MPLS-虚拟专用网 实验（分支之间可以互通）_p设备和pe设备需要bgp互联吗

1、MPLS V_P_N实验（分支之间可以互通）

实验要求：

1、A1和A2可以通过MPLS V_P_N打通，B1和B2可以打通，A不能访问B。
2、R2为ISP
3、R6可以telnetR4，R7可以TelnetR5

配置步骤：

1. 骨干网络做通IGP打通
2. 配置公网的LSP隧道，PE,P设备的loopack的主机路由建立LSP
3. PE之间配置MP-IBGP邻居关系（可以通过RR简化MP——IBGP全互联邻居关系）
4. V_P_N业务接入配置，在PE上创建V_P_N实例（VRF空间）

1、骨干网底层使用OSPF打通

[R1]ospf 1 router-id 1.1.1.1
[R1-ospf-1]a 0
[R1-ospf-1-area-0.0.0.0]network 10.1.12.1 0.0.0.0	
[R1-ospf-1-area-0.0.0.0]network  1.1.1.1 0.0.0.0

[R2]ospf 1 router-id  2.2.2.2
[R2-ospf-1]a 0
[R2-ospf-1-area-0.0.0.0]network  10.1.12.2 0.0.0.0
[R2-ospf-1-area-0.0.0.0]network 2.2.2.2 0.0.0.0
[R2-ospf-1-area-0.0.0.0]network 10.1.23.2 0.0.0.0

[R3]ospf 1 router-id  3.3.3.3
[R3-ospf-1]a 0	
[R3-ospf-1-area-0.0.0.0]network 10.1.23.3 0.0.0.0
[R3-ospf-1-area-0.0.0.0]network  3.3.3.3 0.0.0.0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

查看邻居关系的建立情况

2、配置公网的LSP隧道。（全局和接口都要配置）

[R1]mpls lsr-id 1.1.1.1 
[R1]mpls 
Info: Mpls starting, please wait... OK!
[R1-mpls]mpls ldp
[R1-mpls-ldp]q
[R1]int g0/0/2	
[R1-GigabitEthernet0/0/2]mpls 
[R1-GigabitEthernet0/0/2]mpls ldp 

[R2]mpls lsr-id 2.2.2.2
[R2]mpls 
Info: Mpls starting, please wait... OK!
[R2-mpls]mpls ldp
[R2-mpls-ldp]int g0/0/0	
[R2-GigabitEthernet0/0/0]mpls 	
[R2-GigabitEthernet0/0/0]mpls ldp 
[R2-GigabitEthernet0/0/0]int g0/0/1
[R2-GigabitEthernet0/0/1]mpls 
[R2-GigabitEthernet0/0/1]mpls ldp 

[R3]mpls lsr-id 3.3.3.3
[R3]mpls 
Info: Mpls starting, please wait... OK!
[R3-mpls]mpls ldp
[R3-mpls-ldp]int g0/0/0
[R3-GigabitEthernet0/0/0]mpls 
[R3-GigabitEthernet0/0/0]mpls ldp 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

华为设备默认只为32位主机路由分配标签

3、骨干网铺设MP-BGP（R1和R3为IBGP邻居关系）

[R1]bgp 1
[R1-bgp]peer 3.3.3.3 as-number 1
[R1-bgp]peer 3.3.3.3 connect-interface loo0


[R3]bgp 1
[R3-bgp]peer 1.1.1.1 as-number 1
[R3-bgp]peer 1.1.1.1 connect-interface loo0
1
2
3
4
5
6
7
8

开启VPNV4路由

[R1]bgp 1
[R1-bgp]ipv4-family vpnv4
[R1-bgp-af-vpnv4]peer 3.3.3.3 enable

[R3]bgp 1
[R3-bgp]ipv4-family vpnv4
[R3-bgp-af-vpnv4]peer 1.1.1.1 enable
1
2
3
4
5
6
7
8

查看BGP的VPNV4邻居关系状态

4、V_P_N业务的接入，创建V_P_N实例。

A公司之间

[R1]ip vpn-instance A1
[R1-vpn-instance-A1]route-distinguisher 1:1
[R1-vpn-instance-A1-af-ipv4]vpn-target 1:100 both 
 IVT Assignment result: 
Info: VPN-Target assignment is successful.
 EVT Assignment result: 
Info: VPN-Target assignment is successful.
[R1-vpn-instance-A1]q
[R1]int g0/0/0
[R1-GigabitEthernet0/0/0]ip binding vpn-instance A1
Info: All IPv4 related configurations on this interface are removed!
Info: All IPv6 related configurations on this interface are removed!
[R1-GigabitEthernet0/0/0]ip add 10.1.14.1 24

[R3]ip vpn-instance A2
[R3-vpn-instance-A2]route-distinguisher 1:2
[R3-vpn-instance-A2-af-ipv4]vpn-target 1:100 both 
 IVT Assignment result: 
Info: VPN-Target assignment is successful.
 EVT Assignment result: 
Info: VPN-Target assignment is successful.
[R3-vpn-instance-A2]q
[R3]int g0/0/1
[R3-GigabitEthernet0/0/1]ip binding vpn-instance A2
Info: All IPv4 related configurations on this interface are removed!
Info: All IPv6 related configurations on this interface are removed!	
[R3-GigabitEthernet0/0/1]ip address 10.1.36.3 24
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

B公司之间

[R1]ip vpn-instance B1
[R1-vpn-instance-B1]route-distinguisher 1:3 
[R1-vpn-instance-B1-af-ipv4]vpn-target 2:100 both 
 IVT Assignment result: 
Info: VPN-Target assignment is successful.
 EVT Assignment result: 
Info: VPN-Target assignment is successful.
[R1-vpn-instance-B1-af-ipv4]int g0/0/1
[R1-GigabitEthernet0/0/1]ip binding vpn-instance B1
Info: All IPv4 related configurations on this interface are removed!
Info: All IPv6 related configurations on this interface are removed!
[R1-GigabitEthernet0/0/1]ip add 10.1.15.1 24

[R3]ip vpn-instance B2
[R3-vpn-instance-B2]route-distinguisher 1:4
[R3-vpn-instance-B2-af-ipv4]vpn-target 2:100 both 
 IVT Assignment result: 
Info: VPN-Target assignment is successful.
 EVT Assignment result: 
Info: VPN-Target assignment is successful.
[R3-vpn-instance-B2-af-ipv4]int g0/0/2
[R3-GigabitEthernet0/0/2]ip binding vpn-instance B2
Info: All IPv4 related configurations on this interface are removed!
Info: All IPv6 related configurations on this interface are removed!
[R3-GigabitEthernet0/0/2]ip add 10.1.37.3 24

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

1、RD的作用的为了防止在同一个PE不同实例中发送相同路由时难以区分是那个实例出来的路由

例如：在A1里有192.168.1.0/24的路由，在B1里也有192.168.1.0/24的路由 通过RD得以区分，同一个PE上RD值保持唯一，不能一样

2、RT则是选择兴趣爱好，eRT表示发出去的路由，iRT表示自己接受的路由。故可以将不同的路由区分开 进入正确的实例中。

5、PE上起相对应实例的OSPF协议

[R1]ospf 2 router-id 1.1.1.1 vpn-instance A1
[R1-ospf-2]a 0
[R1-ospf-2-area-0.0.0.0]network 10.1.14.1 0.0.0.0

[R3]ospf 3 router-id 3.3.3.3 vpn-instance A2
[R3-ospf-3]a 0	
[R3-ospf-3-area-0.0.0.0]network 10.1.36.3 0.0.0.0


[R1]ospf 4 router-id 1.1.1.1 vpn-instance B1
[R1-ospf-4]a 0
[R1-ospf-4-area-0.0.0.0]network 10.1.15.1 0.0.0.0

[R3]ospf 5 router-id 3.3.3.3 vpn-instance B2
[R3-ospf-3]a 0	
[R3-ospf-3-area-0.0.0.0]network 10.1.37.3 0.0.0.0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

R4/R5/R6/R7上正常起相对应进程的OSPF协议即可

测试：

在R1不能直接ping的原因是R1上有两张路由表，故要指明那张路由表中的路由

6、路由引入

[R1]ospf 2 
[R1-ospf-2]import-route bgp 
[R1]bgp  1
[R1-bgp]ipv4-family vpn-instance A1
[R1-bgp-A1]import-route ospf  2

[R3]bgp 1
[R3-bgp]ipv4-family vpn-instance A2
[R3-bgp-A2]import-route ospf 3
[R3]ospf 3
[R3-ospf-3]import-route bgp 
1
2
3
4
5
6
7
8
9
10
11

测试：

此过程中流量有两层标签来进行转发（外层1025，内层1028）

查看标签转发表

7、开启Telnet功能

[R4]aaa
[R4-aaa]local-user ccna password cipher huawei@123
Info: Add a new user.
[R4-aaa]local-user ccna service-type telnet 
[R4]user-interface vty 0 4
[R4-ui-vty0-4]user privilege level 15	
[R4-ui-vty0-4]authentication-mode aaa

[R5]aaa
[R5-aaa]local-user ccnp password cipher cisco123
Info: Add a new user.
[R5-aaa]local-user ccnp service-type telnet
[R5]user-interface vty 0 4
[R5-ui-vty0-4]user privilege level 15
1
2
3
4
5
6
7
8
9
10
11
12
13
14

测试：

扩展：将R2变成RR

[R1]bgp 1
[R1-bgp]peer 2.2.2.2 as-number 1
[R1-bgp]peer 2.2.2.2 connect-interface loo0
[R1-bgp]ipv4-family vpnv4
[R1-bgp-af-vpnv4]peer 2.2.2.2 enable 

[R2]bgp 1
[R2-bgp]peer 1.1.1.1 as-number 1
[R2-bgp]peer 1.1.1.1 connect-interface loo0
[R2-bgp]peer 3.3.3.3 as-number 1
[R2-bgp]peer 3.3.3.3 connect-interface loo0
[R2-bgp]ipv4-family vpnv4
[R2-bgp-af-vpnv4]peer 1.1.1.1 enable 
[R2-bgp-af-vpnv4]peer 1.1.1.1 reflect-client 
[R2-bgp-af-vpnv4]peer 3.3.3.3 enable 
[R2-bgp-af-vpnv4]peer 3.3.3.3 reflect-client 

[R3]bgp 1
[R3-bgp]undo peer 1.1.1.1
[R3-bgp]peer 2.2.2.2 as-number 1
[R3-bgp]peer 2.2.2.2 connect-interface loo0
[R3-bgp]ipv4-family vpnv4
[R3-bgp-af-vpnv4]peer 2.2.2.2 enable 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

查看BGP的VPNV4邻居关系状态

当出现RR时，存在一个问题，VPNV4路由传到RR上后被过滤。

policy vpn-target 默认开启基于RT属性V_P_NV4路由的过滤

1、如果本路由器没有V_P_N实例业务的接入，则丢弃所有的V_P_NV4路由
2、如果本路由器存在V_P_N实例业务的接入，则对eRT和本段所有V_P_N实例的iRT做匹配，如果eRT没有和任何一个本段V_P_N实例的iRT匹配，则丢弃。

解决方案：undo policy vpn-target 关闭基于RT属性V_P_NV4路由的过滤

[R2-bgp-af-vpnv4]undo policy vpn-target 
1

注：本次实验只能让公司之间互访并不能访问ISP，使用的是私网IP。
若想访问ISP必须再拉线到运营商 并且使用公网IP