【华三】MPLS VPN 跨域方案 Option A

跨域方案A背景

注意点

配置

CE1

[H3C]sysname CE1

[CE1]int g0/0
[CE1-GigabitEthernet0/0]ip address 10.1.1.1 30
[CE1-GigabitEthernet0/0]quit
[CE1]int LoopBack 1
[CE1-LoopBack1]ip address 172.16.1.1 32
[CE1-LoopBack1]int LoopBack 2
[CE1-LoopBack2]ip address 172.16.1.2 32
[CE1-LoopBack2]int LoopBack 3
[CE1-LoopBack3]ip address 172.16.1.3 32
[CE1-LoopBack3]qu

# 将业务路由宣告进OSPF中
[CE1]int range g0/0 lo1 lo2 lo3
[CE1-if-range]ospf 1 area 0
[CE1-if-range]quit

CE2

[H3C]sysname CE2

[CE2]int g0/0
[CE2-GigabitEthernet0/0]ip address 10.2.1.2 30
[CE2-GigabitEthernet0/0]qu

[CE2]int LoopBack 1
[CE2-LoopBack1]ip address 172.16.1.1 32
[CE2-LoopBack1]int LoopBack 2
[CE2-LoopBack2]ip address 172.16.1.2 32
[CE2-LoopBack2]int LoopBack 3
[CE2-LoopBack3]ip address 172.16.1.3 32
[CE2-LoopBack3]qu

[CE2]int range lo1 lo2 lo3 g0/0
[CE2-if-range]ospf 1 a 0
[CE2-if-range]qu

PE1

基础配置

[H3C]sysname PE1

# 用VPN实例将客户分离开
[PE1]ip vpn-instance A
[PE1-vpn-instance-A]route-distinguisher 100:1
[PE1-vpn-instance-A]vpn-target 100:1 import-extcommunity 
[PE1-vpn-instance-A]vpn-target 100:2 export-extcommunity 
[PE1-vpn-instance-A]address-family ipv4
[PE1-vpn-ipv4-A]quit
[PE1-vpn-instance-A]quit

[PE1]int g0/1
[PE1-GigabitEthernet0/1]ip binding vpn-instance A
[PE1-GigabitEthernet0/1]ip address 10.1.1.2 30
[PE1-GigabitEthernet0/1]ospf 1 area 0
[PE1-GigabitEthernet0/1]quit

# 内部用ISIS全互通
[PE1]isis 1
[PE1-isis-1]network-entity 49.0001.0000.0000.0001.00
[PE1-isis-1]cost-style wide
[PE1-isis-1]quit

[PE1]interface LoopBack 0
[PE1-LoopBack0]ip address 10.255.1.1 32
[PE1-LoopBack0]qu

[PE1]int g0/0
[PE1-GigabitEthernet0/0]ip address 10.1.2.1 30
[PE1-GigabitEthernet0/0]qu

[PE1]int range lo0 g0/0
[PE1-if-range]isis enable 1
[PE1-if-range]qu

MPLS LDP

[PE1]mpls lsr-id 10.255.1.1   # 这个lsr-id用的地址必须是存在且是/32位掩码的
[PE1]mpls ldp 
[PE1-ldp]qu

[PE1]int g0/0
[PE1-GigabitEthernet0/0]mpls enable 
[PE1-GigabitEthernet0/0]mpls ldp enable 
[PE1-GigabitEthernet0/0]qu

MP-BGP

# 与ASBR1建立MP-iBGP VPNv4邻居
[PE1]bgp 100
[PE1-bgp-default]peer 10.255.3.3 as-number 100
[PE1-bgp-default]peer 10.255.3.3 connect-interface lo0
[PE1-bgp-default]address-family vpnv4
[PE1-bgp-default-vpnv4]peer 10.255.3.3 enable 
[PE1-bgp-default-vpnv4]quit
[PE1-bgp-default]quit

# BGP和OSPF双向重分布
[PE1]bgp 100
[PE1-bgp-default]ip vpn-instance A
[PE1-bgp-default-A]address-family ipv4
[PE1-bgp-default-ipv4-A]import-route ospf 
[PE1-bgp-default-ipv4-A]quit
[PE1-bgp-default-A]quit
[PE1-bgp-default]quit

[PE1]ospf 1
[PE1-ospf-1]import-route bgp 
[PE1-ospf-1]qu

P1

基础配置

[H3C]sysname P1
[P1]int g0/0
[P1-GigabitEthernet0/0]ip address 10.1.2.2 30
[P1-GigabitEthernet0/0]quit

[P1]int g0/1
[P1-GigabitEthernet0/1]ip address 10.1.3.1 30
[P1-GigabitEthernet0/1]qu

[P1]int lo0
[P1-LoopBack0]ip address 10.255.2.2 32
[P1-LoopBack0]quit

[P1]isis 1
[P1-isis-1]network-entity 49.0001.0000.0000.0002.00
[P1-isis-1]cost-style wide
[P1-isis-1]qu

[P1]int range g0/0 g0/1 lo0
[P1-if-range]isis enable 1
[P1-if-range]quit

MPLS LDP

[P1]mpls lsr-id 10.255.2.2 
[P1]mpls ldp 
[P1-ldp]quit

[P1]int range g0/0 g0/1
[P1-if-range]mpls enable 
[P1-if-range]mpls ldp enable 
[P1-if-range]qu

ASBR1

基础配置

[H3C]sysname ASBR1

[ASBR1]int LoopBack 0
[ASBR1-LoopBack0]ip address 10.255.3.3 32
[ASBR1-LoopBack0]quit

[ASBR1]int g0/0
[ASBR1-GigabitEthernet0/0]ip address 10.1.3.2 30
[ASBR1-GigabitEthernet0/0]qu

[ASBR1]int g0/1
[ASBR1-GigabitEthernet0/1]ip address 10.0.0.1 30
[ASBR1-GigabitEthernet0/1]quit

[ASBR1]isis 1
[ASBR1-isis-1]network-entity 49.0001.0000.0000.0003.00
[ASBR1-isis-1]cost-style wide
[ASBR1-isis-1]qu

[ASBR1]int range lo0 g0/0
[ASBR1-if-range]isis en
[ASBR1-if-range]isis enable 1

Option A

# 与P1建立MPLS LDP邻居，防止IGP内部出现路由黑洞
[ASBR1]mpls lsr-id 10.255.3.3
[ASBR1]mpls ldp 
[ASBR1-ldp]quit

[ASBR1]int g0/0
[ASBR1-GigabitEthernet0/0]mpls enable 
[ASBR1-GigabitEthernet0/0]mpls ldp enable 
[ASBR1-GigabitEthernet0/0]qu

# 与CE1建立BGP VPNv4邻居
[ASBR1]bgp 100
[ASBR1-bgp-default]peer 10.255.1.1 as-number 100
[ASBR1-bgp-default]peer 10.255.1.1 connect-interface LoopBack 0
[ASBR1-bgp-default]address-family vpnv4
[ASBR1-bgp-default-vpnv4]peer 10.255.1.1 enable 
[ASBR1-bgp-default-vpnv4]quit
[ASBR1-bgp-default]quit

# OptionA的精髓
# 建立VPN实例 A（接受PE1的路由）
[ASBR1]ip vpn-instance A
[ASBR1-vpn-instance-A]route-distinguisher 100:1
[ASBR1-vpn-instance-A]vpn-target 100:2 import-extcommunity 
[ASBR1-vpn-instance-A]vpn-target 100:1 export-extcommunity 
[ASBR1-vpn-instance-A]address-family ipv4
[ASBR1-vpn-ipv4-A]quit
[ASBR1-vpn-instance-A]quit

# 创建单臂路由子接口与ASBR2连接，并绑定实例A
[ASBR1]int g0/1.1
[ASBR1-GigabitEthernet0/1.1]ip binding vpn-instance A
[ASBR1-GigabitEthernet0/1.1]vlan-type dot1q vid 10
[ASBR1-GigabitEthernet0/1.1]ip address 10.0.12.1 30
[ASBR1-GigabitEthernet0/1.1]quit

# 与ASBR2建立实例A的BGP IPv4邻居
# 使两个域能够互通

[ASBR1]bgp 100
[ASBR1-bgp-default]ip vpn-instance A
[ASBR1-bgp-default-A]peer 10.0.12.2 as-number 200
[ASBR1-bgp-default-A]address-family ipv4
[ASBR1-bgp-default-ipv4-A]peer 10.0.12.2 enable 
[ASBR1-bgp-default-ipv4-A]qu
[ASBR1-bgp-default-A]qu
[ASBR1-bgp-default]qu

ASBR2

基础配置

[H3C]sysname ASBR2
[ASBR2]int g0/0
[ASBR2-GigabitEthernet0/0]ip address 10.0.0.2 30
[ASBR2-GigabitEthernet0/0]quit

[ASBR2]int LoopBack 0
[ASBR2-LoopBack0]ip address 10.255.4.4 32
[ASBR2-LoopBack0]quit

[ASBR2]int g0/1
[ASBR2-GigabitEthernet0/1]ip address 10.2.3.1 30
[ASBR2-GigabitEthernet0/1]quit

[ASBR2]isis 1
[ASBR2-isis-1]network-entity 49.0002.0000.0000.0001.00
[ASBR2-isis-1]cost-style wide
[ASBR2-isis-1]quit

[ASBR2]int range lo0 g0/1
[ASBR2-if-range]isis enable 1
[ASBR2-if-range]quit

OptionA

# 与P2建立MPLS LDP邻居，防止IGP内部出现路由黑洞
[ASBR2]mpls lsr-id 10.255.4.4
[ASBR2]mpls ldp 
[ASBR2-ldp]quit

[ASBR2]int g0/1
[ASBR2-GigabitEthernet0/1]mpls enable 
[ASBR2-GigabitEthernet0/1]mpls ldp enable 
[ASBR2-GigabitEthernet0/1]qu

# 与CE2建立BGP VPNv4邻居
[ASBR2]bgp 200
[ASBR2-bgp-default]peer 10.255.6.6 as-number 200
[ASBR2-bgp-default]peer 10.255.6.6 connect-interface lo0
[ASBR2-bgp-default]address-family vpnv4
[ASBR2-bgp-default-vpnv4]peer 10.255.6.6 enable 
[ASBR2-bgp-default-vpnv4]quit
[ASBR2-bgp-default]quit

# 建立VPN实例 A（接受PE2的路由）
[ASBR2]ip vpn-instance A
[ASBR2-vpn-instance-A]route-distinguisher 200:1
[ASBR2-vpn-instance-A]vpn-target 200:2 import-extcommunity 
[ASBR2-vpn-instance-A]vpn-target 200:1 export-extcommunity 
[ASBR2-vpn-instance-A]address-family ipv4
[ASBR2-vpn-ipv4-A]qu
[ASBR2-vpn-instance-A]qu

# 创建单臂路由子接口与ASBR2连接，并绑定实例A
[ASBR2]int g0/0.1
[ASBR2-GigabitEthernet0/0.1]vlan-type dot1q vid 10
[ASBR2-GigabitEthernet0/0.1]ip binding vpn-instance A
[ASBR2-GigabitEthernet0/0.1]ip address 10.0.12.2 30
[ASBR2-GigabitEthernet0/0.1]qu

# 与ASBR1建立实例A的BGP IPv4邻居
# 使两个域能够互通
[ASBR2]bgp 200
[ASBR2-bgp-default]ip vpn-instance A
[ASBR2-bgp-default-A]peer 10.0.12.1 as-number 100
[ASBR2-bgp-default-A]address-family ipv4
[ASBR2-bgp-default-ipv4-A]peer 10.0.12.1 enable 
[ASBR2-bgp-default-ipv4-A]qu
[ASBR2-bgp-default-A]qu
[ASBR2-bgp-default]qu

P2

基础配置

[H3C]sysname P2
[P2]int lo
[P2]int LoopBack 0
[P2-LoopBack0]ip address 10.255.5.5 32
[P2-LoopBack0]quit

[P2]int g0/0
[P2-GigabitEthernet0/0]ip address 10.2.3.2 30
[P2-GigabitEthernet0/0]qu

[P2]int g0/1
[P2-GigabitEthernet0/1]ip address 10.2.2.1 30
[P2-GigabitEthernet0/1]quit

[P2]isis 1
[P2-isis-1]network-entity 49.0002.0000.0000.0002.00
[P2-isis-1]cost-style wide
[P2-isis-1]quit

[P2]int range g0/0 g0/1 lo0
[P2-if-range]isis enable 1
[P2-if-range]quit

MPLS LDP

[P2]mpls lsr-id 10.255.5.5 
[P2]mpls ldp 
[P2-ldp]quit

[P2]int range g0/0 g0/1
[P2-if-range]mpls enable 
[P2-if-range]mpls ldp enable 
[P2-if-range]qu

PE2

基础配置

[H3C]sysname PE2

# 用VPN实例将客户分离开
[PE2]ip vpn-instance A
[PE2-vpn-instance-A]route-distinguisher 200:1
[PE2-vpn-instance-A]vpn-target 200:1 import-extcommunity 
[PE2-vpn-instance-A]vpn-target 200:2 export-extcommunity 
[PE2-vpn-instance-A]address-family ipv4
[PE2-vpn-ipv4-A]qu
[PE2-vpn-instance-A]qu

# 与CE2建立OSPF邻居
[PE2]int g0/1
[PE2-GigabitEthernet0/1]ip binding vpn-instance A
[PE2-GigabitEthernet0/1]ip address 10.2.1.1 30
[PE2-GigabitEthernet0/1]ospf 1 area 0
[PE2-GigabitEthernet0/1]quit

# 内部用ISIS全互通
[PE2]isis 1
[PE2-isis-1]network-entity 49.0002.0000.0000.0003.00
[PE2-isis-1]cost-style wide
[PE2-isis-1]qu

[PE2]int g0/0
[PE2-GigabitEthernet0/0]ip address 10.2.2.2 30
[PE2-GigabitEthernet0/0]qu

[PE2]int lo0
[PE2-LoopBack0]ip address 10.255.6.6 32
[PE2-LoopBack0]quit

# 宣告进ISIS
[PE2]int range g0/0 lo0
[PE2-if-range]isis enable 1
[PE2-if-range]quit

MPLS LDP

[PE2]mpls lsr-id 10.255.6.6
[PE2]mpls ldp 
[PE2-ldp]quit

[PE2]int g0/0
[PE2-GigabitEthernet0/0]mpls enable 
[PE2-GigabitEthernet0/0]mpls ldp enable 
[PE2-GigabitEthernet0/0]qu

MP-BGP

[PE2]bgp 200
[PE2-bgp-default]peer 10.255.4.4 as-number 200
[PE2-bgp-default]peer 10.255.4.4 connect-interface lo0
[PE2-bgp-default]address-family vpnv4
[PE2-bgp-default-vpnv4]peer 10.255.4.4 enable 
[PE2-bgp-default-vpnv4]qu
[PE2-bgp-default]qu

# 双向重分布，让CE1学习到CE2的路由
[PE2]bgp 200
[PE2-bgp-default]ip vpn-instance A
[PE2-bgp-default-A]address-family ipv4
[PE2-bgp-default-ipv4-A]import-route ospf 
[PE2-bgp-default-ipv4-A]qu
[PE2-bgp-default-A]qu
[PE2-bgp-default]qu

[PE2]ospf 1
[PE2-ospf-1]import-route bgp 
[PE2-ospf-1]qu

剖析路径转发

CE1（纯IP路由）

CE1要去找CE2，从IP路由表中找到172.16.2.1的路由，发现从G0/0出去
[CE1]display ip routing-table

PE1（双标签）

当PE1收到IP路由，首先就在快速转发表中查找目标网段出接口，发现内层标签为24256，索引值为2
[PE1]display fib vpn-instance A
**第二次查表：**查索引值
【PE1】dis mpls forwarding nhlfe
这个时候就在这边发现出接口了，并且外层标签为24126

P1（双标签（3/））

[P1]display mpls forwarding ilm
在这边发现，P1收到PE1发来的数据包中，外标签为24126，对应转发表的动作是SWAP，就是将外标签替换成标签3，而标签3又是属于影式空标签（倒二跳弹出，发送数据的时候看不到标签），此时标签值为3（外标签）/24256（内标签），后面ASBR1收到的数据包中，就剩下单标签24256

ASBR1（纯IP路由）

ASBR1收到P1的数据包中，标签为24256，查看MPLS 的标签接收表，发现24256匹配的动作是“POP”，那就是删除标签，此时数据包就没有携带标签值，此时就找VRF 编号1对应的了

第二次查表：查VRF 编号
[ASBR1]display ip vpn-instance，发现是VPN实例A的路由

第三次查表：查看ASBR VPN实例A的路由表
发现去往CE2的路由是从子接口发送给ASBR2，以纯IP数据发送

ASBR2

收到ASBR1的数据包，发现目的地址是CE2，以纯IP路由方式，那么就查看IP实例A的转发表，发现发往P2的数据包的内标签值为24255，索引值（Token）为1
[ASBR2]display fib vpn-instance A

第二次查表：查索引值
可以发现，索引值1,对应的外标签为24127，从G0/1口转发数据出去

P2

收到ASBR2的数据包，发现外标签为24127，查看MPLS的接收表