70.配置部署MPLS L3VPN 跨域Option A

提示：文章写完后，目录可以自动生成，如何生成可参考右边的帮助文档

---

71.部署 MPLS VPN跨域 Option-B 无RR （含排障思路）

前言

两个AS的边界路由器ASBR直接相连，ASBR同时也是各自所在自治系统的PE；两个ASBR都把对端ASBR看作自己的CE设 备，通过EBGP对等体关系向对端发布IPv4路由

---

提示：以下是本篇文章正文内容，下面案例可供参考

一、Option A

ASBR将对端AS的ASBR视为一台CE设备，并使用VRF接口与其对接；两个AS的ASBR之间交互IPv4形态的VPN路由

由于ASBR需要管理所有VPN路由，为每个VPN创建VPN实例，这将导致ASBR上的VPNv4路 由数量过大；

并且，由于ASBR间是普通的IP转发，要求为每个跨域的VPN使用不同的接口【可以是子接口、物理接口、捆绑的逻辑接 口】，因此对ASBR设备有较高的要求

Option A 控制平面

1、CE1通告IPv4路由给PE1，路由的下一跳为CE1
2、PE1将IPv4路由转化为VPNv4路由发送给ASBR-PE1，并且设置下一跳为PE1，分配VPN标签V1
3、PE1、P1分别为去往PE1的路由分配隧道标签T1、T2
4、ASBR-PE1将VPNv4路由转化为IPv4路由发送给ASBR-PE2,并且设置下一跳为ASBR-PE1
5、ASBR-PE2将IPv4路由转化为VPNv4路由发送给PE2，并且设置下一跳为ASBR-PE2，分配VPN标签V2
6、ASBR-PE2、P2分别为去往ASBR-PE2的路由分配隧道标签T3、T4
7、PE2将VPNv4路由转变为IPv4路由，通告给CE2，并且设置下一跳为PE2
注：本例中的数字编号仅为方便理解，并不代表设备真实的处理顺序

Option A 转发平面

1、CE2发送一个目的地为Net1的IP报文给PE2
2、PE2收到IP报文后，先封装VPN标签V2，再封装外层标签T4，然后将此报文发送给P2
3、P2把外层标签T4换成T3，然后将此报文发送给ASBR-PE24、ASBR-PE2去掉所有标签，将IP报文转发给ASBR-PE1
5、ASBR-PE1收到IP报文后先封装VPN标签V1，再封装外层标签T2，然后将此报文发送给P1
6、P1进行标签交换，把外层标签T2换成T1，然后将此报文发送给PE1 7、PE1收到后去掉所有标签，将IP报文转发给CE1

二、基础配置

1.接口地址+测试地址 （直接黏贴方便敲别的）

CE1
防止弹出+

sys
us co 0
id 0 0
q

interface GigabitEthernet0/0/0
 ip address 10.1.1.2 255.255.255.252 
interface LoopBack0
 ip address 7.7.7.7 255.255.255.255 
interface LoopBack1
 ip address 192.168.1.1 255.255.255.0 

PE1

sys
sysname PE1
interface GigabitEthernet0/0/0
 ip address 12.1.1.1 255.255.255.252 
interface GigabitEthernet0/0/1
 ip address 10.1.1.1 255.255.255.252 
interface LoopBack0
 ip address 1.1.1.1 255.255.255.255 

P1

sys
sysname P1
interface GigabitEthernet0/0/0
 ip address 23.1.1.1 255.255.255.252 
interface GigabitEthernet0/0/1
 ip address 12.1.1.2 255.255.255.252 
 interface LoopBack0
 ip address 2.2.2.2 255.255.255.255 

ASBR-PE1
G0/0/2 的地址可以不敲反正配置VRF的时候地址会消失= =

sys 
 sysname ASBR-PE1
interface GigabitEthernet0/0/1
 ip address 23.1.1.2 255.255.255.252 
interface GigabitEthernet0/0/2
 ip address 202.106.0.1 255.255.255.252 
interface LoopBack0
 ip address 3.3.3.3 255.255.255.255

ASBR-PE2

sys
 sysname ASBR-PE2 
interface GigabitEthernet0/0/1
 ip address 45.1.1.1 255.255.255.252 
interface GigabitEthernet0/0/2
 ip address 202.106.0.2 255.255.255.252 
interface LoopBack0
 ip address 4.4.4.4 255.255.255.255 

P2

sys
 sysname P2
interface GigabitEthernet0/0/0
 ip address 45.1.1.2 255.255.255.252 
interface GigabitEthernet0/0/1
 ip address 56.1.1.1 255.255.255.252 
interface GigabitEthernet0/0/2
interface LoopBack0
 ip address 5.5.5.5 255.255.255.255 

PE2

sys
 sysname P2
interface GigabitEthernet0/0/0
 ip address 56.1.1.2 255.255.255.252 
interface GigabitEthernet0/0/1
 ip address 20.1.1.1 255.255.255.252 
interface GigabitEthernet0/0/2
interface LoopBack0
 ip address 6.6.6.6 255.255.255.255 

CE2

sys
 sysname CE2
interface GigabitEthernet0/0/0
 ip address 20.1.1.2 255.255.255.252 
interface LoopBack0
 ip address 8.8.8.8 255.255.255.255 
interface LoopBack1
 ip address 192.168.2.1 255.255.255.0 

2.基础路由协议配置（只黏贴左边的配置，对称右边配置拉到最后 显示在什么层级下进行的配置）

2.1 PE-PE 的IS-IS、开启MPLS LDP

PE1

mpls lsr-id 1.1.1.1
mpls
mpls ldp

isis 1
 is-level level-2
 network-entity 4910.0000.0000.0001.00
 
interface GigabitEthernet0/0/0
 isis enable 1
 mpls
 mpls ldp
 
 int lo 0
 isis en 1

P1

mpls lsr-id 2.2.2.2
mpls
mpls ldp

isis 1
 is-level level-2
 network-entity 4910.0000.0000.0002.00

interface GigabitEthernet0/0/0
 isis enable 1
 mpls
 mpls ldp

interface GigabitEthernet0/0/1
 isis enable 1
 mpls
 mpls ldp

 int lo 0
 isis en 1

ASBR-PE1

mpls lsr-id 3.3.3.3
mpls
mpls ldp

isis 1
 is-level level-2
 network-entity 4910.0000.0000.0003.00
 
interface GigabitEthernet0/0/1
 isis enable 1
 mpls
 mpls ldp
 
int lo 0
 isis en 1

确认状态

P1-isis-1]dis isis peer 

                          Peer information for ISIS(1)

  System Id     Interface          Circuit Id       State HoldTime Type     PRI
-------------------------------------------------------------------------------
0000.0000.0001  GE0/0/1            0000.0000.0001.01 Up   9s       L2       64 
0000.0000.0003  GE0/0/0            0000.0000.0003.01 Up   21s      L2       64 

[P1-LoopBack0]dis mpl ldp s

 LDP Session(s) in Public Network
 Codes: LAM(Label Advertisement Mode), SsnAge Unit(DDDD:HH:MM)
 A '*' before a session means the session is being deleted.
 ------------------------------------------------------------------------------
 PeerID             Status      LAM  SsnRole  SsnAge      KASent/Rcv
 ------------------------------------------------------------------------------
 1.1.1.1:0          Operational DU   Active   0000:00:00  4/4
 3.3.3.3:0          Operational DU   Passive  0000:00:00  4/4
 ------------------------------------------------------------------------------

2.2 、建立BGP、MP-BGP

PE1
bgp 100
peer 3.3.3.3 as 100
peer 3.3.3.3 co lo 0
ipv4-family vpnv4
peer 3.3.3.3 en

ASBR-PE1

bgp 100
peer 1.1.1.1 as 100
peer 1.1.1.1 co lo 0
ipv4-family vpnv4
peer 1.1.1.1 en

[PE1-bgp-af-vpnv4]dis bgp vpnv4 all peer 

 BGP local router ID : 12.1.1.1
 Local AS number : 100
 Total number of peers : 1		  Peers in established state : 1

  Peer            V          AS  MsgRcvd  MsgSent  OutQ  Up/Down       State Pre
fRcv

  3.3.3.3         4         100        4        7     0 00:02:18 Established 

2.3 建立vpn-instance

PE1

ip vpn-instance CE1
route-distinguisher 100:1
vpn-target 100:1
int g0/0/1
ip binding vpn-instance CE1
ip add 10.1.1.1 30

ASBR-PE

ip vpn-instance CE1
route-distinguisher 100:1
vpn-target 100:1
int g0/0/2
ip binding vpn-instance CE1
ip add 202.106.0.1

2.4 CE-PE 的OSPF+路由引入

CE1

ospf 1 router-id 7.7.7.7 
 area 0.0.0.0 
  network 7.7.7.7 0.0.0.0 
  network 10.1.1.0 0.0.0.3 
  network 192.168.1.0 0.0.0.255 

PE1

ospf 1 vpn-instance CE1
 import-route bgp
 area 0.0.0.0 
  network 10.1.1.0 0.0.0.3 

路由引入

bgp 100
ipv4-family vpn-instance CE2
import-route ospf 1

[Huawei-ospf-1-area-0.0.0.0]dis ospf peer br

	 OSPF Process 1 with Router ID 7.7.7.7
		  Peer Statistic Information
 ----------------------------------------------------------------------------
 Area Id          Interface                        Neighbor id      State    
 0.0.0.0          GigabitEthernet0/0/0             10.1.1.1         Full        
 ----------------------------------------------------------------------------

2.3 ASBR 之间的EBGP

ASBR-PE1
bgp 100
[ASBR-PE1-bgp]ipv4-family vpn-instance CE1
[ASBR-PE1-bgp-CE1]peer 202.106.0.2 as 200
[ASBR-PE1-bgp-CE1]peer 202.106.0.2 co g0/0/2
[ASBR-PE1-bgp-CE1]peer 202.106.0.2 ebgp-max-hop 2

ASBR-PE2
bgp 200
[ASBR-PE2-bgp]ipv4-family vpn-instance CE2
[ASBR-PE2-bgp-CE2]peer 202.106.0.1 as 100
[ASBR-PE2-bgp-CE2]peer 202.106.0.1 connect-interface g0/0/2
[ASBR-PE2-bgp-CE2]peer 202.106.0.1 e 2

三、右边

3.1 PE-PE 的IS-IS、开启MPLS LDP

ASBR-PE2

[ASBR-PE2]isis 1
[ASBR-PE2-isis-1]is-level level-2
[ASBR-PE2-isis-1]net 49.0020.0000.0000.0004.00
[ASBR-PE2-isis-1]mpls ls 4.4.4.4
[ASBR-PE2]mpls
[ASBR-PE2-mpls]mpls ldp
[ASBR-PE2-mpls-ldp]int g0/0/1
[ASBR-PE2-GigabitEthernet0/0/1]isis en 1
[ASBR-PE2-GigabitEthernet0/0/1]mpls
[ASBR-PE2-GigabitEthernet0/0/1]mpls ldp
[ASBR-PE2-GigabitEthernet0/0/1]int lo 0
[ASBR-PE2-LoopBack0]isis en 1

P2

[P2]isis 1
[P2-isis-1]is-l level-2 
[P2-isis-1]net 49.0020.0000.0000.0005.00
[P2-isis-1]mpls ls 5.5.5.5 
[P2]mpls
Info: Mpls starting, please wait... OK!
[P2-mpls]mpls ldp
[P2-mpls-ldp]int g0/0/0
[P2-GigabitEthernet0/0/0]mpls
[P2-GigabitEthernet0/0/0]mpls ldp
[P2-GigabitEthernet0/0/1]isis en 1
[P2-GigabitEthernet0/0/1]mpls 
[P2-GigabitEthernet0/0/1]mpls ldp
interface LoopBack0
 ip address 5.5.5.5 255.255.255.255 
 isis enable 1

PE2

mpls lsr-id 6.6.6.6
mpls
#
mpls ldp
isis 1
 is-level level-2
 network-entity 49.0020.0000.0000.0006.00
interface GigabitEthernet0/0/0
 ip address 56.1.1.2 255.255.255.252 
 isis enable 1
 mpls
 mpls ldp
interface GigabitEthernet0/0/1
 ip address 20.1.1.1 255.255.255.252 
interface LoopBack0
 ip address 6.6.6.6 255.255.255.255 
 isis enable 1

[P2-mpls-ldp]dis isis peer

                          Peer information for ISIS(1)

  System Id     Interface          Circuit Id       State HoldTime Type     PRI
-------------------------------------------------------------------------------
0000.0000.0004  GE0/0/0            0000.0000.0005.01 Up   22s      L2       64 
0000.0000.0006  GE0/0/1            0000.0000.0005.02 Up   27s      L2       64 

[P2-mpls-ldp]dis mpls ldp se

 LDP Session(s) in Public Network
 Codes: LAM(Label Advertisement Mode), SsnAge Unit(DDDD:HH:MM)
 A '*' before a session means the session is being deleted.
 ------------------------------------------------------------------------------
 PeerID             Status      LAM  SsnRole  SsnAge      KASent/Rcv
 ------------------------------------------------------------------------------
 4.4.4.4:0          Operational DU   Active   0000:00:06  27/27
 6.6.6.6:0          Operational DU   Passive  0000:00:03  14/14
 ------------------------------------------------------------------------------
 TOTAL: 2 session(s) Found.

3.2 、右边建立BGP、MP-BGP

[ASBR-PE2-LoopBack0]bgp 200
[ASBR-PE2-bgp]peer 6.6.6.6 as 200
[ASBR-PE2-bgp]peer 6.6.6.6 co lo 0
[ASBR-PE2-bgp]ip vpnv4
[ASBR-PE2-bgp-af-vpnv4]peer 6.6.6.6 en

[P2]bgp 200
[P2-bgp]peer 4.4.4.4 as 200
[P2-bgp]peer 4.4.4.4 co lo 0
[P2-bgp]ip vpnv4 
[P2-bgp-af-vpnv4]peer 4.4.4.4 en


[ASBR-PE2-bgp-af-vpnv4]dis bgp vpnv4 all peer

 BGP local router ID : 45.1.1.1
 Local AS number : 200
 Total number of peers : 1		  Peers in established state : 1

  Peer            V          AS  MsgRcvd  MsgSent  OutQ  Up/Down       State Pre
fRcv

  6.6.6.6         4         200        2        4     0 00:00:23 Established 0

3.3 建立vpn-instance

ASBR-PE2

[ASBR-PE2]ip vpn-instance CE2
[ASBR-PE2-vpn-instance-CE2]route-distinguisher 100:1	
[ASBR-PE2-vpn-instance-CE2-af-ipv4]vpn-target 100:1
[ASBR-PE2-vpn-instance-CE2-af-ipv4]int g0/0/2
[ASBR-PE2-GigabitEthernet0/0/2]ip binding vpn-instance CE2
[ASBR-PE2-GigabitEthernet0/0/2]ip add 202.106.0.2 30

PE2

[P2]ip vpn-instance CE2
[P2-vpn-instance-CE2]route-distinguisher 100:1	
[P2-vpn-instance-CE2-af-ipv4]vpn-target 100:1
[P2-GigabitEthernet0/0/0]int g0/0/1
[P2-GigabitEthernet0/0/1]ip binding vpn-instance CE2
[P2-GigabitEthernet0/0/1]ip add 20.1.1.1 30

3.4 CE-PE 的OSPF+路由引入

PE2

[P2]ospf vpn-instance CE2 1 router-id 6.6.6.6 
[P2-ospf-1]area 0
[P2-ospf-1-area-0.0.0.0]net 20.1.1.1 0.0.0.3
[P2-ospf-1]import-route bgp

[P2-bgp]ipv4-family vpn-instance CE2
[P2-bgp-CE2]import-route ospf 1

CE2

[CE2]ospf 1 ro	
[CE2]ospf 1 router-id 8.8.8.8 
[CE2-ospf-1-area-0.0.0.0]net 8.8.8.8 0.0.0.0
[CE2-ospf-1-area-0.0.0.0]net 192.168.2.0 0.0.0.255
[CE2-ospf-1-area-0.0.0.0]net 20.1.1.1 0.0.0.3

排障

CE1上未查看到 CE2的路由

1. 逐段查看路由情况，寻找CE2的路由
   PE2 vpn-instance CE2查看到该路由，但是ASBR-PE2没有
   怀疑路由没有从OSPF引入到BGP
   查看BGP的配置

[P2-bgp]dis ip routing-table vpn-instance CE2
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: CE2
         Destinations : 6        Routes : 6        

Destination/Mask    Proto   Pre  Cost      Flags NextHop         Interface

        8.8.8.8/32  OSPF    10   1           D   20.1.1.2        GigabitEthernet
0/0/1
       20.1.1.0/30  Direct  0    0           D   20.1.1.1        GigabitEthernet
0/0/1
       20.1.1.1/32  Direct  0    0           D   127.0.0.1       GigabitEthernet
0/0/1
       20.1.1.3/32  Direct  0    0           D   127.0.0.1       GigabitEthernet
0/0/1
    192.168.2.1/32  OSPF    10   1           D   20.1.1.2        GigabitEthernet
0/0/1
255.255.255.255/32  Direct  0    0           D   127.0.0.1       InLoopBack0

[P2-bgp]dis this
[V200R003C00]
#
bgp 200
 peer 4.4.4.4 as-number 200 
 peer 4.4.4.4 connect-interface LoopBack0
 #
 ipv4-family unicast
  undo synchronization
  import-route ospf 1
  peer 4.4.4.4 enable
 # 
 ipv4-family vpnv4
  policy vpn-target
  peer 4.4.4.4 enable

路由引入应该是在VRF下
更改配置

[P2-bgp]undo import-route ospf 1
[P2-bgp]ipv4-family vpn-instance CE2
[P2-bgp-CE2]import-route ospf 1

2。重新查看CE1相关路由表

Huawei>dis ip ro p o
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Public routing table : OSPF
         Destinations : 4        Routes : 4        

OSPF routing table status : <Active>
         Destinations : 4        Routes : 4

Destination/Mask    Proto   Pre  Cost      Flags NextHop         Interface

        8.8.8.8/32  O_ASE   150  1           D   10.1.1.1        GigabitEthernet
0/0/0
       20.1.1.0/30  O_ASE   150  1           D   10.1.1.1        GigabitEthernet
0/0/0
    192.168.2.1/32  O_ASE   150  1           D   10.1.1.1        GigabitEthernet
0/0/0

思路

1、配置两边内网
使用isis
查看isis 邻居

配置mpls ldp
只在内部接口开启
查看ldp session

建立bgp peer
因为要传递VPNV4路由，在VPNV4下建立bgp peer
查看VPNV4 peer关系

2、配置 CE-PE
3、PE 使用 VRF 与CE 配置OSPF
4、PE的路由引入，将OSPF传来的私网路由引入VPN BGP
将VPNV4 BGP路由引入 OSPF
5。建立EBGP关系，因为将对方ASBR看做 CE
在ASBR 的VPNV4 下建立BGP peer关系