CCNA第六天

1、 配置帧中继 1. 点对点的帧中继的一个基本的配置 配置的步骤; A 配置一个帧中继交换机，我们给R1分配的DLCI号码是102，给R2分配的DLCI号码是201，那么R1的分配的IP地址是202.202.202.1,R2分配的IP地址是202.202.202.2 frame-relay-switch(config)#frame-relay switching interface Serial1/0 no ip address encapsulation frame-relay 封装帧中继 serial restart-delay 0 clock rate 64000 设置时钟速率 no frame-relay inverse-arp 关闭IARP（反向地址解析）的自动解析 frame-relay lmi-type cisco 设置LMI（本地管理接口）的类型是cisco的 frame-relay intf-type dce 设置我这边的接口是局端S0 frame-relay route 102 interface Serial1/2 201 分配给S1/0的DLCI号码是102，并且把她映射到S1/2的DLCI号码是201. ! ! interface Serial1/2 no ip address encapsulation frame-relay serial restart-delay 0 clock rate 64000 no frame-relay inverse-arp frame-relay lmi-type cisco frame-relay intf-type dce frame-relay route 201 interface Serial1/0 102 R1上的配置 interface Serial1/0 ip address 202.202.202.1 255.255.255.0 encapsulation frame-relay serial restart-delay 0 frame-relay map ip 202.202.202.1 102 broadcast ospf不通信 手工的映射，把去往202.202.202.2的流量，扔给DLCI号码为102，并且是广播。 frame-relay map ip 202.202.202.2 102 broadcast no frame-relay inverse-arp 关闭自动的映射 r1#sh frame-relay pvc 查询永久虚链路PVC的状态信息 PVC Statistics for interface Serial1/0 (Frame Relay DTE) Active Inactive Deleted Static LMI提供的 Local 1 0 0 0 Switched 0 0 0 0 Unused 0 0 0 0 Active：表示的是链路没有任何问题 Inactive：表示的是你的链路层起来了，但是可能局端那里配置有问题。 Deleted：表示这个链路根本就没有起来。 DLCI = 102, DLCI USAGE = LOCAL, PVC STATUS = ACTIVE, INTERFACE = Serial1/0 input pkts 0 output pkts 0 in bytes 0 out bytes 0 dropped pkts 0 in pkts dropped 0 out pkts dropped 0 out bytes dropped 0 in FECN pkts 0 in BECN pkts 0 out FECN pkts 0 out BECN pkts 0 in DE pkts 0 out DE pkts 0 out bcast pkts 0 out bcast bytes 0 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec pvc create time 00:02:46, last time pvc status changed 00:00:11 r1#sh frame-relay map 查询帧中继的映射表 Serial1/0 (up): ip 202.202.202.1 dlci 102(0x66,0x1860), static, broadcast, CISCO, status defined, active Serial1/0 (up): ip 202.202.202.2 dlci 102(0x66,0x1860), static, broadcast, CISCO, status defined, active 为什么不能用动态解析的原因？ 2. 点对点和点对多点的应用 A 我们先来看一下点对点的优势，以一个实际的工程项目来看 2、 配置SDM 步骤： A 路由器的配置 Router(config)#username cisco privilege 15 password cisco Router(config)#int f0/0 Router(config-if)#ip add 1.1.1.1 255.255.255.0 Router(config-if)#no shut Router(config-if)#exit Router(config)#ip http secure-server 3、 DHCP（动态主机配置协议）动态分配IP地址 她可以作为一个管理IP地址的工具。 4、 VPN的技术 专线的费用是非常高的，但是我们可以将我们的所有的设备接入到internet中，那么这个花费是低廉的。但是这个也是不安全的，我们需要用vpn来对这样的行为进行加密 VPN其实全称叫虚拟私有网络，其实说白了，就是再一个共有的环境中，提供一个私有的隧道，把我们说的话，进行隧道的包裹，然后进行加密的一种技术。 其实,再应用中，她就是二次拨号。 1. VPN的二种模式： A 传输模式：加密点和传输点为同一个，例如，主机到服务器之间启动vpn技术 B 隧道模式：加密点和传输点不是同一个，例如，两台路由器之间启动VPN。 2. IPsec的协议 问题：什么是加密？ 例子：写了一封情，然后怕别人看。 私密性 (資料加密) ：私密性可确保资料只透露给预定的收件人。 数据完整性：确保受到的资料与传送的资料完全相同。 认证：收件人可以认证包是否来自于合法的发送者。 反重新播放：确定每个封包的唯一性。 5、 IPV6 她是解决地址空间不足的问题，就算我们已经学习了： 1. VLSM：可变长子网掩码 2. CIDR：无类型域间路由选择 3. NAT/PAT 其实，以上的这三种技术，都是为了解决IPv4地址不足的问题。IPv6她的格式要简单于IPv4，但是地址长度要远远的高于IPv4，IPv4是32位，而ipv6是128位。 试验、IPv6的静态路由试验 13.2.1试验拓扑 IPv6静态路由的试验拓扑如下图13-2所示：每台路由器都以串行点对点的模式连接，路由器的以太网接口都连接在一台交换机上，彼此可以互相访问。在此试验中，需要用到R1和R2两台路由器。 图13- 2 IPv6静态路由试验拓扑图 13.2.2试验过程 基本试验过程将在R1和R2上来实施，参照上图13-2，需要配置路由器R1与R2的直连接口的IPv6地址，并且建立测试地址loopback0，启动静态路由协议。 基本的IPv6静态路由试验 在R1路由器上的基本配置 interface Loopback0 no ip address IPv6 address 2000:0:0:1::1/64 设置IPv6格式的IP地址 ! interface Serial1/0 no ip address IPv6 address 2001:0:0:2::1/64 设置IPv6格式的IP地址i clockrate 64000 ！ IPv6 unicast-routing 一定要打这条命令，因为默认情况下IPv6 路由选择功能是关闭的 ！ IPv6 route 2002:0:0:3::/64 2001:0:0:2::2 启动静态路由协议，下一跳是对端的IP地址，静态路由协议和IPv4一样，只不过变成了IPv6格式 在R2路由器上的基本配置 interface Loopback0 no ip address IPv6 address 2002:0:0:3::2/64 ! interface Serial1/0 no ip address IPv6 address 2001:0:0:2::2/64 ! IPv6 unicast-routing ! IPv6 route ::/0 2001:0:0:2::1 （这里用：：/0 表示默认静态路由） 基本的IPv6静态路由结果测试 R1#sh ipv route R1上的路由表：用sh IPv6 route 打开 IPv6 Routing Table - 9 entries Codes: C - Connected, L - Local, S - Static, R - RIP, B - BGP U - Per-user Static route I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary O - OSPF intra, OI - OSPF inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2 ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2 C 2000:0:0:1::/64 [0/0] via ::, Loopback0 L 2000:0:0:1::1/128 [0/0] via ::, Loopback0 C 2001:0:0:2::/64 [0/0] via ::, Serial1 L 2001:0:0:2::1/128 [0/0] via ::, Serial1 S 2002:0:0:3::/64 [1/0] via 2001:0:0:2::2 L FE80::/10 [0/0] via ::, Null0 L FF00::/8 [0/0] via ::, Null0 我们可以看到有一条S 的路由，是我们写的，他的管理距离是1，下一条是R2 的S1 口。 R2#sh ipv route 查询R2 的路由表 IPv6 Routing Table - 7 entries Codes: C - Connected, L - Local, S - Static, R - RIP, B - BGP U - Per-user Static route I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary O - OSPF intra, OI - OSPF inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2 ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2 S ::/0 [1/0] via 2001:0:0:2::1 C 2001:0:0:2::/64 [0/0] via ::, Serial1 L 2001:0:0:2::2/128 [0/0] via ::, Serial1 C 2002:0:0:3::/64 [0/0] via ::, Loopback0 L 2002:0:0:3::2/128 [0/0] via ::, Loopback0 L FE80::/10 [0/0] via ::, Null0 L FF00::/8 [0/0] via ::, Null0 有一条默认静态路由。 测试一下R1到R2环回接口的连通性 R1#ping IPv6 2002:0:0:3::2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2002:0:0:3::2, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 28/31/32 ms R2#ping IPv6 2000:0:0:1::1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2000:0:0:1::1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 32/32/32 ms OK！成功了 IPv6的负载均衡试验 IPV6 的负载和IPV4 的负载是一样的，都可以在两条链路上走，实现负载。我们可以通过修改管理距离来把负载的一条链路做成浮动静态路由，方法和IPV4 的一样在静态路由后面加上管理距离值。在R1和R2之间增加以太网的第二条链路。 在R1路由器上的基本配置 interface Loopback0 no ip address IPv6 address 2000:0:0:1::1/64 建立环回接口的IP地址 ! interface Serial1/0 no ip address IPv6 address 2001:0:0:2::1/64 建立串行接口的IP地址 clockrate 64000 ! interface f0/0 no ip address IPv6 address 2003:0:0:1::1/64 建立以太网接口的IP地址 ！ IPv6 unicast-routing （一定要打这条命令，因为默认情况下IPV6 路由选择功能是关闭的） ！ IPv6 route 2002:0:0:3::/64 f0/0 2003:0:0:1::2 IPv6 route 2002:0:0:3::/64 Serial1/0 2001:0:0:2::2 联合接口和下一跳地址一起写 ！ 在R2路由器上的基本配置 interface Loopback0 no ip address IPv6 address 2002:0:0:3::2/64 ! interface Serial1/0 no ip address IPv6 address 2001:0:0:2::2/64 ! interface f0/0 no ip address IPv6 address 2003:0:0:1::2/64 ! IPv6 unicast-routing ! IPv6 route ::/0 f0/0 2003:0:0:1::1 联合接口和下一跳一起写的默认路由 IPv6 route ::/0 2001:0:0:2::1 基本的IPv6负载均衡结果测试 R1# sh ipv route 查看R1上的路由表：用sh IPv6 route 打开 IPv6 Routing Table - 9 entries Codes: C - Connected, L - Local, S - Static, R - RIP, B - BGP U - Per-user Static route I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary O - OSPF intra, OI - OSPF inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2 ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2 C 2000:0:0:1::/64 [0/0] via ::, Loopback0 L 2000:0:0:1::1/128 [0/0] via ::, Loopback0 C 2001:0:0:2::/64 [0/0] via ::, Serial1 L 2001:0:0:2::1/128 [0/0] via ::, Serial1 S 2002:0:0:3::/64 [1/0] via 2001:0:0:2::2, Serial1 via 2003:0:0:1::2, Ethernet0 C 2003:0:0:1::/64 [0/0] via ::, Ethernet0 L 2003:0:0:1::1/128 [0/0] via ::, Ethernet0 L FE80::/10 [0/0] via ::, Null0 L FF00::/8 [0/0] via ::, Null0 可以看到有一条S 的路由，里面有两个下一跳地址，也就说我们能通过这两个地址到达目标，实现了负载均衡的目的 R2# sh ipv route 查看R2 的路由表 IPv6 Routing Table - 9 entries Codes: C - Connected, L - Local, S - Static, R - RIP, B - BGP U - Per-user Static route I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary O - OSPF intra, OI - OSPF inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2 ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2 S ::/0 [1/0] via 2001:0:0:2::1 via 2003:0:0:1::1, Ethernet0 C 2001:0:0:2::/64 [0/0] via ::, Serial1 L 2001:0:0:2::2/128 [0/0] via ::, Serial1 C 2002:0:0:3::/64 [0/0] via ::, Loopback0 L 2002:0:0:3::2/128 [0/0] via ::, Loopback0 C 2003:0:0:1::/64 [0/0] via ::, Ethernet0 L 2003:0:0:1::2/128 [0/0] via ::, Ethernet0 L FE80::/10 [0/0] via ::, Null0 L FF00::/8 [0/0] via ::, Null0 有两条默认静态路由。 测试一下R1到R3环回接口的连通性 R1#ping IPv6 2002:0:0:3::2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2002:0:0:3::2, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 28/31/32 ms R2#ping IPv6 2000:0:0:1::1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2000:0:0:1::1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 32/32/32 ms OK！成功了 测试ipv6的ping： r2#ping ipv6 2001:0:0:2::1 试验、IPv6的rip的试验 13.3.1试验拓扑 IPv6动态RIP路由的试验拓扑如下图13-3所示：每台路由器都以串行点对点的模式连接，路由器的以太网接口都连接在一台交换机上，彼此可以互相访问。在此试验中，需要用到R1和R2两台路由器。 图13- 3 IPv6动态RIP路由试验拓扑图 13.2.2试验过程 基本试验过程将在R1和R2上来实施，参照上图13-3，需要配置路由器R1与R2的直连接口的IPv6地址，并且建立测试地址loopback0，启动动态RIP路由协议。 基本的IPv6动态RIP路由试验 在R1路由器上的基本配置 interface Loopback0 配置环回接口的IP地址 no ip address ipv6 address 2000::1/64 ipv6 rip pliskin enable 这里定义了一个进程的名字叫pliskin，在启用RIPng 时，所有的接口都要打这条命令。 ! interface Serial1/0 no ip address ipv6 address 2001::1/64 设置接口IP地址 ipv6 rip pliskin enable 开启接口下的IPv6 RIP协议 clockrate 64000 ! ipv6 router rip pliskin （一定要打这条命令，因为默认情况下IPV6 路由选择功能是关闭的） ！ ipv6 router rip pliskin 这个命令是系统自动创建的 在R2路由器上的基本配置 interface Loopback0 no ip address ipv6 address 2002::1/64 ipv6 rip pliskin enable ! interface Serial1/0 no ip address ipv6 address 2001::2/64 ipv6 rip pliskin ! ipv6 unicast-routing ! ipv6 router rip pliskin 基本的IPv6动态RIP路由测试 R1#sh ipv route 查询R1 上的路由表，用sh ipv6 route 打开。 IPv6 Routing Table - 7 entries Codes: C - Connected, L - Local, S - Static, R - RIP, B - BGP U - Per-user Static route I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary O - OSPF intra, OI - OSPF inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2 ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2 C 2000::/64 [0/0] via ::, Loopback0 L 2000::1/128 [0/0] via ::, Loopback0 C 2001::/64 [0/0] via ::, Serial1 L 2001::1/128 [0/0] via ::, Serial1 R 2002::/64 [120/2] via FE80::200:CFF:FE42:5E93, Serial1/0 L FE80::/10 [0/0] via ::, Null0 L FF00::/8 [0/0] via ::, Null0 可以看到有一条R 的路由，管理距离是120，下一跳是R2路由器 的S1/0接口IP地址，并且地址是本地单播地址。 R2#sh ipv route 查看R2路由器的路由表 IPv6 Routing Table - 7 entries Codes: C - Connected, L - Local, S - Static, R - RIP, B - BGP U - Per-user Static route I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary O - OSPF intra, OI - OSPF inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2 Page 10 of 39 ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2 R 2000::/64 [120/2] via FE80::200:CFF:FE09:A0B8, Serial1/0 C 2001::/64 [0/0] via ::, Serial1 L 2001::2/128 [0/0] via ::, Serial1 C 2002::/64 [0/0] via ::, Loopback0 L 2002::1/128 [0/0] via ::, Loopback0 L FE80::/10 [0/0] via ::, Null0 L FF00::/8 [0/0] via ::, Null0 测试从R1到R2的环回接口连通性 R1#ping ipv6 2002::1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2002::1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 28/31/32 ms R2#ping ipv6 2000::1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2000::1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 32/32/32 ms OK！成功了 IPv6动态RIP高级测试 R1#sh ipv rip 查看R1的IPv6的RIP协议详细信息 RIP process "pliskin", port 521, multicast-group FF02::9, pid 78 Administrative distance is 120. Maximum paths is 16 Updates every 30 seconds, expire after 180 Holddown lasts 0 seconds, garbage collect after 120 Split horizon is on; poison reverse is off Default routes are not generated Periodic updates 35, trigger updates 3 Interfaces: Serial1/0 Loopback0 Redistribution: None 可以看到RIPng 的进程是pliskin，组播地址是FF02::9，管理距离为120，可做负载的路径是16 条，还有4 个计时器，水平分割是开的，起用的接口是环回接口和s1/0 串口。 R1(config)#ipv router rip pliskin 可以进入相应的进程来改这些参数： R1(config-rtr)#? default Set a command to its defaults distance Administrative distance distribute-list Filter networks in routing updates exit Exit from IPv6 routing protocol configuration mode maximum-paths Forward packets over multiple paths no Negate a command or set its defaults poison-reverse Poison reverse updates port Port and multicast address redistribute Redistribute IPv6 prefixes from another routing protocol split-horizon Split horizon updates summary-prefix Configure IPv6 summary prefix timers Adjust routing timers R1(config-rtr)#timers 5 15 15 40 R1(config-rtr)#maximum-paths 10 R1(config-rtr)#distance 160 改变了计时器，最大路径和管理距离，再次查看结果： rack01#sh ipv rip RIP process "pliskin", port 521, multicast-group FF02::9, pid 78 Administrative distance is 160. Maximum paths is 10 Updates every 5 seconds, expire after 15 Holddown lasts 15 seconds, garbage collect after 40 Split horizon is on; poison reverse is off Default routes are not generated Periodic updates 77, trigger updates 3 Interfaces: Serial1 Loopback0 Redistribution: None 成功了！ 基本的IPv6动态RIP汇总试验 在R1路由器上建立测试的环回接口，并在R1路由器上完成汇总的配置 R1 路由器的基本配置 ! interface Loopback0 no ip address ipv6 address 2000:1:1:10::1/64 ipv6 rip pliskin enable ! interface Loopback1 no ip address ipv6 address 2000:1:1:11::1/64 ipv6 rip pliskin enable ! interface Loopback2 no ip address ipv6 address 2000:1:1:12::1/64 ipv6 rip pliskin enable ! interface Loopback3 no ip address ipv6 address 2000:1:1:13::1/64 ipv6 rip pliskin enable ! 所起的LOOP 做测试 ! interface Serial1/0 Page 13 of 39 no ip address ipv6 address 2001::1/64 ipv6 rip pliskin enable ipv6 rip pliskin summary-address 2000:1:1:10::/62 建立汇总地址 clockrate 64000 ! ipv6 router rip pliskin R2路由器的基本配置 interface Loopback0 no ip address ipv6 address 2002::1/64 ipv6 rip pliskin enable ! interface Serial1 no ip address ipv6 address 2001::2/64 ipv6 rip pliskin enable ! ipv6 unicast-routing ! ipv6 router rip pliskin 基本的IPv6动态RIP汇总试验测试 R1#s ipv route 查看R1上的路由表，用sh ipv6 route 打开。 IPv6 Routing Table - 13 entries Codes: C - Connected, L - Local, S - Static, R - RIP, B - BGP U - Per-user Static route I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary O - OSPF intra, OI - OSPF inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2 ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2 C 2000:1:1:10::/64 [0/0] via ::, Loopback0 L 2000:1:1:10::1/128 [0/0] via ::, Loopback0 C 2000:1:1:11::/64 [0/0] via ::, Loopback1 L 2000:1:1:11::1/128 [0/0] via ::, Loopback1 C 2000:1:1:12::/64 [0/0] via ::, Loopback2 L 2000:1:1:12::1/128 [0/0] Page 14 of 39 via ::, Loopback2 C 2000:1:1:13::/64 [0/0] via ::, Loopback3 L 2000:1:1:13::1/128 [0/0] via ::, Loopback3 C 2001::/64 [0/0] via ::, Serial1 L 2001::1/128 [0/0] via ::, Serial1 R 2002::/64 [120/2] via FE80::200:CFF:FE42:5E93, Serial1/0 L FE80::/10 [0/0] via ::, Null0 L FF00::/8 [0/0] via ::, Null0 rack02#sh ipv route 查看R2的路由表 IPv6 Routing Table - 7 entries Codes: C - Connected, L - Local, S - Static, R - RIP, B - BGP U - Per-user Static route I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary O - OSPF intra, OI - OSPF inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2 ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2 R 2000:1:1:10::/62 [120/2] via FE80::200:CFF:FE09:A0B8, Serial1/0 C 2001::/64 [0/0] via ::, Serial1 L 2001::2/128 [0/0] via ::, Serial1 C 2002::/64 [0/0] via ::, Loopback0 L 2002::1/128 [0/0] via ::, Loopback0 L FE80::/10 [0/0] via ::, Null0 L FF00::/8 [0/0] via ::, Null0 看见了一条汇总的地址 在R2 上做来测试一下连通性： rack02#ping ipv6 2000:1:1:10::1 Page 15 of 39 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2000:1:1:10::1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 32/32/32 ms rack02#ping ipv6 2000:1:1:11::1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2000:1:1:11::1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 28/31/32 ms rack02#ping ipv6 2000:1:1:12::1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2000:1:1:12::1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 32/32/32 ms rack02#ping ipv6 2000:1:1:13::1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2000:1:1:13::1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 28/31/32 ms OK 成功了