组网需求
某大型企业有总部（Hub）和多个分支（Spoke1、Spoke2……，举例中仅使用两个分支），分布在不同地域，总部和分支的子网环境会经常出现变动。分支采用动态地址接入公网。企业现网网络规划使用OSPF路由协议。
现在用户希望能够实现分支之间的VPN互联，同时对总部和分支机构以及分支机构间传输的数据进行加密保护。
配置思路
企业网络管理员可以采用如下思路进行分析：
- 由于分支是采用动态地址接入公网的，分支之间互相不知道对方的公网地址，因此必须采用DSVPN来实现分支之间的VPN互联。
- 由于分支数量较多，因此采用shortcut场景的DSVPN。
- 由于分支和总部的子网环境经常出现变动，为简化维护并根据企业网络规划，选择部署OSPF路由协议来实现分支/总部间的通信。
- 由于需要对机构之间的传输数据进行加密保护，因此采用配置IPSec保护的DSVPN来实现该功能。
注意：在DSVPN中部署IPSec时，如果两个分支位于不同NAT设备之后或者总部位于NAT设备之后，则IPSec封装模式仅支持为传输模式。
操作步骤
配置IP地址
AR1
<Huawei>sys
[Huawei]sys AR1
[AR1]int g0/0/0
[AR1-GigabitEthernet0/0/0]ip add 10.1.1.1 24
[AR1-GigabitEthernet0/0/0]q
[AR1]int lo1
[AR1-LoopBack1]ip add 172.16.1.1 24
[AR1-LoopBack1]q
[AR1]int t0/0/0
[AR1-Tunnel0/0/0]ip add 123.123.123.1 24
[AR1-Tunnel0/0/0]q
AR2
<Huawei>sys
[Huawei]sys AR2
[AR2]int g0/0/1
[AR2-LoopBack1]ip add 10.1.2.2 24
[AR2-LoopBack1]q
[AR2]int lo1
[AR2-GigabitEthernet0/0/0]ip add 172.16.2.2 24
[AR2-GigabitEthernet0/0/0]q
[AR2]int t0/0/0
[AR2-Tunnel0/0/0]ip add 123.123.123.2 24
[AR2-Tunnel0/0/0]q
AR3
<Huawei>sys
[Huawei]sys AR3
[AR3]int g0/0/1
[AR3-LoopBack1]ip add 10.1.3.3 24
[AR3-LoopBack1]q
[AR3]int lo1
[AR3-GigabitEthernet0/0/0]ip add 172.16.3.3 24
[AR3-GigabitEthernet0/0/0]q
[AR3]int t0/0/0
[AR3-Tunnel0/0/0]ip add 123.123.123.3 24
[AR3-Tunnel0/0/0]q
Internet
<Huawei>sys
[Huawei]sys Inernet
[Inernet]int g0/0/0
[Inernet-GigabitEthernet0/0/0]ip add 10.1.1.10 24
[Inernet-GigabitEthernet0/0/0]q
[Inernet]int g0/0/1
[Inernet-GigabitEthernet0/0/1]ip add 10.1.2.10 24
[Inernet-GigabitEthernet0/0/1]q
[Inernet]int g0/0/2
[Inernet-GigabitEthernet0/0/2]ip add 10.1.3.10 24
[Inernet-GigabitEthernet0/0/2]q
配置公网路由可达
AR1
[AR1]ospf 2 router-id 10.1.1.1
[AR1-ospf-2]area 1
[AR1-ospf-2-area-0.0.0.1]net 10.1.1.0 0.0.0.255
[AR1-ospf-2-area-0.0.0.1]q
[AR1-ospf-2]q
AR2
[AR2]ospf 2 router-id 10.1.2.2
[AR2-ospf-2]area 1
[AR2-ospf-2-area-0.0.0.1]net 10.1.2.0 0.0.0.255
[AR2-ospf-2-area-0.0.0.1]q
[AR2-ospf-2]q
AR3
[AR3]ospf 2 router-id 10.1.3.3
[AR3-ospf-2]area 1
[AR3-ospf-2-area-0.0.0.1]net 10.1.3.0 0.0.0.255
[AR3-ospf-2-area-0.0.0.1]q
[AR3-ospf-2]q
Internet
[Inernet]ospf 2 router-id 10.1.123.10
[Inernet-ospf-2]area 1
[Inernet-ospf-2-area-0.0.0.1]ne
[Inernet-ospf-2-area-0.0.0.1]net 10.1.1.0 0.0.0.255
[Inernet-ospf-2-area-0.0.0.1]net 10.1.2.0 0.0.0.255
[Inernet-ospf-2-area-0.0.0.1]net 10.1.3.0 0.0.0.255
[Inernet-ospf-2-area-0.0.0.1]q
[Inernet-ospf-2]q
验证配置
#查看路由表
[AR1]display ospf 2 routing
OSPF Process 2 with Router ID 10.1.1.1
Routing Tables
Routing for Network
Destination Cost Type NextHop AdvRouter Area
10.1.1.0/24 1 Transit 10.1.1.1 10.1.1.1 0.0.0.1
10.1.2.0/24 2 Transit 10.1.1.10 10.1.2.2 0.0.0.1
10.1.3.0/24 2 Transit 10.1.1.10 10.1.3.3 0.0.0.1
Total Nets: 3
Intra Area: 3 Inter Area: 0 ASE: 0 NSSA: 0
#ping验证
[AR1]ping 10.1.3.3
PING 10.1.3.3: 56 data bytes, press CTRL_C to break
Reply from 10.1.3.3: bytes=56 Sequence=1 ttl=254 time=30 ms
Reply from 10.1.3.3: bytes=56 Sequence=2 ttl=254 time=30 ms
Reply from 10.1.3.3: bytes=56 Sequence=3 ttl=254 time=30 ms
Reply from 10.1.3.3: bytes=56 Sequence=4 ttl=254 time=30 ms
Reply from 10.1.3.3: bytes=56 Sequence=5 ttl=254 time=20 ms
--- 10.1.3.3 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 20/28/30 ms
配置内网路由可达
AR1
[AR1]ospf 1 router-id 172.16.1.1
[AR1-ospf-1]area 0
[AR1-ospf-1-area-0.0.0.0]ne
[AR1-ospf-1-area-0.0.0.0]network 172.16.1.0 0.0.0.255
[AR1-ospf-1-area-0.0.0.0]net 123.123.123.0 0.0.0.255
[AR1-ospf-1-area-0.0.0.0]q
[AR1-ospf-1]q
AR2
[AR2]ospf 1 router-id 172.16.2.2
[AR2-ospf-1]area 0
[AR2-ospf-1-area-0.0.0.0]net 172.16.2.0 0.0.0.255
[AR2-ospf-1-area-0.0.0.0]net 123.123.123.0 0.0.0.255
[AR2-ospf-1-area-0.0.0.0]q
[AR2-ospf-1]q
AR3
[AR3]ospf 1 router-id 172.16.3.3
[AR3-ospf-1]area 0
[AR3-ospf-1-area-0.0.0.0]net 172.16.3.0 0.0.0.255
[AR3-ospf-1-area-0.0.0.0]net 123.123.123.0 0.0.0.255
[AR3-ospf-1-area-0.0.0.0]q
[AR3-ospf-1]q
配置IKE提议
AR1
[AR1]ike prop 1
[AR1-ike-proposal-1]dh group5
[AR1-ike-proposal-1]authentication-algorithm sha1
#配置IKEv2协商时所使用的伪随机数产生函数的算法（简称PRF算法）
[AR1-ike-proposal-1]prf aes-xcbc-128
[AR1-ike-proposal-1]q
[AR1]
AR2
[AR2]ike prop 1
[AR2-ike-proposal-1]dh group5
[AR2-ike-proposal-1]authentication-algorithm sha1
[AR2-ike-proposal-1]prf aes-xcbc-128
[AR2-ike-proposal-1]q
AR3
[AR3]ike prop 1
[AR3-ike-proposal-1]dh group5
[AR3-ike-proposal-1]authentication-algorithm sha1
[AR3-ike-proposal-1]prf aes-xcbc-128
[AR3-ike-proposal-1]q
配置IKE对等体
AR1
[AR1]ike peer 1 v2
[AR1-ike-peer-1]ike-proposal 1
[AR1-ike-peer-1]pre-shared-key cipher 20wl
#配置IKE对等体中的DPD检测模式
[AR1-ike-peer-1]dpd type periodic
#配置IKE对等体的DPD空闲时间40秒
[AR1-ike-peer-1]dpd idle-time 40
[AR1-ike-peer-1]q
AR2
[AR2]ike peer 1 v2
[AR2-ike-peer-1]ike-proposal 1
[AR2-ike-peer-1]pre-shared-key cipher 20wl
[AR2-ike-peer-1]dpd type periodic
[AR2-ike-peer-1]dpd idle-time 40
[AR2-ike-peer-1]q
AR3
[AR3]ike peer 1 v2
[AR3-ike-peer-1]ike-proposal 1
[AR3-ike-peer-1]pre-shared-key cipher 20wl
[AR3-ike-peer-1]dpd type periodic
[AR3-ike-peer-1]dpd idle-time 40
[AR3-ike-peer-1]q
创建安全提议
AR1
[AR1]ipsec prop 1
#配置IPSec安全提议使用的安全协议
[AR1-ipsec-proposal-1]transform ah-esp
#配置AH协议使用的认证算法
[AR1-ipsec-proposal-1]ah authentication-algorithm sha2-256
[AR1-ipsec-proposal-1]esp authentication-algorithm sha2-256
[AR1-ipsec-proposal-1]esp encryption-algorithm aes-192
[AR1-ipsec-proposal-1]q
AR2
[AR2]ipsec prop 1
[AR2-ipsec-proposal-1]transform ah-esp
[AR2-ipsec-proposal-1]ah authentication-algorithm sha2-256
[AR2-ipsec-proposal-1]esp authentication-algorithm sha2-256
[AR2-ipsec-proposal-1]esp encryption-algorithm aes-192
[AR2-ipsec-proposal-1]q
AR3
[AR3]ipsec prop 1
[AR3-ipsec-proposal-1]transform ah-esp
[AR3-ipsec-proposal-1]ah authentication-algorithm sha2-256
[AR3-ipsec-proposal-1]esp authentication-algorithm sha2-256
[AR3-ipsec-proposal-1]esp encryption-algorithm aes-192
[AR3-ipsec-proposal-1]q
配置安全框架
AR1
[AR1]ipsec profile 1
[AR1-ipsec-profile-1]ike-peer 1
[AR1-ipsec-profile-1]proposal 1
[AR1-ipsec-profile-1]q
AR2
[AR2]ipsec profile 1
[AR2-ipsec-profile-1]ike-peer 1
[AR2-ipsec-profile-1]proposal 1
[AR2-ipsec-profile-1]q
AR3
[AR3]ipsec profile 1
[AR3-ipsec-profile-1]ike-peer 1
[AR3-ipsec-profile-1]proposal 1
[AR3-ipsec-profile-1]q
配置Tunnel接口
AR1
[AR1]int t0/0/0
[AR1-Tunnel0/0/0]tunnel-protocol gre p2mp
[AR1-Tunnel0/0/0]source g0/0/0
#开启将动态注册的分支加入NHRP组播成员表功能
[AR1-Tunnel0/0/0]nhrp entry multicast dynamic
#设置OSPF接口的网络类型
[AR1-Tunnel0/0/0]ospf network-type p2mp
#NHRP redirect功能
[AR1-Tunnel0/0/0]nhrp redirect
#在Tunnel接口上应用IPSec安全框架
[AR1-Tunnel0/0/0]ipsec profile 1
[AR1-Tunnel0/0/0]q
AR2
[AR2]int t0/0/0
[AR2-Tunnel0/0/0]tunnel-protocol gre p2mp
[AR2-Tunnel0/0/0]source g0/0/1
#指定tunnel接口地址和官网地址，总部节点上生成关于本分支节点的NHRP peer表项。
[AR2-Tunnel0/0/0]nhrp entry 123.123.123.1 10.1.1.1 register
[AR2-Tunnel0/0/0]ospf network-type p2mp
#NHRP shortcut功能
[AR2-Tunnel0/0/0]nhrp shortcut
[AR2-Tunnel0/0/0]ipsec profile 1
[AR2-Tunnel0/0/0]q
AR3
[AR3]int t0/0/0
[AR3-Tunnel0/0/0]tunnel-protocol gre p2mp
[AR3-Tunnel0/0/0]source g0/0/1
[AR3-Tunnel0/0/0]nhrp entry 123.123.123.1 10.1.1.1 register
[AR3-Tunnel0/0/0]ospf network-type p2mp
[AR3-Tunnel0/0/0]nhrp shortcut
[AR3-Tunnel0/0/0]ipsec profile 1
[AR3-Tunnel0/0/0]q
验证
检查DSVPN配置
AR1
[AR1]display nhrp peer all
-------------------------------------------------------------------------------
Protocol-addr Mask NBMA-addr NextHop-addr Type Flag
-------------------------------------------------------------------------------
123.123.123.2 32 10.1.2.2 123.123.123.2 dynamic route tunnel
-------------------------------------------------------------------------------
Tunnel interface: Tunnel0/0/0
Created time : 00:11:19
Expire time : 01:49:13
-------------------------------------------------------------------------------
Protocol-addr Mask NBMA-addr NextHop-addr Type Flag
-------------------------------------------------------------------------------
123.123.123.3 32 10.1.3.3 123.123.123.3 dynamic route tunnel
-------------------------------------------------------------------------------
Tunnel interface: Tunnel0/0/0
Created time : 00:07:31
Expire time : 01:52:56
Number of nhrp peers: 2
AR2
[AR2]display nhrp peer all
-------------------------------------------------------------------------------
Protocol-addr Mask NBMA-addr NextHop-addr Type Flag
-------------------------------------------------------------------------------
123.123.123.1 32 10.1.1.1 123.123.123.1 static hub
-------------------------------------------------------------------------------
Tunnel interface: Tunnel0/0/0
Created time : 00:11:27
Expire time : --
Number of nhrp peers: 1
AR3
[AR2]display nhrp peer all
-------------------------------------------------------------------------------
Protocol-addr Mask NBMA-addr NextHop-addr Type Flag
-------------------------------------------------------------------------------
123.123.123.1 32 10.1.1.1 123.123.123.1 static hub
-------------------------------------------------------------------------------
Tunnel interface: Tunnel0/0/0
Created time : 00:11:27
Expire time : --
Number of nhrp peers: 1
检查IPSec SA信息
AR1
[AR1]display ipsec sa
===============================
Interface: Tunnel0/0/0
Path MTU: 1500
===============================
-----------------------------
IPSec profile name: "1"
Mode : PROF-Template
-----------------------------
Connection ID : 4
Encapsulation mode: Tunnel
Tunnel local : 10.1.1.1
Tunnel remote : 10.1.3.3
Qos pre-classify : Disable
[Outbound ESP SAs]
SPI: 3091581073 (0xb845c891)
Proposal: ESP-ENCRYPT-AES-192 SHA2-256-128
SA remaining key duration (bytes/sec): 1887433396/2860
Max sent sequence-number: 34
UDP encapsulation used for NAT traversal: N
[Outbound AH SAs]
SPI: 1755157590 (0x689d9456)
Proposal: SHA2-256-128
SA remaining key duration (bytes/sec): 1887436800/2860
Max sent sequence-number: 34
UDP encapsulation used for NAT traversal: N
[Inbound AH SAs]
SPI: 1133922043 (0x439646fb)
Proposal: SHA2-256-128
SA remaining key duration (bytes/sec): 1887436800/2860
Max received sequence-number: 30
Anti-replay window size: 32
UDP encapsulation used for NAT traversal: N
[Inbound ESP SAs]
SPI: 3135250784 (0xbae02160)
Proposal: ESP-ENCRYPT-AES-192 SHA2-256-128
SA remaining key duration (bytes/sec): 1887433944/2860
Max received sequence-number: 30
Anti-replay window size: 32
UDP encapsulation used for NAT traversal: N
-----------------------------
IPSec profile name: "1"
Mode : PROF-Template
-----------------------------
Connection ID : 2
Encapsulation mode: Tunnel
Tunnel local : 10.1.1.1
Tunnel remote : 10.1.2.2
Qos pre-classify : Disable
[Outbound ESP SAs]
SPI: 2677832054 (0x9f9c7976)
Proposal: ESP-ENCRYPT-AES-192 SHA2-256-128
SA remaining key duration (bytes/sec): 1887432440/2636
Max sent sequence-number: 44
UDP encapsulation used for NAT traversal: N
[Outbound AH SAs]
SPI: 345017806 (0x14908dce)
Proposal: SHA2-256-128
SA remaining key duration (bytes/sec): 1887436800/2636
Max sent sequence-number: 44
UDP encapsulation used for NAT traversal: N
[Inbound AH SAs]
SPI: 339028987 (0x14352bfb)
Proposal: SHA2-256-128
SA remaining key duration (bytes/sec): 1887436800/2636
Max received sequence-number: 40
Anti-replay window size: 32
UDP encapsulation used for NAT traversal: N
[Inbound ESP SAs]
SPI: 3435456947 (0xccc4e9b3)
Proposal: ESP-ENCRYPT-AES-192 SHA2-256-128
SA remaining key duration (bytes/sec): 1887433040/2636
Max received sequence-number: 40
Anti-replay window size: 32
UDP encapsulation used for NAT traversal: N
AR2
[AR2]display ipsec sa
===============================
Interface: Tunnel0/0/0
Path MTU: 1500
===============================
-----------------------------
IPSec profile name: "1"
Mode : PROF-ISAKMP
-----------------------------
Connection ID : 2
Encapsulation mode: Tunnel
Tunnel local : 10.1.2.2
Tunnel remote : 10.1.1.1
Qos pre-classify : Disable
[Outbound ESP SAs]
SPI: 3435456947 (0xccc4e9b3)
Proposal: ESP-ENCRYPT-AES-192 SHA2-256-128
SA remaining key duration (bytes/sec): 1887433224/2704
Max sent sequence-number: 38
UDP encapsulation used for NAT traversal: N
[Outbound AH SAs]
SPI: 339028987 (0x14352bfb)
Proposal: SHA2-256-128
SA remaining key duration (bytes/sec): 1887436800/2704
Max sent sequence-number: 38
UDP encapsulation used for NAT traversal: N
[Inbound AH SAs]
SPI: 345017806 (0x14908dce)
Proposal: SHA2-256-128
SA remaining key duration (bytes/sec): 1887436800/2704
Max received sequence-number: 41
Anti-replay window size: 32
UDP encapsulation used for NAT traversal: N
[Inbound ESP SAs]
SPI: 2677832054 (0x9f9c7976)
Proposal: ESP-ENCRYPT-AES-192 SHA2-256-128
SA remaining key duration (bytes/sec): 1887432728/2704
Max received sequence-number: 41
Anti-replay window size: 32
UDP encapsulation used for NAT traversal: N
AR3
[AR3]display ipsec sa
===============================
Interface: Tunnel0/0/0
Path MTU: 1500
===============================
-----------------------------
IPSec profile name: "1"
Mode : PROF-ISAKMP
-----------------------------
Connection ID : 2
Encapsulation mode: Tunnel
Tunnel local : 10.1.3.3
Tunnel remote : 10.1.1.1
Qos pre-classify : Disable
[Outbound ESP SAs]
SPI: 3135250784 (0xbae02160)
Proposal: ESP-ENCRYPT-AES-192 SHA2-256-128
SA remaining key duration (bytes/sec): 1887433852/2820
Max sent sequence-number: 31
UDP encapsulation used for NAT traversal: N
[Outbound AH SAs]
SPI: 1133922043 (0x439646fb)
Proposal: SHA2-256-128
SA remaining key duration (bytes/sec): 1887436800/2820
Max sent sequence-number: 31
UDP encapsulation used for NAT traversal: N
[Inbound AH SAs]
SPI: 1755157590 (0x689d9456)
Proposal: SHA2-256-128
SA remaining key duration (bytes/sec): 1887436800/2820
Max received sequence-number: 35
Anti-replay window size: 32
UDP encapsulation used for NAT traversal: N
[Inbound ESP SAs]
SPI: 3091581073 (0xb845c891)
Proposal: ESP-ENCRYPT-AES-192 SHA2-256-128
SA remaining key duration (bytes/sec): 1887433300/2820
Max received sequence-number: 35
Anti-replay window size: 32
UDP encapsulation used for NAT traversal: N
检查OSPF路由
AR1
[AR1]display ospf 1 routing
OSPF Process 1 with Router ID 172.16.1.1
Routing Tables
Routing for Network
Destination Cost Type NextHop AdvRouter Area
123.123.123.1/32 0 Stub 123.123.123.1 172.16.1.1 0.0.0.0
172.16.1.0/24 1 Stub 172.16.1.1 172.16.1.1 0.0.0.0
123.123.123.2/32 1562 Stub 123.123.123.2 172.16.2.2 0.0.0.0
123.123.123.3/32 1562 Stub 123.123.123.3 172.16.3.3 0.0.0.0
172.16.2.0/24 1563 Stub 123.123.123.2 172.16.2.2 0.0.0.0
172.16.3.0/24 1563 Stub 123.123.123.3 172.16.3.3 0.0.0.0
Total Nets: 6
Intra Area: 6 Inter Area: 0 ASE: 0 NSSA: 0
AR2
[AR2]display ospf 1 routing
OSPF Process 1 with Router ID 172.16.2.2
Routing Tables
Routing for Network
Destination Cost Type NextHop AdvRouter Area
123.123.123.2/32 0 Stub 123.123.123.2 172.16.2.2 0.0.0.0
172.16.2.0/24 1 Stub 172.16.2.2 172.16.2.2 0.0.0.0
123.123.123.1/32 1562 Stub 123.123.123.1 172.16.1.1 0.0.0.0
123.123.123.3/32 3124 Stub 123.123.123.1 172.16.3.3 0.0.0.0
172.16.1.0/24 1563 Stub 123.123.123.1 172.16.1.1 0.0.0.0
172.16.3.0/24 3125 Stub 123.123.123.1 172.16.3.3 0.0.0.0
Total Nets: 6
Intra Area: 6 Inter Area: 0 ASE: 0 NSSA: 0
AR3
[AR3]display ospf 1 routing
OSPF Process 1 with Router ID 172.16.3.3
Routing Tables
Routing for Network
Destination Cost Type NextHop AdvRouter Area
123.123.123.3/32 0 Stub 123.123.123.3 172.16.3.3 0.0.0.0
172.16.3.0/24 1 Stub 172.16.3.3 172.16.3.3 0.0.0.0
123.123.123.1/32 1562 Stub 123.123.123.1 172.16.1.1 0.0.0.0
123.123.123.2/32 3124 Stub 123.123.123.1 172.16.2.2 0.0.0.0
172.16.1.0/24 1563 Stub 123.123.123.1 172.16.1.1 0.0.0.0
172.16.2.0/24 3125 Stub 123.123.123.1 172.16.2.2 0.0.0.0
Total Nets: 6
Intra Area: 6 Inter Area: 0 ASE: 0 NSSA: 0
执行ping操作，查看配置结果
AR2
[AR2]ping -a 172.16.2.2 172.16.3.3
PING 172.16.3.3: 56 data bytes, press CTRL_C to break
Reply from 172.16.3.3: bytes=56 Sequence=1 ttl=255 time=30 ms
Reply from 172.16.3.3: bytes=56 Sequence=2 ttl=255 time=20 ms
Reply from 172.16.3.3: bytes=56 Sequence=3 ttl=255 time=30 ms
Reply from 172.16.3.3: bytes=56 Sequence=4 ttl=255 time=30 ms
Reply from 172.16.3.3: bytes=56 Sequence=5 ttl=255 time=30 ms
--- 172.16.3.3 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 20/28/30 ms
[AR2]display nhrp peer all
-------------------------------------------------------------------------------
Protocol-addr Mask NBMA-addr NextHop-addr Type Flag
-------------------------------------------------------------------------------
123.123.123.1 32 10.1.1.1 123.123.123.1 static hub
-------------------------------------------------------------------------------
Tunnel interface: Tunnel0/0/0
Created time : 00:55:09
Expire time : --
-------------------------------------------------------------------------------
Protocol-addr Mask NBMA-addr NextHop-addr Type Flag
-------------------------------------------------------------------------------
123.123.123.3 32 10.1.3.3 123.123.123.3 dynamic route tunnel
-------------------------------------------------------------------------------
Tunnel interface: Tunnel0/0/0
Created time : 00:21:48
Expire time : 01:38:30
-------------------------------------------------------------------------------
Protocol-addr Mask NBMA-addr NextHop-addr Type Flag
-------------------------------------------------------------------------------
123.123.123.2 32 10.1.2.2 123.123.123.2 dynamic local
-------------------------------------------------------------------------------
Tunnel interface: Tunnel0/0/0
Created time : 00:21:48
Expire time : 01:38:12
-------------------------------------------------------------------------------
Protocol-addr Mask NBMA-addr NextHop-addr Type Flag
-------------------------------------------------------------------------------
172.16.2.20 24 10.1.2.2 123.123.123.2 dynamic local
-------------------------------------------------------------------------------
Tunnel interface: Tunnel0/0/0
Created time : 00:21:30
Expire time : 01:38:30
-------------------------------------------------------------------------------
Protocol-addr Mask NBMA-addr NextHop-addr Type Flag
-------------------------------------------------------------------------------
172.16.3.3 32 10.1.3.3 123.123.123.3 dynamic route network
-------------------------------------------------------------------------------
Tunnel interface: Tunnel0/0/0
Created time : 00:16:46
Expire time : 01:43:14
-------------------------------------------------------------------------------
Protocol-addr Mask NBMA-addr NextHop-addr Type Flag
-------------------------------------------------------------------------------
172.16.3.10 24 10.1.3.3 123.123.123.3 dynamic route network
-------------------------------------------------------------------------------
Tunnel interface: Tunnel0/0/0
Created time : 00:12:21
Expire time : 01:47:39
Number of nhrp peers: 6
[AR2]
评论区