Scribd
Upload
24 views31 pages

Kuznetsov Olt

The document discusses multi-WAN routing and VRF concepts in MikroTik RouterOS. It provides configuration examples for setting up dual-WAN routing with separate routing tables and connection marking. It also shows a VRF configuration example to isolate routing instances on a provider edge router.

Uploaded by

Thanawan Boontho
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
24 views31 pages

Kuznetsov Olt

The document discusses multi-WAN routing and VRF concepts in MikroTik RouterOS. It provides configuration examples for setting up dual-WAN routing with separate routing tables and connection marking. It also shows a VRF configuration example to isolate routing instances on a provider edge router.

Uploaded by

Thanawan Boontho
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 31

Multiwan and

routing in
MikroTik ROS v7

MUoM
Mikrotik User Online Meeting

1
Об авторе

• Владимир Кузнецов • С сетями с 2008 года

• Сетевой инженер • 12 лет в провайдере

• Yandex • Строил сети и в аутсорсе, там и настиг меня


MikroTik

• MTCRE
• Telegram @smithy1208

• v.kuznetsov48@ya.ru

MUoM
Mikrotik User online Meeting
2
01
Routing tables

Multiwan - несколько провайдеров с помощью таблиц маршрутизации

MUoM
Mikrotik User Online Meeting
3
Схема
Dualwan

MUoM
Mikrotik User online Meeting
4
Стартовые настройки
# Базовые настройки:

• Интерфейсы в провайдеров добавлены в интерфейс /interface ethernet


лист WAN set [ find default-name=ether1 ] comment=ISP1
set [ find default-name=ether2 ] comment=ISP2
• Развешаны IP
/interface list
• Включен masquerading для WAN add name=WAN

/interface list member


add interface=ether1 list=WAN
add interface=ether2 list=WAN

/ip address
add address=198.51.100.6/29 interface=ether1
add address=203.0.113.6/29 interface=ether2
add address=192.168.88.254/24 interface=br-lan

/ip firewall nat


add action=masquerade chain=srcnat out-interface-list=WAN

MUoM
Mikrotik User online Meeting
5
# Создать дополнительные роутинг таблицы
Routing [admin@MikroTik] > /routing/table/export terse

tables
# dec/11/2021 00:50:35 by RouterOS 7.1
# software id =
#
/routing table add disabled=no fib name=rtab-1
/routing table add disabled=no fib name=rtab-2

MUoM
Mikrotik User online Meeting
6
# Добавить дефолты в новые таблицы

Route [admin@MikroTik] /ip/route> export terse


# dec/11/2021 00:59:52 by RouterOS 7.1

defaults # software id =
#
/ip route add distance=251 gateway=198.51.100.1
/ip route add distance=252 gateway=203.0.113.1
/ip route add gateway=198.51.100.1 routing-table=rtab-1
/ip route add gateway=203.0.113.1 routing-table=rtab-2

MUoM
Mikrotik User online Meeting
7
Маркировки (mangle)
# Добавить маркировки

[admin@MikroTik] /ip/firewall/mangle> export


# dec/11/2021 01:07:11 by RouterOS 7.1
# software id =
#
/ip firewall mangle
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=ether1 new-connection-mark=con-isp1
passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=ether2 new-connection-mark=con-isp2
passthrough=yes
add action=mark-routing chain=prerouting connection-mark=con-isp1 in-interface-list=!WAN new-routing-mark=rtab-1
passthrough=yes
add action=mark-routing chain=prerouting connection-mark=con-isp2 in-interface-list=!WAN new-routing-mark=rtab-2
passthrough=yes
add action=mark-routing chain=output connection-mark=con-isp1 new-routing-mark=rtab-1 passthrough=yes
add action=mark-routing chain=output connection-mark=con-isp2 new-routing-mark=rtab-2 passthrough=yes

# При таких маркировках будут работать оба провайдера.


# DST-NAT так же будет работать.

MUoM
Mikrotik User online Meeting
8
# Отказоустойчивость через рекурсивные маршруты

Route [admin@MikroTik] /ip/route> export


# dec/11/2021 01:28:53 by RouterOS 7.1

Recursive
# software id =
#
/ip route

failover add distance=251 gateway=198.51.100.1


add distance=252 gateway=203.0.113.1
add gateway=198.51.100.1 routing-table=rtab-1
add gateway=203.0.113.1 routing-table=rtab-2
add dst-address=4.2.2.1/32 gateway=198.51.100.1 scope=11
add dst-address=4.2.2.2/32 gateway=203.0.113.1 scope=11
add check-gateway=ping distance=10 gateway=4.2.2.1 target-
scope=11
add check-gateway=ping distance=20 gateway=4.2.2.2 target-
scope=11

MUoM
Mikrotik User online Meeting
9
Route recursive

MUoM
Mikrotik User online Meeting
10
Route recursive. Fail ISP1

MUoM
Mikrotik User online Meeting
11
Check
## log check gateway ISP1
10:29:41 forward: proto ICMP (type 8, code 0), 198.51.100.6->4.2.2.1,

gateway 10:29:51 forward: proto ICMP (type 8, code 0), 198.51.100.6->4.2.2.1,


10:30:01 forward: proto ICMP (type 8, code 0), 198.51.100.6->4.2.2.1,
10:30:11 forward: proto ICMP (type 8, code 0), 198.51.100.6->4.2.2.1,
10:30:21 forward: proto ICMP (type 8, code 0), 198.51.100.6->4.2.2.1,
10:30:31 forward: proto ICMP (type 8, code 0), 198.51.100.6->4.2.2.1,

MUoM
Mikrotik User online Meeting
12
02
VRF изолированный!

Закрою гештальт с MUM 2019 https://clck.ru/ZRYyM


слайды 17-21

MUoM
Mikrotik User Online Meeting
13
Схема VRF

MUoM
Mikrotik User online Meeting
14
PE
[admin@PE] > export
# dec/13/2021 11:18:15 by RouterOS 7.1
# software id =
#
Provider Edge router — /ip vrf
граничный add interfaces=ether3 name=vrf2
маршрутизатор add interfaces=ether2 name=vrf1
/ip address
провайдера add address=192.168.2.1/30 interface=ether2 network=192.168.2.0
add address=192.168.2.6/30 interface=ether3 network=192.168.2.4
/ip dhcp-client
add interface=ether1
/system identity
set name=PE

MUoM
Mikrotik User online Meeting
15
[admin@CE6] > export
# dec/13/2021 11:15:17 by RouterOS 6.46.8
# software id =
#
#
#
/ip address
add address=192.168.2.2/30 interface=ether1 network=192.168.2.0
/ip route

CE6
add distance=1 gateway=192.168.2.1
/system identity
set name=CE6
Customer Edge router — [admin@CE6] >
граничный маршрутизатор [admin@CE6] > ping count=2 192.168.2.1
клиента, который SEQ HOST SIZE TTL TIME STATUS
0 192.168.2.1 56 64 5ms
подключен в сеть 1 192.168.2.1 56 64 3ms
провайдера. sent=2 received=2 packet-loss=0% min-rtt=3ms avg-rtt=4ms max-rtt=5ms

[admin@CE6] > ping count=2 192.168.2.6


SEQ HOST SIZE TTL TIME STATUS
0 192.168.2.1 84 64 3ms net unreachable
1 192.168.2.1 84 64 3ms net unreachable
sent=2 received=0 packet-loss=100%

[admin@CE6] > ping count=2 192.168.2.5


SEQ HOST SIZE TTL TIME STATUS
0 192.168.2.1 84 64 3ms net unreachable
1 192.168.2.1 84 64 3ms net unreachable
MUoM sent=2 received=0 packet-loss=100%
Mikrotik User online Meeting
16
[admin@CE7] > /export
# dec/13/2021 10:59:34 by RouterOS 6.46.8
# software id =
#
#
#
/ip address
add address=192.168.2.5/30 interface=ether1 network=192.168.2.4

CE7 /ip route


add distance=1 gateway=192.168.2.6
/system identity
Customer Edge router — set name=CE7
граничный маршрутизатор
клиента, который [admin@CE7] > /ping count=2 192.168.2.6
подключен в сеть SEQ HOST SIZE TTL TIME STATUS
провайдера. 0 192.168.2.6 56 64 2ms
1 192.168.2.6 56 64 2ms
sent=2 received=2 packet-loss=0% min-rtt=2ms avg-rtt=2ms max-rtt=2ms

[admin@CE7] > /ping count=2 192.168.2.1


SEQ HOST SIZE TTL TIME STATUS
0 192.168.2.6 84 64 2ms net unreachable
1 192.168.2.6 84 64 2ms net unreachable
sent=2 received=0 packet-loss=100%

[admin@CE7] > /ping count=2 192.168.2.2


SEQ HOST SIZE TTL TIME STATUS

MUoM 0 192.168.2.6
1 192.168.2.6
84 64 2ms
84 64 5ms
net unreachable
net unreachable
Mikrotik User online Meeting sent=2 received=0 packet-loss=100% 17
03
VRF "route leaking"

vrf-lite and "route leaking"

MUoM
Mikrotik User Online Meeting
18
[admin@PE] > /export
# dec/13/2021 11:29:48 by RouterOS 7.1
# software id =

PE
#
/ip vrf
add interfaces=ether2 name=vrf1
"route leaking" add interfaces=ether3 name=vrf2
/ip address
add address=192.168.2.1/30 interface=ether2 network=192.168.2.0
add address=192.168.2.6/30 interface=ether3 network=192.168.2.4
/ip dhcp-client
add interface=ether1

/ip route
add distance=1 dst-address=192.168.2.4/30 gateway=ether3@vrf2 routing-table=vrf1
add distance=1 dst-address=192.168.2.0/30 gateway=ether2@vrf1 routing-table=vrf2

/system identity
set name=PE

MUoM
Mikrotik User online Meeting
19
[admin@CE6] > /export
# dec/13/2021 11:37:58 by RouterOS 6.46.8
# software id =
#
#
#
/ip address
add address=192.168.2.2/30 interface=ether1 network=192.168.2.0

CE6
/ip route
add distance=1 gateway=192.168.2.1
/system identity
set name=CE6
"route leaking"
[admin@CE6] > ping count=2 192.168.2.1
SEQ HOST SIZE TTL TIME STATUS
0 192.168.2.1 56 64 4ms
1 192.168.2.1 56 64 2ms
sent=2 received=2 packet-loss=0% min-rtt=2ms avg-rtt=3ms max-rtt=4ms

[admin@CE6] > ping count=2 192.168.2.6


SEQ HOST SIZE TTL TIME STATUS
0 192.168.2.6 timeout
1 192.168.2.6 timeout
sent=2 received=0 packet-loss=100%

[admin@CE6] > ping count=2 192.168.2.5


SEQ HOST SIZE TTL TIME STATUS
0 192.168.2.5 56 63 8ms

MUoM 1 192.168.2.5 56 63 7ms


sent=2 received=2 packet-loss=0% min-rtt=7ms avg-rtt=7ms max-rtt=8ms
Mikrotik User online Meeting
20
04
VRF management

MUoM
Mikrotik User Online Meeting
21
[admin@PE] /ip/service> set ssh vrf=vrf1

PE [admin@PE] /ip/service> pri


Flags: X, I - INVALID
Columns: NAME, PORT, CERTIFICATE, VRF
vrf management # NAME PORT CERTIFICATE VRF
0 X telnet 23 main
1 X ftp 21
2 X www 80 main
3 ssh 22 vrf1
4 X www-ssl 443 none main
5 X api 8728 main
6 winbox 8291 main
7 X api-ssl 8729 none main

MUoM
Mikrotik User online Meeting
22
[admin@CE6] > sys ssh 192.168.2.1
password:

MMM MMM KKK TTTTTTTTTTT KKK


MMMM MMMM KKK TTTTTTTTTTT KKK
vrf management MMM MMMM MMM III KKK KKK RRRRRR OOOOOO TTT III KKK KKK
MMM MM MMM III KKKKK RRR RRR OOO OOO TTT III KKKKK
MMM MMM III KKK KKK RRRRRR OOO OOO TTT III KKK KKK
Route leaks не помогли MMM MMM III KKK KKK RRR RRR OOOOOO TTT III KKK KKK

MikroTik RouterOS 7.1 (c) 1999-2021 https://www.mikrotik.com/

Press F1 for help

[admin@PE] >

[admin@CE7] > sys ssh 192.168.2.6


connectHandler: Connection refused

Welcome back!

# Route leaks не помогли.

MUoM
Mikrotik User online Meeting
23
05
VRF vpn

MUoM
Mikrotik User Online Meeting
24
VRF ####################

RD & RT # vrf vpn


####################

[admin@PE] /routing/bgp/vpn> add


copy-from export-route-targets label-allocation-policy vrf
disabled import-filter redistribute
export-filter import-route-targets route-distinguisher

MUoM
Mikrotik User online Meeting
25
06
VRF internet

MUoM
Mikrotik User Online Meeting
26
Схема
Dualwan

MUoM
Mikrotik User online Meeting
27
VRF internet
/ip vrf
add interfaces=ether1 name=vrf1
add interfaces=ether2 name=vrf2

/ip address
add address=10.51.100.6/29 interface=ether1
add address=10.51.100.6/29 interface=ether2

/ip route
add check-gateway=ping distance=251 dst-address=0.0.0.0/0 gateway=10.51.100.1@vrf1 routing-table=main
add check-gateway=ping distance=252 dst-address=0.0.0.0/0 gateway=10.51.100.1@vrf2 routing-table=main
add dst-address=192.168.88.0/24 gateway=br-lan routing-table=vrf1
add dst-address=192.168.88.0/24 gateway=br-lan routing-table=vrf2

Без маркировок

MUoM
Mikrotik User online Meeting
28
VRF internet

MUoM
Mikrotik User online Meeting
29
Ссылки

- https://habr.com/ru/post/463813/

- СДСМ MPLS L3VPN


https://habr.com/post/273679/

- MUM 2019 (mikrotik mpls)


https://clck.ru/ZRYyM

MUoM
Mikrotik User online Meeting
30
Спасибо за внимание!
Буду рад ответить на все ваши
вопросы сейчас или свяжитесь
со мной в будущем:

Telegram @smithy1208
v.kuznetsov48@ya.ru

← Конфиги

MUoM
Mikrotik User Online Meeting
31

You might also like

pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy