Lab1 跨域MPLS-虚拟专网 Option C (RR)配置详解
Option C (RR） 详解
-
- 实验拓扑
- 实验要求
- 配置步骤
-
- R1
- R2
- R3
- R4
- R5
- R6
- R7
- R8
- R9
- R10
实验拓扑
实验要求
本实验使用Option C完成跨域的MPLS-VPN，R9/10是CE，R1/7是PE，R3/5是ASBR，R2/6是P设备，R4/8是反射器RR。
所有涉及到Router-id的协议，全部手动指定Loopback0地址为RID。
所有BGP协议全部关闭自动建立ipv4单播邻居，若有需要手动建立邻居。
一、ISP公网
1.1 部署IGP
1.1.1 AS100和AS200内运行OSPF，进程1.
1.1.2 除与其他AS互联的接口外，全部使用精确通告，划入区域0.
1.1.3 确认各AS内互通。
1.2 部署MPLS
1.2.1 在AS100和AS200内所有设备上启用MPLS
1.2.2 LSR-ID使用Loopback0地址。
1.2.3 启用LDP协议
1.2.4 在R3/5之间仅启用MPLS，不使用LDP。
1.3 AS100部署IBGP
1.3.1 R1/3/4启用BGP，AS100。R2不启用BGP。
1.3.2 R4作为反射器RR，R1/3作为客户端。
1.3.3 R4使用按组打包方式配置邻居关系，组名称ibgp
1.3.4 使用Loopback0建立邻居关系。
1.3.5 R1和R4建立IPv4和v4邻居关系。
1.3.6 R3和R4仅建立IPv4邻居关系。
1.4 AS200部署IBGP
1.4.1 R5/7/8启用BGP，AS200。R6不启用BGP。
1.4.2 R8作为反射器RR，R7作为客户端。（R7代表了所有的PE）
1.4.3 R8使用按组打包方式配置邻居关系，组名称ibgp
1.4.4 使用Loopback0建立邻居关系。
1.4.5 R7和R8仅建立v4邻居关系。
1.4.6 R5和R8不建立邻居关系。
1.5 部署EBGP
1.5.1 R3和R5使用物理接口建立ipv4单播邻居关系。
1.5.2 R3宣告R4的Loopback0路由；R5宣告R8的Loopback0路由。
1.5.3 完成其他必要配置，确认R4和R8的Loopback0互通。
1.5.3 R4和R8建立v4邻居关系，EBGP多跳为255。
二、部署VPN
2.1 建立BGP-LSP
Option C的特点是只有PE维护私网路由，R1收到R10的私网路由下一跳为R7，反之亦然。所以必须先打通R1-R7的BGP-LSP。
2.1.1 R3宣告R1的Loopback0；R5宣告R7的Looback0。
2.1.2 R3/5配置路由策略p1,node 10分配mpls标签。
2.1.3 R3和R5互相发送路由可分配标签，并使用路由策略p1。
2.1.4 R3配置路由策略p2,node10为携带mpls标签的路由分配本地标签。
2.1.5 R3将BGP路由传递给R4时分配标签,使用路由策略p2。
2.1.6 R4反射路由时也携带标签信息。
2.1.7 R5允许LDP为BGP路由分配标签。
2.2 创建VRF
2.2.1 在R1上创建VRF，名称9，RD 9:9 ,出向RT 9:10,配置合适的入向RT。
2.2.2 在R7上创建VRF，名称10，RD10:10,出向RT10:9,配置合适的入向RT。
2.2.3 R1的G0/0/1划入VRF9，并配置IP地址192.168.1.1/24
2.2.4 R7的G0/0/1划入VRF10，并配置IP地址192.168.7.7/24
2.3 部署CE-PE协议
2.3.1 R9是AS9的CE设备，和R1建立BGP邻居关系。
2.3.2 R10是AS10的CE设备，和R7建立BGP邻居关系。
2.4 宣告VPN路由
2.4.1 R9和R10分别宣告Loopback0的路由。
2.4.2 确认RR转发路由，且R1/7收到的路由下一跳是对端PE。
2.4.3 确认R9和R10收到对端路由，且可以通信。
配置步骤
不每一步详写，仅给出所有设备的全部配置，请自行查看！！
R1
<R1>dis cu
[V200R003C00]
#
sysname R1
#
snmp-agent local-engineid 800007DB03000000000000
snmp-agent
#
clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
drop illegal-mac alarm
#
wlan ac-global carrier id other ac id 0
#
set cpu-usage threshold 80 restore 75
#
ip -instance 9
ipv4-family
route-distinguisher 9:9
-target 9:10 export-extcommunity
-target 10:9 import-extcommunity
#
mpls lsr-id 1.1.1.1
mpls
#
mpls ldp
#
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
local-user admin service-type http
#
firewall zone Local
priority 15
#
interface GigabitEthernet0/0/0
ip address 12.1.1.1 255.255.255.0
mpls
mpls ldp
#
interface GigabitEthernet0/0/1
ip binding -instance 9
ip address 192.168.1.1 255.255.255.0
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
ip address 1.1.1.1 255.255.255.255
#
bgp 100
router-id 1.1.1.1
undo default ipv4-unicast
peer 4.4.4.4 as-number 100
peer 4.4.4.4 connect-interface LoopBack0
#
ipv4-family unicast
undo synchronization
peer 4.4.4.4 enable
peer 4.4.4.4 label-route-capability
#
ipv4-family v4
policy -target
peer 4.4.4.4 enable
#
ipv4-family -instance 9
peer 192.168.1.9 as-number 9
#
ospf 1 router-id 1.1.1.1
area 0.0.0.0
network 1.1.1.1 0.0.0.0
network 12.1.1.1 0.0.0.0
#
user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return
R2
<R2>dis cu
[V200R003C00]
#
sysname R2
#
snmp-agent local-engineid 800007DB03000000000000
snmp-agent
#
clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
drop illegal-mac alarm
#
wlan ac-global carrier id other ac id 0
#
set cpu-usage threshold 80 restore 75
#
mpls lsr-id 2.2.2.2
mpls
#
mpls ldp
#
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
local-user admin service-type http
#
firewall zone Local
priority 15
#
interface GigabitEthernet0/0/0
ip address 12.1.1.2 255.255.255.0
mpls
mpls ldp
#
interface GigabitEthernet0/0/1
ip address 23.1.1.2 255.255.255.0
mpls
mpls ldp
#
interface GigabitEthernet0/0/2
ip address 24.1.1.2 255.255.255.0
mpls
mpls ldp
#
interface NULL0
#
interface LoopBack0
ip address 2.2.2.2 255.255.255.255
#
ospf 1 router-id 2.2.2.2
area 0.0.0.0
network 2.2.2.2 0.0.0.0
network 12.1.1.2 0.0.0.0
network 23.1.1.2 0.0.0.0
network 24.1.1.2 0.0.0.0
#
user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return
R3
<R3>dis cu
[V200R003C00]
#
sysname R3
#
snmp-agent local-engineid 800007DB03000000000000
snmp-agent
#
clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
drop illegal-mac alarm
#
wlan ac-global carrier id other ac id 0
#
set cpu-usage threshold 80 restore 75
#
mpls lsr-id 3.3.3.3
mpls
#
mpls ldp
#
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
local-user admin service-type http
#
firewall zone Local
priority 15
#
interface GigabitEthernet0/0/0
ip address 23.1.1.3 255.255.255.0
mpls
mpls ldp
#
interface GigabitEthernet0/0/1
ip address 35.1.1.3 255.255.255.0
mpls
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
ip address 3.3.3.3 255.255.255.255
#
bgp 100
router-id 3.3.3.3
undo default ipv4-unicast
peer 4.4.4.4 as-number 100
peer 4.4.4.4 connect-interface LoopBack0
peer 35.1.1.5 as-number 200
#
ipv4-family unicast
undo synchronization
network 1.1.1.1 255.255.255.255
network 4.4.4.4 255.255.255.255
peer 4.4.4.4 enable
peer 4.4.4.4 route-policy p2 export
peer 4.4.4.4 next-hop-local
peer 4.4.4.4 label-route-capability
peer 35.1.1.5 enable
peer 35.1.1.5 route-policy p1 export
peer 35.1.1.5 label-route-capability
#
ipv4-family v4
policy -target
#
ospf 1 router-id 3.3.3.3
area 0.0.0.0
network 3.3.3.3 0.0.0.0
network 23.1.1.3 0.0.0.0
#
route-policy p1 permit node 10
apply mpls-label
#
route-policy p2 permit node 20
if-match mpls-label
apply mpls-label
#
user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return
R4
<R4>dis cu
[V200R003C00]
#
sysname R4
#
snmp-agent local-engineid 800007DB03000000000000
snmp-agent
#
clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
drop illegal-mac alarm
#
wlan ac-global carrier id other ac id 0
#
set cpu-usage threshold 80 restore 75
#
mpls lsr-id 4.4.4.4
mpls
#
mpls ldp
#
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
local-user admin service-type http
#
firewall zone Local
priority 15
#
interface GigabitEthernet0/0/0
ip address 24.1.1.4 255.255.255.0
mpls
mpls ldp
#
interface GigabitEthernet0/0/1
mpls
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
ip address 4.4.4.4 255.255.255.255
#
bgp 100
router-id 4.4.4.4
undo default ipv4-unicast
peer 8.8.8.8 as-number 200
peer 8.8.8.8 ebgp-max-hop 255
peer 8.8.8.8 connect-interface LoopBack0
group ibgp internal
peer ibgp connect-interface LoopBack0
peer 1.1.1.1 as-number 100
peer 1.1.1.1 group ibgp
peer 3.3.3.3 as-number 100
peer 3.3.3.3 group ibgp
#
ipv4-family unicast
undo synchronization
undo peer 8.8.8.8 enable
peer ibgp enable
peer ibgp reflect-client
peer ibgp next-hop-invariable
peer ibgp label-route-capability
peer 1.1.1.1 enable
peer 1.1.1.1 group ibgp
peer 3.3.3.3 enable
peer 3.3.3.3 group ibgp
#
ipv4-family v4
undo policy -target
peer 8.8.8.8 enable
peer ibgp enable
peer ibgp reflect-client
peer 1.1.1.1 enable
peer 1.1.1.1 group ibgp
#
ospf 1 router-id 4.4.4.4
area 0.0.0.0
network 4.4.4.4 0.0.0.0
network 24.1.1.4 0.0.0.0
#
route recursive-lookup tunnel
#
user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return
R5
<R5>dis cu
[V200R003C00]
#
sysname R5
#
snmp-agent local-engineid 800007DB03000000000000
snmp-agent
#
clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
drop illegal-mac alarm
#
wlan ac-global carrier id other ac id 0
#
set cpu-usage threshold 80 restore 75
#
mpls lsr-id 5.5.5.5
mpls
lsp-trigger bgp-label-route
#
mpls ldp
#
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
local-user admin service-type http
#
firewall zone Local
priority 15
#
interface GigabitEthernet0/0/0
ip address 56.1.1.5 255.255.255.0
mpls
mpls ldp
#
interface GigabitEthernet0/0/1
ip address 35.1.1.5 255.255.255.0
mpls
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
ip address 5.5.5.5 255.255.255.255
#
bgp 200
router-id 5.5.5.5
undo default ipv4-unicast
peer 35.1.1.3 as-number 100
#
ipv4-family unicast
undo synchronization
network 7.7.7.7 255.255.255.255
network 8.8.8.8 255.255.255.255
peer 35.1.1.3 enable
peer 35.1.1.3 route-policy p1 export
peer 35.1.1.3 label-route-capability
#
ipv6-family unicast
undo synchronization
#
ospf 1 router-id 5.5.5.5
import-route bgp
area 0.0.0.0
network 5.5.5.5 0.0.0.0
network 56.1.1.5 0.0.0.0
#
route-policy p1 permit node 10
apply mpls-label
#
user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return
R6
<R6>dis cu
[V200R003C00]
#
sysname R6
#
snmp-agent local-engineid 800007DB03000000000000
snmp-agent
#
clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
drop illegal-mac alarm
#
wlan ac-global carrier id other ac id 0
#
set cpu-usage threshold 80 restore 75
#
mpls lsr-id 6.6.6.6
mpls
#
mpls ldp
#
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
local-user admin service-type http
#
firewall zone Local
priority 15
#
interface GigabitEthernet0/0/0
ip address 56.1.1.6 255.255.255.0
mpls
mpls ldp
#
interface GigabitEthernet0/0/1
ip address 67.1.1.6 255.255.255.0
mpls
mpls ldp
#
interface GigabitEthernet0/0/2
ip address 68.1.1.6 255.255.255.0
mpls
mpls ldp
#
interface NULL0
#
interface LoopBack0
ip address 6.6.6.6 255.255.255.255
#
ospf 1 router-id 6.6.6.6
area 0.0.0.0
network 6.6.6.6 0.0.0.0
network 56.1.1.6 0.0.0.0
network 67.1.1.6 0.0.0.0
network 68.1.1.6 0.0.0.0
#
user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return
R7
<R7>dis cu
[V200R003C00]
#
sysname R7
#
snmp-agent local-engineid 800007DB03000000000000
snmp-agent
#
clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
drop illegal-mac alarm
#
wlan ac-global carrier id other ac id 0
#
set cpu-usage threshold 80 restore 75
#
ip -instance 10
ipv4-family
route-distinguisher 10:10
-target 10:9 export-extcommunity
-target 9:10 import-extcommunity
#
mpls lsr-id 7.7.7.7
mpls
#
mpls ldp
#
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
local-user admin service-type http
#
firewall zone Local
priority 15
#
interface GigabitEthernet0/0/0
ip address 67.1.1.7 255.255.255.0
mpls
mpls ldp
#
interface GigabitEthernet0/0/1
ip binding -instance 10
ip address 192.168.7.7 255.255.255.0
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
ip address 7.7.7.7 255.255.255.255
#
bgp 200
router-id 7.7.7.7
undo default ipv4-unicast
peer 8.8.8.8 as-number 200
peer 8.8.8.8 connect-interface LoopBack0
#
ipv4-family unicast
undo synchronization
undo peer 8.8.8.8 enable
#
ipv4-family v4
policy -target
peer 8.8.8.8 enable
#
ipv4-family -instance 10
peer 192.168.7.10 as-number 10
#
ospf 1 router-id 7.7.7.7
area 0.0.0.0
network 7.7.7.7 0.0.0.0
network 67.1.1.7 0.0.0.0
#
user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return
R8
<R8>DIS CU
[V200R003C00]
#
sysname R8
#
snmp-agent local-engineid 800007DB03000000000000
snmp-agent
#
clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
drop illegal-mac alarm
#
wlan ac-global carrier id other ac id 0
#
set cpu-usage threshold 80 restore 75
#
mpls lsr-id 8.8.8.8
mpls
#
mpls ldp
#
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
local-user admin service-type http
#
firewall zone Local
priority 15
#
interface GigabitEthernet0/0/0
ip address 68.1.1.8 255.255.255.0
mpls
mpls ldp
#
interface GigabitEthernet0/0/1
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
ip address 8.8.8.8 255.255.255.255
#
bgp 200
router-id 8.8.8.8
undo default ipv4-unicast
peer 4.4.4.4 as-number 100
peer 4.4.4.4 ebgp-max-hop 255
peer 4.4.4.4 connect-interface LoopBack0
group ibgp internal
peer ibgp connect-interface LoopBack0
peer 7.7.7.7 as-number 200
peer 7.7.7.7 group ibgp
#
ipv4-family unicast
undo synchronization
undo peer ibgp enable
undo peer 4.4.4.4 enable
undo peer 7.7.7.7 enable
#
ipv4-family v4
undo policy -target
peer 4.4.4.4 enable
peer 4.4.4.4 next-hop-invariable
peer ibgp enable
peer ibgp reflect-client
peer 7.7.7.7 enable
peer 7.7.7.7 group ibgp
#
ospf 1 router-id 8.8.8.8
area 0.0.0.0
network 8.8.8.8 0.0.0.0
network 68.1.1.8 0.0.0.0
#
user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return
R9
<R9>dis cu
[V200R003C00]
#
sysname R9
#
snmp-agent local-engineid 800007DB03000000000000
snmp-agent
#
clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
drop illegal-mac alarm
#
wlan ac-global carrier id other ac id 0
#
set cpu-usage threshold 80 restore 75
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
local-user admin service-type http
#
firewall zone Local
priority 15
#
interface GigabitEthernet0/0/0
ip address 192.168.1.9 255.255.255.0
#
interface GigabitEthernet0/0/1
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
ip address 192.168.9.9 255.255.255.255
#
bgp 9
router-id 192.168.9.9
undo default ipv4-unicast
peer 192.168.1.1 as-number 100
#
ipv4-family unicast
undo synchronization
network 192.168.9.9 255.255.255.255
peer 192.168.1.1 enable
#
user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return
R10
<R10>dis cu
[V200R003C00]
#
sysname R10
#
snmp-agent local-engineid 800007DB03000000000000
snmp-agent
#
clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
drop illegal-mac alarm
#
wlan ac-global carrier id other ac id 0
#
set cpu-usage threshold 80 restore 75
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
local-user admin service-type http
#
firewall zone Local
priority 15
#
interface GigabitEthernet0/0/0
ip address 192.168.7.10 255.255.255.0
#
interface GigabitEthernet0/0/1
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
ip address 192.168.10.10 255.255.255.255
#
bgp 10
router-id 192.168.10.10
undo default ipv4-unicast
peer 192.168.7.7 as-number 200
#
ipv4-family unicast
undo synchronization
network 192.168.10.10 255.255.255.255
peer 192.168.7.7 enable
#
user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return
完结！