Ув специалисты !
Очень требуется скорая помощь.
Тема, созданная ранее осталась без ответов.
С тех пор конфиг поменялся, но задача осталась прежней.
172.22.5.228/32
|
Partner_1(172.28.5.49/29)
|
|
Fa 0/1/2(172.28.5.50/29)
b2b_2801_1 Fa0/1/0(trunk)--3750--Fa0/3 b2b_ASA5510--E0/0(172.20.10.18/29)-core
Fa 0/1/3(172.22.16.75/29)
|
|
Partner_2(172.22.16.73/29)
|
172.22.5.228/32
Искомый хост 172.22.5.228 доступен через 2-х провайдеров Partner_1 и Partner_2.
Необходимо реализовать резервирование доступа из сетей 10.0.0.0/8+172.20.0.0/16 на core
b2b_2801_1
ip cef
ip vrf Partner_2
rd 1:40
!
ip vrf Partner_1
rd 1:30
!
no ipv6 cef
!
interface Loopback0
description for_OSPF_and_Managment
ip address 192.168.1.1 255.255.255.255
!
interface FastEthernet0/1/0
switchport mode trunk
!
interface FastEthernet0/1/2
description to_Partner_1
switchport access vlan 60
!
interface FastEthernet0/1/3
description to_Partner_2
switchport access vlan 70
!
interface Vlan1
no ip address
!
interface Vlan30
ip vrf forwarding Partner_1
ip address 172.20.2.148 255.255.255.248
ip flow ingress
ip flow egress
ip nat inside
ip virtual-reassembly
!
interface Vlan40
ip vrf forwarding Partner_2
ip address 172.20.2.171 255.255.255.248
ip flow ingress
ip flow egress
ip nat inside
ip virtual-reassembly
!
interface Vlan60
ip vrf forwarding Partner_1
ip address 172.28.5.50 255.255.255.248
ip flow ingress
ip flow egress
ip nat outside
ip virtual-reassembly
!
interface Vlan70
ip vrf forwarding Partner_2
ip address 172.22.16.75 255.255.255.248
ip flow ingress
ip flow egress
ip nat outside
ip virtual-reassembly
!
interface Vlan98
description to_B2BASA5510
ip address 172.20.10.75 255.255.255.248
ip flow ingress
ip flow egress
!
router ospf 102 vrf Partner_2
log-adjacency-changes
capability vrf-lite
redistribute static metric 1000 subnets
passive-interface Vlan70
network 172.20.2.168 0.0.0.7 area 1
network 172.22.16.72 0.0.0.7 area 1
!
router ospf 105 vrf Partner_1
log-adjacency-changes
capability vrf-lite
redistribute static metric 900 subnets
passive-interface Vlan60
network 172.20.2.144 0.0.0.7 area 1
network 172.28.5.48 0.0.0.7 area 1
!
router ospf 101
log-adjacency-changes
network 172.20.10.72 0.0.0.7 area 0
!
ip forward-protocol nd
ip route 172.20.10.0 255.255.255.0 172.20.10.73
ip route vrf Partner_2 10.0.0.0 255.0.0.0 172.20.2.170
ip route vrf Partner_2 172.20.0.0 255.255.0.0 172.20.2.170
ip route vrf Partner_2 172.22.16.75 255.255.255.255 172.20.2.170
ip route vrf Partner_2 172.22.5.228 255.255.255.255 172.20.2.170
ip route vrf Partner_1 10.0.0.0 255.0.0.0 172.20.2.145
ip route vrf Partner_1 172.20.0.0 255.255.0.0 172.20.2.145
ip route vrf Partner_1 172.22.5.228 255.255.255.255 172.28.5.49
ip route vrf Partner_1 172.28.5.50 255.255.255.255 172.20.2.145
!
ip nat inside source list nat_Partner_2 interface Vlan70 vrf Partner_2 overload
ip nat inside source list nat_Partner_1 interface Vlan60 vrf Partner_1 overload
!
ip access-list extended nat_Partner_1
permit ip 10.0.0.0 0.255.255.255 any
permit ip 172.20.0.0 0.0.255.255 any
ip access-list extended nat_Partner_2
permit ip 10.0.0.0 0.255.255.255 any
permit ip 172.20.0.0 0.0.255.255 any
end
Конфиг B2B_ASA_5510:
!
interface Ethernet0/0
nameif core
security-level 100
ip address 172.20.10.18 255.255.255.248
!
interface Ethernet0/3
no nameif
no security-level
no ip address
!
interface Ethernet0/3.30
vlan 30
nameif Partner_1
security-level 20
ip address 172.20.2.145 255.255.255.248
ospf database-filter all out
!
interface Ethernet0/3.40
nameif Partner_2
security-level 20
ip address 172.20.2.170 255.255.255.248
ospf database-filter all out
!
interface Ethernet0/3.98
vlan 98
nameif mgmt
security-level 90
ip address 172.20.10.73 255.255.255.248
!
router ospf 100
router-id 1.1.1.1
network 172.20.2.144 255.255.255.248 area 1
log-adj-changes
network 172.20.2.168 255.255.255.248 area 1
!
router ospf 101
router-id 192.168.1.3
network 172.20.10.16 255.255.255.248 area 0
network 172.20.10.72 255.255.255.248 area 0
log-adj-changes
redistribute ospf 100 metric 200 subnets
Было предложено сделать
ip route vrf Partner_2 172.22.5.228 255.255.255.255 172.20.2.170
ip route vrf Partner_1 172.22.5.228 255.255.255.255 172.28.5.49
с разными метриками дистрибуции из своих процессов ospf.(именно этот вариант и приведен выше). Утверждается, что если отвалится канал через Partner_1, то по тайм-ауту придут обновления от процесса с худшей метрикой.
На asa ничего не поменялось.
Прошу помощи в настройке.
