第142篇：大型校园网多出口设计

关键词：校园网、多出口、智能选路、NQA、跟踪策略、负载分担、电信联通、华为

一、引言

大型校园网面临着独特的网络挑战：用户数量庞大（数千至上万人）、应用类型多样（教学、科研、办公、生活）、对互联网出口的质量要求高。单一运营商出口在带宽受限、跨网访问质量差、故障无备份等问题上暴露无遗。多出口设计成为大型校园网的标配方案。

多出口不仅仅是"多拉几条专线"那么简单。关键在于如何实现智能选路、负载分担、故障自动切换，同时保证 NAT 地址资源充足和出口安全策略统一。

二、核心概念

2.1 校园网典型出口拓扑

2.2 多出口的核心问题

2.3 智能选路原理

智能选路的核心是"探测 + 决策"：

1. 探测：使用 NQA（Network Quality Analysis）定期探测各出口到关键目标地址的连通性和延迟
2. 决策：根据探测结果动态调整路由优先级，优选质量最好的出口
3. 切换：当首选出口劣化或中断时，自动切换到次选出口

三、技术细节

3.1 NQA 探测配置

NQA 支持多种探测协议：ICMP（Ping）、TCP、UDP、HTTP、DNS 等。校园网出口选路通常使用 ICMP 和 TCP 双探测。

ICMP 探测

# 电信出口探测
[HUAWEI] nqa test-icmp test-telecom
[HUAWEI-nqa-test-icmp-test-telecom] test-address 114.114.114.114
[HUAWEI-nqa-test-icmp-test-telecom] frequency 10
[HUAWEI-nqa-test-icmp-test-telecom] probe count 3
[HUAWEI-nqa-test-icmp-test-telecom] packet-size 64
[HUAWEI-nqa-test-icmp-test-telecom] timeout 3000

# 联通出口探测
[HUAWEI] nqa test-icmp test-unicom
[HUAWEI-nqa-test-icmp-test-unicom] test-address 119.29.29.29
[HUAWEI-nqa-test-icmp-test-unicom] frequency 10
[HUAWEI-nqa-test-icmp-test-unicom] probe count 3
[HUAWEI-nqa-test-icmp-test-unicom] timeout 3000

# 移动出口探测
[HUAWEI] nqa test-icmp test-mobile
[HUAWEI-nqa-test-icmp-test-mobile] test-address 223.5.5.5
[HUAWEI-nqa-test-icmp-test-mobile] frequency 10
[HUAWEI-nqa-test-icmp-test-mobile] probe count 3
[HUAWEI-nqa-test-icmp-test-mobile] timeout 3000

TCP 探测（更精准的业务质量评估）

# 探测 HTTP 服务（端口80）
[HUAWEI] nqa test-tcp test-telecom-http
[HUAWEI-nqa-test-tcp-test-telecom-http] test-address 114.114.114.114
[HUAWEI-nqa-test-tcp-test-telecom-http] target-port 80
[HUAWEI-nqa-test-tcp-test-telecom-http] frequency 15
[HUAWEI-nqa-test-tcp-test-telecom-http] timeout 3000

3.2 静态路由 + NQA 跟踪

# --- 定义浮动静态路由（Precedence 越大优先级越低）---

# 电信出口（首选，Preference 60）
[HUAWEI] ip route-static 0.0.0.0 0.0.0.0 124.x.x.1 preference 60 track nqa test-icmp test-telecom

# 联通出口（次选，Preference 70）
[HUAWEI] ip route-static 0.0.0.0 0.0.0.0 202.x.x.1 preference 70 track nqa test-icmp test-unicom

# 移动出口（保底，Preference 80）
[HUAWEI] ip route-static 0.0.0.0 0.0.0.0 221.x.x.1 preference 80 track nqa test-icmp test-mobile

# --- 启动 NQA 探测 ---
[HUAWEI-nqa-test-icmp-test-telecom] start now
[HUAWEI-nqa-test-icmp-test-unicom] start now
[HUAWEI-nqa-test-icmp-test-mobile] start now

3.3 策略路由（PBR）按目的地址选路

# --- ACL 匹配目的地址 ---

# 电信优势地址段
[HUAWEI] acl basic 2001
[HUAWEI-acl-basic-2001] rule 10 permit source 58.0.0.0 0.255.255.255
[HUAWEI-acl-basic-2001] rule 20 permit source 113.0.0.0 0.255.255.255
[HUAWEI-acl-basic-2001] rule 30 permit source 114.0.0.0 0.255.255.255
[HUAWEI-acl-basic-2001] rule 40 permit source 117.0.0.0 0.255.255.255

# 联通优势地址段
[HUAWEI] acl basic 2002
[HUAWEI-acl-basic-2002] rule 10 permit source 202.0.0.0 0.255.255.255
[HUAWEI-acl-basic-2002] rule 20 permit source 210.0.0.0 0.255.255.255
[HUAWEI-acl-basic-2002] rule 30 permit source 218.0.0.0 0.255.255.255
[HUAWEI-acl-basic-2002] rule 40 permit source 219.0.0.0 0.255.255.255

# --- 策略路由 ---
[HUAWEI] traffic-policy outbound
[HUAWEI-classifier-telecom] if-match destination-address 2001
[HUAWEI-classifier-telecom] apply gateway 124.x.x.1
[HUAWEI-classifier-unicom] if-match destination-address 2002
[HUAWEI-classifier-unicom] apply gateway 202.x.x.1

# --- 应用策略路由到内网接口 ---
[HUAWEI] interface Vlanif 100
[HUAWEI-Vlanif100] traffic-policy outbound inbound

3.4 NAT 地址规划

# NAT 地址池配置
[HUAWEI] nat address-group TELECOM-POOL
[HUAWEI-nat-address-group-1] section 124.x.x.1 124.x.x.30

[HUAWEI] nat address-group UNICOM-POOL
[HUAWEI-nat-address-group-2] section 202.x.x.1 202.x.x.62

# 源 NAT
[HUAWEI] acl basic 3000
[HUAWEI-acl-basic-3000] rule 10 permit source 10.0.0.0 0.255.255.255

[HUAWEI] interface GigabitEthernet1/0/1
[HUAWEI-GigabitEthernet1/0/1] nat outbound 3000 address-group TELECOM-POOL

3.5 出口带宽利用率监控

四、实战配置/案例分析

4.1 完整的多出口配置

# ========== 核心交换机 CE-SW-01 ==========
[HUAWEI] sysname CE-CAMPUS-01

# --- 运营商上行接口 ---
[CE-CAMPUS-01] interface GigabitEthernet 1/0/1
[CE-CAMPUS-01-GigabitEthernet1/0/1] description TO-TELECOM
[CE-CAMPUS-01-GigabitEthernet1/0/1] ip address 124.x.x.2 255.255.255.252
[CE-CAMPUS-01-GigabitEthernet1/0/1] nat outbound 3000 address-group TELECOM-POOL no-pat

[CE-CAMPUS-01] interface GigabitEthernet 1/0/2
[CE-CAMPUS-01-GigabitEthernet1/0/2] description TO-UNICOM
[CE-CAMPUS-01-GigabitEthernet1/0/2] ip address 202.x.x.2 255.255.255.252
[CE-CAMPUS-01-GigabitEthernet1/0/2] nat outbound 3000 address-group UNICOM-POOL no-pat

[CE-CAMPUS-01] interface GigabitEthernet 1/0/3
[CE-CAMPUS-01-GigabitEthernet1/0/3] description TO-MOBILE
[CE-CAMPUS-01-GigabitEthernet1/0/3] ip address 221.x.x.2 255.255.255.252
[CE-CAMPUS-01-GigabitEthernet1/0/3] nat outbound 3000 address-group MOBILE-POOL no-pat

# --- NQA 探测 ---
[CE-CAMPUS-01] nqa test-icmp test-telecom
[CE-CAMPUS-01-nqa-test-icmp-test-telecom] test-address 114.114.114.114
[CE-CAMPUS-01-nqa-test-icmp-test-telecom] frequency 5
[CE-CAMPUS-01-nqa-test-icmp-test-telecom] probe count 3
[CE-CAMPUS-01-nqa-test-icmp-test-telecom] timeout 2000
[CE-CAMPUS-01-nqa-test-icmp-test-telecom] start now

[CE-CAMPUS-01] nqa test-icmp test-unicom
[CE-CAMPUS-01-nqa-test-icmp-test-unicom] test-address 119.29.29.29
[CE-CAMPUS-01-nqa-test-icmp-test-unicom] frequency 5
[CE-CAMPUS-01-nqa-test-icmp-test-unicom] probe count 3
[CE-CAMPUS-01-nqa-test-icmp-test-unicom] timeout 2000
[CE-CAMPUS-01-nqa-test-icmp-test-unicom] start now

# --- 默认路由（带NQA跟踪）---
[CE-CAMPUS-01] ip route-static 0.0.0.0 0.0.0.0 124.x.x.1 preference 60 track nqa test-icmp test-telecom
[CE-CAMPUS-01] ip route-static 0.0.0.0 0.0.0.0 202.x.x.1 preference 70 track nqa test-icmp test-unicom

# --- NAT 配置 ---
[CE-CAMPUS-01] acl basic 3000
[CE-CAMPUS-01-acl-basic-3000] rule 10 permit source 10.0.0.0 0.255.255.255

[CE-CAMPUS-01] nat address-group TELECOM-POOL
[CE-CAMPUS-01-nat-address-group-1] section 124.x.x.1 124.x.x.30

[CE-CAMPUS-01] nat address-group UNICOM-POOL
[CE-CAMPUS-01-nat-address-group-2] section 202.x.x.1 202.x.x.62

4.2 故障案例：跨网访问质量差

场景：某高校反馈学生反映访问百度、微信等电信优势资源速度极慢，但访问校内系统正常。校园网当前使用联通出口。

排查过程：

# 1. 确认当前默认路由
[CE-CAMPUS-01] display ip routing-table 0.0.0.0 0.0.0.0
# 路由表: 0.0.0.0/0 via 202.x.x.1 (联通)

# 2. 从核心 Ping 百度（电信DNS解析后的地址）
[CE-CAMPUS-01] ping -a 202.x.x.2 220.181.38.148
# 延迟 120ms，丢包率 8%  ← 跨网访问质量差

# 3. 检查 NQA 状态
[CE-CAMPUS-01] display nqa test-icmp test-telecom results
# 电信 NQA: RTT=25ms, 丢包率=0%  ← 电信出口质量良好

根因：校园网仅配置了联通单出口。联通访问电信资源需经过跨网互联互通节点（CN2 核心节点），延迟高且拥塞时丢包严重。

解决方案：部署策略路由，将电信优势地址走电信出口：

# 添加电信出口
[CE-CAMPUS-01] interface GigabitEthernet 1/0/1
[CE-CAMPUS-01-GigabitEthernet1/0/1] ip address 124.x.x.2 255.255.255.252

# ACL 匹配电信优势地址
[CE-CAMPUS-01] acl advanced 3001
[CE-CAMPUS-01-acl-adv-3001] rule 10 permit ip destination 58.0.0.0 0.255.255.255
[CE-CAMPUS-01-acl-adv-3001] rule 20 permit ip destination 113.0.0.0 0.255.255.255
[CE-CAMPUS-01-acl-adv-3001] rule 30 permit ip destination 114.0.0.0 0.255.255.255
[CE-CAMPUS-01-acl-adv-3001] rule 40 permit ip destination 117.0.0.0 0.255.255.255
[CE-CAMPUS-01-acl-adv-3001] rule 50 permit ip destination 120.0.0.0 0.255.255.255
[CE-CAMPUS-01-acl-adv-3001] rule 60 permit ip destination 220.181.0.0 0.0.255.255

# 策略路由
[CE-CAMPUS-01] traffic classifier TELECOM-CLASS
[CE-CAMPUS-01-trafficclassifier-TELECOM-CLASS] if-match destination-address 3001

[CE-CAMPUS-01] traffic behavior TELECOM-ACT
[CE-CAMPUS-01-trafficbehavior-TELECOM-ACT] apply gateway 124.x.x.1

[CE-CAMPUS-01] traffic policy OUTBOUND
[CE-CAMPUS-01-trafficpolicy-OUTBOUND] classifier TELECOM-CLASS behavior TELECOM-ACT

# 应用到内网 VLAN 接口
[CE-CAMPUS-01] interface Vlanif 100
[CE-CAMPUS-01-Vlanif100] traffic-policy OUTBOUND inbound

4.3 故障案例：NQA 误判导致频繁切换

场景：校园网部署了 NQA 智能选路，但出现"抖动"现象：路由在电信和联通出口之间频繁切换，每 1 ~ 2 分钟切换一次。

排查过程：

# 检查 NQA 探测结果
[CE-CAMPUS-01] display nqa test-icmp test-telecom results
# 最新探测: RTT=45ms, 丢包率=0%, 状态=Success
# 历史探测: 成功10次, 失败1次, 最近失败间隔=60s

# 检查 NQA 配置
[CE-CAMPUS-01] display current-configuration nqa test-icmp test-telecom
# frequency 5 (每5秒一次探测)
# probe count 3 (每次发3个探测包)
# timeout 2000 (超时2秒)

# 查看日志
[CE-CAMPUS-01] display logbuffer | include NQA
# %NQA-6-TESTRESULT: Test result changed from Success to Fail
# %NQA-6-TESTRESULT: Test result changed from Fail to Success
# （频繁交替）

根因：NQA 探测频率过高（5秒），且 probe count 仅为 3。偶尔一次网络波动导致 3 个探测包中的 1 个超时，触发路由切换。路由切换后下一轮探测又恢复正常，再次切换。

解决方案：

# 降低探测频率，增加容忍度
[CE-CAMPUS-01] nqa test-icmp test-telecom
[CE-CAMPUS-01-nqa-test-icmp-test-telecom] frequency 30      # 从5秒改为30秒
[CE-CAMPUS-01-nqa-test-icmp-test-telecom] probe count 5      # 从3次改为5次
[CE-CAMPUS-01-nqa-test-icmp-test-telecom] timeout 3000       # 超时从2秒改为3秒

# 增加成功/失败判定门限（连续成功/失败次数）
# Huawei VRP 支持设置判定门限
[CE-CAMPUS-01-nqa-test-icmp-test-telecom] succeed-threshold 3
[CE-CAMPUS-01-nqa-test-icmp-test-telecom] fail-threshold 5
# 连续5次失败才判定为故障，连续3次成功才判定为恢复

五、总结

思考

1. NQA 探测目标地址选的是公网 DNS（114.114.114.114），但这个地址本身可能跨网访问质量不好。如何选择 NQA 探测目标地址才能准确反映出口质量？

2. 校园网采用策略路由按目的地址选路时，如果一个网站同时在电信和联通都有服务器（如 CDN），策略路由是否还能正确选路？

3. 多出口 NAT 转换后，外部服务器看到的源 IP 可能在不同出口间切换。对于有会话保持需求的应用（如在线支付），这种切换会造成什么问题？如何解决？

下篇预告：第143篇：物理冗余与链路冗余的权衡