我单位因为安全生产需要，部署了涉及整个下级生产部门及各生产岗位的全天候监控系统。同时该系统也负责向上级管理单位提供视频监控的实时查看以及录像资料调取和上传功能。因为单位地理位置分散，主干网络采用了广域网技术进行实施，为了支持7X24小时应用的需求，网络在链路层被设计为星环网结构。但方案实施后发现，因为早期投入的不足以及设计上的缺陷，网络依然不能很好的支持7X24应用的要求，经常发生网络中断或者下级单位硬盘录像机无法回传图像等问题。尤其是作为网络核心层的汇聚路由器，因为涉及的下级单位2M接入端口多，只能使用多台路由器进行汇聚，再将各路由器通过交换机进行连接，同时其中一台路由器需要担当网络边界路由器功能，为处于办公网络环境中的各主机节点以及上级单位用户提供视频监控服务功能，交换机因此长期处于高负荷状态，同时因为汇聚路由器只能相对单独工作，其中某一路由器故障后，在其上所有的接入点网络都将故障，导致该视频监控系统不能很好的稳定工作，影响视频监控的图像回传质量和效果。

需求分析

通过技术部门对前期网络存在问题的分析以及对未来网络必须满足7X24小时应用的强实时要求，此次项目升级改造目标是构建一个"安全稳定，实时有效，高效负载"的系统架构。以达到安全生产监控系统对安全工作实时有效的监控和管理，此次网络改造主要是对网络汇聚核心层从新设计和部署，同时从新规划主干网络中星环网的拓扑，并在汇聚核心层提供路由器的在线热负载备份模式。

实施方案

1、网络核心层规划：

将原核心层路由器由4台接入层普通路由器更换为2台H3C MSR36-20汇聚路由器，并在核心层路由器中使用VRRP路由热负载技术对该两台核心路由器进行LAN口热备模式设置，将其中的一个LAN口设置为WLAN口地址进行WLAN口数据的直接交换。核心层路由器核心参数分别配置如下：

1．1、Master路由器配置：

sysnameMASTER_JiangKong_2
#
telnetserverenable
#
routerid196.*.*.5
#
ospf196
peer196.*.*.50
peer196.*.*.62
peer196.*.*.86
peer196.*.*.106
peer196.*.*.122
peer196.*.*.126
peer196.*.*.142
peer196.*.*.154
peer196.*.*.241
area0.0.0.0
network10.*.*.00.0.0.255
network196.*.*.00.0.0.255
network196.*.*.480.0.0.3
network196.*.*.600.0.0.3
network196.*.*.840.0.0.3
network196.*.*.1040.0.0.3
network196.*.*.1200.0.0.3
network196.*.*.1240.0.0.3
network196.*.*.1400.0.0.3
network196.*.*.1520.0.0.3
network196.*.*.2400.0.0.3
#
system-working-mode
password-recoveryenable
#
vlan1
#
controllerCellular0/0
#
controllerCellular0/1
#
interfaceAux0
#
interfaceSerial5/0
fe1unframed
ipaddress196.*.*.49255.255.255.252
ospfnetwork-typep2p
#
interfaceSerial5/1
fe1unframed
ipaddress196.*.*.61255.255.255.252
ospfnetwork-typep2p
#
interfaceSerial5/2
fe1unframed
ipaddress196.*.*.85255.255.255.252
ospfnetwork-typep2p
#
interfaceSerial5/3
fe1unframed
ipaddress196.*.*.105255.255.255.252
ospfnetwork-typep2p
#
interfaceSerial6/0
fe1unframed
ipaddress196.*.*.121255.255.255.252
ospfnetwork-typep2p
#
interfaceSerial6/1
fe1unframed
ipaddress196.*.*.153255.255.255.252
ospfnetwork-typep2p
#
interfaceSerial6/2
fe1unframed
ipaddress196.*.*.141255.255.255.252
ospfnetwork-typep2p
#
interfaceSerial6/3
fe1unframed
ipaddress196.*.*.125255.255.255.252
ospfnetwork-typep2p
#
interfaceNULL0
#
interfaceGigabitEthernet0/0
portlink-moderoute
comboenablecopper
ipaddress196.*.*.5255.255.255.0
vrrpvrid1virtual-ip196.*.*.1
vrrpvrid1priority120
vrrpvrid1preempt-modedelay5
#
interfaceGigabitEthernet0/1
portlink-moderoute
ipaddress196.*.*.242255.255.255.252
#
interfaceGigabitEthernet0/2
portlink-moderoute
ipaddress10.*.*.252255.255.255.0
vrrpvrid2virtual-ip10.*.*.2
vrrpvrid2priority120
vrrpvrid2preempt-modedelay5
#

1．2、Backup路由器重要参数配置：

sysnameBACKUP_JianKong_1
#
telnetserverenable
#
routerid196.*.*.4
#
ospf196
peer196.*.*.5
peer196.*.*.9
peer196.*.*.14
peer196.*.*.18
peer196.*.*.26
peer196.*.*.46
peer196.*.*.66
peer196.*.*.82
peer196.*.*.158
peer196.*.*.174
peer196.*.*.178
peer196.*.*.194
peer196.*.*.198
peer196.*.*.210
peer196.*.*.214
peer196.*.*.230
peer196.*.*.242
area0.0.0.0
network10.*.*.00.0.0.255
network196.*.*.00.0.0.255
network196.*.*.40.0.0.3
network196.*.*.80.0.0.3
network196.*.*.120.0.0.3
network196.*.*.160.0.0.3
network196.*.*.240.0.0.3
network196.*.*.440.0.0.3
network196.*.*.640.0.0.3
network196.*.*.800.0.0.3
network196.*.*.1560.0.0.3
network196.*.*.1720.0.0.3
network196.*.*.1760.0.0.3
network196.*.*.1920.0.0.3
network196.*.*.1960.0.0.3
network196.*.*.2080.0.0.3
network196.*.*.2120.0.0.3
network196.*.*.2280.0.0.3
network196.*.*.2400.0.0.3
#
ipunreachablesenable
ipttl-expiresenable
#
system-working-mode
password-recoveryenable
#
vlan1
#
controllerCellular0/0
#
controllerCellular0/1
#
interfaceAux0
#
interfaceSerial5/0
fe1unframed
ipaddress196.*.*.197255.255.255.252
ospfnetwork-typep2p
#
interfaceSerial5/1
fe1unframed
ipaddress196.*.*.209255.255.255.252
ospfnetwork-typep2p
#
interfaceSerial5/2
fe1unframed
ipaddress196.*.*.177255.255.255.252
ospfnetwork-typep2p
#
interfaceSerial5/3
fe1unframed
ipaddress196.*.*.193255.255.255.252
#
interfaceSerial5/4
fe1unframed
ipaddress196.*.*.157255.255.255.252
ospfnetwork-typep2p
#
interfaceSerial5/5
fe1unframed
ipaddress196.*.*.173255.255.255.252
ospfnetwork-typep2p
#
interfaceSerial5/6
fe1unframed
ipaddress196.*.*.25255.255.255.252
ospfnetwork-typep2p
#
interfaceSerial5/7
fe1unframed
ipaddress196.*.*.45255.255.255.252
ospfnetwork-typep2p
#
interfaceSerial6/0
fe1unframed
ipaddress196.*.*.17255.255.255.252
ospfnetwork-typep2p
#
interfaceSerial6/1
fe1unframed
ipaddress196.*.*.13255.255.255.252
ospfnetwork-typep2p
#
interfaceSerial6/2
fe1unframed
ipaddress196.*.*.6255.255.255.252
ospfnetwork-typep2p
#
interfaceSerial6/3
fe1unframed
ipaddress196.*.*.10255.255.255.252
ospfnetwork-typep2p
#
interfaceSerial6/4
fe1unframed
ipaddress196.*.*.229255.255.255.252
ospfnetwork-typep2p
#
interfaceSerial6/5
fe1unframed
ipaddress196.*.*.213255.255.255.252
ospfnetwork-typep2p
#
interfaceSerial6/6
fe1unframed
ipaddress196.*.*.65255.255.255.252
ospfnetwork-typep2p
#
interfaceSerial6/7
fe1unframed
ipaddress196.*.*.81255.255.255.252
ospfnetwork-typep2p
#
interfaceNULL0
#
interfaceGigabitEthernet0/0
portlink-moderoute
comboenablecopper
ipaddress196.*.*.4255.255.255.0
vrrpvrid1virtual-ip196.*.*.1
#
interfaceGigabitEthernet0/1
portlink-moderoute
ipaddress196.*.*.241255.255.255.252
#
interfaceGigabitEthernet0/2
portlink-moderoute
ipaddress10.*.*.254255.255.255.0
vrrpvrid2virtual-ip10.*.*.2

2、修改网络拓扑结构

将下级单位12个环网中的24个链路定义为出口及入口个12个，分别交叉接入接入MASTER及BACKUP路由器的WLAN端口进行物理环路保护。增设监控网络核心交换机，从网络层隔离监控网络及办公网络数据包，同时也减轻了原核心交换机高负载压力。改造前后拓扑图如下：

后记

该网络改造方案中重新将单位安全监控网络核心路由器由4台减少为了两台，并将两台理由器对办公网络以及监控网络都通过VRRP技术进行了LAN网络接口的热备负载模式，将下级单位中环网的出口及入口链路分别汇聚在两台热备路由器中。这样可以保证即使两台路由器中的一台完全宕机，监控网络也可以通过另一台路由器的工作完成应用的良好可访问性以及各下级单位视频图像的有效实时回传。从而达到了更新改造需要达到的各项技术指标。同时因为在两台路由器中进行了1000MEthernet端口的路由模式直连，使得数据路由时间大大提高。网络延时明显减少，原网络中从视频服务器到各下级单位路由器平均延时在12MS，经过改造后该延时减少到7MS以内。