1.实验拓扑
2.基本配置
a.接入配置（创建VPN实例，获取地址等）
SW1：
#
vlan batch 10 20 30 40
#
ip vpn-instance a
ipv4-family
route-distinguisher 1:1
#
ip vpn-instance b
ipv4-family
route-distinguisher 1:2
#
interface Vlanif10
ip binding vpn-instance a
ip address 192.168.1.254 255.255.255.0
dhcp select relay
dhcp relay server-ip 10.1.1.2
#
interface Vlanif20
ip binding vpn-instance b
ip address 192.168.2.254 255.255.255.0
dhcp select relay
dhcp relay server-ip 10.1.2.2
#
interface Vlanif30
ip binding vpn-instance a
ip address 10.1.1.1 255.255.255.0
#
interface Vlanif40
ip binding vpn-instance b
ip address 10.1.2.1 255.255.255.0
#
interface GigabitEthernet0/0/1
port link-type access
port default vlan 10
#
interface GigabitEthernet0/0/2
port link-type access
port default vlan 20
#
interface GigabitEthernet0/0/3
port link-type trunk
port trunk allow-pass vlan 10 20 30 40
#AR1：
#
ip vpn-instance a
ipv4-family
route-distinguisher 1:1
#
ip vpn-instance b
ipv4-family
route-distinguisher 1:2
#
ip pool a
vpn-instance a
gateway-list 192.168.1.254
network 192.168.1.0 mask 255.255.255.0
#
ip pool b
vpn-instance b
gateway-list 192.168.2.254
network 192.168.2.0 mask 255.255.255.0
#
interface GigabitEthernet0/0/0.10
dot1q termination vid 30
ip binding vpn-instance a
ip address 10.1.1.2 255.255.255.0
arp broadcast enable
dhcp select global
#
interface GigabitEthernet0/0/0.20
dot1q termination vid 40
ip binding vpn-instance b
ip address 10.1.2.2 255.255.255.0
arp broadcast enable
dhcp select global
#AR2：
#
interface GigabitEthernet0/0/0
ip address 10.1.12.2 255.255.255.0
#
b.ospf和防火墙对接和出口对接
AR1：
#
interface GigabitEthernet0/0/1.1
dot1q termination vid 100
ip binding vpn-instance a
ip address 64.1.1.1 255.255.255.0
arp broadcast enable
#
interface GigabitEthernet0/0/1.2
dot1q termination vid 101
ip binding vpn-instance b
ip address 64.1.2.1 255.255.255.0
arp broadcast enable
#
interface GigabitEthernet0/0/2
#
interface GigabitEthernet0/0/2.1
dot1q termination vid 102
ip address 64.1.3.1 255.255.255.0
arp broadcast enable
#
interface GigabitEthernet0/0/2.2
dot1q termination vid 103
ip address 64.1.4.1 255.255.255.0
arp broadcast enable
#
#
ospf 1
area 0.0.0.0
network 10.1.12.0 0.0.0.255
network 64.1.3.0 0.0.0.255
network 64.1.4.0 0.0.0.255
#
ospf 2 vpn-instance a
vpn-instance-capability simple
area 0.0.0.2
network 10.1.1.0 0.0.0.255
network 64.1.1.0 0.0.0.255
#
ospf 3 vpn-instance b
vpn-instance-capability simple
area 0.0.0.3
network 10.1.2.0 0.0.0.255
network 64.1.2.0 0.0.0.255
#FW1：
#
vsys name a 1
assign interface GigabitEthernet1/0/0.1
assign interface GigabitEthernet1/0/1.1
#
vsys name b 2
assign interface GigabitEthernet1/0/0.2
assign interface GigabitEthernet1/0/1.2
#
ip vpn-instance a
ipv4-family
ipv6-family
#
ip vpn-instance b
ipv4-family
ipv6-family#
interface GigabitEthernet1/0/0.1
vlan-type dot1q 100
ip binding vpn-instance a
ip address 64.1.1.2 255.255.255.0
alias GE1/0/0.1
#
interface GigabitEthernet1/0/0.2
vlan-type dot1q 101
ip binding vpn-instance b
ip address 64.1.2.2 255.255.255.0
alias GE1/0/0.2
#
interface GigabitEthernet1/0/1
undo shutdown
#
interface GigabitEthernet1/0/1.1
vlan-type dot1q 102
ip binding vpn-instance a
ip address 64.1.3.2 255.255.255.0
alias GE1/0/1.1
#
interface GigabitEthernet1/0/1.2
vlan-type dot1q 103
ip binding vpn-instance b
ip address 64.1.4.2 255.255.255.0
alias GE1/0/1.2
#interface Virtual-if0
ip address 172.16.1.1 255.255.255.0
#
interface Virtual-if1
ip address 172.16.1.2 255.255.255.0
#
interface Virtual-if2
ip address 172.16.1.3 255.255.255.0
#
ospf 2 vpn-instance a
vpn-instance-capability simple
area 0.0.0.0
network 64.1.3.0 0.0.0.255
area 0.0.0.2
network 64.1.1.0 0.0.0.255
#
ospf 3 vpn-instance b
vpn-instance-capability simple
area 0.0.0.0
network 64.1.4.0 0.0.0.255
area 0.0.0.3
network 64.1.2.0 0.0.0.255
#AR2：
#
ospf 1
default-route-advertise always
area 0.0.0.0
network 10.1.12.0 0.0.0.255
#
3.结果验证
a.ospf邻居是否建立
b.是否能ping通外网
4.总结
a.使用vpn-instance隔离内网两个网段，使用dhcp（vpn-instance）来获取地址
b.使用ospf来让路由器AR1和防火墙进行对接，最后让路由器的area 0（public区域）和防火墙的area 0（vpn a和vpn b）进行邻居建立，让路由从vpn-instance实例表到路由器的public表，这样vpn a和vpn b也可以互访了，而且是需要经过防火墙的，这样可以对业务进行管控
c.此案例在园区网很常见，大家可以好好学习
