思维导图

LAB2思维导图

一、Layer-2

1.1 链路聚合

  • S1和S2之间配置链路聚合，使用手动负载分担模式，基于源目MAC地址负载分担。（2分）

image.png
SW1配置：

  1. [SW1]int Eth-Trunk 1
  2. [SW1-Eth-Trunk1]load-balance src-dst-mac
  3. [SW1-Eth-Trunk1]trunkport GigabitEthernet 0/0/23
  4. [SW1-Eth-Trunk1]trunkport GigabitEthernet 0/0/24

SW2配置：

  1. [SW2]int Eth-Trunk 1
  2. [SW2-Eth-Trunk1]load-balance src-dst-mac
  3. [SW2-Eth-Trunk1]trunkport GigabitEthernet 0/0/23
  4. [SW2-Eth-Trunk1]trunkport GigabitEthernet 0/0/24

最终效果：在SW1/SW2上检查Eth-Trunk状态为UP即可
image.png

1.2 Link-Type

  • 在S1、S2、S3、S4互连接口上的链路类型为Trunk，允许除了VLAN1外的所有VLAN通过。（3分）

image.png
SW1配置：

  1. [SW1]vlan batch 10 20
  2. [SW1]port-group group-member g0/0/1 g0/0/2 g0/0/12 Eth-Trunk 1
  3. [SW1-port-group]port link-type trunk
  4. [SW1-port-group]port trunk allow-pass vlan all
  5. [SW1-port-group]undo port trunk allow-pass vlan 1

SW2配置：

  1. [SW2]vlan batch 10 20
  2. [SW2]port-group group-member g0/0/1 g0/0/2 g0/0/12 Eth-Trunk 1
  3. [SW2-port-group]port link-type trunk
  4. [SW2-port-group]port trunk allow-pass vlan all
  5. [SW2-port-group]undo port trunk allow-pass vlan 1

SW3配置：

  1. [SW2]vlan batch 10 20
  2. [SW3]port-group group-member g0/0/1 g0/0/2
  3. [SW3-port-group]port link-type trunk
  4. [SW3-port-group]port trunk allow-pass vlan all
  5. [SW3-port-group]undo port trunk allow-pass vlan 1
  6. [SW3]int Ethernet0/0/1
  7. [SW3-Ethernet0/0/1]port link-type access
  8. [SW3-Ethernet0/0/1]port default vlan 10

SW4配置：

  1. [SW2]vlan batch 10 20
  2. [SW4]port-group group-member g0/0/1 g0/0/2
  3. [SW4-port-group]port link-type trunk
  4. [SW4-port-group]port trunk allow-pass vlan all
  5. [SW4-port-group]undo port trunk allow-pass vlan 1
  6. [SW4]int Ethernet0/0/1
  7. [SW4-Ethernet0/0/1]port link-type access
  8. [SW4-Ethernet0/0/1]port default vlan 20

1.3 VRRP

  • CE1、CE2的VRRP虚拟IP地址10.3.1.254，为PC1的网关。CE1会周期发送Sender IP为10.3.1.254，源MAC为00-00-5E-00-01-01的免费ARP。PC1与网关之间的数据包封装在VLAN10中（PC1收发untag的帧）。

image.png
CE1配置：

  1. [CE1]int GigabitEthernet 0/0/2.10
  2. [CE1-GigabitEthernet0/0/2.10]arp broadcast enable
  3. [CE1-GigabitEthernet0/0/2.10]vrrp vrid 1 virtual-ip 10.3.1.254
  4. [CE1-GigabitEthernet0/0/2.10]vrrp vrid 1 priority 120


CE2配置：**

  1. [CE2]int GigabitEthernet 0/0/2.10
  2. [CE2-GigabitEthernet0/0/2.10]arp broadcast enable
  3. [CE2-GigabitEthernet0/0/2.10]vrrp vrid 1 virtual-ip 10.3.1.254
  • CE1、CE2的VRRP虚拟IP地址10.3.2.254，为Server1的网关。CE2会周期发送Sender IP为10.3.2.254，源MAC为00-00-5E-00-01-02的免费ARP。PC1与网关之间的数据包封装在VLAN20中（PC1收发untag的帧）。

image.png
CE1配置：

  1. [CE1]int GigabitEthernet 0/0/2.20
  2. [CE1-GigabitEthernet0/0/2.20]arp broadcast enable
  3. [CE1-GigabitEthernet0/0/2.20]vrrp vrid 2 virtual-ip 10.3.2.254

CE2配置：

  1. [CE2]int GigabitEthernet 0/0/2.20
  2. [CE2-GigabitEthernet0/0/2.20]arp broadcast enable
  3. [CE2-GigabitEthernet0/0/2.20]vrrp vrid 2 virtual-ip 10.3.2.254
  4. [CE2-GigabitEthernet0/0/2.20]vrrp vrid 2 priority 120
  • VRRP的Master设备重启时，在G0/0/2变为UP一分钟后，才能重新成为Master。

CE1配置：

  1. [CE1]int GigabitEthernet 0/0/2.10
  2. [CE1-GigabitEthernet0/0/2.10]vrrp vrid 1 preempt-mode timer delay 60

CE2配置：

  1. [CE2]int GigabitEthernet 0/0/2.20
  2. [CE2-GigabitEthernet0/0/2.20]vrrp vrid 2 preempt-mode timer delay 60

最终效果：
image.png
image.png
image.png
image.png
image.png
image.png

1.4 MSTP

  • S1、S2、S3、S4都运行MSTP。VLAN10在Instance 10，S1作为Primary Root。VLAN20在Instance 20，S2作为Primary Root。MSTP的region name是HUAWEI，Revision-level为12。

image.png
SW1配置：

  1. [SW1]stp region-configuration
  2. [SW1-mst-region]region-name HUAWEI
  3. [SW1-mst-region]revision-level 12
  4. [SW1-mst-region]instance 10 vlan 10
  5. [SW1-mst-region]instance 20 vlan 20
  6. [SW1-mst-region]active region-configuration
  7. [SW1]stp instance 10 root primary 
  8. [SW1]stp instance 20 root secondary

SW2配置：

  1. [SW2]stp region-configuration
  2. [SW2-mst-region]region-name HUAWEI
  3. [SW2-mst-region]revision-level 12
  4. [SW2-mst-region]instance 10 vlan 10
  5. [SW2-mst-region]instance 20 vlan 20
  6. [SW2-mst-region]active region-configuration
  7. [SW2]stp instance 10 root secondary
  8. [SW2]stp instance 20 root primary

SW3配置：

  1. [SW3]stp region-configuration 
  2. [SW3-mst-region]region-name HUAWEI
  3. [SW3-mst-region]revision-level 12
  4. [SW3-mst-region]instance 10 vlan 10
  5. [SW3-mst-region]instance 20 vlan 20
  6. [SW3-mst-region]active region-configuration

SW4配置：

  1. [SW4]stp region-configuration 
  2. [SW4-mst-region]region-name HUAWEI
  3. [SW4-mst-region]revision-level 12
  4. [SW4-mst-region]instance 10 vlan 10
  5. [SW4-mst-region]instance 20 vlan 20
  6. [SW4-mst-region]active region-configuration
  • 除了交换机互联的接口，其它接口要确保不能参与MSTP计算，由Disable直接转到Forwarding状态。

SW1/SW2/SW3/SW4配置：将交换机互联接口的边缘端口功能关闭

  1. [SW1]port-group group-member g0/0/1 g0/0/12 Eth-Trunk 1
  2. [SW1-port-group]stp edged-port disable
  3. ------------------------------------------------------------------------------------------
  4. [SW2]port-group group-member g0/0/1 g0/0/12 Eth-Trunk 1
  5. [SW2-port-group]stp edged-port disable
  6. ------------------------------------------------------------------------------------------
  7. [SW3]port-group group-member g0/0/1 g0/0/2
  8. [SW3-port-group]stp edged-port disable
  9. ------------------------------------------------------------------------------------------
  10. [SW4]port-group group-member g0/0/1 g0/0/2
  11. [SW4-port-group]stp edged-port disable

SW1/SW2/SW3/SW4配置：全局开启边缘端口功能，开启BPDU保护：

  1. [SW1]stp edged-port default
  2. [SW1]stp bpdu-protection
  3. ------------------------------------------------------------------------------------------
  4. [SW2]stp edged-port default
  5. [SW2]stp bpdu-protection
  6. ------------------------------------------------------------------------------------------
  7. [SW3]stp edged-port default
  8. [SW3]stp bpdu-protection
  9. ------------------------------------------------------------------------------------------
  10. [SW4]stp edged-port default
  11. [SW4]stp bpdu-protection

最终效果：
image.png
image.png

1.5 WAN

  • PE1-RR1的互联接口Serial接口，绑定为一个逻辑接口，成员链路采用HDLC。逻辑接口的IPv4地址，IPv6地址，请按图中需求配置。（1分）

image.png

PE1配置：

  1. [PE1]int Serial 0/0/0
  2. [PE1-Serial0/0/0]link-protocol hdlc
  3. [PE1]int Serial 0/0/1
  4. [PE1-Serial0/0/1]link-protocol hdlc
  5. [PE1]int Ip-Trunk 1
  6. [PE1-Ip-Trunk1]trunkport Serial 0/0/0
  7. [PE1-Ip-Trunk1]trunkport Serial 0/0/1
  8. [PE1-Ip-Trunk1]ip address 10.1.13.1 30
  9. [PE1-Ip-Trunk1]ipv6 enable
  10. [PE1-Ip-Trunk1]ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:1300 127

RR1配置：

  1. [RR1]int Serial 0/0/0
  2. [RR1-Serial0/0/0]link-protocol hdlc
  3. [RR1]int Serial 0/0/1
  4. [RR1-Serial0/0/1]link-protocol hdlc
  5. [RR1]int Ip-Trunk 1
  6. [RR1-Ip-Trunk1]trunkport Serial 0/0/0
  7. [RR1-Ip-Trunk1]trunkport Serial 0/0/1
  8. [RR1-Ip-Trunk1]ip address 10.1.13.2 30
  9. [RR1-Ip-Trunk1]ipv6 enable 
  10. [RR1-Ip-Trunk1]ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:1301 127

最终效果：
image.png
image.png
image.png

  • PE3-CE3的互联接口POS接口，绑定为一个逻辑接口，成员链路采用PPP。逻辑接口的IPv4地址，按照图中需求配置。

image.png

PE3配置：

  1. [PE3]int Mp-group 0/0/0
  2. [PE3-Mp-group0/0/0]ip address 10.2.33.2 30
  3. [PE3]int Pos 4/0/0
  4. [PE3-Pos4/0/0]ppp mp Mp-group 0/0/0
  5. [PE3]int Pos 6/0/0
  6. [PE3-Pos6/0/0]ppp mp Mp-group 0/0/0

CE3配置：

  1. [CE3]int Mp-group 0/0/0
  2. [CE3-Mp-group0/0/0]ip address 10.2.33.1 30
  3. [CE3]int Pos 4/0/0
  4. [CE3-Pos4/0/0]ppp mp Mp-group 0/0/0
  5. [CE3]int Pos 6/0/0
  6. [CE3-Pos6/0/0]ppp mp Mp-group 0/0/0

最终效果：
image.png
image.png

二、IPv4 IGP


2.1 基本配置


  • 所有设备的接口IPv4地址，按照图中配置。（除PE1-RR1的逻辑接口之外，已经预配）。
  • Router-id与Loopback0的IPv4地址相同。MPLS域中各个设备的loopback0，从172.16.0.0/16取可用的主机地址，比如172.16.1.21/32可能分部在AS100，也可能分部在AS200。


2.2 OSPF


  • CE1和CE2之间的链路，及该两台设备的loopback0，通告入OSPF区域0（已预配置）
  • CE1的G0/0/2.10和G0/0/2.20，CE2的G0/0/2.10和G0/0/2.20，直连网段宣告进入OSPF区域0，但这些接口不能收发OSPF报文。（2分）

image.png
CE1配置：

  1. [CE1]ospf 1
  2. [CE1-ospf-1]area 0
  3. [CE1-ospf-1-area-0.0.0.0]network 10.3.1.1 0.0.0.0
  4. [CE1-ospf-1-area-0.0.0.0]network 10.3.2.1 0.0.0.0
  5. [CE1-ospf-1-area-0.0.0.0]quit
  6. [CE1-ospf-1]silent-interface GigabitEthernet 0/0/2.10
  7. [CE1-ospf-1]silent-interface GigabitEthernet 0/0/2.20

CE2配置：

  1. [CE2]ospf 1
  2. [CE2-ospf-1]area 0
  3. [CE2-ospf-1-area-0.0.0.0]network 10.3.1.2 0.0.0.0
  4. [CE2-ospf-1-area-0.0.0.0]network 10.3.2.2 0.0.0.0
  5. [CE2-ospf-1-area-0.0.0.0]quit
  6. [CE2-ospf-1]silent-interface GigabitEthernet 0/0/2.10
  7. [CE2-ospf-1]silent-interface GigabitEthernet 0/0/2.20

[cEIdispayospfpeebrie
ID172.17.1.1
OSPEProcEsS
Router
With
PeerStatisticIntormatio
State
AreaId
Neighbor
id
Intesface
Fu11
GigabitEtherneto/o/o
0.0.0.0
172,17.1.2
image.png

最终效果：image.png

  • 最终CE1和CE2只通过G0/0/0接口建立邻接关系，没有通过GE0/0/2.10和GE0/0/2.20建立邻接关系。

image.png
image.png

  • RR2、P2、PE3、PE4在OSPF区域0中，cost如图所示。（已预配置）
  • PE3-PE4的OSPF链路类型为P2P。（1分）

image.png

PE3/PE4配置：

  1. [PE3]int GigabitEthernet 0/0/0
  2. [PE3-GigabitEthernet0/0/0]ospf network-type p2p
  3. ------------------------------------------------------------------------------------------
  4. [PE4]int GigabitEthernet 0/0/0
  5. [PE4-GigabitEthernet0/0/0]ospf network-type p2p


  • PE4上将loopback0地址引入OSPF。AS200中，各OSPF网元到PE4的loopback0的路由，要包含内部的cost。

image.png

PE4配置：

  1. [PE4]ip ip-prefix PE4 permit 172.16.1.2 32
  2. [PE4]route-policy PE4 permit node 10
  3. [PE4-route-policy]if-match ip-prefix PE4
  4. [PE4]ospf 1
  5. [PE4-ospf-1]import-route direct route-policy PE4 type 1

最终效果：在其它路由器上172.16.1.2/32这条路由包含内部cost。
image.png

2.3 ISIS


  • AS100内loopback0和互联接口全部开启ISIS协议，其中PE1、PE2路由类型为level-1，区域号为49.0001，RR1、P1路由类型Level-1-2，区域号为49.0001，ASBR1、ASBR2路由类型为Level-2，区域号为49.0002。各单元的System-ID唯一，cost-style为wide，cost值如图配置（除PE1-RR1之间的逻辑接口外，已预配置）。此时AS100中的所有ISIS路由器的loopback0都开启了ISIS功能。

image.png

PE1/RR1配置：根据以上题意，发现PE1-RR1之间的IP-Trunk没有配置ISIS和开销

  1. [PE1]int Ip-Trunk 1
  2. [PE1-Ip-Trunk1]isis enable
  3. [PE1-Ip-Trunk1]isis cost 1500
  4. ------------------------------------------------------------------------------------------
  5. [RR1]int Ip-Trunk 1
  6. [RR1-Ip-Trunk1]isis enable 
  7. [RR1-Ip-Trunk1]isis cost 1500


  • RR2-P2的ISIS链路类型为P2P。（1分）

RR2/P2配置：

  1. [RR2]int GigabitEthernet 0/0/0
  2. [RR2-GigabitEthernet0/0/0]isis circuit-type p2p
  3. ------------------------------------------------------------------------------------------
  4. [P1]int GigabitEthernet 0/0/0
  5. [P1-GigabitEthernet0/0/0]isis circuit-type p2p


  • 为了保证后续MPLS VPN中的AS100公网LDP的可达（L1设备默认只有默认路由指向L2），在RR1和P1上做172.16.0.0/16主机路由level-2向level-1路由的渗透。（自记）

RR1/P1配置：

  1. [RR1]ip ip-prefix L2toL1 permit 172.16.0.0 16 greater-equal 32 less-equal 32
  2. [RR1]isis 1
  3. [RR1-isis-1]import-route isis level-2 into level-1 filter-policy ip-prefix L2toL1
  4. -------------------------------------------------------------------------------------------------
  5. [P1]ip ip-prefix L2toL1 permit 172.16.0.0 16 greater-equal 32 less-equal 32
  6. [P1]isis 1
  7. [P1-isis-1]import-route isis level-2 into level-1 filter-policy ip-prefix L2toL1

最终效果：Level-1设备学习到了AS100域内的所有ISIS路由器的loopback0接口地址
image.png

  • 在RR2、P2上，ISIS和OSPF双向引入前缀为172.16.0.0/16的主机路由。被引入的协议的cost要继承到引入后的协议中，P2和PE4的loopback0互访走最优路径。配置要求有最好的拓展性。（8分）

image.png

RR2配置：

  1. [RR2]ip ip-prefix in permit 172.16.0.0 16 greater-equal 32 less-equal 32
  2. [RR2]route-policy ospftoisis deny node 10
  3. [RR2-route-policy]if-match tag 200
  4. [RR2-route-policy]quit
  5. [RR2]route-policy ospftoisis permit node 20
  6. [RR2-route-policy]if-match ip-prefix in
  7. [RR2-route-policy]apply tag 100
  8. [RR2-route-policy]quit
  9. [RR2]isis 1
  10. [RR2-isis-1]import-route ospf 1 inherit-cost route-policy ospftoisis
  11. ------------------------------------------------------------------------------------------
  12. [RR2]route-policy isistoospf deny node 10
  13. [RR2-route-policy]if-match tag 300
  14. [RR2-route-policy]quit
  15. [RR2]route-policy isistoospf permit node 20
  16. [RR2-route-policy]if-match ip-prefix in
  17. [RR2-route-policy]apply tag 400
  18. [RR2-route-policy]quit
  19. [RR2]ospf 1
  20. [RR2-ospf-1]default cost inherit-metric
  21. [RR2-ospf-1]import-route isis 1 route-policy isistoospf

P2配置：

  1. [P2]ip ip-prefix in permit 172.16.0.0 16 greater-equal 32 less-equal 32
  2. [P2]route-policy ospftoisis deny node 10
  3. [P2-route-policy]if-match tag 400
  4. [P2-route-policy]quit
  5. [P2]route-policy ospftoisis permit node 20
  6. [P2-route-policy]if-match ip-prefix in
  7. [P2-route-policy]apply tag 300
  8. [P2-route-policy]quit
  9. [P2]isis 1
  10. [P2-isis-1]import-route ospf 1 inherit-cost route-policy ospftoisis
  11. ------------------------------------------------------------------------------------------
  12. [P2]route-policy isistoospf deny node 10
  13. [P2-route-policy]if-match tag 100
  14. [P2-route-policy]quit
  15. [P2]route-policy isistoospf permit node 20
  16. [P2-route-policy]if-match ip-prefix in
  17. [P2-route-policy]apply tag 200
  18. [P2-route-policy]quit
  19. [P2]ospf 1
  20. [P2-ospf-1]default cost inherit-metric
  21. [P2-ospf-1]import-route isis 1 route-policy isistoospf

最后通过标签解决环路问题，环路导致的原因：

  1. P2通过OSPF从PE4学习到的172.16.1.2这个外部路由的优先级是150
  2. 在做完双向引入后，RR2把172.16.1.2这条路由引入进ISIS，通过ISIS传递给P2，P2收到后，优先级是15
  3. 设备在对比后，优选了ISIS这条路由，导致路由环路

解决思路：在OSPF中，将不带标签的外部路由的优先级修改为10（高于15）（双向引入后，只有172.16.1.2这条路由是没有带标签的）。

RR2/P2配置：

  1. [RR2]route-policy preference permit node 10
  2. [RR2-route-policy]if-match tag 200
  3. [RR2-route-policy]apply preference 150
  4. [RR2-route-policy]quit
  5. [RR2]ospf 1
  6. [RR2-ospf-1]preference ase route-policy preference 10
  7. ------------------------------------------------------------------------------------------
  8. [P2]route-policy preference permit node 10
  9. [P2-route-policy]if-match tag 400
  10. [P2-route-policy]apply preference 150
  11. [P2-route-policy]quit
  12. [P2]ospf 1
  13. [P2-ospf-1]preference ase route-policy preference 10

最终效果：
image.png

  • 通过以上操作，P2上OSPF学习到的路由172.16.1.2/32的优先级更高，所以优选OSPF路由。


  • P1的ISIS进程：产生LSP的最大延迟时间是1S，初始延时为50ms，递增时间为50ms，使能LSP的快速扩散特性，SPF计算最大延迟为1s，初始延时为100ms，递增时间为100ms。

P1配置：

  1. [P1]isis 1
  2. [P1-isis-1]timer lsp-generation 1 50 50
  3. [P1-isis-1]flash-flood
  4. [P1-isis-1]timer spf 1 100 100


三、MPLS VPN


3.1 基础配置


  • CE1、CE2为VPN1的Hub-CE，PE1、PE2为Hub-PE；CE3、CE4为VPN1的Spoke站点；PE3、PE4为Spoke-PE。


  • CE4为Multi-VPN-Instance CE，CE4的VPN实例VPN1，通过子接口GE0/0/1.1连接PE4。

image.png
CE4配置：配置VPN实例VPN1，将接口绑定VPN实例VPN1

  1. [CE4]ip vpn-instance VPN1
  2. [CE4-vpn-instance-VPN1]route-distinguisher 100:14
  3. [CE4]int GigabitEthernet 0/0/1.1
  4. [CE4-GigabitEthernet0/0/1.1]ip binding vpn-instance VPN1
  5. [CE4-GigabitEthernet0/0/1.1]ip address 10.2.41.1 30
  6. [CE4]int LoopBack 0
  7. [CE4-LoopBack0]ip binding vpn-instance VPN1
  8. [CE4-LoopBack0]ip address 172.17.1.4 32
  9. [CE4]int LoopBack 1
  10. [CE4-LoopBack1]ip binding vpn-instance VPN1
  11. [CE4-LoopBack1]ip address 10.3.3.4 32


  • 合理设置VPN1参数，使得Spoke站点互访的流量必须经过Hub-CE设备。当CE1-PE1链路断开的情况下，PE1仍然可以学习到CE1的业务路由。（PE3上VPN1的RD为100:13，Export RT为100:1，Import RT为200:1）。（2分）

image.png
PE1配置：

  1. [PE1]ip vpn-instance vpn-in
  2. [PE1-vpn-instance-vpn-in]route-distinguisher 100:10
  3. [PE1-vpn-instance-vpn-in-af-ipv4]vpn-target 100:1 import-extcommunity
  4. [PE1-vpn-instance-vpn-in]quit
  5. [PE1]ip vpn-instance vpn-out
  6. [PE1-vpn-instance-vpn-out]route-distinguisher 100:12
  7. [PE1-vpn-instance-vpn-out-af-ipv4]vpn-target 200:1 export-extcommunity
  8. [PE1-vpn-instance-vpn-out]quit
  9. [PE1]int GigabitEthernet0/0/1.1
  10. [PE1-GigabitEthernet0/0/1.1]arp broadcast enable
  11. [PE1-GigabitEthernet0/0/1.1]ip binding vpn-instance vpn-in
  12. [PE1-GigabitEthernet0/0/1.1]ip address 10.2.11.2 30
  13. [PE1]int GigabitEthernet0/0/1.2
  14. [PE1-GigabitEthernet0/0/1.2]arp broadcast enable
  15. [PE1-GigabitEthernet0/0/1.2]ip binding vpn-instance vpn-out
  16. [PE1-GigabitEthernet0/0/1.2]ip address 10.2.11.6 30
  17. ------------------------------------------------------------------------------------------
  18. [PE1]bgp 100
  19. [PE1-bgp]ipv4-family vpn-instance vpn-in
  20. [PE1-bgp-vpn-in]peer 10.2.11.1 as-number 65000
  21. [PE1-bgp-vpn-in]quit
  22. [PE1-bgp]ipv4-family vpn-instance vpn-out
  23. [PE1-bgp-vpn-out]peer 10.2.11.5 as-number 65000

PE2配置：

  1. [PE2]ip vpn-instance vpn-in
  2. [PE2-vpn-instance-vpn-in]route-distinguisher 100:11
  3. [PE2-vpn-instance-vpn-in-af-ipv4]vpn-target 100:1 import-extcommunity
  4. [PE2-vpn-instance-vpn-in]quit
  5. [PE2]ip vpn-instance vpn-out
  6. [PE2-vpn-instance-vpn-out]route-distinguisher 100:15
  7. [PE2-vpn-instance-vpn-out-af-ipv4]vpn-target 200:1 export-extcommunity
  8. [PE2-vpn-instance-vpn-out]quit
  9. [PE2]int GigabitEthernet0/0/1.1
  10. [PE2-GigabitEthernet0/0/1.1]arp broadcast enable
  11. [PE2-GigabitEthernet0/0/1.1]ip binding vpn-instance vpn-in
  12. [PE2-GigabitEthernet0/0/1.1]ip address 10.2.22.2 30
  13. [PE2]int GigabitEthernet0/0/1.2
  14. [PE2-GigabitEthernet0/0/1.2]arp broadcast enable
  15. [PE2-GigabitEthernet0/0/1.2]ip binding vpn-instance vpn-out
  16. [PE2-GigabitEthernet0/0/1.2]ip address 10.2.22.6 30
  17. ------------------------------------------------------------------------------------------
  18. [PE2]bgp 100
  19. [PE2-bgp]ipv4-family vpn-instance vpn-in
  20. [PE2-bgp-vpn-in]peer 10.2.22.1 as-number 65000
  21. [PE2-bgp-vpn-in]quit
  22. [PE2-bgp]ipv4-family vpn-instance vpn-out
  23. [PE2-bgp-vpn-out]peer 10.2.22.5 as-number 65000

CE1配置：

  1. [CE1]int GigabitEthernet 0/0/1.1
  2. [CE1-GigabitEthernet0/0/1.1]arp broadcast enable 
  3. [CE1]int GigabitEthernet 0/0/1.2
  4. [CE1-GigabitEthernet0/0/1.2]arp broadcast enable
  5. [CE1]bgp 65000
  6. [CE1-bgp]peer 10.2.11.2 as-number 100
  7. [CE1-bgp]peer 10.2.11.6 as-number 100

CE2配置：

  1. [CE2]int GigabitEthernet 0/0/1.1
  2. [CE2-GigabitEthernet0/0/1.1]arp broadcast enable 
  3. [CE2]int GigabitEthernet 0/0/1.2
  4. [CE2-GigabitEthernet0/0/1.2]arp broadcast enable
  5. [CE2]bgp 65000
  6. [CE2-bgp]peer 10.2.22.2 as-number 100
  7. [CE2-bgp]peer 10.2.22.6 as-number 100

最终效果：CE与PE设备建立Established的BGP邻居关系
image.png
image.png

  • 如图，CE1通过G0/0/1.1和G0/0/1.2建立直连的EBGP邻居，接入PE1。CE1通过GE0/0/1.2，向PE1通告BGP Update中，某些路由的AS-path中有200。在CE1上将OSPF路由导入BGP。（2分）

CE1配置：

  1. [CE1]bgp 65000
  2. [CE1-bgp]import-route ospf 1 med 0

PE1配置：

  1. [PE1]bgp 100
  2. [PE1-bgp]ipv4-family vpn-instance vpn-out
  3. [PE1-bgp-vpn-out]peer 10.2.11.5 allow-as-loop


  • 如图，CE2通过G0/0/1.1和G0/0/1.2建立直连的EBGP邻居，接入PE2。CE2通过GE0/0/1.2，向PE2通告BGP Update中，某些路由的AS-path中有200。在CE2上将OSPF路由导入BGP。（2分）

CE2配置：

  1. [CE2]bgp 65000
  2. [CE2-bgp]import-route ospf 1 med 0

PE2配置：

  1. [PE2]bgp 100
  2. [PE2-bgp]ipv4-family vpn-instance vpn-out
  3. [PE2-bgp-vpn-out]peer 10.2.22.5 allow-as-loop


  • CE3通过OSPF区域1接入PE3，通过PE3-CE3的逻辑接口互通，通告CE3的各环回口，CE4通过OSPF区域0接入PE4，通过PE4-CE4的G0/0/1.1接口互通，通告CE4的环回口。

PE3配置：

  1. [PE3]ip vpn-instance VPN1
  2. [PE3-vpn-instance-VPN1]route-distinguisher 100:13
  3. [PE3-vpn-instance-VPN1-af-ipv4]vpn-target 100:1 export-extcommunity
  4. [PE3-vpn-instance-VPN1-af-ipv4]vpn-target 200:1 import-extcommunity
  5. [PE3-vpn-instance-VPN1]quit
  6. [PE3]int Mp-group 0/0/0
  7. [PE3-Mp-group0/0/0]ip binding vpn-instance VPN1
  8. [PE3-Mp-group0/0/0]ip address 10.2.33.2 30
  9. ------------------------------------------------------------------------------------------
  10. [PE3]ospf 2 vpn-instance VPN1
  11. [PE3-ospf-2]area 1
  12. [PE3-ospf-2-area-0.0.0.1]network 10.2.33.2 0.0.0.0

PE4配置：

  1. [PE4]ip vpn-instance VPN1
  2. [PE4-vpn-instance-VPN1]route-distinguisher 100:14
  3. [PE4-vpn-instance-VPN1-af-ipv4]vpn-target 100:1 export-extcommunity 
  4. [PE4-vpn-instance-VPN1-af-ipv4]vpn-target 200:1 import-extcommunity
  5. [PE4-vpn-instance-VPN1]quit
  6. [PE4]int GigabitEthernet 0/0/1.1
  7. [PE4-GigabitEthernet0/0/1.1]ip binding vpn-instance VPN1
  8. [PE4-GigabitEthernet0/0/1.1]ip address 10.2.41.2 30
  9. ------------------------------------------------------------------------------------------
  10. [PE4]ospf 2 vpn-instance VPN1
  11. [PE4-ospf-2]area 0
  12. [PE4-ospf-2-area-0.0.0.0]network 10.2.41.2 0.0.0.0

CE3配置：

  1. [CE3]ospf 2
  2. [CE3-ospf-2]area 1
  3. [CE3-ospf-2-area-0.0.0.1]network 10.2.33.1 0.0.0.0
  4. [CE3-ospf-2-area-0.0.0.1]network 10.3.3.3 0.0.0
  5. [CE3-ospf-2-area-0.0.0.1]network 172.17.1.3 0.0.0.0

CE4配置：

  1. [CE4]ospf 2 vpn-instance VPN1
  2. [CE4-ospf-2]vpn-instance-capability simple
  3. [CE4-ospf-2-area-0.0.0.0]network 10.2.41.1 0.0.0.0
  4. [CE4-ospf-2-area-0.0.0.0]network 10.3.3.4 0.0.0.0
  5. [CE4-ospf-2-area-0.0.0.0]network 172.17.1.4 0.0.0.0

最终效果：PE3/PE4学习到了CE3/CE4的环回口地址
image.png
image.png

  • 在ASBR上，将ISIS的loopback0路由引入BGP。（2分）

ASBR1配置：

  1. [ASBR1]ip ip-prefix isisloopback permit 172.16.1.1 32
  2. [ASBR1]ip ip-prefix isisloopback permit 172.16.1.3 32
  3. [ASBR1]ip ip-prefix isisloopback permit 172.16.1.4 32
  4. [ASBR1]ip ip-prefix isisloopback permit 172.16.1.5 32
  5. [ASBR1]ip ip-prefix isisloopback permit 172.16.1.6 32
  6. [ASBR1]ip ip-prefix isisloopback permit 172.16.1.20 32
  7. [ASBR1]route-policy isisloopback permit node 10
  8. [ASBR1-route-policy]if-match ip-prefix isisloopback
  9. [ASBR1]bgp 100
  10. [ASBR1-bgp]import-route isis 1 route-policy isisloopback

ASBR2配置：

  1. [ASBR2]ip ip-prefix isisloopback permit 172.16.1.1 32
  2. [ASBR2]ip ip-prefix isisloopback permit 172.16.1.3 32
  3. [ASBR2]ip ip-prefix isisloopback permit 172.16.1.4 32
  4. [ASBR2]ip ip-prefix isisloopback permit 172.16.1.5 32
  5. [ASBR2]ip ip-prefix isisloopback permit 172.16.1.6 32
  6. [ASBR2]ip ip-prefix isisloopback permit 172.16.1.20 32
  7. [ASBR2]route-policy isisloopback permit node 10
  8. [ASBR2-route-policy]if-match ip-prefix isisloopback
  9. [ASBR2]bgp 100
  10. [ASBR2-bgp]import-route isis 1 route-policy isisloopback

ASBR3配置：

  1. [ASBR3]ip ip-prefix isisloopback permit 172.16.1.7 32
  2. [ASBR3]ip ip-prefix isisloopback permit 172.16.1.8 32
  3. [ASBR3]ip ip-prefix isisloopback permit 172.16.1.9 32
  4. [ASBR3]ip ip-prefix isisloopback permit 172.16.1.10 32
  5. [ASBR3]ip ip-prefix isisloopback permit 172.16.1.11 32
  6. [ASBR3]ip ip-prefix isisloopback permit 172.16.1.2 32
  7. [ASBR3]route-policy isisloopback permit node 10
  8. [ASBR3-route-policy]if-match ip-prefix isisloopback
  9. [ASBR3]bgp 200
  10. [ASBR3-bgp]import-route isis 1 route-policy isisloopback

ASBR4配置：

  1. [ASBR4]ip ip-prefix isisloopback permit 172.16.1.7 32
  2. [ASBR4]ip ip-prefix isisloopback permit 172.16.1.8 32
  3. [ASBR4]ip ip-prefix isisloopback permit 172.16.1.9 32
  4. [ASBR4]ip ip-prefix isisloopback permit 172.16.1.10 32
  5. [ASBR4]ip ip-prefix isisloopback permit 172.16.1.11 32
  6. [ASBR4]ip ip-prefix isisloopback permit 172.16.1.2 32
  7. [ASBR4]route-policy isisloopback permit node 10
  8. [ASBR4-route-policy]if-match ip-prefix isisloopback
  9. [ASBR4]bgp 200
  10. [ASBR4-bgp]import-route isis 1 route-policy isisloopback
  • 如图，AS100、AS200内各个网元配置MPLS LSR-ID，全局使能MPLS，MPLS LDP（已预配）。AS100、AS200内各直连链路建立LDP邻居（除PE1-RR1之间的逻辑链路外，已预配）。（1分）

PE1/RR1配置：

  1. [PE1]int Ip-Trunk 1
  2. [PE1-Ip-Trunk1]mpls
  3. [PE1-Ip-Trunk1]mpls ldp
  4. ------------------------------------------------------------------------------------------
  5. [RR1]int Ip-Trunk 1
  6. [RR1-Ip-Trunk1]mpls
  7. [RR1-Ip-Trunk1]mpls ldp

3.2 MPLS VPN

  • 如图，各站点通过MPLS BGP VPN跨域Option C方案二，能够互相学习路由。MPLS域不能出现次优路径。（15分）

3.2.1 路由传递

BGP（IPv4邻居关系图）
image.png

BGP VPNv4邻居关系图
image.png

  1. 全网通过环回口建立VPNv4的邻居关系
  2. RR作为内部AS的其它PE的反射器
  3. 给邻居传递路由的时候，不需要修改路由的下一跳（例如PE1的路由传递到PE3后，PE3收到的路由下一跳要是PE1的环回口地址）

配置AS100内的IBGP的IPv4/VPNv4的邻居关系

  1. [RR1]bgp 100
  2. [RR1-bgp]peer 172.16.1.1 as-number 100
  3. [RR1-bgp]peer 172.16.1.1 connect-interface LoopBack 0
  4. [RR1-bgp]peer 172.16.1.1 reflect-client
  5. [RR1-bgp]peer 172.16.1.20 as-number 100
  6. [RR1-bgp]peer 172.16.1.20 connect-interface LoopBack 0
  7. [RR1-bgp]peer 172.16.1.20 reflect-client
  8. [RR1-bgp]ipv4-family vpnv4
  9. [RR1-bgp-af-vpnv4]undo policy vpn-target
  10. [RR1-bgp-af-vpnv4]peer 172.16.1.1 enable
  11. [RR1-bgp-af-vpnv4]peer 172.16.1.1 reflect-client
  12. [RR1-bgp-af-vpnv4]peer 172.16.1.1 next-hop-invariable
  13. [RR1-bgp-af-vpnv4]peer 172.16.1.20 enable
  14. [RR1-bgp-af-vpnv4]peer 172.16.1.20 reflect-client
  15. [RR1-bgp-af-vpnv4]peer 172.16.1.20 next-hop-invariable
  16. ------------------------------------------------------------------------------------------
  17. [PE1]bgp 100
  18. [PE1-bgp]peer 172.16.1.3 as-number 100
  19. [PE1-bgp]peer 172.16.1.3 connect-interface LoopBack0
  20. [PE1-bgp]ipv4-family vpnv4
  21. [PE1-bgp-af-vpnv4]peer 172.16.1.3 enable
  22. ------------------------------------------------------------------------------------------
  23. [PE2]bgp 100
  24. [PE2-bgp]peer 172.16.1.3 as-number 100
  25. [PE2-bgp]peer 172.16.1.3 connect-interface LoopBack 0
  26. [PE2-bgp]ipv4-family vpnv4
  27. [PE2-bgp-af-vpnv4]peer 172.16.1.3 enable

最终效果：AS100域内的VPNv4邻居建立成功
image.png

配置AS200内的IBGP IPv4/VPNv4的邻居关系

  1. [RR2]bgp 200
  2. [RR2-bgp]peer 172.16.1.2 as-number 200
  3. [RR2-bgp]peer 172.16.1.2 connect-interface LoopBack 0
  4. [RR2-bgp]peer 172.16.1.2 reflect-client
  5. [RR2-bgp]peer 172.16.1.11 as-number 100
  6. [RR2-bgp]peer 172.16.1.11 connect-interface LoopBack 0
  7. [RR2-bgp]peer 172.16.1.11 reflect-client
  8. [RR2-bgp]ipv4-family vpnv4
  9. [RR2-bgp-af-vpnv4]undo policy vpn-target
  10. [RR2-bgp-af-vpnv4]peer 172.16.1.2 enable
  11. [RR2-bgp-af-vpnv4]peer 172.16.1.2 reflect-client
  12. [RR2-bgp-af-vpnv4]peer 172.16.1.2 next-hop-invariable
  13. [RR2-bgp-af-vpnv4]peer 172.16.1.11 enable
  14. [RR2-bgp-af-vpnv4]peer 172.16.1.11 reflect-client
  15. [RR2-bgp-af-vpnv4]peer 172.16.1.11 next-hop-invariable
  16. ------------------------------------------------------------------------------------------
  17. [PE3]bgp 200
  18. [PE3-bgp]peer 172.16.1.9 as-number 200
  19. [PE3-bgp]peer 172.16.1.9 connect-interface LoopBack 0
  20. [PE3-bgp]ipv4-family vpnv4
  21. [PE3-bgp-af-vpnv4]peer 172.16.1.9 enable
  22. ------------------------------------------------------------------------------------------
  23. [PE4]bgp 200
  24. [PE4-bgp]peer 172.16.1.9 as-number 200
  25. [PE4-bgp]peer 172.16.1.9 connect-interface LoopBack 0
  26. [PE4-bgp]ipv4-family vpnv4
  27. [PE4-bgp-af-vpnv4]peer 172.16.1.9 enable

最终效果：AS200域内的VPNv4邻居建立成功
image.png

ASBR之间建立EBGP（IPv4）的邻居关系

  1. [ASBR1]bgp 100
  2. [ASBR1-bgp]peer 10.1.57.2 as-number 200
  3. ------------------------------------------------------------------------------------------
  4. [ASBR2]bgp 100
  5. [ASBR2-bgp]peer 10.1.68.2 as-number 200
  6. ------------------------------------------------------------------------------------------
  7. [ASBR3]bgp 200
  8. [ASBR3-bgp]peer 10.1.57.1 as-number 100
  9. ------------------------------------------------------------------------------------------
  10. [ASBR4]bgp 200
  11. [ASBR4-bgp]peer 10.1.68.1 as-number 100

分别在ASBR1、ASBR2上将BGP路由引入到ISIS协议（如果没有配置，RR之间邻居起不来）

ASBR1/ASBR2/ASBR3/ASBR4配置：

  1. [ASBR1]isis 1
  2. [ASBR1-isis-1]import-route bgp
  3. ------------------------------------------------------------------------------------------
  4. [ASBR2]isis 1
  5. [ASBR2-isis-1]import-route bgp
  6. ------------------------------------------------------------------------------------------
  7. [ASBR3]isis 1
  8. [ASBR3-isis-1]import-route bgp
  9. ------------------------------------------------------------------------------------------
  10. [ASBR4]isis 1
  11. [ASBR4-isis-1]import-route bgp

最终效果：两个AS域中的PE设备学习到全网的设备的loopback0接口地址
image.png
image.png

RR1与RR2建立EBGP邻居（VPNv4）关系

RR1/RR2配置：

  1. [RR1]bgp 100
  2. [RR1-bgp]peer 172.16.1.9 as-number 200
  3. [RR1-bgp]peer 172.16.1.9 connect-interface LoopBack 0
  4. [RR1-bgp]peer 172.16.1.9 ebgp-max-hop 255
  5. [RR1-bgp]ipv4-family vpnv4
  6. [RR1-bgp-af-vpnv4]peer 172.16.1.9 enable
  7. [RR1-bgp-af-vpnv4]peer 172.16.1.9 allow-as-loop
  8. [RR1-bgp-af-vpnv4]peer 172.16.1.9 next-hop-invariable
  9. [RR1-bgp]ipv4-family unicast
  10. [RR1-bgp-af-ipv4]undo peer 172.16.1.9 enable
  11. ------------------------------------------------------------------------------------------
  12. [RR2]bgp 200
  13. [RR2-bgp]peer 172.16.1.3 as-number 100
  14. [RR2-bgp]peer 172.16.1.3 connect-interface LoopBack 0
  15. [RR2-bgp]peer 172.16.1.3 ebgp-max-hop 255
  16. [RR2-bgp]ipv4-family vpnv4
  17. [RR2-bgp-af-vpnv4]peer 172.16.1.3 enable
  18. [RR2-bgp-af-vpnv4]peer 172.16.1.3 allow-as-loop
  19. [RR2-bgp-af-vpnv4]peer 172.16.1.3 next-hop-invariable
  20. [RR2-bgp]ipv4-family unicast
  21. [RR2-bgp-af-ipv4]undo peer 172.16.1.3 enable

3.2.2 标签分发

  1. 配置ASBR具备标签接受能力和传递能力

ASBR1/ASBR2/ASBR3/ASBR4配置：ASBR之间配置标签接受能力和传递能力

  1. [ASBR1]bgp 100
  2. [ASBR1-bgp]peer 10.1.57.2 label-route-capability
  3. ------------------------------------------------------------------------------------------
  4. [ASBR2]bgp 100
  5. [ASBR2-bgp]peer 10.1.68.2 label-route-capability
  6. ------------------------------------------------------------------------------------------
  7. [ASBR3]bgp 200
  8. [ASBR3-bgp]peer 10.1.57.1 label-route-capability
  9. ------------------------------------------------------------------------------------------
  10. [ASBR4]bgp 200
  11. [ASBR4-bgp]peer 10.1.68.1 label-route-capability

ASBR1/ASBR2/ASBR3/ASBR4配置：在AS之间的ASBR设备接口上开启MPLS

  1. [ASBR1]int GigabitEthernet0/0/2
  2. [ASBR1-GigabitEthernet0/0/2]mpls
  3. ------------------------------------------------------------------------------------------
  4. [ASBR2]int GigabitEthernet0/0/2
  5. [ASBR2-GigabitEthernet0/0/2]mpls
  6. ------------------------------------------------------------------------------------------
  7. [ASBR3]int GigabitEthernet0/0/2
  8. [ASBR3-GigabitEthernet0/0/2]mpls
  9. ------------------------------------------------------------------------------------------
  10. [ASBR4]int GigabitEthernet0/0/2
  11. [ASBR4-GigabitEthernet0/0/2]mpls
  1. 配置ASBR标签分配功能，针对发送给对端ASBR的路由，附加MPLS标签，跨域交换的时候使用

ASBR1/ASBR2/ASB3/ASBR4配置：

  1. [ASBR1]route-policy 2 permit node 10
  2. [ASBR1-route-policy]apply mpls-label
  3. [ASBR1-route-policy]quit
  4. [ASBR1]bgp 100
  5. [ASBR1-bgp]peer 10.1.57.2 route-policy 2 export
  6. ------------------------------------------------------------------------------------------
  7. [ASBR2]route-policy 2 permit node 10
  8. [ASBR2-route-policy]apply mpls-label
  9. [ASBR2-route-policy]quit
  10. [ASBR2]bgp 100
  11. [ASBR2-bgp]peer 10.1.68.2 route-policy 2 export
  12. ------------------------------------------------------------------------------------------
  13. [ASBR3]route-policy 2 permit node 10
  14. [ASBR3-route-policy]apply mpls-label
  15. [ASBR3-route-policy]quit
  16. [ASBR3]bgp 200
  17. [ASBR3-bgp]peer 10.1.57.1 route-policy 2 export
  18. ------------------------------------------------------------------------------------------
  19. [ASBR4]route-policy 2 permit node 10
  20. [ASBR4-route-policy]apply mpls-label
  21. [ASBR4-route-policy]quit
  22. [ASBR4]bgp 200
  23. [ASBR4-bgp]peer 10.1.68.1 route-policy 2 export
  1. 启用为BGP（IPv4）路由产生LDP LSP功能

ASBR1/ASBR2/ASBR3/ASBR4配置：

  1. [ASBR1]mpls
  2. [ASBR1-mpls]lsp-trigger bgp-label-route
  3. ------------------------------------------------------------------------------------------
  4. [ASBR2]mpls
  5. [ASBR2-mpls]lsp-trigger bgp-label-route
  6. ------------------------------------------------------------------------------------------
  7. [ASBR3]mpls
  8. [ASBR3-mpls]lsp-trigger bgp-label-route
  9. ------------------------------------------------------------------------------------------
  10. [ASBR4]mpls
  11. [ASBR4-mpls]lsp-trigger bgp-label-route
  • 在ASBR3上配置后，就会将ASBR1传递过来带标签的路由（BGP LSP）再产生LDP的标签，也就是配置了后，AS内的PE设备去外部AS的时候直接封装LDP的标签即可（2层标签），这就是和方案1的区别点。

3.2.3 路由引入

  • 在PE3、PE4上将VPNv4路由引入OSPF，将OSPF路由引入VPNv4。

PE3/PE4配置：

  1. [PE3]ospf 2 vpn-instance VPN1
  2. [PE3-ospf-2]import-route bgp
  3. [PE3]bgp 200
  4. [PE3-bgp]ipv4-family vpn-instance VPN1
  5. [PE3-bgp-VPN1]import-route ospf 2
  6. ------------------------------------------------------------------------------------------
  7. [PE4]ospf 2 vpn-instance VPN1
  8. [PE4-ospf-2]import-route bgp
  9. [PE4]bgp 200
  10. [PE4-bgp]ipv4-family vpn-instance VPN1
  11. [PE4-bgp-VPN1]import-route ospf 2

3.3 其它配置

  • CE1-PE1之间链路端，CE1设备上可学到Spoke业务网段；当CE2-PE2之间断路，CE2仍可学习到Spoke业务网段。配置保证有最好的拓展性。

CE1配置：

  1. [CE1]route-policy tag permit node 10
  2. [CE1-route-policy]apply tag 100
  3. [CE1-route-policy]quit
  4. [CE1]route-policy ospftobgp deny node 10
  5. [CE1-route-policy]if-match tag 200
  6. [CE1-route-policy]quit
  7. [CE1]route-policy ospftobgp permit node 20
  8. [CE1-route-policy]quit
  9. [CE1]ospf 1
  10. [CE1-ospf-1]import-route bgp route-policy tag
  11. [CE1]bgp 65000
  12. [CE1-bgp]import-route ospf 1 route-policy ospftobgp med 0

CE2配置：

  1. [CE2]route-policy tag permit node 10
  2. [CE2-route-policy]apply tag 200
  3. [CE2-route-policy]quit
  4. [CE2]route-policy ospftobgp deny node 10
  5. [CE2-route-policy]if-match tag 100
  6. [CE2-route-policy]quit
  7. [CE2]route-policy ospftobgp permit node 20
  8. [CE2-route-policy]quit
  9. [CE2]ospf 1
  10. [CE2-ospf-1]import-route bgp route-policy tag
  11. [CE2]bgp 65000
  12. [CE2-bgp]import-route ospf 1 route-policy ospftobgp med 0
  • 在拓扑正常的情况下，需求CE1、CE2访问Spoke业务网段时，不从本AS内部绕行，EBGP优先级改为120。

CE1/CE2配置：

  1. [CE1]bgp 65000
  2. [CE1-bgp]preference 120 255 255
  3. ------------------------------------------------------------------------------------------
  4. [CE2]bgp 65000
  5. [CE2-bgp]preference 120 255 255

最终效果：Hub-CE设备学习到的私网路由优选EBGP路由，不从本AS绕行
image.png
image.png

  • 在PE3/PE4访问对端172.16.A.X/32，若X为奇数，流量走ASBR1-ASBR3这条路径，当X为偶数时，流量走ASBR2-ASBR4这条路径，来回路径是否一致。并保证有最好的拓展性（3分）

因为跨域C方案二要求把BGP引入到ISIS，此处题目要求把ISIS引入到BGP，因此形成了双向引入，而且要求保证最优的拓展性。 所以必须在ASBR上用Tag解决路由回馈问题（之前有配置过路由引入，但是没有做标签）

  1. 跨域双向引入路由优化

image.png

ASBR1配置：

  1. [ASBR1]ip ip-prefix ISIS permit 172.16.0.0 16 greater-equal 32 less-equal 32
  2. [ASBR1]route-policy bgptoisis permit node 10
  3. [ASBR1-route-policy]apply tag 10
  4. [ASBR1-route-policy]quit
  5. [ASBR1]route-policy isistobgp deny node 10
  6. [ASBR1-route-policy]if-match tag 20
  7. [ASBR1-route-policy]quit
  8. [ASBR1]route-policy isistobgp permit node 20
  9. [ASBR1-route-policy]if-match ip-prefix ISIS
  10. [ASBR1]isis 1
  11. [ASBR1-isis-1]import-route bgp route-policy bgptoisis 
  12. [ASBR1]bgp 100
  13. [ASBR1-bgp]import-route isis 1 route-policy isistobgp

ASBR2配置：

  1. [ASBR2]ip ip-prefix ISIS permit 172.16.0.0 16 greater-equal 32 less-equal 32
  2. [ASBR2]route-policy bgptoisis permit node 10
  3. [ASBR2-route-policy]apply tag 20
  4. [ASBR2-route-policy]quit
  5. [ASBR2]route-policy isistobgp deny node 10
  6. [ASBR2-route-policy]if-match tag 10
  7. [ASBR2-route-policy]quit
  8. [ASBR2]route-policy isistobgp permit node 20
  9. [ASBR2-route-policy]if-match ip-prefix ISIS
  10. [ASBR2]isis 1
  11. [ASBR2-isis-1]import-route bgp route-policy bgptoisis 
  12. [ASBR2]bgp 100
  13. [ASBR2-bgp]import-route isis 1 route-policy isistobgp

ASBR3配置：

  1. [ASBR3]ip ip-prefix ISIS permit 172.16.0.0 16 greater-equal 32 less-equal 32
  2. [ASBR3]route-policy bgptoisis permit node 10
  3. [ASBR3-route-policy]apply tag 30
  4. [ASBR3-route-policy]quit
  5. [ASBR3]route-policy isistobgp deny node 10
  6. [ASBR3-route-policy]if-match tag 40
  7. [ASBR3-route-policy]quit
  8. [ASBR3]route-policy isistobgp permit node 20
  9. [ASBR3-route-policy]if-match ip-prefix ISIS
  10. [ASBR3]isis 1
  11. [ASBR3-isis-1]import-route bgp route-policy bgptoisis 
  12. [ASBR3]bgp 100
  13. [ASBR3-bgp]import-route isis 1 route-policy isistobgp

ASBR4配置：

  1. [ASBR4]ip ip-prefix ISIS permit 172.16.0.0 16 greater-equal 32 less-equal 32
  2. [ASBR4]route-policy bgptoisis permit node 10
  3. [ASBR4-route-policy]apply tag 40
  4. [ASBR4-route-policy]quit
  5. [ASBR4]route-policy isistobgp deny node 10
  6. [ASBR4-route-policy]if-match tag 30
  7. [ASBR4-route-policy]quit
  8. [ASBR4]route-policy isistobgp permit node 20
  9. [ASBR4-route-policy]if-match ip-prefix ISIS
  10. [ASBR4]isis 1
  11. [ASBR4-isis-1]import-route bgp route-policy bgptoisis 
  12. [ASBR4]bgp 100
  13. [ASBR4-bgp]import-route isis 1 route-policy isistobgp
  1. 控制流量走向

**

  • 在ASBR上做策略，例如ASBR1上做匹配奇数IP，172.16.1.1 0.0.0.254，抓取到的IP就为172.16.1.1 .3 .5，这样就可以抓取到对端AS200的奇数IP，172.16.1.7 .9 .11，然后在BGP中对路由优先级进行策略，匹配到这些IP的路由优先级调至10。


ASBR1/ASBR3配置：对奇数IP优先级调为10**

  1. [ASBR1]acl 2000
  2. [ASBR1-acl-basic-2000]rule permit source 172.16.1.1 0.0.0.254
  3. [ASBR1]route-policy preference permit node 10
  4. [ASBR1-route-policy]if-match acl 2000
  5. [ASBR1-route-policy]apply preference 10
  6. [ASBR1]bgp 100
  7. [ASBR1-bgp]preference route-policy preference
  8. ------------------------------------------------------------------------------------------
  9. [ASBR3]acl 2000
  10. [ASBR3-acl-basic-2000]rule permit source 172.16.1.1 0.0.0.254
  11. [ASBR3]route-policy preference permit node 10
  12. [ASBR3-route-policy]if-match acl 2000
  13. [ASBR3-route-policy]apply preference 10
  14. [ASBR3]bgp 200
  15. [ASBR3-bgp]preference route-policy preference


ASBR2/ASBR4配置：对偶数IP优先级调为10**

  1. [ASBR2]acl 2000
  2. [ASBR2-acl-basic-2000]rule permit source 172.16.1.0 0.0.0.254
  3. [ASBR2]route-policy preference permit node 10
  4. [ASBR2-route-policy]if-match acl 2000
  5. [ASBR2-route-policy]apply preference 10
  6. [ASBR2]bgp 100
  7. [ASBR2-bgp]preference route-policy preference
  8. ------------------------------------------------------------------------------------------
  9. [ASBR4]acl 2000
  10. [ASBR4-acl-basic-2000]rule permit source 172.16.1.0 0.0.0.254
  11. [ASBR4]route-policy preference permit node 10
  12. [ASBR4-route-policy]if-match acl 2000
  13. [ASBR4-route-policy]apply preference 10
  14. [ASBR4]bgp 100
  15. [ASBR4-bgp]preference route-policy preference

最终效果：
image.png
image.png
image.png
image.png

  • 在PE3/PE4上修改BGP local-preference属性，实现CE3/CE4访问非直连的10.3.X.0/24网段时，若X为奇数，PE3/PE4优选下一跳为PE1，若X为偶数，PE3/PE4优选下一跳为PE2，不用考虑来回路径是否一致。

PE3/PE4配置：

  1. [PE3]ip ip-prefix PE1 permit 172.16.1.1 32
  2. [PE3]ip ip-prefix PE2 permit 172.16.1.20 32
  3. [PE3]acl 2000
  4. [PE3-acl-basic-2000]rule permit source 10.3.1.0 0.0.254.0
  5. [PE3]acl 2001
  6. [PE3-acl-basic-2001]rule permit source 10.3.0.0 0.0.254.0
  7. [PE3]route-policy local permit node 10
  8. [PE3-route-policy]if-match acl 2000
  9. [PE3-route-policy]if-match ip next-hop ip-prefix PE1
  10. [PE3-route-policy]apply local-preference 200
  11. [PE3-route-policy]quit
  12. [PE3]route-policy local permit node 20
  13. [PE3-route-policy]if-match acl 2001
  14. [PE3-route-policy]if-match ip next-hop ip-prefix PE2
  15. [PE3-route-policy]apply local-preference 200
  16. [PE3-route-policy]quit
  17. [PE3]route-policy local permit node 100
  18. [PE3]bgp 200
  19. [PE3-bgp]ipv4-family vpnv4
  20. [PE3-bgp-af-vpnv4]peer 172.16.1.9 route-policy local import
  21. ------------------------------------------------------------------------------------------
  22. [PE4]ip ip-prefix PE1 permit 172.16.1.1 32
  23. [PE4]ip ip-prefix PE2 permit 172.16.1.20 32
  24. [PE4]acl 2000
  25. [PE4-acl-basic-2000]rule permit source 10.3.1.0 0.0.254.0
  26. [PE4]acl 2001
  27. [PE4-acl-basic-2001]rule permit source 10.3.0.0 0.0.254.0
  28. [PE4]route-policy local permit node 10
  29. [PE4-route-policy]if-match acl 2000
  30. [PE4-route-policy]if-match ip next-hop ip-prefix PE1
  31. [PE4-route-policy]apply local-preference 200
  32. [PE4-route-policy]quit
  33. [PE4]route-policy local permit node 20
  34. [PE4-route-policy]if-match acl 2001
  35. [PE4-route-policy]if-match ip next-hop ip-prefix PE2
  36. [PE4-route-policy]apply local-preference 200
  37. [PE4-route-policy]quit
  38. [PE4]route-policy local permit node 100
  39. [PE4]bgp 200
  40. [PE4-bgp]ipv4-family vpnv4
  41. [PE4-bgp-af-vpnv4]peer 172.16.1.9 route-policy local import

最终效果：奇数网段优选下一跳为PE1，偶数网段优选下一跳为PE2
image.png
image.png
image.png
image.png
image.png
image.png

四、Feature

4.1 HA

  • CE1配置静态的默认路由访问ISP，下一跳IP为100.0.1.2。默认该路由要与CE1-ISP链路的BFD绑定（CE1的对端设备不支持BFD），感知故障时间要小于150ms。（2分）

CE1配置：

  1. [CE1]bfd
  2. [CE1]bfd ISP bind peer-ip 100.0.1.2 interface GigabitEthernet 2/0/1 one-arm-echo
  3. [CE1-bfd-session-isp]discriminator local 1
  4. [CE1-bfd-session-isp]min-echo-rx-interval 30
  5. [CE1-bfd-session-isp]commit
  6. [CE1]ip route-static 0.0.0.0 0 100.0.1.2 track bfd-session ISP
  • CE1配置静态的默认路由访问ISP，下一跳IP为100.0.1.2。默认路由要与CE1-ISP链路的NQA ICMP测试，每隔3S测试例执行1次。

CE1配置：

  1. [CE1]nqa test-instance ISP ICMP
  2. [CE1-nqa-ISP-ICMP]test-type icmp 
  3. [CE1-nqa-ISP-ICMP]destination-address ipv4 100.0.1.2
  4. [CE1-nqa-ISP-ICMP]frequency 3
  5. [CE1-nqa-ISP-ICMP]start now
  6. [CE1]ip route-static 0.0.0.0 0 100.0.1.2 track nqa ISP ICMP
  • CE2、CE3、CE4能够通过默认路由访问ISP。（4分）

CE1/CE2配置：

  1. [CE1]ospf 1
  2. [CE1-ospf-1]default-route-advertise
  3. [CE1]bgp 65000
  4. [CE1-bgp]peer 10.2.11.6 default-route-advertise conditional-route-match-all 0.0.0.0 0
  5. ------------------------------------------------------------------------------------------
  6. [CE2]ospf 1
  7. [CE2-ospf-1]default-route-advertise
  8. [CE2]bgp 65000
  9. [CE2-bgp]peer 10.2.22.6 default-route-advertise conditional-route-match-all 0.0.0.0 0

PE3/PE4配置：

  1. [PE3]ospf 2 vpn-instance VPN1
  2. [PE3-ospf-2]default-route-advertise
  3. ------------------------------------------------------------------------------------------
  4. [PE4]ospf 2 vpn-instance VPN1
  5. [PE4-ospf-2]default-route-advertise

4.2 NAT

  • 在CE1上，10.3.0.0/16（不包含10.3.2.10）的内网地址转换为102.0.1.2-102.0.1.6，通过GE2/0/1访问ISP。Server1拥有单独的公网地址102.0.1.1，对ISP提供FTP和HTTP服务。（2分）

CE1配置：

  1. [CE1]nat alg ftp enable
  2. [CE1]nat address-group 1 102.0.1.2 102.0.1.6
  3. [CE1]acl 2000
  4. [CE1-acl-basic-2000]rule deny source 10.3.2.10 0.0.0.0
  5. [CE1-acl-basic-2000]rule permit source 10.3.0.0 0.0.255.255
  6. [CE1]int GigabitEthernet 2/0/1
  7. [CE1-GigabitEthernet2/0/1]nat outbound 2000 address-group 1
  8. [CE1-GigabitEthernet2/0/1]nat server protocol tcp global 102.0.1.1 www inside 10.3.2.10 www
  9. [CE1-GigabitEthernet2/0/1]nat server protocol tcp global 102.0.1.1 ftp inside 10.3.2.10 ftp

最终效果：
image.png
image.png

4.3 QOS

  • 在CE1的G2/0/1，周一至周五的8:00-18:00点，对TCP目的端口号6881-6999的流量，承诺的平均速率为1Mbps。（3分）

CE1配置：

  1. [CE1]time-range working 8:00 to 18:00 working-day 
  2. [CE1]acl 3000
  3. [CE1-acl-adv-3000]rule permit tcp destination-port range 6881 6999 time-range working
  4. [CE1]interface GigabitEthernet 2/0/1
  5. [CE1-GigabitEthernet2/0/1]qos car outbound acl 3000 cir 1024

五、IPv6

5.1 基本配置

  • 所有设备的接口IPv6地址，按照图中配置。（除PE1-RR1的逻辑接口之外，已预配）

PE1/RR1配置：

  1. [PE1]int Ip-Trunk 1
  2. [PE1-Ip-Trunk1]ipv6 enable
  3. [PE1-Ip-Trunk1]ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:1300/127
  4. ------------------------------------------------------------------------------------------
  5. [RR1]int Ip-Trunk 1
  6. [RR1-Ip-Trunk1]ipv6 enable
  7. [RR1-Ip-Trunk1]ipv6 address 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:1301/127

5.2 IPv6 ISIS

  • 如图，PE1、PE2、RR1、P1、ASBR1、ASBR2运行ISIS协议。各直连网段通告入ISIS，配置各链路cost。

image.png

PE1/PE2/RR1/P1/ASBR1/ASBR2配置：**

  1. [PE1]isis 1
  2. [PE1-isis-1]ipv6 enable topology ipv6
  3. [PE1]int GigabitEthernet0/0/0
  4. [PE1-GigabitEthernet0/0/0]isis ipv6 enable
  5. [PE1-GigabitEthernet0/0/0]isis ipv6 cost 20
  6. [PE1]int Ip-Trunk 1
  7. [PE1-Ip-Trunk1]isis ipv6 enable
  8. [PE1-Ip-Trunk1]isis ipv6 cost 1550
  9. [PE1]int LoopBack0
  10. [PE1-LoopBack0]isis ipv6 enable
  11. ------------------------------------------------------------------------------------------
  12. [PE2]isis 1
  13. [PE2-isis-1]ipv6 enable topology ipv6
  14. [PE2]int GigabitEthernet0/0/0
  15. [PE2-GigabitEthernet0/0/0]isis ipv6 enable
  16. [PE2-GigabitEthernet0/0/0]isis ipv6 cost 20
  17. [PE2]int GigabitEthernet0/0/2
  18. [PE2-GigabitEthernet0/0/2]isis ipv6 enable
  19. [PE2-GigabitEthernet0/0/2]isis ipv6 cost 1500
  20. [PE2]int LoopBack0
  21. [PE2-LoopBack0]isis ipv6 enable
  22. ------------------------------------------------------------------------------------------
  23. [RR1]isis 1
  24. [RR1-isis-1]ipv6 enable topology ipv6
  25. [RR1]int GigabitEthernet0/0/0
  26. [RR1-GigabitEthernet0/0/0]isis ipv6 enable
  27. [RR1-GigabitEthernet0/0/0]isis ipv6 cost 80
  28. [RR1]int GigabitEthernet0/0/1
  29. [RR1-GigabitEthernet0/0/1]isis ipv6 enable
  30. [RR1-GigabitEthernet0/0/1]isis ipv6 cost 860
  31. [RR1]int Ip-Trunk 1
  32. [RR1-Ip-Trunk1]isis ipv6 enable
  33. [RR1-Ip-Trunk1]isis ipv6 cost 1550
  34. [RR1]int LoopBack0
  35. [RR1-LoopBack0]isis ipv6 enable
  36. ------------------------------------------------------------------------------------------
  37. [P1]isis 1
  38. [P1-isis-1]ipv6 enable topology ipv6
  39. [P1]int GigabitEthernet0/0/0
  40. [P1-GigabitEthernet0/0/0]isis ipv6 enable
  41. [P1-GigabitEthernet0/0/0]isis ipv6 cost 80
  42. [P1]int GigabitEthernet0/0/2
  43. [P1-GigabitEthernet0/0/2]isis ipv6 enable
  44. [P1-GigabitEthernet0/0/2]isis ipv6 cost 1500
  45. [P1]interface GigabitEthernet0/0/1
  46. [P1-GigabitEthernet0/0/1]isis ipv6 enable
  47. [P1-GigabitEthernet0/0/1]isis ipv6 cost 1000
  48. [P1]int LoopBack0
  49. [P1-LoopBack0]isis ipv6 enable 
  50. ------------------------------------------------------------------------------------------
  51. [ASBR1]isis 1
  52. [ASBR1-isis-1]ipv6 enable topology ipv6 
  53. [ASBR1]int GigabitEthernet0/0/1
  54. [ASBR1-GigabitEthernet0/0/1]isis ipv6 enable
  55. [ASBR1-GigabitEthernet0/0/1]isis ipv6 cost 860
  56. [ASBR1]int GigabitEthernet0/0/0
  57. [ASBR1-GigabitEthernet0/0/0]isis ipv6 enable
  58. [ASBR1-GigabitEthernet0/0/0]isis ipv6 cost 100
  59. [ASBR1]int LoopBack0
  60. [ASBR1-LoopBack0]isis ipv6 enable
  61. ------------------------------------------------------------------------------------------
  62. [ASBR2]isis 1
  63. [ASBR2-isis-1]ipv6 enable topology ipv6
  64. [ASBR2]int GigabitEthernet0/0/1
  65. [ASBR2-GigabitEthernet0/0/1]isis ipv6 enable
  66. [ASBR2-GigabitEthernet0/0/1]isis ipv6 cost 1000
  67. [ASBR2]int GigabitEthernet0/0/
  68. [ASBR2-GigabitEthernet0/0/0]isis ipv6 enable
  69. [ASBR2-GigabitEthernet0/0/0]isis ipv6 cost 100
  70. [ASBR2]int LoopBack0
  71. [ASBR2-LoopBack0]isis ipv6 enable

IPv6路由渗透（为了防止IPv6的ISIS路由的次优路径，在RR1/P1上配置路由泄露）

RR1/P1配置：

  1. [RR1]isis 1
  2. [RR1-isis-1]ipv6 import-route isis level-2 into level-1
  3. ------------------------------------------------------------------------------------------
  4. [P1]isis 1
  5. [P1-isis-1]ipv6 import-route isis level-2 into level-1

5.3 IPv6组播

  • AS100域内所有设备，启用PIM SM

PE1/PE2/RR1/P1/ASBR1/ASBR2配置：

  1. [PE1]multicast ipv6 routing-enable
  2. [PE1]int Ip-Trunk 1
  3. [PE1-Ip-Trunk1]pim ipv6 sm
  4. [PE1]int GigabitEthernet0/0/0
  5. [PE1-GigabitEthernet0/0/0]pim ipv6 sm
  6. ------------------------------------------------------------------------------------------
  7. [PE2]multicast ipv6 routing-enable
  8. [PE2]int GigabitEthernet0/0/0
  9. [PE2-GigabitEthernet0/0/0]pim ipv6 sm
  10. [PE2]int GigabitEthernet0/0/2
  11. [PE2-GigabitEthernet0/0/2]pim ipv6 sm
  12. ------------------------------------------------------------------------------------------
  13. [RR1]multicast ipv6 routing-enable
  14. [RR1]int GigabitEthernet0/0/0
  15. [RR1-GigabitEthernet0/0/0]pim ipv6 sm
  16. [RR1]int GigabitEthernet0/0/1
  17. [RR1-GigabitEthernet0/0/1]pim ipv6 sm
  18. [RR1]int Ip-Trunk 1
  19. [RR1-Ip-Trunk1]pim ipv6 sm
  20. ------------------------------------------------------------------------------------------
  21. [P1]multicast ipv6 routing-enable
  22. [P1-GigabitEthernet0/0/0]pim ipv6 sm
  23. [P1]int GigabitEthernet0/0/1
  24. [P1-GigabitEthernet0/0/1]pim ipv6 sm
  25. [P1]int GigabitEthernet0/0/2
  26. [P1-GigabitEthernet0/0/2]pim ipv6 sm
  27. ------------------------------------------------------------------------------------------
  28. [ASBR1]multicast ipv6 routing-enable
  29. [ASBR1]int GigabitEthernet0/0/0
  30. [ASBR1-GigabitEthernet0/0/0]pim ipv6 sm
  31. [ASBR1]int GigabitEthernet0/0/1
  32. [ASBR1-GigabitEthernet0/0/1]pim ipv6 sm
  33. ------------------------------------------------------------------------------------------
  34. [ASBR2]multicast ipv6 routing-enable
  35. [ASBR2]int GigabitEthernet0/0/0
  36. [ASBR2-GigabitEthernet0/0/0]pim ipv6 sm
  37. [ASBR2]int GigabitEthernet0/0/1
  38. [ASBR2-GigabitEthernet0/0/1]pim ipv6 sm
  • ASBR1，ASBR2的loopback0为C-BSR和C-RP，RP范围FF1E::/112，ASBR1为主BSR，ASBR2为主RP，PE1的E0/0/0加入组FF1E::AA，无论哪台设备作为RP，都需要能够生成（*，G）路由。

ASBR1/ASBR2配置RP和BSR：

  1. [ASBR1]int LoopBack0
  2. [ASBR1-LoopBack0]pim ipv6 sm
  3. [ASBR1]acl ipv6 2000
  4. [ASBR1-acl6-basic-2000]rule permit source FF1E::/112
  5. [ASBR1]pim-ipv6
  6. [ASBR1-pim6]c-bsr priority 255
  7. [ASBR1-pim6]c-bsr 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:DCA5
  8. [ASBR1-pim6]c-rp 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:DCA5 group-policy 2000
  9. ------------------------------------------------------------------------------------------
  10. [ASBR2]int LoopBack0
  11. [ASBR2-LoopBack0]pim ipv6 sm
  12. [ASBR2]acl ipv6 2000
  13. [ASBR2-acl6-basic-2000]rule permit source FF1E::/112
  14. [ASBR2]pim-ipv6
  15. [ASBR2-pim6]c-bsr priority 254
  16. [ASBR2-pim6]c-bsr 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:DCA6
  17. [ASBR2-pim6]c-rp 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:DCA6 group-policy 2000
  18. [ASBR2-pim6]c-rp priority 0


PE1配置：将E0/0/0接口静态加入组播组**

  1. [PE1]int Ethernet0/0/0
  2. [PE1-Ethernet0/0/0]mld static-group FF1E::AA


最终效果：
image.png
image.png
image.png

  • 不管哪台设备作为是RP，产生的（*，G）的路由不能有次优问题。

这个需求在前面做ISIS IPv6路由泄露已经解决！