在安全防火牆上使用動態路由協定配置DVTI
簡介
本檔案介紹如何在安全防火牆9.20上設定動態虛擬通道介面(DVTI)。
必要條件
- 具有一個帶ASA 9.20或更高版本且具備基本路由配置和IKEV2支援的Cisco安全防火牆，該防火牆用作集線器，具有一個環回介面來模擬本地192.168.9.0/24網路。
- 具有一個帶ASA 9.20或更高版本及基本路由配置和IKEv2支援的Cisco安全防火牆，以分支網路1的方式工作，並且預配置一個環回介面以模擬遠端網路192.168.7.0/24。
需求
- 本文檔中介紹的所有動態路由協定（OSPF、EIGRP和BGP）的一般知識。
- 熟悉思科安全防火牆裝置上的CLI配置。
採用元件
本檔案中的資訊是根據以下軟體版本：
- Cisco Secure Firewall with ASA 9.20或更高版本。
注意：本文中的資訊是根據特定實驗室環境內的裝置所建立。文中使用到的所有裝置皆從已清除（預設）的組態來啟動。如果您的網路運作中，請確保您瞭解任何指令可能造成的影響。
背景資訊
動態虛擬通道介面
動態虛擬通道介面(DVTI)可為遠端存取虛擬私人網路(VPN)提供高度安全且可擴展的連線。
DVTI可用於集中星型配置。這些通道為每個VPN會話提供按需獨立的虛擬接入介面。
1.分支發起與中心的VPN連線的IKE交換請求。
2.中心對分支進行身份驗證。
3.思科安全防火牆管理中心在集線器上分配動態虛擬模板。
4.虛擬模板在集線器上動態生成虛擬訪問介面。對於每個分支的VPN會話，此介面是唯一的。
5.中心與使用虛擬接入介面的輻條建立動態VTI隧道。
6.中心和分支使用動態路由協定(BGP/OSPF/EIGRP)或具有受保護網路功能（多安全關聯VTI）的隧道交換流量。
7.動態VTI的功能與任何其他介面類似，因此，只要隧道處於活動狀態，您就可以應用QoS、防火牆規則、路由協定和其他功能。
8.在HUB裝置和多個遠端/分支站點的多個靜態隧道介面上建立一個DVTI。
在本文中，可以通過DVTI測試BGP、OSPF和EIGRP。
註意：思科安全防火牆在版本7.3上新增了DVTI支援，目前根據思科錯誤ID CSCwe13781，它僅支援一個DVTI。
設定
網路圖表
組態
思科安全防火牆中心配置
配置物理隧道源介面。
interface GigabitEthernet0/0
nameif vlan2820
security-level 100
ip address 10.28.20.98 255.255.255.0 配置IkEv2策略。
crypto ikev2 policy 1
encryption aes-256 aes-192 aes
integrity sha512 sha384 sha256 sha
group 21 20 14
prf sha256
lifetime seconds 86400配置IPSEC策略並將其連線到新的IPSEC配置檔案。
crypto ipsec ikev2 ipsec-proposal VPN-LAB
protocol esp encryption aes-256 aes-192 aes
protocol esp integrity sha-512 sha-256 sha-1
crypto ipsec profile VPN-LAB-PROFILE
set ikev2 ipsec-proposal VPN-LAB
set security-association lifetime seconds 1000
使用以前建立的IPSEC配置檔案配置虛擬模板，並將其分配給為DVTI提供IP地址的環回介面。
注意：虛擬模板用於為按需隧道配置DVTI。
interface Loopback200
nameif DVTI-LOOPBACK
ip address 172.16.17.1 255.255.255.255
interface Virtual-Template1 type tunnel
nameif DVTI-HUB
ip unnumbered DVTI-LOOPBACK
tunnel source interface vlan2820
tunnel mode ipsec ipv4
tunnel protection ipsec profile FMC_IPSEC_PROFILE_2
建立輔助環回介面來模擬來自集線器後OnPREM網路的流量。
注意：如果集線器後面有本地流量，請跳過此步驟。
interface Loopback100
nameif ON-PREM
ip address 192.168.9.1 255.255.255.255配置隧道組。
注意：命令route set interface將DVTI IP地址作為靜態IP地址傳送到對等裝置。
tunnel-group 10.28.20.100 type ipsec-l2l
tunnel-group 10.28.20.100 ipsec-attributes
virtual-template 1
ikev2 remote-authentication pre-shared-key *****
ikev2 local-authentication pre-shared-key *****
ikev2 route set interface在建立隧道的介面上啟用IKEv2。
crypto ikev2 enable vlan2820思科安全防火牆分支配置
配置物理隧道源介面。
interface GigabitEthernet0/0
nameif vlan2820
security-level 100
ip address 10.28.20.100 255.255.255.0 配置IKEv2策略。
crypto ikev2 policy 1
encryption aes-256 aes-192 aes
integrity sha512 sha384 sha256 sha
group 21 20 14
prf sha256
lifetime seconds 86400配置IPSEC策略並將其連線到新的IPSEC配置檔案。
crypto ipsec ikev2 ipsec-proposal VPN-LAB
protocol esp encryption aes-256 aes-192 aes
protocol esp integrity sha-512 sha-256 sha-1
crypto ipsec profile VPN-LAB-PROFILE
set ikev2 ipsec-proposal VPN-LAB
set security-association lifetime seconds 1000
使用之前建立的IPSEC配置檔案配置靜態虛擬隧道介面，並將其分配給提供未編號IP地址的環回介面。
interface Loopback200
nameif VTI-LOOPBACK
ip address 172.16.17.2 255.255.255.255
interface Tunnel2
nameif SVTI-SPOKE-3
ip unnumbered VTI-LOOPBACK
tunnel source interface vlan2820
tunnel destination 10.28.20.98
tunnel mode ipsec ipv4
tunnel protection ipsec profile VPN-LAB-PROFILE建立輔助環回介面來模擬來自分支後LAN-REMOTE-1網路的流量。
interface Loopback100
nameif LAN-REMOTE-1
ip address 192.168.7.1 255.255.255.255配置隧道組。
注意：命令route set interface將SVTI IP地址作為靜態IP地址傳送到對等裝置。
tunnel-group 10.28.20.98 type ipsec-l2l
tunnel-group 10.28.20.98 ipsec-attributes
ikev2 remote-authentication pre-shared-key *****
ikev2 local-authentication pre-shared-key *****
ikev2 route set interface在可以建立隧道的介面上啟用IKEv2。
crypto ikev2 enable vlan2820配置OSPF
集線器配置
注意:Redistribute connected subnets命令用於通過OSPF將OnPREM網路通告到分支。根據設計，再分佈可以不同。
router ospf 1
router-id 172.16.17.1
network 172.16.17.0 255.255.255.0 area 0
log-adj-changes
redistribute connected subnets分支配置
router ospf 1
router-id 172.16.17.2
network 172.16.17.0 255.255.255.0 area 0
log-adj-changes
redistribute connected subnets檢驗OSPF
集線器驗證
ASAV2-hub# show ospf
Routing Process "ospf 1" with ID 172.16.17.1
Start time: 4d23h, Time elapsed: 3d04h
Supports only single TOS(TOS0) routes
Supports opaque LSA
Supports Link-local Signaling (LLS)
Supports area transit capability
Event-log enabled, Maximum number of events: 1000, Mode: cyclic
It is an autonomous system boundary router
Redistributing External Routes from,
connected, includes subnets in redistribution
Router is not originating router-LSAs with maximum metric
Initial SPF schedule delay 5000 msecs
Minimum hold time between two consecutive SPFs 10000 msecs
Maximum wait time between two consecutive SPFs 10000 msecs
Incremental-SPF disabled
Minimum LSA interval 5 secs
Minimum LSA arrival 1000 msecs
LSA group pacing timer 240 secs
Interface flood pacing timer 33 msecs
Retransmission pacing timer 66 msecs
Number of external LSA 5. Checksum Sum 0x39716
Number of opaque AS LSA 0. Checksum Sum 0x0
Number of DCbitless external and opaque AS LSA 0
Number of DoNotAge external and opaque AS LSA 0
Number of areas in this router is 1. 1 normal 0 stub 0 nssa
Number of areas transit capable is 0
External flood list length 0
IETF NSF helper support enabled
Cisco NSF helper support enabled
Reference bandwidth unit is 100 mbps
Area BACKBONE(0)
Number of interfaces in this area is 3 (1 loopback)
Area has no authentication
SPF algorithm last executed 2d04h ago
SPF algorithm executed 10 times
Area ranges are
Number of LSA 2. Checksum Sum 0x1c99f
Number of opaque link LSA 0. Checksum Sum 0x0
Number of DCbitless LSA 0
Number of indication LSA 0
Number of DoNotAge LSA 0
Flood list length 0
ASAV2-hub# show ospf neighbor
Neighbor ID Pri State Dead Time Address Interface
172.16.17.2 0 FULL/ - 0:00:39 172.16.17.2 DVTI-HUB_va11現在，集線器上的路由表顯示了通過OSPF的LAN-REMOTE-1網路。
ASAV2-hub# show route ospf
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, + - replicated route
SI - Static InterVRF, BI - BGP InterVRF
Gateway of last resort is 10.28.20.101 to network 0.0.0.0
O E2 192.168.7.0 255.255.255.255
[110/20] via 172.16.17.2, 2d04h, DVTI-HUB_va11分支驗證
ASAv-spoke-2# show ospf
Routing Process "ospf 1" with ID 172.16.17.2
Start time: 3w3d, Time elapsed: 3d04h
Supports only single TOS(TOS0) routes
Supports opaque LSA
Supports Link-local Signaling (LLS)
Supports area transit capability
Event-log enabled, Maximum number of events: 1000, Mode: cyclic
It is an autonomous system boundary router
Redistributing External Routes from,
connected, includes subnets in redistribution
Router is not originating router-LSAs with maximum metric
Initial SPF schedule delay 5000 msecs
Minimum hold time between two consecutive SPFs 10000 msecs
Maximum wait time between two consecutive SPFs 10000 msecs
Incremental-SPF disabled
Minimum LSA interval 5 secs
Minimum LSA arrival 1000 msecs
LSA group pacing timer 240 secs
Interface flood pacing timer 33 msecs
Retransmission pacing timer 66 msecs
Number of external LSA 4. Checksum Sum 0x37bc8
Number of opaque AS LSA 0. Checksum Sum 0x0
Number of DCbitless external and opaque AS LSA 0
Number of DoNotAge external and opaque AS LSA 0
Number of areas in this router is 1. 1 normal 0 stub 0 nssa
Number of areas transit capable is 0
External flood list length 0
IETF NSF helper support enabled
Cisco NSF helper support enabled
Reference bandwidth unit is 100 mbps
Area BACKBONE(0)
Number of interfaces in this area is 2 (1 loopback)
Area has no authentication
SPF algorithm last executed 2d04h ago
SPF algorithm executed 1 times
Area ranges are
Number of LSA 2. Checksum Sum 0x1fe9a
Number of opaque link LSA 0. Checksum Sum 0x0
Number of DCbitless LSA 0
Number of indication LSA 0
Number of DoNotAge LSA 0
Flood list length 0
ASAv-spoke-2# show ospf neighbor
Neighbor ID Pri State Dead Time Address Interface
172.16.17.1 0 FULL/ - 0:00:34 172.16.17.1 SVTI-SPOKE-3分支上的路由表現在顯示通過OSPF的OnPREM網路。
ASAv-spoke-2# show route ospf
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, + - replicated route
SI - Static InterVRF, BI - BGP InterVRF
Gateway of last resort is 10.28.20.101 to network 0.0.0.0
O E2 192.168.9.1 255.255.255.255
[110/20] via 172.16.17.1, 2d04h, SVTI-SPOKE-3現在，分支LAN-REMOTE-1可以訪問OnPREM。
ASAv-spoke-2# ping LAN-REMOTE-1 192.168.9.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.9.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/10 ms
ASAv-spoke-2# show crypto ipsec sa peer 10.28.20.98 | i cap|iden|spi
local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
#pkts encaps: 9, #pkts encrypt: 9, #pkts digest: 9
#pkts decaps: 9, #pkts decrypt: 9, #pkts verify: 9
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
current outbound spi: 4BC1FF2C
current inbound spi : FB455CB8
spi: 0xFB455CB8 (4215626936)
spi: 0x4BC1FF2C (1271004972)現在，集線器OnPREM能夠到達LAN-REMOTE-1。
ASAV2-hub# ping ON-PREM 192.168.7.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.7.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/10 ms
ASAV2-hub# show crypto ipsec sa peer 10.28.20.100
peer address: 10.28.20.100
interface: DVTI-HUB_va12
Crypto map tag: DVTI-HUB_vtemplate_dyn_map, seq num: 1, local addr: 10.28.20.98
Protected vrf (ivrf): Global
local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
current_peer: 10.28.20.100
#pkts encaps: 15, #pkts encrypt: 15, #pkts digest: 15
#pkts decaps: 15, #pkts decrypt: 15, #pkts verify: 15
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 15, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#TFC rcvd: 0, #TFC sent: 0
#Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: 10.28.20.98/500, remote crypto endpt.: 10.28.20.100/500
path mtu 1500, ipsec overhead 94(44), media mtu 1500
PMTU time remaining (sec): 0, DF policy: copy-df
ICMP error validation: disabled, TFC packets: disabled配置EIGRP
集線器配置：
ASAV2-hub# sh run router
router eigrp 10
network 172.16.17.0 255.255.255.0
redistribute connected分支配置：
ASAv-spoke-2# sh run router
router eigrp 10
network 172.16.17.0 255.255.255.0
redistribute connected
現在，分支LAN-REMOTE-1可以訪問OnPREM。
ASAv-spoke-2# ping LAN-REMOTE-1 192.168.9.1 rep 100
Type escape sequence to abort.
Sending 100, 100-byte ICMP Echos to 192.168.9.1, timeout is 2 seconds:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Success rate is 100 percent (100/100), round-trip min/avg/max = 1/2/10 ms
ASAv-spoke-2# show crypto ipsec sa peer 10.28.20.98 | i cap|iden|spi
local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
#pkts encaps: 102, #pkts encrypt: 102, #pkts digest: 102
#pkts decaps: 102, #pkts decrypt: 102, #pkts verify: 102
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
current outbound spi: 3EED404C
current inbound spi : 646D2C0C
spi: 0x646D2C0C (1684876300)
spi: 0x3EED404C (1055735884)現在，集線器OnPREM能夠到達LAN-REMOTE-1。
ASAV2-hub# ping ON-PREM 192.168.7.1 rep 100
Type escape sequence to abort.
Sending 100, 100-byte ICMP Echos to 192.168.7.1, timeout is 2 seconds:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Success rate is 100 percent (100/100), round-trip min/avg/max = 1/1/10 ms
ASAV2-hub# show crypto ipsec sa peer 10.28.20.100 | i cap|iden|spi
local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
#pkts encaps: 208, #pkts encrypt: 208, #pkts digest: 208
#pkts decaps: 208, #pkts decrypt: 208, #pkts verify: 208
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
current outbound spi: 646D2C0C
current inbound spi : 3EED404C
spi: 0x3EED404C (1055735884)
spi: 0x646D2C0C (1684876300)檢驗EIGRP
集線器驗證：
ASAV2-hub# show eigrp neighbors
EIGRP-IPv4 Neighbors for AS(10)
H Address Interface Hold Uptime SRTT RTO Q Seq
(sec) (ms) Cnt Num
0 172.16.17.2 DVTI-HUB_va12 12 00:02:01 8 200 0 4集線器上的路由表現在通過EIGRP顯示LAN-REMOTE-1網路。
ASAV2-hub# show route eigrp
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, + - replicated route
SI - Static InterVRF, BI - BGP InterVRF
Gateway of last resort is 10.28.20.101 to network 0.0.0.0
D EX 192.168.7.1 255.255.255.255
[170/53760] via 172.16.17.2, 00:05:28, DVTI-HUB_va12分支驗證：
ASAv-spoke-2# show eigrp neighbors
EIGRP-IPv4 Neighbors for AS(10)
H Address Interface Hold Uptime SRTT RTO Q Seq
(sec) (ms) Cnt Num
0 172.16.17.1 SVTI-SPOKE-3 12 00:07:05 34 204 0 3分支上的路由表現在通過EIGRP顯示OnPREM網路。
ASAv-spoke-2# show route eigrp
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, + - replicated route
SI - Static InterVRF, BI - BGP InterVRF
Gateway of last resort is 10.28.20.101 to network 0.0.0.0
D EX 192.168.9.1 255.255.255.255
[170/53760] via 172.16.17.1, 00:07:43, SVTI-SPOKE-3設定BGP
註：當靜態或動態VTI介面與eBGP組合時，如果使用BGP，請確保TTL躍點的值大於1。
集線器配置：
router bgp 100
bgp log-neighbor-changes
bgp bestpath compare-routerid
address-family ipv4 unicast
neighbor 172.16.17.2 remote-as 200
neighbor 172.16.17.2 ebgp-multihop 10
neighbor 172.16.17.2 activate
redistribute connected
no auto-summary
no synchronization
exit-address-family分支配置
router bgp 200
bgp log-neighbor-changes
bgp bestpath compare-routerid
address-family ipv4 unicast
neighbor 172.16.17.1 remote-as 100
neighbor 172.16.17.1 ebgp-multihop 10
neighbor 172.16.17.1 activate
redistribute connected
no auto-summary
no synchronization
exit-address-family驗證BGP
集線器驗證：
ASAV2-hub# show bgp neighbors
BGP neighbor is 172.16.17.2, context single_vf, remote AS 200, external link
BGP version 4, remote router ID 192.168.7.1
BGP state = Established, up for 00:05:28
Last read 00:00:01, last write 00:01:00, hold time is 180, keepalive interval is 60 seconds
Neighbor sessions:
1 active, is not multisession capable (disabled)
Neighbor capabilities:
Route refresh: advertised and received(new)
Four-octets ASN Capability: advertised and received
Address family IPv4 Unicast: advertised and received
Multisession Capability:
Message statistics:
InQ depth is 0
OutQ depth is 0
Sent Rcvd
Opens: 1 1
Notifications: 0 0
Updates: 2 2
Keepalives: 6 6
Route Refresh: 0 0
Total: 9 9
Default minimum time between advertisement runs is 30 seconds
For address family: IPv4 Unicast
Session: 172.16.17.2
BGP table version 7, neighbor version 7/0
Output queue size : 0
Index 1
1 update-group member
Sent Rcvd
Prefix activity: ---- ----
Prefixes Current: 3 3 (Consumes 240 bytes)
Prefixes Total: 3 3
Implicit Withdraw: 0 0
Explicit Withdraw: 0 0
Used as bestpath: n/a 2
Used as multipath: n/a 0
Outbound Inbound
Local Policy Denied Prefixes: -------- -------
Bestpath from this peer: 2 n/a
Total: 2 0
Number of NLRIs in the update sent: max 3, min 0
Address tracking is enabled, the RIB does have a route to 172.16.17.2
Connections established 1; dropped 0
Last reset never
External BGP neighbor may be up to 10 hops away.
Transport(tcp) path-mtu-discovery is enabled
Graceful-Restart is disabled
ASAV2-hub#
ASAV2-hub# sh run router
router bgp 100
bgp log-neighbor-changes
bgp bestpath compare-routerid
address-family ipv4 unicast
neighbor 172.16.17.2 remote-as 200
neighbor 172.16.17.2 ebgp-multihop 10
neighbor 172.16.17.2 activate
redistribute connected
no auto-summary
no synchronization
exit-address-family
!
ASAV2-hub# sh run all router
router bgp 100
bgp log-neighbor-changes
no bgp always-compare-med
no bgp asnotation dot
no bgp bestpath med
bgp bestpath compare-routerid
bgp default local-preference 100
no bgp deterministic-med
bgp enforce-first-as
bgp maxas-limit 0
bgp transport path-mtu-discovery
timers bgp 60 180 0
address-family ipv4 unicast
bgp scan-time 60
bgp nexthop trigger enable
bgp nexthop trigger delay 5
bgp aggregate-timer 30
neighbor 172.16.17.2 remote-as 200
neighbor 172.16.17.2 ebgp-multihop 10
neighbor 172.16.17.2 activate
no bgp redistribute-internal
no bgp soft-reconfig-backup
no bgp suppress-inactive
redistribute connected
distance bgp 20 200 200
no auto-summary
no synchronization
exit-address-family
! 集線器上的路由表現在通過BGP顯示LAN-REMOTE-1網路。
ASAV2-hub# show route bgp
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, + - replicated route
SI - Static InterVRF, BI - BGP InterVRF
Gateway of last resort is 10.28.20.101 to network 0.0.0.0
B 192.168.7.1 255.255.255.255 [20/0] via 172.16.17.2, 00:06:16
分支驗證：
ASAv-spoke-2# show bgp neighbors
BGP neighbor is 172.16.17.1, context single_vf, remote AS 100, external link
BGP version 4, remote router ID 192.168.9.1
BGP state = Established, up for 00:06:59
Last read 00:00:27, last write 00:00:20, hold time is 180, keepalive interval is 60 seconds
Neighbor sessions:
1 active, is not multisession capable (disabled)
Neighbor capabilities:
Route refresh: advertised and received(new)
Four-octets ASN Capability: advertised and received
Address family IPv4 Unicast: advertised and received
Multisession Capability:
Message statistics:
InQ depth is 0
OutQ depth is 0
Sent Rcvd
Opens: 1 1
Notifications: 0 0
Updates: 2 2
Keepalives: 7 8
Route Refresh: 0 0
Total: 10 11
Default minimum time between advertisement runs is 30 seconds
For address family: IPv4 Unicast
Session: 172.16.17.1
BGP table version 9, neighbor version 9/0
Output queue size : 0
Index 1
1 update-group member
Sent Rcvd
Prefix activity: ---- ----
Prefixes Current: 3 3 (Consumes 240 bytes)
Prefixes Total: 3 3
Implicit Withdraw: 0 0
Explicit Withdraw: 0 0
Used as bestpath: n/a 2
Used as multipath: n/a 0
Outbound Inbound
Local Policy Denied Prefixes: -------- -------
Bestpath from this peer: 3 n/a
Total: 3 0
Number of NLRIs in the update sent: max 3, min 0
Address tracking is enabled, the RIB does have a route to 172.16.17.1
Connections established 1; dropped 0
Last reset never
External BGP neighbor may be up to 10 hops away.
Transport(tcp) path-mtu-discovery is enabled
Graceful-Restart is disabled現在，分支上的路由表顯示了通過BGP的OnPREM網路。
ASAv-spoke-2# show route bgp
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, + - replicated route
SI - Static InterVRF, BI - BGP InterVRF
Gateway of last resort is 10.28.20.101 to network 0.0.0.0
B 192.168.9.1 255.255.255.255 [20/0] via 172.16.17.1, 00:09:22疑難排解
要排除OSPF故障，請使用以下調試命令和show命令：
debug ip ospf
debug ip ospf packet
debug ip ospf events
debug ip ospf hello
debug ip ospf adj
show ospf
show ospf neighbor
show ospf interface 要排除EIGRP故障，請使用以下debug和show命令：
debug ip eigrp
debug ip eigrp neighbor
debug ip eigrp notifications
show eigrp
show eigrp
show eigrp interfaces show eigrp neighbors show eigrp topology
若要疑難排解BGP，請使用以下偵錯和show命令：。
debug ip bgp all
debug ip bgp updates
debug ip bgp events
show bgp
show bgp summary
show bgp neighbors 要對IKEv2進行故障排除，請使用以下調試和show命令：
debug crypto ikev2 protocol 255
debug crypto ikev2 platform 255
debug crypto ipsec 255相關資訊
修訂記錄
| 修訂 | 發佈日期 | 意見 |
|---|---|---|
1.0 |
31-Mar-2023 |
初始版本 |
意見