AI 助理
备案控制台
开发者社区 开发与运维 文章 正文

BGP MPLS VPN（OPTION A）实验笔记

2023-12-24 188
版权
版权声明：
本文内容由阿里云实名注册用户自发贡献，版权归原作者所有，阿里云开发者社区不拥有其著作权，亦不承担相应法律责任。具体规则请查看《 阿里云开发者社区用户服务协议》和 《阿里云开发者社区知识产权保护指引》。如果您发现本社区中有涉嫌抄袭的内容，填写 侵权投诉表单进行举报，一经查实，本社区将立刻删除涉嫌侵权内容。
简介： BGP MPLS VPN（OPTION A）实验笔记

1.实验说明

(1) 实验目的

配置BGP MPLS VPN OPTION A，使得总部与分公司私网互通，分公司与总部之间可互访，但分公司之间不能互访。

(2) 实验拓扑

image.png

(3) 地址说明

业务地址段：
私网地址段
10.0.1.0/24
10.0.2.0/24
10.0.3.0/24

网络地址段：



路由器
接口
IP
备注


R1-CE
loopback0
1.1.1.1/32



GE 0/0/1
192.168.1.2/30



Ethernet 0/0/1
10.0.1.254/24



R2-PE
loopback0
2.2.2.2/32



GE 0/0/1
192.168.1.1/30
vpn


GE 0/0/0
211.137.23.2/24



R3-P
loopback0
3.3.3.3/32



GE 0/0/0
211.137.23.3/24



GE 0/0/1
211.137.34.3/24



R4-ASBR
loopback0
4.4.4.4/32



GE 0/0/1
211.137.34.4/24



GE 0/0/2
211.137.45.4/24
vpn


R5-ASBR
loopback0
5.5.5.5/32



GE 0/0/2
211.137.45.5/24
vpn


GE 0/0/1
211.137.56.5/24



R6-P
loopback0
6.6.6.6/32



GE 0/0/1
211.137.56.6/24



GE 0/0/0
211.137.67.6/24



R7-PE
loopback0
7.7.7.7/32



GE 0/0/0
211.137.67.7/24



GE 0/0/1
192.168.2.1/30
vpn


GE 0/0/2
192.168.3.1/30
vpn


R8-CE
loopback0
8.8.8.8/32



GE 0/0/1
192.168.2.2/30



Ethernet 0/0/1
10.0.2.254/24



R9-CE
loopback0
9.9.9.9/32



GE 0/0/1
192.168.3.2/30



Ethernet 0/0/1
10.0.3.254/24


(4) 实验思路

1.各AS内的MPLS骨干网上分别配置IGP协议，实现各自骨干网ASBR和PE之间的互通
2.各AS内的MPLS骨干网上分别配置MPLS基本能力和MPLS LDP，建立LDP LSP
3.各AS内，PE与ASBR-PE之间建立MP-IBGP对等体关系，交换VPN路由信息
4.各AS内，与CE相连的PE上需配置VPN实例，并把与CE相连的接口和相应的VPN实例绑定
5.各AS内，PE与CE之间建立EBGP对等体关系，交换VPN路由信息
6.在两个ASBR-PE上创建VPN实例，并将此实例绑定到连接另一个ASBR的接口（把一个ASBR-PE当成是自己的CE），并在ASBR之间建立EBGP对等体关系传递VPN路由信息

(5) OPTION A

路由层面
$$ CE \stackrel{ebgp}{\Longleftrightarrow} PE \stackrel{MP-IBGP}{\Longleftrightarrow} ASBR \stackrel{static}{\Longleftrightarrow} ASBR \stackrel{MP-IBGP}{\Longleftrightarrow} PE \stackrel{ebgp}{\Longleftrightarrow} CE $$

转发层面
$$ CE \stackrel{IP}{\Longleftrightarrow} PE \stackrel{MPLS}{\Longleftrightarrow} P \stackrel{MPLS}{\Longleftrightarrow} ASBR \stackrel{IP} {\Longleftrightarrow} ASBR \stackrel{MPLS}{\Longleftrightarrow} P \stackrel{MPLS}{\Longleftrightarrow} PE \stackrel{IP}{\Longleftrightarrow} CE $$

(6) ABC区别

Option A Option B Option C
ASBR间交换的路由类型 客户的IPv4路由 VPNv4路由 公网IPv4路由
AS间标签交换 否 VPN标签 IPv4路由标签（通过eBGP传递）
AS之间是否需要启用LDP 否 否 否
AS之间是否需要启用MP-BGP 否 是 是
VPNv4路由在哪里维护 ASBR ASBR PE或RR
适用场景 一般用于国际运营商之间 同一个运营商中的不同AS之间 同一个运营商中的不同AS之间

2. 骨干域IGP配置(OSPF)

OSPF配置后，PE、P、ASBR可以相互学到loopback路由，是后续MPLS/LDP标签传递、PE/ASBR BGP邻居建立的基础

## R2-PE的ospf配置
<R2-PE>display current-configuration configuration ospf 
#
ospf 1 router-id 2.2.2.2
 area 0.0.0.0
  network 211.137.23.0 0.0.0.255
  network 2.2.2.2 0.0.0.0
#
return

## R3-P的ospf配置
<R3-P>display current-configuration configuration ospf
#
ospf 1 router-id 3.3.3.3
 area 0.0.0.0
  network 211.137.23.0 0.0.0.255
  network 211.137.34.0 0.0.0.255
  network 3.3.3.3 0.0.0.0
#
return

## R4-ASBR的ospf配置
<R4-ASBR>display current-configuration configuration ospf 
#
ospf 1 router-id 4.4.4.4
 area 0.0.0.0
  network 211.137.34.0 0.0.0.255
  network 4.4.4.4 0.0.0.0
#
return

## R7-PE的ospf配置
<R7-PE>display current-configuration configuration ospf 
#
ospf 1 router-id 7.7.7.7
 area 0.0.0.0
  network 211.137.67.0 0.0.0.255
  network 7.7.7.7 0.0.0.0
#
return

## R6-P的ospf配置
<R6-P>display current-configuration configuration ospf
#
ospf 1 router-id 6.6.6.6
 area 0.0.0.0
  network 211.137.56.0 0.0.0.255
  network 211.137.67.0 0.0.0.255
  network 6.6.6.6 0.0.0.0
#
return

## R5-ASBR的ospf配置
<R5-ASBR>display current-configuration configuration ospf
#
ospf 1 router-id 5.5.5.5
 area 0.0.0.0
  network 211.137.56.0 0.0.0.255
  network 5.5.5.5 0.0.0.0
#
return

查看lsdb，确认PE/P/ASBR的loopback均已通过ospf发布

<R3-P>display ospf lsdb

     OSPF Process 1 with Router ID 3.3.3.3
         Link State Database 

                 Area: 0.0.0.0
 Type      LinkState ID    AdvRouter          Age  Len   Sequence   Metric
 Router    4.4.4.4         4.4.4.4              8  48    80000004       0
 Router    2.2.2.2         2.2.2.2             91  48    80000006       0
 Router    3.3.3.3         3.3.3.3              0  60    80000009       0
 Network   211.137.23.2    2.2.2.2             91  32    80000002       0
 Network   211.137.34.3    3.3.3.3              0  32    80000002       0


<R6-P>display ospf lsdb

     OSPF Process 1 with Router ID 6.6.6.6
         Link State Database 

                 Area: 0.0.0.0
 Type      LinkState ID    AdvRouter          Age  Len   Sequence   Metric
 Router    7.7.7.7         7.7.7.7             18  48    80000006       0
 Router    6.6.6.6         6.6.6.6             19  60    80000007       0
 Router    5.5.5.5         5.5.5.5             26  48    80000006       0
 Network   211.137.67.7    7.7.7.7             18  32    80000002       0
 Network   211.137.56.5    5.5.5.5             26  32    80000002       0

3.骨干域MPLS/LDP配置

分别在全局和接口下启用MPLS和LDP

## R2-PE启用MPLS和LDP
[R2-PE]mpls lsr-id 2.2.2.2
[R2-PE]mpls
Info: Mpls starting, please wait... OK!
[R2-PE-mpls]mpls ldp
[R2-PE-mpls-ldp]quit
[R2-PE]interface GigabitEthernet 0/0/0
[R2-PE-GigabitEthernet0/0/0]mpls
[R2-PE-GigabitEthernet0/0/0]mpls ldp

## R3-P启用MPLS和LDP
[R3-P]mpls lsr-id 3.3.3.3
[R3-P]mpls
Info: Mpls starting, please wait... OK!
[R3-P-mpls]mpls ldp
[R3-P-mpls-ldp]quit
[R3-P]interface GigabitEthernet 0/0/0
[R3-P-GigabitEthernet0/0/0]mpls
[R3-P-GigabitEthernet0/0/0]mpls ldp
[R3-P-GigabitEthernet0/0/0]quit
[R3-P]interface GigabitEthernet 0/0/1
[R3-P-GigabitEthernet0/0/1]mpls
[R3-P-GigabitEthernet0/0/1]mpls ldp

## R4-ASBR启用MPLS和LDP
[R4-ASBR]mpls lsr-id 4.4.4.4
[R4-ASBR]mpls
Info: Mpls starting, please wait... OK!
[R4-ASBR-mpls]mpls ldp
[R4-ASBR-mpls-ldp]quit
[R4-ASBR]interface GigabitEthernet 0/0/1
[R4-ASBR-GigabitEthernet0/0/1]mpls
[R4-ASBR-GigabitEthernet0/0/1]mpls ldp

## R7-PE启用MPLS和LDP
[R7-PE]mpls lsr-id 7.7.7.7
[R7-PE]mpls
Info: Mpls starting, please wait... OK!
[R7-PE-mpls]mpls ldp
[R7-PE-mpls-ldp]quit
[R7-PE]interface GigabitEthernet 0/0/0
[R7-PE-GigabitEthernet0/0/0]mpls
[R7-PE-GigabitEthernet0/0/0]mpls ldp

## R6-P启用MPLS和LDP
[R6-P]mpls lsr-id 6.6.6.6
[R6-P]mpls
Info: Mpls starting, please wait... OK!
[R6-P-mpls]mpls ldp
[R6-P-mpls-ldp]quit
[R6-P]interface GigabitEthernet 0/0/0
[R6-P-GigabitEthernet0/0/0]mpls
[R6-P-GigabitEthernet0/0/0]mpls ldp
[R6-P-GigabitEthernet0/0/0]quit
[R6-P]interface GigabitEthernet 0/0/1
[R6-P-GigabitEthernet0/0/1]mpls
[R6-P-GigabitEthernet0/0/1]mpls ldp

## ASBR2启用MPLS和LDP
[R5-ASBR]mpls lsr-id 5.5.5.5
[R5-ASBR]mpls
Info: Mpls starting, please wait... OK!
[R5-ASBR-mpls]mpls ldp
[R5-ASBR-mpls-ldp]quit
[R5-ASBR]interface GigabitEthernet 0/0/1
[R5-ASBR-GigabitEthernet0/0/1]mpls
[R5-ASBR-GigabitEthernet0/0/1]mpls ldp

查看LSP

<R3-P>display mpls lsp
-------------------------------------------------------------------------------
                 LSP Information: LDP LSP
-------------------------------------------------------------------------------
FEC                In/Out Label  In/Out IF                      Vrf Name       
2.2.2.2/32         NULL/3        -/GE0/0/0                                     
2.2.2.2/32         1024/3        -/GE0/0/0                                     
3.3.3.3/32         3/NULL        -/-                                           
4.4.4.4/32         NULL/3        -/GE0/0/1                                     
4.4.4.4/32         1025/3        -/GE0/0/1<P1>display mpls lsp


<R6-P>display mpls lsp
-------------------------------------------------------------------------------
                 LSP Information: LDP LSP
-------------------------------------------------------------------------------
FEC                In/Out Label  In/Out IF                      Vrf Name       
6.6.6.6/32         3/NULL        -/-                                           
7.7.7.7/32         NULL/3        -/GE0/0/0                                     
7.7.7.7/32         1024/3        -/GE0/0/0                                     
5.5.5.5/32         NULL/3        -/GE0/0/1                                     
5.5.5.5/32         1025/3        -/GE0/0/1

4.骨干域MP-IBGP配置

在R2-PE和R4-ASBR之间配置IBGP

## R2-PE上配置
[R2-PE]bgp 100
[R2-PE-bgp]peer 4.4.4.4 as-number 100
[R2-PE-bgp]peer 4.4.4.4 connect-interface LoopBack 0
[R2-PE-bgp]ipv4-family vpnv4
[R2-PE-bgp-af-vpnv4]policy vpn-target
[R2-PE-bgp-af-vpnv4]peer 4.4.4.4 enable

## R4-ASBR上配置
[R4-ASBR]bgp 100
[R4-ASBR-bgp]peer 2.2.2.2 as-number 100
[R4-ASBR-bgp]peer 2.2.2.2 connect-interface LoopBack 0
[R4-PE-bgp]ipv4-family vpnv4
[R4-PE-bgp-af-vpnv4]policy vpn-target
[R4-PE-bgp-af-vpnv4]peer 2.2.2.2 enable

同样在R7-PE和R5-ASBR之间配置IBGP

## R7-PE上配置
[R7-PE]bgp 200
[R7-PE-bgp]peer 5.5.5.5 as-number 200
[R7-PE-bgp]peer 5.5.5.5 connect-interface LoopBack 0
[R7-PE-bgp]ipv4-family vpnv4
[R7-PE-bgp-af-vpnv4]policy vpn-target
[R7-PE-bgp-af-vpnv4]peer 5.5.5.5 enable
## R5-ASBR上配置
[R5-ASBR]bgp 200
[R5-ASBR-bgp]peer 7.7.7.7 as-number 200
[R5-ASBR-bgp]peer 7.7.7.7 connect-interface LoopBack 0
[R5-PE-bgp]ipv4-family vpnv4
[R5-PE-bgp-af-vpnv4]policy vpn-target
[R5-PE-bgp-af-vpnv4]peer 7.7.7.7 enable

5.PE上VPN实例配置

(1) 分公司配置

同一AS内的ASBR-PE与PE的VPN实例的VPN-Target应能匹配，不同AS的PE的VPN实例的VPN-Target则不需要匹配。
R7-PE上创建VPN实例vpn2和vpn3，将R8-CE和R9-CE分别接入到R7-PE上

## 创建vpn实例，名称为vpn2
[R7-PE]ip vpn-instance vpn2
## 使用ipv地址
[R7-PE-vpn-instance-vpn2]ipv4-family
## RD设置为100:2
[R7-PE-vpn-instance-vpn2-af-ipv4]route-distinguisher 100:2
## 设置vpn-target
[R7-PE-vpn-instance-vpn2-af-ipv4]vpn-target 2:2 export-extcommunity 
 EVT Assignment result: 
Info: VPN-Target assignment is successful.
[R7-PE-vpn-instance-vpn2-af-ipv4]vpn-target 4:4 import-extcommunity 
 IVT Assignment result: 
Info: VPN-Target assignment is successful.
[R7-PE-vpn-instance-vpn2-af-ipv4]quit
[R7-PE-vpn-instance-vpn2]quit
## 创建vpn实例，名称为vpn3
[R7-PE]ip vpn-instance vpn3
[R7-PE-vpn-instance-vpn3]ipv4-family
[R7-PE-vpn-instance-vpn3-af-ipv4]route-distinguisher 100:3
[R7-PE-vpn-instance-vpn3-af-ipv4]vpn-target 3:3 export-extcommunity 
 EVT Assignment result: 
Info: VPN-Target assignment is successful.
[R7-PE-vpn-instance-vpn3-af-ipv4]vpn-target 4:4 import-extcommunity 
 IVT Assignment result: 
Info: VPN-Target assignment is successful.

将vpn2的实例绑定到GigabitEthernet 0/0/1上，vpn3实例绑定到GigabitEthernet 0/0/2上
绑定后需要重新配置IP

[R7-PE]interface GigabitEthernet 0/0/1
[R7-PE-GigabitEthernet0/0/1]ip binding vpn-instance vpn2
Info: All IPv4 related configurations on this interface are removed!
Info: All IPv6 related configurations on this interface are removed!
[R7-PE-GigabitEthernet0/0/1]ip address 192.168.2.1 30
[R7-PE-GigabitEthernet0/0/1]display this
#
interface GigabitEthernet0/0/1
 ip binding vpn-instance vpn2
 ip address 192.168.2.1 255.255.255.252
#
return
[R7-PE-GigabitEthernet0/0/1]quit
[R7-PE]interface GigabitEthernet 0/0/2
[R7-PE-GigabitEthernet0/0/2]ip binding vpn-instance vpn3
Info: All IPv4 related configurations on this interface are removed!
Info: All IPv6 related configurations on this interface are removed!
[R7-PE-GigabitEthernet0/0/2]ip address 192.168.3.1 30
[R7-PE-GigabitEthernet0/0/2]display this
#
interface GigabitEthernet0/0/2
 ip binding vpn-instance vpn3
 ip address 192.168.3.1 255.255.255.252
#
return

配置R7-PE和R8-CE、R9-CE的BGP邻居及路由

## R7-PE上配置BGP，分别在vpn2和vpn3中配置到R8-CE和R9-CE的BGP邻居，并下发缺省路由
[R7-PE]bgp 200
[R7-PE-bgp]ipv4-family vpn-instance vpn2
[R7-PE-bgp-vpn2]peer 192.168.2.2 as-number 10002
[R7-PE-bgp-vpn2]network 0.0.0.0 0.0.0.0
[R7-PE-bgp-vpn2]quit
[R7-PE-bgp]ipv4-family vpn-instance vpn3
[R7-PE-bgp-vpn3]peer 192.168.3.2 as-number 10003
[R7-PE-bgp-vpn3]network 0.0.0.0 0.0.0.0
[R7-PE-bgp-vpn3]quit
[R7-PE-bgp]quit
## R7-PE上配置黑洞路由，以使BGP发布路由生效
[R7-PE]ip route-static vpn-instance vpn2 0.0.0.0 0.0.0.0 NULL0 preference 255
[R7-PE]ip route-static vpn-instance vpn3 0.0.0.0 0.0.0.0 NULL0 preference 255

## R8-CE上配置BGP
[R8-CE]bgp 10002
[R8-CE-bgp]peer 192.168.2.1 as-number 200
[R8-CE-bgp]network 10.0.2.0 255.255.255.0
## R9-CE上配置BGP
[R9-CE]bgp 10003
[R9-CE-bgp]peer 192.168.3.1 as-number 200
[R9-CE-bgp]network 10.0.3.0 255.255.255.0

在R8-CE和R9-CE上查看BGP收发路由情况

<R8-CE>display bgp routing-table peer 192.168.2.1 advertised-routes 

 BGP Local router ID is 8.8.8.8 
 Status codes: * - valid, > - best, d - damped,
               h - history,  i - internal, s - suppressed, S - Stale
               Origin : i - IGP, e - EGP, ? - incomplete


 Total Number of Routes: 1
      Network            NextHop        MED        LocPrf    PrefVal Path/Ogn

 *>   10.0.2.0/24        192.168.2.2     0                     0      10002i
<R8-CE>display bgp routing-table peer 192.168.2.1 received-routes 

 BGP Local router ID is 8.8.8.8 
 Status codes: * - valid, > - best, d - damped,
               h - history,  i - internal, s - suppressed, S - Stale
               Origin : i - IGP, e - EGP, ? - incomplete


 Total Number of Routes: 1
      Network            NextHop        MED        LocPrf    PrefVal Path/Ogn

 *>   0.0.0.0            192.168.2.1     0                     0      200i


<R9-CE>display bgp routing-table peer 192.168.3.1 advertised-routes 

 BGP Local router ID is 9.9.9.9 
 Status codes: * - valid, > - best, d - damped,
               h - history,  i - internal, s - suppressed, S - Stale
               Origin : i - IGP, e - EGP, ? - incomplete


 Total Number of Routes: 1
      Network            NextHop        MED        LocPrf    PrefVal Path/Ogn

 *>   10.0.3.0/24        192.168.3.2     0                     0      10003i
<R9-CE>display bgp routing-table peer 192.168.3.1 received-routes 

 BGP Local router ID is 9.9.9.9 
 Status codes: * - valid, > - best, d - damped,
               h - history,  i - internal, s - suppressed, S - Stale
               Origin : i - IGP, e - EGP, ? - incomplete


 Total Number of Routes: 1
      Network            NextHop        MED        LocPrf    PrefVal Path/Ogn

 *>   0.0.0.0            192.168.3.1     0                     0      200i

在R7-PE上对两段业务地址进行PING测试

<R7-PE>ping -vpn-instance vpn2 10.0.2.1
  PING 10.0.2.1: 56  data bytes, press CTRL_C to break
    Reply from 10.0.2.1: bytes=56 Sequence=1 ttl=127 time=100 ms
    Reply from 10.0.2.1: bytes=56 Sequence=2 ttl=127 time=70 ms
    Reply from 10.0.2.1: bytes=56 Sequence=3 ttl=127 time=80 ms
    Reply from 10.0.2.1: bytes=56 Sequence=4 ttl=127 time=40 ms
    Reply from 10.0.2.1: bytes=56 Sequence=5 ttl=127 time=60 ms

  --- 10.0.2.1 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 40/70/100 ms

<R7-PE>ping -vpn-instance vpn3 10.0.3.1
  PING 10.0.3.1: 56  data bytes, press CTRL_C to break
    Reply from 10.0.3.1: bytes=56 Sequence=1 ttl=127 time=50 ms
    Reply from 10.0.3.1: bytes=56 Sequence=2 ttl=127 time=80 ms
    Reply from 10.0.3.1: bytes=56 Sequence=3 ttl=127 time=70 ms
    Reply from 10.0.3.1: bytes=56 Sequence=4 ttl=127 time=50 ms
    Reply from 10.0.3.1: bytes=56 Sequence=5 ttl=127 time=130 ms

  --- 10.0.3.1 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 50/76/130 ms

(2) 总公司配置

R2-PE上创建VPN实例vpn1，将R1-CE接入到R2-PE上

[R2-PE]ip vpn-instance vpn1
[R2-PE-vpn-instance-vpn1]ipv4-family
[R2-PE-vpn-instance-vpn1-af-ipv4]route-distinguisher 100:1
[R2-PE-vpn-instance-vpn1-af-ipv4]vpn-target 1:1 export-extcommunity 
 EVT Assignment result: 
Info: VPN-Target assignment is successful.
[R2-PE-vpn-instance-vpn1-af-ipv4]vpn-target 1:1 import-extcommunity 
 IVT Assignment result: 
Info: VPN-Target assignment is successful.

将vpn1的实例绑定到GigabitEthernet 0/0/1上

[R2-PE]interface GigabitEthernet 0/0/1
[R2-PE-GigabitEthernet0/0/1]ip binding vpn-instance vpn1
Info: All IPv4 related configurations on this interface are removed!
Info: All IPv6 related configurations on this interface are removed!
[R2-PE-GigabitEthernet0/0/1]ip address 192.168.1.1 30
[R2-PE-GigabitEthernet0/0/1]display this
#
interface GigabitEthernet0/0/1
 ip binding vpn-instance vpn1
 ip address 192.168.1.1 255.255.255.252
#
return

配置R2-PE和R1-CE的BGP邻居及路由

## R2-PE上配置BGP，在vpn1中配置到R1-CE的BGP邻居，并下发缺省路由
[R2-PE]bgp 100
[R2-PE-bgp]ipv4-family vpn-instance vpn1
[R2-PE-bgp-vpn1]peer 192.168.1.2 as-number 10001
[R2-PE-bgp-vpn1]network 0.0.0.0 0.0.0.0

## R2-PE上配置黑洞路由，以使BGP发布路由生效
[R2-PE]ip route-static vpn-instance vpn1 0.0.0.0 0.0.0.0 NULL 0 preference 255

## R1-CE上配置BGP
[R1-CE]bgp 10001
[R1-CE-bgp]peer 192.168.1.1 as-number 100
[R1-CE-bgp]network 10.0.1.0 255.255.255.0

在R1-CE上查看BGP收发路由情况

<R1-CE>display bgp routing-table peer 192.168.1.1 advertised-routes 

 BGP Local router ID is 1.1.1.1 
 Status codes: * - valid, > - best, d - damped,
               h - history,  i - internal, s - suppressed, S - Stale
               Origin : i - IGP, e - EGP, ? - incomplete


 Total Number of Routes: 1
      Network            NextHop        MED        LocPrf    PrefVal Path/Ogn

 *>   10.0.1.0/24        192.168.1.2     0                     0      10001i
<R1-CE>display bgp routing-table peer 192.168.1.1 received-routes 

 BGP Local router ID is 1.1.1.1 
 Status codes: * - valid, > - best, d - damped,
               h - history,  i - internal, s - suppressed, S - Stale
               Origin : i - IGP, e - EGP, ? - incomplete


 Total Number of Routes: 1
      Network            NextHop        MED        LocPrf    PrefVal Path/Ogn

 *>   0.0.0.0            192.168.1.1     0                     0      100i

在R2-PE上对业务地址进行PING测试

<R2-PE>ping -vpn-instance vpn1 10.0.1.1
  PING 10.0.1.1: 56  data bytes, press CTRL_C to break
    Reply from 10.0.1.1: bytes=56 Sequence=1 ttl=127 time=60 ms
    Reply from 10.0.1.1: bytes=56 Sequence=2 ttl=127 time=60 ms
    Reply from 10.0.1.1: bytes=56 Sequence=3 ttl=127 time=40 ms
    Reply from 10.0.1.1: bytes=56 Sequence=4 ttl=127 time=60 ms
    Reply from 10.0.1.1: bytes=56 Sequence=5 ttl=127 time=100 ms

  --- 10.0.1.1 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 40/64/100 ms

6.跨域VPN配置

ASBR之间设置VRF来进行RT值的过滤，选择合适的RT值来完成需求
配置R4-ASBR和R5-ASBR之间的EBGP邻居

## R4-ASBR的vpn实例配置
[R4-ASBR]ip vpn-instance vpn4
[R4-ASBR-vpn-instance-vpn4]route-distinguisher 100:4
[R4-ASBR-vpn-instance-vpn4-af-ipv4]vpn-target 1:1 export-extcommunity 
 EVT Assignment result: 
Info: VPN-Target assignment is successful.
[R4-ASBR-vpn-instance-vpn4-af-ipv4]vpn-target 1:1 import-extcommunity 
 IVT Assignment result: 
Info: VPN-Target assignment is successful.
[R4-ASBR-vpn-instance-vpn4-af-ipv4]quit
[R4-ASBR-vpn-instance-vpn4]quit

## R4-ASBR的BGP配置
[R4-ASBR]bgp 100
[R4-ASBR-bgp]ipv4-family vpn-instance vpn4
[R4-ASBR-bgp-vpn4]peer 211.137.45.5 as-number 200

## R4-ASBR将VPN实例绑定至接口上
[R4-ASBR]interface GigabitEthernet 0/0/2
[R4-ASBR-GigabitEthernet0/0/2]ip binding vpn-instance vpn4
Info: All IPv4 related configurations on this interface are removed!
Info: All IPv6 related configurations on this interface are removed!
[R4-ASBR-GigabitEthernet0/0/2]ip address 211.137.45.4 24

## R5-ASBR的vpn实例配置
[R5-ASBR]ip vpn-instance vpn5
[R5-ASBR-vpn-instance-vpn5]route-distinguisher 100:5
[R5-ASBR-vpn-instance-vpn5-af-ipv4]vpn-target 4:4 export-extcommunity 
 EVT Assignment result: 
Info: VPN-Target assignment is successful.
[R5-ASBR-vpn-instance-vpn5-af-ipv4]vpn-target 2:2 3:3 import-extcommunity 
 IVT Assignment result: 
Info: VPN-Target assignment is successful.
[R5-ASBR-vpn-instance-vpn5-af-ipv4]quit
[R5-ASBR-vpn-instance-vpn5]quit

## R5-ASBR的BGP配置
[R5-ASBR]bgp 200
[R5-ASBR-bgp]ipv4-family vpn-instance vpn5
[R5-ASBR-bgp-vpn5]peer 211.137.45.4 as-number 100

## R5-ASBR将VPN实例绑定至接口上
[R5-ASBR]interface GigabitEthernet 0/0/2
[R5-ASBR-GigabitEthernet0/0/2]ip binding vpn-instance vpn5
Info: All IPv4 related configurations on this interface are removed!
Info: All IPv6 related configurations on this interface are removed!
[R5-ASBR-GigabitEthernet0/0/2]ip address 211.137.45.5 24

7.测试

在客户端上分别进行测试，总部PC1可以连通分公司PC2和PC3，但是分公司之间PC2和PC3无法互通

## 总部PC1测试结果
PC>ping 10.0.2.1

Ping 10.0.2.1: 32 data bytes, Press Ctrl_C to break
From 10.0.2.1: bytes=32 seq=1 ttl=122 time=328 ms
From 10.0.2.1: bytes=32 seq=2 ttl=122 time=297 ms
From 10.0.2.1: bytes=32 seq=3 ttl=122 time=297 ms
From 10.0.2.1: bytes=32 seq=4 ttl=122 time=406 ms
From 10.0.2.1: bytes=32 seq=5 ttl=122 time=375 ms

--- 10.0.2.1 ping statistics ---
  5 packet(s) transmitted
  5 packet(s) received
  0.00% packet loss
  round-trip min/avg/max = 297/340/406 ms

PC>ping 10.0.3.1

Ping 10.0.3.1: 32 data bytes, Press Ctrl_C to break
From 10.0.3.1: bytes=32 seq=1 ttl=122 time=328 ms
From 10.0.3.1: bytes=32 seq=2 ttl=122 time=344 ms
From 10.0.3.1: bytes=32 seq=3 ttl=122 time=250 ms
From 10.0.3.1: bytes=32 seq=4 ttl=122 time=313 ms
From 10.0.3.1: bytes=32 seq=5 ttl=122 time=250 ms

--- 10.0.3.1 ping statistics ---
  5 packet(s) transmitted
  5 packet(s) received
  0.00% packet loss
  round-trip min/avg/max = 250/297/344 ms

## 分公司PC2测试结果
PC>ping 10.0.1.1

Ping 10.0.1.1: 32 data bytes, Press Ctrl_C to break
From 10.0.1.1: bytes=32 seq=1 ttl=122 time=391 ms
From 10.0.1.1: bytes=32 seq=2 ttl=122 time=359 ms
From 10.0.1.1: bytes=32 seq=3 ttl=122 time=406 ms
From 10.0.1.1: bytes=32 seq=4 ttl=122 time=234 ms
From 10.0.1.1: bytes=32 seq=5 ttl=122 time=297 ms

--- 10.0.1.1 ping statistics ---
  5 packet(s) transmitted
  5 packet(s) received
  0.00% packet loss
  round-trip min/avg/max = 234/337/406 ms

PC>ping 10.0.3.1

Ping 10.0.3.1: 32 data bytes, Press Ctrl_C to break
Request timeout!
Request timeout!
Request timeout!
Request timeout!
Request timeout!

--- 10.0.3.1 ping statistics ---
  5 packet(s) transmitted
  0 packet(s) received
  100.00% packet loss

## 分公司PC3测试结果
PC>ping 10.0.1.1

Ping 10.0.1.1: 32 data bytes, Press Ctrl_C to break
From 10.0.1.1: bytes=32 seq=1 ttl=122 time=390 ms
From 10.0.1.1: bytes=32 seq=2 ttl=122 time=360 ms
From 10.0.1.1: bytes=32 seq=3 ttl=122 time=375 ms
From 10.0.1.1: bytes=32 seq=4 ttl=122 time=359 ms
From 10.0.1.1: bytes=32 seq=5 ttl=122 time=375 ms

--- 10.0.1.1 ping statistics ---
  5 packet(s) transmitted
  5 packet(s) received
  0.00% packet loss
  round-trip min/avg/max = 359/371/390 ms

PC>ping 10.0.2.1

Ping 10.0.2.1: 32 data bytes, Press Ctrl_C to break
Request timeout!
Request timeout!
Request timeout!
Request timeout!
Request timeout!

--- 10.0.2.1 ping statistics ---
  5 packet(s) transmitted
  0 packet(s) received
  100.00% packet loss

在PC1上ping测试PC2，并从各个接口上抓包分析标签变化
R1-R2：CE->PE，普通IPv4报文，无标签
image.png

R2-R3：PE-P，内层标签1030，为MP-BGP分配；外层标签1024，为LDP分配
image.png

R3-R4：P-ASBR，外层标签1024根据PHP弹出，因此仅剩内层标签1030
image.png

R4-R5：ASBR-ASBR，普通IPv4报文，无标签
image.png

R5-R6：ASBR-P，内层标签1028，为MP-BGP分配；外层标签1024，为LDP分配
image.png

R6-R7：P-PE，外层标签1024根据PHP弹出，仅剩内层标签1028
image.png

R7-R8：PE-CE，普通IPv4报文，内层标签1028也弹出
image.png

文章标签：
VPN网关
网络虚拟化
网络协议
PHP
Python
网络架构
这啥名啊
目录
相关文章
Jack20
|
网络协议 安全 网络安全
路由与交换系列之GRE VPN 技术原理笔记分享
GRE VPN 技术原理笔记分享
Jack20
1137 0
刘俊辉个人博客
|
6月前
|
网络虚拟化
配置BGP/MPLS IP VPN示例
配置BGP/MPLS IP VPN示例
刘俊辉个人博客
148 0
rubia--
|
网络协议
BGP的基础配置
BGP的基础配置
rubia--
115 0
这啥名啊
|
6月前
|
网络协议 PHP 网络虚拟化
BGP MPLS VPN（OPTION C）实验笔记
BGP MPLS VPN（OPTION C）实验笔记
这啥名啊
165 1
这啥名啊
|
6月前
|
网络协议 PHP 网络虚拟化
BGP MPLS VPN（OPTION B）实验笔记
BGP MPLS VPN（OPTION B）实验笔记
这啥名啊
143 0
BGP MPLS VPN（OPTION B）实验笔记
学校暗杀-11881
|
安全 网络安全 网络虚拟化
GRE和IPsec搭配使用，到底是谁over谁？先看GRE over IPsec
GRE和IPsec搭配使用，到底是谁over谁？先看GRE over IPsec
学校暗杀-11881
600 0
GRE和IPsec搭配使用，到底是谁over谁？先看GRE over IPsec
释然IT杂谈1
|
网络虚拟化
MPLS VPN案例
MPLS VPN案例
释然IT杂谈1
343 0
MPLS VPN案例
Jack20
|
网络协议 安全 网络安全
路由与交换系列之 GRE VPN 技术原理笔记分享
GRE VPN 技术原理笔记分享
Jack20
1053 0
科技小先锋
|
网络协议
OSPF的六大网络类型和帧中继--CCNP学习笔记
科技小先锋
1236 0
余二五
|
网络虚拟化
CCNA实验之---三层交换机实现VLAN间路由
余二五
1301 0