BGP的综合解决方案.txt

noteId: 803AF6909EC64C4B90D108103161959F · 原始路径：/ALL/世赛题目（练习） - 笔记/考核/11月份考核（第一次考核）/广东第三届省赛 C模块题目/C-模块/BGP的综合解决方案.txt

BGP

```

#HQ1,HQ2建立联邦外部2023内部65001 65002,HQ1 HQ2和ISP建立,ISP和DCFW建立
#路由过滤：1.HQ重分发静态 限制仅将 NAT 网段分发给ISP
#路由过滤：2.HQ1和HQ2之间建立邻居 限制排除loop0和NAT的网段

HQ1

router bgp 65001

bgp confederation identifier 2023

bgp confederation peers 65002

network 1.1.1.1 mask 255.255.255.255

network 193.168.1.0 mask 255.255.255.240

redistribute static route-map ISP_BGP

neighbor 2.2.2.2 remote-as 65002

neighbor 2.2.2.2 ebgp-multihop 255

neighbor 2.2.2.2 update-source Loopback0

neighbor 2.2.2.2 route-map HQ_BGP out

neighbor 193.168.1.2 remote-as 3947

ip access-list standard HQ_BGP

permit 1.1.1.1

permit 193.168.255.0 0.0.0.3

ip access-list standard ISP_BGP

permit 193.168.255.0 0.0.0.3

route-map HQ_BGP deny 10

match ip address HQ_BGP

route-map ISP_BGP permit 10

match ip address ISP_BGP

HQ2

router bgp 65002

bgp confederation identifier 2023

bgp confederation peers 65001

network 2.2.2.2 mask 255.255.255.255

network 193.168.2.0 mask 255.255.255.240

redistribute static route-map ISP_BGP

neighbor 1.1.1.1 remote-as 65001

neighbor 1.1.1.1 ebgp-multihop 255

neighbor 1.1.1.1 update-source Loopback0

neighbor 1.1.1.1 route-map HQ_BGP out

neighbor 193.168.2.2 remote-as 3947

ip access-list standard HQ_BGP

permit 2.2.2.2

permit 193.168.255.0 0.0.0.3

ip access-list standard ISP_BGP

permit 193.168.255.0 0.0.0.3

route-map HQ_BGP deny 10

match ip address HQ_BGP

route-map ISP_BGP permit 10

match ip address ISP_BGP

#ISP
router bgp 3947

network 8.8.8.8 mask 255.255.255.255

network 101.20.23.0 mask 255.255.255.0

network 102.20.23.0 mask 255.255.255.0

network 193.168.1.0 mask 255.255.255.240

network 193.168.2.0 mask 255.255.255.240

network 193.168.3.0 mask 255.255.255.240

neighbor 101.20.23.47 remote-as 1012

neighbor 101.20.23.47 timers 1 5 5

neighbor 101.20.23.47 prefix-list CTCC_OUT out

neighbor 102.20.23.47 remote-as 1012

neighbor 102.20.23.47 timers 1 5 5

neighbor 102.20.23.47 prefix-list CUCC_OUT out

neighbor 193.168.1.1 remote-as 2023

neighbor 193.168.2.1 remote-as 2023

neighbor 193.168.3.1 remote-as 2024

ip prefix-list CTCC_OUT seq 5 deny 102.20.23.0/24
ip prefix-list CTCC_OUT seq 10 permit 0.0.0.0/0 le 32
ip prefix-list CUCC_OUT seq 5 deny 101.20.23.0/24
ip prefix-list CUCC_OUT seq 10 permit 0.0.0.0/0 le 32

#BR1
router bgp 2024

network 193.168.3.0 mask 255.255.255.240

network 3.3.3.3 mask 255.255.255.255

neighbor 193.168.3.2 remote-as 3947

DCFW

为了将来自两个不同网络（101和102）的流量分别路由到不同的接口上，而不能将101网络的路由信息也公布到102接口导致无法通信

prefix-list BGP_FW1 seq 5 permit 101.20.23.0/24
prefix-list BGP_FW1 seq 10 permit 112.20.23.47/32
prefix-list BGP_FW1 seq 15 deny 0.0.0.0/0 le 32

prefix-list BGP_FW2 seq 5 permit 102.20.23.0/24
prefix-list BGP_FW2 seq 10 permit 112.20.23.47/32
prefix-list BGP_FW2 seq 15 deny 0.0.0.0/0 le 32

router bgp 1012

address-family ipv4 unicast

neighbor 101.20.23.101 remote-as 3947

neighbor 101.20.23.101 timers 1 5 5

neighbor 101.20.23.101 activate

neighbor 101.20.23.101 prefix-list CTCC_OUT out

neighbor 102.20.23.102 remote-as 3947

neighbor 102.20.23.101 timers 1 5 5

neighbor 102.20.23.102 activate

neighbor 102.20.23.102 prefix-list CUCC_OUT out

network 101.20.23.0 mask 255.255.255.0

network 102.20.23.0 mask 255.255.255.0

redistribute static route-map red_to_BGP

access-list red-to-bgp standard permit host 112.20.23.47

route-map red_to_BGP permit 10

match ip address red-to-bgp

```

ASA NAT

```

object network server

host 172.16.0.100

nat (Inside,Outside_CTCC) static 112.20.23.47

object network serverbak

host 172.16.0.100

nat (Inside,Outside_CUCC) static 112.20.23.47

```