1. 公网默认路由（day0配置） ```shell ip route-static 0.0.0.0 0 172.171.0.1

    route-policy public-filter permit node 1 if-match ip address prefix-list public-filter

    ip prefix-list public-filter index 10 permit 0.0.0.0 0

    2. 2. **私网路由表中引入公网默认路由（控制器配置）**
    3. ```shell
    4. ip vpn-instance connection-nzy
    5.  route-distinguisher 200:93
    6.  address-family ipv4
    7.   route-replicate from public protocol static route-policy public-filter

    1. 通过源地址匹配哪些地址出公网（控制器配置）

      1. acl basic name nat
      2. rule 0 permit vpn-instance connection-nzy source 16.1.1.0 0.0.0.255

    2. 公网地址池（控制器配置，由于直接使用wan口地址且wan口地址可变，该步骤废弃）

      1. nat address-group 1 name nat
      2. address 172.171.15.21 172.171.15.21

    3. 绑定出向NAT策略，注意无需要指定vpn实例（控制器配置）

      1. interface GigabitEthernet2/0
      2. description wan
      3. ip address 172.171.15.21 255.255.240.0
      4. nat outbound name nat
      5. ipsec apply policy connection-nzy_cpe-14_vpe14

    测试报文：
    创建虚网

    1. {
    2.   "branchList": [
    3.     {
    4.       "active": true,
    5.       "cpe": {
    6.         "accessPoints": [{
    7.          "accessRoutes": [
    8.               {
    9.                 "nexthop": "16.1.1.2",
    10.                 "prefix": "52.1.1.0/24"
    11.               }
    12.             ],
    13.           "bandwidth": "100",
    14.           "interfaceIp": "16.1.1.1/24",
    15.           "interfaceName": "GigabitEthernet1/0",
    16.           "vlan": "1006"
    17.         }],
    18.           "snat": {
    19.               "interfaceName": "GigabitEthernet2/0",
    20.               "prefix": ["16.1.1.0/24"]
    21.           },
    22.         "deviceName": "cpe14"
    23.       },
    24.       "description": "branch6",
    25.       "links": [{
    26.         "cpeIfIp": "172.171.15.21/24",
    27.         "cpeIfName": "GigabitEthernet2/0",
    28.         "cpeName": "cpe14",
    29.         "vpeIfIp": "172.171.15.24/24",
    30.         "vpeIfName": "GigabitEthernet2/0",
    31.         "vpeName": "vpe14"
    32.       }],
    33.       "encapType": "vxlan",
    34.       "name": "branch14",
    35.       "vpes": [{
    36.         "deviceName": "vpe14",
    37.         "peAccessPoints": [{
    38.           "interfaceIp": "19.1.1.2/24",
    39.           "remoteIp": "19.1.1.1/24",
    40.           "interfaceName": "GigabitEthernet3/0",
    41.           "vlan": "1099"
    42.         }]
    43.       }]
    44.     }
    45.   ],
    46.   "description": "connection-nzy",
    47.   "name": "connection-nzy"
    48. }

    更新虚网

    1. {
    2.   "branchList": [{
    3.       "active": true,
    4.       "cpe": {
    5.         "accessPoints": [{
    6.           "bandwidth": "100",
    7.           "interfaceIp": "31.1.1.1/24",
    8.           "interfaceName": "GigabitEthernet0/5",
    9.           "vlan": "1000",
    10.           "dhcpPool": {
    11.             "dhcpEnable": true,
    12.             "gateway": "31.1.1.1",
    13.             "subnet": "31.1.1.0/24",
    14.             "dhcpStart": "31.1.1.3",
    15.             "dhcpEnd": "31.1.1.254",
    16.             "leaseTime": "12"
    17.           }
    18.         }],
    19.         "snat": {
    20.             "interfaceName": "GigabitEthernet0/0",
    21.                 "prefix": ["31.1.1.0/24"]
    22.             },
    23.         "deviceName": "cpe4"
    24.       },
    25.       "description": "branch1",
    26.       "links": [{
    27.         "cpeIfIp": "172.171.15.253/24",
    28.         "cpeIfName": "GigabitEthernet0/0",
    29.         "cpeName": "cpe4",
    30.         "vpeIfIp": "172.171.15.24/24",
    31.         "vpeIfName": "GigabitEthernet2/0",
    32.         "vpeName": "vpe14"
    33.       }],
    34.       "name": "branch1",
    35.       "operation": "add",
    36.       "vpes": [{
    37.         "deviceName": "vpe14",
    38.         "peAccessPoints": [{
    39.           "interfaceIp": "19.1.1.2/24",
    40.           "remoteIp": "19.1.1.1/24",
    41.           "interfaceName": "GigabitEthernet3/0",
    42.           "vlan": "1099"
    43.         }]
    44.       }]
    45.     }
    46.   ],
    47.   "description": "connection-nzy",
    48.   "name": "connection-nzy"
    49. }