策略路由设置问题。

]rule 2000 deny ip这里的ip填什么。

不用填，禁止所有其它的源IP通过

[H3C]display acl all Advanced ACL 3101, named -none-, 2 rules, ACL's step is 5 rule 5 permit ip source 10.0.0.0 0.255.255.255 rule 10 deny ip (1320 times matched)

好像也不行，40%丢包率。

(1320 times matched)这个是它自动生成的

policy-based-route pbr6 permit node 200这句我删除了，不然ping不通

policy-based-route pbr6 permit node 200 这条加没有呢

这条需要的，将不需要的策略过滤掉。

[H3C]display policy-based-route Policy based routing configuration information: policy-based-route : aaa Node 5 permit : if-match acl 3101 apply ip-address next-hop 192.168.1.1 apply output-interface GigabitEthernet0/1 policy-based-route : pbr6 Node 200 permit :

[H3C]display policy-based-route Policy based routing configuration information: policy-based-route : aaa Node 5 permit : if-match acl 3101 apply ip-address next-hop 192.168.1.1 apply output-interface GigabitEthernet0/1 policy-based-route : pbr6 Node 200 permit :

[H3C]display policy-based-route Policy based routing configuration information: policy-based-route : aaa Node 5 permit : if-match acl 3101 apply ip-address next-hop 192.168.1.1 apply output-interface GigabitEthernet0/1 policy-based-route : pbr6 Node 200 permit :

这样吗

disp cur 显示的命令发来，个不好年

你看我的路由表在下面的图。

disp cur 显示的命令发来，不好看display policy-based-route Policy based routing configuration information

[H3C]disp cur # version 5.20, Release 2516P28 # sysname H3C # clock timezone Beijing add 08:00:00 # password-control enable undo password-control aging enable undo password-control history enable password-control length 6 password-control login-attempt 3 exceed lock-time 10 password-control password update interval 0 password-control login idle-time 0 password-control complexity user-name check # ftp server enable # ip local policy-based-route aaa # domain default enable system # telnet server enable # dar p2p signature-file flash:/p2p_default.mtd # port-security enable # web idle-timeout 60 # password-recovery enable # acl number 3101 rule 5 permit ip source 10.0.0.0 0.255.255.255 rule 10 deny ip # vlan 1 # domain system access-limit disable state active idle-cut disable self-service-url disable # dhcp server ip-pool nas static-bind ip-address 192.168.123.111 mask 255.255.255.0 static-bind mac-address f44d-30a6-7e41 gateway-list 192.168.123.1 dns-list 114.114.114.114 114.114.115.115 # dhcp server ip-pool vlan1 extended network ip range 192.168.8.2 192.168.8.254 network mask 255.255.255.0 gateway-list 192.168.8.1 dns-list 114.114.114.114 8.8.8.8 # dhcp server ip-pool ywg static-bind ip-address 192.168.123.188 mask 255.255.255.0 static-bind mac-address 309c-239b-4b7b gateway-list 192.168.123.1 dns-list 114.114.114.114 114.114.115.115 # policy-based-route aaa permit node 5 if-match acl 3101 apply ip-address next-hop 192.168.1.1 apply output-interface GigabitEthernet0/1 # policy-based-route pbr6 permit node 200 # user-group system group-attribute allow-guest # local-user admin authorization-attribute level 3 service-type telnet terminal service-type ftp service-type web # cwmp undo cwmp enable # interface Aux0 async mode flow link-protocol ppp # interface Cellular0/0 async mode protocol link-protocol ppp # interface NULL0 # interface Vlan-interface1 ip address 192.168.8.1 255.255.255.0 dhcp server apply ip-pool vlan1 ip flow-ordering internal # interface GigabitEthernet0/0 port link-mode route nat outbound ip address dhcp-alloc ip flow-ordering external # interface GigabitEthernet0/1 port link-mode route nat outbound ip address dhcp-alloc ip flow-ordering external # interface GigabitEthernet0/2 port link-mode bridge # interface GigabitEthernet0/3 port link-mode bridge # interface GigabitEthernet0/4 port link-mode bridge # interface GigabitEthernet0/5 port link-mode bridge # interface GigabitEthernet0/6 port link-mode bridge # interface GigabitEthernet0/7 port link-mode bridge # interface GigabitEthernet0/8 port link-mode bridge # interface GigabitEthernet0/9 port link-mode bridge # dhcp enable # ntp-service unicast-server 203.107.6.88 # ssh server enable sftp server enable # nms primary monitor-interface GigabitEthernet0/0 # ip flow-ordering stat-interval 10 # load xml-configuration # load tr069-configuration # user-interface tty 12 user-interface aux 0 user-interface vty 0 4 authentication-mode scheme # return

不会换行，不好看

静态路由网络地址：10.0.0.0 子网掩码：255.0.0.0 下一跳192.168.1.1 这样设置ping10.2.10.96正常，ping baidu.com丢包。

tracert baidu.com 发现出口没有192.168.2.1的连接。

搞好了，用最笨的办证，再建一个0.0.0.0的静态路由，出口选GigabitEthernet0/0，优先级65。静态路由网络地址：10.0.0.0 子网掩码：255.0.0.0 下一跳192.168.1.1 优先级60.这样就正常了。谢谢您。

1 * * * 请求超时。 2 1 ms * 1 ms 192.168.2.1 3 * 1 ms * 10.57.144.254 4 8 ms * 7 ms 218.64.207.201 5 * * * 请求超时。 6 * 7 ms * 59.205.192.130 7 * * * 请求超时。 8 * * * 请求超时。 9 41 ms 15 ms * 192.168.2.30 10 15 ms * * 10.2.10.96 11 * * * 请求超时。 12 15 ms * * 10.2.10.96 13 14 ms * 15 ms 10.2.10.96

1 * * * 请求超时。 2 1 ms * 1 ms 192.168.2.1 3 * 1 ms * 10.57.144.254 4 8 ms * 7 ms 218.64.207.201 5 * * * 请求超时。 6 * 7 ms * 59.205.192.130 7 * * * 请求超时。 8 * * * 请求超时。 9 41 ms 15 ms * 192.168.2.30 10 15 ms * * 10.2.10.96 11 * * * 请求超时。 12 15 ms * * 10.2.10.96 13 14 ms * 15 ms 10.2.10.96

192.168.1.1是GigabitEthernet0/1的地址。

需要改成对端的地址

192.168.1.36

GigabitEthernet0/1的地址是动态的，网关是192.168.1.1.

apply ip-address next-hop 192.168.1.0

改成这样

不能改成192.168.1.0

摘自说明书： 若无特殊需求，建议用户不要对本地报文应用策略。否则，有可能会对本地报文的发送造成不必要的影响（如ping、telnet服务的失效）

ip local policy-based-route aaa 这句要改，改到内网口下：ip policy-based-route aaa