Заявленный L3 на S2995G-48T

RiddickRB

Posted May 23, 2019 (edited) · Report post

Всем привет!
Решили поставить данный аппарат в сеть OSPF и повесить на него маршрут по умолчанию на два маршрутизатора, потом весть поток запросов раскидать с помощью ЗАЯВЛЕННОГО PBR!

Создал два акцесс-листа

ip access-list standart ONE
permit 192.168.0.0 0.0.0.255

ip access-list standart TWO
permit 192.168.1.0 0.0.0.255

Создал ЗАЯВЛЕННЫЙ PBR:

route-map INTERNET permit 10

match ip address ONE
set ip next-hop 10.1.0.1

route-map INTERNET permit 20

match ip address TWO
set ip next-hop 10.2.0.1

Теперь вопрос!!!
Как привязать созданный роут-мап к интерфейсам для разруливания трафика???
Внимание!!!
Команда

SNR(config-if)# ip policy route-map INTERNET

НЕ ПОДХОДИТ НИ К ОДНОМУ ИНТЕРФЕЙСУ!!! НИ К ФИЗИЧЕСКОМУ НИК ЛОГИЧЕСКОМУ!!!

Прошу помощи!!!

Edited May 23, 2019 by RiddickRB

Share this post

Link to post

Share on other sites

alibek

Posted May 23, 2019 · Report post

В саппорт писали?

Share this post

Link to post

Share on other sites

Aleksey Sonkin

Posted May 24, 2019 · Report post

@RiddickRB
PBR реализован через policy-map

!                                                                               
access-list 1 permit 192.168.0.0 0.0.0.255                                                                                                                       
!                                                                               
class-map c1                                                                    
 match access-group 1                                                           
!                                                                               
policy-map inet1                                                             
 class c1                                                                       
 set ip nexthop  10.1.0.1                                                       
 exit                                                                           
!  
service-policy input inet1 vlan 10

Share this post

Link to post

Share on other sites

RiddickRB

Posted May 24, 2019 · Report post

3 часа назад, Aleksey Sonkin сказал:

@RiddickRB
PBR реализован через policy-map


!                                                                               
access-list 1 permit 192.168.0.0 0.0.0.255                                                                                                                       
!                                                                               
class-map c1                                                                    
 match access-group 1                                                           
!                                                                               
policy-map inet1                                                             
 class c1                                                                       
 set ip nexthop  10.1.0.1                                                       
 exit                                                                           
!  
service-policy input inet1 vlan 10

Огромное спасибо! Настроил по Вашей подсказке - всё работает!

Share this post

Link to post

Share on other sites

RiddickRB

Posted May 27, 2019 (edited) · Report post

@Aleksey Sonkin

Доброго вечера!

Есть ли возможность разрулить трафик именно по двум шлюзам?

Например:
Vlan 10 - входящий канал с ядра сети на SNRS2995G-48T находящийся в процессе OSPF
10.1.0.1 - первый шлюз
10.1.0.2 - второй шлюз
Шлюзы слинкованы с SNRS2995G-48T

На SNRS2995G-48T в OSPF объявлен дефолтный маршрут default-information originate и статикой прописано (думаю что лишнее):
0.0.0.0/0 10.1.0.1
0.0.0.0/0 10.2.0.1

Далее делаю PBR:

ip access-list standard ONE
permit 192.168.1.0 0.0.0.255

ip access-list standart TWO
permit 192.168.2.0 0.0.0.255

class-map TO_ONE
match access-group ONE

class-map TO_TWO
match access-group TWO

policy-map INTERNET
class TO_ONE
set ip nexthop 10.1.0.1
exit
class TO_TWO
set ip nexthop 10.2.0.1
exit

service-policy input INTERNET vlan 10

По этому правилу отрабатывает только set ip nexthop 10.1.0.1
Сломал всю голову как направить трафик от 192.168.2.0 0.0.0.255 на шлюз 10.2.0.1

Прошу помощи!!!!

Edited May 28, 2019 by RiddickRB

Share this post

Link to post

Share on other sites

Aleksey Sonkin

Posted May 28, 2019 · Report post

@RiddickRB
Добрый день!
Покажите, пожалуйста, 'sh ver', 'sh ip route' и 'sh arp vlan 10'

Share this post

Link to post

Share on other sites

RiddickRB

Posted May 28, 2019 (edited) · Report post

@Aleksey Sonkin
Show version

SNR-S2995G-48TX Device, Compiled on Jul 09 15:52:00 2018
sysLocation Building 57/2,Predelnaya st, Ekaterinburg, Russia
CPU Mac f8:f0:82:7a:27:81
Vlan MAC f8:f0:82:7a:27:80
SoftWare Package Version 7.5.3.2(R0004.0084)
BootRom Version 7.5.21
HardWare Version 2.0.1
CPLD Version 1.01
Serial No.:SW078320I921000004
Copyright (C) 2018 NAG LLC
All rights reserved
Last reboot is cold reset.
Uptime is 0 weeks, 4 days, 19 hours, 42 minutes

Show ip route

SNR-S2995G-48TX#show ip route
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default

Gateway of last resort is 172.30.0.1 to network 0.0.0.0

S* 0.0.0.0/0 [1/0] via 172.30.0.1, Vlan4 tag:0
[1/0] via 192.168.1.18, Vlan111 tag:0
O IA 10.1.0.0/16 [110/12] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O IA 10.5.128.0/17 [110/12] via 172.17.1.153, Vlan2, 2d21h35m tag:0
C 10.11.0.0/16 is directly connected, Ethernet0 tag:0
O IA 10.13.0.0/16 [110/12] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O IA 10.17.0.0/16 [110/12] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O IA 10.18.0.0/16 [110/12] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O IA 10.33.0.0/16 [110/12] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O IA 10.40.0.0/24 [110/12] via 172.17.1.153, Vlan2, 17:09:58 tag:0
O IA 10.48.0.0/16 [110/12] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O IA 10.61.0.0/16 [110/12] via 172.17.1.153, Vlan2, 3d06h50m tag:0
O E2 10.128.0.0/9 [110/1] via 172.17.1.153, Vlan2, 4d18h28m tag:1
O E2 10.200.2.0/24 [110/1] via 172.17.1.153, Vlan2, 4d18h28m tag:1
C 127.0.0.0/8 is directly connected, Loopback tag:0
O IA 172.16.48.0/30 [110/12] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O 172.16.255.0/24 [110/12] via 172.17.1.153, Vlan2, 00:00:54 tag:0
O 172.17.1.0/30 [110/2] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O 172.17.1.4/30 [110/3] via 172.17.1.153, Vlan2, 4d18h28m tag:0

O 172.17.1.8/30 [110/2] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O 172.17.1.12/30 [110/3] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O 172.17.1.16/30 [110/2] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O 172.17.1.20/30 [110/3] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O 172.17.1.32/30 [110/2] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O 172.17.1.40/30 [110/2] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O 172.17.1.44/30 [110/3] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O 172.17.1.112/30 [110/2] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O 172.17.1.116/30 [110/3] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O 172.17.1.120/30 [110/2] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O 172.17.1.124/30 [110/3] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O 172.17.1.128/30 [110/2] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O 172.17.1.132/30 [110/3] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O 172.17.1.136/30 [110/2] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O 172.17.1.140/30 [110/3] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O 172.17.1.144/30 [110/2] via 172.17.1.153, Vlan2, 17:10:38 tag:0
O 172.17.1.148/30 [110/3] via 172.17.1.153, Vlan2, 17:10:38 tag:0
C 172.17.1.152/30 is directly connected, Vlan2 tag:0
O 172.17.255.0/30 [110/2] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O 172.17.255.4/30 [110/2] via 172.17.1.153, Vlan2, 4d18h28m tag:0

O 172.18.254.1/32 [110/2] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O 172.18.254.2/32 [110/3] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O 172.18.254.3/32 [110/12] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O 172.18.254.4/32 [110/12] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O 172.18.254.5/32 [110/12] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O 172.18.254.7/32 [110/12] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O 172.18.254.8/32 [110/12] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O 172.18.254.17/32 [110/12] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O IA 172.18.254.21/32 [110/3] via 172.17.1.153, Vlan2, 17:09:58 tag:0
C 172.18.254.22/32 is directly connected, Loopback1 tag:0
O 172.19.1.0/30 [110/2] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O 172.19.1.4/30 [110/3] via 172.17.1.153, Vlan2, 4d18h28m tag:0
C 172.30.0.0/30 is directly connected, Vlan4 tag:0
O IA 192.168.0.0/24 [110/12] via 172.17.1.153, Vlan2, 4d18h28m tag:0
C 192.168.1.0/24 is directly connected, Vlan111 tag:0
O IA 192.168.2.0/24 [110/12] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O IA 192.168.3.0/24 [110/12] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O IA 192.168.4.0/24 [110/12] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O IA 192.168.11.0/24 [110/12] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O IA 192.168.12.0/24 [110/12] via 172.17.1.153, Vlan2, 4d18h28m tag:0

O IA 192.168.13.0/24 [110/12] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O IA 192.168.15.0/24 [110/12] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O IA 192.168.16.0/24 [110/12] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O IA 192.168.17.0/24 [110/12] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O IA 192.168.18.0/24 [110/12] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O IA 192.168.19.0/24 [110/12] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O IA 192.168.20.0/24 [110/12] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O IA 192.168.21.0/24 [110/12] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O IA 192.168.22.0/24 [110/12] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O IA 192.168.23.0/24 [110/12] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O IA 192.168.120.0/24 [110/12] via 172.17.1.153, Vlan2, 4d18h28m tag:0
O IA 192.168.250.0/24 [110/12] via 172.17.1.153, Vlan2, 4d18h28m tag:0
Total routes are : 71 item(s)

Show arp Vlan 2 (входящий вилан)

SNR-S2995G-48TX#sh arp vlan 2
ARP Unicast Items: 33, Valid: 70, Matched: 1, Verifying: 0, Incomplete: 0, Failed: 0, None: 0
Ethernet Manager Port ARP Items: 38
Address Hardware Addr Interface Port Flag Age-time(sec) subvlanVID
172.17.1.153 e0-d9-e3-34-26-43 Vlan2 Ethernet1/0/49 Dynamic 132 2

Полный конфиг

SNR-S2995G-48TX#show run
!!
switch convert mode stand-alone
!!
!
no service password-encryption
!
hostname SNR-S2995G-48TX
sysLocation Building 57/2,Predelnaya st, Ekaterinburg, Russia
sysContact support@nag.ru
!
authentication logging enable
!
username admin privilege 15 password 0 admin
!
authentication line console login local
!
!
!
!
!
info-center source debug level 8 prefix on channel 0
info-center source debug level 8 prefix on channel 1
!
!
!
!
!
Interface Ethernet0
ip address 10.11.0.5 255.255.0.0
!
!
!
vlan 1-4;111
!
ip access-list standard GUEST
permit 172.16.255.0 0.0.0.255
exit
ip access-list standard USER
permit 10.0.0.0 0.255.255.255
permit 192.168.0.0 0.0.255.255
exit
!
class-map CLASS_MAP_USER
match access-group USER
!
class-map CLASS_MAP_GUEST
match access-group GUEST
!
policy-map INTERNET
class CLASS_MAP_USER
set ip nexthop 192.168.1.18
exit
class CLASS_MAP_GUEST
set ip nexthop 10.30.0.1
exit
!
service-policy input INTERNET vlan 2-3
!
Interface Ethernet1/0/1
description TO_CISCO_2911
switchport access vlan 4
!
Interface Ethernet1/0/2
description TO_PFSENSE
switchport access vlan 111
!
Interface Ethernet1/0/3
!
Interface Ethernet1/0/4
!
Interface Ethernet1/0/5
!
Interface Ethernet1/0/6
!
Interface Ethernet1/0/7
!
Interface Ethernet1/0/8
!
Interface Ethernet1/0/9
!
Interface Ethernet1/0/10
!
Interface Ethernet1/0/11
!
Interface Ethernet1/0/12
!
Interface Ethernet1/0/13
!
Interface Ethernet1/0/14
!
Interface Ethernet1/0/15
!
Interface Ethernet1/0/16
!
Interface Ethernet1/0/17
!
Interface Ethernet1/0/18
!
Interface Ethernet1/0/19
!
Interface Ethernet1/0/20
!
Interface Ethernet1/0/21
!
Interface Ethernet1/0/22
!
Interface Ethernet1/0/23
!
Interface Ethernet1/0/24
!
Interface Ethernet1/0/25
!
Interface Ethernet1/0/26
!
Interface Ethernet1/0/27
!
Interface Ethernet1/0/28
!
Interface Ethernet1/0/29
!
Interface Ethernet1/0/30
!
Interface Ethernet1/0/31
!
Interface Ethernet1/0/32
!
Interface Ethernet1/0/33
!
Interface Ethernet1/0/34
!
Interface Ethernet1/0/35
!
Interface Ethernet1/0/36
!
Interface Ethernet1/0/37
!
Interface Ethernet1/0/38
!
Interface Ethernet1/0/39
!
Interface Ethernet1/0/40
!
Interface Ethernet1/0/41
!
Interface Ethernet1/0/42
!
Interface Ethernet1/0/43
!
Interface Ethernet1/0/44
!
Interface Ethernet1/0/45
!
Interface Ethernet1/0/46
!
Interface Ethernet1/0/47
!
Interface Ethernet1/0/48
!
Interface Ethernet1/0/49
speed-duplex force1g-full
description TO_CORE_1
switchport access vlan 2
!
Interface Ethernet1/0/50
speed-duplex force1g-full
description TO_CORE_2
switchport access vlan 3
!
Interface Ethernet1/0/51
!
Interface Ethernet1/0/52
!
interface Vlan1
shutdown
!
interface Vlan2
description TO_CORE_1
ip ospf priority 0
ip address 172.17.1.154 255.255.255.252
!
interface Vlan3
description TO_CORE_2
ip ospf priority 0
ip address 172.17.1.158 255.255.255.252
!
interface Vlan4
description TO_CISCO_2911
ip address 172.30.0.2 255.255.255.252
!
interface Vlan111
description TO_PFSENSE
ip address 192.168.1.23 255.255.255.0
!
interface Loopback1
description MANAGEMENT
ip address 172.18.254.22 255.255.255.255
!
router ospf 1
ospf router-id 253.253.253.253
network 172.17.1.152 0.0.0.3 area 0
network 172.17.1.156 0.0.0.3 area 0
network 172.18.254.22 0.0.0.0 area 0
redistribute static
default-information originate
!
ip route 0.0.0.0/0 172.30.0.1
ip route 0.0.0.0/0 192.168.1.18
!
!
no login
!
captive-portal
!
end

SNR-S2995G-48TX#

Edited May 28, 2019 by RiddickRB

Share this post

Link to post

Share on other sites

Aleksey Sonkin

Posted May 28, 2019 · Report post

@RiddickRB

При этом на какой адрес отправляется весь трафик? 172.30.0.1 192.168.1.18 оба адреса доступны?

Share this post

Link to post

Share on other sites

RiddickRB

Posted May 28, 2019 · Report post

@Aleksey Sonkin

Разобрался вроде, но при этом причину глюка так и не понял.
Текущий конфиг верный и трафик разруливает на оба шлюза

ip access-list standard GUEST
permit 172.16.255.0 0.0.0.255
exit
ip access-list standard USER
permit 10.0.0.0 0.255.255.255
permit 192.168.0.0 0.0.255.255
exit
!
class-map CLASS_MAP_USER
match access-group USER
!
class-map CLASS_MAP_GUEST
match access-group GUEST
!
policy-map INTERNET
class CLASS_MAP_USER
set ip nexthop 192.168.1.18
exit
class CLASS_MAP_GUEST
set ip nexthop 10.30.0.1
exit
!
service-policy input INTERNET vlan 2-3

С клиентской машины под линуксом был запущен MTR (mytraceroute) до 8.8.8.8 Трафик как раз заворачивали на второй шлюз 10.30.0.1
Решил сохранится WR MEM и ребутнуть коммутататор. После перезагрузки всё заработало. Что именно поменялось я так и не понял.
Проверяю трассировку cо всех сетей - всё разруливается по конфигу.

Огромное спасибо!

Надеюсь, что конфиг пригодится всем тем, кто будет пробовать настраивать PBR.

Share this post

Link to post

Share on other sites

Aleksey Sonkin

Posted May 28, 2019 · Report post

@RiddickRB
Пожалуйста. Единственное, что могу предположить это отсутствие связности с одним из шлюзов. Ну и в любом случае обновите ПО, последняя версия уже 0179.

Sign In

Share this post

Link to post

Share on other sites

Share this post

Link to post

Share on other sites

Share this post

Link to post

Share on other sites

Share this post

Link to post

Share on other sites

Share this post

Link to post

Share on other sites

Share this post

Link to post

Share on other sites

Share this post

Link to post

Share on other sites

Share this post

Link to post

Share on other sites

Share this post

Link to post

Share on other sites

Share this post

Link to post

Share on other sites

Join the conversation