• If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.
Xin chào ! Nếu đây là lần đầu tiên bạn đến với diễn đàn, xin vui lòng danh ra một phút bấm vào đây để đăng kí và tham gia thảo luận cùng VnPro.

Announcement

Collapse
No announcement yet.

VPN Redundancy giữa 2 site qua leaseline

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • VPN Redundancy giữa 2 site qua leaseline

    Vừa xử lý xong 1 bài toán thường gặp trong thực tế đó là vấn đề redundancy giữa 2 site (hoặc nhiều site, mô hình Hub-and-Spoke) dùng leaseline hoặc xDSL, post lên để các bạn tham khảo và cùng mổ xẻ để tối ưu hơn:

    mô hình:

    mô tả yêu cầu bài toán:
    công ty ABC có 2 site,

    site 1 bao gồm: R1 là gateway router, R1 có 2 kết nối leaseline đến 2 ISP khác nhau (để dự phòng), R11 giả lập PC trong mạng của site 1
    site 2 bao gồm: R2 là gateway router, R2 có 2 kết nối leaseline đến 2 ISP khác nhau, R21 giả lập PC trong mạng của site 2
    yêu cầu: cấu hình VPN giữa 2 site nhằm bảo đảm tính an toàn cho dữ liệu trao đổi giữa 2 site, vì tính chất tối quan trọng của việc liên lạc giữa 2 site, đảm bảo trong trường hợp nếu một kết nối tại mỗi site down liên lạc giữa 2 site vấn đảm bảo.

    Tuy nhiên trong cấu hình trên vẫn chưa giải quyết triệt để vấn đề!

    cấu hình:
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!ROUTER R1!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

    R1#sh run
    Building configuration...

    Current configuration : 1931 bytes
    !
    version 12.4
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    !
    hostname R1
    !
    boot-start-marker
    boot-end-marker
    !
    !
    no aaa new-model
    memory-size iomem 5
    ip cef
    !
    !
    !
    !
    ip sla monitor 1
    type echo protocol ipIcmpEcho 12.12.12.1 source-interface FastEthernet1/0
    timeout 2000
    threshold 1000
    frequency 2
    ip sla monitor schedule 1 life forever start-time now
    ip sla monitor 2
    type echo protocol ipIcmpEcho 112.112.112.1 source-interface FastEthernet2/0
    timeout 2000
    threshold 1000
    frequency 2
    ip sla monitor schedule 2 life forever start-time now
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    track 1 rtr 1 reachability
    !
    track 2 rtr 2 reachability
    !
    !
    crypto isakmp policy 1
    encr 3des
    hash md5
    authentication pre-share
    group 5
    crypto isakmp key cisco address 12.12.12.1
    crypto isakmp key cisco address 112.112.112.1
    crypto isakmp keepalive 10 periodic
    !
    !
    crypto ipsec transform-set IPSEC esp-3des esp-md5-hmac
    !
    crypto map MAP1 1 ipsec-isakmp
    set peer 12.12.12.1
    set transform-set IPSEC
    match address 100
    !
    crypto map MAP2 1 ipsec-isakmp
    set peer 112.112.112.1
    set transform-set IPSEC
    match address 100
    !
    !
    !
    !
    interface FastEthernet0/0
    ip address 150.1.1.1 255.255.255.0
    duplex auto
    speed auto
    !
    interface FastEthernet0/1
    ip address 1.1.1.1 255.255.255.0
    duplex auto
    speed auto
    !
    interface FastEthernet1/0
    ip address 11.11.11.1 255.255.255.0
    duplex auto
    speed auto
    crypto map MAP1
    !
    interface FastEthernet2/0
    ip address 111.111.111.1 255.255.255.0
    duplex auto
    speed auto
    crypto map MAP2
    !
    ip route 0.0.0.0 0.0.0.0 11.11.11.2 track 1
    ip route 0.0.0.0 0.0.0.0 111.111.111.2 track 2
    !
    !
    ip http server
    no ip http secure-server
    !
    access-list 100 permit ip 150.1.1.0 0.0.0.255 150.1.2.0 0.0.0.255
    !
    !
    !
    !
    control-plane
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    line con 0
    exec-timeout 0 0
    privilege level 15
    logging synchronous
    line aux 0
    line vty 0 4
    login
    !
    !
    end


    !!!!!!!!!!!!!!!!!!!ROUTER R11!!!!!!!!!!!!!!!!!!!!!!!
    R11#sh run
    Building configuration...

    Current configuration : 676 bytes
    !
    version 12.4
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    !
    hostname R11
    !
    boot-start-marker
    boot-end-marker
    !
    !
    no aaa new-model
    memory-size iomem 5
    ip cef
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    interface FastEthernet0/0
    ip address 150.1.1.2 255.255.255.0
    duplex auto
    speed auto
    !
    interface FastEthernet0/1
    no ip address
    shutdown
    duplex auto
    speed auto
    !
    ip route 0.0.0.0 0.0.0.0 150.1.1.1
    !
    !
    ip http server
    no ip http secure-server
    !
    !
    !
    !
    !
    control-plane
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    line con 0
    exec-timeout 0 0
    privilege level 15
    logging synchronous
    line aux 0
    line vty 0 4
    login
    !
    !
    end


    !!!!!!!!!!!!!!!!!!!!!!ROUTER R2!!!!!!!!!!!!!!!!!!!!!!
    R2#sh run
    Building configuration...

    Current configuration : 1931 bytes
    !
    version 12.4
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    !
    hostname R2
    !
    boot-start-marker
    boot-end-marker
    !
    !
    no aaa new-model
    memory-size iomem 5
    ip cef
    !
    !
    !
    !
    ip sla monitor 1
    type echo protocol ipIcmpEcho 11.11.11.1 source-interface FastEthernet1/0
    timeout 2000
    threshold 1000
    frequency 2
    ip sla monitor schedule 1 life forever start-time now
    ip sla monitor 2
    type echo protocol ipIcmpEcho 111.111.111.1 source-interface FastEthernet2/0
    timeout 2000
    threshold 1000
    frequency 2
    ip sla monitor schedule 2 life forever start-time now
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    track 1 rtr 1 reachability
    !
    track 2 rtr 2 reachability
    !
    !
    crypto isakmp policy 1
    encr 3des
    hash md5
    authentication pre-share
    group 5
    crypto isakmp key cisco address 11.11.11.1
    crypto isakmp key cisco address 111.111.111.1
    crypto isakmp keepalive 10 periodic
    !
    !
    crypto ipsec transform-set IPSEC esp-3des esp-md5-hmac
    !
    crypto map MAP1 1 ipsec-isakmp
    set peer 11.11.11.1
    set transform-set IPSEC
    match address 100
    !
    crypto map MAP2 1 ipsec-isakmp
    set peer 111.111.111.1
    set transform-set IPSEC
    match address 100
    !
    !
    !
    !
    interface FastEthernet0/0
    ip address 150.1.2.1 255.255.255.0
    duplex auto
    speed auto
    !
    interface FastEthernet0/1
    ip address 1.1.1.2 255.255.255.0
    duplex auto
    speed auto
    !
    interface FastEthernet1/0
    ip address 12.12.12.1 255.255.255.0
    duplex auto
    speed auto
    crypto map MAP1
    !
    interface FastEthernet2/0
    ip address 112.112.112.1 255.255.255.0
    duplex auto
    speed auto
    crypto map MAP2
    !
    ip route 0.0.0.0 0.0.0.0 12.12.12.2 track 1
    ip route 0.0.0.0 0.0.0.0 112.112.112.2 track 2
    !
    !
    ip http server
    no ip http secure-server
    !
    access-list 100 permit ip 150.1.2.0 0.0.0.255 150.1.1.0 0.0.0.255
    !
    !
    !
    !
    control-plane
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    line con 0
    exec-timeout 0 0
    privilege level 15
    logging synchronous
    line aux 0
    line vty 0 4
    login
    !
    !
    end


    !!!!!!!!!!!!!!!!!!!!!!!ROUTER R21!!!!!!!!!!!!!!!!!!!!!!!!
    R21#sh run
    Building configuration...

    Current configuration : 676 bytes
    !
    version 12.4
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    !
    hostname R21
    !
    boot-start-marker
    boot-end-marker
    !
    !
    no aaa new-model
    memory-size iomem 5
    ip cef
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    interface FastEthernet0/0
    ip address 150.1.2.2 255.255.255.0
    duplex auto
    speed auto
    !
    interface FastEthernet0/1
    no ip address
    shutdown
    duplex auto
    speed auto
    !
    ip route 0.0.0.0 0.0.0.0 150.1.2.1
    !
    !
    ip http server
    no ip http secure-server
    !
    !
    !
    !
    !
    control-plane
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    line con 0
    exec-timeout 0 0
    privilege level 15
    logging synchronous
    line aux 0
    line vty 0 4
    login
    !
    !
    end



    !!!!!!!!!!!!!!!!!!!!INTERNET ROUTER!!!!!!!!!!!!!!!!!!
    INTERNET#sh run
    Building configuration...

    Current configuration : 1370 bytes
    !
    version 12.4
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    !
    hostname INTERNET
    !
    boot-start-marker
    boot-end-marker
    !
    !
    no aaa new-model
    memory-size iomem 5
    ip cef
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    interface FastEthernet0/0
    no ip address
    shutdown
    duplex auto
    speed auto
    !
    interface FastEthernet0/1
    no ip address
    shutdown
    duplex auto
    speed auto
    !
    interface FastEthernet1/0
    !
    interface FastEthernet1/1
    no switchport
    ip address 11.11.11.2 255.255.255.0
    !
    interface FastEthernet1/2
    no switchport
    ip address 111.111.111.2 255.255.255.0
    !
    interface FastEthernet1/3
    no switchport
    ip address 12.12.12.2 255.255.255.0
    !
    interface FastEthernet1/4
    no switchport
    ip address 112.112.112.2 255.255.255.0
    !
    interface FastEthernet1/5
    !
    interface FastEthernet1/6
    !
    interface FastEthernet1/7
    !
    interface FastEthernet1/8
    !
    interface FastEthernet1/9
    !
    interface FastEthernet1/10
    !
    interface FastEthernet1/11
    !
    interface FastEthernet1/12
    !
    interface FastEthernet1/13
    !
    interface FastEthernet1/14
    !
    interface FastEthernet1/15
    !
    interface Vlan1
    no ip address
    !
    !
    !
    ip http server
    no ip http secure-server
    !
    access-list 100 deny ip any any
    !
    !
    !
    !
    control-plane
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    line con 0
    exec-timeout 0 0
    privilege level 15
    logging synchronous
    line aux 0
    line vty 0 4
    login
    !
    !
    end

  • #2
    dùng GRE IPSEC:
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!ROUTER R1!!!!!!!!!!!!!!!!!!!!!!!!!
    R1#sh run
    Building configuration...

    Current configuration : 2328 bytes
    !
    version 12.4
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    !
    hostname R1
    !
    boot-start-marker
    boot-end-marker
    !
    !
    no aaa new-model
    memory-size iomem 5
    ip cef
    !
    !
    !
    !
    ip sla monitor 1
    type echo protocol ipIcmpEcho 11.11.11.2 source-interface FastEthernet1/0
    timeout 2000
    threshold 1000
    frequency 2
    ip sla monitor schedule 1 life forever start-time now
    ip sla monitor 2
    type echo protocol ipIcmpEcho 111.111.111.2 source-interface FastEthernet2/0
    timeout 2000
    threshold 1000
    frequency 2
    ip sla monitor schedule 2 life forever start-time now
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    track 1 rtr 1 reachability
    !
    track 2 rtr 2 reachability
    !
    !
    crypto isakmp policy 1
    encr 3des
    hash md5
    authentication pre-share
    group 5
    crypto isakmp key cisco address 12.12.12.1
    crypto isakmp key cisco address 112.112.112.1
    !
    !
    crypto ipsec transform-set IPSEC esp-3des esp-md5-hmac
    mode transport
    !
    crypto map MAP 1 ipsec-isakmp
    set peer 12.12.12.1
    set transform-set IPSEC
    match address 100
    !
    crypto map MAP1 1 ipsec-isakmp
    set peer 112.112.112.1
    set transform-set IPSEC
    match address 100
    !
    !
    !
    !
    interface Tunnel1
    ip address 123.123.123.1 255.255.255.0
    keepalive 1 3
    tunnel source FastEthernet1/0
    tunnel destination 12.12.12.1
    !
    interface Tunnel2
    ip address 100.100.100.1 255.255.255.0
    keepalive 1 3
    tunnel source FastEthernet2/0
    tunnel destination 112.112.112.1
    !
    interface FastEthernet0/0
    ip address 150.1.1.1 255.255.255.0
    duplex auto
    speed auto
    !
    interface FastEthernet0/1
    ip address 1.1.1.1 255.255.255.0
    duplex auto
    speed auto
    !
    interface FastEthernet1/0
    ip address 11.11.11.1 255.255.255.0
    duplex auto
    speed auto
    crypto map MAP
    !
    interface FastEthernet2/0
    ip address 111.111.111.1 255.255.255.0
    duplex auto
    speed auto
    crypto map MAP1
    !
    ip route 0.0.0.0 0.0.0.0 11.11.11.2 track 1
    ip route 0.0.0.0 0.0.0.0 111.111.111.2 2 track 2
    ip route 150.1.2.0 255.255.255.0 Tunnel1
    ip route 150.1.2.0 255.255.255.0 Tunnel2
    !
    !
    ip http server
    no ip http secure-server
    !
    access-list 100 permit gre host 11.11.11.1 host 12.12.12.1
    access-list 100 permit gre host 111.111.111.1 host 112.112.112.1
    !
    !
    !
    !
    control-plane
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    line con 0
    exec-timeout 0 0
    privilege level 15
    logging synchronous
    line aux 0
    line vty 0 4
    login
    !
    !
    end


    !!!!!!!!!!!!!!!!!!!!!!!!!!!!ROUTER R11!!!!!!!!!!!!!!!!!!!!!!!!!
    hostname R11
    !
    boot-start-marker
    boot-end-marker
    !
    !
    no aaa new-model
    memory-size iomem 5
    ip cef
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    interface FastEthernet0/0
    ip address 150.1.1.2 255.255.255.0
    duplex auto
    speed auto
    !
    interface FastEthernet0/1
    no ip address
    shutdown
    duplex auto
    speed auto
    !
    ip route 0.0.0.0 0.0.0.0 150.1.1.1
    !
    !
    ip http server
    no ip http secure-server
    !
    !
    !
    !
    !
    control-plane
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    line con 0
    exec-timeout 0 0
    privilege level 15
    logging synchronous
    line aux 0
    line vty 0 4
    login
    !
    !
    end


    !!!!!!!!!!!!!!!!!!!!!!!!!!!!ROUTER R2!!!!!!!!!!!!!!!!!!!!!!!!!
    R2#sh run
    Building configuration...

    Current configuration : 2328 bytes
    !
    version 12.4
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    !
    hostname R2
    !
    boot-start-marker
    boot-end-marker
    !
    !
    no aaa new-model
    memory-size iomem 5
    ip cef
    !
    !
    !
    !
    ip sla monitor 1
    type echo protocol ipIcmpEcho 12.12.12.2 source-interface FastEthernet1/0
    timeout 2000
    threshold 1000
    frequency 2
    ip sla monitor schedule 1 life forever start-time now
    ip sla monitor 2
    type echo protocol ipIcmpEcho 112.112.112.2 source-interface FastEthernet2/0
    timeout 2000
    threshold 1000
    frequency 2
    ip sla monitor schedule 2 life forever start-time now
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    track 1 rtr 1 reachability
    !
    track 2 rtr 2 reachability
    !
    !
    crypto isakmp policy 1
    encr 3des
    hash md5
    authentication pre-share
    group 5
    crypto isakmp key cisco address 11.11.11.1
    crypto isakmp key cisco address 111.111.111.1
    !
    !
    crypto ipsec transform-set IPSEC esp-3des esp-md5-hmac
    mode transport
    !
    crypto map MAP 1 ipsec-isakmp
    set peer 11.11.11.1
    set transform-set IPSEC
    match address 100
    !
    crypto map MAP1 1 ipsec-isakmp
    set peer 111.111.111.1
    set transform-set IPSEC
    match address 100
    !
    !
    !
    !
    interface Tunnel1
    ip address 123.123.123.2 255.255.255.0
    keepalive 1 3
    tunnel source FastEthernet1/0
    tunnel destination 11.11.11.1
    !
    interface Tunnel2
    ip address 100.100.100.2 255.255.255.0
    keepalive 1 3
    tunnel source FastEthernet2/0
    tunnel destination 111.111.111.1
    !
    interface FastEthernet0/0
    ip address 150.1.2.1 255.255.255.0
    duplex auto
    speed auto
    !
    interface FastEthernet0/1
    ip address 1.1.1.2 255.255.255.0
    duplex auto
    speed auto
    !
    interface FastEthernet1/0
    ip address 12.12.12.1 255.255.255.0
    duplex auto
    speed auto
    crypto map MAP
    !
    interface FastEthernet2/0
    ip address 112.112.112.1 255.255.255.0
    duplex auto
    speed auto
    crypto map MAP1
    !
    ip route 0.0.0.0 0.0.0.0 12.12.12.2 track 1
    ip route 0.0.0.0 0.0.0.0 112.112.112.2 2 track 2
    ip route 150.1.1.0 255.255.255.0 Tunnel1
    ip route 150.1.1.0 255.255.255.0 Tunnel2
    !
    !
    ip http server
    no ip http secure-server
    !
    access-list 100 permit gre host 12.12.12.1 host 11.11.11.1
    access-list 100 permit gre host 112.112.112.1 host 111.111.111.1
    !
    !
    !
    !
    control-plane
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    line con 0
    exec-timeout 0 0
    privilege level 15
    logging synchronous
    line aux 0
    line vty 0 4
    login
    !
    !
    end


    !!!!!!!!!!!!!!!!!!!!!!!!!!!!ROUTER R21!!!!!!!!!!!!!!!!!!!!!!!!!
    R21#sh run
    Building configuration...

    Current configuration : 676 bytes
    !
    version 12.4
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    !
    hostname R21
    !
    boot-start-marker
    boot-end-marker
    !
    !
    no aaa new-model
    memory-size iomem 5
    ip cef
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    interface FastEthernet0/0
    ip address 150.1.2.2 255.255.255.0
    duplex auto
    speed auto
    !
    interface FastEthernet0/1
    no ip address
    shutdown
    duplex auto
    speed auto
    !
    ip route 0.0.0.0 0.0.0.0 150.1.2.1
    !
    !
    ip http server
    no ip http secure-server
    !
    !
    !
    !
    !
    control-plane
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    line con 0
    exec-timeout 0 0
    privilege level 15
    logging synchronous
    line aux 0
    line vty 0 4
    login
    !
    !
    end


    !!!!!!!!!!!!!!!!!!!!!!!!!!!!INTERNET ROUTER!!!!!!!!!!!!!!!!!!!!!!!!!
    INTERNET#sh run
    Building configuration...

    Current configuration : 1370 bytes
    !
    version 12.4
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    !
    hostname INTERNET
    !
    boot-start-marker
    boot-end-marker
    !
    !
    no aaa new-model
    memory-size iomem 5
    ip cef
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    interface FastEthernet0/0
    no ip address
    shutdown
    duplex auto
    speed auto
    !
    interface FastEthernet0/1
    no ip address
    shutdown
    duplex auto
    speed auto
    !
    interface FastEthernet1/0
    !
    interface FastEthernet1/1
    no switchport
    ip address 11.11.11.2 255.255.255.0
    !
    interface FastEthernet1/2
    no switchport
    ip address 111.111.111.2 255.255.255.0
    !
    interface FastEthernet1/3
    no switchport
    ip address 12.12.12.2 255.255.255.0
    !
    interface FastEthernet1/4
    no switchport
    ip address 112.112.112.2 255.255.255.0
    !
    interface FastEthernet1/5
    !
    interface FastEthernet1/6
    !
    interface FastEthernet1/7
    !
    interface FastEthernet1/8
    !
    interface FastEthernet1/9
    !
    interface FastEthernet1/10
    !
    interface FastEthernet1/11
    !
    interface FastEthernet1/12
    !
    interface FastEthernet1/13
    !
    interface FastEthernet1/14
    !
    interface FastEthernet1/15
    !
    interface Vlan1
    no ip address
    !
    !
    !
    ip http server
    no ip http secure-server
    !
    access-list 100 deny ip any any
    !
    !
    !
    !
    control-plane
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    line con 0
    exec-timeout 0 0
    privilege level 15
    logging synchronous
    line aux 0
    line vty 0 4
    login
    !
    !
    end

    Comment

    Working...
    X