超详细华为防火墙旁挂案例（使用ospf对接，dhcp获取地址）

1.实验拓扑

2.基本配置

a.接入配置（创建VPN实例，获取地址等）

SW1：

#
vlan batch 10 20 30 40
#
ip vpn-instance a
ipv4-family
route-distinguisher 1:1
#
ip vpn-instance b
ipv4-family
route-distinguisher 1:2
#
interface Vlanif10
ip binding vpn-instance a
ip address 192.168.1.254 255.255.255.0
dhcp select relay
dhcp relay server-ip 10.1.1.2
#
interface Vlanif20
ip binding vpn-instance b
ip address 192.168.2.254 255.255.255.0
dhcp select relay
dhcp relay server-ip 10.1.2.2
#
interface Vlanif30
ip binding vpn-instance a
ip address 10.1.1.1 255.255.255.0
#
interface Vlanif40
ip binding vpn-instance b
ip address 10.1.2.1 255.255.255.0
#
interface GigabitEthernet0/0/1
port link-type access
port default vlan 10
#
interface GigabitEthernet0/0/2
port link-type access
port default vlan 20
#
interface GigabitEthernet0/0/3
port link-type trunk
port trunk allow-pass vlan 10 20 30 40
#

AR1：

#
ip vpn-instance a
ipv4-family
route-distinguisher 1:1
#
ip vpn-instance b
ipv4-family
route-distinguisher 1:2
#
ip pool a
vpn-instance a
gateway-list 192.168.1.254
network 192.168.1.0 mask 255.255.255.0
#
ip pool b
vpn-instance b
gateway-list 192.168.2.254
network 192.168.2.0 mask 255.255.255.0
#
interface GigabitEthernet0/0/0.10
dot1q termination vid 30
ip binding vpn-instance a
ip address 10.1.1.2 255.255.255.0
arp broadcast enable
dhcp select global
#
interface GigabitEthernet0/0/0.20
dot1q termination vid 40
ip binding vpn-instance b
ip address 10.1.2.2 255.255.255.0
arp broadcast enable
dhcp select global
#

AR2：

#
interface GigabitEthernet0/0/0
ip address 10.1.12.2 255.255.255.0
#

b.ospf和防火墙对接和出口对接

AR1：

#
interface GigabitEthernet0/0/1.1
dot1q termination vid 100
ip binding vpn-instance a
ip address 64.1.1.1 255.255.255.0
arp broadcast enable
#
interface GigabitEthernet0/0/1.2
dot1q termination vid 101
ip binding vpn-instance b
ip address 64.1.2.1 255.255.255.0
arp broadcast enable
#
interface GigabitEthernet0/0/2
#
interface GigabitEthernet0/0/2.1
dot1q termination vid 102
ip address 64.1.3.1 255.255.255.0
arp broadcast enable
#
interface GigabitEthernet0/0/2.2
dot1q termination vid 103
ip address 64.1.4.1 255.255.255.0
arp broadcast enable
#
#
ospf 1
area 0.0.0.0
network 10.1.12.0 0.0.0.255
network 64.1.3.0 0.0.0.255
network 64.1.4.0 0.0.0.255
#
ospf 2 vpn-instance a
vpn-instance-capability simple
area 0.0.0.2
network 10.1.1.0 0.0.0.255
network 64.1.1.0 0.0.0.255
#
ospf 3 vpn-instance b
vpn-instance-capability simple
area 0.0.0.3
network 10.1.2.0 0.0.0.255
network 64.1.2.0 0.0.0.255
#

FW1：
#
vsys name a 1
assign interface GigabitEthernet1/0/0.1
assign interface GigabitEthernet1/0/1.1
#
vsys name b 2
assign interface GigabitEthernet1/0/0.2
assign interface GigabitEthernet1/0/1.2
#
ip vpn-instance a
ipv4-family
ipv6-family
#
ip vpn-instance b
ipv4-family
ipv6-family

#
interface GigabitEthernet1/0/0.1
vlan-type dot1q 100
ip binding vpn-instance a
ip address 64.1.1.2 255.255.255.0
alias GE1/0/0.1
#
interface GigabitEthernet1/0/0.2
vlan-type dot1q 101
ip binding vpn-instance b
ip address 64.1.2.2 255.255.255.0
alias GE1/0/0.2
#
interface GigabitEthernet1/0/1
undo shutdown
#
interface GigabitEthernet1/0/1.1
vlan-type dot1q 102
ip binding vpn-instance a
ip address 64.1.3.2 255.255.255.0
alias GE1/0/1.1
#
interface GigabitEthernet1/0/1.2
vlan-type dot1q 103
ip binding vpn-instance b
ip address 64.1.4.2 255.255.255.0
alias GE1/0/1.2
#

interface Virtual-if0
ip address 172.16.1.1 255.255.255.0
#
interface Virtual-if1
ip address 172.16.1.2 255.255.255.0
#
interface Virtual-if2
ip address 172.16.1.3 255.255.255.0
#
ospf 2 vpn-instance a
vpn-instance-capability simple
area 0.0.0.0
network 64.1.3.0 0.0.0.255
area 0.0.0.2
network 64.1.1.0 0.0.0.255
#
ospf 3 vpn-instance b
vpn-instance-capability simple
area 0.0.0.0
network 64.1.4.0 0.0.0.255
area 0.0.0.3
network 64.1.2.0 0.0.0.255
#

AR2：

#
ospf 1
default-route-advertise always
area 0.0.0.0
network 10.1.12.0 0.0.0.255
#

3.结果验证

a.ospf邻居是否建立

b.是否能ping通外网

4.总结

a.使用vpn-instance隔离内网两个网段，使用dhcp（vpn-instance）来获取地址

b.使用ospf来让路由器AR1和防火墙进行对接，最后让路由器的area 0（public区域）和防火墙的area 0（vpn a和vpn b）进行邻居建立，让路由从vpn-instance实例表到路由器的public表，这样vpn a和vpn b也可以互访了，而且是需要经过防火墙的，这样可以对业务进行管控

c.此案例在园区网很常见，大家可以好好学习