Сравнение версий

Старая версия 34

changes.mady.by.user Сервисный центр Ethernet

Сохранено

по сравнению с

Новая версия 35

changes.mady.by.user Сервисный центр Ethernet

Сохранено

Ключ

  • Эта строка добавлена.
  • Эта строка удалена.
  • Изменено форматирование.
Комментарий: Руди Г.Г.: Пример настройки Source NAT

...

Блок кода
titleESR-1
cluster
  cluster-interface bridge 1
  unit 1
    mac-address cc:9d:a2:71:83:78
  exit
  unit 2
    mac-address cc:9d:a2:71:82:38
  exit
  enable
exit
   
hostname ESR-1 unit 1
hostname ESR-2 unit 2
   
security zone SYNC
exit
security zone LAN
exit
   
bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp id 1
  vrrp ip 198.51.100.1/24
  vrrp group 1
  vrrp
  enable
exit
   
interface gigabitethernet 1/0/2
  security-zone LAN
  ip address 192.0.2.254/24
  vrrp id 2
  vrrp ip 192.0.2.1/24
  vrrp group 1
  vrrp authentication key ascii-text encrypted 88B11079B51D
  vrrp authentication algorithm md5
  vrrp
exit
interface gigabitethernet 1/0/3
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/2
  security-zone LAN
  ip address 192.0.2.253/24
  vrrp id 2
  vrrp ip 192.0.2.1/24
  vrrp group 1
  vrrp authentication key ascii-text encrypted 88B11079B51D
  vrrp authentication algorithm md5
  vrrp
exit
interface gigabitethernet 2/0/3
  mode switchport
  spanning-tree disable
exit
   
security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair LAN self
  rule 1
    action permit
    enable
  exit
exit
Решение:

Сконфигурируем object-group для настройки failover-сервисов:

...

Блок кода
titleESR-1
ESR-1# show high-availability state 
DHCP server:
    State:                         Disabled
    Last state change:             --
crypto-sync:
    State:                         Disabled
Firewall sessions and NAT translations:
VRF:                               --
    Tracking VRRP Group            1
    Tracking VRRP Group state:     Master
    State:                         Successful synchronization
    Fault Reason:                  --
    Last synchronization:          2025-01-09 13:36:13
Итоговая конфигурация кластера:
Блок кода
cluster
  cluster-interface bridge 1
  unit 1
    mac-address 68:13:e2:7f:22:c0
  exit
  unit 2
    mac-address 68:13:e2:7f:10:30
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

object-group service FAILOVER
  port-range 9999
exit

object-group network SYNC_DST
  ip address-range 198.51.100.253 unit 1
  ip address-range 198.51.100.254 unit 2
exit
object-group network SYNC_SRC
  ip address-range 198.51.100.254 unit 1
  ip address-range 198.51.100.253 unit 2
exit

security zone SYNC
exit
security zone LAN
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp id 1
  vrrp ip 198.51.100.1/24
  vrrp group 1
  vrrp
  enable
exit

interface gigabitethernet 1/0/2
  security-zone LAN
  ip address 192.0.2.254/24
  vrrp id 2
  vrrp ip 192.0.2.1/24
  vrrp group 1
  vrrp authentication key ascii-text encrypted 88B11079B51D
  vrrp authentication algorithm md5
  vrrp
exit
interface gigabitethernet 1/0/3
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/2
  security-zone LAN
  ip address 192.0.2.253/24
  vrrp id 2
  vrrp ip 192.0.2.1/24
  vrrp group 1
  vrrp authentication key ascii-text encrypted 88B11079B51D
  vrrp authentication algorithm md5
  vrrp
exit
interface gigabitethernet 2/0/3
  mode switchport
  spanning-tree disable
exit

ip failover
  local-address object-group SYNC_SRC
  remote-address object-group SYNC_DST
  vrrp-group 1
exit

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
  rule 4
    action permit
    match protocol udp
    match destination-port object-group FAILOVER
    enable
  exit
exit
security zone-pair LAN self
  rule 1
    action permit
    enable
  exit
exit

ip firewall failover
  sync-type unicast
  port 9999
  enable
exit

...

Функция Source NAT (SNAT) используется для подмены адреса источника у пакетов, проходящих через сетевой шлюз. При прохождении пакетов из локальной сети в публичную сеть адрес источника заменяется на один из публичных адресов шлюза. Дополнительно к адресу источника может применяться замена порта источника (NATP). При прохождении пакетов из публичной сети в локальную происходит обратная подмена адреса и порта.В текущей схеме SNAT используется для предоставления доступа

Пример настройки

Задача:
  • предоставить доступ в Интернет хостам, находящимся в локальной сети

...

  • ;
  • клиентская подсеть: 192.0.2.0/24;
  • публичный IP адрес  – IP адрес на интерфейсе.
Image Added
Исходная конфигурация кластера:
Блок кода
cluster
  cluster-interface bridge 1
  unit 1
    mac-address cc:9d:a2:71:83:78
  exit
  unit 2
    mac-address cc:9d:a2:71:82:38
  exit
  enable
exit
 
hostname ESR-1 unit 1
hostname ESR-2 unit 2
 
security zone SYNC
exit
security zone LAN
exit
security zone WAN
exit
 
bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp id 1
  vrrp ip 198.51.100.1/24
  vrrp group 1
  vrrp
  enable
exit
 
interface gigabitethernet 1/0/2
  security-zone LAN
  ip address 192.0.2.254/24
  vrrp id 2
  vrrp ip 192.0.2.1/24
  vrrp group 1
  vrrp authentication key ascii-text encrypted 88B11079B51D
  vrrp authentication algorithm md5
  vrrp
exit
interface gigabitethernet 1/0/3
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/2
  security-zone LAN
  ip address 192.0.2.253/24
  vrrp id 2
  vrrp ip 192.0.2.1/24
  vrrp group 1
  vrrp authentication key ascii-text encrypted 88B11079B51D
  vrrp authentication algorithm md5
  vrrp
exit
interface gigabitethernet 2/0/3
  mode switchport
  spanning-tree disable
exit
 
security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair LAN self
  rule 1
    action permit
    enable
  exit
exit

Сконфигурируем необходимые сетевые интерфейсы c принадлежностью к зоне безопасности:

Блок кода
titleESR-1
ESR-1(config)# interface gigabitethernet 1/0/1
ESR-1(config-if-gi)# ip address 203.0.113.254/24
ESR-1(config-if-gi)# security-zone WAN
ESR-1(config-if-gi)# exit
ESR-1(config)# interface gigabitethernet 2/0/1
ESR-1(config-if-gi)# ip address 203.0.113.253/24
ESR-1(config-if-gi)# security-zone WAN
ESR-1(config-if-gi)# exit

Создадим список IP-адресов, которые будут иметь возможность выхода в Интернет:

Блок кода
titleESR-1
ESR-1(config)# object-group network INTERNET_USERS
ESR-1(config-object-group-network)# ip address-range 192.0.2.10-192.0.2.100
ESR-1(config-object-group-network)# exit

Добавим правило, где включена проверка адреса источника данных на принадлежность к диапазону адресов INTERNET_USERS, для соблюдения ограничения на выход в публичную сеть:

Блок кода
titleESR-1
ESR-1(config)# security zone-pair LAN WAN 
ESR-1(config-security-zone-pair)# rule 1
ESR-1(config-security-zone-pair-rule)# action permit 
ESR-1(config-security-zone-pair-rule)# match source-address object-group INTERNET_USERS
ESR-1(config-security-zone-pair-rule)# enable 
ESR-1(config-security-zone-pair-rule)# exit
ESR-1(config-security-zone-pair)# exit

Создадим набор правил SNAT. В атрибутах набора укажем, что правила применяются только для пакетов, направляющихся в зону WAN. Правила включают проверку адреса источника данных на принадлежность к пулу INTERNET_USERS и задают трансляцию в IP-адрес интерфейса:

Блок кода
titleESR-1
ESR-1(config)# nat source 
ESR-1(config-snat)# ruleset SNAT_WAN
ESR-1(config-snat-ruleset)# to zone WAN 
ESR-1(config-snat-ruleset)# rule 1
ESR-1(config-snat-rule)# match source-address object-group INTERNET_USERS
ESR-1(config-snat-rule)# action source-nat interface 
ESR-1(config-snat-rule)# enable 
ESR-1(config-snat-rule)# exit
ESR-1(config-snat-ruleset)# exit
ESR-1(config-snat)# exit
Итоговая конфигурация кластера:
Блок кода
cluster
  cluster-interface bridge 1
  unit 1
    mac-address 68:13:e2:7f:22:c0
  exit
  unit 2
    mac-address 68:13:e2:7f:10:30
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

object-group network INTERNET_USERS
  ip address-range 192.0.2.10-192.0.2.100
exit

security zone SYNC
exit
security zone LAN
exit
security zone WAN
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp id 1
  vrrp ip 198.51.100.1/24
  vrrp group 1
  vrrp
  enable
exit

interface gigabitethernet 1/0/1
  security-zone WAN
  ip address 203.0.113.254/24
exit
interface gigabitethernet 1/0/2
  security-zone LAN
  ip address 192.0.2.254/24
  vrrp id 2
  vrrp ip 192.0.2.1/24
  vrrp group 1
  vrrp authentication key ascii-text encrypted 88B11079B51D
  vrrp authentication algorithm md5
  vrrp
exit
interface gigabitethernet 1/0/3
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/1
  security-zone WAN
  ip address 203.0.113.253/24
exit
interface gigabitethernet 2/0/2
  security-zone LAN
  ip address 192.0.2.253/24
  vrrp id 2
  vrrp ip 192.0.2.1/24
  vrrp group 1
  vrrp authentication key ascii-text encrypted 88B11079B51D
  vrrp authentication algorithm md5
  vrrp
exit
interface gigabitethernet 2/0/3
  mode switchport
  spanning-tree disable
exit

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair LAN self
  rule 1
    action permit
    enable
  exit
exit
security zone-pair LAN WAN
  rule 1
    action permit
    match source-address object-group INTERNET_USERS
    enable
  exit
exit

nat source
  ruleset SNAT_WAN
    rule 1

Создайте список IP-адресов, которые будут иметь возможность выхода в Интернет. Так как в локальной сети работает DHCP-сервер и раздает адреса 192.168.3.50-192.168.3.100, то именно они и получат возможность выхода в Интернет:

Блок кода
titleESR-1
ESR-1(config)# object-group network INTERNET_USERS
ESR-1(config-object-group-network)# ip address-range 192.168.3.50-192.168.3.100
ESR-1(config-object-group-network)# exit

Scroll Pagebreak

Добавьте правило, где включена проверка адреса источника данных на принадлежность к диапазону адресов INTERNET_USERS, для соблюдения ограничения на выход в публичную сеть:

Блок кода
titleESR-1
ESR-1(config)# security zone-pair TRUSTED ISP1_ISP2 
ESR-1(config-security-zone-pair)# rule 1
ESR-1(config-security-zone-pair-rule)# action permit 
ESR-1(config-security-zone-pair-rule)# match source-address object-group INTERNET_USERS
ESR-1(config-security-zone-pair-rule)# enable 
ESR-1(config-security-zone-pair-rule)# exit
ESR-1(config-security-zone-pair)# exit

Создайте набор правил SNAT. В атрибутах набора укажите, что правила применяются только для пакетов, направляющихся в зону ISP1_ISP2. Правила включают проверку адреса источника данных на принадлежность к пулу INTERNET_USERS и задают трансляцию в IP-адрес интерфейса:

Блок кода
titleESR-1
ESR-1(config)# nat source 
ESR-1(config-snat)# ruleset SNAT_ISP1_ISP2
ESR-1(config-snat-ruleset)# to zone ISP1_ISP2 
ESR-1(config-snat-ruleset)# rule 1
ESR-1(config-snat-rule)# match source-address object-group INTERNET_USERS
ESR-1(config-snat-rule)#      action source-nat interface
 
ESR-1(config-snat-rule)# enable 
ESR-1(config-snat-rule)# exit
ESR-1(config-snat-ruleset)# exit
ESR-1(config-snat)# exit

...

     enable
    exit
  exit
exit

Настройка Destination NAT

...

С алгоритмом настройки BGP можно ознакомиться по ссылке в разделе: Алгоритм настройки BGP.

Пример настройки 1

Задача:

Настроить BGP-протокол в кластере маршрутизаторов ESR-1 и ESR-2 со следующими параметрами:

  • соседство устанавливается только с Active устройством;
  • клиентская подсеть: 192.0.2.0/24;
  • анонсирование подсетей, подключенных напрямую;
  • собственная AS 2500;
  • соседство – подсеть 203.0.113.0/24, vrrp IP-адрес для подключения 203.0.113.1, IP-адрес соседа 203.0.113.2, AS3000.

Исходная конфигурация кластера:
Блок кода
titleESR-1
cluster
  cluster-interface bridge 1
  unit 1
    mac-address cc:9d:a2:71:83:78
  exit
  unit 2
    mac-address cc:9d:a2:71:82:38
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

security zone SYNC
exit
security zone LAN
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp id 1
  vrrp ip 198.51.100.1/24
  vrrp group 1
  vrrp
  enable
exit

interface gigabitethernet 1/0/2
  security-zone LAN
  ip address 192.0.2.254/24
  vrrp id 2
  vrrp ip 192.0.2.1/24
  vrrp group 1
  vrrp authentication key ascii-text encrypted 88B11079B51D
  vrrp authentication algorithm md5
  vrrp
exit
interface gigabitethernet 1/0/3
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/2
  security-zone LAN
  ip address 192.0.2.253/24
  vrrp id 2
  vrrp ip 192.0.2.1/24
  vrrp group 1
  vrrp authentication key ascii-text encrypted 88B11079B51D
  vrrp authentication algorithm md5
  vrrp
exit
interface gigabitethernet 2/0/3
  mode switchport
  spanning-tree disable
exit

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair LAN self
  rule 1
    action permit
    enable
  exit
exit

...

Примечание

В случае выхода из строя Active устройства, BGP будет полностью переустанавливаться со Standby устройством.

Итоговая конфигурация кластера:
Блок кода
cluster
  cluster-interface bridge 1
  unit 1
    mac-address cc:9d:a2:71:83:78
  exit
  unit 2
    mac-address cc:9d:a2:71:82:38
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

object-group service og_bgp
  port-range 179
exit

security zone SYNC
exit
security zone LAN
exit
security zone WAN
exit

route-map bgp-out
  rule 1
    match ip address 198.51.100.0/24
    action deny
  exit
  rule 2
  exit
exit

router bgp 2500
  neighbor 203.0.113.2
    remote-as 3000
    update-source 203.0.113.1
    address-family ipv4 unicast
      route-map bgp-out out
      enable
    exit
    enable
  exit
  address-family ipv4 unicast
    redistribute connected
  exit
  enable
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp id 1
  vrrp ip 198.51.100.1/24
  vrrp group 1
  vrrp
  enable
exit

interface gigabitethernet 1/0/1
  security-zone WAN
  ip address 203.0.113.254/24
  vrrp id 4
  vrrp ip 203.0.113.1/24
  vrrp group 1
  vrrp authentication key ascii-text encrypted 88B11079B51D
  vrrp authentication algorithm md5
  vrrp
exit
interface gigabitethernet 1/0/2
  security-zone LAN
  ip address 192.0.2.254/24
  vrrp id 2
  vrrp ip 192.0.2.1/24
  vrrp group 1
  vrrp authentication key ascii-text encrypted 88B11079B51D
  vrrp authentication algorithm md5
  vrrp
exit
interface gigabitethernet 1/0/3
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/1
  security-zone WAN
  ip address 203.0.113.253/24
  vrrp id 4
  vrrp ip 203.0.113.1/24
  vrrp group 1
  vrrp authentication key ascii-text encrypted 88B11079B51D
  vrrp authentication algorithm md5
  vrrp
exit
interface gigabitethernet 2/0/2
  security-zone LAN
  ip address 192.0.2.253/24
  vrrp id 2
  vrrp ip 192.0.2.1/24
  vrrp group 1
  vrrp authentication key ascii-text encrypted 88B11079B51D
  vrrp authentication algorithm md5
  vrrp
exit
interface gigabitethernet 2/0/3
  mode switchport
  spanning-tree disable
exit

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair LAN self
  rule 1
    action permit
    enable
  exit
exit
security zone-pair WAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
  rule 2
    action permit
    match protocol ah
    enable
  exit
  rule 3
    action permit
    match protocol icmp
    enable
  exit
  rule 4
    action permit
    match protocol tcp
    match destination-port object-group og_bgp
    enable
  exit
exit

Пример настройки 2

Задача:

Настроить BGP-протокол в кластере маршрутизаторов ESR-1 и ESR-2 со следующими параметрами:

...

Блок кода
ESR-2# show bgp ipv4 unicast neighbor 203.0.113.6 advertise-routes 
Status codes: u - unicast, b - broadcast, m - multicast, a - anycast
              * - valid, > - best
Origin codes: i - IGP, e - EGP, ? - incomplete

     Network              Next Hop             Metric  LocPrf      Weight Path        
*> u 192.0.2.0/24         203.0.113.5          --      --          --     2500 20 ?
*> u 203.0.113.4/30       203.0.113.5          --      --          --     2500 20 ?
ESR-2# show bgp ipv4 unicast neighbor 203.0.113.6 routes 
Status codes: u - unicast, b - broadcast, m - multicast, a - anycast
              * - valid, > - best
Origin codes: i - IGP, e - EGP, ? - incomplete

     Network              Next Hop             Metric  LocPrf      Weight Path        
*> u 0.0.0.0/0            203.0.113.6          --      100         0      3500 ?
Итоговая конфигурация кластера:
Блок кода
cluster
  cluster-interface bridge 1
  unit 1
    mac-address cc:9d:a2:71:83:78
  exit
  unit 2
    mac-address cc:9d:a2:71:82:38
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

object-group service og_bgp
  port-range 179
exit

security zone SYNC
exit
security zone LAN
exit
security zone WAN
exit

route-map bgp-out
  rule 1
    match ip address 198.51.100.0/24
    action deny
  exit
  rule 2
    action set as-path prepend 20 track 1
  exit
exit

router bgp 2500 unit 1
  neighbor 203.0.113.2
    remote-as 3000
    update-source 203.0.113.1
    address-family ipv4 unicast
      route-map bgp-out out
      enable
    exit
    enable
  exit
  address-family ipv4 unicast
    redistribute connected
  exit
  enable
exit
router bgp 2500 unit 2
  neighbor 203.0.113.6
    remote-as 3500
    update-source 203.0.113.5
    address-family ipv4 unicast
      route-map bgp-out out
      enable
    exit
    enable
  exit
  address-family ipv4 unicast
    redistribute connected
  exit
  enable
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp id 1
  vrrp ip 198.51.100.1/24
  vrrp group 1
  vrrp
  enable
exit

interface gigabitethernet 1/0/1
  security-zone WAN
  ip address 203.0.113.1/30
exit
interface gigabitethernet 1/0/2
  security-zone LAN
  ip address 192.0.2.254/24
  vrrp id 2
  vrrp ip 192.0.2.1/24
  vrrp group 1
  vrrp authentication key ascii-text encrypted 88B11079B51D
  vrrp authentication algorithm md5
  vrrp
exit
interface gigabitethernet 1/0/3
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/1
  security-zone WAN
  ip address 203.0.113.5/30
exit
interface gigabitethernet 2/0/2
  security-zone LAN
  ip address 192.0.2.253/24
  vrrp id 2
  vrrp ip 192.0.2.1/24
  vrrp group 1
  vrrp authentication key ascii-text encrypted 88B11079B51D
  vrrp authentication algorithm md5
  vrrp
exit
interface gigabitethernet 2/0/3
  mode switchport
  spanning-tree disable
exit

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair LAN self
  rule 1
    action permit
    enable
  exit
exit
security zone-pair WAN self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol tcp
    match destination-port object-group og_bgp
    enable
  exit
exit

track 1
  track vrrp id 1 state not master
  enable
exit

...