HCIP-DATACOM核心网络技术(MPLS-VPN实验)

如图所示，客户X与Y各自有2个站点，现需要通过MPLS VPN 实现站点之间的互联，分别对应VPNX和VPNY，互联接口、AS号及IP地址信息，CE与PE通过OSPF、ISIS、BGP、静态路由四种协议方式交换路由信息。

1.配置IP地址(按上图所配)

注意：CE与PE之间所连接的接口【PE设备】不需要配置IP地址，到后面绑定VPN实例时再配置IP地址（接口需要划分到VRF空间中）
CE1:

[Huawei]sys CE1
[CE1]int LoopBack 0
[CE1-LoopBack0]ip address 192.168.1.1 24
[CE1-LoopBack0]int g0/0/0
[CE1-GigabitEthernet0/0/0]ip address 192.168.100.1 24

CE2:

[Huawei]sysname CE2
[CE2]int LoopBack 0
[CE2-LoopBack0]ip address 192.168.2.1 24
[CE2-LoopBack0]int g0/0/0
[CE2-GigabitEthernet0/0/0]ip address 192.168.200.1 24

CE3:

[Huawei]sys CE3
[CE3]int LoopBack 0
[CE3-LoopBack0]ip address 192.168.1.1 24
[CE3-LoopBack0]int g0/0/0
[CE3-GigabitEthernet0/0/0]ip address 192.168.100.1 24

CE4:

[Huawei]sysname CE4
[CE4]int LoopBack 0
[CE4-LoopBack0]ip address 192.168.2.1 24
[CE4-LoopBack0]int g0/0/0
[CE4-GigabitEthernet0/0/0]ip address 192.168.200.1 24

PE1:

[Huawei]sysname PE1
[PE1]int l0	
[PE1-LoopBack0]ip address 1.1.1.1 32
[PE1-LoopBack0]int g0/0/0
[PE1-GigabitEthernet0/0/0]ip address 10.0.12.1 24

P:

[Huawei]sysname P
[P]interface LoopBack 0
[P-LoopBack0]ip address 2.2.2.2 32
[P-LoopBack0]int g0/0/0
[P-GigabitEthernet0/0/0]ip address 10.0.12.2 24
[P-GigabitEthernet0/0/0]int g0/0/1
[P-GigabitEthernet0/0/1]ip address 10.0.23.1 24

PE2:

[Huawei]sysname PE2
[PE2]interface LoopBack 0
[PE2-LoopBack0]ip address 3.3.3.3 24
[PE2-LoopBack0]int g0/0/0
[PE2-GigabitEthernet0/0/0]ip address 10.0.23.2 24

2.MPLS-VPN骨干网的配置

2.1 IGP配置，实现骨干网的连通性（OSPF、ISIS、RIP都可以，接下来我用OSPF协议做演示）

PE1:

[PE1]ospf 1 router-id 1.1.1.1
[PE1-ospf-1]area 0
[PE1-ospf-1-area-0.0.0.0]network 1.1.1.1 0.0.0.0
[PE1-ospf-1-area-0.0.0.0]network 10.0.12.1 0.0.0.0

P:

[P]ospf 1 router-id 2.2.2.2
[P-ospf-1]area 0
[P-ospf-1-area-0.0.0.0]network 2.2.2.2 0.0.0.0
[P-ospf-1-area-0.0.0.0]network 10.0.12.2 0.0.0.0
[P-ospf-1-area-0.0.0.0]network 10.0.23.1 0.0.0.0

PE2:

[PE2]ospf 1 router-id 3.3.3.3
[PE2-ospf-1]area 0	
[PE2-ospf-1-area-0.0.0.0]network 3.3.3.3 0.0.0.0
[PE2-ospf-1-area-0.0.0.0]network 10.0.23.2 0.0.0.0

测试连通性：

2.2 配置MPLS 与 MPLS LDP，建立MPLS lsp 公网隧道，传输VPN数据

PE1:

[PE1]mpls lsr-id 1.1.1.1
[PE1]mpls
Info: Mpls starting, please wait... OK!
[PE1-mpls]q	
[PE1]mpls ldp 
[PE1-mpls-ldp]q
[PE1]int g0/0/0
[PE1-GigabitEthernet0/0/0]mpls
[PE1-GigabitEthernet0/0/0]mpls ldp 

P:

[P]mpls lsr-id 2.2.2.2
[P]mpls 
Info: Mpls starting, please wait... OK!
[P-mpls]q
[P]mpls ldp 
[P-mpls-ldp]q
[P]int g0/0/0
[P-GigabitEthernet0/0/0]mpls ld	
[P-GigabitEthernet0/0/0]mpls ldp 
[P-GigabitEthernet0/0/0]int g0/0/1
[P-GigabitEthernet0/0/1]mpls 
[P-GigabitEthernet0/0/1]mpls ldp 

PE2:

[PE2]mpls lsr-id 3.3.3.3
[PE2]mpls
Info: Mpls starting, please wait... OK!
[PE2-mpls]q
[PE2]mpls ldp 
[PE2-mpls-ldp]q
[PE2]int g0/0/0
[PE2-GigabitEthernet0/0/0]mpls
[PE2-GigabitEthernet0/0/0]mpls ldp 

查看MPLS标签传输：

查看LDP对等体关系和LDP会话：

2.3 配置MP-BGP，建立后续传递vpnv4路由的MP-BGP对等体关系

PE1:

[PE1]bgp 123
[PE1-bgp]peer 3.3.3.3 as-number 123
[PE1-bgp]peer 3.3.3.3 connect-interface LoopBack 0
[PE1-bgp]ipv4-family vpnv4 unicast 
[PE1-bgp-af-vpnv4]peer 3.3.3.3 enable 

PE2:

[PE2]bgp 123
[PE2-bgp]peer 1.1.1.1 as-number 123
[PE2-bgp]peer 1.1.1.1 connect-interface LoopBack 0
[PE2-bgp]ipv4-family vpnv4 unicast 
[PE2-bgp-af-vpnv4]peer 1.1.1.1 enable 

3.VPN用户接入配置

3.1 创建VPN实例并配置参数(RT、RD)，这里有俩个站点，需要配置俩个VPN实例–xxx与yyy

PE1:

[PE1]ip vpn-instance xxx          --实例xxx
[PE1-vpn-instance-xxx]route-distinguisher 100:100  
[PE1-vpn-instance-xxx-af-ipv4]vpn-target 100:1 import-extcommunity 
 IVT Assignment result: 
Info: VPN-Target assignment is successful.
[PE1-vpn-instance-xxx-af-ipv4]vpn-target 100:2 export-extcommunity 
 EVT Assignment result: 
Info: VPN-Target assignment is successful.
[PE1-vpn-instance-xxx-af-ipv4]q
[PE1-vpn-instance-xxx]q

[PE1]ip vpn-instance yyy     --实例yyy
[PE1-vpn-instance-yyy]route-distinguisher 200:200
[PE1-vpn-instance-yyy-af-ipv4]vpn-target 200:1 import-extcommunity 
 IVT Assignment result: 
Info: VPN-Target assignment is successful.
[PE1-vpn-instance-yyy-af-ipv4]vpn-target 200:2 ex	
[PE1-vpn-instance-yyy-af-ipv4]vpn-target 200:2 export-extcommunity 
 EVT Assignment result: 
Info: VPN-Target assignment is successful.

PE2:

[PE2]ip vpn-instance xxx       --实例xxx
[PE2-vpn-instance-xxx]route-distinguisher 100:100
[PE2-vpn-instance-xxx-af-ipv4]vpn-target 100:1 export-extcommunity      --入向RT值与出向RT值相反
 EVT Assignment result: 
Info: VPN-Target assignment is successful.
[PE2-vpn-instance-xxx-af-ipv4]vpn-target 100:2 import-extcommunity 
 IVT Assignment result: 
Info: VPN-Target assignment is successful.
[PE2-vpn-instance-xxx-af-ipv4]q
[PE2-vpn-instance-xxx]q

[PE2]ip vpn-instance yyy     --实例yyy
[PE2-vpn-instance-yyy]route-distinguisher 200:200	
[PE2-vpn-instance-yyy-af-ipv4]vpn-target 200:1 export-extcommunity 
 EVT Assignment result: 
Info: VPN-Target assignment is successful.
[PE2-vpn-instance-yyy-af-ipv4]vpn-target 200:2 import-extcommunity 
 IVT Assignment result: 
Info: VPN-Target assignment is successful.

3.2 将接口划入VPN实例

PE1:

[PE1]int g0/0/1
[PE1-GigabitEthernet0/0/1]ip binding vpn-instance xxx
Info: All IPv4 related configurations on this interface are removed!
Info: All IPv6 related configurations on this interface are removed!
[PE1-GigabitEthernet0/0/1]ip address 192.168.100.2 24
Jan  6 2024 20:34:47-08:00 PE1 %%01IFNET/4/LINK_STATE(l)[8]:The line protocol IP
 on the interface GigabitEthernet0/0/1 has entered the UP state. 
[PE1-GigabitEthernet0/0/1]q
[PE1]int g0/0/2
[PE1-GigabitEthernet0/0/2]ip binding vpn-instance yyy
Info: All IPv4 related configurations on this interface are removed!
Info: All IPv6 related configurations on this interface are removed!
[PE1-GigabitEthernet0/0/2]ip address 192.168.100.2 24

PE2:

[PE2]int g0/0/1
[PE2-GigabitEthernet0/0/1]ip binding vpn-instance xxx
Info: All IPv4 related configurations on this interface are removed!
Info: All IPv6 related configurations on this interface are removed!
[PE2-GigabitEthernet0/0/1]ip address 192.168.200.2 24
Jan  6 2024 20:35:52-08:00 PE2 %%01IFNET/4/LINK_STATE(l)[8]:The line protocol IP
 on the interface GigabitEthernet0/0/1 has entered the UP state. 
[PE2-GigabitEthernet0/0/1]q
[PE2]int g0/0/2
[PE2-GigabitEthernet0/0/2]ip binding vpn-instance yyy
Info: All IPv4 related configurations on this interface are removed!
Info: All IPv6 related configurations on this interface are removed!
[PE2-GigabitEthernet0/0/2]ip address 192.168.200.2 24
Jan  6 2024 20:36:17-08:00 PE2 %%01IFNET/4/LINK_STATE(l)[9]:The line protocol IP
 on the interface GigabitEthernet0/0/2 has entered the UP state. 

3.3 配置PE1-CE1、PE2-CE2之间的路由交换

3.3.1 PE1与CE1之间部署OSPF协议

注意：PE设备运行的OSPF协议需要进入VRF空间宣告路由
PE1:

[PE1]ospf 11 vpn-instance xxx  
[PE1-ospf-11]area 1
[PE1-ospf-11-area-0.0.0.1]net	
[PE1-ospf-11-area-0.0.0.1]network 192.168.100.2 0.0.0.0

CE1:

[CE1]ospf 11
[CE1-ospf-11]area 1
[CE1-ospf-11-area-0.0.0.1]network 192.168.1.1 0.0.0.0
[CE1-ospf-11-area-0.0.0.1]network 192.168.100.1 0.0.0.0

3.3.2 PE2与CE2之间部署静态路由

CE2: （需要配置到达站点A的所有网段的静态路由）

[CE2]ip route-static 192.168.1.0 24 192.168.200.2
[CE2]ip route-static 192.168.100.0 24 192.168.200.2

至此，就配置好客户X的路由信息，但是PE1-PE2、CE1-CE2仍然没有对方的路由信息，在这里需要在PE设备上进行路由重发布
PE1

[PE1]bgp 123
[PE1-bgp]ipv4-family vpn-instance xxx	
[PE1-bgp-xxx]import-route ospf  11

[PE1]ospf 11 vpn-instance xxx
[PE1-ospf-11]import-route bgp 

PE2:

[PE2]ip route-static vpn-instance xxx 192.168.2.0 24 192.168.200.1

[PE2]bgp 123
[PE2-bgp]ipv4-family vpn-instance xxx
[PE2-bgp-xxx]import-route static 
[PE2-bgp-xxx]import-route direct 

测试：查看PE1与PE2的vpnv4路由–vpn实例xxx


查看CE1与CE2的路由信息以及连通性：

3.4 配置PE1-CE3、PE2-CE4之间的路由交换

3.4.1 PE1与CE3之间部署EBGP协议

==注意：PE与CE之间使用BGP交换路由时，不需要在PE上执行路由重发布
PE1:

[PE1]bgp 123
[PE1-bgp]ipv4-family vpn-instance yyy
[PE1-bgp-yyy]peer 192.168.100.1 as-number 100

CE3:

[CE3]bgp 100
[CE3-bgp]router-id 192.168.1.1
[CE3-bgp]peer 192.168.100.2 as-number 123
[CE3-bgp]network 192.168.1.0 24

3.4.2 PE2与CE4之间部署ISIS协议

PE2:

[PE2]isis 300 vpn-instance yyy
[PE2-isis-300]is-level level-2
[PE2-isis-300]network-entity 49.0001.0000.0002.00
Jan  6 2024 21:29:40-08:00 PE2 %%01ISIS/4/START_ENABLE_ISIS(l)[10]:ISIS 11265 en
abled all ISIS modules. 
[PE2-isis-300]q
[PE2]int g0/0/2
[PE2-GigabitEthernet0/0/2]isis enable 300

CE4:

[CE4]isis 300
[CE4-isis-300]is-level level-2 
[CE4-isis-300]network-entity 4900.0100.0000.0001.00
Jan  6 2024 21:27:30-08:00 CE4 %%01ISIS/4/START_ENABLE_ISIS(l)[1]:ISIS 11265 ena
bled all ISIS modules. 
[CE4-isis-300]q
[CE4]int g0/0/0
[CE4-GigabitEthernet0/0/0]isis enable 300	
[CE4]int LoopBack 0
[CE4-LoopBack0]isis enable 300

至此，就配置好客户Y的路由信息，但是PE1-PE2、CE3-CE4仍然没有对方的路由信息，在这里需要在PE设备上进行路由重发布
PE2:

[PE2]bgp 123
[PE2-bgp]ipv4-family vpn-instance yyy
[PE2-bgp-yyy]import-route isis 300

[PE2]isis 300 vpn-instance yyy
[PE2-isis-300]import-route bgp 

测试：查看PE1与PE2的vpnv4路由–vpn实例yyy

查看CE3与CE4的路由信息以及连通性：




至此，整个MPLS-VPN实验大功告成！！