思维导图

LAB1思维导图

一、Layer-2

1.1 链路聚合

  • S1和S2之间配置链路聚合，使用手动负载分担模式，基于源目MAC地址负载分担。

image.png
SW1配置：

  1. [SW1]int Eth-Trunk 1
  2. [SW1-Eth-Trunk1]mode manual load-balance
  3. [SW1-Eth-Trunk1]load-balance src-dst-mac 
  4. [SW1-Eth-Trunk1]trunkport GigabitEthernet 0/0/23
  5. [SW1-Eth-Trunk1]trunkport GigabitEthernet 0/0/24

SW2配置：

  1. [SW2]int Eth-Trunk 1
  2. [SW2-Eth-Trunk1]mode manual load-balance
  3. [SW2-Eth-Trunk1]load-balance src-dst-mac 
  4. [SW2-Eth-Trunk1]trunkport GigabitEthernet 0/0/23
  5. [SW2-Eth-Trunk1]trunkport GigabitEthernet 0/0/24

最终效果：
image.png
image.png

1.2 Link-type

  • S1,S2,S3,S4互连接口的链路类型为Trunk，允许除VLAN1外的所有VLAN通过。

image.png

image.png
image.png

  • 通过命令查看CE1和CE2的两个接口的预配发现，PC1属于VLAN10，PC2属于VLAN20，同时也可以知道SW1和SW2的接口G0/0/2属于Trunk链路，并且运行除了VLAN1以外的vlan通过。

SW1配置：

  1. [SW2]vlan batch 10 20
  2. [SW1]port-group group-member g0/0/1 g0/0/2 g0/0/12 Eth-Trunk 1
  3. [SW1-port-group]port link-type trunk 
  4. [SW1-port-group]port trunk allow-pass vlan all 
  5. [SW1-port-group]undo port trunk allow-pass vlan 1

SW2配置：

  1. [SW2]vlan batch 10 20
  2. [SW2]port-group group-member g0/0/1 g0/0/2 g0/0/12 Eth-Trunk 1
  3. [SW2-port-group]port link-type trunk 
  4. [SW2-port-group]port trunk allow-pass vlan all 
  5. [SW2-port-group]undo port trunk allow-pass vlan 1

SW3配置：

  1. [SW3]vlan batch 10 20
  2. [SW3]port-group group-member g0/0/1 g0/0/2
  3. [SW3-port-group]port link-type trunk 
  4. [SW3-port-group]port trunk allow-pass vlan all
  5. [SW3-port-group]undo port trunk allow-pass vlan 1
  6. [SW3]int Ethernet0/0/1
  7. [SW3-Ethernet0/0/1]port link-type access
  8. [SW3-Ethernet0/0/1]port default vlan 10

SW4配置：

  1. [SW4]vlan batch 10 20
  2. [SW4]port-group group-member g0/0/1 g0/0/2
  3. [SW4-port-group]port link-type trunk 
  4. [SW4-port-group]port trunk allow-pass vlan all
  5. [SW4-port-group]undo port trunk allow-pass vlan 1
  6. [SW4]int Ethernet0/0/1
  7. [SW4-Ethernet0/0/1]port link-type access
  8. [SW4-Ethernet0/0/1]port default vlan 20

1.3 VRRP

  • CE1，CE2的VRRP虚拟IP地址10.3.1.254，为PC1的网关，CE1会周期性发送Sender IP为10.3.1.254，源MAC为00-00-5E-00-01-01的免费ARP。PC1与网关之间的数据包封装在VLAN10中（PC1收发untag的帧）。

image.png

CE1配置：

  1. [CE1]int GigabitEthernet 0/0/2.10
  2. [CE1-GigabitEthernet0/0/2.10]arp broadcast enable
  3. [CE1-GigabitEthernet0/0/2.10]vrrp vrid 1 virtual-ip 10.3.1.254
  4. [CE1-GigabitEthernet0/0/2.10]vrrp vrid 1 priority 120

CE2配置：

  1. [CE2]int GigabitEthernet 0/0/2.10
  2. [CE2-GigabitEthernet0/0/2.10]arp broadcast enable
  3. [CE2-GigabitEthernet0/0/2.10]vrrp vrid 1 virtual-ip 10.3.1.254
  • CE1，CE2的VRRP虚拟IP地址10.3.2.254，为Server的网关，CE2会周期性发送Sender IP为10.3.2.254，源MAC为00-00-5E-00-01-02的免费ARP。Server2与网关之间的数据包封装在VLAN20中（Server收发untag的帧）。

image.png

CE1配置：

  1. [CE1]int GigabitEthernet 0/0/2.20
  2. [CE1-GigabitEthernet0/0/2.20]arp broadcast enable
  3. [CE1-GigabitEthernet0/0/2.20]vrrp vrid 2 virtual-ip 10.3.2.254

CE2配置：

  1. [CE2]int GigabitEthernet 0/0/2.20
  2. [CE2-GigabitEthernet0/0/2.20]arp broadcast enable
  3. [CE2-GigabitEthernet0/0/2.20]vrrp vrid 2 virtual-ip 10.3.2.254
  4. [CE2-GigabitEthernet0/0/2.20]vrrp vrid 2 priority 120
  • VRRP的Master设备重启时，在G0/0/2变为UP的1分钟后，才能重新成为Master。

CE1配置：

  1. [CE1-GigabitEthernet0/0/2.10]vrrp vrid 1 preempt-mode timer delay 60

CE2配置：

  1. [CE2-GigabitEthernet0/0/2.20]vrrp vrid 2 preempt-mode timer delay 60

最终效果：
image.pngimage.png
image.png
image.png
image.png
image.png

1.4 MSTP

  • S1、S2、S3、S4都运行MSTP。VLAN10在Instance 10，S1作为Primary Root，S2作为Secondary Root。VLAN20在Instance 20，S2作为Primary Root，S1作为Secondary Root。MSTP的region name是HUAWEI，Revision-level为12。

image.png

S1配置：

  1. [SW1]stp mode mstp
  2. [SW1]stp region-configuration
  3. [SW1-mst-region]region-name HUAWEI
  4. [SW1-mst-region]revision-level 12
  5. [SW1-mst-region]instance 10 vlan 10
  6. [SW1-mst-region]instance 20 vlan 20
  7. [SW1-mst-region]active region-configuration
  8. [SW1]stp instance 10 root primary
  9. [SW1]stp instance 20 root secondary

S2配置：

  1. [SW2]stp mode mstp
  2. [SW2]stp region-configuration
  3. [SW2-mst-region]region-name HUAWEI
  4. [SW2-mst-region]revision-level 12
  5. [SW2-mst-region]instance 10 vlan 10
  6. [SW2-mst-region]instance 20 vlan 20
  7. [SW2-mst-region]active region-configuration
  8. [SW2]stp instance 10 root secondary
  9. [SW2]stp instance 20 root primary

S3配置：

  1. [SW3]stp mode mstp
  2. [SW3]stp region-configuration
  3. [SW3-mst-region]region-name HUAWEI
  4. [SW3-mst-region]revision-level 12
  5. [SW3-mst-region]instance 10 vlan 10
  6. [SW3-mst-region]instance 20 vlan 20
  7. [SW3-mst-region]active region-configuration

S4配置：

  1. [SW4]stp mode mstp
  2. [SW4]stp region-configuration
  3. [SW4-mst-region]region-name HUAWEI
  4. [SW4-mst-region]revision-level 12
  5. [SW4-mst-region]instance 10 vlan 10
  6. [SW4-mst-region]instance 20 vlan 20
  7. [SW4-mst-region]active region-configuration

最终效果：
image.png
image.png

  • 除了交换机互连的接口，其它接口要确保不参与MSTP计算。

S1配置：

  1. [SW1]port-group group-member g0/0/1 g0/0/12 Eth-Trunk 1
  2. [SW1-port-group]stp edged-port disable

S2配置：

  1. [SW2]port-group group-member g0/0/1 g0/0/12 Eth-Trunk 1
  2. [SW2-port-group]stp edged-port disable

S3配置：

  1. [SW3]port-group group-member g0/0/1 g0/0/2
  2. [SW3-port-group]stp edged-port disable

S4配置：

  1. [SW4]port-group group-member g0/0/1 g0/0/2
  2. [SW4-port-group]stp edged-port disable

S1/S2/S3/S4配置：

  1. stp edged-port default
  2. stp bpdu-protection

最终效果：
image.png
image.png

1.5 WAN

  • PE1-RR1的互连Serial接口，绑定为一个逻辑接口，成员链路采用HDLC。逻辑接口的IPv4地址，IPv6地址（PS：该IPv6地址放在ipv6需求中再进行配置）

image.png

PE1配置：

  1. [PE1]int Serial 0/0/0
  2. [PE1-Serial0/0/0]link-protocol hdlc
  3. [PE1]int Serial 0/0/1
  4. [PE1-Serial0/0/1]link-protocol hdlc
  5. [PE1]int Ip-Trunk 1
  6. [PE1-Ip-Trunk1]ip address 10.1.13.1 30
  7. [PE1-Ip-Trunk1]trunkport Serial 0/0/0
  8. [PE1-Ip-Trunk1]trunkport Serial 0/0/1

PE2配置：

  1. [PE2]int Serial 0/0/0
  2. [PE2-Serial0/0/0]link-protocol hdlc
  3. [PE2]int Serial 0/0/1
  4. [PE2-Serial0/0/1]link-protocol hdlc
  5. [PE2]int Ip-Trunk 1
  6. [PE2-Ip-Trunk1]ip address 10.1.13.2 30
  7. [PE2-Ip-Trunk1]trunkport Serial 0/0/0
  8. [PE2-Ip-Trunk1]trunkport Serial 0/0/1

最终效果：
image.png

  • PE3-CE3的互连POS接口，绑定为一个逻辑接口，成员链路采用PPP。逻辑接口的IPv4地址。

image.png

PE3配置：

  1. [PE3]int Mp-group 0/0/0
  2. [PE3-Mp-group0/0/0]ip address 10.2.33.2 30
  3. [PE3]int Pos 4/0/0
  4. [PE3-Pos4/0/0]ppp mp Mp-group 0/0/0
  5. [PE3]int Pos 6/0/0
  6. [PE3-Pos6/0/0]ppp mp Mp-group 0/0/0

CE3配置：

  1. [PE4]int Mp-group 0/0/0
  2. [PE4-Mp-group0/0/0]ip address 10.2.33.1 30
  3. [PE4]int Pos 4/0/0
  4. [PE4-Pos4/0/0]ppp mp Mp-group 0/0/0
  5. [PE4]int Pos 6/0/0
  6. [PE4-Pos6/0/0]ppp mp Mp-group 0/0/0

最终效果：
image.png

二、IPv4 IGP

2.1 基本配置

  • 所有设备的接口IPv4地址（除PE1-RR1的逻辑接口之外，已预配置）
  • Router-id与Loopback0的IPv4地址相同。MPLS域中各设备的loopback0，从172.16.0.0/16取可用的主机地址，比如172.16.1.21/32可能分布在AR100，也可能分布在AS200

2.2 OSPF

  • CE和CE2之间的链路，及该两台设备的loopback0，通告入OSPF区域0。（已预配置）
  • CE1和GE0/0/2.10和G0/0/2.20，CE2的GE0/0/2.10和GE0/0/2.20，直连网段宣告入OSPF区域0，但这些接口不能收发OSPF报文。

image.png
CE1配置：

  1. [CE1]ospf 1
  2. [CE1-ospf-1]area 0
  3. [CE1-ospf-1-area-0.0.0.0]network 10.3.1.1 0.0.0.0
  4. [CE1-ospf-1-area-0.0.0.0]network 10.3.2.1 0.0.0.0
  5. [CE1-ospf-1-area-0.0.0.0]quit
  6. [CE1-ospf-1]silent-interface GigabitEthernet 0/0/2.10
  7. [CE1-ospf-1]silent-interface GigabitEthernet 0/0/2.20

CE2配置：

  1. [CE2]ospf 1
  2. [CE2-ospf-1]area 0
  3. [CE2-ospf-1-area-0.0.0.0]network 10.3.1.2 0.0.0.0
  4. [CE2-ospf-1-area-0.0.0.0]network 10.3.2.2 0.0.0.0
  5. [CE2-ospf-1-area-0.0.0.0]quit
  6. [CE2-ospf-1]silent-interface GigabitEthernet 0/0/2.10
  7. [CE1-ospf-1]silent-interface GigabitEthernet 0/0/2.20

最终效果：
image.png

  • 最终CE1和CE2只通过G0/0/0接口建立邻接关系，没有通过GE0/0/2.10和GE0/0/2.20建立邻接关系。

image.png
image.png

  • PE2、P2、PE3、PE4在OSPF区域0中，cost如图所示（都已预配置）。
  • PE3-PE4的OSPF链路类型为P2P。

image.png

PE3配置：

  1. [PE3]int GigabitEthernet 0/0/0
  2. [PE3-GigabitEthernet0/0/0]ospf network-type p2p

PE4配置：

  1. [PE4]int GigabitEthernet 0/0/0
  2. [PE4-GigabitEthernet0/0/0]ospf network-type p2p
  • PE4上将Loopback0地址引入OSPF。AS200中，各OSPF到PE4的loopback0的地址，要包含内部cost。

image.png

PE4配置：

  1. [PE4]ip ip-prefix PE4 permit 172.16.1.2 32
  2. [PE4]route-policy PE4 permit node 10
  3. [PE4-route-policy]if-match ip-prefix PE4
  4. [PE4]ospf 1
  5. [PE4-ospf-1]import-route direct route-policy PE4 type 1 //type-1会保留之前的cost值

最终效果：在其它路由器上172.16.1.2/32这条路由包含内部cost。
QQ截图20200820164622.png

2.3 ISIS

  • AS100内loopback0和互连接口全部开启ISIS协议，其中PE1、PE2路由类型L1，区域号为49.0001；RR1、P1路由类型L1/2，区域号为49.0001；ASBR1、ASBR2路由类型L2，区域号为49.0002。

image.png

  • 根据以上题意，发现PE1与RR1之间的逻辑链路还没有启用ISIS

PE1与RR1配置：

  1. interface ip-Trunk 1
  2. isis enable
  3. isis cost 1500
  • RR2-P2的ISIS链路类型为P2P。

RR2与P2配置：

  1. interface g0/0/0
  2. isis circuit-type p2p
  • 为了保证后续MPLS VPN中的AS 100公网LDP的可达（L1设备默认只有默认路由指向L2），在RR1和P1上做172.16.0.0/16主机路由level-2向level-1路由的渗透。

在L1/L2设备上，做路由引入（RR1/P1）

RR1和P1配置：

  1. ip ip-prefix L2toL1 permit 172.16.0.0 16 gr 32 le 32 //使用前缀列表抓取路由
  2. isis 1 //进入ISIS进程1
  3. import-route isis level-2 into level-1 filter-policy ip-prefix L2toL1

最终效果：L1设备有了到了AS100域中的所有loopback0的明细条目
image.png

  • 在RR2、P2上，ISIS和OSPF双向引入前缀为172.16.0.0/16的主机路由。被引入的协议的cost要继承到引入后的协议中 ，P2和PE4的loopback0互访走最优路径。配置要求有最好的拓展性。

image.png

RR2配置：将OSPF路由引入ISIS

  1. [RR2]ip ip-prefix in permit 172.16.0.0 16 greater-equal 32 less-equal 32 //抓取环回口地址的路由
  2. [RR2]route-policy ospftoisis deny node 10
  3. [RR2-route-policy]if-match tag 200
  4. [RR2-route-policy]quit
  5. [RR2]route-policy ospftoisis permit node 20
  6. [RR2-route-policy]if-match ip-prefix in
  7. [RR2-route-policy]apply tag 100
  8. [RR2-route-policy]quit
  9. [RR2]isis 1
  10. [RR2-isis-1]import-route ospf 1 inherit-cost route-policy ospftoisis

P2配置：将OSPF路由引入ISIS

  1. [P1]ip ip-prefix in permit 172.16.0.0 16 greater-equal 32 less-equal 32 //抓取环回口地址的路由
  2. [P1]route-policy ospftoisis deny node 10
  3. [P1-route-policy]if-match tag 400
  4. [P1-route-policy]quit
  5. [P1]route-policy ospftoisis permit node 20
  6. [P1-route-policy]if-match ip-prefix in
  7. [P1-route-policy]apply tag 300
  8. [P1-route-policy]quit
  9. [P1]isis 1
  10. [P1-isis-1]import-route ospf 1 inherit-cost route-policy ospftoisis

RR2配置：将ISIS路由引入到OSPF

  1. [RR2]route-policy isistoospf deny node 10
  2. [RR2-route-policy]if-match tag 300
  3. [RR2-route-policy]quit
  4. [RR2]route-policy isistoospf permit node 20
  5. [RR2-route-policy]if-match ip-prefix in
  6. [RR2-route-policy]apply tag 400
  7. [RR2-route-policy]quit
  8. [RR2-ospf-1]default cost inherit-metric
  9. [RR2-ospf-1]import-route isis 1 route-policy isistoospf

P2配置：将ISIS路由引入到OSPF

  1. [P1]route-policy isistoospf deny node 10
  2. [P1-route-policy]if-match tag 100
  3. [P1-route-policy]quit
  4. [P1]route-policy isistoospf permit node 20
  5. [P1-route-policy]if-match ip-prefix in
  6. [P1-route-policy]apply tag 200
  7. [P1-route-policy]quit
  8. [P1-ospf-1]default cost inherit-metric
  9. [P1-ospf-1]import-route isis 1 route-policy isistoospf

最后通过标签解决环路问题，环路导致的原因：

  1. P2通过OSPF从PE4学习到的172.16.1.2这个外部路由的优先级是150
  2. 在做完双向引入后，RR2把172.16.1.2这条路由引入进ISIS，通过ISIS传递给P2，P2收到后，优先级是15
  3. 设备在对比后，优选了ISIS这条路由，导致路由环路

解决思路：在OSPF中，将不带标签的外部路由的优先级修改为10（高于15）（双向引入后，只有172.16.1.2这条路由是没有带标签的）。

RR2配置：

  1. [RR2]route-policy preference permit node 10
  2. [RR2-route-policy]if-match tag 200
  3. [RR2-route-policy]apply preference 150
  4. [RR2-route-policy]quit
  5. [RR2]ospf 1
  6. [RR2-ospf-1]preference ase route-policy preference 10

P2配置：

  1. [P1]route-policy preference permit node 10
  2. [P1-route-policy]if-match tag 400
  3. [P1-route-policy]apply preference 150
  4. [P1-route-policy]quit
  5. [P1]ospf 1
  6. [P1-ospf-1]preference ase route-policy preference 10

最终效果：
image.png

  • 通过以上操作，P2上OSPF学习到的路由172.16.1.2/32的优先级更高，所以优选OSPF路由。

  • P1的ISIS进程：产生LSP的最大延迟时间是1S，初始延迟为50ms，递增时间为50ms，使能LSP的快速扩散特性，SPF计算最大延迟为1S，初始延迟为100ms，递增时间为100ms。

P1配置：

  1. [P1]isis 1
  2. [P1-isis-1]timer lsp-generation 1 50 50
  3. [P1-isis-1]flash-flood
  4. [P1-isis-1]timer spf 1 100 100

三、MPLS VPN

3.1 基础配置

  • CE1、CE2为VPN1的Hub-CE，PE1、PE2为Hub-PE，CE3、CE4为VPN1的Spoke站点，PE3、PE4为Spoke-PE。


  • CE4为Multi-VPN-instance CE，CE4的VPN实例VPN1，通过GE0/0/1连接PE4。（PE4上VPN1的RD为100：14）

image.png

CE4配置：

  1. [CE4]ip vpn-instance VPN1
  2. [CE4-vpn-instance-VPN1]route-distinguisher 100:14
  3. [CE4-vpn-instance-VPN1-af-ipv4]quit
  4. [CE4]int GigabitEthernet 0/0/1
  5. [CE4-GigabitEthernet0/0/1]ip binding vpn-instance VPN1
  6. [CE4-GigabitEthernet0/0/1]ip address 10.2.41.1 30
  7. [CE4]int LoopBack 0
  8. [CE4-LoopBack0]ip binding vpn-instance VPN1
  9. [CE4-LoopBack0]ip address 172.17.1.4 32
  10. [CE4]int LoopBack 1
  11. [CE4-LoopBack1]ip binding vpn-instance VPN1
  12. [CE4-LoopBack1]ip address 10.3.3.4 32
  • 合理设置VPN1参数，使得Spoke站点互访的流量必须经过Hub-CE设备。当CE-PE1链路断开的情况下，PE1仍然可以学习到CE1的业务路由。（PE3上VPN1的RD为100：13，Export RT为100：1，Import RT为200：1）。

image.png

PE1配置：

  1. [PE1]ip vpn-instance VPN-in
  2. [PE1-vpn-instance-VPN-in]route-distinguisher 100:10
  3. [PE1-vpn-instance-VPN-in-af-ipv4]vpn-target 100:1 import-extcommunity
  4. [PE1]ip vpn-instance VPN-out
  5. [PE1-vpn-instance-VPN-out]route-distinguisher 100:12
  6. [PE1-vpn-instance-VPN-out-af-ipv4]vpn-target 200:1 export-extcommunity
  7. [PE1]int GigabitEthernet0/0/1.1
  8. [PE1-GigabitEthernet0/0/1.1]arp broadcast enable
  9. [PE1-GigabitEthernet0/0/1.1]ip binding vpn-instance VPN-in
  10. [PE1-GigabitEthernet0/0/1.1]ip address 10.2.11.2 30
  11. [PE1]int GigabitEthernet0/0/1.2
  12. [PE1-GigabitEthernet0/0/1.2]arp broadcast enable
  13. [PE1-GigabitEthernet0/0/1.2]ip binding vpn-instance VPN-out
  14. [PE1-GigabitEthernet0/0/1.2]ip address 10.2.11.6 30

PE2配置：

  1. [PE2]ip vpn-instance VPN-in
  2. [PE2-vpn-instance-VPN-in]route-distinguisher 100:11
  3. [PE2-vpn-instance-VPN-in-af-ipv4]vpn-target 100:1 import-extcommunity
  4. [PE2]ip vpn-instance VPN-out
  5. [PE2-vpn-instance-VPN-out]route-distinguisher 100:15
  6. [PE2-vpn-instance-VPN-out-af-ipv4]vpn-target 200:1 export-extcommunity 
  7. [PE2]int GigabitEthernet0/0/1.1
  8. [PE2-GigabitEthernet0/0/1.1]arp broadcast enable
  9. [PE2-GigabitEthernet0/0/1.1]ip binding vpn-instance VPN-in
  10. [PE2-GigabitEthernet0/0/1.1]ip address 10.2.22.2 30
  11. [PE2]int GigabitEthernet0/0/1.2
  12. [PE2-GigabitEthernet0/0/1.2]arp broadcast enable
  13. [PE2-GigabitEthernet0/0/1.2]ip binding vpn-instance VPN-out
  14. [PE2-GigabitEthernet0/0/1.2]ip address 10.2.22.6 30

PE与CE端建立BGP的邻居

PE1配置：

  1. [PE1]bgp 100
  2. [PE1-bgp]ipv4-family vpn-instance VPN-in
  3. [PE1-bgp-VPN-in]peer 10.2.11.1 as-number 65000
  4. [PE1-bgp-VPN-in]quit
  5. [PE1-bgp]ipv4-family vpn-instance VPN-out
  6. [PE1-bgp-VPN-out]peer 10.2.11.5 as-number 65000

PE2配置：

  1. [PE2]bgp 100
  2. [PE2-bgp]ipv4-family vpn-instance VPN-in
  3. [PE2-bgp-VPN-in]peer 10.2.22.1 as-number 65000
  4. [PE2-bgp-VPN-in]quit
  5. [PE2-bgp]ipv4-family vpn-instance VPN-out
  6. [PE2-bgp-VPN-out]peer 10.2.22.5 as-number 65000

CE1配置：

  1. [CE1]int GigabitEthernet 0/0/1.1
  2. [CE1-GigabitEthernet0/0/1.1]arp broadcast enable
  3. [CE1]int GigabitEthernet 0/0/1.2
  4. [CE1-GigabitEthernet0/0/1.2]arp broadcast enable
  5. [CE1]bgp 65000
  6. [CE1-bgp]peer 10.2.11.2 as-number 100
  7. [CE1-bgp]peer 10.2.11.6 as-number 100

CE2配置：

  1. [CE2]int GigabitEthernet 0/0/1.1
  2. [CE2-GigabitEthernet0/0/1.1]arp broadcast enable
  3. [CE2]int GigabitEthernet 0/0/1.2
  4. [CE2-GigabitEthernet0/0/1.2]arp broadcast enable
  5. [CE2]bgp 65000
  6. [CE2-bgp]peer 10.2.22.2 as-number 100
  7. [CE2-bgp]peer 10.2.22.6 as-number 100

最终效果：CE与PE设备建立Established的BGP邻居关系
image.png
image.png

  • CE1通过GE0/0/1.1和GE0/0/1.2建立EBGP邻居，接入PE1。CE1通过GE0/0/0.2，向PE1通告的BGP update中，某些路由的AS-path中有200。在CE1上将OSPF路由导入BGP。

CE1配置：

  1. [CE1]bgp 65000
  2. [CE1-bgp]import-route ospf 1 med 0

PE1配置：

  1. [PE1]bgp 100
  2. [PE1-bgp]ipv4-family vpn-instance VPN-out
  3. [PE1-bgp-VPN-out]peer 10.2.11.5 allow-as-loop

image.png

  • 允许多AS-path配置，否则会导致其它站点学习不到路由（例如CE3学习不到CE4的路由）

  • CE2通过GE0/0/1.1和GE0/0/1.2建立EBGP邻居，接入PE2。CE2通过GE0/0/0.2，向PE2通告的BGP update中，某些路由的AS-path中有200。在CE2上将OSPF路由导入BGP。

CE2配置：

  1. [CE2]bgp 65000
  2. [CE2-bgp]import-route ospf 1 med 0

PE2配置：

  1. [PE2]bgp 100
  2. [PE2-bgp]ipv4-family vpn-instance VPN-out
  3. [PE2-bgp-VPN-out]peer 10.2.22.5 allow-as-loop
  • CE3通过OSPF区域1接入PE3，通过PE3-CE3的逻辑接口互通，通告CE3的各环回口，CE4通过OSPF区域0接入PE4，通过PE4-CE4的GE0/0/1接口互通，通告CE4的各loopback。

image.png

PE3配置：配置VPN实例，并将对应的接口加入到实例中，并配置绑定VPN实例的OSPF进程。

  1. [PE3]ip vpn-instance VPN1
  2. [PE3-vpn-instance-VPN1]route-distinguisher 100:13
  3. [PE3-vpn-instance-VPN1-af-ipv4]vpn-target 100:1 export-extcommunity
  4. [PE3-vpn-instance-VPN1-af-ipv4]vpn-target 200:1 import-extcommunity 
  5. [PE3-vpn-instance-VPN1]quit
  6. [PE3]int Mp-group 0/0/0
  7. [PE3-Mp-group0/0/0]ip binding vpn-instance VPN1
  8. [PE3-Mp-group0/0/0]ip address 10.2.33.2 30
  9. [PE3-Mp-group0/0/0]quit
  10. [PE3]ospf 2 vpn-instance VPN1
  11. [PE3-ospf-2]area 1
  12. [PE3-ospf-2-area-0.0.0.1]network 10.2.33.2 0.0.0.0

PE4配置：配置VPN实例，并将对应的接口加入到实例中，并配置绑定VPN实例的OSPF进程。

  1. [PE4]ip vpn-instance VPN1
  2. [PE4-vpn-instance-VPN1]route-distinguisher 100:14
  3. [PE4-vpn-instance-VPN1-af-ipv4]vpn-target 100:1 export-extcommunity
  4. [PE4-vpn-instance-VPN1-af-ipv4]vpn-target 200:1 import-extcommunity
  5. [PE4-vpn-instance-VPN1]quit
  6. [PE4]int GigabitEthernet 0/0/1
  7. [PE4-GigabitEthernet0/0/1]ip binding vpn-instance VPN1
  8. [PE4-GigabitEthernet0/0/1]ip address 10.2.41.2 30
  9. [PE4-GigabitEthernet0/0/1]quit
  10. [PE4]ospf 2 vpn-instance VPN1
  11. [PE4-ospf-2]area 0    
  12. [PE4-ospf-2-area-0.0.0.0]network 10.2.41.2 0.0.0.0

CE3配置：配置OSPF进程，宣告自己的直连网段。

  1. [CE3]ospf 2
  2. [CE3-ospf-2]area 1
  3. [CE3-ospf-2-area-0.0.0.1]network 10.2.33.1 0.0.0.0
  4. [CE3-ospf-2-area-0.0.0.1]network 10.3.3.3 0.0.0.0
  5. [CE3-ospf-2-area-0.0.0.1]network 172.17.1.3 0.0.0.0
  6. [CE3-ospf-2-area-0.0.0.1]quit

CE4配置：配置OSPF进程，宣告自己的直连网段。

  1. [CE4]ospf 2 vpn-instance VPN1
  2. [CE4-ospf-2]vpn-instance-capability simple
  3. [CE4-ospf-2]area 0
  4. [CE4-ospf-2-area-0.0.0.0]network 10.2.41.1 0.0.0.0
  5. [CE4-ospf-2-area-0.0.0.0]network 10.3.3.4 0.0.0.0
  6. [CE4-ospf-2-area-0.0.0.0]network 172.17.1.4 0.0.0.0
  7. [CE4-ospf-2-area-0.0.0.0]quit

最终效果：PE设备上关于VPN实例1学习到了CE设备的loopback0路由
image.png
image.png

  • 在AS100、AR200内建立IBGP IPv4邻居关系：RR1是PE1、PE2、P1、ASBR1、ASBR2的反射器，RR2是PE3、PE4、P2、ASBR3、ASBR4的反射器。ASBR-ASBR3、ASBR2-ASBR4建立EBGP IPv4邻居关系。（已预配）。

image.png

  • 在ASBR上，将ISIS的Loopback0路由引入BGP

image.png

ASBR1与ASBR2配置：配置前缀列表，抓取需要引入的路由（内部AS100的环回口地址）

  1. ip ip-prefix isisloopback index 10 permit 172.16.1.1 32
  2. ip ip-prefix isisloopback index 20 permit 172.16.1.3 32
  3. ip ip-prefix isisloopback index 30 permit 172.16.1.4 32
  4. ip ip-prefix isisloopback index 40 permit 172.16.1.5 32
  5. ip ip-prefix isisloopback index 50 permit 172.16.1.6 32
  6. ip ip-prefix isisloopback index 60 permit 172.16.1.20 32
  7. route-policy isisloopback permit node 10
  8. if-match ip-prefix isisloopback
  9. bgp 100
  10. import-route isis 1 route-policy isisloopback

ASBR3与ASBR4配置：配置前缀列表，抓取需要引入的路由（内部AS200的环回口路由）

  1. ip ip-prefix isisloopback index 10 permit 172.16.1.7 32
  2. ip ip-prefix isisloopback index 20 permit 172.16.1.8 32
  3. ip ip-prefix isisloopback index 30 permit 172.16.1.9 32
  4. ip ip-prefix isisloopback index 40 permit 172.16.1.10 32
  5. ip ip-prefix isisloopback index 50 permit 172.16.1.11 32
  6. ip ip-prefix isisloopback index 60 permit 172.16.1.2 32
  7. route-policy isisloopback permit node 10
  8. if-match ip-prefix isisloopback
  9. bgp 100
  10. import-route isis 1 route-policy isisloopback

最终效果：ASBR设备上有全网环回口地址
image.png

  • 如图AS100 AS200内各个网元配置MPLS LSR-ID，全局使能MPLS，MPLS LDP（已预配）。AS100、AS200内直连链路建立LDP邻居（除PE1-RR1之间的逻辑链路外，已预配）。

PE1与RR1的配置：全网MPLS和MPLS LDP都已预配，只有PE1-RR1的逻辑接口没有配置MPLS和LDP。

  1. [PE1]int Ip-Trunk 1
  2. [PE1-Ip-Trunk1]mpls
  3. [PE1-Ip-Trunk1]mpls ldp
  4. -----------------------------------------------------------------------------------------------
  5. [RR1]int Ip-Trunk 1
  6. [RR1-Ip-Trunk1]mpls
  7. [RR1-Ip-Trunk1]mpls ldp

3.2 MPLS VPN（Option C方案一）

  • 各站点通过MPLS BGP VPN跨域Option C 方案一，能够互相学习路由。MPLS域不能出现次优路径。

1.部署整体的MP-BGP邻居，MP-BGP的邻居关系图如下，配置完成后，整体的路由传递路径就完成了。
image.png

  • 全网通过环回口建立VPNv4的邻居关系
  • RR设备作为AS内部其它VPNv4的邻居的反射器
  • 给邻居传递路由的时候，不需要修改路由的下一跳（例如PE1的路由传递到PE3后，PE3收到的路由下一跳要是PE1的环回口地址）。

配置步骤：

3.2.1 路由传递

AS100内部VPNv4配置，需要完成MP-IBGP的邻居建立。
image.png

RR1配置：配置MP-IBGP

  1. [RR1]bgp 100
  2. [RR1-bgp]ipv4-family vpnv4
  3. [RR1-bgp-af-vpnv4]undo policy vpn-target
  4. [RR1-bgp-af-vpnv4]peer 172.16.1.1 enable
  5. [RR1-bgp-af-vpnv4]peer 172.16.1.1 reflect-client
  6. [RR1-bgp-af-vpnv4]peer 172.16.1.1 next-hop-invariable
  7. [RR1-bgp-af-vpnv4]peer 172.16.1.4 enable
  8. [RR1-bgp-af-vpnv4]peer 172.16.1.4 reflect-client
  9. [RR1-bgp-af-vpnv4]peer 172.16.1.4 next-hop-invariable
  10. [RR1-bgp-af-vpnv4]peer 172.16.1.5 enable
  11. [RR1-bgp-af-vpnv4]peer 172.16.1.5 reflect-client
  12. [RR1-bgp-af-vpnv4]peer 172.16.1.5 next-hop-invariable
  13. [RR1-bgp-af-vpnv4]peer 172.16.1.6 enable
  14. [RR1-bgp-af-vpnv4]peer 172.16.1.6 reflect-client
  15. [RR1-bgp-af-vpnv4]peer 172.16.1.6 next-hop-invariable
  16. [RR1-bgp-af-vpnv4]peer 172.16.1.20 enable
  17. [RR1-bgp-af-vpnv4]peer 172.16.1.20 reflect-client
  18. [RR1-bgp-af-vpnv4]peer 172.16.1.20 next-hop-invariable
  • 为什么需要配置**undo policy vpn-target**？：私网路由在进行传递的时候，在域间通过MP-EBGP传递，RR要接受所有的私网路由，而RR收到的私网路由是携带RD值和RT值的，RR没有VPN实例是无法正常接受学习对应的私网路由的，如果需要正常学习到，需要将标签过滤的命令取消掉。

PE1/PE2/P1/ASBR1/ASBR2配置：配置BGP VPNv4

  1. bgp 100
  2. ipv4-family vpnv4
  3. peer 172.16.1.3 enable

**
image.png
image.png

AS200内部VPNv4配置，需要完成MP-IBGP的邻居关系建立

image.png
RR2配置：配置MP-IBGP

  1. [RR1]bgp 200
  2. [RR1-bgp]ipv4-family vpnv4
  3. [RR1-bgp-af-vpnv4]undo policy vpn-target
  4. [RR1-bgp-af-vpnv4]peer 172.16.1.7 enable
  5. [RR1-bgp-af-vpnv4]peer 172.16.1.7 reflect-client
  6. [RR1-bgp-af-vpnv4]peer 172.16.1.7 next-hop-invariable
  7. [RR1-bgp-af-vpnv4]peer 172.16.1.8 enable
  8. [RR1-bgp-af-vpnv4]peer 172.16.1.8 reflect-client
  9. [RR1-bgp-af-vpnv4]peer 172.16.1.8 next-hop-invariable
  10. [RR1-bgp-af-vpnv4]peer 172.16.1.10 enable
  11. [RR1-bgp-af-vpnv4]peer 172.16.1.10 reflect-client
  12. [RR1-bgp-af-vpnv4]peer 172.16.1.10 next-hop-invariable
  13. [RR1-bgp-af-vpnv4]peer 172.16.1.11 enable
  14. [RR1-bgp-af-vpnv4]peer 172.16.1.11 reflect-client
  15. [RR1-bgp-af-vpnv4]peer 172.16.1.11 next-hop-invariable
  16. [RR1-bgp-af-vpnv4]peer 172.16.1.2 enable
  17. [RR1-bgp-af-vpnv4]peer 172.16.1.2 reflect-client
  18. [RR1-bgp-af-vpnv4]peer 172.16.1.2 next-hop-invariable

PE3/PE4/P2/ASBR3/ASBR4配置：配置BGP VPNv4

  1. [ASBR3]bgp 200
  2. [ASBR3-bgp]ipv4-family vpnv4
  3. [ASBR3-bgp-af-vpnv4]peer 172.16.1.9 enable

最终效果：BGP IPv4邻居建立成功，BGP VPNv4邻居建立成功
image.png
image.png

RR1与RR2建立MP-EBGP（不需要建立IPv4的邻居关系）

image.png

RR1配置：与RR2建立MP-EBGP

  1. [RR1]bgp 100
  2. [RR1-bgp]peer 172.16.1.9 as-number 200
  3. [RR1-bgp]peer 172.16.1.9 connect-interface LoopBack 0
  4. [RR1-bgp]peer 172.16.1.9 ebgp-max-hop 255
  5. [RR1-bgp]ipv4-family unicast
  6. [RR1-bgp-af-ipv4]undo peer 172.16.1.9 enable
  7. [RR1-bgp-af-ipv4]quit
  8. [RR1-bgp]ipv4-family vpnv4
  9. [RR1-bgp-af-vpnv4]peer 172.16.1.9 enable
  10. [RR1-bgp-af-vpnv4]peer 172.16.1.9 allow-as-loop
  11. [RR1-bgp-af-vpnv4]peer 172.16.1.9 next-hop-invariable

RR2配置：与RR1建立MP-EBGP

  1. [RR2]bgp 200
  2. [RR2-bgp]peer 172.16.1.3 as-number 100
  3. [RR2-bgp]peer 172.16.1.3 connect-interface LoopBack 0
  4. [RR2-bgp]peer 172.16.1.3 ebgp-max-hop 255
  5. [RR2-bgp]ipv4-family unicast
  6. [RR2-bgp-af-ipv4]undo peer 172.16.1.3 enable
  7. [RR2-bgp-af-ipv4]quit
  8. [RR2-bgp]ipv4-family vpnv4
  9. [RR2-bgp-af-vpnv4]peer 172.16.1.3 enable
  10. [RR2-bgp-af-vpnv4]peer 172.16.1.3 allow-as-loop
  11. [RR2-bgp-af-vpnv4]peer 172.16.1.3 next-hop-invariable
  • 这些配置完成后，RR1与RR2的EBGP邻居关系不会马上建立，因为当前2个AS域之间的通信没有打通，在后面的标签配置完成后，2个域之间打通后，就可以正常建立MP-EBGP邻居。

3.2.2 标签分配

  • 路由完成传递后，需要在ASBR上配置针对跨域路由的标签分配功能，全网BGP邻居需要具备标签传递能力

ASBR1分配标签配置：

  1. [ASBR1]route-policy 1 permit node 10
  2. [ASBR1-route-policy]if-match mpls-label
  3. [ASBR1-route-policy]apply mpls-label
  4. [ASBR1]route-policy 2 permit node 10
  5. [ASBR1-route-policy]apply mpls-label
  6. [ASBR1]bgp 100
  7. [ASBR1-bgp]peer 10.1.57.2 route-policy 2 export
  8. [ASBR1-bgp]peer 172.16.1.3 route-policy 1 export

ASBR2分配标签配置：

  1. [ASBR2]route-policy 1 permit node 10
  2. [ASBR2-route-policy]if-match mpls-label
  3. [ASBR2-route-policy]apply mpls-label
  4. [ASBR2]route-policy 2 permit node 10
  5. [ASBR2-route-policy]apply mpls-label
  6. [ASBR2]bgp 100
  7. [ASBR2-bgp]peer 10.1.68.2 route-policy 2 export
  8. [ASBR2-bgp]peer 172.16.1.3 route-policy 1 export

ASBR3分配标签配置：

  1. [ASBR3]route-policy 1 permit node 10
  2. [ASBR3-route-policy]if-match mpls-label
  3. [ASBR3-route-policy]apply mpls-label
  4. [ASBR3]route-policy 2 permit node 10
  5. [ASBR3-route-policy]apply mpls-label
  6. [ASBR3]bgp 100
  7. [ASBR3-bgp]peer 10.1.57.1 route-policy 2 export
  8. [ASBR3-bgp]peer 172.16.1.9 route-policy 1 export

ASBR4分配标签配置：

  1. [ASBR4]route-policy 1 permit node 10
  2. [ASBR4-route-policy]if-match mpls-label
  3. [ASBR4-route-policy]apply mpls-label
  4. [ASBR4]route-policy 2 permit node 10
  5. [ASBR4-route-policy]apply mpls-label
  6. [ASBR4]bgp 100
  7. [ASBR4-bgp]peer 10.1.68.1 route-policy 2 export
  8. [ASBR4-bgp]peer 172.16.1.9 route-policy 1 export
  • 全网BGP使能MPLS标签的能力（让BGP对等体之间具备传递接受BGP路由的MPLS标签的能力）

RR1上配置：

  1. [RR1]bgp 100
  2. [RR1-bgp]peer 172.16.1.1 label-route-capability
  3. [RR1-bgp]peer 172.16.1.4 label-route-capability
  4. [RR1-bgp]peer 172.16.1.5 label-route-capability
  5. [RR1-bgp]peer 172.16.1.6 label-route-capability
  6. [RR1-bgp]peer 172.16.1.20 label-route-capability

PE1/PE2/P1/ASBR1/ASBR2配置：

  1. [PE1]bgp 100
  2. [PE1-bgp]peer 172.16.1.3 label-route-capability
  3. -------------------------------------------------
  4. [PE2]bgp 100
  5. [PE2-bgp]peer 172.16.1.3 label-route-capability
  6. -------------------------------------------------
  7. [P1]bgp 100
  8. [P1-bgp]peer 172.16.1.3 label-route-capability
  9. -------------------------------------------------
  10. [ASBR1]bgp 100
  11. [ASBR1-bgp]peer 172.16.1.3 label-route-capability
  12. -------------------------------------------------
  13. [ASBR2]bgp 100
  14. [ASBR2-bgp]peer 172.16.1.3 label-route-capability

RR2配置：

  1. [RR2]bgp 200
  2. [RR2-bgp]peer 172.16.1.7 label-route-capability
  3. [RR2-bgp]peer 172.16.1.8 label-route-capability
  4. [RR2-bgp]peer 172.16.1.10 label-route-capability
  5. [RR2-bgp]peer 172.16.1.11 label-route-capability
  6. [RR2-bgp]peer 172.16.1.2 label-route-capability

PE3/PE4/P2/ASBR3/ASBR4配置：

  1. [PE3]bgp 200
  2. [PE3-bgp]peer 172.16.1.9 label-route-capability
  3. -------------------------------------------------
  4. [PE4]bgp 200
  5. [PE4-bgp]peer 172.16.1.9 label-route-capability
  6. -------------------------------------------------
  7. [P2]bgp 200
  8. [P2-bgp]peer 172.16.1.9 label-route-capability
  9. -------------------------------------------------
  10. [ASBR3]bgp 200
  11. [ASBR3-bgp]peer 172.16.1.9 label-route-capability
  12. -------------------------------------------------
  13. [ASBR4]bgp 200
  14. [ASBR4-bgp]peer 172.16.1.9 label-route-capability

ASBR配置：针对EBGP邻居启用标签分配的能力并开启MPLS

  1. [ASBR1]bgp 100
  2. [ASBR1-bgp]peer 10.1.57.2 label-route-capability
  3. [ASBR1-bgp]quit
  4. [ASBR1]int GigabitEthernet0/0/2
  5. [ASBR1-GigabitEthernet0/0/2]mpls
  6. -----------------------------------------------------------------------------------------------
  7. [ASBR2]bgp 100
  8. [ASBR2-bgp]peer 10.1.68.2 label-route-capability
  9. [ASBR2-bgp]quit
  10. [ASBR2]int GigabitEthernet0/0/2
  11. [ASBR2-GigabitEthernet0/0/2]mpls
  12. -----------------------------------------------------------------------------------------------
  13. [ASBR3]bgp 200
  14. [ASBR3-bgp]peer 10.1.57.1 label-route-capability
  15. [ASBR3-bgp]quit
  16. [ASBR3]int GigabitEthernet0/0/2
  17. [ASBR3-GigabitEthernet0/0/2]mpls
  18. -----------------------------------------------------------------------------------------------
  19. [ASBR4]bgp 200
  20. [ASBR4-bgp]peer 10.1.68.2 label-route-capability
  21. [ASBR4-bgp]quit
  22. [ASBR4]int GigabitEthernet0/0/2
  23. [ASBR4-GigabitEthernet0/0/2]mpls

最终效果：RR1与RR2之间建立MP-EBGP邻居关系
image.png

3.2.3 引入路由

  • 在PE3、PE4上将VPNv4路由引入OSPF，将OSPF路由引入VPNv4

image.png

PE3/PE4配置：双向引入路由

  1. [PE3]ospf 2 vpn-instance VPN1
  2. [PE3-ospf-2]import-route bgp
  3. [PE3-ospf-2]quit
  4. [PE3]bgp 200
  5. [PE3-bgp]ipv4-family vpn-instance VPN1
  6. [PE3-bgp-VPN1]import-route ospf 2
  7. -----------------------------------------------------------------------------------------------
  8. [PE4]ospf 2 vpn-instance VPN1
  9. [PE4-ospf-2]import-route bgp
  10. [PE4-ospf-2]quit
  11. [PE4]bgp 200
  12. [PE4-bgp]ipv4-family vpn-instance VPN1
  13. [PE4-bgp-VPN1]import-route ospf 2

最终效果：使用display bgp vpnv4 all routing-table查看是否存在以下路由
image.png

3.3 其它配置

  • CE1-PE1之间链路端，CE1设备上可学到spoke业务网段，当CE2-PE2之间断路，CE2仍可学习到spoke业务网段。配置保证有最好的拓展性。

image.png
CE1配置：

  1. [CE1]route-policy tag permit node 10
  2. [CE1-route-policy]apply tag 100
  3. [CE1-route-policy]quit
  4. [CE1]route-policy ospftobgp deny node 10
  5. [CE1-route-policy]if-match tag 200
  6. [CE1-route-policy]quit
  7. [CE1]route-policy ospftobgp permit node 20
  8. [CE1-route-policy]quit
  9. [CE1]ospf 1
  10. [CE1-ospf-1]import-route bgp route-policy tag
  11. [CE1]bgp 65000
  12. [CE1-bgp]import-route ospf 1 route-policy ospftobgp med 0

CE2配置：

  1. [CE2]route-policy tag permit node 10
  2. [CE2-route-policy]apply tag 200
  3. [CE2-route-policy]quit
  4. [CE2]route-policy ospftobgp deny node 10
  5. [CE2-route-policy]if-match tag 100
  6. [CE2-route-policy]quit
  7. [CE2]route-policy ospftobgp permit node 20
  8. [CE2-route-policy]quit
  9. [CE2]ospf 1
  10. [CE2-ospf-1]import-route bgp route-policy tag
  11. [CE2]bgp 65000
  12. [CE2-bgp]import-route ospf 1 route-policy ospftobgp med 0
  • 在拓扑正常的情况下，要求CE1、CE2访问spoke业务网段时，不从本AS内部绕行。

次优路径的问题：如下图，在双向引入后，CE1会通过BGP路由学习到CE3的路由，同时也会通过OSPF从CE2学习到OSPF的路由，但是对比路由优先级，会优先选择从CE2学习到的OSPF的路由加表（BGP优先级255，OSPF外部路由150）。

image.png
CE1/CE2配置：调整EBGP路由的优先级来实现走最优路径（调整到小于150即可）

  1. [CE1]bgp 65000
  2. [CE1-bgp]preference 120 255 255
  3. -----------------------------------------------------------------------------------------------
  4. [CE2]bgp 65000
  5. [CE2-bgp]preference 120 255 255

最终效果：CE设备优选EBGP路由，从而流量不经过内部网络
image.png

  • 在PE3/PE4上修改BGP local-preference属性，实现CE3/CE4访问非直连的10.3.x.0/24网段时，若X为奇数，PE3/PE4优选下一跳为PE1，若X为偶数，PE3/PE4优选下一跳为PE2，不用考虑来回路径是否一致。

PE3配置：

  1. [PE3]ip ip-prefix PE1 permit 172.16.1.1 32
  2. [PE3]ip ip-prefix PE2 permit 172.16.1.20 32
  3. [PE3]acl 2000
  4. [PE3-acl-basic-2000]rule permit source 10.3.1.0 0.0.254.0
  5. [PE3]acl 2001
  6. [PE3-acl-basic-2001]rule permit source 10.3.0.0 0.0.254.0
  7. [PE3]route-policy local permit node 10
  8. [PE3-route-policy]if-match acl 2000
  9. [PE3-route-policy]if-match ip next-hop ip-prefix PE1
  10. [PE3-route-policy]apply local-preference 200
  11. [PE3-route-policy]quit
  12. [PE3]route-policy local permit node 20
  13. [PE3-route-policy]if-match acl 2001
  14. [PE3-route-policy]if-match ip next-hop ip-prefix PE2
  15. [PE3-route-policy]apply local-preference 200
  16. [PE3-route-policy]quit
  17. [PE3]route-policy local permit node 100
  18. [PE3]bgp 200
  19. [PE3-bgp]ipv4-family vpnv4
  20. [PE3-bgp-af-vpnv4]peer 172.16.1.9 route-policy local import

PE4配置：

  1. [PE4]ip ip-prefix PE1 permit 172.16.1.1 32
  2. [PE4]ip ip-prefix PE2 permit 172.16.1.20 32
  3. [PE4]acl 2000
  4. [PE4-acl-basic-2000]rule permit source 10.3.1.0 0.0.254.0
  5. [PE4]acl 2001
  6. [PE4-acl-basic-2001]rule permit source 10.3.0.0 0.0.254.0
  7. [PE4]route-policy local permit node 10
  8. [PE4-route-policy]if-match acl 2000
  9. [PE4-route-policy]if-match ip next-hop ip-prefix PE1
  10. [PE4-route-policy]apply local-preference 200
  11. [PE4-route-policy]quit
  12. [PE4]route-policy local permit node 20
  13. [PE4-route-policy]if-match acl 2001
  14. [PE4-route-policy]if-match ip next-hop ip-prefix PE2
  15. [PE4-route-policy]apply local-preference 200
  16. [PE4-route-policy]quit
  17. [PE4]route-policy local permit node 100
  18. [PE4]bgp 200
  19. [PE4-bgp]ipv4-family vpnv4
  20. [PE4-bgp-af-vpnv4]peer 172.16.1.9 route-policy local import

最终效果：在PE3/PE4设备上10.0.X.0的路由走PE1（X为奇数），10.0.X.0的路由走PE2（X为偶数）。
image.png

3.4 最终效果

CE3—-PC1
image.png

CE3—-Server
image.png

CE4—-PC1
image.png
CE4—-Server
image.png

四、Feature

4.1 HA

  • CE1配置静态的默认路由访问ISP，下一跳IP为100.0.1.2。该默认路由要与CE1-ISP链路的BFD状态绑定（CE1的对端设备不支持BFD），感知故障的时间要小于100ms。

CE1配置：

  1. [CE1]bfd ISP bind peer-ip 100.0.1.2 interface GigabitEthernet 2/0/1 one-arm-echo
  2. [CE1-bfd-session-isp]discriminator local 1
  3. [CE1-bfd-session-isp]min-echo-rx-interval 10
  4. [CE1-bfd-session-isp]commit
  5. [CE1]ip route-static 0.0.0.0 0 100.0.1.2 track bfd-session ISP
  • CE1配置静态的默认路由访问ISP，下一跳为100.0.1.2。默认路由要与CE1-ISP链路的NQA ICMP测试，每隔3S测试例执行1次。

CE1配置：

  1. [CE1]nqa test-instance ISP ICMP
  2. [CE1-nqa-ISP-ICMP]test-type icmp
  3. [CE1-nqa-ISP-ICMP]destination-address ipv4 100.0.1.2
  4. [CE1-nqa-ISP-ICMP]frequency 3
  5. [CE1-nqa-ISP-ICMP]start now 
  6. [CE1]ip route-static 0.0.0.0 0 100.0.1.2 track nqa ISP ICMP
  • CE2、CE3、CE4能够通过默认路由访问ISP。

CE端针对OSPF与BGP协议下发默认路由：

  1. [CE1]ospf 1
  2. [CE1-ospf-1]default-route-advertise
  3. [CE1]bgp 65000
  4. [CE1-bgp]peer 10.2.11.6 default-route-advertise conditional-route-match-all 0.0.0.0 0
  5. //当匹配了路由为0.0.0.0时，BGP设备向对等体发布默认路由，如果没有匹配，不下发。
  6. -----------------------------------------------------------------------------------------
  7. [CE2]ospf 1
  8. [CE2-ospf-1]default-route-advertise
  9. [CE2]bgp 65000
  10. [CE2-bgp]peer 10.2.22.6 default-route-advertise conditional-route-match-all 0.0.0.0 0

PE端针对OSPF区域下发路由：

  1. [PE3]ospf 2 vpn-instance VPN1
  2. [PE3-ospf-2]default-route-advertise
  3. -----------------------------------------------------------------------------------------
  4. [PE4]ospf 2 vpn-instance VPN1
  5. [PE4-ospf-2]default-route-advertise

最终效果：PE3和PE4学习到了Hub-CE下方的默认路由，CE3与CE4设备上通过OSPF学习到了PE设备下放的默认路由。
image.png
image.png
image.png
image.png

  • NAT：在CE1上，10.3.0.0/16（不包含10.3.2.10）的内网地址转换为102.0.1.2- 102.0.1.6，通过G2/0/1访问ISP，Server1拥有单独的公网地址102.0.1.1，对ISP提供FTP和HTTP服务。

CE1配置：

  1. [CE1]nat address-group 1 102.0.1.2 102.0.1.6
  2. [CE1]acl 2000
  3. [CE1-acl-basic-2000]rule deny source 10.3.2.10 0
  4. [CE1-acl-basic-2000]rule permit source 10.3.0.0 0.0.255.255
  5. [CE1-GigabitEthernet2/0/1]nat outbound 2000 address-group 1
  6. [CE1-GigabitEthernet2/0/1]nat server protocol tcp global 102.0.1.1 ftp inside 10.3.2.10 ftp
  7. [CE1-GigabitEthernet2/0/1]nat server protocol tcp global 102.0.1.1 www inside 10.3.2.10 www

最终效果：两个spoke节点都能访问外网
image.png
image.png
image.png

4.2 Qos

  • 在CE1的G2/0/1，周一至周五的8:00-18:00点，对TCP目的端口号6881-6999的流量，承诺的平均速率为1Mbps。

CE1配置：

  1. [CE1]time-range workday 8:00 to 18:00 working-day //定义时间范围
  2. [CE1]acl 3000
  3. [CE1-acl-adv-3000]rule permit tcp destination-port range 6881 6999 time-range workday
  4. [CE1-GigabitEthernet2/0/1]qos car outbound acl 3000 cir 1024 //对接口做流量监管
  • CE4-PE4的QOS规划如下表所示，在CE4的G0/0/1出方向对流量进行802.1p标记，在PE4的G0/0/1入方向，继承CE4的802.1p值，并将802.1p映射为DSCP。
业务地址前缀 业务类别 802.1p DSCP 队列调度 拥塞避免
调度策略 Weight 拥塞避免机制 低门限 高门限 丢包概率
10.3.1.0/24 RealTime 101 EF 46 5 PQ 不丢包
10.3.2.0/24 single 010 CS4 32 4 WFQ 63 WRED 70% 100% 50%
10.3.3.0/24 Monitor 011 CS3 24 3 WFQ 21 WRED 50% 90% 50%
10.3.4.0/24 office 010 CS2 16 2 WFQ 9 WRED 50% 80% 50%
其它 BE 000 BE 0 0 WFQ 1 WRED 50% 80% 50%

CE4配置：在CE4的G0/0/1出方向对流量进行802.1p标记
LAB1 - 图72

  1. 通过ACL抓取策略匹配的网段：
  2. [CE4]acl name office 3996
  3. [CE4-acl-adv-office]rule permit ip destination 10.3.4.0 0.0.0.255
  4. [CE4]acl name monitor 3997
  5. [CE4-acl-adv-monitor]rule permit ip destination 10.3.3.0 0.0.0.255
  6. [CE4]acl name single 3998
  7. [CE4-acl-adv-single]rule permit ip destination 10.3.2.0 0.0.0.255
  8. [CE4]acl name Readtime 3999
  9. [CE4-acl-adv-Readtime]rule permit ip destination 10.3.1.0 0.0.0.255
  10. -----------------------------------------------------------------------------------------
  11. 流分类，ACL抓取IP，并分类
  12. [CE4]traffic classifier office
  13. [CE4-classifier-office]if-match acl office
  14. [CE4]traffic classifier monitor
  15. [CE4-classifier-monitor]if-match acl monitor
  16. [CE4]traffic classifier single
  17. [CE4-classifier-single]if-match acl single
  18. [CE4]traffic classifier readtime
  19. [CE4-classifier-readtime]if-match acl Readtime
  20. ------------------------------------------------------------------------------------------
  21. 定义流行为，标记每个策略需要标记802.1p的优先级的标签
  22. [CE4]traffic behavior office
  23. [CE4-behavior-office]remark 8021p 2
  24. [CE4]traffic behavior monitor
  25. [CE4-behavior-monitor]remark 8021p 3
  26. [CE4]traffic behavior single
  27. [CE4-behavior-single]remark 8021p 4
  28. [CE4]traffic behavior readtime
  29. [CE4-behavior-readtime]remark 8021p 5
  30. [CE4]traffic behavior other
  31. [CE4-behavior-other]remark 8021p 0
  32. ------------------------------------------------------------------------------------------
  33. 将流分类和流行为绑定在流策略中
  34. [CE4]traffic policy qos
  35. [CE4-trafficpolicy-qos]classifier office behavior office
  36. [CE4-trafficpolicy-qos]classifier monitor behavior monitor
  37. [CE4-trafficpolicy-qos]classifier single behavior single
  38. [CE4-trafficpolicy-qos]classifier readtime behavior readtime
  39. [CE4-trafficpolicy-qos]classifier default-class behavior other
  40. ------------------------------------------------------------------------------------------
  41. 在CE4的接口G0/0/1下调用流策略
  42. [CE4]int GigabitEthernet 0/0/1
  43. [CE4-GigabitEthernet0/0/1]traffic-policy qos outbound //对出方向的流量执行流策略

最终效果：检查流分类和流行为对应是否正确，是否调用流策略
image.png

PE4配置：继承从CE4传来的802.1p的映射

  1. [PE4]qos map-table dot1p-dscp
  2. [PE4-maptbl-dot1p-dscp]input 5 output 46
  3. [PE4-maptbl-dot1p-dscp]input 4 output 32
  4. [PE4-maptbl-dot1p-dscp]input 3 output 24
  5. [PE4-maptbl-dot1p-dscp]input 2 output 16
  6. [PE4-maptbl-dot1p-dscp]input 0 output 0
  7. [PE4]int GigabitEthernet 0/0/1
  8. [PE4-GigabitEthernet0/0/1]trust 8021p override
  • PE4的G0/0/0和G0/0/2匹配DSCP，根据表所示，配置拥塞管理和拥塞避免

PE4配置：配置丢弃模板

  1. [PE4]drop-profile cs4
  2. [PE4-drop-profile-cs4]wred dscp
  3. [PE4-drop-profile-cs4]dscp cs4 low-limit 70 high-limit 100 discard-percentage 50
  4. [PE4]drop-profile cs3
  5. [PE4-drop-profile-cs3]wred dscp
  6. [PE4-drop-profile-cs3]dscp cs3 low-limit 50 high-limit 90 discard-percentage 50
  7. [PE4]drop-profile cs2
  8. [PE4-drop-profile-cs2]wred dscp
  9. [PE4-drop-profile-cs2]dscp cs2 low-limit 50 high-limit 80 discard-percentage 50
  10. [PE4]drop-profile cs0
  11. [PE4-drop-profile-cs0]wred dscp
  12. [PE4-drop-profile-cs0]dscp default low-limit 50 high-limit 80 discard-percentage 50

PE4配置：配置队列，并关联权重与丢弃模板

  1. [PE4]qos queue-profile drop
  2. [PE4-qos-queue-profile-drop]queue 0 weight 1
  3. [PE4-qos-queue-profile-drop]queue 2 weight 9
  4. [PE4-qos-queue-profile-drop]queue 3 weight 21
  5. [PE4-qos-queue-profile-drop]queue 4 weight 63
  6. [PE4-qos-queue-profile-drop]schedule wfq 0 to 4 pq 5 
  7. //配置0-4队列采用加权公平调度模式，5队列采用严格优先级调度模式
  8. ------------------------------------------------------------------------------------------
  9. [PE4-qos-queue-profile-drop]queue 0 drop-profile cs0
  10. [PE4-qos-queue-profile-drop]queue 2 drop-profile cs2
  11. [PE4-qos-queue-profile-drop]queue 3 drop-profile cs3
  12. [PE4-qos-queue-profile-drop]queue 4 drop-profile cs4

PE4配置：在接口上调用队列

  1. [PE4]int GigabitEthernet 0/0/0
  2. [PE4-GigabitEthernet0/0/2]qos queue-profile drop
  3. [PE4]int GigabitEthernet 0/0/2
  4. [PE4-GigabitEthernet0/0/2]qos queue-profile drop

五、IPv6

5.1 基础配置

  • 所有设备的接口IPv6地址。按照图中配置（除PE1-RR1的逻辑接口之外，已预配置）。

image.png

PE1配置：

  1. [PE1]int Ip-Trunk 1
  2. [PE1-Ip-Trunk1]ipv6 enable
  3. [PE1-Ip-Trunk1]ipv6 address 2000:EDA8:99EF:CC3E:B2AD:9EFF:32DD:1300 127

RR1配置：

  1. [RR1]int Ip-Trunk 1
  2. [RR1-Ip-Trunk1]ipv6 enable
  3. [RR1-Ip-Trunk1]ipv6 address 2000:EDA8:99EF:CC3E:B2AD:9EFF:32DD:1301 127

5.2 IPv6 ISIS

  • PE1、PE2、RR1、P1、ASBR1、ASBR2运行ISIS协议。各直连网段宣告进ISIS，配置各链路cost。

PE1配置：

  1. [PE1]isis 1
  2. [PE1-isis-1]ipv6 enable topology ipv6
  3. [PE1]int GigabitEthernet0/0/0
  4. [PE1-GigabitEthernet0/0/0]isis ipv6 enable
  5. [PE1-GigabitEthernet0/0/0]isis ipv6 cost 20
  6. [PE1]int Ip-Trunk 1
  7. [PE1-Ip-Trunk1]isis ipv6 enable
  8. [PE1-Ip-Trunk1]isis ipv6 cost 1550
  9. [PE1]int LoopBack 0
  10. [PE1-LoopBack0]isis ipv6 enable

PE2配置：

  1. [PE2]isis 1
  2. [PE2-isis-1]ipv6 enable topology ipv6
  3. [PE2]int GigabitEthernet0/0/0
  4. [PE2-GigabitEthernet0/0/0]isis ipv6 enable
  5. [PE2-GigabitEthernet0/0/0]isis ipv6 cost 20
  6. [PE2]int GigabitEthernet0/0/2
  7. [PE2-GigabitEthernet0/0/2]isis ipv6 enable
  8. [PE2-GigabitEthernet0/0/2]isis ipv6 cost 1500
  9. [PE2]int LoopBack0
  10. [PE2-LoopBack0]isis ipv6 enable

RR1配置：

  1. [RR1]isis 1
  2. [RR1-isis-1]ipv6 enable topology ipv6 
  3. [RR1]int GigabitEthernet0/0/0
  4. [RR1-GigabitEthernet0/0/0]isis ipv6 enable
  5. [RR1-GigabitEthernet0/0/0]isis ipv6 cost 80
  6. [RR1]int GigabitEthernet0/0/1
  7. [RR1-GigabitEthernet0/0/1]isis ipv6 enable
  8. [RR1-GigabitEthernet0/0/1]isis ipv6 cost 860
  9. [RR1]int Ip-Trunk 1
  10. [RR1-Ip-Trunk1]isis ipv6 enable
  11. [RR1-Ip-Trunk1]isis ipv6 cost 1550
  12. [RR1]int LoopBack0
  13. [RR1-LoopBack0]isis ipv6 enable

P1配置：

  1. [P1]isis 1
  2. [P1-isis-1]ipv6 enable topology ipv6 
  3. [P1]int GigabitEthernet0/0/0
  4. [P1-GigabitEthernet0/0/0]isis ipv6 enable
  5. [P1-GigabitEthernet0/0/0]isis ipv6 cost 80
  6. [P1]int GigabitEthernet0/0/2
  7. [P1-GigabitEthernet0/0/2]isis ipv6 enable
  8. [P1-GigabitEthernet0/0/2]isis ipv6 cost 1500
  9. [P1]int GigabitEthernet0/0/1
  10. [P1-GigabitEthernet0/0/1]isis ipv6 enable
  11. [P1-GigabitEthernet0/0/1]isis ipv6 cost 1000
  12. [P1]int LoopBack0
  13. [P1-LoopBack0]isis ipv6 enable

ASBR1配置：

  1. [ASBR1]isis 1
  2. [ASBR1-isis-1]ipv6 enable topology ipv6
  3. [ASBR1]int GigabitEthernet0/0/1
  4. [ASBR1-GigabitEthernet0/0/1]isis ipv6 enable
  5. [ASBR1-GigabitEthernet0/0/1]isis ipv6 cost 860
  6. [ASBR1]int GigabitEthernet0/0/0
  7. [ASBR1-GigabitEthernet0/0/0]isis ipv6 enable
  8. [ASBR1-GigabitEthernet0/0/0]isis ipv6 cost 100
  9. [ASBR1]int LoopBack0
  10. [ASBR1-LoopBack0]isis ipv6 enable

ASBR2配置：

  1. [ASBR2]isis 1
  2. [ASBR2-isis-1]ipv6 enable topology ipv6
  3. [ASBR2]int GigabitEthernet0/0/1
  4. [ASBR2-GigabitEthernet0/0/1]isis ipv6 enable
  5. [ASBR2-GigabitEthernet0/0/1]isis ipv6 cost 1000
  6. [ASBR2]int GigabitEthernet0/0/0
  7. [ASBR2-GigabitEthernet0/0/0]isis ipv6 enable
  8. [ASBR2-GigabitEthernet0/0/0]isis ipv6 cost 100
  9. [ASBR2]int LoopBack0
  10. [ASBR2-LoopBack0]isis ipv6 enable
  • IPv6路由渗透（为了防止IPv6的ISIS路由的次优路径），在RR1/P1上配置路由泄露，不泄露会导致IPv6 BGP路由下一跳不可达后续需求无法实现。

RR1/P1配置：

  1. [RR1]isis 1
  2. [RR1-isis-1]ipv6 import-route isis level-2 into level-1
  3. -------------------------------------------------------------------------------------------------
  4. [P1]isis 1
  5. [P1-isis-1]ipv6 import-route isis level-2 into level-1

最终效果：在PE1上查看路由表，检查去往各个设备的环回口的明细路由，说明配置成功
image.png

5.3 IPv6 BGP

  • ASBR1-ASBR3通过直连链路建立EBGP4+邻居，PE1、PE2、P1是RR1的IBGP4+客户端。（已预配）

image.png

PE1/PE2/P1/ASBR2配置：

  1. [PE1]bgp 100
  2. [PE1-bgp]ipv6-family unicast
  3. [PE1-bgp-af-ipv6]peer 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:DCA3 enable
  4. --------------------------------------------------------------------------------------------------
  5. [PE2]bgp 100
  6. [PE2-bgp]ipv6-family unicast
  7. [PE2-bgp-af-ipv6]peer 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:DCA3 enable
  8. --------------------------------------------------------------------------------------------------
  9. [P1]bgp 100
  10. [P1-bgp]ipv6-family unicast
  11. [P1-bgp-af-ipv6]peer 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:DCA3 enable
  12. --------------------------------------------------------------------------------------------------
  13. [ASBR2]bgp 100
  14. [ASBR2-bgp]ipv6-family unicast
  15. [ASBR2-bgp-af-ipv6]peer 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:DCA3 enable

ASBR1配置：

  1. [ASBR1]bgp 100
  2. [ASBR1-bgp-af-ipv6]peer 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:DCA3 enable
  3. [ASBR1-bgp-af-ipv6]peer 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:5701 enable

RR1配置：

  1. [RR1]bgp 100
  2. [RR1-bgp-af-ipv6]peer 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:DCA5 enable
  3. [RR1-bgp-af-ipv6]peer 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:DCA6 enable

最终效果：IPv6 BGP邻居建立成功，ASBR1与RR1建立IBG与ASBR3建立EBGP邻居关系
image.png
image.png

  • 在ASBR1上将ISIS IPv6的路由导入BGP4+，只向ASBR3通告前缀为2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:DC00/120的路由（不能使用route-policy）。将ASBR3的loopback0通告入BGP4+。

image.png
ASBR1配置：

  1. [ASBR1]bgp 100
  2. [ASBR1-bgp]ipv6-family unicast
  3. [ASBR1-bgp-af-ipv6]import-route isis 1
  4. [ASBR1-bgp-af-ipv6]aggregate 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:DC00 120 detail-suppressed
  5. -------------------------------------------------------------------------------------------------
  6. 配置完以上聚合后，ASBR3上还是会有127位的路由，通过前缀列表匹配120位的IPv6路由，针对ASBR3只发布该路由条目
  7. [ASBR1]ip ipv6-prefix 1 permit 2000:EDA8:99EF:CC3E:B2AD:9EFF:32DD:DC00 120 greater-equal 120 less-equal 120
  8. [ASBR1-bgp-af-ipv6]peer 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:5701 ipv6-prefix 1 export


  • PE1、PE2学习到ASBR3 loopback0的BGP4+明细路由

ASBR3配置：

  1. [ASBR3]bgp 200
  2. [ASBR3-bgp]ipv6-family unicast
  3. [ASBR3-bgp-af-ipv6]network 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:DCA7 128

ASBR1配置：拒绝部分汇总的路由（将DCA7这条拒绝汇总）

  1. [ASBR1]ip ipv6-prefix asbrloopback permit 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:DCA7 128
  2. [ASBR1]route-policy asbrloopback deny node 10
  3. [ASBR1-route-policy]if-match ipv6 address prefix-list asbrloopback
  4. [ASBR1]route-policy asbrloopback permit node 20
  5. [ASBR1]bgp 100
  6. [ASBR1-bgp]ipv6-family unicast
  7. [ASBR1-bgp-af-ipv6]aggregate 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:DC00 120 suppress-policy asbrloopback
  8. [ASBR1-bgp-af-ipv6]peer 2000:EAD8:99EF:CC3E:B2AD:9EFF:32DD:DCA3 next-hop-local

最终效果：PE1和PE2上学习到了ASBR3的loopback0明细路由。
image.png
image.png

  • 请在PE1使能某特性，以确保PE1在启动过程中，PE2-ASBR3的IPv6 ping无丢包。

PE1配置：

  1. [PE1]isis 1
  2. [PE1-isis-1]set-overload on-startup wait-for-bgp