AR28/AR46系列路由器DVPN和GRE配合使用的典型配置

AR28/AR46系列路由器DVPN和GRE配合使用的典型配置

【需求】

如下图所示，总部需要与分支A通过DVPN构建虚拟私有网络，与分支B通过GRE构建虚拟私有网络，这样总部与分支A及分支B共同构建一个大的VPN网络。在该网络中需要实现：

?  Server与Client1、Client2可以互通。

?  Server与Client1之间通过pre-share-key进行身份验证。

?  Client1与Client2通过Server进行互通。

【组网图】

【配置脚本】

Server的配置脚本

# 使能DVPN功能 <Server> system-view [Server] dvpn service  enable # 配置Ethernet0/0/0接口。 [Server] interface Ethernet0/0/0 [Server-Ethernet0/0/0] ip address 201.1.1.1 255.255.255.0 [Server-Ethernet0/0/0] quit # 配置Ethernet0/0/1接口。 [Server] interface Ethernet0/0/1 [Server-Ethernet0/0/1] ip address 10.0.1.1 255.255.255.0 [Server-Ethernet0/0/1] quit # 配置Server的身份pre-shared-key。 [Server] dvpn server pre-shared-key 123456 # 配置DVPN policy。 [Server] dvpn policy testpolicy [Server-dvpn-Policy-testpolicy] authentication-client method chap domain dvpn [Server-dvpn-Policy-testpolicy] data algorithm-suite 7 [Server-dvpn-Policy-testpolicy] session algorithm-suite 12 [Server-dvpn-Policy-testpolicy] quit # 配置DVPN的验证域使用本地验证。 [Server] domain dvpn [Server-isp-domain] scheme local [Server-isp-domain] state active [Server-isp-domain] quit # 配置DVPN本地用户。 [Server] local-user dvpnuser [Server-luser-dvpnuser] password simple dvpnuser [Server-luser-dvpnuser] service-type dvpn [Server-luser-dvpnuser] quit # 配置DVPN使用的Tunnel0接口。 [Server] interface tunnel 0 [Server-Tunnel0] tunnel-protocol udp dvpn [Server-Tunnel0] dvpn interface-type server [Server-Tunnel0] ip address 10.0.0.1 255.255.255.0 [Server-Tunnel0] source Ethernet0/0/0 [Server-Tunnel0] dvpn dvpn-id 1 [Server-Tunnel0] dvpn policy testpolicy [Server-Tunnel0] quit # 配置GRE使用的Tunnel1接口。 [Server] interface tunnel 1 [Server-Tunnel1] ip address 10.1.0.1 255.255.255.0 [Server-Tunnel1] destination 211.1.1.3 [Server-Tunnel1] source Ethernet0/0/0 [Server-Tunnel1] quit # 配置路由信息。 [Server] ip route-static 10.1.2.0  255.255.255.0  10.1.0.2 [Server] ip route-static 10.0.2.0  255.255.255.0  10.0.0.2

Client1的配置脚本

# 使能DVPN功能 <Client1> system-view [Client1] dvpn service  enable # 配置Ethernet0/0/0接口通过DHCP获取地址。 [Client1] interface Ethernet0/0/0 [Client1-Ethernet0/0/0] ip address dhcp-alloc [Client1-Ethernet0/0/0] quit # 配置Ethernet0/0/1接口。 [Client1] interface Ethernet0/0/1 [Client1-Ethernet0/0/1] ip address 10.0.2.1 255.255.255.0 [Client1-Ethernet0/0/1] quit # 配置dvpn-class。 [Client2] dvpn class testserver [Client1-dvpn-class-testserver] public-ip 201.1.1.1 [Client1-dvpn-class-testserver] authentication-server method pre-share [Client1-dvpn-class-testserver] pre-shared-key 123456 [Client1-dvpn-class-testserver] local-user dvpnuser password simple dvpnuser [Client1-dvpn-class-testserver] quit # 配置Tunnel0接口属性。 [Client1] interface tunnel 0 [Client1-Tunnel0] ip address 10.0.0.2 255.255.255.0 [Client1-Tunnel0] tunnel-protocol udp dvpn [Client1-Tunnel0] source Ethernet0/0/0 [Client1-Tunnel0] dvpn interface-type client [Client1-Tunnel0] dvpn server testserver [Client1-Tunnel0] dvpn vpn-id 1 [Client1-Tunnel0] quit # 配置静态路由。 [Client1] ip route-static 10.0.1.0  255.255.255.0  10.0.0.1 [Client1] ip route-static 10.1.2.0  255.255.255.0  10.0.0.1

Client2的配置脚本

# 使能DVPN功能 <Client2> system-view [Client2] dvpn service  enable # 配置Ethernet0/0/0接口。 [Client2] interface Ethernet0/0/0 [Client2-Ethernet0/0/0] ip address 201.1.1.3 255.255.255.0 [Client2-Ethernet0/0/0] quit # 配置Ethernet0/0/1接口。 [Client2] interface Ethernet0/0/1 [Client2-Ethernet0/0/1] ip address 10.1.2.1 255.255.255.0 [Client2-Ethernet0/0/1] quit # 配置Tunnel0接口属性。 [Client2] interface tunnel 0 [Client2-Tunnel0] ip address 10.1.0.2 255.255.255.0 [Client2-Tunnel0] tunnel-protocol gre [Client2-Tunnel0] source Ethernet0/0/0 [Client2-Tunnel0] quit # 配置静态路由。 [Client2] ip route-static 10.0.1.0  255.255.255.0  10.1.0.1 [Client2] ip route-static 10.0.2.0  255.255.255.0  10.1.0.1

【提示】

在本组网案例中，由于Client1与Server建立的是DVPN连接，而Client2与Server建立的是GRE连接，所以在Client1和Client2之间不会自动生成会话连接，Client1与Client而的数据通讯需要通过Server转发。因此在Client1和Client2端配置的路由其下一跳都是Server的Tunnel0口地址。