通过FTD中的路由协议通告远程访问VPN子网

下载选项

PDF (1.6 MB)
在各种设备上使用 Adobe Reader 查看
ePub (1.2 MB)
在 iPhone、iPad、Android、Sony Reader 或 Windows Phone 上使用各种应用查看
Mobi (Kindle) (1.2 MB)
在 Kindle 设备上查看或在多个设备上使用 Kindle 应用查看

已更新: 2025 年 5 月 5 日

文档 ID:222994

非歧视性语言

此产品的文档集力求使用非歧视性语言。在本文档集中，非歧视性语言是指不隐含针对年龄、残障、性别、种族身份、族群身份、性取向、社会经济地位和交叉性的歧视的语言。由于产品软件的用户界面中使用的硬编码语言、基于 RFP 文档使用的语言或引用的第三方产品使用的语言，文档中可能无法确保完全使用非歧视性语言。深入了解思科如何使用包容性语言。

关于此翻译

思科采用人工翻译与机器翻译相结合的方式将此文档翻译成不同语言，希望全球的用户都能通过各自的语言得到支持性的内容。请注意：即使是最好的机器翻译，其准确度也不及专业翻译人员的水平。 Cisco Systems, Inc. 对于翻译的准确性不承担任何责任，并建议您总是参考英文原始文档（已提供链接）。

简介

本文档介绍使用路由协议EIGRP、OSPF和BGP通告VPN相关子网的可用选项。

diagram1

先决条件

要求

本文档没有任何特定的要求。

使用的组件

本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始（默认）配置。如果您的网络处于活动状态，请确保您了解所有命令的潜在影响。

本文档中的信息基于以下软件和硬件版本：

思科安全防火墙管理中心7.6.0
思科安全防火墙7.6.0

注意：本文档概述使用FMC通过EIGRP、OSPF和BGP重新分配远程访问VPN子网的配置。有关使用FDM重新分发路由的指南，请参阅FDM配置指南。

背景信息

首先要了解的是FTD如何在其路由表中对VPN子网进行分类。虽然这些子网看起来像通过VPN连接，但是它们不被视为直接连接的子网；相反，它们被视为静态路由。

show输出显示了这一点。

FTD show route输出：

FTD-1# show route

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, + - replicated route
       SI - Static InterVRF, BI - BGP InterVRF
Gateway of last resort is not set

C        10.10.20.0 255.255.255.0 is directly connected, outside
L        10.10.20.1 255.255.255.255 is directly connected, outside
C        192.168.100.0 255.255.255.252 is directly connected, inside
L        192.168.100.2 255.255.255.255 is directly connected, inside
V        10.100.100.10 255.255.255.255 connected by VPN (advertised), outside

FTD show route connected输出：

FTD-1# show route connected

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, + - replicated route
       SI - Static InterVRF, BI - BGP InterVRF

Gateway of last resort is not set

C        10.10.20.0 255.255.255.0 is directly connected, outside
L        10.10.20.1 255.255.255.255 is directly connected, outside
C        192.168.100.0 255.255.255.252 is directly connected, inside
L        192.168.100.2 255.255.255.255 is directly connected, inside

FTD show route static输出：

FTD-HQ-1# show route static

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, + - replicated route
       SI - Static InterVRF, BI - BGP InterVRF

Gateway of last resort is not set

V        10.100.100.10 255.255.255.255 connected by VPN (advertised), outside

现在我们已经清楚如何在防火墙的路由表中处理VPN子网，下一步是探索如何使用各种路由协议通告这些子网。

通过FTD上的EIGRP重新分发远程访问VPN子网

网络图

diagram2

属于network语句范围的静态路由会自动重分发到EIGRP;您不需要为其定义重分发规则。但是，在重分发指向EIGRP中的VTI接口的静态路由时，必须指定度量。对于指向其他类型接口的静态路由，不需要指定度量。

由于EIGRP自动重分发属于network语句范围内的静态路由的行为，因此在FTD上通过EIGRP通告VPN子网有两个选项：

使用network语句
使用redistribute static方法。

在本示例中，目标是让R1通过EIGRP学习VPN子网10.100.100.0/24。

FTD初始配置：

hostname FTD-1
!
ip local pool VPN-POOL1 10.100.100.10-10.100.100.254 mask 255.255.255.0
!
webvpn
...
  group-policy LAB_GROUP1 internal
group-policy LAB_GROUP1 attributes
...
  address-pools value VPN-POOL1
!
router eigrp 100
 no default-information in
 no default-information out
 no eigrp log-neighbor-warnings
 no eigrp log-neighbor-changes
network 192.168.100.0 255.255.255.252

FTD初始路由表：

FTD-1# show route

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, + - replicated route
       SI - Static InterVRF, BI - BGP InterVRF

Gateway of last resort is not set

C        10.10.20.0 255.255.255.0 is directly connected, outside
L        10.10.20.1 255.255.255.255 is directly connected, outside
C        192.168.100.0 255.255.255.252 is directly connected, inside
L        192.168.100.2 255.255.255.255 is directly connected, inside
V       10.100.100.10 255.255.255.255 connected by VPN (advertised), outside

FTD初始EIGRP拓扑表：

FTD-1# show eigrp topology

EIGRP-IPv4 Topology Table for AS(100)/ID(192.168.100.2)
Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
       r - reply Status, s - sia Status

P 192.168.100.0 255.255.255.252, 1 successors, FD is 512 via Connected, inside

R1初始路由表：

R1#show ip route

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, m - OMP
       n - NAT, Ni - NAT inside, No - NAT outside, Nd - NAT DIA
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       H - NHRP, G - NHRP registered, g - NHRP registration summary
       o - ODR, P - periodic downloaded static route, l - LISP  
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR
       & - replicated local route overrides by connected

Gateway of last resort is not set

C        192.168.100.0/30 is directly connected, GigabitEthernet1
L        192.168.100.1/32 is directly connected, GigabitEthernet1

使用network语句通过FTD上的EIGRP重分布远程访问VPN子网

配置

步骤1.为VPN子网创建网络对象。

Network

步骤2.在network语句中包含VPN子网对象。

在FMC设备管理UI中，导航到路由> EIGRP >设置，并在选定的网络/主机中包含VPN子网。

EIGRP1

保存并部署FTD上的配置。

验证

FTD EIGRP配置：

FTD-1# show run router
router eigrp 100
 no default-information in
 no default-information out
 no eigrp log-neighbor-warnings
 no eigrp log-neighbor-changes
 network 10.100.100.0 255.255.255.0
 network 192.168.100.0 255.255.255.252

FTD EIGRP拓扑表：

FTD-1# show eigrp topology

EIGRP-IPv4 Topology Table for AS(100)/ID(192.168.100.2)
Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
       r - reply Status, s - sia Status

P 10.100.100.10 255.255.255.255, 1 successors, FD is 512 
        via Rstatic (512/0)

P 192.168.100.0 255.255.255.252, 1 successors, FD is 512
        via Connected, inside

R1路由表：

R1#show ip route

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, m - OMP
       n - NAT, Ni - NAT inside, No - NAT outside, Nd - NAT DIA
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       H - NHRP, G - NHRP registered, g - NHRP registration summary
       o - ODR, P - periodic downloaded static route, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR
       & - replicated local route overrides by connected


Gateway of last resort is not set

C        192.168.100.0/30 is directly connected, GigabitEthernet1
L        192.168.100.1/32 is directly connected, GigabitEthernet1
      10.0.0.0/32 is subnetted, 1 subnets
D        10.100.100.10
           [90/3072] via 192.168.100.2, 00:02:17, GigabitEthernet1

注意：请注意，虽然network语句是10.100.100.0/24，但FTD通过EIGRP重新分配/32子网。发生这种情况的原因是FTD为每个远程访问VPN会话创建一个带有/32前缀的静态路由。要优化此配置，您可以使用EIGRP汇总地址功能。

使用redistribute static方法通过FTD上的EIGRP重分布远程访问VPN子网

配置

在FMC设备管理UI中，导航到路由> EIGRP >重分发，然后选择添加按钮。

EIGRP2

在协议字段中，选择Static，然后选择OK按钮。

Static

注意：这会将所有静态路由重分发到EIGRP。如果需要只通告VPN子网，可以使用network语句方法或应用路由映射来过滤它们。

结果：

Enable EIGRP

保存并部署FTD上的配置。

验证

FTD EIGRP配置：

FTD-HQ-1# show run router

router eigrp 100
 no default-information in
 no default-information out
 no eigrp log-neighbor-warnings
 no eigrp log-neighbor-changes
 network 192.168.100.0 255.255.255.252
 redistribute static

FTD EIGRP拓扑表：

FTD-1# show eigrp topology
EIGRP-IPv4 Topology Table for AS(100)/ID(192.168.100.2)
Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
       r - reply Status, s - sia Status

P 10.100.100.10 255.255.255.255, 1 successors, FD is 512
        via Rstatic (512/0)
P 192.168.100.0 255.255.255.252, 1 successors, FD is 512
        via Connected, inside

R1路由表：

R1#show ip route

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, m - OMP
       n - NAT, Ni - NAT inside, No - NAT outside, Nd - NAT DIA
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       H - NHRP, G - NHRP registered, g - NHRP registration summary
       o - ODR, P - periodic downloaded static route, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR
       & - replicated local route overrides by connected

Gateway of last resort is not set

C        192.168.100.0/30 is directly connected, GigabitEthernet1
L        192.168.100.1/32 is directly connected, GigabitEthernet1
D EX     10.100.100.10
           [170/3072] via 192.168.100.2, 00:03:52, GigabitEthernet1

提示：或者，您可以使用FTD上的EIGRP汇总地址功能优化路由表的大小。

EIGRP汇总地址配置

配置

如果尚未创建，请为VPN子网创建网络对象。

VPN-Network

在FMC设备管理UI中，导航到路由> EIGRP >摘要地址，然后选择添加按钮。

Advertise

在interface字段中，输入面向EIGRP邻居的对象，在network字段中，输入为VPN子网创建的对象。

inside_VPN-Subnet

结果：

Summary_Address

验证

FTD EIGRP汇总地址配置：

FTD-1# sh run interface

interface GigabitEthernet0/0
 nameif inside
 security-level 0
 zone-member inside
 ip address 192.168.100.2 255.255.255.252
summary-address eigrp 100 10.100.100.0 255.255.255.0

FTD EIGRP拓扑表：

FTD-1# show eigrp topology

EIGRP-IPv4 Topology Table for AS(100)/ID(192.168.100.2)
Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
       r - reply Status, s - sia Status

P 10.100.100.10 255.255.255.255, 1 successors, FD is 512
        via Rstatic (512/0)
P 10.100.100.0 255.255.255.0, 1 successors, FD is 512
        via Summary (512/0), Null0
P 192.168.100.0 255.255.255.0, 1 successors, FD is 512
        via Connected, inside

R1路由表：

R1#show ip route

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, m - OMP
       n - NAT, Ni - NAT inside, No - NAT outside, Nd - NAT DIA
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       H - NHRP, G - NHRP registered, g - NHRP registration summary
       o - ODR, P - periodic downloaded static route, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR
       & - replicated local route overrides by connected

Gateway of last resort is not set

C        192.168.100.0/30 is directly connected, GigabitEthernet1
L        192.168.100.1/32 is directly connected, GigabitEthernet1
      10.0.0.0/24 is subnetted, 1 subnets
D        10.100.100.0 [90/3072] via 192.168.100.2, 00:01:54, GigabitEthernet1

通过FTD上的OSPF重分布远程访问VPN子网

网络图

Diagram3

初始配置

ip local pool VPN-POOL1 10.100.100.10-10.100.100.254 mask 255.255.255.0
!
webvpn
  group-policy LAB_GROUP1 internal
...
group-policy LAB_GROUP1 attributes
...
  address-pools value VPN-POOL1
!
router ospf 1
network 192.168.100.0 255.255.255.252 area 0

FTD show ospf neighbor输出：

FTD-1# show ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
192.168.100.1          1   FULL/DR         0:00:39     192.168.100.1   inside

R1 show ip ospf neighbor输出：

R1#show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
192.168.100.2    1   FULL/BDR        00:00:37    192.168.100.2  GigabitEthernet1

R1路由表：

R1#show ip route

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, m - OMP
       n - NAT, Ni - NAT inside, No - NAT outside, Nd - NAT DIA
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       H - NHRP, G - NHRP registered, g - NHRP registration summary
       o - ODR, P - periodic downloaded static route, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR
       & - replicated local route overrides by connected

Gateway of last resort is not set

C        192.168.100.0/30 is directly connected, GigabitEthernet1
L        192.168.100.1/32 is directly connected, GigabitEthernet1

配置

在FMC设备管理UI中，导航到路由> OSPF >重分发，然后选择添加按钮。

OSPF1

注意：OSPF角色必须设置为ASBR或ABR和ASBR才能启用重分发。

在Route Type字段中，选择Static，然后选中Use Subnets框。

Use_Subnets

注意：这会将所有静态路由重分发到OSPF。如果需要仅通告VPN子网，可以应用路由映射来过滤它们。

结果：

OSPF_Process

验证

FTD OSPF重分发配置：

FTD-1# sh run router
router ospf 1
 network 192.168.100.0 255.255.255.252 area 0
 redistribute static subnets

R1路由表：

R1#show ip route

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, m - OMP
       n - NAT, Ni - NAT inside, No - NAT outside, Nd - NAT DIA
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       H - NHRP, G - NHRP registered, g - NHRP registration summary
       o - ODR, P - periodic downloaded static route, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR
       & - replicated local route overrides by connected

Gateway of last resort is not set

C        192.168.100.0/30 is directly connected, GigabitEthernet1
L        192.168.100.1/32 is directly connected, GigabitEthernet1
      10.0.0.0/32 is subnetted, 1 subnets
O E2     10.100.100.10 [110/20] via 192.168.100.2, 00:08:01, GigabitEthernet1

提示：请注意，虽然VPN池是10.100.100.0/24，但FTD通过OSPF重新分配/32子网。发生这种情况的原因是FTD为每个远程访问VPN会话创建一个带有/32前缀的静态路由。要优化此功能，您可以使用OSPF汇总地址功能。

OSPF摘要地址配置

配置

如果尚未创建，请为VPN子网创建网络对象。

VPN-Subnet2

在FMC设备管理UI中，导航到Routing > OSPF> Summary Address，然后选择Add按钮。

OSPF_Summary

添加VPN子网对象并选中Advertise复选框。

OSPF_Process

结果：

OSPF_Address

验证

FTD OSPF配置：

FTD-1# sh run router

router ospf 1
 network 192.168.100.0 255.255.255.252 area 0
redistribute static subnets
 summary-address 10.100.100.0 255.255.255.0

R1路由表：

R1#sh ip route

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, m - OMP
       n - NAT, Ni - NAT inside, No - NAT outside, Nd - NAT DIA
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       H - NHRP, G - NHRP registered, g - NHRP registration summary
       o - ODR, P - periodic downloaded static route, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR
       & - replicated local route overrides by connected

Gateway of last resort is not set

C        192.168.100.0/30 is directly connected, GigabitEthernet1
L        192.168.100.1/32 is directly connected, GigabitEthernet1
      10.0.0.0/24 is subnetted, 1 subnets
O E2     10.100.100.0 [110/20] via 192.168.100.2, 00:00:26, GigabitEthernet1

通过FTD上的eBGP重新分发远程访问VPN子网

网络图

Diagram5

在本示例中，目标是使R1通过eBGP学习VPN子网10.100.100.0/24。

初始配置

FTD初始配置：

hostname FTD-1
!
ip local pool VPN-POOL1 10.100.100.10-10.100.100.254 mask 255.255.255.0
!
webvpn
...
  group-policy LAB_GROUP1 internal
group-policy LAB_GROUP1 attributes
...
  address-pools value VPN-POOL1
!
router bgp 65000
 bgp log-neighbor-changes
 bgp router-id vrf auto-assign
 address-family ipv4 unicast
  neighbor 192.168.100.1 remote-as 65001
  neighbor 192.168.100.1 transport path-mtu-discovery disable
  neighbor 192.168.100.1 activate
  no auto-summary
  no synchronization
 exit-address-family

FTD bgp表输出：

FTD-1# show bgp

BGP table version is 25, local router ID is 192.168.100.2
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath
Origin codes: i - IGP, e - EGP, ? - incomplete

Network               Next Hop        Metric LocPrf Weight  Path
r> 192.168.100.0/30  192.168.100.1       1             0  65001 ?

FTD show bgp summary输出：

FTD-1# show bgp summary
BGP router identifier 192.168.100.2, local AS number 65000
BGP table version is 25, main routing table version 25
1 network entries using 2000 bytes of memory
17 path entries using 1360 bytes of memory
3/3 BGP path/bestpath attribute entries using 624 bytes of memory
2 BGP AS-PATH entries using 48 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
BGP using 4032 total bytes of memory
BGP activity 176/166 prefixes, 257/240 paths, scan interval 60 secs

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
192.168.100.1  4        65001 4589    3769          25    0    0 2d21h  8

R1 show ip bgp summary输出：

R1#sh ip bgp summary
BGP router identifier 192.168.100.1, local AS number 65001
BGP table version is 258, main routing table version 258
1 network entries using 2480 bytes of memory
1 path entries using 2312 bytes of memory
1/1 BGP path/bestpath attribute entries using 864 bytes of memory
1 BGP AS-PATH entries using 64 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
BGP using 5720 total bytes of memory
BGP activity 85/75 prefixes, 244/227 paths, scan interval 60 secs
12 networks peaked at 11:10:00 Apr 17 2025 UTC (00:06:27.485 ago)

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
192.168.100.2  4        65000    3770    4590      258    0    0 2d21h           9

R1 bgp表输出：

R1#show ip bgp
BGP table version is 258, local router ID is 192.168.100.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
             r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
              x best-external, a additional-path, c RIB-compressed,
              t secondary path, L long-lived-stale,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
       Network          Next Hop            Metric LocPrf Weight Path
 *>   192.168.100.0/30                      0.0.0.0                  1         32768 ?

R1路由表：

R1#show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, m - OMP
       n - NAT, Ni - NAT inside, No - NAT outside, Nd - NAT DIA
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       H - NHRP, G - NHRP registered, g - NHRP registration summary
       o - ODR, P - periodic downloaded static route, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR
       & - replicated local route overrides by connected

Gateway of last resort is not set

C        192.168.100.0/30 is directly connected, GigabitEthernet1
L        192.168.100.1/32 is directly connected, GigabitEthernet1

配置

在FMC设备管理UI中，导航到Routing > BGP > IPv4 > Redistribution，然后选择Add按钮。

IPv4

在源协议字段中，选择静态，然后选择确定按钮。

Source_Static

注意：这会将所有静态路由重分发到BGP。如果需要仅通告VPN子网，可以应用路由映射来过滤它们。

结果：

Redistribution

保存并部署FTD上的配置。

验证

FTD BGP配置：

FTD-HQ-1# show run router
router bgp 65000
 bgp log-neighbor-changes
 bgp router-id vrf auto-assign
 address-family ipv4 unicast
  neighbor 192.168.100.1 remote-as 65001
  neighbor 192.168.100.1 transport path-mtu-discovery disable
  neighbor 192.168.100.1 activate
  redistribute static
  no auto-summary
  no synchronization
 exit-address-family

FTD bgp表输出：

FTD-1# show bgp

BGP table version is 26, local router ID is 192.168.100.2
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath
Origin codes: i - IGP, e - EGP, ? - incomplete
   Network          Next Hop        Metric LocPrf Weight  Path
*> 10.100.100.10/32 10.100.100.10        0         32768  ?
r> 192.168.100.0/30 192.168.100.1      1             0  65001 ?

R1 bgp表输出：

R1#show ip bgp

BGP table version is 259, local router ID is 192.168.100.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
              x best-external, a additional-path, c RIB-compressed,
              t secondary path, L long-lived-stale,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found

     Network          Next Hop            Metric LocPrf Weight Path
 *>   10.100.100.10/32 192.168.100.2           0             0 65000 ?
 *>   192.168.100.0/30  0.0.0.0                 1         32768 ?

R1路由表输出：

R1#show ip route

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, m - OMP
       n - NAT, Ni - NAT inside, No - NAT outside, Nd - NAT DIA
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       H - NHRP, G - NHRP registered, g - NHRP registration summary
       o - ODR, P - periodic downloaded static route, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR
       & - replicated local route overrides by connected

Gateway of last resort is not set

C        192.168.100.0/30 is directly connected, GigabitEthernet1
L        192.168.100.1/32 is directly connected, GigabitEthernet1
      10.0.0.0/32 is subnetted, 1 subnets
B        10.100.100.10 [20/0] via 192.168.100.2, 00:02:00

提示：请注意，虽然VPN池是10.100.100.0/24，但FTD通过BGP重新分配/32子网。发生这种情况的原因是FTD为每个远程访问VPN会话创建一个带有/32前缀的静态路由。要优化此功能，您可以使用BGP汇聚地址功能。

BGP汇聚地址配置

配置

如果尚未创建，请为VPN子网创建网络对象。

Network10

在FMC设备管理UI中，导航到Routing > BGP> IPv4 > Add Aggregate Address，然后选择Add 按钮。

IPv4_Aggregate

在network字段中，添加VPN子网的对象，然后选中Filter all routes from updates复选框。

AS_set_path

注意：如果未选中Filter all routes from updates复选框，则FTD会通过BGP通告汇总地址和特定/32 VPN路由。启用该复选框后，FMC将命令aggregate-address summary-only推送到FTD LINA配置，确保仅通告汇总地址。

结果：

Add_Aggregate

保存并部署FTD上的配置。

验证

FTD BGP配置：

FTD-1# sh run router
router bgp 65000
 bgp log-neighbor-changes
 bgp router-id vrf auto-assign
 address-family ipv4 unicast
  neighbor 192.168.100.1 remote-as 65001
  neighbor 192.168.100.1 transport path-mtu-discovery disable
  neighbor 192.168.100.1 activate
 redistribute static
  aggregate-address 10.100.100.0 255.255.255.0 summary-only
  no auto-summary
  no synchronization
 exit-address-family

FTD BGP表输出：

FTD-1# sh bgp

BGP table version is 28, local router ID is 192.168.100.2
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop        Metric LocPrf Weight  Path

*> 10.100.100.0/24  0.0.0.0                        32768  i
s> 10.100.100.10/32 10.100.100.10        0         32768  ?
r> 192.168.100.0/30 192.168.100.1       1             0  65001 ?

R1 BGP表输出：

R1#show ip bgp

BGP table version is 261, local router ID is 192.168.100.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
              x best-external, a additional-path, c RIB-compressed,
              t secondary path, L long-lived-stale,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found

     Network          Next Hop            Metric LocPrf Weight Path
*>   10.100.100.0/24  192.168.100.2          0             0 65000 i
 *>   192.168.100.0/30  0.0.0.0                  1         32768 ?

R1路由表输出：

R1#show ip route

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, m - OMP
       n - NAT, Ni - NAT inside, No - NAT outside, Nd - NAT DIA
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       H - NHRP, G - NHRP registered, g - NHRP registration summary
       o - ODR, P - periodic downloaded static route, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR
       & - replicated local route overrides by connected

Gateway of last resort is not set

C        192.168.100.0/30 is directly connected, GigabitEthernet1
L        192.168.100.1/32 is directly connected, GigabitEthernet1
      10.0.0.0/24 is subnetted, 1 subnets
B        10.100.100.0 [20/0] via 192.168.100.2, 00:02:04

修订历史记录

版本	发布日期	备注
1.0	05-May-2025	初始版本

由思科工程师提供

卢西亚诺·贝泽拉
思科TAC工程师

此文档是否有帮助?

反馈

联系我们

提交支持案例
(需要思科服务合同)

通过FTD中的路由协议通告远程访问VPN子网

下载选项

非歧视性语言

关于此翻译

目录

简介

先决条件

要求

使用的组件

背景信息

通过FTD上的EIGRP重新分发远程访问VPN子网

网络图

使用network语句通过FTD上的EIGRP重分布远程访问VPN子网

配置

验证

使用redistribute static方法通过FTD上的EIGRP重分布远程访问VPN子网

配置

验证

EIGRP汇总地址配置

配置

验证

通过FTD上的OSPF重分布远程访问VPN子网

网络图

配置

验证

OSPF摘要地址配置

配置

验证

通过FTD上的eBGP重新分发远程访问VPN子网

网络图

配置

验证

BGP汇聚地址配置

配置

验证

修订历史记录

由思科工程师提供

此文档是否有帮助?

联系我们

本文档适用于以下产品