跨域MPLS 虛擬私有網絡的Option 2 解決方案全實戰

阿新 • • 發佈：2018-07-23

cast group 網絡 png iss 實戰 ipa 過多生成

跨域MPLS ×××的Option 2 解決方案實戰
技術分享圖片

讀者如果要完成Option2的實施，可以在Option1的基礎上完成，也可以在構建完畢兩個AS內部的MPLS ×××之後來實施。
Option2和Option1的區別在於在ASBR上不在需要VRF的實施，而直接通過直連路由在ASBR之間構建MP-EBGP的×××V4鄰居關系，即通過BGP更新兩側AS的客戶路由；同時在ASBR之間為標簽轉發，而不在是IP轉發
8.2.1 Option2中ASBR之間構建×××v4的EBGP鄰居
請讀者自行去掉ASBR上的VRF配置（直連接口需要重新配置全局的IPv4地址）。

R4-ASBR#
R4-ASBR(config)#int g3
R4-ASBR(config-if)#no vrf for QYT
% Interface GigabitEthernet3 IPv4 disabled and address(es) removed due to enabling VRF QYT
R4-ASBR(config-if)#ip address 24.1.1.4 255.255.255.0
R4-ASBR(config-if)#do ping 24.1.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 24.1.1.2, timeout is 2 seconds:
.!!!!
interface GigabitEthernet3
 ip address 24.1.1.4 255.255.255.0
RP/0/0/CPU0:ASBR-R2#sh run interface gigabitEthernet 0/0/0/1
Fri Jun 24 06:46:45.453 UTC
interface GigabitEthernet0/0/0/1
 ipv4 address 24.1.1.2 255.255.255.0
我們來完成ASBR上的×××V4的EBGP鄰居：
ASBR-R2：
router bgp 100
 address-family ***v4 unicast
  !
 neighbor 11.1.1.1
  remote-as 100
  update-source Loopback0
  address-family ***v4 unicast //和PE之間的×××v4的iBGP鄰居關系，用於更新×××v4的路由
   next-hop-self //不要忘記針對iBGP鄰居關系做下一跳自我，因為×××v4的路由從AS200接收之後會保留下一跳為24.1.1.4，此時下一跳不可達，會造成×××v4路由不優化
  !
 !
 neighbor 24.1.1.4
  remote-as 200
  address-family ***v4 unicast //和AS200構建×××v4的eBGP鄰居，在XR上的EBGP上需要通過RPL放行路由
   route-policy EBGP in
   route-policy EBGP out
!
route-policy EBGP
  pass
end-policy
！
ASBR-R4：
router bgp 200
 bgp log-neighbor-changes
 no bgp default ipv4-unicast
 neighbor 24.1.1.2 remote-as 100
 neighbor 66.1.1.1 remote-as 200
 neighbor 66.1.1.1 update-source Loopback0
 !
 address-family ipv4
 exit-address-family
 !
 address-family ***v4
  neighbor 24.1.1.2 activate //IOS上針對鄰居建立×××v4的EBGP鄰居
  neighbor 24.1.1.2 send-community extended
  neighbor 66.1.1.1 activate
  neighbor 66.1.1.1 send-community extended
  neighbor 66.1.1.1 next-hop-self //針對×××V4的iBGP鄰居修改下一跳自我使得×××v4路由最優
驗證ASBR上的×××v4鄰居關系：
R4-ASBR#show bgp ***v4 unicast all summary 
BGP router identifier 44.1.1.1, local AS number 200
BGP table version is 5, main routing table version 5
4 network entries using 1024 bytes of memory
4 path entries using 480 bytes of memory
4/4 BGP path/bestpath attribute entries using 1088 bytes of memory
1 BGP AS-PATH entries using 24 bytes of memory
3 BGP extended community entries using 180 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
BGP using 2796 total bytes of memory
BGP activity 4/0 prefixes, 4/0 paths, scan interval 60 secs

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
24.1.1.2        4          100    1018    1123        5    0    0 16:53:51        0
66.1.1.1        4          200    1130    1125        5    0    0 16:56:44        0

在IOS上當建立×××v4的eBGP之後會自動發生如下的一些變化：
1.會產生一條對端直連接口的32位主機路由
2.直連接口下會自動生成一條命令： mpls bgp forwarding，BGP去分配標簽
3.生成對端直連地址的32位直連地址的pop標簽
我們在IOS上驗證如上3點：
R4-ASBR#show ip route connected
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP

a - application route

- replicated route, % - next hop override, p - overrides from PfR

Gateway of last resort is 10.255.0.1 to network 0.0.0.0

  10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks

C 10.255.0.0/16 is directly connected, GigabitEthernet1
L 10.255.1.42/32 is directly connected, GigabitEthernet1
24.0.0.0/8 is variably subnetted, 3 subnets, 2 masks
C 24.1.1.0/24 is directly connected, GigabitEthernet3
C 24.1.1.2/32 is directly connected, GigabitEthernet3
L 24.1.1.4/32 is directly connected, GigabitEthernet3
44.0.0.0/32 is subnetted, 1 subnets
C 44.1.1.1 is directly connected, Loopback0
45.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C 45.1.1.0/24 is directly connected, GigabitEthernet2
L 45.1.1.4/32 is directly connected, GigabitEthernet2
R4-ASBR#sh run int g3
Building configuration...

Current configuration : 108 bytes
!
interface GigabitEthernet3
ip address 24.1.1.4 255.255.255.0
negotiation auto
mpls bgp forwarding
R4-ASBR#show mpls forwarding-table 24.1.1.2
Local Outgoing Prefix Bytes Label Outgoing Next Hop
Label Label or Tunnel Id Switched interface
405 Pop Label 24.1.1.2/32 0 Gi3 24.1.1.2
需要註意的是在IOS XR上並不會自動完成上述三點，我們需要額外的配置
8.2.2 解決ASBR收取×××v4路由問題
既然Option2的解決方案已經不再實施VRF，那如何來收取×××v4的路由呢？按照之前的知識點需要VRF的RT匹配才可以。對BGP，默認情況下開啟了針對RT的過濾，在Option2中可以和關閉默認的對RT的過濾來收取所有×××v4的路由，當然這也會造成ASBR收取的×××v4路由過多，容易成為單點故障點

ASBR-R2：
router bgp 100
 address-family ***v4 unicast
  retain route-target all //IOS XR上收取所有的×××v4的命令開關
R4-ASBR#
router bgp 200
 bgp log-neighbor-changes
 no bgp default ipv4-unicast
 no bgp default route-target filter //關閉默認的針對RT的過濾
查看ASBR收到的×××v4路由：
RP/0/0/CPU0:ASBR-R2#show bgp ***v4 unicast  //收取了所有的×××v4的路由   
Fri Jun 24 07:06:22.373 UTC
BGP router identifier 22.1.1.1, local AS number 100
BGP generic scan interval 60 secs
Non-stop routing is enabled
BGP table state: Active
Table ID: 0x0   RD version: 0
BGP main routing table version 9
BGP NSR Initial initsync version 5 (Reached)
BGP NSR/ISSU Sync-Group versions 0/0
BGP scan interval 60 secs

Status codes: s suppressed, d damped, h history, * valid, > best
              i - internal, r RIB-failure, S stale, N Nexthop-discard
Origin codes: i - IGP, e - EGP, ? - incomplete
   Network            Next Hop            Metric LocPrf Weight Path
Route Distinguisher: 100:18
*>i18.1.1.0/24        11.1.1.1                 0    100      0 ?
*>i88.1.1.1/32        11.1.1.1                 2    100      0 ?
Route Distinguisher: 200:67
*> 67.1.1.0/24        24.1.1.4                               0 200 ?
*> 77.1.1.1/32        24.1.1.4                               0 200 ?

R4-ASBR#show bgp ***v4 unicast all
BGP table version is 5, local router ID is 44.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found

 Network          Next Hop            Metric LocPrf Weight Path

Route Distinguisher: 100:18
> 18.1.1.0/24 24.1.1.2 0 100 ?
> 88.1.1.1/32 24.1.1.2 0 100 ?
Route Distinguisher: 200:67
>i 67.1.1.0/24 66.1.1.1 0 100 0 ?
>i 77.1.1.1/32 66.1.1.1 2 100 0 ?
8.2.3 PE設備收取×××v4路由
在Option1中，兩個AS的VRF的RT屬性可以不匹配，但是在Option2中PE設備（XR1和R6）VRF的RT必須匹配，否則PE設備無法收取×××v4的路由

XR1：
vrf QYT
 address-family ipv4 unicast
  import route-target
   64512:78
  !
  export route-target
   64512:78
R6-PE：
vrf definition QYT
 rd 200:67
 !
 address-family ipv4
  route-target export 64512:78
  route-target import 64512:7
```8
查看PE設備上×××v4的路由情況：
PE-R6#show ip bgp ***v4 all 
BGP table version is 91, local router ID is 66.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, 
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, 
              x best-external, a additional-path, c RIB-compressed, 
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found

     Network          Next Hop            Metric LocPrf Weight Path
Route Distinguisher: 100:18
 *>i 18.1.1.0/24      44.1.1.1                 0    100      0 100 ?
 *>i 88.1.1.1/32      44.1.1.1                 0    100      0 100 ?
Route Distinguisher: 200:67 (default for vrf QYT)
 *>i 18.1.1.0/24      44.1.1.1                 0    100      0 100 ?
 *>  67.1.1.0/24      0.0.0.0                  0         32768 ?
 *>  77.1.1.1/32      67.1.1.7                 2         32768 ?
 *>i 88.1.1.1/32      44.1.1.1                 0    100      0 100 ?
RP/0/0/CPU0:PE-XR1#show bgp ***v4 unicast //PE設備收取了所有×××v4的路由，而且是最優的，優化與否至關重要，PE設備路由優化是因為在ASBR上針對PE做了下一跳自我命令
Fri Jun 24 07:21:38.223 UTC
BGP router identifier 11.1.1.1, local AS number 100
BGP generic scan interval 60 secs
Non-stop routing is enabled
BGP table state: Active
Table ID: 0x0   RD version: 0
BGP main routing table version 79
BGP NSR Initial initsync version 1 (Reached)
BGP NSR/ISSU Sync-Group versions 0/0
BGP scan interval 60 secs

Status codes: s suppressed, d damped, h history, * valid, > best
              i - internal, r RIB-failure, S stale, N Nexthop-discard
Origin codes: i - IGP, e - EGP, ? - incomplete
   Network            Next Hop            Metric LocPrf Weight Path
Route Distinguisher: 100:18 (default for vrf QYT)
*> 18.1.1.0/24        0.0.0.0                  0         32768 ?
*>i67.1.1.0/24        22.1.1.1                      100      0 200 ?
*>i77.1.1.1/32        22.1.1.1                      100      0 200 ?
*> 88.1.1.1/32        18.1.1.8                 2         32768 ?
Route Distinguisher: 200:67
*>i67.1.1.0/24        22.1.1.1                      100      0 200 ?
*>i77.1.1.1/32        22.1.1.1                      100      0 200 ?
PE設備上的IGP和BGP的重分步不在贅述，僅僅給出配置，請讀者自行完成

router ospf 10
vrf QYT
domain-id type 0005 value 000000000100
redistribute bgp 100
address-family ipv4 unicast
area 0
interface GigabitEthernet0/0/0/3
router bgp 100
address-family ***v4 unicast
!
neighbor 22.1.1.1
remote-as 100
update-source Loopback0
address-family ***v4 unicast
!
!
vrf QYT
rd 100:18
address-family ipv4 unicast
redistribute ospf 10 match internal external


此時客戶端可以正常的收取到路由：
CE-R7#show ip route ospf
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR

Gateway of last resort is not set

      18.0.0.0/24 is subnetted, 1 subnets
O IA     18.1.1.0 [110/2] via 67.1.1.6, 00:45:32, GigabitEthernet0/1
      88.0.0.0/32 is subnetted, 1 subnets
O IA     88.1.1.1 [110/2] via 67.1.1.6, 00:45:32, GigabitEthernet0/1
8.2.4 解決ASBR為IOS XR的標簽分發問題
在IOS XR的ASBR上需要手工創建一條去往對端ASBR直連接口的32位主機路由，而且不能接下一跳只能跟出接口
router static
 address-family ipv4 unicast
  24.1.1.4/32 GigabitEthernet0/0/0/1
RP/0/0/CPU0:ASBR-R2#show route static 
Fri Jun 24 09:00:49.082 UTC

S    24.1.1.4/32 is directly connected, 19:00:42, GigabitEthernet0/0/0/1
RP/0/0/CPU0:ASBR-R2#show mpls forwarding 
Fri Jun 24 09:01:20.680 UTC
Local  Outgoing    Prefix             Outgoing     Next Hop        Bytes       
Label  Label       or ID              Interface                    Switched    
------ ----------- ------------------ ------------ --------------- ------------
24000  17          11.1.1.1/32        Gi0/0/0/0    23.1.1.3        123841      
24001  Pop         33.1.1.1/32        Gi0/0/0/0    23.1.1.3        127575      
24002  Pop         13.1.1.0/24        Gi0/0/0/0    23.1.1.3        480         
24003  Pop         24.1.1.4/32        Gi0/0/0/1    24.1.1.4        123640     //去往對端的直連地址的32位主機路由的標簽必須為Pop標簽
24004  24003       100:18:18.1.1.0/24              11.1.1.1        0           
24005  24004       100:18:88.1.1.1/32              11.1.1.1        2158        
24006  403         200:67:67.1.1.0/24 Gi0/0/0/1    24.1.1.4        0           //讀者可以在這裏清晰的看到去往67.1.1.0的×××V4的路由的標簽為403，去往77.1.1.1的標簽為404
24007  404         200:67:77.1.1.1/32 Gi0/0/0/1    24.1.1.4        6428
驗證數據報文的轉發,客戶的數據此時可以正常的通信，通過如下測試讀者也可以看到多層標簽的轉發情況：
CE-R8#traceroute 77.1.1.1 source loopback 0 numeric 
Type escape sequence to abort.
Tracing the route to 77.1.1.1
VRF info: (vrf in name/id, vrf out name/id)
  1 18.1.1.1 7 msec 4 msec 4 msec
  2 13.1.1.3 [MPLS: Labels 18/24007 Exp 0] 27 msec 29 msec 25 msec
  3 23.1.1.2 [MPLS: Label 24007 Exp 0] 27 msec 26 msec 27 msec
  4 24.1.1.4 [MPLS: Label 404 Exp 0] 30 msec 30 msec 27 msec
  5 45.1.1.5 [MPLS: Labels 16/21 Exp 0] 34 msec 33 msec 22 msec
  6 67.1.1.6 [MPLS: Label 21 Exp 0] 22 msec 34 msec 20 msec
  7 67.1.1.7 32 msec *  43 msec

跨域MPLS 虛擬私有網絡的Option 2 解決方案全實戰

cast group 網絡 png iss 實戰 ipa 過多生成跨域MPLS ×××的Option 2 解決方案實戰讀者如果要完成Option2的實施，可以在Option1的基礎上完成，也可以在構建完畢兩個AS內部的MPLS ×××之後來實施。Option2和Opt

跨域MPLS 虛擬私有網絡的Option 2 解決方案全實戰

跨域MPLS 虛擬私有網絡的Option 2 解決方案全實戰

在華為設備上實戰站點到站點的虛擬私有網絡

實戰華為動態智能虛擬私有網絡，同時實現業務數據通信

vbox虛擬機和vm虛擬機虛擬機網絡不通的解決方法

虛擬機器centos7 識別不出網絡卡的解決方案

VMware虛擬機上網絡連接解決方案

APP輕鬆通過蘋果IPv6稽核——阿里雲網絡產品級解決方案

Debian 無線網絡切換問題解決方案

httpd-2.2項目(虛擬主機、用戶認證、私有網絡安全實現）

虛擬機網絡連接NAT模式，本地用Xshell連接

VM虛擬機網絡在Bridge模式下，本機不能連接SSH問題的解決

大學校園網之跨園區免登陸共享網絡

虛擬機網絡模式

VirtualBox虛擬機網絡設置（四種方式）

虛擬機網絡連接問題

DevOps之虛擬專用網絡VPN

VMware虛擬機網絡配置

VMWare虛擬機網絡連接模式

virtualbox中centos虛擬機網絡配置

centos虛擬機網絡配置--橋接模式

跨域MPLS 虛擬私有網絡的Option 2 解決方案全實戰

相關推薦