策略路由配置

# 路由策略配置

背景概述：
内网出口通过两条外线进行访问外网，通过路由策略控制不同源地址用户访问的路径。

拓扑：

![](/media/202207/2022-07-02_113906_893572.png)

## 配置
```shell
# 核心交换机配置
system-view
#
ssh server enable
ip https enable
lldp global enable
#
line vty 0 4
authentication-mode scheme
user-role network-admin
quit
#

dhcp enable
dhcp server ip-pool vlan1
gateway-list 192.168.1.1
network 192.168.1.0 mask 255.255.255.0
dns-list 114.114.114.114 8.8.8.8
quit
#
local-user admin class manage
password simple 123456
service-type terminal ssh https
authorization-attribute user-role network-admin
quit
#
interface GigabitEthernet1/0/1
 port link-mode route
 combo enable fiber
 ip address 10.0.0.2 255.255.255.0
#
interface Vlan-interface1
 ip address 192.168.1.1 255.255.255.0
#
ip route-static 0.0.0.0 0 10.0.0.1
```
```shell
# 网关路由器配置
interface GigabitEthernet0/0
 port link-mode route
 combo enable copper
 ip address 100.1.1.2 255.255.255.252
#
interface GigabitEthernet0/1
 port link-mode route
 combo enable copper
 ip address 200.1.1.2 255.255.255.252
#
interface GigabitEthernet0/2
 port link-mode route
 combo enable copper
 ip address 10.0.0.1 255.255.255.252
#
 ip route-static 0.0.0.0 0 100.1.1.1
 ip route-static 0.0.0.0 0 200.1.1.1
 ip route-static 192.168.1.0 24 10.0.0.2
```
```shell
# 外网路由器配置
interface LoopBack0
 ip address 172.16.1.1 255.255.255.0
#
interface GigabitEthernet0/0
 port link-mode route
 combo enable copper
 ip address 100.1.1.1 255.255.255.252
#
interface GigabitEthernet0/1
 port link-mode route
 combo enable copper
 ip address 200.1.1.1 255.255.255.252
#
ip route-static 192.168.1.0 24 100.1.1.2
ip route-static 192.168.1.0 24 200.1.1.2
ip route-static 10.0.0.0 30 100.1.1.2
ip route-static 10.0.0.0 30 200.1.1.2
```
## 测试
测试PC_4 ping测试172.16.1.1，pc_4地址为：192.168.1.3/24
```shell
<H3C>ping -r 172.16.1.1
Ping 172.16.1.1 (172.16.1.1): 56 data bytes, press CTRL_C to break
56 bytes from 172.16.1.1: icmp_seq=0 ttl=253 time=1.000 ms
RR:     10.0.0.2
        100.1.1.2
        200.1.1.1
        10.0.0.1
        192.168.1.1
        192.168.1.3
56 bytes from 172.16.1.1: icmp_seq=1 ttl=253 time=2.000 ms      (same route)
56 bytes from 172.16.1.1: icmp_seq=2 ttl=253 time=2.000 ms      (same route)
56 bytes from 172.16.1.1: icmp_seq=3 ttl=253 time=1.000 ms      (same route)
56 bytes from 172.16.1.1: icmp_seq=4 ttl=253 time=1.000 ms      (same route)

--- Ping statistics for 172.16.1.1 ---
5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss
round-trip min/avg/max/std-dev = 1.000/1.400/2.000/0.490 ms
<H3C>%Jul  2 11:07:48:725 2022 H3C PING/6/PING_STATISTICS: Ping statistics for 172.16.1.1: 5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss, round-trip min/avg/max/std-dev = 1.000/1.400/2.000/0.490 ms.

<H3C>
```
显示路径从100.1.1.2出去，然后从200.1.1.1回来。
这边需求是PC_4走左边，PC_5走右边出口，需要通过策略路由配置。

## 策略路由配置
在网关出口路由器配置。
```shell
# 创建ACL匹配PC_4
acl advanced 3000
 rule 0 permit ip source 192.168.1.3 0
# 配置转发策略路由，名称test，节点node 1,if-match 匹配acl 3000,设置下一跳100.1.1.1
policy-based-route test permit node 1
 if-match acl 3000
 apply next-hop 100.1.1.1
# 应用策略路由，在内网口应用即可进行转发控制
int g0/2
ip policy-based-route test
```
ping测试结果：
```shell
<H3C>ping -r 172.16.1.1
Ping 172.16.1.1 (172.16.1.1): 56 data bytes, press CTRL_C to break
56 bytes from 172.16.1.1: icmp_seq=0 ttl=253 time=2.000 ms
RR:     10.0.0.2
        100.1.1.2
        100.1.1.1
        10.0.0.1
        192.168.1.1
        192.168.1.3
56 bytes from 172.16.1.1: icmp_seq=1 ttl=253 time=1.000 ms      (same route)
56 bytes from 172.16.1.1: icmp_seq=2 ttl=253 time=1.000 ms      (same route)
56 bytes from 172.16.1.1: icmp_seq=3 ttl=253 time=1.000 ms      (same route)
56 bytes from 172.16.1.1: icmp_seq=4 ttl=253 time=1.000 ms      (same route)

--- Ping statistics for 172.16.1.1 ---
5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss
round-trip min/avg/max/std-dev = 1.000/1.200/2.000/0.400 ms
<H3C>%Jul  2 11:36:11:974 2022 H3C PING/6/PING_STATISTICS: Ping statistics for 172.16.1.1: 5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss, round-trip min/avg/max/std-dev = 1.000/1.200/2.000/0.400 ms.
```