Cisco IOS Cookbook 中文精简版第二十四章移动IP

wade2007

24.1.  本地移动性（Local Area Mobility）

mal>提问 配置本地移动性来实现设备的网络漫游

回答

归属地路由器HomeRouter

RouterHome#configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

RouterHome(config)#interface FastEthernet0/0

RouterHome(config-if)#ip address 192.168.10.1 255.255.255.0

RouterHome(config-if)#ip proxy-arp

RouterHome(config-if)#ip mobile arp

RouterHome(config-if)#exit

RouterHome(config)#router eigrp 99

RouterHome(config-router)#network 192.168.10.0

RouterHome(config-router)#default-metric 10000 10 255 1 1500

RouterHome(config-router)#redistribute mobile

RouterHome(config-router)#no auto-summary

RouterHome(config-router)#exit

RouterHome(config)#end

RouterHome#

访问地路由器ForeignRouter

RouterForeign#configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

RouterForeign(config)#interface FastEthernet0/0

RouterForeign(config-if)#ip address 192.168.110.1 255.255.255.0

RouterForeign(config-if)#ip proxy-arp

RouterForeign(config-if)#ip mobile arp

RouterForeign(config-if)#exit

RouterForeign(config)#router eigrp 99

RouterForeign(config-router)#network 192.168.100.0

RouterForeign(config-router)#default-metric 10000 10 255 1 1500

RouterForeign(config-router)#redistribute mobile

RouterForeign(config-router)#no auto-summary

RouterForeign(config-router)#exit

RouterForeign(config)#end

RouterForeign#

注释 Local Area Mobility是思科通过Proxy Arp来实现的一种简单移动IP，只是作为没有DHCP的暂时替代方案，当访问地使用ARP查到了访问设备以后会在路由表生成一条主机路由，然后此主机路由会通过路由协议被归属地所学到，比如访问地的ARP和路由表

RouterForeign#show ip arp FastEthernet0/0

Protocol  Address          Age (min)  Hardware Addr   Type   Interface

Internet  192.168.110.1           -   000e.d7d6.1060  ARPA   FastEthernet0/0

Internet  192.168.10.109          1   00b0.64ab.0580  ARPA   FastEthernet0/0

Internet  192.168.110.9          21   0000.0c75.c684  ARPA   FastEthernet0/0

RouterForeign#

RouterForeign#show ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

       ia - IS-IS inter area, * - candidate default, U - per-user static route

       o - ODR, P - periodic downloaded static route



Gateway of last resort is not set



C    192.168.110.0/24 is directly connected, FastEthernet0/0

     192.168.10.0/24 is variably subnetted, 2 subnets, 2 masks

M       192.168.10.109/32 [3/1] via 192.168.10.109, 00:17:59, FastEthernet0/0

D       192.168.10.0/24 [90/2172416] via 192.168.55.11, 00:29:43, Serial0/0

C    192.168.55.0/24 is directly connected, Serial0/0

RouterForeign#

归属地通过EIGRP学到

RouterHome#show ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

       ia - IS-IS inter area, * - candidate default, U - per-user static route

       o - ODR, P - periodic downloaded static route



Gateway of last resort is not set



D    192.168.110.0/24 [90/2172416] via 192.168.55.12, 00:31:43, Serial0/0

     192.168.10.0/24 is variably subnetted, 2 subnets, 2 masks

D EX    192.168.10.109/32 [170/2172416] via 192.168.55.12, 00:18:19, Serial0/0

C       192.168.10.0/24 is directly connected, FastEthernet0/0

C    192.168.55.0/24 is directly connected, Serial0/0

RouterHome#

wade2007

24.2.  归属地代理（Home Agent）配置

提问 配置路由器成为移动终端的归属地代理

回答

RouterHome#configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

RouterHome(config)#interface Loopback0

RouterHome(config-if)#ip address 192.168.9.1 255.255.255.255

RouterHome(config-if)#exit

RouterHome(config)#router mobile

RouterHome(config-router)#exit

RouterHome(config)#router eigrp 99

RouterHome(config-router)#redistribute mobile

RouterHome(config-router)#network 192.168.9.0

RouterHome(config-router)#network 192.168.10.0

RouterHome(config-router)#default-metric 10000 10 255 1 1500

RouterHome(config-router)#no auto-summary

RouterHome(config-router)#exit

RouterHome(config)#ip mobile home-agent address 192.168.9.1

RouterHome(config)#ip mobile virtual-network 192.168.10.0 255.255.255.0

RouterHome(config)#ip mobile host 192.168.10.1 192.168.10.254 virtual-network 192.168.10.0 255.255.255.0

RouterHome(config)#ip mobile secure host 192.168.10.110 spi 100 key ascii neoshi

RouterHome(config)#ip mobile secure host 192.168.10.111 spi 100 key ascii neoshi

RouterHome(config)#ip mobile secure host 192.168.10.112 spi 100 key ascii neoshi

RouterHome(config)#ip mobile secure host 192.168.10.113 spi 100 key ascii neoshi

RouterHome(config)#ip mobile secure host 192.168.10.114 spi 100 key ascii neoshi

RouterHome(config)#ip mobile secure host 192.168.10.115 spi 100 key ascii neoshi

RouterHome(config)#end

RouterHome#

注释 配置归属地代理是配置移动IP的第一步，首先是基本的移动IP配置然后是定义Home Agent的IP地址和定义移动终端的地址段，最后是配置对不同移动终端的认证，对于认证也可以使用AAA来增强扩展性

RouterHome(config)#aaa new-model

RouterHome(config)#aaa authorization ipmobile default group tacacs+

RouterHome(config)#ip mobile secure mn-aaa spi 200 algorithm md5

注意一点移动IP隧道使用的IP协议号是55

24.3.  访问地代理（Foreign Agent）配置

提问 配置路由器成为移动终端的访问地代理

回答

RouterForeign#configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

RouterForeign(config)#router mobile

RouterForeign(config-router)#exit

RouterForeign(config)#router eigrp 99

RouterForeign(config-router)#network 192.168.110.0

RouterForeign(config-router)#no auto-summary

RouterForeign(config-router)#exit

RouterForeign(config)#interface Ethernet0/0

RouterForeign(config-if)#ip address 192.168.110.1 255.255.255.0

RouterForeign(config-if)#ip irdp

RouterForeign(config-if)#ip mobile foreign-service

RouterForeign(config-if)#exit

RouterForeign(config)#ip mobile foreign-agent care-of Ethernet0/0

RouterForeign(config)#end

RouterForeign#

注释 移动IP的第二步配置就是配置访问地代理，初始配置和归属地代理配置基本相同，然后就是在接口启用IRDP，移动终端通过IRDP来发现访问地代理地址，然后启用归属地代理，最后是配置归属地的转交地址（care-of address）此地址用来和归属地地址建立隧道。有趣的是不论在归属地还是访问地的配置中都没有定义对端的地址，因为这个地址在移动终端会宣告。

另外为了增加安全性可以配置归属地代理和访问地代理的认证

RouterHome(config)#ip mobile secure foreign-agent 192.168.110.1 spi 100 key ascii neoshi

RouterForeign(config)#ip mobile secure home-agent 192.168.9.1 spi 100 key ascii neoshi

24.4.  配置路由器成为移动终端

提问 配置路由器作为移动终端

回答

RouterMobile#configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

RouterMobile(config)#router mobile

RouterMobile(config-router)#exit

RouterMobile(config)#ip mobile secure home-agent 192.168.9.1 spi 100 key ascii neoshi

RouterMobile(config)#ip mobile router

RouterMobile(mobile-router)#address 192.168.10.112 255.255.255.0

RouterMobile(mobile-router)#home-agent 192.168.9.1

RouterMobile(mobile-router)#exit

RouterMobile(config)#interface FastEthernet0/0

RouterMobile(config-if)#ip address 192.168.10.112 255.255.255.0

RouterMobile(config-if)#ip irdp

RouterMobile(config-if)#ip mobile router-service roam

RouterMobile(config-if)#ip mobile router-service solicit

RouterMobile(config-if)#exit

RouterMobile(config)#end

RouterMobile#

注释 从12.2(4)T以后路由器开始支持配置为移动终端

24.5.  反向隧道转发（Reverse-Tunnel Forwarding）

提问 强制所有数据包都通过隧道转发来避免网络中为了防止地址欺骗所定义的控制列表

回答

RouterMobile#configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

RouterMobile(config)#ip mobile router

RouterMobile(mobile-router)#reverse-tunnel

RouterMobile(mobile-router)#exit

RouterMobile(config)#end

RouterMobile#

注释 由移动终端回程的数据包到了访问地代理后可能会通过本地路由而不是通过隧道转发回归属地代理，这样可能回违反访问地代理的安全策略，因此启用此特性来强制回程数据包也必须通过隧道转发，不过这个特性需要协商，验证：

RouterForeign#show ip mobile tunnel

Mobile Tunnels:



Tunnel0:

    src 192.168.110.1, dest 192.168.9.1

    encap IP/IP, mode reverse-allowed, tunnel-users 1

    IP MTU 1480 bytes

    Path MTU Discovery, mtu: 0, ager: 10 mins, expires: never

    outbound interface Serial0/0

    FA created, fast switching enabled, ICMP unreachable enabled

    105 packets input, 8462 bytes, 0 drops

    0 packets output, 0 bytes

RouterForeign#

24.6.  配置归属地代理HSRP支持来增加冗余性

提问 通过配置多个归属地代理来增加冗余

回答

RouterHome1#configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

RouterHome1(config)#interface FastEthernet0/0

RouterHome1(config-if)#ip address 192.168.9.2 255.255.255.0

RouterHome1(config-if)#standby 1 ip 192.168.9.1

RouterHome1(config-if)#standby 1 name HA-GROUP

RouterHome1(config-if)#exit

RouterHome1(config)#router mobile

RouterHome1(config-router)#exit

RouterHome1(config)#router eigrp 99

RouterHome1(config-router)#redistribute mobile

RouterHome1(config-router)#network 192.168.9.0

RouterHome1(config-router)#network 192.168.10.0

RouterHome1(config-router)#default-metric 10000 10 255 1 1500

RouterHome1(config-router)#no auto-summary

RouterHome1(config-router)#exit

RouterHome1(config)#ip mobile home-agent address 192.168.9.1

RouterHome1(config)#ip mobile home-agent redundancy HA-GROUP virtual-network

RouterHome1(config)#ip mobile virtual-network 192.168.10.0 255.255.255.0

RouterHome1(config)#ip mobile host 192.168.10.1 192.168.10.254 virtual-network 192.168.10.0 255.255.255.0

RouterHome1(config)#ip mobile secure home-agent 192.168.9.3 spi 100 key ascii cisco

RouterHome1(config)#ip mobile secure host 192.168.10.110 spi 100 key ascii cookbook

RouterHome1(config)#ip mobile secure host 192.168.10.111 spi 100 key ascii cookbook

RouterHome1(config)#ip mobile secure host 192.168.10.112 spi 100 key ascii cookbook

RouterHome1(config)#ip mobile secure host 192.168.10.113 spi 100 key ascii cookbook

RouterHome1(config)#ip mobile secure host 192.168.10.114 spi 100 key ascii cookbook

RouterHome1(config)#ip mobile secure host 192.168.10.115 spi 100 key ascii cookbook

RouterHome1(config)#end

RouterHome1#

RouterHome2#configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

RouterHome2(config)#interface FastEthernet0/0

RouterHome2(config-if)#ip address 192.168.9.3 255.255.255.0

RouterHome2(config-if)#standby 1 ip 192.168.9.1

RouterHome2(config-if)#standby 1 name HA-GROUP

RouterHome2(config-if)#exit

RouterHome2(config)#router mobile

RouterHome2(config-router)#exit

RouterHome2(config)#router eigrp 99

RouterHome2(config-router)#redistribute mobile

RouterHome2(config-router)#network 192.168.9.0

RouterHome2(config-router)#network 192.168.10.0

RouterHome2(config-router)#default-metric 10000 10 255 1 1500

RouterHome2(config-router)#no auto-summary

RouterHome2(config-router)#exit

RouterHome2(config)#ip mobile home-agent address 192.168.9.1

RouterHome2(config)#ip mobile home-agent redundancy HA-GROUP virtual-network

RouterHome2(config)#ip mobile virtual-network 192.168.10.0 255.255.255.0

RouterHome2(config)#ip mobile host 192.168.10.1 192.168.10.254 virtual-network 192.168.10.0 255.255.255.0

RouterHome2(config)#ip mobile secure home-agent 192.168.9.2 spi 100 key ascii cisco

RouterHome2(config)#ip mobile secure host 192.168.10.110 spi 100 key ascii cookbook

RouterHome2(config)#ip mobile secure host 192.168.10.111 spi 100 key ascii cookbook

RouterHome2(config)#ip mobile secure host 192.168.10.112 spi 100 key ascii cookbook

RouterHome2(config)#ip mobile secure host 192.168.10.113 spi 100 key ascii cookbook

RouterHome2(config)#ip mobile secure host 192.168.10.114 spi 100 key ascii cookbook

RouterHome2(config)#ip mobile secure host 192.168.10.115 spi 100 key ascii cookbook

RouterHome2(config)#end

RouterHome2#

注释 使用HSRP的虚拟地址来作为归属地地址来增加冗余，另外多了ip mobile home-agent redundancy HA-GROUP virtual-network 命令来关联相应的HSRP组，同时需要配置两个归属地代理之间的认证来同步信息ip mobile secure home-agent 192.168.9.3 spi 100 key ascii cisco