VRF(Virtual Routing and Rorwarding,虚拟路由转发)
VRF(Virtual Routing and Forwarding,虚拟路由转发)技术通过在一台三层转发设备上创建多张路由表实现数据或业务的隔离,常用于MPLS VPN、防火墙等一些需要实现隔离的应用场景。
VRF是对物理设备的一个逻辑划分,每个逻辑单元都被称为一个VPN实例,实例之间在路由层面是隔离的。VRF实现过程如下:
-
- 创建实例,并将三层接口(可以是路由器的物理接口或者子接口,也可以是VLANIF接口)绑定到实例;
- (可选)配置与实例绑定的路由协议或静态路由;
- 基于与实例绑定的接口和路由协议等建立实例路由表并基于实例路由表转发数据,实现实例间隔离。
- 常见应用场景
- 防火墙虚拟系统
虚拟系统(Virtual System)是在一台物理设备上划分出的多台相互独立的逻辑设备。虚拟系统主要具有以下特点:
资源虚拟化:每个虚拟系统都有独享的资源,包括接口、VLAN、策略和会话等。
路由虚拟化:每个虚拟系统都拥有各自的路由表,相互独立隔离。
其中路由虚拟化依靠创建VPN实例来实现。
-
- BGP/MPLS IP VPN
BGP/MPLS IP VPN是一种基于PE的L3VPN技术。它使用BGP在服务提供商骨干网上发布VPN路由,使用MPLS在服务提供商骨干网上转发VPN报文。
通过创建VPN实例的方式在PE上区别不同VPN的路由。
[Huawei] ip vpn-instance vpn-instance-name
ip vpn-instance命令用来创建VPN实例,并进入VPN实例视图。缺省情况下,未配置VPN实例。
-
- 2.使能VPN实例的IPv4类型的路由通告和数据转发功能
[Huawei-vpn-instance-InstanceName] ipv4-family
ipv4-family命令用来使能VPN实例的IPv4地址族,并进入VPN实例IPv4地址族视图。缺省情况下,未使能VPN实例的IPv4地址族。接口不能与未使能任何地址族的VPN实例绑定。
-
- 3.将接口绑定到VPN实例
3.将接口绑定到VPN实例
[Huawei-GigabitEthernet0/0/0]ip binding vpn-instance vpn-instance-name
ip binding vpn-instance命令用来将PE上的接口与VPN实例绑定。缺省情况下,接口不与任何VPN实例绑定,属于根实例。配置接口与VPN实例绑定后,或取消接口与VPN实例的绑定,都会清除该接口的IP地址、三层特性和IP相关的路由协议,如果需要应重新配置。
-
- 4.向VPN实例的路由表中添加静态路由
4.向VPN实例的路由表中添加静态路由
[Huawei] ip route-static vpn-instance vpn-instance-name ip-address { mask | mask-length } { nexthop-address | interface-type interface-number }
-
- 5.创建与VPN实例绑定的动态路由协议进程(以OSPF为例)
5.创建与VPN实例绑定的动态路由协议进程(以OSPF为例)
[Huawei] ospf [ process-id | router-id router-id ] vpn-instance vpn-instance-name
注:不同VPN实例之间的进程号不可重叠。
-
- 6.VPN实例维护命令
[Huawei] display ip routing-table vpn-instance vpn-instance-name
[Huawei] ping -vpn-instance vpn-instance-name host
[Huawei] tracert -vpn-instance vpn-instance-name host
注:如果执行ping时没有携带vpn-instance关键字及参数,则默认在根设备上执行ping操作,并且所产生的ICMP报文根据全局路由表进行转发。tracert操作同理。
每台设备都有loop back口,AR1 10.1.1.1/32,AR210.1.2.2/32,PC1和PC2网段冲突
-
- 实验目的:实现PC1访问AR2和PC2访问AR3的流量完全隔离
- SW1配置:
vlan batch 10 20
interface GigabitEthernet0/0/1
port link-type access
port default vlan 10
#
interface GigabitEthernet0/0/2
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#
interface GigabitEthernet0/0/3
port link-type access
port default vlan 20
-
- AR1配置:
ip vpn-instance vlan10 (创建VRF名称vlan10)
ipv4-family
#
ip vpn-instance vlan20 (创建VRF名称vlan20)
ipv4-family
interface GigabitEthernet0/0/2.10
dot1q termination vid 10
ip binding vpn-instance vlan10 (将子接口绑定到VRF vlan10)
ip address 192.168.1.254 255.255.255.0
arp broadcast enable
#
interface GigabitEthernet0/0/2.20
dot1q termination vid 20
ip binding vpn-instance vlan20 (将子接口绑定到VRF vlan20)
ip address 192.168.1.254 255.255.255.0
arp broadcast enable
-
- 检查接口IP,发现两个IP一样:是因为开启了VRF,
[AR1]dis ip int bri
*down: administratively down
^down: standby
(l): loopback
(s): spoofing
The number of interface that is UP in Physical is 6
The number of interface that is DOWN in Physical is 0
The number of interface that is UP in Protocol is 3
The number of interface that is DOWN in Protocol is 3
Interface IP Address/Mask Physical Protocol
GigabitEthernet0/0/0 unassigned up down
GigabitEthernet0/0/1 unassigned up down
GigabitEthernet0/0/2 unassigned up down
GigabitEthernet0/0/2.10 192.168.1.254/24 up up
GigabitEthernet0/0/2.20 192.168.1.254/24 up up
NULL0 unassigned up up(s)
-
- 检查路由表:
[AR1]dis ip routing-table (发现没有关于192.168.1.0/24的路由表)
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: Public
Destinations : 4 Routes : 4
Destination/Mask Proto Pre Cost Flags NextHop Interface
127.0.0.0/8 Direct 0 0 D 127.0.0.1 InLoopBack0
127.0.0.1/32 Direct 0 0 D 127.0.0.1 InLoopBack0
127.255.255.255/32 Direct 0 0 D 127.0.0.1 InLoopBack0
255.255.255.255/32 Direct 0 0 D 127.0.0.1 InLoopBack0
[AR1]dis ip routing-table vpn-instance vlan10 发现有关于192.168.1.0/24路由
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: vlan10
Destinations : 4 Routes : 4
Destination/Mask Proto Pre Cost Flags NextHop Interface
192.168.1.0/24 Direct 0 0 D 192.168.1.254 GigabitEthernet
0/0/2.10
192.168.1.254/32 Direct 0 0 D 127.0.0.1 GigabitEthernet
0/0/2.10
192.168.1.255/32 Direct 0 0 D 127.0.0.1 GigabitEthernet
0/0/2.10
255.255.255.255/32 Direct 0 0 D 127.0.0.1 InLoopBack0
[AR1]dis ip routing-table vpn-instance vlan20 发现也有192.168.1.0/24路由表,且和VRF vlan10 中的路由表相同,但是互不影响。因为互为隔离。
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: vlan20
Destinations : 4 Routes : 4
Destination/Mask Proto Pre Cost Flags NextHop Interface
192.168.1.0/24 Direct 0 0 D 192.168.1.254 GigabitEthernet
0/0/2.20
192.168.1.254/32 Direct 0 0 D 127.0.0.1 GigabitEthernet
0/0/2.20
192.168.1.255/32 Direct 0 0 D 127.0.0.1 GigabitEthernet
0/0/2.20
255.255.255.255/32 Direct 0 0 D 127.0.0.1 InLoopBack0
-
- 配置PC1和AR2互联,PC2和AR3互联
AR1:
interface GigabitEthernet0/0/0
ip binding vpn-instance vlan10
ip address 10.1.12.1 255.255.255.0
#
interface GigabitEthernet0/0/1
ip binding vpn-instance vlan20
ip address 10.1.13.1 255.255.255.0
[AR2-GigabitEthernet0/0/0]ip add 10.1.12.2 24
[AR3-GigabitEthernet0/0/1]ip add 10.1.13.3 24
检查AR1的两个VRF到AR2,AR3的互联状态
[AR1]dis ip routing-table vpn-instance vlan10 ,发现有10.1.12.0/24路由
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: vlan10
Destinations : 7 Routes : 7
Destination/Mask Proto Pre Cost Flags NextHop Interface
10.1.12.0/24 Direct 0 0 D 10.1.12.1 GigabitEthernet
0/0/0
10.1.12.1/32 Direct 0 0 D 127.0.0.1 GigabitEthernet
0/0/0
10.1.12.255/32 Direct 0 0 D 127.0.0.1 GigabitEthernet
0/0/0
192.168.1.0/24 Direct 0 0 D 192.168.1.254 GigabitEthernet
0/0/2.10
192.168.1.254/32 Direct 0 0 D 127.0.0.1 GigabitEthernet
0/0/2.10
192.168.1.255/32 Direct 0 0 D 127.0.0.1 GigabitEthernet
0/0/2.10
255.255.255.255/32 Direct 0 0 D 127.0.0.1 InLoopBack0
[AR1]dis ip rou vpn-instance vlan20 发现有10.1.13.0/24的路由
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: vlan20
Destinations : 7 Routes : 7
Destination/Mask Proto Pre Cost Flags NextHop Interface
10.1.13.0/24 Direct 0 0 D 10.1.13.1 GigabitEthernet
0/0/1
10.1.13.1/32 Direct 0 0 D 127.0.0.1 GigabitEthernet
0/0/1
10.1.13.255/32 Direct 0 0 D 127.0.0.1 GigabitEthernet
0/0/1
192.168.1.0/24 Direct 0 0 D 192.168.1.254 GigabitEthernet
0/0/2.20
192.168.1.254/32 Direct 0 0 D 127.0.0.1 GigabitEthernet
0/0/2.20
192.168.1.255/32 Direct 0 0 D 127.0.0.1 GigabitEthernet
0/0/2.20
255.255.255.255/32 Direct 0 0 D 127.0.0.1 InLoopBack0
ping测试:
[AR1]ping -vpn-instance vlan10 -a 10.1.12.1 10.1.12.2
PING 10.1.12.2: 56 data bytes, press CTRL_C to break
Reply from 10.1.12.2: bytes=56 Sequence=1 ttl=255 time=60 ms
Reply from 10.1.12.2: bytes=56 Sequence=2 ttl=255 time=10 ms
Reply from 10.1.12.2: bytes=56 Sequence=3 ttl=255 time=40 ms
Reply from 10.1.12.2: bytes=56 Sequence=4 ttl=255 time=20 ms
Reply from 10.1.12.2: bytes=56 Sequence=5 ttl=255 time=20 ms
--- 10.1.12.2 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 10/30/60 ms
[AR1]ping -vpn-instance vlan20 -a 10.1.13.1 10.1.13.3
PING 10.1.13.3: 56 data bytes, press CTRL_C to break
Reply from 10.1.13.3: bytes=56 Sequence=1 ttl=255 time=60 ms
Reply from 10.1.13.3: bytes=56 Sequence=2 ttl=255 time=30 ms
Reply from 10.1.13.3: bytes=56 Sequence=3 ttl=255 time=20 ms
Reply from 10.1.13.3: bytes=56 Sequence=4 ttl=255 time=20 ms
Reply from 10.1.13.3: bytes=56 Sequence=5 ttl=255 time=40 ms
--- 10.1.13.3 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 20/34/60 ms
PC>ping 10.1.2.2 不通是因为AR1的VRF路由里 没有到达10.1.2.2路由,且10.1.2.2也没有回192.168.1.1的路由。所以下面需要添加路由
Ping 10.1.2.2: 32 data bytes, Press Ctrl_C to break
Request timeout!
Request timeout!
--- 10.1.2.2 ping statistics ---
2 packet(s) transmitted
0 packet(s) received
100.00% packet loss
-
- PC1到AR2添加路由:
[AR1]ip route-static vpn-instance vlan10 10.1.2.2 32 10.1.12.2
[AR2]ip route-static 192.168.1.0 24 10.1.12.1
PC>ping 10.1.2.2
Ping 10.1.2.2: 32 data bytes, Press Ctrl_C to break
From 10.1.2.2: bytes=32 seq=1 ttl=254 time=32 ms
From 10.1.2.2: bytes=32 seq=2 ttl=254 time=31 ms
From 10.1.2.2: bytes=32 seq=3 ttl=254 time=31 ms
From 10.1.2.2: bytes=32 seq=4 ttl=254 time=31 ms
From 10.1.2.2: bytes=32 seq=5 ttl=254 time=32 ms
--- 10.1.2.2 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 31/31/32 ms
添加路由后PC1和AR2可以ping通
-
- PC2到AR3使用动态路由:
[AR1]ospf 1 vpn-instance vlan20 router-id 10.1.1.1
[AR1-ospf-1]area 0
[AR1-ospf-1-area-0.0.0.0]net 0.0.0.0 0.0.0.0
[AR3]ospf 1
[AR3-ospf-1]area 0
[AR3-ospf-1-area-0.0.0.0]net 0.0.0.0 0.0.0.0
-
- 检查AR1到AR3路由
[AR1]dis ip routing-table vpn-instance vlan20
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: vlan20
Destinations : 8 Routes : 8
Destination/Mask Proto Pre Cost Flags NextHop Interface
10.1.3.3/32 OSPF 10 1 D 10.1.13.3 GigabitEthernet
0/0/1
10.1.13.0/24 Direct 0 0 D 10.1.13.1 GigabitEthernet
0/0/1
10.1.13.1/32 Direct 0 0 D 127.0.0.1 GigabitEthernet
0/0/1
10.1.13.255/32 Direct 0 0 D 127.0.0.1 GigabitEthernet
0/0/1
192.168.1.0/24 Direct 0 0 D 192.168.1.254 GigabitEthernet
0/0/2.20
192.168.1.254/32 Direct 0 0 D 127.0.0.1 GigabitEthernet
0/0/2.20
192.168.1.255/32 Direct 0 0 D 127.0.0.1 GigabitEthernet
0/0/2.20
255.255.255.255/32 Direct 0 0 D 127.0.0.1 InLoopBack0
[AR3]dis ip routing-table
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: Public
Destinations : 9 Routes : 9
Destination/Mask Proto Pre Cost Flags NextHop Interface
10.1.3.3/32 Direct 0 0 D 127.0.0.1 LoopBack0
10.1.13.0/24 Direct 0 0 D 10.1.13.3 GigabitEthernet
0/0/1
10.1.13.3/32 Direct 0 0 D 127.0.0.1 GigabitEthernet
0/0/1
10.1.13.255/32 Direct 0 0 D 127.0.0.1 GigabitEthernet
0/0/1
127.0.0.0/8 Direct 0 0 D 127.0.0.1 InLoopBack0
127.0.0.1/32 Direct 0 0 D 127.0.0.1 InLoopBack0
127.255.255.255/32 Direct 0 0 D 127.0.0.1 InLoopBack0
192.168.1.0/24 OSPF 10 2 D 10.1.13.1 GigabitEthernet
0/0/1
255.255.255.255/32 Direct 0 0 D 127.0.0.1 InLoopBack0
发现AR1的VRF vlan20里 和 AR3 都有关于192.168.1.0/24 和loop back口的路由
-
- PC1 ping AR3环口测试:
PC>ping 10.1.3.3
Ping 10.1.3.3: 32 data bytes, Press Ctrl_C to break
From 10.1.3.3: bytes=32 seq=1 ttl=254 time=47 ms
From 10.1.3.3: bytes=32 seq=2 ttl=254 time=31 ms
From 10.1.3.3: bytes=32 seq=3 ttl=254 time=31 ms
From 10.1.3.3: bytes=32 seq=4 ttl=254 time=32 ms
From 10.1.3.3: bytes=32 seq=5 ttl=254 time=31 ms
--- 10.1.3.3 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 31/34/47 ms
tracert 测试:
[AR1]tracert -vpn-instance vlan10 10.1.2.2
traceroute to vlan10 10.1.2.2(10.1.
2.2), max hops: 30 ,packet length: 40,press CTRL_C to break
1 10.1.12.2 20 ms 20 ms 20 ms
欢迎联系我,一起交流,学习~
讨论网络技术,或网络相关~