Cisco2911双线接入 策略路由web服务器双线访问

环境: 1.电信、联通都是10M光纤接入,固定IP: 电信:121.x.x.x 联通:58.x.x.x 2.域名xxx.com在DNSPOD上做双线解析(电信为默认线路,); 3.内网有一台web服务器需要发布到公网; 4.现在一台Cisco2911 K9路由器3个GB LAN口 5.内网只有一个网段192.168.0.0/24 实现结果: 1.内网用户能正常通过2个出口上网(负载或冗余) 2.外网用户访问web服务器: 一、联通用户访问走联通线路(收集了800多条联通的路由条目); 二、电信和其他任何运营商线路都走电信线路. 下面是配置: version 15.1 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname Router ! boot-start-marker boot-end-marker ! ! enable secret 5 $1$KEex$6XEpUd1oJbZAXjD7LXJok1 ! no aaa new-model clock timezone GMT 8 0 ! no ipv6 cef ip source-route ip cef ! ! ! ! ! no ip domain lookup multilink bundle-name authenticated ! ! crypto pki token default removal timeout 0 ! ! license udi pid CISCO2911/K9 sn FGLXXXXXXX ! ! username XXXXX secret 5 $1$rqjo$xx8MyKYj186xrUeD4CUZ2. ! ! ! ! ! ! interface GigabitEthernet0/0 ip address 192.168.0.X 255.255.255.0 ip nat inside ip virtual-reassembly in duplex auto speed auto ! interface GigabitEthernet0/1 ip address 121.x.x.x 255.255.255.248 ip nat outside ip virtual-reassembly in duplex auto speed auto ! interface GigabitEthernet0/2 ip address 58.x.x.x 255.255.255.248 ip nat outside ip virtual-reassembly in duplex auto speed auto ! ip forward-protocol nd ! no ip http server no ip http secure-server ! ip nat translation tcp-timeout 300 ip nat translation udp-timeout 30 ip nat translation syn-timeout 30 ip nat translation icmp-timeout 30 ip nat pool pool-telecom 121.x.x.113 121.x.x.117 netmask 255.255.255.248 ip nat pool pool-unicom 58.x.x.2 58.x.x.5 netmask 255.255.255.248 ip nat source static tcp 192.168.0.254 8018 58.x.x.x 8018 extendable ip nat source static tcp 192.168.0.254 8018 121.x.x.x 8018 extendable ip nat inside source route-map telecom pool pool-telecom overload ip nat inside source route-map unicom pool pool-unicom overload ip nat inside source static tcp 192.168.0.247 21 58.x.x.x 21 extendable ip nat inside source static tcp 192.168.0.251 80 58.x.x.x 80 extendable ip nat inside source static tcp 192.168.0.254 2020 58.x.x.x 2020 extendable ip nat inside source static tcp 192.168.0.254 8018 58.x.x.x 8018 extendable ip nat inside source static tcp 192.168.0.251 8019 58.x.x.x 8019 extendable ip nat inside source static tcp 192.168.0.246 8080 58.x.x.x 8080 extendable ip nat inside source static tcp 192.168.0.247 21 121.x.x.x 21 extendable ip nat inside source static tcp 192.168.0.251 80 121.x.x.x 80 extendable ip nat inside source static tcp 192.168.0.254 2020 121.x.x.x 2020 extendable ip nat inside source static tcp 192.168.0.254 8018 121.x.x.x 8018 extendable ip nat inside source static tcp 192.168.0.251 8019 121.x.x.x 8019 extendable ip nat inside source static tcp 192.168.0.246 8080 121.x.x.x 8080 extendable ip route 0.0.0.0 0.0.0.0 121.x.x.118 ip route 0.0.0.0 0.0.0.0 58.x.x.1 50 ip route 1.24.0.0 255.248.0.0 58.x.x.1 ip route 1.56.0.0 255.248.0.0 58.x.x.1 ip route 1.188.0.0 255.252.0.0 58.x.x.1 ip route 14.204.0.0 255.254.0.0 58.x.x.1 ..................800多路由条目.............. ! access-list 2001 permit ip 192.168.0.0 0.0.0.255 any ! route-map unicom permit 10 match ip address 2001 match interface GigabitEthernet0/2 set ip next-hop 58.x.x.1 ! route-map telecom permit 10 match ip address 2001 match interface GigabitEthernet0/1 set ip next-hop 121.x.x.118 ! ! ! control-plane ! ! line con 0 logging synchronous login local line aux 0 line vty 0 4 logging synchronous login local transport input all ! scheduler allocate 20000 1000 end Router# 现在结果: 1.内网用户可以正常上网,通过电信、联通都可以出去 2.电信用户、联通用户通过自己运营商的DNS服务器来解析我的网站,正常访问 3.遇到的问题: 一、其它非电信、非联通的运营商可能会用到联通的DNS服务器来解析我的网站,从而就解析到我的联通ip,造成的结果是,用户从联通接口进来,出去时就走电信线路了,造成不能 访问网站的情况。 该如何解决? 二、还有更坑爹的是:有的用户是电信线路,用的是联通dns解析; 有的是联通用户,用电信DNS解析。这样解析出来的地址刚好是交叉的,也不能访问,(真遇到过这样的复杂的用户:小区物业电信、联通宽带叠加,不知道搞了什么策略,联通线路有时出口解析时用到电 信DNS解析的) 这又该如何解决? 纠结啊..................... 以上2个问题该如何解决,还忘各位高手鼎力相助,谢谢!!!!!!! 该问题已经解决! 详情请看12楼!!!!! 问题最终解决,下面是我的配置 web服务器添加双IP,双ip 80 端口分别映射到不同线路,然后用策略路由,指定双IP出去公网的数据到不同ip,即可! 下面是配置信息 Router#show runn Currentconfiguration : 42687 bytes ! ! Noconfiguration change since last restart ! version15.1 继续阅读