Noriu/Cyber_Security_Notes
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

2024年8月28日 16:41:57

Browse Source
This commit is contained in:
Noriu 2024-08-28 16:41:56 +08:00
parent 8bea0a7484
commit e1073ebd89
2 changed files with 246 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

202
B. 第二阶段/拓扑练习/0828_BFD和VRRP.md Normal file
View File

@ -0,0 +1,202 @@
# BFD和VRRP
![image-20240828162230655](https://picgo-noriu.oss-cn-beijing.aliyuncs.com/Images/image-20240828162230655.png)
### 一、PC`s IP
### 二、VLAN
- **SW3**
```
[SW3]vlan 10
[SW3-vlan10]quit
[SW3]port-group group-member g0/0/1 g0/0/2
[SW3-port-group]port link-type access
[SW3-port-group]port default vlan 10
[SW3-port-group]quit
[SW3]port-group group-member g0/0/3 g0/0/4
[SW3-port-group]port link-type trunk
[SW3-port-group]port trunk allow-pass vlan all
```
### 三、VRRP
- **SW1**
```
[SW1]vlan 10
[SW1-vlan10]quit
[SW1]int g0/0/1
[SW1-GigabitEthernet0/0/1]port link-type trunk
[SW1-GigabitEthernet0/0/1]port trunk allow-pass vlan all
[SW1-GigabitEthernet0/0/1]quit
[SW1]int vlan 10
[SW1-Vlanif10]ip add 192.168.10.254 24
[SW1-Vlanif10]vrrp vrid 10 virtual-ip 192.168.10.254
[SW1-Vlanif10]vrrp vrid 10 priority 130
```
- **SW2**
```
[SW2]vlan 10
[SW2-vlan10]quit
[SW2]int g0/0/1
[SW2-GigabitEthernet0/0/1]port link-type trunk
[SW2-GigabitEthernet0/0/1]port trunk allow-pass vlan all
[SW2-GigabitEthernet0/0/1]quit
[SW2]int vlan 10
[SW2-Vlanif10]ip add 192.168.10.252 24
[SW2-Vlanif10]vrrp vrid 10 virtual-ip 192.168.10.254
```
### 四、BFD
- **SW1**
```
[SW1]bfd
[SW1-bfd]quit
[SW1]bfd ntd2407 bind peer-ip 192.168.10.252
[SW1-bfd-session-ntd2407]discriminator local 1
[SW1-bfd-session-ntd2407]discriminator remote 2
[SW1-bfd-session-ntd2407]min-tx-interval 100
[SW1-bfd-session-ntd2407]min-rx-interval 100
[SW1-bfd-session-ntd2407]commit
```
- **SW2**
```
[SW2]bfd
[SW2-bfd]quit
[SW2]bfd ntd2407 bind peer-ip 192.168.10.251
[SW2-bfd-session-ntd2407]discriminator local 2
[SW2-bfd-session-ntd2407]discriminator remote 1
[SW2-bfd-session-ntd2407]min-tx-interval 100
[SW2-bfd-session-ntd2407]min-rx-interval 100
[SW2-bfd-session-ntd2407]commit
```
### 五、BFD与VRRP联动
- **SW2**
```
[SW2]int vlan 10
[SW2-Vlanif10]vrrp vrid 10 track bfd-session 2 increased 60
```
*解释：*
1. `[SW2]int vlan 10`
- 进入交换机的VLAN接口配置模式，针对VLAN 10。
2. `[SW2-Vlanif10]vrrp vrid 10 track bfd-session 2 increased 60`
- 在VLAN接口10上配置VRRP虚拟路由器ID为10，并设置对BFD会话2的跟踪。
- `track bfd-session 2`：指定跟踪的BFD会话，这里的会话ID是2。
- `increased 60`：当BFD会话2的状态变为Down时，VRRP的优先级将增加60。这通常用于确保当主链路出现问题时，备份链路能够接管，提高其VRRP优先级，从而成为新的主路由器。
> 这个配置的作用是，当BFD会话2检测到链路故障时，VRRP的优先级会增加，这有助于VRRP组中的备用路由器成为新的主路由器，从而保证网络的连续性和可靠性。
>
> 请注意，这个配置假设BFD会话2已经正确配置，并且与VRRP虚拟路由器关联的接口是VLAN 10。如果BFD会话状态变为Down，VRRP优先级的增加将触发VRRP主备切换。
### 六、完备性测试
- **SW1**
```
[SW1]dis vrrp
Vlanif10 | Virtual Router 10
State : Master
Virtual IP : 192.168.10.254
Master IP : 192.168.10.254
PriorityRun : 255
PriorityConfig : 130
MasterPriority : 255
Preempt : YES Delay Time : 0 s
TimerRun : 1 s
TimerConfig : 1 s
Auth type : NONE
Virtual MAC : 0000-5e00-010a
Check TTL : YES
Config type : normal-vrrp
Create time : 2024-08-28 15:57:41 UTC-08:00
Last change time : 2024-08-28 16:13:44 UTC-08:00
```
- **SW2**
```
[SW2]dis vrrp
Vlanif10 | Virtual Router 10
State : Backup
Virtual IP : 192.168.10.254
Master IP : 192.168.10.254
PriorityRun : 100
PriorityConfig : 100
MasterPriority : 255
Preempt : YES Delay Time : 0 s
TimerRun : 1 s
TimerConfig : 1 s
Auth type : NONE
Virtual MAC : 0000-5e00-010a
Check TTL : YES
Config type : normal-vrrp
Track BFD : 2 Priority increased : 60
BFD-session state : INITIALIZE
Create time : 2024-08-28 15:55:20 UTC-08:00
Last change time : 2024-08-28 16:28:55 UTC-08:00
```
### 七、功能性测试
![image-20240828163927888](https://picgo-noriu.oss-cn-beijing.aliyuncs.com/Images/image-20240828163927888.png)
- **SW1**
```
[SW1]dis vrrp
Vlanif10 | Virtual Router 10
State : Initialize
Virtual IP : 192.168.10.254
Master IP : 0.0.0.0
PriorityRun : 255
PriorityConfig : 130
MasterPriority : 0
Preempt : YES Delay Time : 0 s
TimerRun : 1 s
TimerConfig : 1 s
Auth type : NONE
Virtual MAC : 0000-5e00-010a
Check TTL : YES
Config type : normal-vrrp
Create time : 2024-08-28 15:57:41 UTC-08:00
Last change time : 2024-08-28 16:39:16 UTC-08:00
```
- **SW2**
```
[SW2]dis vrrp
Vlanif10 | Virtual Router 10
State : Master
Virtual IP : 192.168.10.254
Master IP : 192.168.10.252
PriorityRun : 100
PriorityConfig : 100
MasterPriority : 100
Preempt : YES Delay Time : 0 s
TimerRun : 1 s
TimerConfig : 1 s
Auth type : NONE
Virtual MAC : 0000-5e00-010a
Check TTL : YES
Config type : normal-vrrp
Track BFD : 2 Priority increased : 60
BFD-session state : INITIALIZE
Create time : 2024-08-28 15:55:20 UTC-08:00
Last change time : 2024-08-28 16:39:17 UTC-08:00
```

45
B. 第二阶段/拓扑练习/0828_BFD和静态路由.md
View File

@ -14,6 +14,7 @@
[AR1-GigabitEthernet0/0/0]int g0/0/1
[AR1-GigabitEthernet0/0/1]ip add 192.168.13.1 24
[AR1-GigabitEthernet0/0/1]quit
[AR1]ip route-static 192.168.2.0 24 192.168.12.2
[AR1]ip route-static 192.168.2.0 24 192.168.13.2 preference 100
```
@ -26,6 +27,7 @@
[AR2-GigabitEthernet0/0/0]int g0/0/1
[AR2-GigabitEthernet0/0/1]ip add 192.168.24.2 24
[AR2-GigabitEthernet0/0/1]quit
[AR2]ip route-static 192.168.1.0 24 192.168.12.1
[AR2]ip route-static 192.168.2.0 24 192.168.24.4
```
@ -38,6 +40,7 @@
[AR3-GigabitEthernet0/0/0]int g0/0/1
[AR3-GigabitEthernet0/0/1]ip add 192.168.34.3 24
[AR3-GigabitEthernet0/0/1]quit
[AR3]ip route-static 192.168.1.0 24 192.168.13.1
[AR3]ip route-static 192.168.2.0 24 192.168.34.4
```
@ -52,6 +55,7 @@
[AR4-GigabitEthernet0/0/1]int g0/0/2
[AR4-GigabitEthernet0/0/2]ip add 192.168.2.254 24
[AR4-GigabitEthernet0/0/2]quit
[AR4]ip route-static 192.168.1.0 24 192.168.24.2
[AR4]ip route-static 192.168.1.0 24 192.168.34.3 preference 100
```
@ -63,6 +67,7 @@
```
[AR1]ip route-static 192.168.24.0 24 192.168.12.2
[AR1]ip route-static 192.168.34.0 24 192.168.13.3
[AR1]bfd
[AR1-bfd]quit
[AR1]bfd ntd2407 bind peer-ip 192.168.24.4
@ -71,6 +76,9 @@
[AR1-bfd-session-ntd2407]min-tx-interval 10
[AR1-bfd-session-ntd2407]min-rx-interval 10
[AR1-bfd-session-ntd2407]commit
[AR1-bfd-session-ntd2407]quit
[AR1]ip route-static 192.168.2.0 24 192.168.12.2 track bfd ntd2407
```
- *注解：*
@ -82,12 +90,14 @@
6. `[AR1-bfd-session-ntd2407]min-tx-interval 10`：设置BFD会话的最小发送间隔为`10`毫秒
7. `[AR1-bfd-session-ntd2407]min-rx-interval 10`：设置BFD会话的最小接收间隔为`10`毫秒
8. `[AR1-bfd-session-ntd2407]commit`：提交BFD会话的配置，使其生效
9. `ip route-static 192.168.2.0 24 192.168.12.2 track bfd ntd2407`：BFD与静态路由联动
- **AR4**
```
[AR4]ip route-static 192.168.12.0 24 192.168.24.2
[AR4]ip route-static 192.168.13.0 24 192.168.34.3
[AR4]bfd
[AR4-bfd]quit
[AR4]bfd ntd2407 bind peer-ip 192.168.12.1
@ -106,4 +116,37 @@
5. `[AR1-bfd-session-ntd2407]discriminator remote 1`：设置对端设备BFD会话的鉴别器值为`1`
6. `[AR1-bfd-session-ntd2407]min-tx-interval 10`：设置BFD会话的最小发送间隔为`10`毫秒
7. `[AR1-bfd-session-ntd2407]min-rx-interval 10`：设置BFD会话的最小接收间隔为`10`毫秒
8. `[AR1-bfd-session-ntd2407]commit`：提交BFD会话的配置，使其生效
8. `[AR1-bfd-session-ntd2407]commit`：提交BFD会话的配置，使其生效
### 三、功能性测试
- **断连测试**
![image-20240828153740948](https://picgo-noriu.oss-cn-beijing.aliyuncs.com/Images/image-20240828153740948.png)
- 查看BFD信息
```
[AR1]dis bfd session all
--------------------------------------------------------------------------------
Local Remote PeerIpAddr State Type InterfaceName
--------------------------------------------------------------------------------
1 4 192.168.24.4 Down S_IP_PEER -
--------------------------------------------------------------------------------
Total UP/DOWN Session Number : 0/1
```
- PING
```
```
- Tracert
```
```