F1000防火墙如何做到公网与VRF互访

问题描述

组网拓扑：PC1、PC2、PC3分别连交换机的vlan,10、vlan11、vlan100；且电脑的网关都在此交换机上（即交换机vlan虚接口地址）；

vlan10虚接口绑定vpn实例vpn10，vlan11虚接口绑定vpn实例vpn11，vlan100虚接口绑定vpn实例vpn100

现要实现vlan100可以和vlan10互访，vlan100可以和vlan11互访，即跨vpn实例互访

 

 

解决方法

注意要保证各个电脑与交换机之间互联的网段不在同一个网段，否则该方法不能使用

1、vpn10、vpn11与vpn100之间RT值打通。

#

ip vpn-instance vpn10

route-distinguisher 100:1

vpn-target 100:1 300:1 import-extcommunity

vpn-target 100:1 export-extcommunity

#

ip vpn-instance vpn11

route-distinguisher 200:1

vpn-target 200:1 300:1 import-extcommunity

vpn-target 200:1 export-extcommunity

#

ip vpn-instance vpn100

route-distinguisher 300:1

vpn-target 300:1 100:1 200:1 import-extcommunity

vpn-target 300:1 export-extcommunity

 

2、配置vlan虚接口绑定vlan实例

interface Vlan-interface10

ip binding vpn-instance vpn10

ip address 10.1.1.1 255.255.255.252

#

interface Vlan-interface11

ip binding vpn-instance vpn11

ip address 10.1.1.5 255.255.255.252

#

interface Vlan-interface100

ip binding vpn-instance vpn100

ip address 10.1.1.253 255.255.255.252

 

 

3、vpn实例中直接引入另外一个vpn实例的直连路由。在vpn视图下添加如下命令：

 

ip vpn-instance vpn10

route-distinguisher 100:1

vpn-target 100:1 300:1 import-extcommunity

vpn-target 100:1 export-extcommunity

#

address-family ipv4

  route-replicate from vpn-instance vpn100 protocol direct

#

ip vpn-instance vpn11

route-distinguisher 200:1

vpn-target 200:1 300:1 import-extcommunity

vpn-target 200:1 export-extcommunity

#

address-family ipv4

  route-replicate from vpn-instance vpn100 protocol direct

#

ip vpn-instance vpn100

route-distinguisher 300:1

vpn-target 300:1 100:1 200:1 import-extcommunity

vpn-target 300:1 export-extcommunity

#

address-family ipv4

  route-replicate from vpn-instance vpn10 protocol direct

  route-replicate from vpn-instance vpn11 protocol direct

 

补充下：

公网路由表引入VPN实例路由，配置如下：

ip public-instance

 #

 address-family ipv4

  route-replicate from vpn-instance vpn100 protocol direct

 

VPN实例路由表引入公网路由，配置如下：

ip vpn-instance vpn100

 route-distinguisher 1:1

 #

 address-family ipv4

  route-replicate from public protocol direct