带有 2 个路由器、N 条冗余链路的 OSPF

网络工程 局域网 ospf 冗余
2022-02-20 20:50:58

我很难找到解决方案，而且我似乎无法在网络上的任何地方找到我需要的东西。

我们需要配置 2 台路由器 (MOXA EDR 810) 以在彼此之间拥有 N 条冗余链路。不幸的是，有些链接会阻塞 L2 数据包，因此我们不能使用 STP / LACP 或专有的 L2 协议（例如 MOXA 的 Turbo Ring v2）。

示例图

我们正在尝试使用 OSPF 和 N VLAN 找到解决方法。该解决方案在连接 1 个接口时有效，但在连接 2 个以上接口时似乎开始抖动/丢失数据包，即使链路权重不同。

我是 OSPF 的新手，我想知道 OSPF 在所有可用链路上看到相同的路由器 ID 是否会导致抖动。

我一直试图在网上找到答案，但我很茫然，所以我在这里寻求帮助。

任何答复表示赞赏。

预先谢谢你

编辑：附加细节，收集评论：

  • 所有端口都禁用 RSTP
  • N 条链路中的每一条都分配有一个专用的未标记 VLAN

编辑 2：配置文件

路由器 #1

! ---------- EDR-810-VPN-2GSFP-T ----------
router ospf 10.0.1.10
 redistribute connected
 redistribute static
 redistribute rip
 area 0.0.0.0
vlan create  1
vlan create  90
vlan create  91
interface ethernet 1/1
 no shutdown 
 speed-duplex Auto
 no flowcontrol 
 media cable-mode auto
 switchport access vlan  1
 no spanning-tree edge-port 
interface ethernet 1/2
 no shutdown 
 speed-duplex Auto
 no flowcontrol 
 media cable-mode auto
 switchport access vlan  1
 no spanning-tree edge-port 
interface ethernet 1/3
 no shutdown 
 name PC
 speed-duplex Auto
 no flowcontrol 
 media cable-mode auto
 switchport access vlan  1
 no spanning-tree edge-port 
interface ethernet 1/4
 no shutdown 
 speed-duplex Auto
 no flowcontrol 
 media cable-mode auto
 switchport access vlan  1
 no spanning-tree edge-port 
interface ethernet 1/5
 no shutdown 
 speed-duplex Auto
 no flowcontrol 
 media cable-mode auto
 switchport access vlan  1
 no spanning-tree edge-port 
interface ethernet 1/6
 no shutdown 
 name PTP1
 speed-duplex Auto
 no flowcontrol 
 media cable-mode auto
 switchport access vlan  90
 no spanning-tree edge-port 
interface ethernet 1/7
 no shutdown 
 name PTP2
 speed-duplex Auto
 no flowcontrol 
 media cable-mode auto
 switchport access vlan  91
 no spanning-tree edge-port 
interface ethernet 1/8
 no shutdown 
 speed-duplex Auto
 no flowcontrol 
 media cable-mode auto
 switchport access vlan  1
 no spanning-tree edge-port 
interface ethernet 1/9
 no shutdown 
 switchport access vlan  1
 no spanning-tree edge-port 
interface ethernet 1/10
 no shutdown 
 switchport access vlan  1
 no spanning-tree edge-port 
interface lan 
 bind vlan 1
 ip address  static 10.0.1.10 255.255.255.0
 name  LAN
 ip dvmrp 
 ip pim-sm 
 ip pim-sm hello-interval 5
interface vlan  90
 ip address   10.0.90.1 255.255.255.0
 name  PTP1
 ip ospf area 0.0.0.0
 ip ospf hello-interval 5
 ip ospf dead-interval 10
 ip dvmrp 
 ip pim-sm 
 ip pim-sm hello-interval 5
interface vlan  91
 ip address   10.0.91.1 255.255.255.0
 name  PTP2
 ip ospf area 0.0.0.0
 ip ospf priority 10
 ip ospf hello-interval 5
 ip ospf dead-interval 10
 ip dvmrp 
 ip pim-sm 
 ip pim-sm hello-interval 5
interface bridge 
 ip address 192.168.126.254 255.255.255.0
 name BRG_LAN
 shutdown 
 no goose-pass-through 
interface zone-base-bridge 
 ip address 0.0.0.0 0.0.0.0
 name ZONE_BRG
 shutdown 
 no goose-pass-through 
dot1x reauth period 3600
interface wan 
 shutdown 
 ip address static 10.0.0.2 255.255.255.0 10.0.0.1 
firewall 1
 action drop
 interface ALL ALL
 protocol All
 mode ip
 src-ip all
 src-port all
 dst-ip all
 dst-port all
 logging severity 0
firewall 1 disable
firewall malformed logging severity 0
l2-filter 1
 action accept
 interface all all
 protocol all
 src-mac 00:00:00:00:00:00
 dst-mac 00:00:00:00:00:00
l2-filter 1 disable
dos icmp-death 4000
no dos icmp-death
dos syn-flood 4000
no dos syn-flood
dos arp-flood 4000
no dos arp-flood
logging dos severity 0
snmp-server trap-mode trap-v1
ip dhcp pool 1
 network 10.0.1.100 10.0.1.200 255.255.255.0
 lease 60
 default-router 10.0.1.10
ip ddns service disable
service dhcp 
no lldp enable 
lldp timer 30
hostname MOXA1
snmp-server location ONE
settingcheck timer 180
logging trusted-access severity 0
modbus-filter 1
 action accept
 protocol all
 src-ip all
 dst-ip all
 function 0
 uid 0
 interface all all 
modbus-filter 1 disable
redundancy 
 turbo-ring-v2  1 primary interface 1/6 secondary interface 1/7
 no turbo-ring-v2  1 master
 no turbo-ring-v2  2 master
 no turbo-ring-v2  2
 no turbo-ring-v2 coupling  
redundancy mode rstp
no ip igmp-snooping 
qos mapping dscp-to-queue 30 2
qos mode weighted-fair
monitor source interface 1/6 both
monitor destination interface 1/2
username admin password 810448e13d53513dddd17d6c045025abddd17d6c045025abddd17d6c045025ab31048d2e6661d3e07ec5d571e37f1886 privilege 1
username configadmin password 810448e13d53513dddd17d6c045025abddd17d6c045025abddd17d6c045025ab31048d2e6661d3e07ec5d571e37f1886 privilege 2
username configadmin privilege 4
username user password 810448e13d53513dddd17d6c045025abddd17d6c045025abddd17d6c045025ab31048d2e6661d3e07ec5d571e37f1886 privilege 3
moxa-utility 
ip telnet port 23
ip telnet
ip ssh port 22
ip ssh
ip telnet max-login-users 5
ip http-server port 80
ip http-server
ip http-server secure port 443
ip http-server secure
ip http-server max-login-users 5
no ip ping-response
ip auto-logout 0
auth radius auth-type pap
openvpn server 1
 device-type tap
 protocol udp
 port 1194
 no client-to-client 
 no comp-lzo 
 keepalive 
 cipher BF-CBC
 hash SHA1
 network 10.8.0.0 255.255.255.0
 push route 192.168.127.0 255.255.255.0
 server-bridge 
 bridge-if LAN
openvpn server 1 disable
openvpn client 1
 device-type tun
 protocol udp
 server 0.0.0.0 port 1194
 cipher BF-CBC
 hash SHA1
 comp-lzo 
 client-auth certificate
openvpn client 1 disable
openvpn client 2
 device-type tun
 protocol udp
 server 0.0.0.0 port 1194
 cipher BF-CBC
 hash SHA1
 comp-lzo 
 client-auth certificate
openvpn client 2 disable
no security-notification event-firewall
no security-notification event-dosattack
no security-notification event-accessviolation
no security-notification event-loginfail
password-policy minimum-length 4
no password-policy complexity-check
no password-policy complexity-check digit
no password-policy complexity-check alphabet
no password-policy complexity-check special-characters
no login-lockout 
login-lockout retry-threshold 5
login-lockout lockout-time 5
no logging-capacity 
logging-capacity snmp-trap-warning
logging-capacity email-warning
logging-capacity over-size-action overwrite-oldest
no fast-bootup 
mtu LAN 1500
mtu PTP1 1500
mtu PTP2 1500
web-display-language 0

路由器 #2

! ---------- EDR-810-VPN-2GSFP-T ----------
router ospf 10.0.2.10
 redistribute connected
 redistribute static
 redistribute rip
 area 0.0.0.0
vlan create  1
vlan create  90
vlan create  91
interface ethernet 1/1
 no shutdown 
 speed-duplex Auto
 no flowcontrol 
 media cable-mode auto
 switchport access vlan  1
 no spanning-tree edge-port 
interface ethernet 1/2
 no shutdown 
 speed-duplex Auto
 no flowcontrol 
 media cable-mode auto
 switchport access vlan  1
 no spanning-tree edge-port 
interface ethernet 1/3
 no shutdown 
 name PC
 speed-duplex Auto
 no flowcontrol 
 media cable-mode auto
 switchport access vlan  1
 no spanning-tree edge-port 
interface ethernet 1/4
 no shutdown 
 speed-duplex Auto
 no flowcontrol 
 media cable-mode auto
 switchport access vlan  1
 no spanning-tree edge-port 
interface ethernet 1/5
 no shutdown 
 speed-duplex Auto
 no flowcontrol 
 media cable-mode auto
 switchport access vlan  1
 no spanning-tree edge-port 
interface ethernet 1/6
 no shutdown 
 name PTP1
 speed-duplex Auto
 no flowcontrol 
 media cable-mode auto
 switchport access vlan  90
 no spanning-tree edge-port 
interface ethernet 1/7
 no shutdown 
 name PTP2
 speed-duplex Auto
 no flowcontrol 
 media cable-mode auto
 switchport access vlan  91
 no spanning-tree edge-port 
interface ethernet 1/8
 no shutdown 
 speed-duplex Auto
 no flowcontrol 
 media cable-mode auto
 switchport access vlan  1
 no spanning-tree edge-port 
interface ethernet 1/9
 no shutdown 
 switchport access vlan  1
 no spanning-tree edge-port 
interface ethernet 1/10
 no shutdown 
 switchport access vlan  1
 no spanning-tree edge-port 
interface lan 
 bind vlan 1
 ip address  static 10.0.2.10 255.255.255.0
 name  LAN
 ip dvmrp 
 ip pim-sm 
 ip pim-sm hello-interval 5
interface vlan  90
 ip address   10.0.90.2 255.255.255.0
 name  PTP1
 ip ospf area 0.0.0.0
 ip ospf hello-interval 5
 ip ospf dead-interval 10
 ip dvmrp 
 ip pim-sm 
 ip pim-sm hello-interval 5
interface vlan  91
 ip address   10.0.91.2 255.255.255.0
 name  PTP2
 ip ospf area 0.0.0.0
 ip ospf priority 10
 ip ospf hello-interval 5
 ip ospf dead-interval 10
 ip dvmrp 
 ip pim-sm 
 ip pim-sm hello-interval 5
interface bridge 
 ip address 192.168.126.254 255.255.255.0
 name BRG_LAN
 shutdown 
 no goose-pass-through 
interface zone-base-bridge 
 ip address 0.0.0.0 0.0.0.0
 name ZONE_BRG
 shutdown 
 no goose-pass-through 
dot1x reauth period 3600
interface wan 
 shutdown 
 ip address static 10.0.100.2 255.255.255.0 10.0.100.1 
firewall 1
 action drop
 interface ALL ALL
 protocol All
 mode ip
 src-ip all
 src-port all
 dst-ip all
 dst-port all
 logging severity 0
firewall 1 disable
firewall malformed logging severity 0
l2-filter 1
 action accept
 interface all all
 protocol all
 src-mac 00:00:00:00:00:00
 dst-mac 00:00:00:00:00:00
l2-filter 1 disable
dos icmp-death 4000
no dos icmp-death
dos syn-flood 4000
no dos syn-flood
dos arp-flood 4000
no dos arp-flood
logging dos severity 0
snmp-server trap-mode trap-v1
ip dhcp pool 1
 network 10.0.2.100 10.0.2.200 255.255.255.0
 lease 60
 default-router 10.0.2.10
ip ddns service disable
service dhcp 
no lldp enable 
lldp timer 30
hostname MOXA2
snmp-server location TWO
settingcheck timer 180
logging trusted-access severity 0
modbus-filter 1
 action accept
 protocol all
 src-ip all
 dst-ip all
 function 0
 uid 0
 interface all all 
modbus-filter 1 disable
redundancy 
 turbo-ring-v2  1 primary interface 1/6 secondary interface 1/7
 no turbo-ring-v2  1 master
 no turbo-ring-v2  2 master
 no turbo-ring-v2  2
 no turbo-ring-v2 coupling  
redundancy mode rstp
no ip igmp-snooping 
qos mapping dscp-to-queue 30 2
qos mode weighted-fair
username admin password 810448e13d53513dddd17d6c045025abddd17d6c045025abddd17d6c045025ab31048d2e6661d3e07ec5d571e37f1886 privilege 1
username configadmin password 810448e13d53513dddd17d6c045025abddd17d6c045025abddd17d6c045025ab31048d2e6661d3e07ec5d571e37f1886 privilege 2
username user password 810448e13d53513dddd17d6c045025abddd17d6c045025abddd17d6c045025ab31048d2e6661d3e07ec5d571e37f1886 privilege 3
moxa-utility 
ip telnet port 23
ip telnet
ip ssh port 22
ip ssh
ip telnet max-login-users 5
ip http-server port 80
ip http-server
ip http-server secure port 443
ip http-server secure
ip http-server max-login-users 5
no ip ping-response
ip auto-logout 0
auth radius auth-type pap
openvpn server 1
 device-type tun
 protocol udp
 port 1194
 no client-to-client 
 comp-lzo 
 keepalive 
 cipher BF-CBC
 hash SHA1
 network 10.8.0.0 255.255.255.0
 push route 192.168.127.0 255.255.255.0
 server-bridge 
openvpn server 1 disable
openvpn client 1
 device-type tun
 protocol udp
 server 0.0.0.0 port 1194
 cipher BF-CBC
 hash SHA1
 comp-lzo 
 client-auth certificate
openvpn client 1 disable
openvpn client 2
 device-type tun
 protocol udp
 server 0.0.0.0 port 1194
 cipher BF-CBC
 hash SHA1
 comp-lzo 
 client-auth certificate
openvpn client 2 disable
no security-notification event-firewall
no security-notification event-dosattack
no security-notification event-accessviolation
no security-notification event-loginfail
password-policy minimum-length 4
no password-policy complexity-check
no password-policy complexity-check digit
no password-policy complexity-check alphabet
no password-policy complexity-check special-characters
no login-lockout 
login-lockout retry-threshold 5
login-lockout lockout-time 5
no logging-capacity 
logging-capacity snmp-trap-warning
logging-capacity email-warning
logging-capacity over-size-action overwrite-oldest
no fast-bootup 
mtu LAN 1500
mtu PTP1 1500
mtu PTP2 1500
web-display-language 0

编辑 3：下面用供应商解决方案自我回答。

2个回答

当供应商找到我们遇到的问题的解决方案时，我正在添加问题的答案。我只是在这里添加他的解释，它可能对参与此事件的任何其他人有用。再次感谢你！

[2021 年 4 月 13 日 12:31]

我找到了需要在两个 EDR 的接口之一上添加虚拟 MAC 地址的解决方案。

请找到我的示例的附件，Solution.pptx，虚拟 MAC 需要添加在两个 EDR-810 的同一 VLAN 上，例如在两个 VLAN91 上，添加虚拟 MAC 00:90:e8:00:00:01 &每个 EDR 上的 02。

使用此配置，两台笔记本电脑之间的通信将继续，而不会丢失数据包。

我测试了配置，它工作得很好。我将解决方案扩展为 3 链路 OSPF 设置，并且可以正确扩展。我发回了配置，询问更多细节，他们给出了非常清楚的解释：

[2021年4月15日18:12]

我检查了你的配置，它们是正确的。

这是EDR-810上的正确配置，因为EDR-810的交换芯片是SVL（Shared VLAN learning mode）
https://forum.huawei.com/enterprise/en/ivl-svl/thread/607910-875

哪里有解释

MAC 地址学习模式包括 IVL 模式和 SVL 模式。IVL，即独立的VLAN学习方式，表示每个VLAN都可以学习MAC地址。另外，每个VLAN的MAC地址表是独立的，同一个MAC地址可以存在于多个VLAN中。SVL即共享VLAN学习模式，表示在一个VLAN中学习到的MAC地址可以与其他VLAN共享，并且该MAC地址在MAC地址表中是唯一的。

在 IVL 模式下，每个 VLAN 都有自己的 MAC 转发表。转发时根据VLAN找到MAC地址，然后根据MAC地址表进行转发。广播数据包在此 VLAN 中转发。在 SVL 模式下，所有 VLAN 共享同一个 MAC 转发表。在转发过程中，根据MAC地址找到出端口，然后端口判断是否允许这个VLAN通过。

如果同一个 MAC 地址在多个 VLAN 中，则应使用 IVL 模式。这种情况下，如果使用SVL方式，业务无法区分VLAN。

应用于我们的案例

每次有新的 OSPF 数据包到达时，MAC 地址都会在 SVL 表中被覆盖 正确的路由 路由失败 正确配置

RSTP 会干扰您对路由链接的设置。

据我从手册中可以看出，EDR-810 无法分离其交换机端口或将它们配置为路由 (L3) 端口。

作为一种解决方法，为每个端口配置一个自己的未标记 VLAN。然后将每个 VLAN 配置为路由端口。在这些端口上也禁用 RSTP - 当只有一个端口时，不会有环路。（无论 VLAN 成员身份如何，RSTP 都会阻止它认为冗余的端口。支持 VLAN 的 STP 需要具有该设备不支持的多个实例的 MSTP。）

这样做之后，您应该不会再遇到任何问题，为使用 OSPF 的冗余路由配置多个端口。

[编辑] 由于使用其他稳定的路由表似乎存在无法解释的、相当长的延迟测试 ping（导致它们超时），我严重怀疑多路径路由引擎或动态更新中存在错误机制。

其它你可能感兴趣的问题
上一篇通过 VRF 的 Cisco IOS 流量 下一篇具有外部托管服务的网络中子网的优势