Lab1 跨域MPLS-虚拟专网 Option C (RR)配置详解

实验拓扑

实验要求

本实验使用Option C完成跨域的MPLS-VPN，R9/10是CE，R1/7是PE，R3/5是ASBR，R2/6是P设备，R4/8是反射器RR。
所有涉及到Router-id的协议，全部手动指定Loopback0地址为RID。
所有BGP协议全部关闭自动建立ipv4单播邻居，若有需要手动建立邻居。

一、ISP公网
1.1 部署IGP
1.1.1 AS100和AS200内运行OSPF，进程1.
1.1.2 除与其他AS互联的接口外，全部使用精确通告，划入区域0.
1.1.3 确认各AS内互通。

1.2 部署MPLS
1.2.1 在AS100和AS200内所有设备上启用MPLS
1.2.2 LSR-ID使用Loopback0地址。
1.2.3 启用LDP协议
1.2.4 在R3/5之间仅启用MPLS，不使用LDP。

1.3 AS100部署IBGP
1.3.1 R1/3/4启用BGP，AS100。R2不启用BGP。
1.3.2 R4作为反射器RR，R1/3作为客户端。
1.3.3 R4使用按组打包方式配置邻居关系，组名称ibgp
1.3.4 使用Loopback0建立邻居关系。
1.3.5 R1和R4建立IPv4和vpnv4邻居关系。
1.3.6 R3和R4仅建立IPv4邻居关系。

1.4 AS200部署IBGP
1.4.1 R5/7/8启用BGP，AS200。R6不启用BGP。
1.4.2 R8作为反射器RR，R7作为客户端。（R7代表了所有的PE）
1.4.3 R8使用按组打包方式配置邻居关系，组名称ibgp
1.4.4 使用Loopback0建立邻居关系。
1.4.5 R7和R8仅建立vpnv4邻居关系。
1.4.6 R5和R8不建立邻居关系。

1.5 部署EBGP
1.5.1 R3和R5使用物理接口建立ipv4单播邻居关系。
1.5.2 R3宣告R4的Loopback0路由；R5宣告R8的Loopback0路由。
1.5.3 完成其他必要配置，确认R4和R8的Loopback0互通。
1.5.3 R4和R8建立vpnv4邻居关系，EBGP多跳为255。

二、部署VPN
2.1 建立BGP-LSP
Option C的特点是只有PE维护私网路由，R1收到R10的私网路由下一跳为R7，反之亦然。所以必须先打通R1-R7的BGP-LSP。
2.1.1 R3宣告R1的Loopback0；R5宣告R7的Looback0。
2.1.2 R3/5配置路由策略p1,node 10分配mpls标签。
2.1.3 R3和R5互相发送路由可分配标签，并使用路由策略p1。
2.1.4 R3配置路由策略p2,node10为携带mpls标签的路由分配本地标签。
2.1.5 R3将BGP路由传递给R4时分配标签,使用路由策略p2。
2.1.6 R4反射路由时也携带标签信息。
2.1.7 R5允许LDP为BGP路由分配标签。

2.2 创建VRF
2.2.1 在R1上创建VRF，名称9，RD 9:9 ,出向RT 9:10,配置合适的入向RT。
2.2.2 在R7上创建VRF，名称10，RD10:10,出向RT10:9,配置合适的入向RT。
2.2.3 R1的G0/0/1划入VRF9，并配置IP地址192.168.1.1/24
2.2.4 R7的G0/0/1划入VRF10，并配置IP地址192.168.7.7/24

2.3 部署CE-PE协议
2.3.1 R9是AS9的CE设备，和R1建立BGP邻居关系。
2.3.2 R10是AS10的CE设备，和R7建立BGP邻居关系。

2.4 宣告VPN路由
2.4.1 R9和R10分别宣告Loopback0的路由。
2.4.2 确认RR转发路由，且R1/7收到的路由下一跳是对端PE。
2.4.3 确认R9和R10收到对端路由，且可以通信。

配置步骤

不每一步详写，仅给出所有设备的全部配置，请自行查看！！

R1

<R1>dis cu
[V200R003C00]
#
 sysname R1
#
 snmp-agent local-engineid 800007DB03000000000000
 snmp-agent 
#
 clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
 drop illegal-mac alarm
#
 wlan ac-global carrier id other ac id 0
#
 set cpu-usage threshold 80 restore 75
#
ip vpn-instance 9
 ipv4-family
  route-distinguisher 9:9
  vpn-target 9:10 export-extcommunity
  vpn-target 10:9 import-extcommunity
#
mpls lsr-id 1.1.1.1
mpls                                      
#
mpls ldp
#
#
aaa 
 authentication-scheme default
 authorization-scheme default
 accounting-scheme default
 domain default 
 domain default_admin 
 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
 local-user admin service-type http
#
firewall zone Local
 priority 15
#
interface GigabitEthernet0/0/0
 ip address 12.1.1.1 255.255.255.0 
 mpls
 mpls ldp
#
interface GigabitEthernet0/0/1
 ip binding vpn-instance 9
 ip address 192.168.1.1 255.255.255.0     
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
 ip address 1.1.1.1 255.255.255.255 
#
bgp 100
 router-id 1.1.1.1
 undo default ipv4-unicast
 peer 4.4.4.4 as-number 100 
 peer 4.4.4.4 connect-interface LoopBack0
 #
 ipv4-family unicast
  undo synchronization
  peer 4.4.4.4 enable
  peer 4.4.4.4 label-route-capability
 # 
 ipv4-family vpnv4
  policy vpn-target
  peer 4.4.4.4 enable
 #
 ipv4-family vpn-instance 9               
  peer 192.168.1.9 as-number 9 
#
ospf 1 router-id 1.1.1.1 
 area 0.0.0.0 
  network 1.1.1.1 0.0.0.0 
  network 12.1.1.1 0.0.0.0 
#
user-interface con 0
 authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return

R2

<R2>dis cu
[V200R003C00]
#
 sysname R2
#
 snmp-agent local-engineid 800007DB03000000000000
 snmp-agent 
#
 clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
 drop illegal-mac alarm
#
 wlan ac-global carrier id other ac id 0
#
 set cpu-usage threshold 80 restore 75
#
mpls lsr-id 2.2.2.2
mpls
#
mpls ldp
#
#
aaa 
 authentication-scheme default            
 authorization-scheme default
 accounting-scheme default
 domain default 
 domain default_admin 
 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
 local-user admin service-type http
#
firewall zone Local
 priority 15
#
interface GigabitEthernet0/0/0
 ip address 12.1.1.2 255.255.255.0 
 mpls
 mpls ldp
#
interface GigabitEthernet0/0/1
 ip address 23.1.1.2 255.255.255.0 
 mpls
 mpls ldp
#
interface GigabitEthernet0/0/2
 ip address 24.1.1.2 255.255.255.0 
 mpls
 mpls ldp                                 
#
interface NULL0
#
interface LoopBack0
 ip address 2.2.2.2 255.255.255.255 
#
ospf 1 router-id 2.2.2.2 
 area 0.0.0.0 
  network 2.2.2.2 0.0.0.0 
  network 12.1.1.2 0.0.0.0 
  network 23.1.1.2 0.0.0.0 
  network 24.1.1.2 0.0.0.0 
#
user-interface con 0
 authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return

R3

<R3>dis cu
[V200R003C00]
#
 sysname R3
#
 snmp-agent local-engineid 800007DB03000000000000
 snmp-agent 
#
 clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
 drop illegal-mac alarm
#
 wlan ac-global carrier id other ac id 0
#
 set cpu-usage threshold 80 restore 75
#
mpls lsr-id 3.3.3.3
mpls
#
mpls ldp
#
#
aaa 
 authentication-scheme default            
 authorization-scheme default
 accounting-scheme default
 domain default 
 domain default_admin 
 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
 local-user admin service-type http
#
firewall zone Local
 priority 15
#
interface GigabitEthernet0/0/0
 ip address 23.1.1.3 255.255.255.0 
 mpls
 mpls ldp
#
interface GigabitEthernet0/0/1
 ip address 35.1.1.3 255.255.255.0 
 mpls
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0                       
 ip address 3.3.3.3 255.255.255.255 
#
bgp 100
 router-id 3.3.3.3
 undo default ipv4-unicast
 peer 4.4.4.4 as-number 100 
 peer 4.4.4.4 connect-interface LoopBack0
 peer 35.1.1.5 as-number 200 
 #
 ipv4-family unicast
  undo synchronization
  network 1.1.1.1 255.255.255.255 
  network 4.4.4.4 255.255.255.255 
  peer 4.4.4.4 enable
  peer 4.4.4.4 route-policy p2 export
  peer 4.4.4.4 next-hop-local 
  peer 4.4.4.4 label-route-capability
  peer 35.1.1.5 enable
  peer 35.1.1.5 route-policy p1 export
  peer 35.1.1.5 label-route-capability
 # 
 ipv4-family vpnv4
  policy vpn-target
#                                         
ospf 1 router-id 3.3.3.3 
 area 0.0.0.0 
  network 3.3.3.3 0.0.0.0 
  network 23.1.1.3 0.0.0.0 
#
route-policy p1 permit node 10 
 apply mpls-label
#
route-policy p2 permit node 20 
 if-match mpls-label 
 apply mpls-label
#
user-interface con 0
 authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return

R4

<R4>dis cu
[V200R003C00]
#
 sysname R4
#
 snmp-agent local-engineid 800007DB03000000000000
 snmp-agent 
#
 clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
 drop illegal-mac alarm
#
 wlan ac-global carrier id other ac id 0
#
 set cpu-usage threshold 80 restore 75
#
mpls lsr-id 4.4.4.4
mpls
#
mpls ldp
#
#
aaa 
 authentication-scheme default            
 authorization-scheme default             
 accounting-scheme default
 domain default 
 domain default_admin 
 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
 local-user admin service-type http
#
firewall zone Local
 priority 15
#
interface GigabitEthernet0/0/0
 ip address 24.1.1.4 255.255.255.0 
 mpls
 mpls ldp
#
interface GigabitEthernet0/0/1
 mpls
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
 ip address 4.4.4.4 255.255.255.255 
#                                         
bgp 100
 router-id 4.4.4.4
 undo default ipv4-unicast
 peer 8.8.8.8 as-number 200 
 peer 8.8.8.8 ebgp-max-hop 255 
 peer 8.8.8.8 connect-interface LoopBack0
 group ibgp internal
 peer ibgp connect-interface LoopBack0
 peer 1.1.1.1 as-number 100 
 peer 1.1.1.1 group ibgp 
 peer 3.3.3.3 as-number 100 
 peer 3.3.3.3 group ibgp 
 #
 ipv4-family unicast
  undo synchronization
  undo peer 8.8.8.8 enable
  peer ibgp enable
  peer ibgp reflect-client
  peer ibgp next-hop-invariable 
  peer ibgp label-route-capability
  peer 1.1.1.1 enable
  peer 1.1.1.1 group ibgp 
  peer 3.3.3.3 enable
  peer 3.3.3.3 group ibgp                 
 # 
 ipv4-family vpnv4
  undo policy vpn-target
  peer 8.8.8.8 enable
  peer ibgp enable
  peer ibgp reflect-client
  peer 1.1.1.1 enable
  peer 1.1.1.1 group ibgp 
#
ospf 1 router-id 4.4.4.4 
 area 0.0.0.0 
  network 4.4.4.4 0.0.0.0 
  network 24.1.1.4 0.0.0.0 
#
route recursive-lookup tunnel
#
user-interface con 0
 authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return

R5

<R5>dis cu
[V200R003C00]
#
 sysname R5
#
 snmp-agent local-engineid 800007DB03000000000000
 snmp-agent 
#
 clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
 drop illegal-mac alarm
#
 wlan ac-global carrier id other ac id 0
#
 set cpu-usage threshold 80 restore 75
#
mpls lsr-id 5.5.5.5
mpls
 lsp-trigger bgp-label-route
#
mpls ldp
#
#
aaa                                       
 authentication-scheme default
 authorization-scheme default
 accounting-scheme default
 domain default 
 domain default_admin 
 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
 local-user admin service-type http
#
firewall zone Local
 priority 15
#
interface GigabitEthernet0/0/0
 ip address 56.1.1.5 255.255.255.0 
 mpls
 mpls ldp
#
interface GigabitEthernet0/0/1
 ip address 35.1.1.5 255.255.255.0 
 mpls
#
interface GigabitEthernet0/0/2
#
interface NULL0
#                                         
interface LoopBack0
 ip address 5.5.5.5 255.255.255.255 
#
bgp 200
 router-id 5.5.5.5
 undo default ipv4-unicast
 peer 35.1.1.3 as-number 100 
 #
 ipv4-family unicast
  undo synchronization
  network 7.7.7.7 255.255.255.255 
  network 8.8.8.8 255.255.255.255 
  peer 35.1.1.3 enable
  peer 35.1.1.3 route-policy p1 export
  peer 35.1.1.3 label-route-capability
 #
 ipv6-family unicast
  undo synchronization
#
ospf 1 router-id 5.5.5.5 
 import-route bgp
 area 0.0.0.0 
  network 5.5.5.5 0.0.0.0 
  network 56.1.1.5 0.0.0.0                
#
route-policy p1 permit node 10 
 apply mpls-label
#
user-interface con 0
 authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return

R6

<R6>dis cu
[V200R003C00]
#
 sysname R6
#
 snmp-agent local-engineid 800007DB03000000000000
 snmp-agent 
#
 clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
 drop illegal-mac alarm
#
 wlan ac-global carrier id other ac id 0
#
 set cpu-usage threshold 80 restore 75
#
mpls lsr-id 6.6.6.6
mpls
#
mpls ldp
#
#
aaa 
 authentication-scheme default            
 authorization-scheme default
 accounting-scheme default
 domain default 
 domain default_admin 
 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
 local-user admin service-type http
#
firewall zone Local
 priority 15
#
interface GigabitEthernet0/0/0
 ip address 56.1.1.6 255.255.255.0 
 mpls
 mpls ldp
#
interface GigabitEthernet0/0/1
 ip address 67.1.1.6 255.255.255.0 
 mpls
 mpls ldp
#
interface GigabitEthernet0/0/2
 ip address 68.1.1.6 255.255.255.0 
 mpls
 mpls ldp                                 
#
interface NULL0
#
interface LoopBack0
 ip address 6.6.6.6 255.255.255.255 
#
ospf 1 router-id 6.6.6.6 
 area 0.0.0.0 
  network 6.6.6.6 0.0.0.0 
  network 56.1.1.6 0.0.0.0 
  network 67.1.1.6 0.0.0.0 
  network 68.1.1.6 0.0.0.0 
#
user-interface con 0
 authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return

R7

<R7>dis cu
[V200R003C00]
#
 sysname R7
#
 snmp-agent local-engineid 800007DB03000000000000
 snmp-agent 
#
 clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
 drop illegal-mac alarm
#
 wlan ac-global carrier id other ac id 0
#
 set cpu-usage threshold 80 restore 75
#
ip vpn-instance 10
 ipv4-family
  route-distinguisher 10:10
  vpn-target 10:9 export-extcommunity
  vpn-target 9:10 import-extcommunity
#
mpls lsr-id 7.7.7.7
mpls                                      
#
mpls ldp
#
#
aaa 
 authentication-scheme default
 authorization-scheme default
 accounting-scheme default
 domain default 
 domain default_admin 
 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
 local-user admin service-type http
#
firewall zone Local
 priority 15
#
interface GigabitEthernet0/0/0
 ip address 67.1.1.7 255.255.255.0 
 mpls
 mpls ldp
#
interface GigabitEthernet0/0/1
 ip binding vpn-instance 10
 ip address 192.168.7.7 255.255.255.0     
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
 ip address 7.7.7.7 255.255.255.255 
#
bgp 200
 router-id 7.7.7.7
 undo default ipv4-unicast
 peer 8.8.8.8 as-number 200 
 peer 8.8.8.8 connect-interface LoopBack0
 #
 ipv4-family unicast
  undo synchronization
  undo peer 8.8.8.8 enable
 # 
 ipv4-family vpnv4
  policy vpn-target
  peer 8.8.8.8 enable
 #
 ipv4-family vpn-instance 10 
  peer 192.168.7.10 as-number 10          
#
ospf 1 router-id 7.7.7.7 
 area 0.0.0.0 
  network 7.7.7.7 0.0.0.0 
  network 67.1.1.7 0.0.0.0 
#
user-interface con 0
 authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return

R8

<R8>DIS CU 
[V200R003C00]
#
 sysname R8
#
 snmp-agent local-engineid 800007DB03000000000000
 snmp-agent 
#
 clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
 drop illegal-mac alarm
#
 wlan ac-global carrier id other ac id 0
#
 set cpu-usage threshold 80 restore 75
#
mpls lsr-id 8.8.8.8
mpls
#
mpls ldp
#
#
aaa 
 authentication-scheme default            
 authorization-scheme default             
 accounting-scheme default                
 domain default 
 domain default_admin 
 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
 local-user admin service-type http
#
firewall zone Local
 priority 15
#
interface GigabitEthernet0/0/0
 ip address 68.1.1.8 255.255.255.0 
 mpls
 mpls ldp
#
interface GigabitEthernet0/0/1
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
 ip address 8.8.8.8 255.255.255.255 
#
bgp 200
 router-id 8.8.8.8                        
 undo default ipv4-unicast
 peer 4.4.4.4 as-number 100 
 peer 4.4.4.4 ebgp-max-hop 255 
 peer 4.4.4.4 connect-interface LoopBack0
 group ibgp internal
 peer ibgp connect-interface LoopBack0
 peer 7.7.7.7 as-number 200 
 peer 7.7.7.7 group ibgp 
 #
 ipv4-family unicast
  undo synchronization
  undo peer ibgp enable
  undo peer 4.4.4.4 enable
  undo peer 7.7.7.7 enable
 # 
 ipv4-family vpnv4
  undo policy vpn-target
  peer 4.4.4.4 enable
  peer 4.4.4.4 next-hop-invariable 
  peer ibgp enable
  peer ibgp reflect-client
  peer 7.7.7.7 enable
  peer 7.7.7.7 group ibgp 
#                                         
ospf 1 router-id 8.8.8.8 
 area 0.0.0.0 
  network 8.8.8.8 0.0.0.0 
  network 68.1.1.8 0.0.0.0 
#
user-interface con 0
 authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return

R9

<R9>dis cu
[V200R003C00]
#
 sysname R9
#
 snmp-agent local-engineid 800007DB03000000000000
 snmp-agent 
#
 clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
 drop illegal-mac alarm
#
 wlan ac-global carrier id other ac id 0
#
 set cpu-usage threshold 80 restore 75
#
aaa 
 authentication-scheme default
 authorization-scheme default
 accounting-scheme default
 domain default 
 domain default_admin 
 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
 local-user admin service-type http       
#
firewall zone Local
 priority 15
#
interface GigabitEthernet0/0/0
 ip address 192.168.1.9 255.255.255.0 
#
interface GigabitEthernet0/0/1
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
 ip address 192.168.9.9 255.255.255.255 
#
bgp 9
 router-id 192.168.9.9
 undo default ipv4-unicast
 peer 192.168.1.1 as-number 100 
 #
 ipv4-family unicast
  undo synchronization
  network 192.168.9.9 255.255.255.255     
  peer 192.168.1.1 enable
#
user-interface con 0
 authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return

R10

<R10>dis cu
[V200R003C00]
#
 sysname R10
#
 snmp-agent local-engineid 800007DB03000000000000
 snmp-agent 
#
 clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
 drop illegal-mac alarm
#
 wlan ac-global carrier id other ac id 0
#
 set cpu-usage threshold 80 restore 75
#
aaa 
 authentication-scheme default
 authorization-scheme default
 accounting-scheme default
 domain default 
 domain default_admin 
 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
 local-user admin service-type http       
#                                         
firewall zone Local
 priority 15
#
interface GigabitEthernet0/0/0
 ip address 192.168.7.10 255.255.255.0 
#
interface GigabitEthernet0/0/1
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
 ip address 192.168.10.10 255.255.255.255 
#
bgp 10
 router-id 192.168.10.10
 undo default ipv4-unicast
 peer 192.168.7.7 as-number 200 
 #
 ipv4-family unicast
  undo synchronization
  network 192.168.10.10 255.255.255.255 
  peer 192.168.7.7 enable                 
#
user-interface con 0
 authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return

完结！