组网需求
某公司需要通过MPLS VPN实现总部和分支间的IPv6孤岛互通，同时需要隔离两种不同的业务。为节省开支，希望分支通过一台高性能CE设备接入PE。
如图1所示，按如下组网：
- CE1、CE2连接企业总部，CE1属于vpna，CE2属于vpnb
- MCE连接企业分支，通过CE3和CE4分别连接vpna和vpnb
要求属于相同VPN的用户之间能互相访问，但不同VPN的用户之间不能互相访问，从而实现不同业务间隔离。
图1 MCE IPv6示例组网图
配置思路
本例配置主要思路是：
- PE与PE间配置OSPF协议，实现PE之间的互通；配置MP-IBGP交换VPN路由信息。
- PE上配置MPLS基本能力和MPLS LDP，建立LDP LSP。
- PE和MCE上创建不同的VPN实例（vpna和vpnb），实现不同VPN间的业务隔离。
- PE1与相连的CE之间建立EBGP对等体，将私网路由信息引入到PE1的VPN路由表中。
- MCE与Site、MCE与PE2之间配置路由，将私网路由信息引入到PE2的VPN路由表中。
操作步骤
- 在骨干网的PE上配置OSPF协议，实现PE之间的互通
# 配置PE1。PE2的配置与PE1类似，不再赘述。
<Huawei> system-view [Huawei] sysname PE1 [PE1] ospf [PE1-ospf-1] area 0 [PE1-ospf-1-area-0.0.0.0] network 1.1.1.9 0.0.0.0 [PE1-ospf-1-area-0.0.0.0] network 172.1.1.0 0.0.0.255 [PE1-ospf-1-area-0.0.0.0] quit [PE1-ospf-1] quit
完成此步配置后，PE之间应能互相学习到对方的Loopback1的地址。
以PE2为例：
[PE2] display ip routing-table Route Flags: R - relay, D - download to fib ------------------------------------------------------------------------------ Routing Tables: Public Destinations : 9 Routes : 9 Destination/Mask Proto Pre Cost Flags NextHop Interface 1.1.1.9/32 OSPF 10 2 D 172.1.1.1 Vlanif30 2.2.2.9/32 Direct 0 0 D 127.0.0.1 LoopBack1 127.0.0.0/8 Direct 0 0 D 127.0.0.1 InLoopBack0 127.0.0.1/32 Direct 0 0 D 127.0.0.1 InLoopBack0 127.255.255.255/32 Direct 0 0 D 127.0.0.1 InLoopBack0 172.1.1.0/24 Direct 0 0 D 172.1.1.2 Vlanif30 172.1.1.2/32 Direct 0 0 D 172.1.1.1 Vlanif30 172.1.1.255/32 Direct 0 0 D 127.0.0.1 Vlanif30 255.255.255.255/32 Direct 0 0 D 127.0.0.1 InLoopBack0 - 在骨干网的PE上配置MPLS基本能力和MPLS LDP，PE之间建立LDP LSP # 配置PE1。PE2的配置与PE1类似，不再赘述。
[PE1] mpls lsr-id 1.1.1.9 [PE1] mpls [PE1-mpls] quit [PE1] mpls ldp [PE1-mpls-ldp] quit [PE1] interface vlanif 30 [PE1-Vlanif30] mpls [PE1-Vlanif30] mpls ldp [PE1-Vlanif30] quit
完成此步配置后，在PE上执行命令display mpls ldp session，应能看见PE之间的MPLS LDP会话状态为“Operational”。
以PE2为例：
[PE2] display mpls ldp session LDP Session(s) in Public Network Codes: LAM(Label Advertisement Mode), SsnAge Unit(DDDD:HH:MM) A '*' before a session means the session is being deleted. ------------------------------------------------------------------------------ Peer-ID Status LAM SsnRole SsnAge KA-Sent/Rcv ------------------------------------------------------------------------------ 1.1.1.9:0 Operational DU Active 0000:00:04 17/17 ------------------------------------------------------------------------------ TOTAL: 1 session(s) Found.
- 在PE设备上使能IPv6，配置VPN实例，将CE1、CE2接入PE1，将MCE接入PE2
# 配置PE1。
[PE1] ipv6 [PE1] vlan batch 10 20 [PE1] interface gigabitethernet 1/0/0 [PE1-GigabitEthernet1/0/0] port hybrid pvid vlan 10 [PE1-GigabitEthernet1/0/0] port hybrid untagged vlan 10 [PE1-GigabitEthernet1/0/0] quit [PE1] interface gigabitethernet 2/0/0 [PE1-GigabitEthernet2/0/0] port hybrid pvid vlan 20 [PE1-GigabitEthernet2/0/0] port hybrid untagged vlan 20 [PE1-GigabitEthernet2/0/0] quit [PE1] ip vpn-instance vpna [PE1-vpn-instance-vpna] ipv6-family [PE1-vpn-instance-vpna-af-ipv6] route-distinguisher 100:1 [PE1-vpn-instance-vpna-af-ipv6] vpn-target 111:1 both [PE1-vpn-instance-vpna-af-ipv6] quit [PE1-vpn-instance-vpna] quit [PE1] ip vpn-instance vpnb [PE1-vpn-instance-vpnb] ipv6-family [PE1-vpn-instance-vpnb-af-ipv6] route-distinguisher 100:2 [PE1-vpn-instance-vpnb-af-ipv6] vpn-target 222:2 both [PE1-vpn-instance-vpnb-af-ipv6] quit [PE1-vpn-instance-vpnb] quit [PE1] interface vlanif 10 [PE1-Vlanif10] ip binding vpn-instance vpna [PE1-Vlanif10] ipv6 enable [PE1-Vlanif10] ipv6 address 2001::1 64 [PE1-Vlanif10] quit [PE1] interface vlanif 20 [PE1-Vlanif20] ip binding vpn-instance vpnb [PE1-Vlanif20] ipv6 enable [PE1-Vlanif20] ipv6 address 2002::1 64 [PE1-Vlanif20] quit
# 配置PE2。
[PE2] ipv6 [PE2] vlan batch 100 200 [PE2] interface gigabitethernet 2/0/0 [PE2-GigabitEthernet2/0/0] port link-type trunk [PE2-GigabitEthernet2/0/0] port trunk allow-pass vlan 100 200 [PE2-GigabitEthernet2/0/0] quit [PE2] ip vpn-instance vpna [PE2-vpn-instance-vpna] ipv6-family [PE2-vpn-instance-vpna-af-ipv6] route-distinguisher 200:1 [PE2-vpn-instance-vpna-af-ipv6] vpn-target 111:1 both [PE2-vpn-instance-vpna-af-ipv6] quit [PE2-vpn-instance-vpna] quit [PE2] ip vpn-instance vpnb [PE2-vpn-instance-vpnb] ipv6-family [PE2-vpn-instance-vpnb-af-ipv6] route-distinguisher 200:2 [PE2-vpn-instance-vpnb-af-ipv6] vpn-target 222:2 both [PE2-vpn-instance-vpnb-af-ipv6] quit [PE2-vpn-instance-vpnb] quit [PE2] interface vlanif 60 [PE2-Vlanif60] ip binding vpn-instance vpna [PE2-Vlanif60] ipv6 enable [PE2-Vlanif60] ipv6 address 2007::1 64 [PE2-Vlanif60] quit [PE2] interface vlanif 70 [PE2-Vlnaif70] ip binding vpn-instance vpnb [PE2-Vlnaif70] ipv6 enable [PE2-Vlnaif70] ipv6 address 2008::1 64 [PE2-Vlnaif70] quit
- 在MCE设备上配置IPv6和VPN实例，将CE3、CE4接入MCE
<Huawei> system-view [Huawei] sysname MCE [MCE] ipv6 [MCE] ip vpn-instance vpna [MCE-vpn-instance-vpna] ipv6-family [MCE-vpn-instance-vpna-af-ipv6] route-distinguisher 100:1 [MCE-vpn-instance-vpna-af-ipv6] quit [MCE-vpn-instance-vpna] quit [MCE] ip vpn-instance vpnb [MCE-vpn-instance-vpnb] ipv6-family [MCE-vpn-instance-vpnb-af-ipv6] route-distinguisher 200:2 [MCE-vpn-instance-vpnb-af-ipv6] quit [MCE-vpn-instance-vpnb] quit [MCE] interface gigabitethernet 1/0/0.1 [MCE-GigabitEthernet1/0/0.1] ip binding vpn-instance vpna [MCE-GigabitEthernet1/0/0.1] dot1q termination vid 100 [MCE-GigabitEthernet1/0/0.1] ipv6 enable [MCE-GigabitEthernet1/0/0.1] ipv6 address 2007::2 64 [MCE-GigabitEthernet1/0/0.1] ipv6 nd ns multicast-enable [MCE-GigabitEthernet1/0/0.1] quit [MCE] interface gigabitethernet 1/0/0.2 [MCE-GigabitEthernet1/0/0.2] ip binding vpn-instance vpnb [MCE-GigabitEthernet1/0/0.2] dot1q termination vid 200 [MCE-GigabitEthernet1/0/0.2] ipv6 enable [MCE-GigabitEthernet1/0/0.2] ipv6 address 2008::2 64 [MCE-GigabitEthernet1/0/0.2] ipv6 nd ns multicast-enable [MCE-GigabitEthernet1/0/0.2] quit [MCE] interface gigabitethernet 3/0/0 [MCE-GigabitEthernet3/0/0] ip binding vpn-instance vpna [MCE-GigabitEthernet3/0/0] ipv6 enable [MCE-GigabitEthernet3/0/0] ipv6 address FC03::2 64 [MCE-GigabitEthernet3/0/0] quit [MCE] interface gigabitethernet 4/0/0 [MCE-GigabitEthernet4/0/0] ip binding vpn-instance vpnb [MCE-GigabitEthernet4/0/0] ipv6 enable [MCE-GigabitEthernet4/0/0] ipv6 address FC04::1 64 [MCE-GigabitEthernet4/0/0] quit
- 在PE之间建立MP-IBGP对等体，在PE1与CE1、CE2之间建立EBGP对等体
# 配置PE1，和PE2建立MP-IBGP对等体。
[PE1] bgp 100 [PE1-bgp] peer 2.2.2.9 as-number 100 [PE1-bgp] peer 2.2.2.9 connect-interface loopback 1 [PE1-bgp] ipv6-family vpnv6 [PE1-bgp-af-vpnv6] peer 2.2.2.9 enable [PE1-bgp-af-vpnv6] quit
# 配置PE2，和PE1建立MP-IBGP对等体，PE2的配置过程同PE1（略）。
# 配置PE1，和CE1、CE2建立EBGP对等体。
[PE1] bgp 100 [PE1-bgp] ipv6-family vpn-instance vpna [PE1-bgp6-vpna] peer 2001::2 as-number 65410 [PE1-bgp6-vpna] quit [PE1-bgp] ipv6-family vpn-instance vpnb [PE1-bgp6-vpnb] peer 2002::2 as-number 65420 [PE1-bgp6-vpnb] quit [PE1-bgp] quit
# 配置CE1。
[CE1] bgp 65410 [CE1-bgp] peer 2001::1 as-number 100 [CE1-bgp] ipv6-family unicast [CE1-bgp-af-ipv6] peer 2001::1 enable [CE1-bgp-af-ipv6] import-route direct [CE1-bgp-af-ipv6] quit [CE1-bgp] quit
# CE2的配置过程同CE1（略）。
完成此步配置后，在PE1上执行命令display bgp vpnv6 all peer可以看见PE1与PE2的IBGP对等体关系及PE1与CE1、CE2之间建立EBGP对等体关系均为“Established”。
[PE1] display bgp vpnv6 all peer BGP local router ID : 1.1.1.9 Local AS number : 100 Total number of peers : 1 Peers in established state : 1 Peer V AS MsgRcvd MsgSent OutQ Up/Down State PrefRcv 2.2.2.9 4 100 288 287 0 01:19:16 Established 6 Peer of vpn instance : vpn instance vpna : 2001::2 4 65410 9 11 0 00:04:14 Established 2 vpn instance vpnb : 2002::2 4 65420 9 12 0 00:04:09 Established 2
- 在MCE与Site间的配置路由 MCE与vpna直接相连，且vpna内未使用路由协议，因此可以使用静态路由进行配置。
-
# 配置CE3
CE3连接vpna接口地址为FC05::1/64。
<Huawei> system-view [Huawei] sysname CE3 [CE3] ipv6 [CE3] vlan batch 60 80 [CE3] interface gigabitethernet 1/0/0 [CE3-GigabitEthernet1/0/0] port link-type trunk [CE3-GigabitEthernet1/0/0] port trunk allow-pass vlan 60 [CE3-GigabitEthernet1/0/0] port trunk pvid vlan 60 [CE3-GigabitEthernet1/0/0] quit [CE3]interface vlanif 60 [CE3-Vlanif60]ipv6 enable [CE3-Vlanif60]ipv6 address FC03::3 64 [CE3-Vlanif60] quit [CE3] interface gigabitethernet 2/0/0 [CE3-GigabitEthernet2/0/0] port link-type trunk [CE3-GigabitEthernet2/0/0] port trunk allow-pass vlan 80 [CE3-GigabitEthernet2/0/0] quit [CE3]interface vlanif 80 [CE3-Vlanif80]ipv6 enable [CE3-Vlanif80]ipv6 address FC05::1 64 [CE3-Vlanif80] quit [CE3]ipv6 route-static 0::0 0 FC03::2
-
# 配置MCE。
[MCE] ipv6 route-static vpn-instance vpna FC05:: 64 FC03::3
- #显示MCE上为vpna实例维护的路由信息。
[MCE]display ipv6 routing-table vpn-instance vpna Routing Table : vpna Destinations : 6 Routes : 6 Destination : FC03:: PrefixLength : 64 NextHop : FC03::2 Preference : 0 Cost : 0 Protocol : Direct RelayNextHop : :: TunnelID : 0x0 Interface : GigabitEthernet3/0/0 Flags : D Destination : FC03::2 PrefixLength : 128 NextHop : ::1 Preference : 0 Cost : 0 Protocol : Direct RelayNextHop : :: TunnelID : 0x0 Interface : GigabitEthernet3/0/0 Flags : D Destination : FC05:: PrefixLength : 64 NextHop : FC03::3 Preference : 60 Cost : 0 Protocol : Static RelayNextHop : :: TunnelID : 0x0 Interface : GigabitEthernet3/0/0 Flags : RD Destination : 2007:: PrefixLength : 64 NextHop : 2007::2 Preference : 0 Cost : 0 Protocol : Direct RelayNextHop : :: TunnelID : 0x0 Interface : GigabitEthernet1/0/0.1 Flags : D Destination : 2007::2 PrefixLength : 128 NextHop : ::1 Preference : 0 Cost : 0 Protocol : Direct RelayNextHop : :: TunnelID : 0x0 Interface : GigabitEthernet1/0/0.1 Flags : D Destination : FE80:: PrefixLength : 10 NextHop : :: Preference : 0 Cost : 0 Protocol : Direct RelayNextHop : :: TunnelID : 0x0 Interface : NULL0 Flags : D可以看到，已经在MCE上为vpna指定了静态路由。
在vpnb内运行RIPng，在MCE上配置RIPng进程200，并与vpnb实例绑定，以便将vpnb内的路由学习到vpnb实例的路由表中。
- # 配置MCE。
[MCE] ripng 200 vpn-instance vpnb [MCE-ripng-200] import-route ospfv3 200 [MCE-ripng-200] quit [MCE] interface gigabitethernet 4/0/0 [MCE-GigabitEthernet4/0/0] ripng 200 enable [MCE-GigabitEthernet4/0/0] quit
-
# 配置CE4。
CE4连接vpnb接口地址为FC06::1/64。
<Huawei> system-view [Huawei] sysname CE4 [CE4] ipv6 [CE4] vlan batch 70 80 [CE4] interface gigabitethernet 1/0/0 [CE4-GigabitEthernet1/0/0] port link-type trunk [CE4-GigabitEthernet1/0/0] port trunk allow-pass vlan 70 [CE4-GigabitEthernet1/0/0] port trunk pvid vlan 70 [CE4-GigabitEthernet1/0/0] quit [CE4] interface vlanif 70 [CE4-Vlanif70] ipv6 enable [CE4-Vlanif70] ipv6 address FC04::3 64 [CE4-Vlanif70] quit [CE4] interface gigabitethernet 2/0/0 [CE4-GigabitEthernet2/0/0] port link-type trunk [CE4-GigabitEthernet2/0/0] port trunk allow-pass vlan 80 [CE4-GigabitEthernet2/0/0] quit [CE4] interface vlanif 80 [CE4-Vlanif80] ipv6 enable [CE4-Vlanif80] ipv6 address FC06::1 64 [CE4-Vlanif80] quit [CE4] ripng 200 [CE4-ripng-200] quit [CE4] interface vlanif 70 [CE4-Vlanif70] ripng 200 enable [CE4-Vlanif70] quit [CE4] interface vlanif 80 [CE4-Vlanif80] ripng 200 enable [CE4-Vlanif80] quit
- #显示MCE上为vpnb实例维护的路由信息。
[MCE] display ipv6 routing-table vpn-instance vpnb Routing Table : vpnb Destinations : 6 Routes : 6 Destination : FC04:: PrefixLength : 64 NextHop : FC04::2 Preference : 0 Cost : 0 Protocol : Direct RelayNextHop : :: TunnelID : 0x0 Interface : GigabitEthernet4/0/0 Flags : D Destination : FC04::2 PrefixLength : 128 NextHop : ::1 Preference : 0 Cost : 0 Protocol : Direct RelayNextHop : :: TunnelID : 0x0 Interface : GigabitEthernet4/0/0 Flags : D Destination : FC06:: PrefixLength : 64 NextHop : FE80::5689:98FF:FE28:8442 Preference : 100 Cost : 0 Protocol : RIPng RelayNextHop : :: TunnelID : 0x0 Interface : GigabitEthernet4/0/0 Flags : D Destination : 2008:: PrefixLength : 64 NextHop : 2008::2 Preference : 0 Cost : 0 Protocol : Direct RelayNextHop : :: TunnelID : 0x0 Interface : GigabitEthernet1/0/0.2 Flags : D Destination : 2008::2 PrefixLength : 128 NextHop : ::1 Preference : 0 Cost : 0 Protocol : Direct RelayNextHop : :: TunnelID : 0x0 Interface : GigabitEthernet1/0/0.2 Flags : D Destination : FE80:: PrefixLength : 10 NextHop : :: Preference : 0 Cost : 0 Protocol : Direct RelayNextHop : :: TunnelID : 0x0 Interface : NULL0 Flags : D可以看到，MCE已经通过RIP学习到了vpnb内的私网路由，并与vpna内的FC05::/64路由信息分别维护在两个路由表内，有效进行了隔离。
-
- 在MCE和PE2之间配置OSPFv3多实例
# 配置PE2。
[PE2] ospfv3 100 vpn-instance vpna [PE2-ospfv3-100] import-route bgp [PE2-ospf-100] quit [PE2] ospfv3 200 vpn-instance vpnb [PE2-ospfv3-200] import-route bgp [PE2-ospf-200] quit [PE2] bgp 100 [PE2-bgp] ipv6-family vpn-instance vpna [PE2-bgp-vpna] import-route ospfv3 100 [PE2-bgp-vpna] quit [PE2-bgp] ipv6-family vpn-instance vpnb [PE2-bgp-vpnb] import-route ospfv3 200 [PE2-bgp-vpnb] quit [PE2] interface vlanif 100 [PE2-Vlanif100] ospfv3 100 area 0 [PE2-Vlanif100] quit [PE2] interface vlanif 200 [PE2-Vlnaif200] ospfv3 200 area 0 [PE2-Vlnaif200] quit
[MCE] ospfv3 100 vpn-instance vpna [MCE-ospfv3-100] router-id 1.1.1.1 [MCE-ospfv3-100] import-route static [MCE-ospfv3-100] vpn-instance-capability simple [MCE-ospfv3-100] quit [MCE] ospfv3 200 vpn-instance vpnb [MCE-ospfv3-200] router-id 2.2.2.2 [MCE-ospfv3-200] import-route ripng 200 [MCE-ospfv3-200] vpn-instance-capability simple [MCE-ospfv3-200] quit [MCE] interface gigabitethernet 1/0/0.1 [MCE-GigabitEthernet1/0/0.1] ospfv3 100 area 0 [MCE-GigabitEthernet1/0/0.1] quit [MCE] interface gigabitethernet 1/0/0.2 [MCE-GigabitEthernet1/0/0.2] ospfv3 200 area 0 [MCE-GigabitEthernet1/0/0.2] quit
- 验证配置结果
# 完成上述配置后，在MCE设备上执行命令display ipv6 routing-table vpn-instance命令，可以看到去往对端CE的路由。
# 以vpna为例：
[MCE] display ipv6 routing-table vpn-instance vpna Routing Table : vpna Destinations : 7 Routes : 7 Destination : 2001:: PrefixLength : 64 NextHop : FE80::5689:98FF:FE28:8472 Preference : 150 Cost : 0 Protocol : OSPFv3ASE RelayNextHop : :: TunnelID : 0x0 Interface : GigabitEthernet1/0/0.1 Flags : D Destination : FC03:: PrefixLength : 64 NextHop : FC03::2 Preference : 0 Cost : 0 Protocol : Direct RelayNextHop : :: TunnelID : 0x0 Interface : GigabitEthernet3/0/0 Flags : D Destination : FC03::2 PrefixLength : 128 NextHop : ::1 Preference : 0 Cost : 0 Protocol : Direct RelayNextHop : :: TunnelID : 0x0 Interface : GigabitEthernet3/0/0 Flags : D Destination : FC05:: PrefixLength : 64 NextHop : FC03::3 Preference : 60 Cost : 0 Protocol : Static RelayNextHop : :: TunnelID : 0x0 Interface : GigabitEthernet3/0/0 Flags : RD Destination : 2007:: PrefixLength : 64 NextHop : 2007::2 Preference : 0 Cost : 0 Protocol : Direct RelayNextHop : :: TunnelID : 0x0 Interface : GigabitEthernet1/0/0.1 Flags : D Destination : 2007::2 PrefixLength : 128 NextHop : ::1 Preference : 0 Cost : 0 Protocol : Direct RelayNextHop : :: TunnelID : 0x0 Interface : GigabitEthernet1/0/0.1 Flags : D Destination : FE80:: PrefixLength : 10 NextHop : :: Preference : 0 Cost : 0 Protocol : Direct RelayNextHop : :: TunnelID : 0x0 Interface : NULL0 Flags : D# 在PE上执行display ipv6 routing-table vpn-instance命令，可以看到去往对端CE的路由。
# 以PE1上的vpna为例：
[PE1] display ipv6 routing-table vpn-instance vpna Routing Table : vpna Destinations : 6 Routes : 6 Destination : 2001:: PrefixLength : 64 NextHop : 2001::1 Preference : 0 Cost : 0 Protocol : Direct RelayNextHop : :: TunnelID : 0x0 Interface : Vlanif30 Flags : D Destination : 2001::1 PrefixLength : 128 NextHop : ::1 Preference : 0 Cost : 0 Protocol : Direct RelayNextHop : :: TunnelID : 0x0 Interface : Vlanif30 Flags : D Destination : FC03:: PrefixLength : 64 NextHop : ::FFFF:2.2.2.9 Preference : 255 Cost : 0 Protocol : BGP RelayNextHop : :: TunnelID : 0x0 Interface : Vlanif30 Flags : RD Destination : FC05:: PrefixLength : 64 NextHop : ::FFFF:2.2.2.9 Preference : 255 Cost : 0 Protocol : BGP RelayNextHop : :: TunnelID : 0x0 Interface : Vlanif30 Flags : RD Destination : 2007:: PrefixLength : 64 NextHop : ::FFFF:2.2.2.9 Preference : 255 Cost : 0 Protocol : BGP RelayNextHop : :: TunnelID : 0x0 Interface : Vlanif30 Flags : RD Destination : FE80:: PrefixLength : 10 NextHop : :: Preference : 0 Cost : 0 Protocol : Direct RelayNextHop : :: TunnelID : 0x0 Interface : NULL0 Flags : D# CE1、CE3之间可以互通，CE2、CE4之间可以互通。
# CE1不能与CE2和CE4互通，CE3也不能与CE2和CE4互通。
3252
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
