• 全部
  • 经验案例
  • 典型配置
  • 技术公告
  • FAQ
案例类型
搜索
取消
产品线
关键字
发布者
发布时间

F5000-S F5020-S

C
2017-12-01提问
  • 0关注
  • 0收藏,667浏览
0

问题描述:

原有一台F5000,正常使用,现在加入一台F5020,因为网络环境的原因,坐冷备。测试时发现在F5020上并未学到ospf邻居,觉得是域间策略的问题。大神们帮忙看看域间策略哪里出了问题,指点指点。

最佳答案

0

OSPF报文需要上送CPU,F5020需要放通到local和local到对应区域的策略


如果来回路径不一致,需要开启session state-machine mode loose

1 个回答
0

接口加入安全域,并放通域间策略,具体的需要看配置

我有将相应的配置发出来的

C 发表时间:2017-12-01

这是5000上的vpn,ospf,以及相应的域间策略 # ip vpn-instance yibao description ***Ò½±£*** route-distinguisher 1000:1 vpn-target 1000:1 export-extcommunity vpn-target 1000:1 import-extcommunity # ip vpn-instance guahao description ***µçÐÅÔ¤Ô¼¹ÒºÅ*** route-distinguisher 2000:2 vpn-target 2000:2 export-extcommunity vpn-target 2000:2 import-extcommunity # ip vpn-instance weishengju description ***ÎÀÉú¾Ö*** route-distinguisher 3000:3 vpn-target 3000:3 export-extcommunity vpn-target 3000:3 import-extcommunity # ip vpn-instance nonghang description ***Å©ÒµÒøÐÐ*** route-distinguisher 4000:4 vpn-target 4000:4 export-extcommunity vpn-target 4000:4 import-extcommunity # ip vpn-instance internal description ***ÄÚÍø*** route-distinguisher 10000:1 vpn-target 10000:1 export-extcommunity vpn-target 10000:1 import-extcommunity # ip vpn-instance caizheng description "caizheng" route-distinguisher 5000:5 vpn-target 5000:5 export-extcommunity vpn-target 5000:5 import-extcommunity # ospf 1 router-id 192.160.3.238 vpn-instance yibao area 0.0.0.0 network 192.160.3.224 0.0.0.15 network 192.159.13.0 0.0.0.255 network 192.69.2.0 0.0.0.255 # ospf 2 router-id 172.16.50.2 vpn-instance nonghang vpn-instance-capability simple area 0.0.0.0 network 172.16.50.0 0.0.0.3 network 192.168.20.0 0.0.0.3 # ospf 3 router-id 172.16.8.2 vpn-instance internal area 0.0.0.0 network 192.168.99.0 0.0.0.255 network 172.16.8.0 0.0.0.3 # vd Root id 1 vd yibao id 2 allocate interface Vlan-interface250 allocate interface Vlan-interface251 allocate interface Vlan-interface252 allocate vlan 250 to 252 vd guahao id 3 allocate interface Vlan-interface253 allocate interface Vlan-interface255 allocate vlan 253 255 vd weishengju id 4 allocate interface Vlan-interface256 allocate interface Vlan-interface629 allocate vlan 256 629 vd nonghang id 5 allocate interface Vlan-interface150 allocate interface Vlan-interface257 allocate vlan 150 257 vd internal id 6 allocate interface Vlan-interface11 allocate interface Virtual-Template0 allocate interface Virtual-Template1 allocate vlan 11 vd caizheng id 7 allocate interface Vlan-interface258 allocate interface Vlan-interface259 allocate vlan 258 to 259 # zone name Management id 0 priority 100 import interface GigabitEthernet0/0 zone name Local id 1 priority 100 zone name Trust id 2 priority 85 import interface GigabitEthernet0/4 vlan 1 to 10 13 to 149 151 to 187 189 to 249 254 260 to 628 630 to 4094 import interface Vlan-interface10 import interface Vlan-interface100 zone name DMZ id 3 priority 50 zone name Untrust id 4 priority 5 import interface GigabitEthernet0/1 import interface GigabitEthernet0/3 import interface Vlan-interface9 import interface Vlan-interface188 import interface Vlan-interface189 import interface Vlan-interface261 switchto vd yibao zone name yibaotrust id 1 priority 85 import interface Vlan-interface250 zone name yibaountrust id 2 priority 5 import interface Vlan-interface251 import interface Vlan-interface252 switchto vd guahao zone name guahaotrust id 1 priority 85 import interface Vlan-interface255 zone name guahaountrust id 2 priority 5 import interface Vlan-interface253 switchto vd weishengju zone name weishengjutrust id 1 priority 85 import interface Vlan-interface256 zone name weishengjuuntrust id 2 priority 5 import interface Vlan-interface629 switchto vd nonghang zone name nonghangtrust id 1 priority 85 import interface Vlan-interface150 zone name nonghanguntrust id 2 priority 5 import interface GigabitEthernet0/10 vlan 150 257 import interface Vlan-interface257 switchto vd internal zone name internaltrust id 1 priority 85 import interface Vlan-interface11 import interface Virtual-Template0 zone name internaluntrust id 2 priority 5 switchto vd caizheng zone name trust id 1 priority 85 import interface Vlan-interface259 zone name untrust id 2 priority 5 import interface Vlan-interface258 switchto vd Root object network subnet 122.244.55.154/0.0.0.7 subnet 122.244.55.154 0.0.0.7 object network subnet 172.17.70.2/0.0.0.0 subnet 172.17.70.2 0.0.0.0 object network subnet 192.168.0.0/0.0.0.255 subnet 192.168.0.0 0.0.0.255 object network subnet 192.168.1.222/0.0.0.0 subnet 192.168.1.222 0.0.0.0 object network subnet 192.168.2.9/0.0.0.0 subnet 192.168.2.9 0.0.0.0 zone name Management id 0 ip virtual-reassembly zone name Local id 1 ip virtual-reassembly zone name Trust id 2 ip virtual-reassembly zone name DMZ id 3 ip virtual-reassembly zone name Untrust id 4 ip virtual-reassembly interzone source Trust destination Untrust session log enable acl 3001 interzone source Untrust destination Trust rule 0 permit source-ip any_address destination-ip any_address service any_service rule enable switchto vd yibao zone name yibaotrust id 1 ip virtual-reassembly zone name yibaountrust id 2 ip virtual-reassembly switchto vd guahao zone name guahaotrust id 1 ip virtual-reassembly zone name guahaountrust id 2 ip virtual-reassembly switchto vd weishengju zone name weishengjutrust id 1 ip virtual-reassembly zone name weishengjuuntrust id 2 ip virtual-reassembly switchto vd nonghang zone name nonghangtrust id 1 ip virtual-reassembly zone name nonghanguntrust id 2 ip virtual-reassembly interzone source nonghanguntrust destination nonghangtrust switchto vd internal zone name internaltrust id 1 ip virtual-reassembly zone name internaluntrust id 2 ip virtual-reassembly switchto vd caizheng zone name trust id 1 ip virtual-reassembly zone name untrust id 2 ip virtual-reassembly #

C 发表时间:2017-12-01

编辑答案

你正在编辑答案

如果你要对问题或其他回答进行点评或询问,请使用评论功能。

分享扩散:

提出建议

    +

亲~登录后才可以操作哦!

确定

你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作

举报

×

侵犯我的权益 >
对根叔社区有害的内容 >
辱骂、歧视、挑衅等(不友善)

侵犯我的权益

×

泄露了我的隐私 >
侵犯了我企业的权益 >
抄袭了我的内容 >
诽谤我 >
辱骂、歧视、挑衅等(不友善)
骚扰我

泄露了我的隐私

×

您好,当您发现根叔知了上有泄漏您隐私的内容时,您可以向根叔知了进行举报。 请您把以下内容通过邮件发送到zhiliao@h3c.com 邮箱,我们会尽快处理。
  • 1. 您认为哪些内容泄露了您的隐私?(请在邮件中列出您举报的内容、链接地址,并给出简短的说明)
  • 2. 您是谁?(身份证明材料,可以是身份证或护照等证件)

侵犯了我企业的权益

×

您好,当您发现根叔知了上有关于您企业的造谣与诽谤、商业侵权等内容时,您可以向根叔知了进行举报。 请您把以下内容通过邮件发送到 zhiliao@h3c.com 邮箱,我们会在审核后尽快给您答复。
  • 1. 您举报的内容是什么?(请在邮件中列出您举报的内容和链接地址)
  • 2. 您是谁?(身份证明材料,可以是身份证或护照等证件)
  • 3. 是哪家企业?(营业执照,单位登记证明等证件)
  • 4. 您与该企业的关系是?(您是企业法人或被授权人,需提供企业委托授权书)
我们认为知名企业应该坦然接受公众讨论,对于答案中不准确的部分,我们欢迎您以正式或非正式身份在根叔知了上进行澄清。

抄袭了我的内容

×

原文链接或出处

诽谤我

×

您好,当您发现根叔知了上有诽谤您的内容时,您可以向根叔知了进行举报。 请您把以下内容通过邮件发送到zhiliao@h3c.com 邮箱,我们会尽快处理。
  • 1. 您举报的内容以及侵犯了您什么权益?(请在邮件中列出您举报的内容、链接地址,并给出简短的说明)
  • 2. 您是谁?(身份证明材料,可以是身份证或护照等证件)
我们认为知名企业应该坦然接受公众讨论,对于答案中不准确的部分,我们欢迎您以正式或非正式身份在根叔知了上进行澄清。

对根叔社区有害的内容

×

垃圾广告信息
色情、暴力、血腥等违反法律法规的内容
政治敏感
不规范转载 >
辱骂、歧视、挑衅等(不友善)
骚扰我
诱导投票

不规范转载

×

举报说明