VPLS over GRE over IPSEC on VMX

参考:

dci-vpls-o-gre-o-ipsec.pdf

Linux-6 ens3:

ip:192.16810.1/24

mac:00:50:00:00:06:00

Linux-7 ens3:

ip:192.16810.2/24

mac:00:50:00:00:07:00

第1步:配置隧道化服务

set chassis fpc 0 pic 0 tunnel-services bandwidth 1g

set chassis fpc 0 pic 0 interface-type ge

set chassis fpc 0 pic 0 inline-services bandwidth 1g

set chassis fpc 0 lite-mode

set chassis network-services enhanced-ip

第2步:配置接口

set interfaces lo0 unit 0 family inet address 10.0.255.2/32 #用于MP-IBGP

set interfaces lo0 unit 0 family inet address 10.1.255.2/32 #用于GRE外层ip

set interfaces si-0/0/0 unit 1 description "IPsec interface to VMX-2"

set interfaces si-0/0/0 unit 1 family inet address 172.16.1.1/30

set interfaces si-0/0/0 unit 1 service-domain inside

set interfaces si-0/0/0 unit 2 family inet

set interfaces si-0/0/0 unit 2 service-domain outside

第3步:配置IPSEC

set services ipsec-vpn ike proposal IKE-PROPOSAL authentication-method pre-shared-keys

set services ipsec-vpn ike proposal IKE-PROPOSAL dh-group group5

set services ipsec-vpn ike proposal IKE-PROPOSAL authentication-algorithm sha1

set services ipsec-vpn ike proposal IKE-PROPOSAL encryption-algorithm aes-256-cbc

set services ipsec-vpn ike proposal IKE-PROPOSAL lifetime-seconds 21600

set services ipsec-vpn ike policy IKE-POLICY mode main

set services ipsec-vpn ike policy IKE-POLICY proposals IKE-PROPOSAL

set services ipsec-vpn ike policy IKE-POLICY pre-shared-key ascii-text BAIDU123

set services ipsec-vpn ipsec proposal IPSEC-PROPOSAL protocol esp

set services ipsec-vpn ipsec proposal IPSEC-PROPOSAL authentication-algorithm hmac-sha1-96

set services ipsec-vpn ipsec proposal IPSEC-PROPOSAL encryption-algorithm aes-256-cbc

set services ipsec-vpn ipsec proposal IPSEC-PROPOSAL lifetime-seconds 3600

set services ipsec-vpn ipsec policy IPSEC-POLICY perfect-forward-secrecy keys group5

set services ipsec-vpn ipsec policy IPSEC-POLICY proposals IPSEC-PROPOSAL

set services ipsec-vpn establish-tunnels immediately

set services ipsec-vpn rule DC2-VPN-RULE term 1 then remote-gateway 10.0.13.3

set services ipsec-vpn rule DC2-VPN-RULE term 1 then dynamic ike-policy IKE-POLICY

set services ipsec-vpn rule DC2-VPN-RULE term 1 then dynamic ipsec-policy IPSEC-POLICY

set services ipsec-vpn rule DC2-VPN-RULE match-direction input

set services service-set DC2-VPN-SET next-hop-service inside-service-interface si-0/0/0.1

set services service-set DC2-VPN-SET next-hop-service outside-service-interface si-0/0/0.2

set services service-set DC2-VPN-SET ipsec-vpn-options local-gateway 10.0.12.2

set services service-set DC2-VPN-SET ipsec-vpn-rules DC2-VPN-RULE

第4步:配置GRE

set interfaces gr-0/0/10 unit 0 description "GRE TO DC2"

set interfaces gr-0/0/10 unit 0 tunnel source 10.1.255.2

set interfaces gr-0/0/10 unit 0 tunnel destination 10.1.255.3

set interfaces gr-0/0/10 unit 0 family inet

set interfaces gr-0/0/10 unit 0 family mpls

set routing-options static route 10.1.255.3/32 next-hop si-0/0/0.1

第5步:配置OSPF

set protocols ospf traffic-engineering

set protocols ospf area 0.0.0.0 interface lo0.0 passive

set protocols ospf area 0.0.0.0 interface gr-0/0/10.0

第6步:配置VPLS

set interfaces ge-0/0/1 encapsulation ethernet-vpls

set interfaces ge-0/0/1 unit 0 description "LAN for VPLS to DC2"

set interfaces ge-0/0/1 unit 0 family vpls

set routing-options autonomous-system 12

set protocols bgp group iBGP type internal

set protocols bgp group iBGP local-address 10.0.255.2

set protocols bgp group iBGP family l2vpn signaling

set protocols bgp group iBGP neighbor 10.0.255.3

set protocols rsvp interface gr-0/0/10.0

set protocols mpls interface gr-0/0/10.0

set protocols mpls label-switched-path From-DC1-to-DC2 from 10.0.255.2

set protocols mpls label-switched-path From-DC1-to-DC2 to 10.0.255.3

set protocols mpls label-switched-path From-DC1-to-DC2 no-cspf

set routing-instances VPLS instance-type vpls

set routing-instances VPLS interface ge-0/0/1.0

set routing-instances VPLS route-distinguisher 10.0.255.2:100

set routing-instances VPLS vrf-target target:12:100

set routing-instances VPLS protocols vpls no-tunnel-services

set routing-instances VPLS protocols vpls site-range 10

set routing-instances VPLS protocols vpls site DC1 site-identifier 1

-------------------------------------具体配置如下-------------------------------------------------------

root@INTERNET-R> show configuration | display set

set version 14.1R4.8

set system host-name INTERNET-R

set system root-authentication encrypted-password "$1$czFmzflT$fRwwwJRTUyHfii1irLHQd1"

set system syslog user * any emergency

set system syslog file messages any notice

set system syslog file messages authorization info

set system syslog file interactive-commands interactive-commands any

set interfaces ge-0/0/0 unit 0 family inet address 10.0.12.1/24

set interfaces ge-0/0/1 unit 0 family inet address 10.0.13.1/24

root@VMX-1> show configuration | display set

set version 17.4R1.16

set system host-name VMX-1

set system root-authentication encrypted-password "$6$ZQ4qNe6G$pbGgzALEFmxJE32UKCsHvXEyHy9jntcPZN9bkAnLJm3/hlL3/D.OAmdfTAc00psRb1zFb8Jf5gpxyYXDOda.O1"

set system services ssh root-login allow

set system services ssh protocol-version v2

set system syslog user * any emergency

set system syslog file messages any notice

set system syslog file messages authorization info

set system syslog file interactive-commands interactive-commands any

set system processes dhcp-service traceoptions file dhcp_logfile

set system processes dhcp-service traceoptions file size 10m

set system processes dhcp-service traceoptions level all

set system processes dhcp-service traceoptions flag all