A continuación se muestra la secuencia de un ping yendo y volviendo desde Getafe a la 25.25.25.25.
s:source d: destination ->: Hace NAT
NAT*: s=32.88.99.33->11.11.11.52, d=25.25.25.25 [170]
NAT*: s=11.11.11.52, d=25.25.25.25->10.10.10.2 [170]
NAT: s=32.88.99.33->11.11.11.52, d=25.25.25.25 [170]
NAT: s=11.11.11.52, d=25.25.25.25->10.10.10.2 [170
Ojo: Que no se haga NAT entre Getafe (32.88.99.33) y las demás direcciones. Y, muy importante, debe haber BU por RDSI. Lo que requiere Tunneling para separar el tráfico de una forma lógica aunque no física tanto si va por RDSI o FR.
Configuraciones de
los router:
______________________________________________________________
hostname Aluche
!username Leganes password 0 cisco
ip nat pool SP1 11.11.11.52 11.11.11.52 prefix-length 24
ip nat inside source static 10.10.10.2 25.25.25.25
ip nat outside source list 101 pool SP1
ip host Leganes 32.88.39.242
ip host Aranjuez 1.1.1.1
ip host alcorcon 3.3.3.1
ip host Getafe 32.88.99.33
isdn switch-type basic-net3
isdn tei-negotiation first-call
clock timezone CET 0
clock summer-time EDT recurring last Sun Mar 2:00 last Sun Oct 3:00
!
interface Loopback0
ip address 32.88.137.153 255.255.255.255
!
! Dos túneles, uno para la FR y otro para la RDSI.
!
interface Tunnel0
ip address 9.9.9.1 255.255.255.252
tunnel source 32.88.39.241
tunnel destination 32.88.39.242
!
interface Tunnel1
ip address 8.8.8.2 255.255.255.252
tunnel source 32.88.234.6
tunnel destination 32.88.234.5
!
interface Serial0
description Conexion a frame-relay switch (FRAD) Aranjuez
mtu 1524
no ip address
no ip directed-broadcast
encapsulation frame-relay IETF
no ip route-cache
no ip mroute-cache
frame-relay lmi-type ansi
!
interface Serial0.99 point-to-point
description PVC de gestion con FRAD Aranjuez
mtu 1524
ip address 1.1.1.2 255.255.255.252
no ip directed-broadcast
no ip route-cache
no ip mroute-cache
bandwidth 4
no cdp enable
frame-relay interface-dlci 99
!
interface Serial0.200 point-to-point
description PVC Conexion con Leganes
mtu 1524
ip address 32.88.39.241 255.255.255.252
no ip directed-broadcast
ip nat outside
no ip route-cache
no ip mroute-cache
bandwidth 1000000
no cdp enable
frame-relay interface-dlci 200
!
interface Ethernet0
ip address 10.10.10.100 255.255.255.0
ip nat inside
no ip route-cache
no ip mroute-cache
ip policy route-map pbr-NAT
!
interface BRI0
description linea rdsi xxxxx71 conectada a este puerto
mtu 2000
no ip address
no ip directed-broadcast
encapsulation ppp
no ip route-cache
no ip mroute-cache
no keepalive
isdn sending-complete
no peer default ip address
dialer pool-member 1
no fair-queue
no cdp enable
ppp authentication chap
!
interface Dialer0
description 64k conexion a Leganes para DAC
ip address 32.88.234.6 255.255.255.252
no ip directed-broadcast
ip nat outside
encapsulation ppp
ip ospf cost 16600
no ip mroute-cache
bandwidth 64
dialer remote-name leganes
dialer pool 1
dialer-group 1
no fair-queue
no cdp enable
!
router ospf 100
redistribute connected subnets
redistribute static subnets
network 8.8.8.0 0.0.0.3 area 0
network 9.9.9.0 0.0.0.3 area 0
!
ip classless
ip route 3.3.3.0 255.255.255.252 Serial0.200
ip route 11.11.11.52 255.255.255.255 32.88.39.242
ip route 11.11.11.52 255.255.255.255 32.88.234.5 200
ip route 135.76.35.0 255.255.255.0 10.10.10.2
access-list 101 permit ip host 32.88.99.33 host 25.25.25.25
access-list 166 permit ip any host 32.88.99.33
!
! Con el route map separamos el tráfico para el NAT, todo irá por el Túnel. El problema del NAT es que si viene por un mismo interface, hace NAT
! Aunque no cumpla la lista de acceso. OJO!! NO ES NECESARIO!!!!!!! Se puede quitar el policy routing, lo importante es separar el camino.
!
route-map pbr-NAT permit 10
match ip address 166
set interface Tunnel0
!
route-map pbr-NAT permit 15
match ip address 166
set interface Tunnel1
!
dialer-list 1 protocol ip permit
________________________________________________________
hostname Leganes
!username Aluche password 0 cisco
ip subnet-zero
isdn switch-type basic-net3
isdn tei-negotiation first-call
!
interface Tunnel0
ip address 9.9.9.2 255.255.255.252
tunnel source 32.88.39.242
tunnel destination 32.88.39.241
!
interface Tunnel1
ip address 8.8.8.1 255.255.255.252
tunnel source 32.88.234.5
tunnel destination 32.88.234.6
!
interface Serial0
description conexion con frame-relay switch (FRAD) Alcorcon
mtu 1524
no ip address
no ip directed-broadcast
encapsulation frame-relay IETF
no ip mroute-cache
cdp enable
frame-relay lmi-type ansi
!
interface Serial0.97 point-to-point
description PVC de gestion con FRAD Alcorcon
mtu 1524
ip address 3.3.3.2 255.255.255.252
no ip directed-broadcast
bandwidth 4
no cdp enable
frame-relay interface-dlci 97
!
interface Serial0.200 point-to-point
description PVC conexion con Aluche
mtu 1524
ip address 32.88.39.242 255.255.255.252
no ip directed-broadcast
bandwidth 1000000
no cdp enable
frame-relay interface-dlci 200
!
interface Serial1
ip address 32.88.99.34 255.255.255.252
no ip directed-broadcast
encapsulation ppp
no ip route-cache
no ip mroute-cache
bandwidth 64
!
interface BRI0
description Linea RDSI xxxxxxx52 conectada a este puerto
no ip address
no ip directed-broadcast
encapsulation ppp
no ip route-cache
no ip mroute-cache
dialer pool-member 1
!
interface Dialer0
description llamado por Aluche
ip address 32.88.234.5 255.255.255.252
no ip directed-broadcast
encapsulation ppp
no ip route-cache
ip ospf cost 16600
no ip mroute-cache
bandwidth 128
no peer default ip address
dialer remote-name Aluche
dialer idle-timeout 180
dialer wait-for-carrier-time 10
dialer string xxxxxxxx71
dialer hold-queue 100
dialer pool 1
dialer-group 1
no fair-queue
no cdp enable
ppp authentication chap
!
router ospf 100
redistribute connected subnets
redistribute static subnets
network 9.9.9.0 0.0.0.3 area 0
network 8.8.8.0 0.0.0.3 area 0
!
router bgp 100
timers bgp 15 45
neighbor 32.88.137.153 remote-as 100
!
ip default-gateway 192.168.10.2
ip classless
ip route 0.0.0.0 0.0.0.0 32.88.234.6 200
ip route 25.25.25.25 255.255.255.255 32.88.39.241
ip route 25.25.25.25 255.255.255.255 32.88.234.6 20
ip route 32.88.137.153 255.255.255.255 32.88.234.6 200
access-list 100 permit tcp any any eq bgp
access-list 100 permit icmp any any
!
dialer-list 1 protocol ip list 100
end
No hay comentarios:
Publicar un comentario
Nota: solo los miembros de este blog pueden publicar comentarios.