0.255
 [R1-ospf-1-area-0.0.0.12]quit
 ②配置OSPF - R2
 undo terminal monitor
 system-view
 [Huawei]sysname R2
 [R2]interface GigabitEthernet0/0/1
 [R2-GigabitEthernet0/0/1]ip address 192.168.12.2 24
 [R2-GigabitEthernet0/0/1]quit
[R2]interface GigabirEthernet0/0/0
 [R2-GigabitEthernet0/0/0]ip address 192.168.23.2 24
 [R2-GigabitEthernet0/0/0]quit
[R2]ospf 1 router-id 2.2.2.2
 [R2-ospf-1]area 12
 [R2-ospf-1-area-0.0.0.12]network 192.168.12.0 0.0.0.255
 [R2-ospf-1-area-0.0.0.12]quit
 [R2-ospf-1]area 0
 [R2-ospf-1-area-0.0.0.0]network 192.168.23.0 0.0.0.255
 [R2-ospf-1-area-0.0.0.0]quit
 ③配置OSPF - R3
 undo terminal monitor
 system-view
 [Huawei]sysname R3
 [R3]interface GigabitEthernet0/0/1
 [R3-GigabitEthernet0/0/1]ip address 192.168.23.3 24
 [R3-GigabitEthernet0/0/1]quit
[R3]interface GigabirEthernet0/0/0
 [R3-GigabitEthernet0/0/0]ip address 192.168.34.3 24
 [R3-GigabitEthernet0/0/0]quit
[R3]ospf 1 router-id 3.3.3.3
 [R3-ospf-1]area 0
 [R3-ospf-1-area-0.0.0.0]network 192.168.34.0 0.0.0.255
 [R3-ospf-1-area-0.0.0.0]network 192.168.23.0 0.0.0.255
 [R3-ospf-1-area-0.0.0.0]quit
 ④配置OSPF - R4
 undo terminal monitor
 system-view
 [Huawei]sysname R4
 [R4]interface GigabitEthernet0/0/1
 [R4-GigabitEthernet0/0/1]ip address 192.168.34.4 24
 [R4-GigabitEthernet0/0/1]quit
[R4]interface GigabirEthernet0/0/0
 [R4-GigabitEthernet0/0/0]ip address 192.168.45.4 24
 [R4-GigabitEthernet0/0/0]quit
[R4]ospf 1 router-id 4.4.4.4
 [R4-ospf-1]area 0
 [R4-ospf-1-area-0.0.0.0]network 192.168.34.0 0.0.0.255
 [R4-ospf-1-area-0.0.0.0]network 192.168.45.0 0.0.0.255
 [R4-ospf-1-area-0.0.0.0]quit
 ⑤配置OSPF - R5
 undo terminal monitor
 system-view
 [Huawei]sysname R5
 [R5]interface GigabitEthernet0/0/1
 [R5-GigabitEthernet0/0/1]ip address 192.168.45.5 24
 [R5-GigabitEthernet0/0/1]quit
[R5]interface GigabirEthernet0/0/0
 [R5-GigabitEthernet0/0/0]ip address 192.168.56.5 24
 [R5-GigabitEthernet0/0/0]quit
[R5]ospf 1 router-id 5.5.5.5
 [R5-ospf-1]area 0
 [R5-ospf-1-area-0.0.0.0]network 192.168.45.0 0.0.0.255
 [R5-ospf-1-area-0.0.0.0]quit
 [R5-ospf-1]area 56
 [R5-ospf-1-area-0.0.0.56]network 192.168.56.0 0.0.0.255
 [R5-ospf-1-area-0.0.0.56]quit
 ⑥配置OSPF - R6
 undo terminal monitor
 system-view
 [Huawei]sysname R6
 [R6]interface GigabitEthernet0/0/1
 [R6-GigabitEthernet0/0/1]ip address 192.168.56.6 24
 [R6-GigabitEthernet0/0/1]quit
[R6]ospf 1 router-id 6.6.6.6
 [R6-ospf-1]area 56
 [R6-ospf-1-area-0.0.0.56]network 192.168.56.0 0.0.0.255
 [R6-ospf-1-area-0.0.0.56]quit
 ⑦配置R6的外部路由汇总
 [R6]ospf 1
 [R6-ospf-1]import-route direct
 [R6-ospf-1]asbr-summary 10.60.0.0 255.255.0.0
项目总结
在OSPF网络中,5类LSA表示外部路由
 在OSPF网络中,只有 ASBR可以产生5类LSA
 在OSPF网络中,只能在产生这些5类LSA的ASBR上进行
 路由汇总,可以减少对方设备资源的占用,提高网络的稳定性
OSPF安全认证之链路认证
项目背景
企业内外运行多区域的OSPF网络,区域之间通过骨干区域互通
 为了保证区域0的安全,需要确保骨干区域的邻居关系都必须是经过认证的
 非法接入的路由器不能与骨干区域建立邻居关系
 
项目分析
为确保非法路由器不能与0区域的设备建立邻居关系,需要对建立邻居的hello报文进行加密处理
 Hello报文是通过路由器的接口传输的,所以需要在接口配置认证
解决方案
OSPF链路认证,即对运行OSPF协议的接口发送和接收的OSPF进行加密和认证
 OSPF链路认证的类型分为:“明文认证”和“密文认证”
 配置思路
 如图配置接口IP地址和OSPF多区域网络
 在属于区域0 的链路上配置OSPF链路认证
 R2-R3、R3-R4配置明文认证,R4和R5之间配置密文认证
 配置命令
 配置R2-R3之间的明文认证
 R2:interface GigabitEthernet0/0/0
 ospf authentication-mode simple cipher HCIE
 quit
 R3:interface GigabitEthernet0/0/1
 ospf authentication-mode simple cipher HCIE
 quit
 配置R3-R4之间的明文认证
 R3:interface GigabitEthernet0/0/0
 ospf authentication-mode simple cipher HCIP
 quit
 R4:interface GigabitEthernet0/0/1
 ospf authentication-mode simple cipher HCIP
 quit
 在R4-R5之间的密文认证
 R4:interface GigabitEthernet0/0/0
 ospf authentication-mode md5 10 cipher HCIA
 quit
 R5:interface GigabitEthernet0/0/1
 ospf authentication-mode md5 10 cipher HCIA
 quit
配置步骤

 ①配置OSPF - R1
 undo terminal monitor
 system-view
 [Huawei]sysname R1
 [R1]interface GigabitEthernet0/0/0
 [R1-GigabitEthernet0/0/0]ip address 192.168.12.1 24
 [R1-GigabitEthernet0/0/0]quit
[R1]ospf 1 router-id 1.1.1.1
 [R1-ospf-1]area 12
 [R1-ospf-1-area-0.0.0.12]network 192.168.12.0 0.0.0.255
 [R1-ospf-1-area-0.0.0.12]quit
 ②配置OSPF - R2
 undo terminal monitor
 system-view
 [Huawei]sysname R2
 [R2]interface GigabitEthernet0/0/1
 [R2-GigabitEthernet0/0/1]ip address 192.168.12.2 24
 [R2-GigabitEthernet0/0/1]quit
[R2]interface GigabirEthernet0/0/0
 [R2-GigabitEthernet0/0/0]ip address 192.168.23.2 24
 [R2-GigabitEthernet0/0/0]quit
[R2]ospf 1 router-id 2.2.2.2
 [R2-ospf-1]area 12
 [R2-ospf-1-area-0.0.0.12]network 192.168.12.0 0.0.0.255
 [R2-ospf-1-area-0.0.0.12]quit
 [R2-ospf-1]area 0
 [R2-ospf-1-area-0.0.0.0]network 192.168.23.0 0.0.0.255
 [R2-ospf-1-area-0.0.0.0]quit
 ③配置OSPF - R3
 undo terminal monitor
 system-view
 [Huawei]sysname R3
 [R3]interface GigabitEthernet0/0/1
 [R3-GigabitEthernet0/0/1]ip address 192.168.23.3 24
 [R3-GigabitEthernet0/0/1]quit
[R3]interface GigabirEthernet0/0/0
 [R3-GigabitEthernet0/0/0]ip address 192.168.34.3 24
 [R3-GigabitEthernet0/0/0]quit
[R3]ospf 1 router-id 3.3.3.3
 [R3-ospf-1]area 0
 [R3-ospf-1-area-0.0.0.0]network 192.168.34.0 0.0.0.255
 [R3-ospf-1-area-0.0.0.0]network 192.168.23.0 0.0.0.255
 [R3-ospf-1-area-0.0.0.0]quit
 ④配置OSPF - R4
 undo terminal monitor
 system-view
 [Huawei]sysname R4
 [R4]interface GigabitEthernet0/0/1
 [R4-GigabitEthernet0/0/1]ip address 192.168.34.4 24
 [R4-GigabitEthernet0/0/1]quit
[R4]interface GigabirEthernet0/0/0
 [R4-GigabitEthernet0/0/0]ip address 192.168.45.4 24
 [R4-GigabitEthernet0/0/0]quit
[R4]ospf 1 router-id 4.4.4.4
 [R4-ospf-1]area 0
 [R4-ospf-1-area-0.0.0.0]network 192.168.34.0 0.0.0.255
 [R4-ospf-1-area-0.0.0.0]network 192.168.45.0 0.0.0.255
 [R4-ospf-1-area-0.0.0.0]quit
 ⑤配置OSPF - R5
 undo terminal monitor
 system-view
 [Huawei]sysname R5
 [R5]interface GigabitEthernet0/0/1
 [R5-GigabitEthernet0/0/1]ip address 192.168.45.5 24
 [R5-GigabitEthernet0/0/1]quit
[R5]interface GigabirEthernet0/0/0
 [R5-GigabitEthernet0/0/0]ip address 192.168.56.5 24
 [R5-GigabitEthernet0/0/0]quit
[R5]ospf 1 router-id 5.5.5.5
 [R5-ospf-1]area 0
 [R5-ospf-1-area-0.0.0.0]network 192.168.45.0 0.0.0.255
 [R5-ospf-1-area-0.0.0.0]quit
 [R5-ospf-1]area 56
 [R5-ospf-1-area-0.0.0.56]network 192.168.56.0 0.0.0.255
 [R5-ospf-1-area-0.0.0.56]quit
 ⑥配置OSPF - R6
 undo terminal monitor
 system-view
 [Huawei]sysname R6
 [R6]interface GigabitEthernet0/0/1
 [R6-GigabitEthernet0/0/1]ip address 192.168.56.6 24
 [R6-GigabitEthernet0/0/1]quit
[R6]ospf 1 router-id 6.6.6.6
 [R6-ospf-1]area 56
 [R6-ospf-1-area-0.0.0.56]network 192.168.56.0 0.0.0.255
 [R6-ospf-1-area-0.0.0.56]quit
 ⑦配置R2和R3之间的链路认证 - 明文认证,密码为HCIE
 [R2]interface GigabitEthernet0/0/0
 [R2-GigabitEthernet0/0/0]ospf authentication-mode simple cipher HCIE
 [R2-GigabitEthernet0/0/0]quit
[R3]interface GigabitEthernet0/0/1
 [R3-GigabitEthernet0/0/1]ospf authentication-mode simple cipher HCIE
 [R3-GigabitEthernet0/0/1]quit
 ⑧配置R3和R4之间的链路认证 - 明文认证,密码为HCIP
 [R3]interface GigabitEthernet0/0/0
 [R3-GigabitEthernet0/0/0]ospf authentication-mode simple cipher HCIP
 [R3-GigabitEthernet0/0/0]quit
[R4]interface GigabitEthernet0/0/1
 [R4-GigabitEthernet0/0/1]ospf authentication-mode simple cipher HCIP
 [R4-GigabitEthernet0/0/1]quit
 ⑨配置R4和R5之间的链路认证 - 密文认证,密码为HCIA
 [R4]interface GigabitEthernet0/0/0
 [R4-GigabitEthernet0/0/0]ospf authentication-mode md5 10 cipher HCIA
 [R4-GigabitEthernet0/0/0]quit
[R5]interface GigabitEthernet0/0/1
 [R5-GigabitEthernet0/0/1]ospf authentication-mode md5 10 cipher HCIA
 [R5-GigabitEthernet0/0/1]quit
项目总结
OSPF链路认证,仅仅对当前端口起作用
 一个端口下,只能配置一种类型的认证
 同一个区域中的多个链路,可以配置不同类型的认证和密码
 明文认证的规则是“链路两端的认证类型和密码都要相同”
 密文认证的规则是“链路两端的认证类型、key-id、密码要相同”
OSPF安全认证之区域认证
项目背景
企业内网运行多区域的OSPF网络,区域之间通过骨干区域互通
 骨干区域的网络设备非常多,需要确保非法接入到骨干区域的设备,不能与骨干区域建立正常的OSPF邻居关系
 
项目分析
骨干区域范围庞大,并且网络设备以及互联接口非常多
 需要确保该区域的每个设备的每个接口,都启用OSPF认证
 更加高效的配置方案是:OSPF 区域 认证
解决方案
OSPF区域认证,即该设备上的所有属于特定区域的接口,都启用认证功能
 OSPF区域认证的类型分为“明文认证”和“密文认证”
 配置思路
 如图配置接口IP地址和OSPF多区域网络
 在属于区域0的每个路由器上配置OSPF区域认证
 配置命令
 配置R2/R3/R4/R5的OSPF区域0认证
 ospf 1 (明文认证)
 area 0
 authentication-mode simple cipher HCIE
 quit
 ospf 1(密文认证)
 area 0
 authentication-mode md5 7 cipher HCIE
 quit
配置步骤

 ①配置OSPF - R1
 undo terminal monitor
 system-view
 [Huawei]sysname R1
 [R1]interface GigabitEthernet0/0/0
 [R1-GigabitEthernet0/0/0]ip address 192.168.12.1 24
 [R1-GigabitEthernet0/0/0]quit
[R1]ospf 1 router-id 1.1.1.1
 [R1-ospf-1]area 12
 [R1-ospf-1-area-0.0.0.12]network 192.168.12.0 0.0.0.255
 [R1-ospf-1-area-0.0.0.12]quit
 ②配置OSPF - R2
 undo terminal monitor
 system-view
 [Huawei]sysname R2
 [R2]interface GigabitEthernet0/0/1
 [R2-GigabitEthernet0/0/1]ip address 192.168.12.2 24
 [R2-GigabitEthernet0/0/1]quit
[R2]interface GigabirEthernet0/0/0
 [R2-GigabitEthernet0/0/0]ip address 192.168.23.2 24
 [R2-GigabitEthernet0/0/0]quit
[R2]ospf 1 router-id 2.2.2.2
 [R2-ospf-1]area 12
 [R2-ospf-1-area-0.0.0.12]network 192.168.12.0 0.0.0.255
 [R2-ospf-1-area-0.0.0.12]quit
 [R2-ospf-1]area 0
 [R2-ospf-1-area-0.0.0.0]network 192.168.23.0 0.0.0.255
 [R2-ospf-1-area-0.0.0.0]quit
 ③配置OSPF - R3
 undo terminal monitor
 system-view
 [Huawei]sysname R3
 [R3]interface GigabitEthernet0/0/1
 [R3-GigabitEthernet0/0/1]ip address 192.168.23.3 24
 [R3-GigabitEthernet0/0/1]quit
[R3]interface GigabirEthernet0/0/0
 [R3-GigabitEthernet0/0/0]ip address 192.168.34.3 24
 [R3-GigabitEthernet0/0/0]quit
[R3]ospf 1 router-id 3.3.3.3
 [R3-ospf-1]area 0
 [R3-ospf-1-area-0.0.0.0]network 192.168.34.0 0.0.0.255
 [R3-ospf-1-area-0.0.0.0]network 192.168.23.0 0.0.0.255
 [R3-ospf-1-area-0.0.0.0]quit
 ④配置OSPF - R4
 undo terminal monitor
 system-view
 [Huawei]sysname R4
 [R4]interface GigabitEthernet0/0/1
 [R4-GigabitEthernet0/0/1]ip address 192.168.34.4 24
 [R4-GigabitEthernet0/0/1]quit
[R4]interface GigabirEthernet0/0/0
 [R4-GigabitEthernet0/0/0]ip address 192.168.45.4 24
 [R4-GigabitEthernet0/0/0]quit
[R4]ospf 1 router-id 4.4.4.4
 [R4-ospf-1]area 0
 [R4-ospf-1-area-0.0.0.0]network 192.168.34.0 0.0.0.255
 [R4-ospf-1-area-0.0.0.0]network 192.168.45.0 0.0.0.255
 [R4-ospf-1-area-0.0.0.0]quit
 ⑤配置OSPF - R5
 undo terminal monitor
 system-view
 [Huawei]sysname R5
 [R5]interface GigabitEthernet0/0/1
 [R5-GigabitEthernet0/0/1]ip address 192.168.45.5 24
 [R5-GigabitEthernet0/0/1]quit
[R5]interface GigabirEthernet0/0/0
 [R5-GigabitEthernet0/0/0]ip address 192.168.56.5 24
 [R5-GigabitEthernet0/0/0]quit
[R5]ospf 1 router-id 5.5.5.5
 [R5-ospf-1]area 0
 [R5-ospf-1-area-0.0.0.0]network 192.168.45.0 0.0.0.255
 [R5-ospf-1-area-0.0.0.0]quit
 [R5-ospf-1]area 56
 [R5-ospf-1-area-0.0.0.56]network 192.168.56.0 0.0.0.255
 [R5-ospf-1-area-0.0.0.56]quit
 ⑥配置OSPF - R6
 undo terminal monitor
 system-view
 [Huawei]sysname R6
 [R6]interface GigabitEthernet0/0/1
 [R6-GigabitEthernet0/0/1]ip address 192.168.56.6 24
 [R6-GigabitEthernet0/0/1]quit
[R6]ospf 1 router-id 6.6.6.6
 [R6-ospf-1]area 56
 [R6-ospf-1-area-0.0.0.56]network 192.168.56.0 0.0.0.255
 [R6-ospf-1-area-0.0.0.56]quit
 ⑦对区域0中的设备进行“密文认证”,设置密码为HCIE
 [R2]ospf 1
 [R2-ospf-1]area 0
 [R2-ospf-1-area-0.0.0.0]authentication-mode md5 7 cipher HCIE
 [R2-ospf-1-area-0.0.0.0]quit
[R3]ospf 1
 [R3-ospf-1]area 0
 [R3-ospf-1-area-0.0.0.0]authentication-mode md5 7 cipher HCIE
 [R3-ospf-1-area-0.0.0.0]quit
[R4]ospf 1
 [R4-ospf-1]area 0
 [R4-ospf-1-area-0.0.0.0]authentication-mode md5 7 cipher HCIE
 [R4-ospf-1-area-0.0.0.0]quit
[R5]ospf 1
 [R5-ospf-1]area 0
 [R5-ospf-1-area-0.0.0.0]authentication-mode md5 7 cipher HCIE
 [R5-ospf-1-area-0.0.0.0]quit
项目总结
OSPF区域认证,对该设备上的属于指定区域的所有接口都起作用
 明文认证的规则是“链路两端的认证类型和密码都要相同”
 密文认证的规则是“链路两端的认证类型、key-id、密码要相同”
 针对同一个区域的链路,同时配置了区域认证和链路认证,优先使用链路认证的密码进行加密和认证
OSPF不连续区域之虚链路
项目背景
企业内网运行多区域的OSPF网络,因网络规划问题,导致区域12没有连接到骨干区域
 现因业务需要,需确保R1能和其他区域的设备实现快速互通
 
项目分析
正常的OSPF网络架构中,所有的非骨干区域,必须与骨干区域直接相连
 不同区域之间的数据包进行互通,必须使用区域之间的路由条目
 不同区域之间的路由,是通过Sum-net LSA表示的。而这种LSA只有ABR可以产生
 故,必须确保区域12存在ABR设备。此时使用方案:虚链路
解决方案
OSPF虚链路,即永远属于骨干区域的一个虚拟的链路。通过虚拟链路建立的邻居,也都属于OSPF骨干区域
 OSPF虚链路的建立,必须要穿越“普通的”非骨干区域
 配置思路
 如图配置接口IP地址和OSPF多区域网络
 穿越普通区域34,在R2和R5之间建立OSPF虚链路
 配置命令
 配置R2的OSPF虚链路
 ospf 1 router-id 2.2.2.2
 area 34
 vlink-peer 5.5.5.5 //vlink-peer 后面跟的是对端设备的router-id
 配置R5的OSPF虚链路
 ospf 1 router-id 5.5.5.5
 area 34
 vlink-peer 2.2.2.2 //vlink-peer 后面跟的是对端设备的router-id
 查看OSPF虚链路的状态
 display ospf vlink
 查看R1的OSPF路由表,可以学习到其他区域的路由
 display ip routing-table protocol ospf
 测试R1与R6的连通性
 ping 192.168.56.6
配置步骤

 ①配置OSPF - R1
 undo terminal monitor
 system-view
 [Huawei]sysname R1
 [R1]interface GigabitEthernet0/0/0
 [R1-GigabitEthernet0/0/0]ip address 192.168.12.1 24
 [R1-GigabitEthernet0/0/0]quit
[R1]ospf 1 router-id 1.1.1.1
 [R1-ospf-1]area 12
 [R1-ospf-1-area-0.0.0.12]network 192.168.12.0 0.0.0.255
 [R1-ospf-1-area-0.0.0.12]quit
 ②配置OSPF - R2
 undo terminal monitor
 system-view
 [Huawei]sysname R2
 [R2]interface GigabitEthernet0/0/1
 [R2-GigabitEthernet0/0/1]ip address 192.168.12.2 24
 [R2-GigabitEthernet0/0/1]quit
[R2]interface GigabirEthernet0/0/0
 [R2-GigabitEthernet0/0/0]ip address 192.168.23.2 24
 [R2-GigabitEthernet0/0/0]quit
[R2]ospf 1 router-id 2.2.2.2
 [R2-ospf-1]area 12
 [R2-ospf-1-area-0.0.0.12]network 192.168.12.0 0.0.0.255
 [R2-ospf-1-area-0.0.0.12]quit
 [R2-ospf-1]area 0
 [R2-ospf-1-area-0.0.0.0]network 192.168.23.0 0.0.0.255
 [R2-ospf-1-area-0.0.0.0]quit
 ③配置OSPF - R3
 undo terminal monitor
 system-view
 [Huawei]sysname R3
 [R3]interface GigabitEthernet0/0/1
 [R3-GigabitEthernet0/0/1]ip address 192.168.23.3 24
 [R3-GigabitEthernet0/0/1]quit
[R3]interface GigabirEthernet0/0/0
 [R3-GigabitEthernet0/0/0]ip address 192.168.34.3 24
 [R3-GigabitEthernet0/0/0]quit
[R3]ospf 1 router-id 3.3.3.3
 [R3-ospf-1]area 0
 [R3-ospf-1-area-0.0.0.0]network 192.168.34.0 0.0.0.255
 [R3-ospf-1-area-0.0.0.0]network 192.168.23.0 0.0.0.255
 [R3-ospf-1-area-0.0.0.0]quit
 ④配置OSPF - R4
 undo terminal monitor
 system-view
 [Huawei]sysname R4
 [R4]interface GigabitEthernet0/0/1
 [R4-GigabitEthernet0/0/1]ip address 192.168.34.4 24
 [R4-GigabitEthernet0/0/1]quit
[R4]interface GigabirEthernet0/0/0
 [R4-GigabitEthernet0/0/0]ip address 192.168.45.4 24
 [R4-GigabitEthernet0/0/0]quit
[R4]ospf 1 router-id 4.4.4.4
 [R4-ospf-1]area 0
 [R4-ospf-1-area-0.0.0.0]network 192.168.34.0 0.0.0.255
 [R4-ospf-1-area-0.0.0.0]network 192.168.45.0 0.0.0.255
 [R4-ospf-1-area-0.0.0.0]quit
 ⑤配置OSPF - R5
 undo terminal monitor
 system-view
 [Huawei]sysname R5
 [R5]interface GigabitEthernet0/0/1
 [R5-GigabitEthernet0/0/1]ip address 192.168.45.5 24
 [R5-GigabitEthernet0/0/1]quit
[R5]interface GigabirEthernet0/0/0
 [R5-GigabitEthernet0/0/0]ip address 192.168.56.5 24
 [R5-GigabitEthernet0/0/0]quit
[R5]ospf 1 router-id 5.5.5.5
 [R5-ospf-1]area 0
 [R5-ospf-1-area-0.0.0.0]network 192.168.45.0 0.0.0.255
 [R5-ospf-1-area-0.0.0.0]quit
 [R5-ospf-1]area 56
 [R5-ospf-1-area-0.0.0.56]network 192.168.56.0 0.0.0.255
 [R5-ospf-1-area-0.0.0.56]quit
 ⑥配置OSPF - R6
 undo terminal monitor
 system-view
 [Huawei]sysname R6
 [R6]interface GigabitEthernet0/0/1
 [R6-GigabitEthernet0/0/1]ip address 192.168.56.6 24
 [R6-GigabitEthernet0/0/1]quit
[R6]ospf 1 router-id 6.6.6.6
 [R6-ospf-1]area 56
 [R6-ospf-1-area-0.0.0.56]network 192.168.56.0 0.0.0.255
 [R6-ospf-1-area-0.0.0.56]quit
 ⑦穿越区域34,在R2和R5之间建立虚链路
 [R2]ospf 1
 [R2-ospf-1]area 34
 [R2-ospf-1-area-0.0.0.34]vlink-peer 5.5.5.5
 [R2-ospf-1-area-0.0.0.34]quit
[R5]ospf 1
 [R5-ospf-1]area 34
 [R5-ospf-1-area-0.0.0.34]vlink-peer 2.2.2.2
 [R5-ospf-1-area-0.0.0.34]quit
项目总结
OSPF多区域网络设计中,必须确保非骨干区域和骨干区域相连
 OSPF虚链路永远属于OSPF骨干区域
 OSPF虚链路的建立,必须穿越普通的非骨干区域,无法穿越特殊区域
 OSPF虚链路,是在两个ABR设备之间建立的
 OSPF虚链路配置中,vlink-peer参数后面跟的是router-id,不是接口的IP地址
