GRE隧道 路由

对端的

对端

1.7  GRE典型配置举例

1.7.1  GRE over IPv4隧道配置举例

1. 组网需求

Device A和Device B分别连接IPv4私有网络Group 1和Group 2。这两个私有网络都使用私网地址，且属于同一个VPN。通过在Device A和Device B之间建立GRE隧道，实现两个私有网络的互联。

2. 组网图

图1-7 GRE over IPv4隧道配置组网图

‌

3. 配置步骤

(1)     配置Device A

# 根据组网图中规划的信息，配置各接口的IP地址，具体配置步骤如下。

<DeviceA> system-view

[DeviceA] interface gigabitethernet 1/2/5/1

[DeviceA-GigabitEthernet1/2/5/1] ip address 10.1.1.1 255.255.255.0

[DeviceA-GigabitEthernet1/2/5/1] quit

请参考以上步骤配置其他接口的IP地址，具体配置步骤略。

# 创建Tunnel0接口，并指定隧道模式为GRE over IPv4隧道。

[DeviceA] interface tunnel 0 mode gre

[DeviceA-Tunnel0] ip address 10.1.2.1 255.255.255.0

[DeviceA-Tunnel0] source 1.1.1.1

[DeviceA-Tunnel0] destination 2.2.2.2

[DeviceA-Tunnel0] quit

# 请根据组网图中规划的信息，配置静态路由，本举例假设下一跳IP地址为1.1.1.2，实际使用中请以具体组网情况为准，具体配置步骤如下。本举例仅以静态路由方式配置路由信息。实际组网中，请根据具体情况选择相应的路由配置方式。

[DeviceA] ip route-static 2.2.2.2 24 1.1.1.2

[DeviceA] ip route-static 10.1.3.0 24 tunnel 0

# 请根据组网图中规划的信息，将接口加入对应的安全域，具体配置步骤如下。

[DeviceA] security-zone name Untrust

[DeviceA-security-zone-Untrust] import interface Tunnel 0

[DeviceA-security-zone-Untrust] import interface gigabitethernet 1/2/5/1

[DeviceA-security-zone-Untrust] quit

[DeviceA] security-zone name Trust

[DeviceA-security-zone-Trust] import interface gigabitethernet 1/2/5/2

[DeviceA-security-zone-Trust] quit

# 配置名称为grelocalout的安全策规则，使Device A可以向Device B发送报文，具体配置步骤如下。

[DeviceA] security-policy ip

[DeviceA-security-policy-ip] rule name grelocalout

[DeviceA-security-policy-ip-1-grelocalout] source-zone local

[DeviceA-security-policy-ip-1-grelocalout] destination-zone untrust

[DeviceA-security-policy-ip-1-grelocalout] source-ip-host 1.1.1.1

[DeviceA-security-policy-ip-1-grelocalout] source-ip-host 10.1.2.1

[DeviceA-security-policy-ip-1-grelocalout] source-ip-host 10.1.1.1

[DeviceA-security-policy-ip-1-grelocalout] destination-ip-host 2.2.2.2

[DeviceA-security-policy-ip-1-grelocalout] destination-ip-host 10.1.2.2

[DeviceA-security-policy-ip-1-grelocalout] destination-ip-host 10.1.3.1

[DeviceA-security-policy-ip-1-grelocalout] action pass

[DeviceA-security-policy-ip-1-grelocalout] quit

# 配置名称为grelocalin的安全策略规则，使Device A可以接收和处理来自Device B的报文，具体配置步骤如下。

[DeviceA-security-policy-ip] rule name grelocalin

[DeviceA-security-policy-ip-2-grelocalin] source-zone untrust

[DeviceA-security-policy-ip-2-grelocalin] destination-zone local

[DeviceA-security-policy-ip-2-grelocalin] source-ip-host 2.2.2.2

[DeviceA-security-policy-ip-2-grelocalin] source-ip-host 10.1.2.2

[DeviceA-security-policy-ip-2-grelocalin] source-ip-host 10.1.3.1

[DeviceA-security-policy-ip-2-grelocalin] destination-ip-host 1.1.1.1

[DeviceA-security-policy-ip-2-grelocalin] destination-ip-host 10.1.2.1

[DeviceA-security-policy-ip-2-grelocalin] destination-ip-host 10.1.1.1

[DeviceA-security-policy-ip-2-grelocalin] action pass

[DeviceA-security-policy-ip-2-grelocalin] quit

[DeviceA-security-policy-ip] quit

(2)     配置Device B

# 根据组网图中规划的信息，配置各接口的IP地址，具体配置步骤如下。

<DeviceB> system-view

[DeviceB] interface gigabitethernet 1/2/5/1

[DeviceB-GigabitEthernet1/2/5/1] ip address 10.1.3.1 255.255.255.0

[DeviceB-GigabitEthernet1/2/5/1] quit

请参考以上步骤配置其他接口的IP地址，具体配置步骤略。

# 创建Tunnel0接口，并指定隧道模式为GRE over IPv4隧道。

[DeviceB] interface tunnel 0 mode gre

[DeviceB-Tunnel0] ip address 10.1.2.2 255.255.255.0

[DeviceB-Tunnel0] source 2.2.2.2

[DeviceB-Tunnel0] destination 1.1.1.1

[DeviceB-Tunnel0] quit

# 请根据组网图中规划的信息，配置静态路由，本举例假设下一跳IP地址为2.2.2.3，实际使用中请以具体组网情况为准，具体配置步骤如下。本举例仅以静态路由方式配置路由信息。实际组网中，请根据具体情况选择相应的路由配置方式。

[DeviceB] ip route-static 1.1.1.1 24 2.2.2.3

[DeviceB] ip route-static 10.1.1.0 24 tunnel 0

# 请根据组网图中规划的信息，将接口加入对应的安全域，具体配置步骤如下。

[DeviceB] security-zone name Untrust

[DeviceB-security-zone-Untrust] import interface Tunnel 0

[DeviceB-security-zone-Untrust] import interface gigabitethernet 1/2/5/1

[DeviceB-security-zone-Untrust] quit

[DeviceB] security-zone name Trust

[DeviceB-security-zone-Trust] import interface gigabitethernet 1/2/5/2

[DeviceB-security-zone-Trust] quit

# 配置名称为grelocalout的安全策规则，使Device B可以向Device A发送报文，具体配置步骤如下。

[DeviceB] security-policy ip

[DeviceB-security-policy-ip] rule 1 name grelocalout

[DeviceB-security-policy-ip-1-grelocalout] source-zone local

[DeviceB-security-policy-ip-1-grelocalout] destination-zone untrust

[DeviceB-security-policy-ip-1-grelocalout] source-ip-host 2.2.2.2

[DeviceB-security-policy-ip-1-grelocalout] source-ip-host 10.1.2.2

[DeviceB-security-policy-ip-1-grelocalout] source-ip-host 10.1.3.1

[DeviceB-security-policy-ip-1-grelocalout] destination-ip-host 1.1.1.1

[DeviceB-security-policy-ip-1-grelocalout] destination-ip-host 10.1.2.1

[DeviceB-security-policy-ip-1-grelocalout] destination-ip-host 10.1.1.1

[DeviceB-security-policy-ip-1-grelocalout] action pass

[DeviceB-security-policy-ip-1-grelocalout] quit

# 配置名称为grelocalin的安全策略规则，使Device B可以接收和处理来自Device A的报文，具体配置步骤如下。

[DeviceB-security-policy-ip] rule name grelocalin

[DeviceB-security-policy-ip-2-grelocalin] source-zone untrust

[DeviceB-security-policy-ip-2-grelocalin] destination-zone local

[DeviceB-security-policy-ip-2-grelocalin] source-ip-host 1.1.1.1

[DeviceB-security-policy-ip-2-grelocalin] source-ip-host 10.1.2.1

[DeviceB-security-policy-ip-2-grelocalin] source-ip-host 10.1.1.1

[DeviceB-security-policy-ip-2-grelocalin] destination-ip-host 2.2.2.2

[DeviceB-security-policy-ip-2-grelocalin] destination-ip-host 10.1.2.2

[DeviceB-security-policy-ip-2-grelocalin] destination-ip-host 10.1.3.1

[DeviceB-security-policy-ip-2-grelocalin] action pass

[DeviceB-security-policy-ip-2-grelocalin] quit

[DeviceB-security-policy-ip] quit