企业IPv6网关负载分担方案的设计与实现

背景需求

(1)随着企业业务数量大幅增加,以及网络应用的高速发展,现有IPv4地址已不能满足需求,根据通信架构合理规划IPv6网络,对企业网络进行构建及扩充。

(2)企业业务量上升网络主机对外部访问量增加,单一网关设计的网络不再满足高可用性的要求,需要根据企业网络需求,设计多个网关的主/备运行,在当前运行网关设备故障或维护时,依然可以保证业务流量的畅通。

(3)依照企业网络规划,需要基于IPv6设计的路由协议及地址可兼容与企业网关备份策略及技术,合理配置网管设备,使其可用于IPv6网络网关备份。

(4)接入层划分vlan实现二层隔离。

(5)使用vrrp6技术实现网关冗余备份

(6)使用ospfv3技术实现内网互联互通

(7)使用dhcpv6技术实现终端自动获取ip地址

(8)使用防火墙配置安全策略保护内网安全

将该公司申请的/48进一步划分为/46, 分配给各部门

|------|---------------------|--------|
| 接入单位 | 地址 | 所属vlan |
| 行政部 | 2001:100:200:1::/64 | 10 |
| IT部 | 2001:100:200:2::/64 | 20 |
| 商务部 | 2001:100:200:3::/64 | 30 |
| 办公有线 | 2001:100:200:4::/64 | 40 |
| 车间 | 2001:100:200:5::/64 | 50 |
| 测试 | 2001:100:200:6::/64 | 60 |
| 服务器 | 2001:100:200:7::/64 | N/A |

设备互联地址

|-------------|-------------------------|
| 名称 | 地址 |
| FW---核心1 | 2001:100:200:abc::/126 |
| FW---核心2 | 2001:100:200:abc::4/126 |
| FW---服务器核心1 | 2001:100:200:abc::8/126 |
| FW---服务器核心2 | 2001:100:200:abc::C/126 |
| 出口地址 | 2005::/64 |

拓扑

配置过程

Vlan创建

vlan batch 10 20 30 40

vlan batch 50 60

其他交换机配置相同

交换机接口划分

办公楼接入交换机

interface GigabitEthernet0/0/1

port link-type access

port default vlan 10

interface GigabitEthernet0/0/2

port link-type access

port default vlan 10

interface GigabitEthernet0/0/3

port link-type trunk

port trunk allow-pass vlan 2 to 4094

interface GigabitEthernet0/0/4

port link-type access

port default vlan 10

车间接入交换机

interface GigabitEthernet0/0/1

port link-type access

port default vlan 50

interface GigabitEthernet0/0/2

port link-type access

port default vlan 50

interface GigabitEthernet0/0/3

port link-type trunk

port trunk allow-pass vlan 2 to 4094

#接入交换机

其他配置均相同 加入相应vlan即可

汇聚交换机配置

interface GigabitEthernet0/0/1

port link-type trunk

port trunk allow-pass vlan 10 20 30 40

interface GigabitEthernet0/0/2

port link-type trunk

port trunk allow-pass vlan 10 20 30 40

interface GigabitEthernet0/0/3

port link-type trunk

port trunk allow-pass vlan 10 20 30 40

interface GigabitEthernet0/0/4

port link-type trunk

port trunk allow-pass vlan 10 20 30 40

interface GigabitEthernet0/0/5

port link-type trunk

port trunk allow-pass vlan 10 20 30 40

interface GigabitEthernet0/0/6

port link-type trunk

port trunk allow-pass vlan 10 20 30 40

生产车间汇聚交换机

interface GigabitEthernet0/0/1

port link-type trunk

port trunk allow-pass vlan 50 60

interface GigabitEthernet0/0/2

port link-type trunk

port trunk allow-pass vlan 50 60

interface GigabitEthernet0/0/3

port link-type trunk

port trunk allow-pass vlan 50 60

interface GigabitEthernet0/0/4

port link-type trunk

port trunk allow-pass vlan 50 60

核心配置业务接口

开启ipv6

其他设备均要开启ipv6功能

配置接口ipv6地址,配置vrrp网关

interface GigabitEthernet0/0/0.10

dot1q termination vid 10

ipv6 enable

ipv6 address 2001:100:200:1::1/64

undo ipv6 nd ra halt

ospfv3 1 area 0.0.0.0

vrrp6 vrid 10 virtual-ip FE80::1 link-local

vrrp6 vrid 10 virtual-ip 2001:100:200:1::3

vrrp6 vrid 10 priority 120

arp broadcast enable

interface GigabitEthernet0/0/0.20

dot1q termination vid 20

ipv6 enable

ipv6 address 2001:100:200:2::1/64

undo ipv6 nd ra halt

ospfv3 1 area 0.0.0.0

vrrp6 vrid 20 virtual-ip FE80::2 link-local

vrrp6 vrid 20 virtual-ip 2001:100:200:2::3

vrrp6 vrid 20 priority 120

arp broadcast enable

dhcpv6 server vlan20

interface GigabitEthernet0/0/0.30

dot1q termination vid 30

ipv6 enable

ipv6 address 2001:100:200:3::1/64

ospfv3 1 area 0.0.0.0

vrrp6 vrid 30 virtual-ip FE80::3 link-local

vrrp6 vrid 30 virtual-ip 2001:100:200:3::3

arp broadcast enable

interface GigabitEthernet0/0/0.40

dot1q termination vid 40

ipv6 enable

ipv6 address 2001:100:200:4::1/64

ospfv3 1 area 0.0.0.0

vrrp6 vrid 40 virtual-ip FE80::4 link-local

vrrp6 vrid 40 virtual-ip 2001:100:200:4::3

arp broadcast enable

备份配置

interface GigabitEthernet0/0/0.10

dot1q termination vid 10

ipv6 enable

ipv6 address 2001:100:200:1::2/64

ospfv3 1 area 0.0.0.0

vrrp6 vrid 10 virtual-ip FE80::1 link-local

vrrp6 vrid 10 virtual-ip 2001:100:200:1::3

arp broadcast enable

interface GigabitEthernet0/0/0.20

dot1q termination vid 20

ipv6 enable

ipv6 address 2001:100:200:2::2/64

ospfv3 1 area 0.0.0.0

vrrp6 vrid 20 virtual-ip FE80::2 link-local

vrrp6 vrid 20 virtual-ip 2001:100:200:2::3

arp broadcast enable

interface GigabitEthernet0/0/0.30

dot1q termination vid 30

<Huawei>

Please check whether system data has been changed, and save data in time

Configuration console time out, please press any key to log on

<Huawei>dis cu int

[V200R003C00]

interface GigabitEthernet0/0/0

interface GigabitEthernet0/0/0.10

dot1q termination vid 10

ipv6 enable

ipv6 address 2001:100:200:1::2/64

ospfv3 1 area 0.0.0.0

vrrp6 vrid 10 virtual-ip FE80::1 link-local

vrrp6 vrid 10 virtual-ip 2001:100:200:1::3

arp broadcast enable

interface GigabitEthernet0/0/0.20

dot1q termination vid 20

ipv6 enable

ipv6 address 2001:100:200:2::2/64

ospfv3 1 area 0.0.0.0

vrrp6 vrid 20 virtual-ip FE80::2 link-local

vrrp6 vrid 20 virtual-ip 2001:100:200:2::3

arp broadcast enable

interface GigabitEthernet0/0/0.30

dot1q termination vid 30

ipv6 enable

ipv6 address 2001:100:200:3::2/64

ospfv3 1 area 0.0.0.0

vrrp6 vrid 30 virtual-ip FE80::3 link-local

vrrp6 vrid 30 virtual-ip 2001:100:200:3::3

vrrp6 vrid 30 priority 120

arp broadcast enable

interface GigabitEthernet0/0/0.40

dot1q termination vid 40

ipv6 enable

ipv6 address 2001:100:200:4::2/64

ospfv3 1 area 0.0.0.0

vrrp6 vrid 40 virtual-ip FE80::4 link-local

vrrp6 vrid 40 virtual-ip 2001:100:200:4::3

vrrp6 vrid 40 priority 120

arp broadcast enable

interface GigabitEthernet0/0/1

interface GigabitEthernet0/0/1.50

dot1q termination vid 50

ipv6 enable

ipv6 address 2001:100:200:5::2/64

ospfv3 1 area 0.0.0.0

vrrp6 vrid 50 virtual-ip FE80::5 link-local

vrrp6 vrid 50 virtual-ip 2001:100:200:5::3

arp broadcast enable

interface GigabitEthernet0/0/1.60

dot1q termination vid 60

ipv6 enable

ipv6 address 2001:100:200:6::2/64

ospfv3 1 area 0.0.0.0

vrrp6 vrid 60 virtual-ip FE80::6 link-local

vrrp6 vrid 60 virtual-ip 2001:100:200:6::3

arp broadcast enable

配置D HCPv 6

关闭ra报文抑制

interface GigabitEthernet0/0/1

ipv6 enable

ipv6 address 2001:100:200:7::1/64

undo ipv6 nd ra halt

ipv6 nd autoconfig managed-address-flag

ipv6 nd autoconfig other-flag

dhcpv6 server server

配置自动配置 RA标志位 使用有状态dhcpv6 获取地址

配置地址池

dhcpv6 pool server

address prefix 2001:100:200:7::/64

excluded-address 2001:100:200:7::1

excluded-address 2001:100:200:7::3

OSPFv3 配置

interface GigabitEthernet0/0/2

ipv6 enable

ipv6 address 2001:100:200:ABC::1/126

ospfv3 1 area 0.0.0.0

ospfv3 1

router-id 1.1.1.1

其他配置均相同 创建ospfv3 进程 进入接口启用ospfv3 以及区域

防火墙配置

去往ISP路由

ipv6 route-static :: 0 2005::2

Ospfv3 引入默认

安全区域配置

firewall zone trust

set priority 85

add interface GigabitEthernet0/0/0

add interface GigabitEthernet1/0/0

add interface GigabitEthernet1/0/1

firewall zone untrust

set priority 5

add interface GigabitEthernet1/0/4

firewall zone dmz

set priority 50

add interface GigabitEthernet1/0/2

add interface GigabitEthernet1/0/3

配置安全策略

security-policy

rule name tr-un

source-zone trust

destination-zone untrust

action permit

rule name tr-dmz

source-zone trust

destination-zone dmz

action permit

防火墙OSPF宣告配置

interface GigabitEthernet1/0/1

undo shutdown

ipv6 enable

ipv6 address 2001:100:200:ABC::5/126

ospfv3 1 area 0.0.0.0

interface GigabitEthernet1/0/2

undo shutdown

ipv6 enable

ipv6 address 2001:100:200:ABC::A/126

ospfv3 1 area 0.0.0.0

interface GigabitEthernet1/0/3

undo shutdown

ipv6 enable

ipv6 address 2001:100:200:ABC::E/126

ospfv3 1 area 0.0.0.0

测试

私信获取

相关推荐
VVVVWeiYee9 分钟前
Mesh路由组网
运维·网络·智能路由器·信息与通信
IT枫斗者26 分钟前
如何解决Java EasyExcel 导出报内存溢出
java·服务器·开发语言·网络·分布式·物联网
北'辰34 分钟前
使用ENSP实现DHCP+动态路由
运维·网络
网络安全Jack34 分钟前
网络安全基础
网络·智能路由器
Hacker_LaoYi40 分钟前
网络安全之接入控制
网络·web安全·智能路由器
air_72942 分钟前
实验四:构建园区网(OSPF 动态路由)
服务器·网络·智能路由器
ladymorgana43 分钟前
【Nginx从入门到精通】05-安装部署-虚拟机不能上网简单排错
网络·nginx·智能路由器
很楠不爱1 小时前
Linux网络——传输层协议
linux·网络·udp
澜世1 小时前
2024小迪安全基础入门第二课
网络·笔记·安全
xxjkkjjkj1 小时前
udp_socket
linux·网络