DMVPN的实验模拟与分析

此篇博客正在介绍的是下图中的DMVPN：

为什么会出现DMVPN这个技术呢？

在这篇博客中https://www.cnblogs.com/huwentao/p/9355240.html介绍过Dynamic P2P GRE OVER VPN的技术，DMVPN的出现就是为了解决Dynamic P2P GRE OVER VPN技术的缺陷的。对于一个公司而言，总部的VPN路由器是相当重要的，因此一旦总部的路由器配置完成之后，无论公司是如何发展的，我们都要尽量的避免总部路由器的变更，但是Dynamic P2P GRE OVER VPN技术却有以下缺陷，如下图中的配置，在我们设置隧道目的地址的时候，需要在分部路由器上面设置一个环回接口，这也就代表着当分部路由器增加一台，我们就要再设置一个GRE tunnel去匹配。因此DMVPN出现了。接下来看一下DMVPN是怎么配置的吧。

拓扑结构图如下：

拓扑图描述：用IOU3模拟公网INTERNET，并且作为一台DHCP服务器给IOU5和IOU4分配动态的地址，现在要实现的是通过DMVPN技术实现总部和分部的路由交换和互通。总部的路由器一般被成为hub端，分部的被称为spoke端。

步骤一：基础网络配置：

IOU1的配置：

IOU1#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
IOU1(config-if)#ip add 10.1.1.1 255.255.255.0  配置地址
IOU1(config-if)#no shutdown 
IOU1(config)#ip route 0.0.0.0 0.0.0.0 10.1.1.2  设置默认路由指向10.1.1.2接口

IOU2的配置：

IOU2#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
IOU2(config)#inter e0/0 
IOU2(config-if)#ip add 10.1.1.2 255.255.255.0 
IOU2(config-if)#no shutdown 
IOU2(config-if)#inter e0/1
IOU2(config-if)#ip add 23.1.1.1 255.255.255.0 
IOU2(config-if)#no shutdown 
IOU2(config)#ip route 0.0.0.0 0.0.0.0 23.1.1.2 

IOU3的配置：

IOU3#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
IOU3(config)#inter e0/1 
IOU3(config-if)#ip add 25.1.1.2 255.255.255.0 
IOU3(config-if)#no shutdown 
IOU3(config-if)#inter e0/2 
IOU3(config-if)#ip add 24.1.1.1 255.255.255.0 
IOU3(config-if)#no shutdown 
IOU3(config-if)#inter e0/0 
IOU3(config-if)#ip add 23.1.1.2 255.255.255.0 
IOU3(config-if)#no shutdown 
IOU3(config-if)#exit
IOU3(config)#ip dhcp pool 24DHCP    设置动态的地址池，名字为24DHCP
IOU3(dhcp-config)#network 24.1.1.0 255.255.255.0   地址池的地址范围
IOU3(dhcp-config)#default-router 24.1.1.1      设置分发地址的默认网关地址
IOU3(dhcp-config)#exit
IOU3(config)#ip dhcp pool 25DHCP
IOU3(dhcp-config)#network 25.1.1.0 255.255.255.0
IOU3(dhcp-config)#default-router 25.1.1.2
IOU3(dhcp-config)#exit
IOU3(config)#ip dhcp excluded-address 24.1.1.1     　　除去默认网关的地址，其余地址可以分配
IOU3(config)#ip dhcp excluded-address 25.1.1.2

IOU4的配置：

IOU4#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
IOU4(config-if)#ip address dhcp    设置接口地址通过dhcp服务器获取
IOU4(config-if)#no shutdown 
IOU4(config-if)#
*Jul 24 00:55:56.952: %DHCP-6-ADDRESS_ASSIGN: Interface Ethernet0/0 assigned DHCP address 25.1.1.3, mask 255.255.255.0, hostname IOU4
IOU4(config-if)#inte lo0 
IOU4(config-if)#ip add 192.168.2.1 255.255.255.0 
IOU4(config-if)#no shutdown 

IOU5的配置：　　

IOU5#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
IOU5(config-if)#inter e0/0 
IOU5(config-if)#ip address dhcp 
IOU5(config-if)#no shutdown 
*Jul 24 00:58:56.869: %DHCP-6-ADDRESS_ASSIGN: Interface Ethernet0/0 assigned DHCP address 24.1.1.3, mask 255.255.255.0, hostname IOU5
IOU5(config-if)#inter lo0 
IOU5(config-if)#ip add 192.168.1.1 255.255.255.0 
IOU5(config-if)#no shutdown 
IOU5(config-if)#exit

测试网络：

IOU2 ping 24.1.1.3  和 ping  25.1.1.3 是可以ping通的，但是ping 192.168.1.1 和ping 192.168.2.1 是不通的

IOU2#ping 24.1.1.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 24.1.1.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/6/8 ms
IOU2#ping 25.1.1.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 25.1.1.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 5/5/6 ms
IOU2#ping 192.168.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
UUUUU
Success rate is 0 percent (0/5)
IOU2#ping 192.168.2.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.2.1, timeout is 2 seconds:
UUUUU
Success rate is 0 percent (0/5)
IOU2#

步骤二：IPSEC配置

对于IOU2, IOU4, IOU5而言，它的IIPSEC的配置都是一样的。

IOU2的配置：

IOU2#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
IOU2(config)#crypto isakmp policy 10   配置ike策略
IOU2(config-isakmp)#encryption 3des   加密算法
IOU2(config-isakmp)#group 1   密钥交换算法
IOU2(config-isakmp)#hAsh md5     hash算法
IOU2(config-isakmp)#authentication pre-share    设置认证方法为预共享密钥 
IOU2(config-isakmp)#exit
IOU2(config)#crypto isakmp key 0 huwentao address 0.0.0.0    设置密钥，因为是动态的，所以address地址为  0.0.0.0 
IOU2(config)#crypto ipsec transform-set IPSEC esp-3des esp-md5-hmac 
IOU2(cfg-crypto-trans)#exit
IOU2(config)#crypto ipsec profile IPSEC_PROFILE        设置ipsec profile对隧道进行加密
IOU2(ipsec-profile)#set transform-set IPSEC
IOU2(ipsec-profile)#EXIT

IOU4的配置（和IOU2配置是一样的）：

IOU2(config)#crypto isakmp policy 10 
IOU2(config-isakmp)#encryption 3des 
IOU2(config-isakmp)#group 1
IOU2(config-isakmp)#hAsh md5 
IOU2(config-isakmp)#authentication pre-share 
IOU2(config-isakmp)#exit
IOU2(config)#crypto isakmp key 0 huwentao address 0.0.0.0
IOU2(config)#crypto ipsec transform-set IPSEC esp-3des esp-md5-hmac 
IOU2(cfg-crypto-trans)#exit
IOU2(config)#crypto ipsec profile IPSEC_PROFILE
IOU2(ipsec-profile)#set transform-set IPSEC
IOU2(ipsec-profile)#EXIT　　

IOU5的配置（和IOU2的配置是一样的）：

IOU2(config)#crypto isakmp policy 10 
IOU2(config-isakmp)#encryption 3des 
IOU2(config-isakmp)#group 1
IOU2(config-isakmp)#hAsh md5 
IOU2(config-isakmp)#authentication pre-share 
IOU2(config-isakmp)#exit
IOU2(config)#crypto isakmp key 0 huwentao address 0.0.0.0 
IOU2(config)#crypto ipsec transform-set IPSEC esp-3des esp-md5-hmac 
IOU2(cfg-crypto-trans)#exit
IOU2(config)#crypto ipsec profile IPSEC_PROFILE
IOU2(ipsec-profile)#set transform-set IPSEC
IOU2(ipsec-profile)#EXIT

　　

步骤三：GRE隧道配置 

隧道的设置一定要注意的是几个地址的配置

IOU2的配置(隧道地址为1.1.1.1)：

IOU2(config)#inter tunnel 1 
*Jul 24 02:08:30.478: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed 
IOU2(config-if)#ip address 1.1.1.1 255.255.255.0       设置隧道地址为1.1.1.1
IOU2(config-if)#tunnel source e0/1        　　  设置隧道源地址为它的出接口e0/1，因为是MGRE，所以是不用设置隧道的目的地址的
IOU2(config-if)#tunnel mode gre multipoint      设置隧道的模式为MGRE
IOU2(config-if)#tunnel protection ipsec profile IPSEC_PROFILE     在隧道上应用IPSEC profile对隧道进行加密
IOU2(config-if)#
*Jul 24 02:10:39.273: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON
IOU2(config-if)#bandwidth 1000          设置接口的带宽，从而影响路由协议的距离的计算（不更改其实也是可以的），所有节点都要一致
IOU2(config-if)#ip  mtu 1400          更改mtu的值为1400，如果不更改，下一跳路由器会对数据包进行分片和重新封装，所有节点都要一致
IOU2(config-if)#ip nhrp authentication huwentao    设置nhrp的认证密码，所有节点的密码都要一致
IOU2(config-if)#ip nhrp network-id  1     设置nhrp的网络id，相当于启用了nhrp，所有节点要一致
IOU2(config-if)#ip nhrp map multicast dynamic 自动的将spoke的地址值加入到hub中   
IOU2(config-if)#no ip  split-horizon eigrp 1　关掉水平分割，使得两个分部的路由可以交换

IOU4的配置：

IOU4(config)#inter tunnel 1 
IOU4(config-if)#ip ad
*Jul 24 02:28:25.190: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to down
IOU4(config-if)#ip add 1.1.1.4 255.255.255.0 
IOU4(config-if)#tunnel source e0/0 
IOU4(config-if)#tunnel mode gre multipoint 
IOU4(config-if)#tunnel protection ipsec profile IPSEC_PROFILE 
IOU4(config-if)#no ip split-horizon eigrp 1 
IOU4(config-if)#bandwidth 1000
IOU4(config-if)#ip mtu 1400
IOU4(config-if)#ip nhrp authentication huwentao
IOU4(config-if)#ip nhrp map 1.1.1.1 23.1.1.1     设置hub端的隧道地址和源地址的映射，1.1.1.1是IOU2的隧道地址，23.1.1.1为IOU2的出接口的地址
IOU4(config-if)#ip nhrp map multicast 23.1.1.1    开启组播功能，以及动态路由协议的功能，hub端的地址为23.1.1.1
IOU4(config-if)#ip nhrp network-id 1
IOU4(config-if)#ip nhrp nhs 1.1.1.1    这个地址一定注意，是hub端的隧道地址，也就是IOU2的隧道地址（我在这个地方掉进过一次，排查了好长时间才发现原来是这个地方配置错了）

IOU5的配置（和IOU4的配置是一样的，只是隧道的地址改一下就可以了）：

IOU4(config)#inter tunnel 1 
IOU4(config-if)#ip ad
*Jul 24 02:28:25.190: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to down
IOU4(config-if)#ip add 1.1.1.5 255.255.255.0    配置隧道的地址
IOU4(config-if)#tunnel source e0/0 
IOU4(config-if)#tunnel mode gre multipoint 
IOU4(config-if)#tunnel protection ipsec profile IPSEC_PROFILE 
IOU4(config-if)#no ip split-horizon eigrp 1 
IOU4(config-if)#bandwidth 1000
IOU4(config-if)#ip mtu 1400
IOU4(config-if)#ip nhrp authentication huwentao
IOU4(config-if)#ip nhrp map 1.1.1.1 23.1.1.1
IOU4(config-if)#ip nhrp map multicast 23.1.1.1
IOU4(config-if)#ip nhrp network-id 1
IOU4(config-if)#ip nhrp nhs 1.1.1.1

　　

 查看IOU2 ping 1.1.1.4 和ping 1.1.1.5都是可以ping通的，说明MGRE隧道已经建立成功：

IOU2#ping 1.1.1.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.4, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 5/5/6 ms
IOU2#ping 1.1.1.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 6/13/16 ms
IOU2#

查看IOU2 show  ip  nhrp发现有1.1.1.4和1.1.1.5对应的接口地址信息

IOU2#show ip nhrp 
1.1.1.4/32 via 1.1.1.4
   Tunnel1 created 00:06:01, expire 01:54:00
   Type: dynamic, Flags: unique registered 
   NBMA address: 25.1.1.4 
1.1.1.5/32 via 1.1.1.5
   Tunnel1 created 00:05:54, expire 01:54:06
   Type: dynamic, Flags: unique registered 
   NBMA address: 24.1.1.2 

查看IOU2 show crypto isakmp peers 发现有两个对等体已经建立成功，已经sa也已经建立成功。

IOU2#show crypto isakmp peers 
Peer: 24.1.1.2 Port: 500 Local: 23.1.1.1
 Phase1 id: 24.1.1.2
Peer: 25.1.1.4 Port: 500 Local: 23.1.1.1
 Phase1 id: 25.1.1.4
IOU2#show crypto isakmp sa    
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
23.1.1.1        24.1.1.2        QM_IDLE           1006 ACTIVE
23.1.1.1        25.1.1.4        QM_IDLE           1005 ACTIVE

IPv6 Crypto ISAKMP SA

IOU2#

查看IOU2 show crypto ipsec sa 发现有两个sa分别是和IOU4和IOU5建立的。

IOU2#SHOW crypto ipsec sa

interface: Tunnel1
    Crypto map tag: Tunnel1-head-0, local addr 23.1.1.1  

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (23.1.1.1/255.255.255.255/47/0)
   remote ident (addr/mask/prot/port): (24.1.1.2/255.255.255.255/47/0) 代表的是和24.1.1.2建立了ipsec sa用来加密数据。
   current_peer 24.1.1.2 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 8, #pkts encrypt: 8, #pkts digest: 8
    #pkts decaps: 8, #pkts decrypt: 8, #pkts verify: 8
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 23.1.1.1, remote crypto endpt.: 24.1.1.2
     plaintext mtu 1446, path mtu 1500, ip mtu 1500, ip mtu idb (none)
     current outbound spi: 0xFC42BCA6(4232232102)
     PFS (Y/N): N, DH group: none

     inbound esp sas:
      spi: 0x55EA3DDB(1441414619)
        transform: esp-3des esp-md5-hmac ,
        in use settings ={Tunnel, }
        conn id: 15, flow_id: SW:15, sibling_flags 80000040, crypto map: Tunnel1-head-0
        sa timing: remaining key lifetime (k/sec): (4284915/2516)
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE(ACTIVE)

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0xFC42BCA6(4232232102)
        transform: esp-3des esp-md5-hmac ,  定义的ipsec的交换集
        in use settings ={Tunnel, }     定义的ipsec的加密模式
        conn id: 16, flow_id: SW:16, sibling_flags 80000040, crypto map: Tunnel1-head-0
        sa timing: remaining key lifetime (k/sec): (4284915/2516)
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE(ACTIVE)
          
     outbound ah sas:

     outbound pcp sas:

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (23.1.1.1/255.255.255.255/47/0)
   remote ident (addr/mask/prot/port): (25.1.1.4/255.255.255.255/47/0)代表的是和25.1.1.4建立的ipsec sa，用来加密数据的额
   current_peer 25.1.1.4 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 8, #pkts encrypt: 8, #pkts digest: 8
    #pkts decaps: 8, #pkts decrypt: 8, #pkts verify: 8
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 23.1.1.1, remote crypto endpt.: 25.1.1.4
     plaintext mtu 1446, path mtu 1500, ip mtu 1500, ip mtu idb (none)
     current outbound spi: 0x3D0D283B(1024272443)
     PFS (Y/N): N, DH group: none

     inbound esp sas:
      spi: 0xAFF87D4(184518612)
        transform: esp-3des esp-md5-hmac ,  定义的ipsec交换集
        in use settings ={Tunnel, }
        conn id: 13, flow_id: SW:13, sibling_flags 80000040, crypto map: Tunnel1-head-0
        sa timing: remaining key lifetime (k/sec): (4265113/2510)
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE(ACTIVE)

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0x3D0D283B(1024272443)
        transform: esp-3des esp-md5-hmac ,
        in use settings ={Tunnel, }
        conn id: 14, flow_id: SW:14, sibling_flags 80000040, crypto map: Tunnel1-head-0
        sa timing: remaining key lifetime (k/sec): (4265113/2510)
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE(ACTIVE)

     outbound ah sas:

     outbound pcp sas:        

步骤四：路由交换配置

IOU2的配置：

IOU2(config)#router eigrp 1
IOU2(config-router)#no au
IOU2(config-router)#no auto-summary 
IOU2(config-router)#networ
IOU2(config-router)#network 1.1.1.1 255.255.255.0 
IOU2(config-router)#network
IOU2(config-router)#network 10.1.1.0 255.255.255.0 
IOU2(config-router)#exit

IOU4的配置：

IOU4(config)#router eigrp 1
IOU4(config-router)#no auto-summary 
IOU4(config-router)#network 1.1.1.0 255.255.255.0 
*Jul 24 13:40:34.320: %DUAL-5-NBRCHANGE: EIGRP-IPv4 1: Neighbor 1.1.1.1 (Tunnel1) is up: new adjacency
IOU4(config-router)#network 192.168.2.0 255.255.255.0 
IOU4(config-router)#exit

IOU5的配置：

IOU5(config)#router eigrp 1
IOU5(config-router)#no auto-summary 
IOU5(config-router)#network 1.1.1.0 255.255.255.0 
*Jul 24 13:41:26.047: %DUAL-5-NBRCHANGE: EIGRP-IPv4 1: Neighbor 1.1.1.1 (Tunnel1) is up: new adjacency
IOU5(config-router)#network 192.168.1.0 255.255.255.0 
IOU5(config-router)#

　　

 查看IOU2的eigrp邻居信息和路由表，发现已经能够学习到路由了：

IOU2#show ip eigrp neighbors 
EIGRP-IPv4 Neighbors for AS(1)
H   Address                 Interface              Hold Uptime   SRTT   RTO  Q  Seq
                                                   (sec)         (ms)       Cnt Num
1   1.1.1.5                 Tu1                      13 00:02:19   10   132  0  4
0   1.1.1.4                 Tu1                      13 00:03:10    1   132  0  5
IOU2#show ip ro
IOU2#show ip route  
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override

Gateway of last resort is 23.1.1.2 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 23.1.1.2
      1.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        1.1.1.0/24 is directly connected, Tunnel1
L        1.1.1.1/32 is directly connected, Tunnel1
      10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        10.1.1.0/24 is directly connected, Ethernet0/0
L        10.1.1.2/32 is directly connected, Ethernet0/0
      23.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        23.1.1.0/24 is directly connected, Ethernet0/1
L        23.1.1.1/32 is directly connected, Ethernet0/1
      192.168.1.0/32 is subnetted, 1 subnets
D        192.168.1.1 [90/3968000] via 1.1.1.5, 00:02:30, Tunnel1
      192.168.2.0/32 is subnetted, 1 subnets
D        192.168.2.1 [90/3968000] via 1.1.1.4, 00:03:24, Tunnel1
IOU2#

但是对于IOU4和IOU5只和IOU2建立邻居，因为IOU4和IOU5之间是没有模拟隧道的，所以建立不了eigrp邻居

IOU4#show ip eigrp neighbors 
EIGRP-IPv4 Neighbors for AS(1)
H   Address                 Interface              Hold Uptime   SRTT   RTO  Q  Seq
                                                   (sec)         (ms)       Cnt Num
0   1.1.1.1                 Tu1                      12 00:05:58   13   138  0  6
IOU4#
IOU5#show ip eigrp neighbors  
EIGRP-IPv4 Neighbors for AS(1)
H   Address                 Interface              Hold Uptime   SRTT   RTO  Q  Seq
                                                   (sec)         (ms)       Cnt Num
0   1.1.1.1                 Tu1                      14 00:05:32   17   138  0  6

由于我们关闭了EIGRP的水平分割，因此IOU4和IOU5都有对方的路由：

IOU5#show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override

Gateway of last resort is 24.1.1.1 to network 0.0.0.0

S*    0.0.0.0/0 [254/0] via 24.1.1.1
      1.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        1.1.1.0/24 is directly connected, Tunnel1
L        1.1.1.5/32 is directly connected, Tunnel1
      10.0.0.0/24 is subnetted, 1 subnets
D        10.1.1.0 [90/3865600] via 1.1.1.1, 00:05:39, Tunnel1
      24.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        24.1.1.0/24 is directly connected, Ethernet0/0
L        24.1.1.2/32 is directly connected, Ethernet0/0
      192.168.1.0/32 is subnetted, 1 subnets
C        192.168.1.1 is directly connected, Loopback0
      192.168.2.0/32 is subnetted, 1 subnets
D        192.168.2.1 [90/5248000] via 1.1.1.1, 00:05:39, Tunnel1
IOU5#




IOU4#show ip eigrp neighbors 
EIGRP-IPv4 Neighbors for AS(1)
H   Address                 Interface              Hold Uptime   SRTT   RTO  Q  Seq
                                                   (sec)         (ms)       Cnt Num
0   1.1.1.1                 Tu1                      12 00:05:58   13   138  0  6
IOU4#show ip rout
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override

Gateway of last resort is 25.1.1.2 to network 0.0.0.0

S*    0.0.0.0/0 [254/0] via 25.1.1.2
      1.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        1.1.1.0/24 is directly connected, Tunnel1
L        1.1.1.4/32 is directly connected, Tunnel1
      10.0.0.0/24 is subnetted, 1 subnets
D        10.1.1.0 [90/3865600] via 1.1.1.1, 00:10:02, Tunnel1
      25.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        25.1.1.0/24 is directly connected, Ethernet0/0
L        25.1.1.4/32 is directly connected, Ethernet0/0
      192.168.1.0/32 is subnetted, 1 subnets
D        192.168.1.1 [90/5248000] via 1.1.1.1, 00:08:54, Tunnel1
      192.168.2.0/32 is subnetted, 1 subnets
C        192.168.2.1 is directly connected, Loopback0
IOU4#

测试结果：

IOU2去ping IOU4和IOU5,可以ping 通，中间的被隧道所隐藏:

IOU2#traceroute 192.168.1.1
Type escape sequence to abort.
Tracing the route to 192.168.1.1
VRF info: (vrf in name/id, vrf out name/id)
  1 1.1.1.5 5 msec 5 msec 5 msec


IOU2#traceroute 192.168.2.1
Type escape sequence to abort.
Tracing the route to 192.168.2.1
VRF info: (vrf in name/id, vrf out name/id)
  1 1.1.1.4 5 msec 5 msec 5 msec
IOU2#

IOU4去ping IOU2和IOU5：

IOU4#traceroute 10.1.1.1
Type escape sequence to abort.
Tracing the route to 10.1.1.1
VRF info: (vrf in name/id, vrf out name/id)
  1 1.1.1.1 6 msec 5 msec 2 msec
  2 10.1.1.1 5 msec 6 msec 5 msec

IOU4#traceroute 192.168.1.1
Type escape sequence to abort.
Tracing the route to 192.168.1.1
VRF info: (vrf in name/id, vrf out name/id)
  1 1.1.1.1 5 msec 6 msec 4 msec
  2 1.1.1.1 4 msec 5 msec 5 msec
  3 1.1.1.5 5 msec 5 msec 7 msec
IOU4#

为了不让IOU2进行中转，因此在IOU2上面配置：

IOU2(config)#interface tunnel 1
IOU2(config-if)#no ip next-hop-self eigrp 1
IOU2(config-if)#

重新ping 192.168.1.1就会发现，不在向IOU2进行询问，直接从1.1.1.5发出去了：

Type escape sequence to abort.
Tracing the route to 192.168.1.1
VRF info: (vrf in name/id, vrf out name/id)
  1 1.1.1.5 4 msec 4 msec 5 msec
IOU4#

小小技巧：

配置没有问题，但是就是没有办法ping通的时候：从hub端开始，依次在internet tunnel 【number】下shutdown之后，再重新no  shutdown一下

例如此配置：

操作一：shutdown

先shutdownIOU2
IOU2#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
IOU2(config)#inter
IOU2(config)#interface tu
IOU2(config)#interface tunnel 1
IOU2(config-if)#shutdown


然后shutdown IOU4和IOU5 
IOU4(config)#interface tunnel 1
IOU4(config-if)#shutdown

IOU5(config)#interface tunnel 1
IOU5(config-if)#shutdown

操作二：no shutdown 

先no shutdownIOU2
IOU2#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
IOU2(config)#inter
IOU2(config)#interface tu
IOU2(config)#interface tunnel 1
IOU2(config-if)#no shutdown


然后shutdown IOU4和IOU5 
IOU4(config)#interface tunnel 1
IOU4(config-if)#no shutdown

IOU5(config)#interface tunnel 1
IOU5(config-if)#no  shutdown