AR系列路由器DVPN穿越NAT典型配置

AR系列路由器DVPN穿越NAT典型配置

【需求】

通过配置DVPN，client1、client2可以和server互通，client1和client2之间可以直接互通。

其中Client1和Client2都配置NAT.

【组网图】

 

【配置脚本】

Server配置脚本

# sysname Server # dvpn policy 1                                  /创建dvpn-policy视图1/ # interface Aux0 async mode flow # interface Ethernet0/0 ip address dhcp-alloc # interface Ethernet0/1 ip address 202.1.1.1 255.255.255.0 # interface Serial0/0 clock DTECLK1 link-protocol ppp ip address ppp-negotiate # interface Tunnel0                             /创建Tunnel0接口/ ip address 10.0.0.1 255.255.255.0 tunnel-protocol udp dvpn source Ethernet0/1 dvpn interface-type server dvpn dvpn-id 1 dvpn policy 1 # interface NULL0 # interface LoopBack0 ip address 172.16.1.1 255.255.255.0 # FTP server enable # dvpn service enable                          /使能DVPN功能/ dvpn server pre-shared-key 12345             /配置Server的身份pre-shared-key/ # ip route-static 172.16.2.0 255.255.255.0 10.0.0.2 preference 60  /配置路由信息/ ip route-static 172.16.3.0 255.255.255.0 10.0.0.3 preference 60 # user-interface con 0 user-interface aux 0 user-interface vty 0 4 authentication-mode scheme # return

Client1配置脚本

# sysname Clinet111 # cpu-usage cycle 1min # dvpn class test                               /配置Tunnel接口使用的dvpn-class/ public-ip 202.1.1.1 authentication-server method pre-share pre-shared-key 12345 # acl number 3000 rule 0 permit ip # interface Aux0 async mode flow # interface Ethernet0/0/0                       /在接口上使能NAT/ ip address 202.1.1.2 255.255.255.0 nat outbound 3000 # interface Ethernet0/0/1 ip address 100.0.0.1 255.255.255.0 # interface Tunnel0                             /创建Tunnel0接口/ ip address 10.0.0.2 255.255.255.0 tunnel-protocol udp dvpn source Ethernet0/0/0 dvpn interface-type client dvpn dvpn-id 1 dvpn server test # interface NULL0 # interface LoopBack0 ip address 172.16.2.1 255.255.255.0 # FTP server enable # dvpn service enable # ip route-static 0.0.0.0 0.0.0.0 Ethernet 0/0/0 preference 60        /配置路由信息/ ip route-static 172.16.1.0 255.255.255.0 10.0.0.1 preference 60 ip route-static 172.16.3.0 255.255.255.0 10.0.0.3 preference 60 # user-interface con 0 user-interface aux 0 user-interface vty 0 4 authentication-mode scheme # return

Client2配置脚本

# sysname Client2222 # cpu-usage cycle 1min # dvpn class test                            /配置Tunnel接口使用的dvpn-class/ public-ip 202.1.1.1 authentication-server method pre-share pre-shared-key 12345 # acl number 3000 rule 0 permit ip # interface Aux0 async mode flow # interface Ethernet1/0                  ip address 202.1.1.3 255.255.255.0 nat outbound 3000                         /在接口上使能NAT/ # interface Ethernet1/1 ip address dhcp-alloc # interface Serial2/0 clock DTECLK1 link-protocol ppp ip address dhcp-alloc # interface Serial2/1 clock DTECLK1 link-protocol ppp ip address dhcp-alloc # interface Tunnel0                       /创建Tunnel0接口/ ip address 10.0.0.3 255.255.255.0 tunnel-protocol udp dvpn source Ethernet1/0 dvpn interface-type client dvpn dvpn-id 1 dvpn server test # interface NULL0 # interface LoopBack0 ip address 172.16.3.1 255.255.255.0 # FTP server enable # dvpn service enable # ip route-static 0.0.0.0 0.0.0.0 Ethernet 1/0 preference 60            /配置路由信息/ ip route-static 172.16.1.0 255.255.255.0 10.0.0.1 preference 60 ip route-static 172.16.2.0 255.255.255.0 10.0.0.2 preference 60 # user-interface con 0 user-interface aux 0 user-interface vty 0 4 authentication-mode scheme # return

 

【验证】

Server、 Clinent1和Clinent2可以两两互通。且Client1和Client2之间可以直接建立Session.

Server上的和session信息：

[Server]dis dvpn sess all

vpn-id       private-ip        public-ip    port     state  type

-----------------------------------------------------------------

1         10.0.0.2        202.1.1.2   40959   SUCCESS  S->C

1         10.0.0.3        202.1.1.3   40959   SUCCESS  S->C

Client1上和session信息：

<Clinet111>dis dvpn session all

vpn-id       private-ip        public-ip    port     state  type

-----------------------------------------------------------------

1         10.0.0.1        202.1.1.1   40959   SUCCESS  C->S

1         10.0.0.3        202.1.1.3   40959   SUCCESS  C->C

Client2上和session信息：

[Client2222]dis dvpn session all

vpn-id       private-ip        public-ip    port     state  type

-----------------------------------------------------------------

1         10.0.0.1        202.1.1.1   40959   SUCCESS  C->S

1         10.0.0.2        202.1.1.2   40959   SUCCESS  C->C