MPLS VPN跨域C2 RR反射器方案

  • 拓扑设计

MPLS VPN跨域C2 RR反射器方案_第1张图片

  • 拓扑介绍

如图,R9与R10分别是AS100和AS200中的RR反射器;R9与R10建立MP-BGP邻居关系,用于传递VPNV4路由,R1与R6都是PE设备,如果有多个PE设备那么配置起来相对复杂与繁琐,所以现在使用RR反射器进行配置,可以直接将路由传递给多个PE设备,减少配置命令与设备压力。

  • 数据配置

R1

ip -instance 1

 ipv4-family

  route-distinguisher 1:1

  -target 1:6 export-extcommunity

  -target 6:1 import-extcommunity

#

mpls lsr-id 1.1.1.1

mpls

#

mpls ldp

#

#

aaa

 authentication-scheme default

 authorization-scheme default

 accounting-scheme default

 domain default

 domain default_admin

 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$

 local-user admin service-type http

#

isis 1

 is-level level-2

 cost-style wide

 network-entity 49.0000.0000.0001.00

#

firewall zone Local

 priority 15

#

interface GigabitEthernet0/0/0

 ip binding -instance 1

 ip address 17.1.1.1 255.255.255.0

 ospf enable 1 area 0.0.0.0

#

interface GigabitEthernet0/0/1

 ip address 12.1.1.1 255.255.255.0

 isis enable 1

 mpls

 mpls ldp

#

interface GigabitEthernet0/0/2

#

interface NULL0

#

interface LoopBack0

 ip address 1.1.1.1 255.255.255.255

 isis enable 1

#

bgp 100

 peer 9.9.9.9 as-number 100

 peer 9.9.9.9 connect-interface LoopBack0

 #

 ipv4-family unic

  peer 9.9.9.9 enable

  peer 9.9.9.9 label-route-capability

 #

 ipv4-family v4

  policy -target

  peer 9.9.9.9 enable

 #

 ipv4-family -instance 1

  import-route ospf 1

R3

mpls lsr-id 3.3.3.3

mpls

 lsp-trigger bgp-label-route

#

mpls ldp

#

#

aaa

 authentication-scheme default

 authorization-scheme default

 accounting-scheme default

 domain default

 domain default_admin

 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$

 local-user admin service-type http

#

isis 1

 is-level level-2

 cost-style wide

 network-entity 49.0000.0000.0003.00

 import-route bgp

#

firewall zone Local

 priority 15

#

interface GigabitEthernet0/0/0

 ip address 23.1.1.3 255.255.255.0

 isis enable 1

 mpls

 mpls ldp

#

interface GigabitEthernet0/0/1

 ip address 34.1.1.3 255.255.255.0

 mpls

#

interface GigabitEthernet0/0/2

#

interface NULL0

#

interface LoopBack0

 ip address 3.3.3.3 255.255.255.255

 isis enable 1

#

bgp 100

 peer 9.9.9.9 as-number 100

 peer 9.9.9.9 connect-interface LoopBack0

 peer 34.1.1.4 as-number 200

 #

 ipv4-family unicast

  undo synchronization

  network 1.1.1.1 255.255.255.255

  network 9.9.9.9 255.255.255.255

  peer 9.9.9.9 enable

  peer 9.9.9.9 label-route-capability

  peer 34.1.1.4 enable

  peer 34.1.1.4 route-policy 1 export

  peer 34.1.1.4 label-route-capability

#

route-policy 1 permit node 10

 apply mpls-label

R9

mpls lsr-id 9.9.9.9

mpls

#

mpls ldp

#

#

aaa

 authentication-scheme default

 authorization-scheme default

 accounting-scheme default

 domain default

 domain default_admin

 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$

 local-user admin service-type http

#

isis 1

 is-level level-2

 cost-style wide

 network-entity 49.0000.0000.0009.00

#

firewall zone Local

 priority 15

#

interface GigabitEthernet0/0/0

 ip address 29.1.1.9 255.255.255.0

 isis enable 1

 mpls

 mpls ldp

#

interface GigabitEthernet0/0/1

#

interface GigabitEthernet0/0/2

#

interface NULL0

#

interface LoopBack0

 ip address 9.9.9.9 255.255.255.255

 isis enable 1

#

bgp 100

 peer 1.1.1.1 as-number 100

 peer 1.1.1.1 connect-interface LoopBack0

 peer 3.3.3.3 as-number 100

 peer 3.3.3.3 connect-interface LoopBack0

 peer 10.10.10.10 as-number 200

 peer 10.10.10.10 ebgp-max-hop 255

 peer 10.10.10.10 connect-interface LoopBack0

 #

 ipv4-family unicast

  undo synchronization

  peer 1.1.1.1 enable

  peer 1.1.1.1 label-route-capability

  peer 3.3.3.3 enable

  peer 3.3.3.3 label-route-capability

  undo peer 10.10.10.10 enable

 #

 ipv4-family v4

  undo policy -target

  peer 1.1.1.1 enable

  peer 1.1.1.1 next-hop-invariable

  peer 10.10.10.10 enable

  peer 10.10.10.10 next-hop-invariable

R4

mpls lsr-id 4.4.4.4

mpls

 lsp-trigger bgp-label-route

#

mpls ldp

#

#

aaa

 authentication-scheme default

 authorization-scheme default

 accounting-scheme default

 domain default

 domain default_admin

 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$

 local-user admin service-type http

#

isis 1

 is-level level-2

 cost-style wide

 network-entity 50.0000.0000.0004.00

 import-route bgp

#

firewall zone Local

 priority 15

#

interface GigabitEthernet0/0/0

 ip address 34.1.1.4 255.255.255.0

 mpls

#

interface GigabitEthernet0/0/1

 ip address 45.1.1.4 255.255.255.0

 isis enable 1

 mpls

 mpls ldp

#

interface GigabitEthernet0/0/2

#

interface NULL0

#

interface LoopBack0

 ip address 4.4.4.4 255.255.255.255

 isis enable 1

#

bgp 200

 peer 10.10.10.10 as-number 200

 peer 10.10.10.10 connect-interface LoopBack0

 peer 34.1.1.3 as-number 100

 #

 ipv4-family unicast

  undo synchronization

  network 6.0.0.0

  network 6.6.6.6 255.255.255.255

  network 10.0.0.0

  network 10.10.10.10 255.255.255.255

  peer 10.10.10.10 enable

  peer 10.10.10.10 label-route-capability

  peer 34.1.1.3 enable

  peer 34.1.1.3 route-policy 1 export

  peer 34.1.1.3 label-route-capability

#

route-policy 1 permit node 10

 apply mpls-label

R6

ip -instance 1

 ipv4-family

  route-distinguisher 6:6

  -target 6:1 export-extcommunity

  -target 1:6 import-extcommunity

#

mpls lsr-id 6.6.6.6

mpls

#

mpls ldp

#

#

aaa

 authentication-scheme default

 authorization-scheme default

 accounting-scheme default

 domain default

 domain default_admin

 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$

 local-user admin service-type http

#

isis 1

 is-level level-2

 cost-style wide

 network-entity 50.0000.0000.0006.00

#

firewall zone Local

 priority 15

#

interface GigabitEthernet0/0/0

 ip address 56.1.1.6 255.255.255.0

 isis enable 1

 mpls

 mpls ldp

#

interface GigabitEthernet0/0/1

 ip binding -instance 1

 ip address 68.1.1.6 255.255.255.0

 ospf enable 1 area 0.0.0.0

#

interface GigabitEthernet0/0/2

#

interface NULL0

#

interface LoopBack0

 ip address 6.6.6.6 255.255.255.255

 isis enable 1

#

bgp 200

 peer 10.10.10.10 as-number 200

 peer 10.10.10.10 connect-interface LoopBack0

 #

 ipv4-family unicast

  undo synchronization

  peer 10.10.10.10 enable

  peer 10.10.10.10 label-route-capability

 #

 ipv4-family v4

  policy -target

  peer 10.10.10.10 enable

 #

 ipv4-family -instance 1

  import-route ospf 1

#

ospf 1 -instance 1

 import-route bgp

 area 0.0.0.0

R10

mpls lsr-id 10.10.10.10

mpls

#

mpls ldp

#

#

aaa

 authentication-scheme default

 authorization-scheme default

 accounting-scheme default

 domain default

 domain default_admin

 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$

 local-user admin service-type http

#

isis 1

 is-level level-2

 cost-style wide

 network-entity 50.0000.0000.0010.00

#

firewall zone Local

 priority 15

#

interface GigabitEthernet0/0/0

 ip address 15.1.1.1 255.255.255.0

 isis enable 1

 mpls

 mpls ldp

#

interface GigabitEthernet0/0/1

#

interface GigabitEthernet0/0/2

#

interface NULL0

#

interface LoopBack0

 ip address 10.10.10.10 255.255.255.255

 isis enable 1

#

bgp 200

 peer 4.4.4.4 as-number 200

 peer 4.4.4.4 connect-interface LoopBack0

 peer 6.6.6.6 as-number 200

 peer 6.6.6.6 connect-interface LoopBack0

 peer 9.9.9.9 as-number 100

 peer 9.9.9.9 ebgp-max-hop 255

 peer 9.9.9.9 connect-interface LoopBack0

 #

 ipv4-family unicast

  undo synchronization

  peer 4.4.4.4 enable

  peer 4.4.4.4 label-route-capability

  peer 6.6.6.6 enable

  peer 9.9.9.9 enable

  peer 9.9.9.9 next-hop-invariable

  peer 9.9.9.9 label-route-capability

 #

 ipv4-family v4

  undo policy -target

  peer 6.6.6.6 enable

  peer 6.6.6.6 next-hop-invariable

  peer 9.9.9.9 enable

  peer 9.9.9.9 next-hop-invariable

#

  • 路由传递

MPLS VPN跨域C2 RR反射器方案_第2张图片MPLS VPN跨域C2 RR反射器方案_第3张图片

  如图,7.7.7.7的路由传递给R6时,首先R1把R7的路由引入到MP-BGP中,MP-BGP会为这个VRF实例分配一个内层标签会被VPNV4路由携带。这条路由被R1传递给MP-IBGP邻居R9(也就是反射器),因为反射器配置了不检查RT值功能,所以他可以接收这条路由,并把这条路由继续传递给R10设备,R10也是一台RR设备,它同时也配置了不检查RT值功能,所以他也可以收到这条路由,并把路由反射给了R6设备,R6设备根据内层标签将路由传递给了VRF实例。

  • 数据转发
  1. R1设备查看FIB表,发现去往目的地址8.8.8.8是有隧道ID,也就意味着去往这条路由需要迭代到隧道。
  2. 在FIB表中可以看到需要迭代到去往6.6.6.6的隧道,于是按照MPLS表封装内层标签1025,并往下一跳R2转发。
    MPLS VPN跨域C2 RR反射器方案_第4张图片
  3. 现在R2设备收到了MPLS标签为1025的数据包并按照封装为1028标签继续向R3传递,R3会把LDP产生的标签弹掉之后封装策略产生的标签1028进行跨域MPLS VPN跨域C2 RR反射器方案_第5张图片
  4. 跨域之后继续按照隧道的标签依次传递,最终流量转发成功MPLS VPN跨域C2 RR反射器方案_第6张图片

你可能感兴趣的:(数据通信,网络)