devbox
Monodyee
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

华为配置BGP/MPLS IP VPN示例

作者：Monodyee | 2024-02-09 12:00:59

赞

踩

华为配置BGP/MPLS IP VPN示例

配置BGP/MPLS IP VPN示例

组网图形

图1 BGP/MPLS IP VPN组网图
 

  • BGP/MPLS IP VPN简介
  • 配置注意事项
  • 组网需求
  • 配置思路
  • 操作步骤
  • 配置文件

BGP/MPLS IP VPN简介

BGP/MPLS IP VPN是一种基于MPLS的L3VPN，组网方式灵活，可扩展性好，支持大规模部署。新增一个站点时，只需要修改提供该站点业务的边缘节点的配置。

BGP/MPLS IP VPN适用于位于不同地理位置的公司总部和分支之间需要相互通信的场景，由于通信数据需要穿越运营商的骨干网，可以使用BGP在骨干网上发布VPN路由，使用MPLS在骨干网上转发VPN报文；由于公司内部各个部门之间需要相互隔离，可以通过该功能实现不同VPN之间的路由隔离、地址空间隔离和访问隔离。

配置注意事项
  • 本举例适用的产品和版本包括：
    • S5700-HI、S5710-EI：V200R002C00及后续版本
    • S5720-EI：V200R009C00及后续版本
    • S5720-HI：V200R007C10及后续版本
    • S5710-HI、S5730-HI、S5731-H、S5731-H-K、S5731S-H、S5732-H、S5732-H-K：适用版本请参见“案例适用的产品和版本说明”中的表1
    • S5731-S、S6730-S：V200R022C00及后续版本
    • S6700-EI：V200R005（C00&C01）
    • S6720-EI、S6720S-EI、S6720-HI、S6730-H、S6730-H-K、S6730S-H：适用版本请参见“案例适用的产品和版本说明”中的表1
    • S7703、S7706、S7712、S7703 PoE、S7706 PoE、S7710、S7905、S7908、S9703、S9706、S9712：适用版本请参见“案例适用的产品和版本说明”中的表1
  • SA系列单板、E3L系列单板不支持BGP/MPLS IP VPN功能，X1E系列单板在V200R006C00版本及后续版本支持BGP/MPLS IP VPN功能。

如需了解交换机软件配套详细信息，请点击Info-Finder，在选择产品系列或产品型号后，在“硬件中心”进行查询。

S5731-L和S5731S-L属于远端模块，不支持Web管理、YANG和命令行，仅支持通过中心交换机对其下发配置，相关操作请参见《S300, S500, S2700, S5700, S6700 V200R022C00 配置指南-设备管理》中的“智能极简园区网络配置（小行星方案）”。

组网需求

如图1所示：

  • CE1连接公司总部研发区、CE3连接分支机构研发区，CE1和CE3属于vpna；
  • CE2连接公司总部非研发区、CE4连接分支机构非研发区，CE2和CE4属于vpnb。

公司要求通过部署BGP/MPLS IP VPN，实现总部和分支机构的安全互通，同时要求研发区和非研发区间数据隔离。

配置思路

采用如下的思路配置BGP/MPLS IP VPN：

  1. P、PE之间配置OSPF，实现骨干网的IP连通性。
  2. PE、P上配置MPLS基本能力和MPLS LDP，建立MPLS LSP公网隧道，传输VPN数据。
  3. PE1和PE2之间配置MP-IBGP，交换VPN路由信息。
  4. PE1和PE2上配置VPN实例，其中，vpna使用的VPN-target属性为111:1，vpnb使用的VPN-target属性为222:2，以实现相同VPN间互通，不同VPN间隔离。同时，与CE相连的接口和相应的VPN实例绑定，以接入VPN用户。
  5. CE与PE之间配置EBGP，交换VPN路由信息。

操作步骤
  1. 在MPLS骨干网上配置IGP协议，实现骨干网PE和P的互通 

    1. # 配置PE1。
    2.  
    3. <HUAWEI> system-view
    4. [HUAWEI] sysname PE1
    5. [PE1] interface loopback 1
    6. [PE1-LoopBack1] ip address 1.1.1.9 32
    7. [PE1-LoopBack1] quit
    8. [PE1] vlan batch 10 20 30
    9. [PE1] interface gigabitethernet 1/0/0
    10. [PE1-GigabitEthernet1/0/0] port link-type trunk
    11. [PE1-GigabitEthernet1/0/0] port trunk allow-pass vlan 10 
    12. [PE1-GigabitEthernet1/0/0] quit
    13. [PE1] interface gigabitethernet 2/0/0
    14. [PE1-GigabitEthernet2/0/0] port link-type trunk
    15. [PE1-GigabitEthernet2/0/0] port trunk allow-pass vlan 20 
    16. [PE1-GigabitEthernet2/0/0] quit
    17. [PE1] interface gigabitethernet 3/0/0
    18. [PE1-GigabitEthernet3/0/0] port link-type trunk
    19. [PE1-GigabitEthernet3/0/0] port trunk allow-pass vlan 30 
    20. [PE1-GigabitEthernet3/0/0] quit
    21. [PE1] interface vlanif 30
    22. [PE1-Vlanif30] ip address 172.1.1.1 24
    23. [PE1-Vlanif30] quit
    24. [PE1] ospf 1 router-id 1.1.1.9
    25. [PE1-ospf-1] area 0
    26. [PE1-ospf-1-area-0.0.0.0] network 172.1.1.0 0.0.0.255
    27. [PE1-ospf-1-area-0.0.0.0] network 1.1.1.9 0.0.0.0
    28. [PE1-ospf-1-area-0.0.0.0] quit
    29. [PE1-ospf-1] quit
    30. # 配置P。
    31.  
    32. <HUAWEI> system-view
    33. [HUAWEI] sysname P
    34. [P] interface loopback 1
    35. [P-LoopBack1] ip address 2.2.2.9 32
    36. [P-LoopBack1] quit
    37. [P] vlan batch 30 60
    38. [P] interface gigabitethernet 1/0/0 
    39. [P-GigabitEthernet1/0/0] port link-type trunk
    40. [P-GigabitEthernet1/0/0] port trunk allow-pass vlan 30
    41. [P-GigabitEthernet1/0/0] quit
    42. [P] interface gigabitethernet 2/0/0 
    43. [P-GigabitEthernet2/0/0] port link-type trunk
    44. [P-GigabitEthernet2/0/0] port trunk allow-pass vlan 60
    45. [P-GigabitEthernet2/0/0] quit
    46. [P] interface vlanif 30
    47. [P-Vlanif30] ip address 172.1.1.2 24
    48. [P-Vlanif30] quit
    49. [P] interface vlanif 60
    50. [P-Vlanif60] ip address 172.2.1.1 24
    51. [P-Vlanif60] quit
    52. [P] ospf 1 router-id 2.2.2.9
    53. [P-ospf-1] area 0
    54. [P-ospf-1-area-0.0.0.0] network 172.1.1.0 0.0.0.255
    55. [P-ospf-1-area-0.0.0.0] network 172.2.1.0 0.0.0.255
    56. [P-ospf-1-area-0.0.0.0] network 2.2.2.9 0.0.0.0
    57. [P-ospf-1-area-0.0.0.0] quit
    58. [P-ospf-1] quit
    59. # 配置PE2。
    60.  
    61. <HUAWEI> system-view
    62. [HUAWEI] sysname PE2
    63. [PE2] interface loopback 1
    64. [PE2-LoopBack1] ip address 3.3.3.9 32
    65. [PE2-LoopBack1] quit
    66. [PE2] vlan batch 40 50 60
    67. [PE2] interface gigabitethernet 1/0/0
    68. [PE2-GigabitEthernet1/0/0] port link-type trunk
    69. [PE2-GigabitEthernet1/0/0] port trunk allow-pass vlan 40
    70. [PE2-GigabitEthernet1/0/0] quit
    71. [PE2] interface gigabitethernet 2/0/0 
    72. [PE2-GigabitEthernet2/0/0] port link-type trunk
    73. [PE2-GigabitEthernet2/0/0] port trunk allow-pass vlan 50
    74. [PE2-GigabitEthernet2/0/0] quit
    75. [PE2] interface gigabitethernet 3/0/0 
    76. [PE2-GigabitEthernet3/0/0] port link-type trunk
    77. [PE2-GigabitEthernet3/0/0] port trunk allow-pass vlan 60
    78. [PE2-GigabitEthernet3/0/0] quit
    79. [PE2] interface vlanif 60
    80. [PE2-Vlanif60] ip address 172.2.1.2 24
    81. [PE2-Vlanif60] quit
    82. [PE2] ospf 1 router-id 3.3.3.9
    83. [PE2-ospf-1] area 0
    84. [PE2-ospf-1-area-0.0.0.0] network 172.2.1.0 0.0.0.255
    85. [PE2-ospf-1-area-0.0.0.0] network 3.3.3.9 0.0.0.0
    86. [PE2-ospf-1-area-0.0.0.0] quit
    87. [PE2-ospf-1] quit

    配置完成后，PE1和P、P和PE2之间应能建立OSPF邻居关系，执行display ospf peer命令可以看到邻居状态为Full。执行display ip routing-table命令可以看到PE之间学习到对方的Loopback1路由。

    以PE1的显示为例：

    1. [PE1] display ip routing-table
    2. Route Flags: R - relay, D - download to fib, T - to vpn-instance
    3. ------------------------------------------------------------------------------
    4. Routing Tables: Public
    5.          Destinations : 8       Routes : 8
    6.  
    7.   Destination/Mask    Proto  Pre  Cost     Flags NextHop         Interface
    8.  
    9.          1.1.1.9/32   Direct 0    0           D  127.0.0.1       LoopBack1
    10.          2.2.2.9/32   OSPF   10   1           D  172.1.1.2       Vlanif30
    11.          3.3.3.9/32   OSPF   10   2           D  172.1.1.2       Vlanif30
    12.         127.0.0.0/8   Direct 0    0           D  127.0.0.1       InLoopBack0
    13.        127.0.0.1/32   Direct 0    0           D  127.0.0.1       InLoopBack0
    14.        172.1.1.0/24   Direct 0    0           D  172.1.1.1       Vlanif30
    15.        172.1.1.1/32   Direct 0    0           D  127.0.0.1       Vlanif30
    16.        172.2.1.0/24   OSPF   10   2           D  172.1.1.2       Vlanif30
    17. [PE1] display ospf peer
    18.  
    19.           OSPF Process 1 with Router ID 1.1.1.9
    20.                   Neighbors
    21.  
    22.  Area 0.0.0.0 interface 172.1.1.1(Vlanif30)'s neighbors
    23.  Router ID: 2.2.2.9         Address: 172.1.1.2
    24.    State: Full  Mode:Nbr is  Master  Priority: 1
    25.    DR: 172.1.1.2  BDR: 172.1.1.1  MTU: 0 
    26.    Dead timer due in 37  sec
    27.    Retrans timer interval: 5 
    28.    Neighbor is up for 00:16:21
    29.    Authentication Sequence: [ 0 ]

  2. 在MPLS骨干网上配置MPLS基本能力和MPLS LDP，建立LDP LSP 

    1. ​
    2.  
    3. [PE1] mpls lsr-id 1.1.1.9
    4. [PE1] mpls
    5. [PE1-mpls] quit
    6. [PE1] mpls ldp
    7. [PE1-mpls-ldp] quit
    8. [PE1] interface vlanif 30
    9. [PE1-Vlanif30] mpls
    10. [PE1-Vlanif30] mpls ldp
    11. [PE1-Vlanif30] quit
    12.  
    13. [P] mpls lsr-id 2.2.2.9
    14. [P] mpls
    15. [P-mpls] quit
    16. [P] mpls ldp
    17. [P-mpls-ldp] quit
    18. [P] interface vlanif 30
    19. [P-Vlanif30] mpls
    20. [P-Vlanif30] mpls ldp
    21. [P-Vlanif30] quit
    22. [P] interface vlanif 60
    23. [P-Vlanif60] mpls
    24. [P-Vlanif60] mpls ldp
    25. [P-Vlanif60] quit
    26.  
    27. [PE2] mpls lsr-id 3.3.3.9
    28. [PE2] mpls
    29. [PE2-mpls] quit
    30. [PE2] mpls ldp
    31. [PE2-mpls-ldp] quit
    32. [PE2] interface vlanif 60
    33. [PE2-Vlanif60] mpls
    34. [PE2-Vlanif60] mpls ldp
    35. [PE2-Vlanif60] quit
    36.  
    37.  
    38. [PE1] display mpls ldp session
    39.  
    40.  LDP Session(s) in Public Network
    41.  Codes: LAM(Label Advertisement Mode), SsnAge Unit(DDDD:HH:MM)
    42.  A '*' before a session means the session is being deleted. 
    43.  ------------------------------------------------------------------------------
    44.  PeerID            Status      LAM  SsnRole  SsnAge       KASent/Rcv
    45.  ------------------------------------------------------------------------------
    46.  2.2.2.9:0          Operational DU   Passive  0000:00:01  6/6
    47.  ------------------------------------------------------------------------------
    48.  TOTAL: 1 session(s) Found.
    49.  
    50. [PE1] display mpls ldp lsp
    51.  
    52. LDP LSP Information
    53.  -------------------------------------------------------------------------------
    54.  Flag after Out IF: (I) - LSP Is Only Iterated by RLFA
    55.  -------------------------------------------------------------------------------
    56.  DestAddress/Mask   In/OutLabel   UpstreamPeer     NextHop     OutInterface   
    57.  -------------------------------------------------------------------------------
    58.  1.1.1.9/32         3/NULL        2.2.2.9          127.0.0.1   InLoop0    
    59. *1.1.1.9/32         Liberal/1024                   DS/2.2.2.9
    60.  2.2.2.9/32         NULL/3        -                172.1.1.2   Vlanif30       
    61.  2.2.2.9/32         1024/3        2.2.2.9          172.1.1.2   Vlanif30       
    62.  3.3.3.9/32         NULL/1025     -                172.1.1.2   Vlanif30       
    63.  3.3.3.9/32         1025/1025     2.2.2.9          172.1.1.2   Vlanif30      
    64.  -------------------------------------------------------------------------------
    65.  TOTAL: 5 Normal LSP(s) Found.
    66.  TOTAL: 1 Liberal LSP(s) Found.
    67.  TOTAL: 0 Frr LSP(s) Found.
    68.  A '*' before an LSP means the LSP is not established 
    69.  A '*' before a Label means the USCB or DSCB is stale 
    70.  A '*' before a UpstreamPeer means the session is stale 
    71.  A '*' before a DS means the session is stale 
    72.  A '*' before a NextHop means the LSP is FRR LSP
    73.  
    74. 在PE设备上配置VPN实例，将CE接入PE
    75.  
    76. [PE1] ip vpn-instance vpna
    77. [PE1-vpn-instance-vpna] route-distinguisher 100:1
    78. [PE1-vpn-instance-vpna-af-ipv4] vpn-target 111:1 both
    79. [PE1-vpn-instance-vpna-af-ipv4] quit
    80. [PE1-vpn-instance-vpna] quit
    81. [PE1] ip vpn-instance vpnb
    82. [PE1-vpn-instance-vpnb] route-distinguisher 100:2
    83. [PE1-vpn-instance-vpnb-af-ipv4] vpn-target 222:2 both
    84. [PE1-vpn-instance-vpnb-af-ipv4] quit
    85. [PE1-vpn-instance-vpnb] quit
    86. [PE1] interface vlanif 10
    87. [PE1-Vlanif10] ip binding vpn-instance vpna
    88. [PE1-Vlanif10] ip address 10.1.1.2 24
    89. [PE1-Vlanif10] quit
    90. [PE1] interface vlanif 20
    91. [PE1-Vlanif20] ip binding vpn-instance vpnb
    92. [PE1-Vlanif20] ip address 10.2.1.2 24
    93. [PE1-Vlanif20] quit
    94.  
    95. [PE2] ip vpn-instance vpna
    96. [PE2-vpn-instance-vpna] route-distinguisher 200:1
    97. [PE2-vpn-instance-vpna-af-ipv4] vpn-target 111:1 both
    98. [PE2-vpn-instance-vpna-af-ipv4] quit
    99. [PE2-vpn-instance-vpna] quit
    100. [PE2] ip vpn-instance vpnb
    101. [PE2-vpn-instance-vpnb] route-distinguisher 200:2
    102. [PE2-vpn-instance-vpnb-af-ipv4] vpn-target 222:2 both
    103. [PE2-vpn-instance-vpnb-af-ipv4] quit
    104. [PE2-vpn-instance-vpnb] quit
    105. [PE2] interface vlanif 40
    106. [PE2-Vlanif40] ip binding vpn-instance vpna
    107. [PE2-Vlanif40] ip address 10.3.1.2 24
    108. [PE2-Vlanif40] quit
    109. [PE2] interface vlanif 50
    110. [PE2-Vlanif50] ip binding vpn-instance vpnb
    111. [PE2-Vlanif50] ip address 10.4.1.2 24
    112. [PE2-Vlanif50] quit
    113.  
    114. <HUAWEI> system-view
    115. [HUAWEI] sysname CE1
    116. [CE1] vlan batch 10
    117. [CE1] interface gigabitethernet 1/0/0
    118. [CE1-GigabitEthernet1/0/0] port link-type trunk
    119. [CE1-GigabitEthernet1/0/0] port trunk allow-pass vlan 10 
    120. [CE1-GigabitEthernet1/0/0] quit
    121. [CE1] interface vlanif 10
    122. [CE1-Vlanif10] ip address 10.1.1.1 24
    123. [CE1-Vlanif10] quit
    124. ​

  3. 配置完成后，在PE设备上执行display ip vpn-instance verbose命令可以看到VPN实例的配置情况。各PE能ping通自己接入的CE。

    当PE上有多个接口绑定了同一个VPN，则使用ping -vpn-instance命令ping对端PE接入的CE时，要指定源IP地址，即要指定ping -vpn-instance vpn-instance-name -a source-ip-address dest-ip-address命令中的参数-a source-ip-address，否则可能ping不通。

    1. 以PE1为例：
    2.  
    3. [PE1] display ip vpn-instance verbose
    4.  Total VPN-Instances configured : 2
    5.  Total IPv4 VPN-Instances configured : 2
    6.  Total IPv6 VPN-Instances configured : 0
    7.  
    8.  VPN-Instance Name and ID : vpna, 1
    9.   Interfaces : Vlanif10
    10.  Address family ipv4
    11.   Create date : 2014-11-03 02:39:34+00:00
    12.   Up time : 0 days, 22 hours, 24 minutes and 53 seconds
    13.   Route Distinguisher : 100:1
    14.   Export VPN Targets :  111:1
    15.   Import VPN Targets :  111:1
    16.   Label Policy : label per instance
    17.   Per-Instance Label : 4098
    18.   Log Interval : 5
    19.  
    20.  VPN-Instance Name and ID : vpnb, 2
    21.   Interfaces : Vlanif20
    22.  Address family ipv4
    23.   Create date : 2014-11-03 02:39:34+00:00
    24.   Up time : 0 days, 22 hours, 24 minutes and 53 seconds
    25.   Route Distinguisher : 100:2
    26.   Export VPN Targets :  222:2
    27.   Import VPN Targets :  222:2
    28.   Label Policy : label per instance
    29.   Per-Instance Label : 4098
    30.   Log Interval : 5
    31.   
    32. [PE1] ping -vpn-instance vpna 10.1.1.1
    33.   PING 10.1.1.1: 56  data bytes, press CTRL_C to break
    34.     Reply from 10.1.1.1: bytes=56 Sequence=1 ttl=255 time=5 ms
    35.     Reply from 10.1.1.1: bytes=56 Sequence=2 ttl=255 time=3 ms
    36.     Reply from 10.1.1.1: bytes=56 Sequence=3 ttl=255 time=3 ms
    37.     Reply from 10.1.1.1: bytes=56 Sequence=4 ttl=255 time=3 ms
    38.     Reply from 10.1.1.1: bytes=56 Sequence=5 ttl=255 time=16 ms
    39.  
    40.   --- 10.1.1.1 ping statistics ---
    41.     5 packet(s) transmitted
    42.     5 packet(s) received
    43.     0.00% packet loss
    44.     round-trip min/avg/max = 3/6/16 ms

  4. 在PE与CE之间建立EBGP对等体关系，引入VPN路由 

    1. # 配置连接公司总部研发区的CE1。CE2、CE3和CE4的配置与CE1类似，详见配置文件。
    2.  
    3. [CE1] bgp 65410
    4. [CE1-bgp] peer 10.1.1.2 as-number 100
    5. [CE1-bgp] import-route direct
    6. [CE1-bgp] quit
    7. # 配置PE1。PE2的配置与PE1类似，详见配置文件。
    8.  
    9. [PE1] bgp 100
    10. [PE1-bgp] ipv4-family vpn-instance vpna
    11. [PE1-bgp-vpna] peer 10.1.1.1 as-number 65410
    12. [PE1-bgp-vpna] import-route direct
    13. [PE1-bgp-vpna] quit
    14. [PE1-bgp] ipv4-family vpn-instance vpnb
    15. [PE1-bgp-vpnb] peer 10.2.1.1 as-number 65420
    16. [PE1-bgp-vpnb] import-route direct
    17. [PE1-bgp-vpnb] quit
    18. [PE1-bgp] quit
    19. 配置完成后，在PE设备上执行display bgp vpnv4 vpn-instance peer命令，可以看到PE与CE之间的BGP对等体关系已建立，并达到Established状态。
    20.  
    21. 以PE1与CE1的对等体关系为例：
    22.  
    23. [PE1] display bgp vpnv4 vpn-instance vpna peer
    24.  
    25.  BGP local router ID : 1.1.1.9
    26.  Local AS number : 100
    27.  VPN-Instance vpna, Router ID 1.1.1.9:
    28.  Total number of peers : 1                 Peers in established state : 1
    29.  
    30.   Peer            V    AS  MsgRcvd  MsgSent  OutQ  Up/Down       State      PrefRcv
    31.  
    32.   10.1.1.1        4 65410       11        9     0 00:07:25      Established       1

  5. 在PE之间建立MP-IBGP对等体关系 

    1. # 配置PE1。
    2.  
    3. [PE1] bgp 100
    4. [PE1-bgp] peer 3.3.3.9 as-number 100
    5. [PE1-bgp] peer 3.3.3.9 connect-interface loopback 1
    6. [PE1-bgp] ipv4-family vpnv4
    7. [PE1-bgp-af-vpnv4] peer 3.3.3.9 enable
    8. [PE1-bgp-af-vpnv4] quit
    9. [PE1-bgp] quit
    10. # 配置PE2。
    11.  
    12. [PE2] bgp 100
    13. [PE2-bgp] peer 1.1.1.9 as-number 100
    14. [PE2-bgp] peer 1.1.1.9 connect-interface loopback 1
    15. [PE2-bgp] ipv4-family vpnv4
    16. [PE2-bgp-af-vpnv4] peer 1.1.1.9 enable
    17. [PE2-bgp-af-vpnv4] quit
    18. [PE2-bgp] quit
    19. 配置完成后，在PE设备上执行display bgp peer或display bgp vpnv4 all peer命令，可以看到PE之间的BGP对等体关系已建立，并达到Established状态。
    20.  
    21. [PE1] display bgp peer
    22.  
    23.  BGP local router ID : 1.1.1.9
    24.  Local AS number : 100
    25.  Total number of peers : 1                 Peers in established state : 1
    26.  
    27.   Peer            V    AS  MsgRcvd  MsgSent  OutQ  Up/Down       State              PrefRcv
    28.  
    29.   3.3.3.9         4   100       12        6     0 00:02:21        Established       0
    30. [PE1] display bgp vpnv4 all peer
    31.  
    32. BGP local router ID : 1.1.1.9
    33.  Local AS number : 100
    34.  Total number of peers : 3                 Peers in established state : 3
    35.  
    36.   Peer            V    AS  MsgRcvd  MsgSent    OutQ  Up/Down    State        PrefRcv
    37.  
    38.   3.3.3.9         4   100   12      18         0     00:09:38   Established   0
    39.   Peer of IPv4-family for vpn instance :
    40.  
    41.  VPN-Instance vpna, Router ID 1.1.1.9: 
    42.   10.1.1.1        4   65410  25     25         0     00:17:57   Established   1
    43.  VPN-Instance vpnb, Router ID 1.1.1.9: 
    44.   10.2.1.1        4   65420  21     22         0     00:17:10   Established   1

  6. 检查配置结果 
    1. 在PE设备上执行display ip routing-table vpn-instance命令，可以看到去往对端CE的路由。
    2.  
    3. 以PE1的显示为例：
    4.  
    5. [PE1] display ip routing-table vpn-instance vpna
    6. Route Flags: R - relay, D - download to fib, T - to vpn-instance
    7. ------------------------------------------------------------------------------
    8. Routing Tables: vpna
    9.          Destinations : 3        Routes : 3
    10.  
    11. Destination/Mask    Proto  Pre  Cost     Flags NextHop         Interface
    12.  
    13.      10.1.1.0/24    Direct 0    0        D     10.1.1.2        Vlanif10
    14.      10.1.1.2/32    Direct 0    0        D     127.0.0.1       Vlanif10
    15.     10.3.1.0/24     IBGP   255  0        RD    3.3.3.9         Vlanif30
    16. [PE1] display ip routing-table vpn-instance vpnb
    17. Route Flags: R - relay, D - download to fib, T - to vpn-instance
    18. ------------------------------------------------------------------------------
    19. Routing Tables: vpnb
    20.          Destinations : 3        Routes : 3
    21.  
    22. Destination/Mask    Proto  Pre  Cost     Flags NextHop         Interface
    23.  
    24.      10.2.1.0/24    Direct 0    0        D     10.2.1.2        Vlanif20
    25.      10.2.1.2/32    Direct 0    0        D     127.0.0.1       Vlanif20
    26.     10.4.1.0/24    IBGP    255  0        RD    3.3.3.9         Vlanif30
    27. 同一VPN的CE能够相互Ping通，不同VPN的CE不能相互Ping通。
    28.  
    29. 例如：连接公司总部研发区的CE1能够Ping通连接分支机构研发区的CE3（10.3.1.1），但不能Ping通连接分支机构非研发区的CE4（10.4.1.1）。
    30.  
    31. [CE1] ping 10.3.1.1
    32.   PING 10.3.1.1: 56  data bytes, press CTRL_C to break
    33.     Reply from 10.3.1.1: bytes=56 Sequence=1 ttl=253 time=72 ms
    34.     Reply from 10.3.1.1: bytes=56 Sequence=2 ttl=253 time=34 ms
    35.     Reply from 10.3.1.1: bytes=56 Sequence=3 ttl=253 time=50 ms
    36.     Reply from 10.3.1.1: bytes=56 Sequence=4 ttl=253 time=50 ms
    37.     Reply from 10.3.1.1: bytes=56 Sequence=5 ttl=253 time=34 ms
    38.   --- 10.3.1.1 ping statistics ---
    39.     5 packet(s) transmitted
    40.     5 packet(s) received
    41.     0.00% packet loss
    42.     round-trip min/avg/max = 34/48/72 ms

配置文件
  1. PE1的配置文件
  2.  
  3. #
  4. sysname PE1
  5. #
  6. vlan batch 10 20 30
  7. #
  8. ip vpn-instance vpna
  9.  ipv4-family
  10.   route-distinguisher 100:1
  11.   vpn-target 111:1 export-extcommunity
  12.   vpn-target 111:1 import-extcommunity
  13. #
  14. ip vpn-instance vpnb
  15.  ipv4-family
  16.   route-distinguisher 100:2
  17.   vpn-target 222:2 export-extcommunity
  18.   vpn-target 222:2 import-extcommunity
  19. #
  20. mpls lsr-id 1.1.1.9
  21. mpls
  22. #
  23. mpls ldp
  24. #
  25. interface Vlanif10
  26.  ip binding vpn-instance vpna
  27.  ip address 10.1.1.2 255.255.255.0
  28. # 
  29. interface Vlanif20
  30.  ip binding vpn-instance vpnb
  31.  ip address 10.2.1.2 255.255.255.0
  32. #
  33. interface Vlanif30
  34.  ip address 172.1.1.1 255.255.255.0
  35.  mpls
  36.  mpls ldp
  37. #
  38. interface GigabitEthernet1/0/0
  39.  port link-type trunk
  40.  port trunk allow-pass vlan 10
  41. # 
  42. interface GigabitEthernet2/0/0
  43.  port link-type trunk
  44.  port trunk allow-pass vlan 20
  45. #
  46. interface GigabitEthernet3/0/0
  47.  port link-type trunk
  48.  port trunk allow-pass vlan 30
  49. #
  50. interface LoopBack1
  51.  ip address 1.1.1.9 255.255.255.255
  52. # 
  53. bgp 100
  54.  peer 3.3.3.9 as-number 100
  55.  peer 3.3.3.9 connect-interface LoopBack1
  56.  #
  57.  ipv4-family unicast
  58.   undo synchronization
  59.   peer 3.3.3.9 enable
  60.  #
  61.  ipv4-family vpnv4
  62.   policy vpn-target
  63.   peer 3.3.3.9 enable
  64.  #
  65.  ipv4-family vpn-instance vpna
  66.   import-route direct
  67.   peer 10.1.1.1 as-number 65410
  68.  #
  69.  ipv4-family vpn-instance vpnb
  70.   import-route direct
  71.   peer 10.2.1.1 as-number 65420
  72. #
  73. ospf 1 router-id 1.1.1.9
  74.  area 0.0.0.0
  75.   network 1.1.1.9 0.0.0.0
  76.   network 172.1.1.0 0.0.0.255
  77. #
  78. return
  79. P的配置文件
  80.  
  81. #
  82. sysname P
  83. #
  84. vlan batch 30 60
  85. #
  86. mpls lsr-id 2.2.2.9
  87. mpls
  88. #
  89. mpls ldp
  90. # 
  91. interface Vlanif30
  92.  ip address 172.1.1.2 255.255.255.0
  93.  mpls
  94.  mpls ldp
  95. #
  96. interface Vlanif60
  97.  ip address 172.2.1.1 255.255.255.0
  98.  mpls
  99.  mpls ldp
  100. #
  101. interface GigabitEthernet1/0/0
  102.  port link-type trunk
  103.  port trunk allow-pass vlan 30
  104. # 
  105. interface GigabitEthernet2/0/0
  106.  port link-type trunk
  107.  port trunk allow-pass vlan 60
  108. # 
  109. interface LoopBack1
  110.  ip address 2.2.2.9 255.255.255.255
  111. #
  112. ospf 1 router-id 2.2.2.9
  113.  area 0.0.0.0
  114.   network 2.2.2.9 0.0.0.0
  115.   network 172.1.1.0 0.0.0.255
  116.   network 172.2.1.0 0.0.0.255
  117. #
  118. return
  119. PE2的配置文件
  120.  
  121. #
  122. sysname PE2
  123. #
  124. vlan batch 40 50 60
  125. #
  126. ip vpn-instance vpna
  127.  ipv4-family
  128.   route-distinguisher 200:1
  129.   vpn-target 111:1 export-extcommunity
  130.   vpn-target 111:1 import-extcommunity
  131. #
  132. ip vpn-instance vpnb
  133.  ipv4-family
  134.   route-distinguisher 200:2
  135.   vpn-target 222:2 export-extcommunity
  136.   vpn-target 222:2 import-extcommunity
  137. #
  138. mpls lsr-id 3.3.3.9
  139. mpls
  140. #
  141. mpls ldp
  142. #
  143. interface Vlanif40
  144.  ip binding vpn-instance vpna
  145.  ip address 10.3.1.2 255.255.255.0
  146. #
  147. interface Vlanif50
  148.  ip binding vpn-instance vpnb
  149.  ip address 10.4.1.2 255.255.255.0
  150. #
  151. interface Vlanif60
  152.  ip address 172.2.1.2 255.255.255.0
  153.  mpls
  154.  mpls ldp
  155. #
  156. interface GigabitEthernet1/0/0
  157.  port link-type trunk
  158.  port trunk allow-pass vlan 40
  159. # 
  160. interface GigabitEthernet2/0/0
  161.  port link-type trunk
  162.  port trunk allow-pass vlan 50
  163. # 
  164. interface GigabitEthernet3/0/0
  165.  port link-type trunk
  166.  port trunk allow-pass vlan 60
  167. # 
  168. interface LoopBack1
  169.  ip address 3.3.3.9 255.255.255.255
  170. #
  171. bgp 100
  172.  peer 1.1.1.9 as-number 100
  173.  peer 1.1.1.9 connect-interface LoopBack1
  174.  #
  175.  ipv4-family unicast
  176.   undo synchronization
  177.   peer 1.1.1.9 enable
  178.  #
  179.  ipv4-family vpnv4
  180.   policy vpn-target
  181.   peer 1.1.1.9 enable 
  182.  #
  183.  ipv4-family vpn-instance vpna
  184.   import-route direct
  185.   peer 10.3.1.1 as-number 65430
  186.  #
  187.  ipv4-family vpn-instance vpnb
  188.   import-route direct
  189.   peer 10.4.1.1 as-number 65440
  190. #
  191. ospf 1 router-id 3.3.3.9
  192.  area 0.0.0.0
  193.   network 3.3.3.9 0.0.0.0
  194.   network 172.2.1.0 0.0.0.255
  195. # 
  196. return
  197. 连接公司总部研发区的CE1的配置文件
  198.  
  199. #
  200. sysname CE1
  201. #
  202. vlan batch 10
  203. #
  204. interface Vlanif10
  205.  ip address 10.1.1.1 255.255.255.0
  206. #
  207. interface GigabitEthernet1/0/0
  208.  port link-type trunk
  209.  port trunk allow-pass vlan 10
  210. #
  211. bgp 65410
  212.  peer 10.1.1.2 as-number 100
  213.  #
  214.  ipv4-family unicast
  215.   undo synchronization
  216.   import-route direct
  217.   peer 10.1.1.2 enable
  218. #
  219. return
  220. 连接公司总部非研发区的CE2的配置文件
  221.  
  222. #
  223. sysname CE2
  224. #
  225. vlan batch 20
  226. #
  227. interface Vlanif20
  228.  ip address 10.2.1.1 255.255.255.0
  229. #
  230. interface GigabitEthernet1/0/0
  231.  port link-type trunk
  232.  port trunk allow-pass vlan 20
  233. #
  234. bgp 65420
  235.  peer 10.2.1.2 as-number 100
  236.  #
  237.  ipv4-family unicast
  238.   undo synchronization
  239.   import-route direct
  240.   peer 10.2.1.2 enable
  241. #
  242. return
  243. 连接分支机构研发区的CE3的配置文件
  244.  
  245. #
  246. sysname CE3
  247. #
  248. vlan batch 40
  249. #
  250. interface Vlanif40
  251.  ip address 10.3.1.1 255.255.255.0
  252. #
  253. interface GigabitEthernet1/0/0
  254.  port link-type trunk
  255.  port trunk allow-pass vlan 40
  256. #
  257. bgp 65430
  258.  peer 10.3.1.2 as-number 100
  259.  #
  260.  ipv4-family unicast
  261.   undo synchronization
  262.   import-route direct
  263.   peer 10.3.1.2 enable
  264. #
  265. return
  266. 连接分支机构非研发区的CE4的配置文件
  267.  
  268. #
  269. sysname CE4
  270. #
  271. vlan batch 50
  272. #
  273. interface Vlanif50
  274.  ip address 10.4.1.1 255.255.255.0
  275. #
  276. interface GigabitEthernet1/0/0
  277.  port link-type trunk
  278.  port trunk allow-pass vlan 50
  279. #
  280. bgp 65440
  281.  peer 10.4.1.2 as-number 100
  282.  #
  283.  ipv4-family unicast
  284.   undo synchronization
  285.   import-route direct
  286.   peer 10.4.1.2 enable
  287. #
  288. return

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/Monodyee/article/detail/71789
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号