目录
实验条件
网络拓朴
背景环境配置
R1
interface Loopback0
ip address 1.1.1.2 255.255.255.255 secondary
ip address 1.1.1.1 255.255.255.255
interface Ethernet0/0
ip address 12.1.1.1 255.255.255.0
interface Ethernet0/1
ip address 13.1.1.1 255.255.255.0
ip prefix-list CON seq 5 deny 12.1.1.0/24
ip prefix-list CON seq 10 deny 13.1.1.0/24
route-map RED permit 10
match ip address prefix-list CON
router bgp 1111
bgp router-id 1.1.1.1
redistribute connected route-map RED
neighbor 12.1.1.2 remote-as 12345
neighbor 13.1.1.3 remote-as 12345
R2
interface Loopback0
ip address 2.2.2.2 255.255.255.255
ip ospf 12345 area 0
interface Ethernet0/0
ip address 12.1.1.2 255.255.255.0
interface Ethernet0/2
ip address 23.1.1.2 255.255.255.0
ip ospf 12345 area 0
ip ospf cost 1000
interface Ethernet0/3
ip address 25.1.1.2 255.255.255.0
ip ospf 12345 area 0
router ospf 12345
router-id 2.2.2.2
router bgp 12345
bgp router-id 2.2.2.2
bgp default local-preference 150
network 2.2.2.2 mask 255.255.255.255
neighbor 5.5.5.5 remote-as 12345
neighbor 5.5.5.5 update-source Loopback0
neighbor 5.5.5.5 route-map LP in
neighbor 12.1.1.1 remote-as 1111
access-list 1 permit 1.1.1.1
access-list 1 permit 1.1.1.0
route-map LP permit 10
match ip address 1
set local-preference 99
route-map LP permit 20
R3
interface Loopback0
ip address 3.3.3.3 255.255.255.255
ip ospf 12345 area 0
interface Ethernet0/0
ip address 34.1.1.3 255.255.255.0
ip ospf 12345 area 0
interface Ethernet0/1
ip address 13.1.1.3 255.255.255.0
interface Ethernet0/2
ip address 23.1.1.3 255.255.255.0
ip ospf 12345 area 0
ip ospf cost 1000
router ospf 12345
router-id 3.3.3.3
router bgp 12345
bgp router-id 3.3.3.3
network 3.3.3.0 mask 255.255.255.0
neighbor 4.4.4.4 remote-as 12345
neighbor 4.4.4.4 update-source Loopback0
neighbor 4.4.4.4 next-hop-self
neighbor 13.1.1.1 remote-as 1111
R4
interface Loopback0
ip address 4.4.4.4 255.255.255.255
interface Ethernet0/0
ip address 34.1.1.4 255.255.255.0
ip ospf 12345 area 0
interface Ethernet0/2
ip address 45.1.1.4 255.255.255.0
ip ospf 12345 area 0
interface Ethernet0/3
ip address 47.1.1.4 255.255.255.0
ip ospf 12345 area 0
router ospf 12345
router-id 4.4.4.4
router bgp 12345
bgp router-id 4.4.4.4
bgp log-neighbor-changes
neighbor 3.3.3.3 remote-as 12345
neighbor 3.3.3.3 update-source Loopback0
neighbor 3.3.3.3 route-reflector-client
neighbor 5.5.5.5 remote-as 12345
neighbor 5.5.5.5 update-source Loopback0
neighbor 5.5.5.5 next-hop-self
neighbor 7.7.7.7 remote-as 12345
neighbor 7.7.7.7 update-source Loopback0
neighbor 7.7.7.7 route-reflector-client
R5
interface Loopback0
ip address 5.5.5.5 255.255.255.255
ip ospf 12345 area 0
interface Ethernet0/1
ip address 56.1.1.5 255.255.255.0
ip ospf 12345 area 0
interface Ethernet0/2
ip address 45.1.1.5 255.255.255.0
ip ospf 12345 area 0
interface Ethernet0/3
ip address 25.1.1.5 255.255.255.0
ip ospf 12345 area 0
router ospf 12345
router-id 5.5.5.5
router bgp 12345
bgp router-id 5.5.5.5
bgp log-neighbor-changes
neighbor 2.2.2.2 remote-as 12345
neighbor 2.2.2.2 update-source Loopback0
neighbor 2.2.2.2 route-reflector-client
neighbor 4.4.4.4 remote-as 12345
neighbor 4.4.4.4 update-source Loopback0
neighbor 4.4.4.4 route-reflector-client
neighbor 6.6.6.6 remote-as 12345
neighbor 6.6.6.6 shutdown
neighbor 6.6.6.6 update-source Loopback0
neighbor 6.6.6.6 route-reflector-client
R6
interface Loopback0
ip address 6.6.6.6 255.255.255.255
ip ospf 12345 area 0
interface Ethernet0/0
ip address 6.7.8.6 255.255.255.0
interface Ethernet0/1
ip address 56.1.1.6 255.255.255.0
ip ospf 12345 area 0
interface Ethernet0/2
ip address 67.1.1.6 255.255.255.0
ip ospf 12345 area 0
router ospf 12345
router-id 6.6.6.6
router bgp 12345
bgp router-id 6.6.6.6
bgp log-neighbor-changes
neighbor 5.5.5.5 remote-as 12345
neighbor 5.5.5.5 update-source Loopback0
neighbor 5.5.5.5 next-hop-self
neighbor 6.7.8.8 remote-as 8888
neighbor 6.7.8.8 route-map MED out
route-map MED permit 10
match ip address 3
set metric 100
route-map MED permit 20
match ip address 2
set metric 200
route-map MED permit 30
access-list 2 permit 2.2.2.2
access-list 3 permit 3.3.3.3
R7
interface Loopback0
ip address 7.7.7.7 255.255.255.255
ip ospf 12345 area 0
interface Ethernet0/1
ip address 6.7.8.7 255.255.255.0
interface Ethernet0/2
ip address 67.1.1.7 255.255.255.0
ip ospf 12345 area 0
ip ospf cost 1000
interface Ethernet0/3
ip address 47.1.1.7 255.255.255.0
ip ospf 12345 area 0
router ospf 12345
router-id 7.7.7.7
router bgp 12345
bgp router-id 7.7.7.7
bgp log-neighbor-changes
neighbor 4.4.4.4 remote-as 12345
neighbor 4.4.4.4 password SPOTO
neighbor 4.4.4.4 update-source Loopback0
neighbor 4.4.4.4 next-hop-self
neighbor 6.7.8.8 remote-as 8888
neighbor 6.7.8.8 route-map MED out
route-map MED permit 10
match ip address 3
set metric 200
route-map MED permit 20
match ip address 2
set metric 100
route-map MED permit 30
access-list 2 permit 2.2.2.2
access-list 3 permit 3.3.3.3
R8
interface Loopback0
ip address 8.8.8.8 255.255.255.255
interface Ethernet0/2
ip address 6.7.8.8 255.255.255.0
router bgp 8888
bgp router-id 8.8.8.8
bgp log-neighbor-changes
network 8.8.8.8 mask 255.255.255.255
neighbor 6.7.8.6 remote-as 12345
neighbor 6.7.8.7 remote-as 12345
Switch
空，没有配置
1. 确保所有的邻居正常建立
错点1：R4-R7邻居建立报错，BGP认证不通过
配置R4
R4：
router bgp 12345
neighbor 7.7.7.7 password SPOTO
配置完成之后，邻居还是有问题。没有建立。
R4(config-router)#do ping 7.7.7.7 so 4.4.4.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 7.7.7.7, timeout is 2 seconds:
Packet sent with a source address of 4.4.4.4
.....
Success rate is 0 percent (0/5)
发现网络有问题。4.4.4.4 没有宣告进OSPF
错点2：4.4.4.4 没有宣告进OSPF
R4：
interface Loopback0
ip ospf 12345 area 0
R4-R7之间邻居建立.
错点3：R5-R6邻居被关闭，重新启用
R5：
router bgp 12345
no neighbor 6.6.6.6 shutdown
错点4：交换机接口没开
R5：
interface range ethernet 0/0-2
no shutdown
检查所有邻居状态，都正常建立邻居
2. 路由选择
去往3.3.3.3路径调整
R8#traceroute 3.3.3.3 so lo0
Type escape sequence to abort.
Tracing the route to 3.3.3.3
VRF info: (vrf in name/id, vrf out name/id)
1 * * *
2 * * *
网络不通，检查环回口是否配置，是否宣告进BGP等
经查，有配置环回口，宣告进BGP时，宣告路由不正确
错点5：3.3.3.3没有正确宣告进BGP
R3:
router bgp 12345
no network 3.3.3.0 mask 255.255.255.0
network 3.3.3.3 mask 255.255.255.255
宣告进BGP的路由条目，必须和路由表保持一致。
再次测试成功
R8#traceroute 3.3.3.3 so lo0
Type escape sequence to abort.
Tracing the route to 3.3.3.3
VRF info: (vrf in name/id, vrf out name/id)
1 6.7.8.6 1 msec 0 msec 0 msec
2 56.1.1.5 0 msec 0 msec 1 msec
3 45.1.1.4 0 msec 1 msec 0 msec
4 34.1.1.3 1 msec * 1 msec
R8#
去往2.2.2.2路径调整
R8#traceroute 2.2.2.2 so lo0
Type escape sequence to abort.
Tracing the route to 2.2.2.2
VRF info: (vrf in name/id, vrf out name/id)
1 6.7.8.7 0 msec 1 msec 0 msec
2 47.1.1.4 0 msec 0 msec 0 msec
3 45.1.1.5 0 msec 0 msec 0 msec
4 25.1.1.2 1 msec * 1 msec
R8#
与目标一致无须调整。
去往1.1.1.1/1.1.1.2路径调整
两个环回口的ip地址没有被宣告进BGP，经过检查发现，是在直连路由重分布进BGP的时候，被过滤了
错点6：R1重分布时，过滤路由时配置错误
R1
R1#show ip prefix-list
ip prefix-list CON: 2 entries
seq 5 deny 12.1.1.0/24
seq 10 deny 13.1.1.0/24
没有permit其它ip地址
R1:
ip prefix-list CON permit 0.0.0.0/0 le 32
结果查询：
R1(config)#do show ip prefix-list
ip prefix-list CON: 3 entries
seq 5 deny 12.1.1.0/24
seq 10 deny 13.1.1.0/24
seq 15 permit 0.0.0.0/0 le 32
R1(config)#do show ip bgp
BGP table version is 6, local router ID is 1.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
t secondary path,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
Network Next Hop Metric LocPrf Weight Path
*> 1.1.1.1/32 0.0.0.0 0 32768 ?
*> 1.1.1.2/32 0.0.0.0 0 32768 ?
* 2.2.2.2/32 13.1.1.3 0 12345 i
*> 12.1.1.2 0 0 12345 i
* 3.3.3.3/32 12.1.1.2 0 12345 i
*> 13.1.1.3 0 0 12345 i
* 8.8.8.8/32 12.1.1.2 0 12345 8888 i
*> 13.1.1.3 0 12345 8888 i
R1(config)#
错误7：12，13网段被过滤，R2，R3的IBGP邻居要配置下一跳的IP地址为自己
IGP的路由很可能没有直达12，13网段的路由，所以如果指定下一跳的IP是12，13网段很可能会让网络不通，因为最好是转发路由通告的时候，把下一跳的IP指向自己。
查询BGP配置，发现R3已经配置好了，R2没有配置
R2：
router bgp 12345
neighbor 5.5.5.5 next-hop-self
错点8：R8没有开启BGP多路负载均衡
R8#traceroute 1.1.1.1 so lo 0 probe 2
Type escape sequence to abort.
Tracing the route to 1.1.1.1
VRF info: (vrf in name/id, vrf out name/id)
1 6.7.8.7 1 msec 0 msec
2 47.1.1.4 1 msec 0 msec
3 34.1.1.3 1 msec 0 msec
4 13.1.1.1 2 msec *
与目标不一致。因为没有开启多路负载均衡。
R8：
router bgp 8888
maximum-paths 2
检查路径：
R8#traceroute 1.1.1.1 so lo 0 probe 2
Type escape sequence to abort.
Tracing the route to 1.1.1.1
VRF info: (vrf in name/id, vrf out name/id)
1 6.7.8.6 0 msec
6.7.8.7 1 msec
2 56.1.1.5 0 msec
47.1.1.4 1 msec
3 25.1.1.2 1 msec
45.1.1.5 0 msec
4 12.1.1.1 1 msec
25.1.1.2 1 msec
R8#traceroute 1.1.1.2 so lo 0 probe 2
Type escape sequence to abort.
Tracing the route to 1.1.1.2
VRF info: (vrf in name/id, vrf out name/id)
1 6.7.8.6 1 msec
6.7.8.7 1 msec
2 56.1.1.5 0 msec
47.1.1.4 1 msec
3 25.1.1.2 1 msec
45.1.1.5 0 msec
4 12.1.1.1 1 msec
25.1.1.2 0 msec
R8#
查结果发现多路负载均衡时，两个目标网络都是走以下的路径(配合拓扑图分析得出):
R8->R6->R5->R2->R1
R8->R7->R4->R5->R2
从要求上看，去往1.1.1.2的路由符合要求，达到目标，而去往1.1.1.1的第3跳应该是R3或是R4，但在R4上进行路由时，下一跳变成R5，分析R4路由器上的BGP路由表
R4(config-if)#do show ip bgp
......
Network Next Hop Metric LocPrf Weight Path
*>i 1.1.1.1/32 2.2.2.2 0 150 0 1111 ?
*>i 1.1.1.2/32 2.2.2.2 0 150 0 1111 ?
r>i 2.2.2.2/32 2.2.2.2 0 150 0 i
r>i 3.3.3.3/32 3.3.3.3 0 100 0 i
* i 8.8.8.8/32 6.6.6.6 0 100 0 8888 i
*>i 7.7.7.7 0 100 0 8888 i
R4(config-if)#do show ip route
......
1.0.0.0/32 is subnetted, 2 subnets
B 1.1.1.1 [200/0] via 2.2.2.2, 00:08:11
B 1.1.1.2 [200/0] via 2.2.2.2, 00:08:11
2.0.0.0/32 is subnetted, 1 subnets
O 2.2.2.2 [110/21] via 45.1.1.5, 03:38:43, Ethernet0/2
3.0.0.0/32 is subnetted, 1 subnets
O 3.3.3.3 [110/11] via 34.1.1.3, 03:38:43, Ethernet0/0
R4(config-if)#
......
可以看出，R4上的并没有收到R3通告过来关于1.1.1.1的路由信息，查询R3的路由表信息
R3(config-router)#do show ip bgp
......
Network Next Hop Metric LocPrf Weight Path
*>i 1.1.1.1/32 2.2.2.2 0 150 0 1111 ?
* 13.1.1.1 0 0 1111 ?
*>i 1.1.1.2/32 2.2.2.2 0 150 0 1111 ?
* 13.1.1.1 0 0 1111 ?
r>i 2.2.2.2/32 2.2.2.2 0 150 0 i
*> 3.3.3.3/32 0.0.0.0 0 32768 i
*>i 8.8.8.8/32 7.7.7.7 0 100 0 8888 i
R3(config-router)#do show ip bgp 1.1.1.1/32
BGP routing table entry for 1.1.1.1/32, version 11
Paths: (2 available, best #1, table default)
Advertised to update-groups:
1
Refresh Epoch 2
1111
2.2.2.2 (metric 31) from 4.4.4.4 (4.4.4.4)
Origin incomplete, metric 0, localpref 150, valid, internal, best
Originator: 2.2.2.2, Cluster list: 4.4.4.4, 5.5.5.5
rx pathid: 0, tx pathid: 0x0
Refresh Epoch 1
1111
13.1.1.1 from 13.1.1.1 (1.1.1.1)
Origin incomplete, metric 0, localpref 100, valid, external
rx pathid: 0, tx pathid: 0
R3(config-router)#
在R3上可以看到R2和R1通告过来的关于1.1.1.1路由信息。由于R2的local-preference被调整过。所以下一跳为2.2.2.2的路由变成了最优（该路由经过了4.4.4.4和5.5.5.5两个反射器反射到了R3且还是最优，则由R1通告过来的路由就被忽略了不传递给反射器），为了不影响其它的路由选路，最好用Prefix-list或是access-list来修改指定1.1.1.1路由的local-preference值。让从R3到R1的路径变成最优。可以在R2向IBGP的OUT方向，调小1.1.1.1的local-preference，让从R2走的路由优先级变小。从而达到从R3走的目的，（调大R3向IBGP的OUT方向的策略不会生效：因为从R1来的1.1.1.1路由到R3之后并不会被通告出去，所以R3向IBGP的OUT方向不会生效），可以从R1->R3的in方向，调大1.1.1.1的local-preference，让从R3走的路由优先级变大，从而达到从R3走的目的。
错点9：route-map 应用方向错误
查询原有R2调整1.1.1.1路由的local-preference配置：
R2：
access-list 1 permit 1.1.1.1
access-list 1 permit 1.1.1.0
route-map LP permit 10
match ip address 1
set local-preference 99
route-map LP permit 20
router bgp 12345
neighbor 5.5.5.5 route-map LP in
从配置上看，目的是为了调小1.1.1.1的路由local-preference值，降低优先级。达到不从R2走的目的，但是由于1.1.1.1的路由通告方向是从R1->R2->R5(到R5反射器)，而以上的配置则表示是从R5方向接受1.1.1.1路由的时候设置local-preference值为150，显然与实际路由通告的方向不符导致配置失效，现进行以下修改：
R2：
router bgp 12345
no neighbor 5.5.5.5 route-map LP in
neighbor 5.5.5.5 route-map LP out
查询R2，R5的BGP路由表（查询之前记得先清理 do clear ip bgp * soft）
R2(config-router)#do show ip bgp
......
Network Next Hop Metric LocPrf Weight Path
* i 1.1.1.1/32 3.3.3.3 0 100 0 1111 ?
*> 12.1.1.1 0 0 1111 ?
*> 1.1.1.2/32 12.1.1.1 0 0 1111 ?
*> 2.2.2.2/32 0.0.0.0 0 32768 i
r>i 3.3.3.3/32 3.3.3.3 0 100 0 i
*>i 8.8.8.8/32 6.6.6.6 0 100 0 8888 i
R2(config-router)#do show ip bgp 1.1.1.1/32
BGP routing table entry for 1.1.1.1/32, version 6
Paths: (2 available, best #2, table default)
Advertised to update-groups:
6
Refresh Epoch 19
1111
3.3.3.3 (metric 31) from 5.5.5.5 (5.5.5.5)
Origin incomplete, metric 0, localpref 100, valid, internal
Originator: 3.3.3.3, Cluster list: 5.5.5.5, 4.4.4.4
rx pathid: 0, tx pathid: 0
Refresh Epoch 2
1111
12.1.1.1 from 12.1.1.1 (1.1.1.1)
Origin incomplete, metric 0, localpref 150, valid, external, best
rx pathid: 0, tx pathid: 0x0
现在由于降低了R2的1.1.1.1的local-preference值，可以收到R3反射来的路由了。最优路径还是从直连12.1.1.1走，这是合理的
R5(config-router)#do show ip bgp
......
Network Next Hop Metric LocPrf Weight Path
*>i 1.1.1.1/32 3.3.3.3 0 100 0 1111 ?
* i 2.2.2.2 0 99 0 1111 ?
*>i 1.1.1.2/32 2.2.2.2 0 150 0 1111 ?
r>i 2.2.2.2/32 2.2.2.2 0 150 0 i
r>i 3.3.3.3/32 3.3.3.3 0 100 0 i
*>i 8.8.8.8/32 6.6.6.6 0 100 0 8888 i
* i 7.7.7.7 0 100 0 8888 i
R5(config-router)#do show ip route
......
1.0.0.0/32 is subnetted, 2 subnets
B 1.1.1.1 [200/0] via 3.3.3.3, 00:01:19
B 1.1.1.2 [200/0] via 2.2.2.2, 00:48:33
2.0.0.0/32 is subnetted, 1 subnets
O 2.2.2.2 [110/11] via 25.1.1.2, 04:19:05, Ethernet0/3
3.0.0.0/32 is subnetted, 1 subnets
O 3.3.3.3 [110/21] via 45.1.1.4, 04:19:05, Ethernet0/2
......
现在R5去往1.1.1.1目标网络，变成从3.3.3.3的机器走了，3.3.3.3则是走R4的路由，因此目的达成,且去往1.1.1.2的路由不受影响。测试路由如下：
R8#traceroute 1.1.1.1 so lo 0 probe 2
Type escape sequence to abort.
Tracing the route to 1.1.1.1
VRF info: (vrf in name/id, vrf out name/id)
1 6.7.8.6 1 msec
6.7.8.7 0 msec
2 67.1.1.7 0 msec
47.1.1.4 1 msec
3 47.1.1.4 1 msec
34.1.1.3 0 msec
4 34.1.1.3 1 msec
13.1.1.1 1 msec
R8#traceroute 1.1.1.2 so lo 0 probe 2
Type escape sequence to abort.
Tracing the route to 1.1.1.2
VRF info: (vrf in name/id, vrf out name/id)
1 6.7.8.6 1 msec
6.7.8.7 0 msec
2 56.1.1.5 1 msec
47.1.1.4 0 msec
3 25.1.1.2 1 msec
45.1.1.5 0 msec
4 12.1.1.1 0 msec
25.1.1.2 1 msec
R8#
要求已满足。
另外一种方法达到目的
在R3上修改方法
R3:
access-list 1 permit 1.1.1.1
route-map R3-LP permit 10
match ip address 1
set local-preference 151
route-map R3-LP permit 20
router bgp 12345
neighbor 13.1.1.1 route-map R3-LP in
查询R3，R5的BGP路由表（查询之前记得先清理 do clear ip bgp * soft）
R3:
Network Next Hop Metric LocPrf Weight Path
*> 1.1.1.1/32 13.1.1.1 0 151 0 1111 ?
* 1.1.1.2/32 13.1.1.1 0 0 1111 ?
*>i 2.2.2.2 0 150 0 1111 ?
r>i 2.2.2.2/32 2.2.2.2 0 150 0 i
*> 3.3.3.3/32 0.0.0.0 0 32768 i
*>i 8.8.8.8/32 7.7.7.7 0 100 0 8888 i
R5：
Network Next Hop Metric LocPrf Weight Path
*>i 1.1.1.1/32 3.3.3.3 0 151 0 1111 ?
* i 2.2.2.2 0 150 0 1111 ?
*>i 1.1.1.2/32 2.2.2.2 0 150 0 1111 ?
r>i 2.2.2.2/32 2.2.2.2 0 150 0 i
r>i 3.3.3.3/32 3.3.3.3 0 100 0 i
*>i 8.8.8.8/32 6.6.6.6 0 100 0 8888 i
* i 7.7.7.7 0 100 0 8888 i
测试路由
R8#traceroute 1.1.1.1 so lo 0 probe 2
Type escape sequence to abort.
Tracing the route to 1.1.1.1
VRF info: (vrf in name/id, vrf out name/id)
1 6.7.8.6 1 msec
6.7.8.7 0 msec
2 67.1.1.7 0 msec
47.1.1.4 1 msec
3 47.1.1.4 1 msec
34.1.1.3 0 msec
4 34.1.1.3 1 msec
13.1.1.1 1 msec
R8#traceroute 1.1.1.2 so lo 0 probe 2
Type escape sequence to abort.
Tracing the route to 1.1.1.2
VRF info: (vrf in name/id, vrf out name/id)
1 6.7.8.6 1 msec
6.7.8.7 0 msec
2 56.1.1.5 1 msec
47.1.1.4 0 msec
3 25.1.1.2 1 msec
45.1.1.5 0 msec
4 12.1.1.1 0 msec
25.1.1.2 1 msec
R8#
与要求一致目标达成了。
5万+
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
