企业IPv6网关负载分担方案的设计与实现

背景需求

（1）随���企业业务数量大幅增加，以及网络应用的高速发展，现有IPv4地址已不能满足需求，根据通信架构合理规划IPv6网络，对企业网络进行构建及扩充。

（2）企业业务量上升网络主机对外部访问量增加，单一网关设计的网络不再满足高可用性的要求，需要根据企业网络需求，设计多个网关的主/备运行，在当前运行网关设备故障或维护时，依然可以保证业务流量的畅通。

（3）依照企业网络规划，需要基于IPv6设计的路由协议及地址可兼容与企业网关备份策略及技术，合理配置网管设备，使其可用于IPv6网络网关备份。

（4）接入层划分vlan实现二层隔离。

（5）使用vrrp6技术实现网关冗余备份

（6）使用ospfv3技术实现内网互联互通

（7）使用dhcpv6技术实现终端自动获取ip地址

（8）使用防火墙配置安全策略保护内网安全

将该公司申请的/48进一步划分为/46， 分配给各部门

接入单位	地址	所属vlan
行政部	2001:100:200:1::/64	10
IT部	2001:100:200:2::/64	20
商务部	2001:100:200:3::/64	30
办公有线	2001:100:200:4::/64	40
车间	2001:100:200:5::/64	50
测试	2001:100:200:6::/64	60
服务器	2001:100:200:7::/64	N/A

设备互联地址

名称	地址
FW---核心1	2001:100:200:abc::/126
FW---核心2	2001:100:200:abc::4/126
FW---服务器核心1	2001:100:200:abc::8/126
FW---服务器核心2	2001:100:200:abc::C/126
出口地址	2005::/64

拓扑

配置过程

Vlan创建

vlan batch 10 20 30 40

vlan batch 50 60

其他交换机配置相同

交换机接口划分

办公楼接入交换机

interface GigabitEthernet0/0/1

 port link-type access

 port default vlan 10

#

interface GigabitEthernet0/0/2

 port link-type access

 port default vlan 10

#

interface GigabitEthernet0/0/3

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

#

interface GigabitEthernet0/0/4

 port link-type access

 port default vlan 10

#

车间接入交换机

interface GigabitEthernet0/0/1

 port link-type access

 port default vlan 50

#

interface GigabitEthernet0/0/2

 port link-type access

 port default vlan 50

#

interface GigabitEthernet0/0/3

 port link-type trunk

 port trunk allow-pass vlan 2 to 4094

#接入交换机

其他配置均相同 加入相应vlan即可

汇聚交换机配置

interface GigabitEthernet0/0/1

 port link-type trunk

 port trunk allow-pass vlan 10 20 30 40

#

interface GigabitEthernet0/0/2

 port link-type trunk

 port trunk allow-pass vlan 10 20 30 40

#

interface GigabitEthernet0/0/3

 port link-type trunk

 port trunk allow-pass vlan 10 20 30 40

#

interface GigabitEthernet0/0/4

 port link-type trunk

 port trunk allow-pass vlan 10 20 30 40

#

interface GigabitEthernet0/0/5

 port link-type trunk

 port trunk allow-pass vlan 10 20 30 40

#

interface GigabitEthernet0/0/6

 port link-type trunk

 port trunk allow-pass vlan 10 20 30 40

#

生产车间汇聚交换机

interface GigabitEthernet0/0/1

 port link-type trunk

 port trunk allow-pass vlan 50 60

#

interface GigabitEthernet0/0/2

 port link-type trunk

 port trunk allow-pass vlan 50 60

#

interface GigabitEthernet0/0/3

 port link-type trunk

 port trunk allow-pass vlan 50 60

#

interface GigabitEthernet0/0/4

 port link-type trunk

 port trunk allow-pass vlan 50 60

#

核心配置业务接口

开启ipv6

其他设备均要开启ipv6功能

配置接口ipv6地址，配置vrrp网关

interface GigabitEthernet0/0/0.10

 dot1q termination vid 10

 ipv6 enable

 ipv6 address 2001:100:200:1::1/64

 undo ipv6 nd ra halt

 ospfv3 1 area 0.0.0.0

 vrrp6 vrid 10 virtual-ip FE80::1 link-local

 vrrp6 vrid 10 virtual-ip 2001:100:200:1::3

 vrrp6 vrid 10 priority 120

 arp broadcast enable

#

interface GigabitEthernet0/0/0.20

 dot1q termination vid 20

 ipv6 enable

 ipv6 address 2001:100:200:2::1/64

 undo ipv6 nd ra halt

 ospfv3 1 area 0.0.0.0

 vrrp6 vrid 20 virtual-ip FE80::2 link-local

 vrrp6 vrid 20 virtual-ip 2001:100:200:2::3

 vrrp6 vrid 20 priority 120

 arp broadcast enable

 dhcpv6 server vlan20

#

interface GigabitEthernet0/0/0.30

 dot1q termination vid 30

 ipv6 enable

 ipv6 address 2001:100:200:3::1/64

 ospfv3 1 area 0.0.0.0

 vrrp6 vrid 30 virtual-ip FE80::3 link-local

 vrrp6 vrid 30 virtual-ip 2001:100:200:3::3

 arp broadcast enable

#

interface GigabitEthernet0/0/0.40

 dot1q termination vid 40

 ipv6 enable

 ipv6 address 2001:100:200:4::1/64

 ospfv3 1 area 0.0.0.0

 vrrp6 vrid 40 virtual-ip FE80::4 link-local

 vrrp6 vrid 40 virtual-ip 2001:100:200:4::3

 arp broadcast enable

#

备份配置

interface GigabitEthernet0/0/0.10

 dot1q termination vid 10

 ipv6 enable

 ipv6 address 2001:100:200:1::2/64

 ospfv3 1 area 0.0.0.0

 vrrp6 vrid 10 virtual-ip FE80::1 link-local

 vrrp6 vrid 10 virtual-ip 2001:100:200:1::3

 arp broadcast enable

#

interface GigabitEthernet0/0/0.20

 dot1q termination vid 20

 ipv6 enable

 ipv6 address 2001:100:200:2::2/64

 ospfv3 1 area 0.0.0.0

 vrrp6 vrid 20 virtual-ip FE80::2 link-local

 vrrp6 vrid 20 virtual-ip 2001:100:200:2::3

 arp broadcast enable

#

interface GigabitEthernet0/0/0.30

 dot1q termination vid 30

  Please check whether system data has been changed, and save data in time

  Configuration console time out, please press any key to log on

dis cu int

[V200R003C00]

#

interface GigabitEthernet0/0/0

#

interface GigabitEthernet0/0/0.10

 dot1q termination vid 10

 ipv6 enable

 ipv6 address 2001:100:200:1::2/64

 ospfv3 1 area 0.0.0.0

 vrrp6 vrid 10 virtual-ip FE80::1 link-local

 vrrp6 vrid 10 virtual-ip 2001:100:200:1::3

 arp broadcast enable

#

interface GigabitEthernet0/0/0.20

 dot1q termination vid 20

 ipv6 enable

 ipv6 address 2001:100:200:2::2/64

 ospfv3 1 area 0.0.0.0

 vrrp6 vrid 20 virtual-ip FE80::2 link-local

 vrrp6 vrid 20 virtual-ip 2001:100:200:2::3

 arp broadcast enable

#

interface GigabitEthernet0/0/0.30

 dot1q termination vid 30

 ipv6 enable

 ipv6 address 2001:100:200:3::2/64

 ospfv3 1 area 0.0.0.0

 vrrp6 vrid 30 virtual-ip FE80::3 link-local

 vrrp6 vrid 30 virtual-ip 2001:100:200:3::3

 vrrp6 vrid 30 priority 120

 arp broadcast enable

#

interface GigabitEthernet0/0/0.40

 dot1q termination vid 40

 ipv6 enable

 ipv6 address 2001:100:200:4::2/64

 ospfv3 1 area 0.0.0.0

 vrrp6 vrid 40 virtual-ip FE80::4 link-local

 vrrp6 vrid 40 virtual-ip 2001:100:200:4::3

 vrrp6 vrid 40 priority 120

 arp broadcast enable

#

interface GigabitEthernet0/0/1

#

interface GigabitEthernet0/0/1.50

 dot1q termination vid 50

 ipv6 enable

 ipv6 address 2001:100:200:5::2/64

 ospfv3 1 area 0.0.0.0

 vrrp6 vrid 50 virtual-ip FE80::5 link-local

 vrrp6 vrid 50 virtual-ip 2001:100:200:5::3

 arp broadcast enable

#

interface GigabitEthernet0/0/1.60

 dot1q termination vid 60

 ipv6 enable

 ipv6 address 2001:100:200:6::2/64

 ospfv3 1 area 0.0.0.0

 vrrp6 vrid 60 virtual-ip FE80::6 link-local

 vrrp6 vrid 60 virtual-ip 2001:100:200:6::3

 arp broadcast enable

#

配置DHCPv6

关闭ra报文抑制

interface GigabitEthernet0/0/1

 ipv6 enable

 ipv6 address 2001:100:200:7::1/64

 undo ipv6 nd ra halt

 ipv6 nd autoconfig managed-address-flag

 ipv6 nd autoconfig other-flag

dhcpv6 server server

配置自动配置 RA标志位 使用有状态dhcpv6 获取地址

配置地址池

dhcpv6 pool server

 address prefix 2001:100:200:7::/64

 excluded-address 2001:100:200:7::1

 excluded-address 2001:100:200:7::3

#

OSPFv3 配置

interface GigabitEthernet0/0/2

 ipv6 enable

 ipv6 address 2001:100:200:ABC::1/126

 ospfv3 1 area 0.0.0.0

#

ospfv3 1

 router-id 1.1.1.1

#

其他配置均相同  创建ospfv3  进程  进入接口启用ospfv3 以及区域

防火墙配置

去往ISP路由

ipv6 route-static :: 0 2005::2

Ospfv3 引入默认

安全区域配置

firewall zone trust

 set priority 85

 add interface GigabitEthernet0/0/0

 add interface GigabitEthernet1/0/0

 add interface GigabitEthernet1/0/1

#

firewall zone untrust

 set priority 5

 add interface GigabitEthernet1/0/4

#

firewall zone dmz

 set priority 50

 add interface GigabitEthernet1/0/2

 add interface GigabitEthernet1/0/3

配置安全策略

security-policy

 rule name tr-un

  source-zone trust

  destination-zone untrust

  action permit

 rule name tr-dmz

  source-zone trust

  destination-zone dmz

  action permit

#

防火墙OSPF宣告配置

interface GigabitEthernet1/0/1

 undo shutdown

 ipv6 enable

 ipv6 address 2001:100:200:ABC::5/126

 ospfv3 1 area 0.0.0.0

#

interface GigabitEthernet1/0/2

 undo shutdown

 ipv6 enable

 ipv6 address 2001:100:200:ABC::A/126

 ospfv3 1 area 0.0.0.0

#

interface GigabitEthernet1/0/3

 undo shutdown

 ipv6 enable

 ipv6 address 2001:100:200:ABC::E/126

 ospfv3 1 area 0.0.0.0

测试

私信获取