跨域MPLS VPN option A配置笔记

跨域MPLS VPN option A配置笔记

option A的思路还是单域的MPLS VPN思路，还是CE-PE-P-PE-CE，只是把对端运营商的边界设备相互看做是CE和PE。
本端把VPN v4路由发给边界PE，边界PE通过单个线路和子接口方式取分客户，保证客户间路由和通信。这是因为边界设备建立的是ipv4 的BGP关系，只能传递不带标签的ipv4 BGP路由，虽然边界PE收到的客户的标签路由也能区分客户，但是发给对端运营商边界时就没有标签了，为了能区分客户，只能采用用单独的线路或者子接口逻辑线路方式进行区分。

1、配置运营商部分的IGP和MPLS域，即配置北京运营商使用OSPF互联，上海运营商使用isis互联，都开启MPLS 和LDP。

# 北京运营商MPLS域部分配置
[R1-asbr]ospf 10 router-id 1.1.1.1
[R1-asbr-ospf-10]area 0	
[R1-asbr-ospf-10-area-0.0.0.0]network 1.1.1.1 0.0.0.0
[R1-asbr-ospf-10-area-0.0.0.0]network 12.1.1.1 0.0.0.0

[R1-asbr]mpls lsr-id 1.1.1.1
[R1-asbr]mpls 
[R1-asbr]mpls ldp 
[R1-asbr]int g0/0/1
[R1-asbr-GigabitEthernet0/0/1]mpls 	
[R1-asbr-GigabitEthernet0/0/1]mpls ldp 

# 上海运营商MPLS域部分配置
[R6-asbr]isis 15
[R6-asbr-isis-15]network-entity 49.6789.0000.0000.0006.00
[R6-asbr-isis-15]is-level level-2
[R6-asbr-isis-15]q
[R6-asbr]int l0	
[R6-asbr-LoopBack0]isis enable 15
[R6-asbr-LoopBack0]q
[R6-asbr]int g0/0/1
[R6-asbr-GigabitEthernet0/0/1]isis enable 15
[R6-asbr-GigabitEthernet0/0/1]q

[R6-asbr]mpls lsr-id 6.6.6.6
[R6-asbr]mpls 
[R6-asbr-mpls]q	
[R6-asbr]mpls ldp 
[R6-asbr-mpls-ldp]q
[R6-asbr]int g0/0/1
[R6-asbr-GigabitEthernet0/0/1]mpls 
[R6-asbr-GigabitEthernet0/0/1]mpls ldp 
[R6-asbr-GigabitEthernet0/0/1]q

北京部分：

2、运营商内部边界设备PE和路由反射R3器建立vpnv4 IBGP邻居，R4实例为A_beijing rd 10:10 rt 10:10 both，这里理解一下R4是北京区域的客户端PE，R1是北京端连接分部的ASBR看成另一个PE，把整上海分部当成一个CE对待，R1就不是边界ASBR而是PE设备，这里其实是中断了标签传递，R1和R6之间是建立的ipv4 的EBGP关系，他们都会把本域的CE私网路由传给彼此，但是这是通过ipv4传递的，要求边界设备为每个CE都建立实例和用专线或者子接口方式传递才不会出错。

# 创建北京端实际连接的客户的PE的实例
[R4-pe]ip vpn-instance A_beijing	
[R4-pe-vpn-instance-A_beijing]route-distinguisher 10:10
[R4-pe-vpn-instance-A_beijing-af-ipv4]vpn-target 10:10 both 
[R4-pe-vpn-instance-A_beijing-af-ipv4]q
[R4-pe-vpn-instance-A_beijing]q
[R4-pe]int g0/0/1
[R4-pe-GigabitEthernet0/0/1]ip binding vpn-instance A_beijing
[R4-pe-GigabitEthernet0/0/1]ip addr 172.16.45.4 24
[R4-pe-GigabitEthernet0/0/1]q
# 连接客户的PE和反射器RR建立VPN v4关系，传递全部路由给RR
[R4-pe]bgp 1234 
[R4-pe-bgp]router-id 4.4.4.4
[R4-pe-bgp]undo default ipv4-unicast 
[R4-pe-bgp]peer 3.3.3.3 as-number 1234	
[R4-pe-bgp]peer 3.3.3.3 connect-interface LoopBack 0
[R4-pe-bgp]ipv4-family vpnv4 unicast 
[R4-pe-bgp-af-vpnv4]peer 3.3.3.3 enable 
[R4-pe-bgp-af-vpnv4]q


# 创建两地运营商互联的实例，一个实例对应一个客户，因为这里使用ipv4 BGP传递路由的，没有标签了，只能有单独的实例通道用于区分客户
[R1-asbr]ip vpn-instance A_shanghai
[R1-asbr-vpn-instance-A_shanghai]route-distinguisher 10:10
[R1-asbr-vpn-instance-A_shanghai-af-ipv4]vpn-target 10:10 both 
[R1-asbr-vpn-instance-A_shanghai]q
[R1-asbr]int g0/0/0
[R1-asbr-GigabitEthernet0/0/0]ip binding vpn-instance A_shanghai
[R1-asbr-GigabitEthernet0/0/0]ip addr 16.1.1.1 24
[R1-asbr-GigabitEthernet0/0/0]q
# 配置互联的实例即虚拟PE和反射器RR建立VPN v4 BGP关系传递VPN v4路由
[R1-asbr]bgp 1234
[R1-asbr-bgp]router-id 1.1.1.1
[R1-asbr-bgp]undo default ipv4-unicast 
[R1-asbr-bgp]peer 3.3.3.3 as-number 1234
[R1-asbr-bgp]peer 3.3.3.3 connect-interface LoopBack 0
[R1-asbr-bgp]ipv4-family vpnv4 unicast 	
[R1-asbr-bgp-af-vpnv4]peer 3.3.3.3 enable 
[R1-asbr-bgp-af-vpnv4]q

3、配置反射器RR用于接受全部的PE发送的所有VPNv4路由，反射给R1虚拟的PE

[R3]bgp 1234
[R3-bgp]router-id 3.3.3.3
[R3-bgp]undo default ipv4-unicast 
[R3-bgp]peer 1.1.1.1 as-number 1234	
[R3-bgp]peer 1.1.1.1 connect-interface LoopBack 0
[R3-bgp]peer 4.4.4.4 as-number 1234	
[R3-bgp]peer 4.4.4.4 connect-interface LoopBack 0
[R3-bgp]ipv4-family vpnv4 unicast 
[R3-bgp-af-vpnv4]peer 1.1.1.1 enable 
[R3-bgp-af-vpnv4]peer 1.1.1.1 reflect-client 
[R3-bgp-af-vpnv4]peer 4.4.4.4 enable 
[R3-bgp-af-vpnv4]peer 4.4.4.4 reflect-client 
[R3-bgp-af-vpnv4]undo policy vpn-target 
[R3-bgp-af-vpnv4]q
[R3-bgp]q

[R3]dis bgp vpnv4 all peer 
[R3]dis bgp vpnv4 all routing-table

4、配置客户侧PE和CE的BGP关系

# 连接客户的PE实例和客户建立ipv4 BGP关系
[R4-pe-bgp]ipv4-family vpn-instance A_beijing
[R4-pe-bgp-A_beijing]pe	
[R4-pe-bgp-A_beijing]peer 172.16.45.5 as	
[R4-pe-bgp-A_beijing]peer 172.16.45.5 as-number 5
[R4-pe-bgp-A_beijing]q
[R4-pe-bgp]q

[R5-ce]bgp 5
[R5-ce-bgp]router-id 5.5.5.5 
[R5-ce-bgp]peer 172.16.45.4 as-number 1234
[R5-ce-bgp]import-route direct 
[R5-ce-bgp]q

上海部分：

6、建立实例PE用于和RR、北京边界和客户CE互联， 即配置两个PE

# 连接北京部分的虚拟PE实例
[R6-asbr]ip vpn-instance A_beijing
[R6-asbr-vpn-instance-A_beijing]route-distinguisher 20:20
[R6-asbr-vpn-instance-A_beijing-af-ipv4]vpn-target 20:20 both 
[R6-asbr-vpn-instance-A_beijing-af-ipv4]q
[R6-asbr-vpn-instance-A_beijing]q
[R6-asbr]int g0/0/0	
[R6-asbr-GigabitEthernet0/0/0]ip binding vpn-instance A_beijing
[R6-asbr-GigabitEthernet0/0/0]ip addr 16.1.1.6 24
[R6-asbr-GigabitEthernet0/0/0]
[R6-asbr-GigabitEthernet0/0/0]q
# 配置虚拟PE和RR的VPN v4 IBGP邻居关系
[R6-asbr]bgp 6789
[R6-asbr-bgp]router-id 6.6.6.6
[R6-asbr-bgp]undo default ipv4-unicast 
[R6-asbr-bgp]peer 8.8.8.8 as-number 6789
[R6-asbr-bgp]peer 8.8.8.8 connect-interface LoopBack 0
[R6-asbr-bgp]ipv4-family vpnv4 unicast 	
[R6-asbr-bgp-af-vpnv4]peer 8.8.8.8 enable 
[R6-asbr-bgp-af-vpnv4]q	


# 配置上海连接客户的PE实例
[R9-pe]ip vpn-instance A_shanghai
[R9-pe-vpn-instance-A_shanghai]route-distinguisher 20:20
[R9-pe-vpn-instance-A_shanghai-af-ipv4]vpn-target 20:20 both 
[R9-pe-vpn-instance-A_shanghai-af-ipv4]q
[R9-pe-vpn-instance-A_shanghai]q
[R9-pe]int g0/0/1
[R9-pe-GigabitEthernet0/0/1]ip binding vpn-instance A_shanghai
[R9-pe-GigabitEthernet0/0/1]ip addr 192.168.109.9 24
[R9-pe-GigabitEthernet0/0/1]q
# 配置客户测PE和RR的VPNv4关系
[R9-pe]bgp 6789
[R9-pe-bgp]router-id 9.9.9.9
[R9-pe-bgp]undo default ipv4-unicast 
[R9-pe-bgp]peer 8.8.8.8 as-number 6789
[R9-pe-bgp]peer 8.8.8.8 connect-interface LoopBack 0
[R9-pe-bgp]ipv4-family vpnv4 unicast 
[R9-pe-bgp-af-vpnv4]peer 8.8.8.8 enable 
[R9-pe-bgp-af-vpnv4]q

7、配置上海部分的RR反射器

[R8]bgp 6789
[R8-bgp]router-id 8.8.8.8
[R8-bgp]undo default ipv4-unicast 
[R8-bgp]peer 6.6.6.6 as-number 6789
[R8-bgp]peer 6.6.6.6 connect-interface LoopBack 0
[R8-bgp]peer 9.9.9.9 as-number 6789
[R8-bgp]peer 9.9.9.9 connect-interface LoopBack 0
[R8-bgp]ipv4-family vpnv4 unicast 
[R8-bgp-af-vpnv4]peer 6.6.6.6 enable 
[R8-bgp-af-vpnv4]peer 6.6.6.6 reflect-client 
[R8-bgp-af-vpnv4]peer 9.9.9.9 enable 
[R8-bgp-af-vpnv4]peer 9.9.9.9 reflect-client
[R8-bgp-af-vpnv4]undo policy vpn-target 
[R8-bgp-af-vpnv4]q
[R8-bgp]q

8、配置上海侧的客户PE和CE的BGP关系

[R9-pe-bgp]ipv4-family vpn-instance A_shanghai
[R9-pe-bgp-A_shanghai]peer 192.168.109.10 as-number 10
[R9-pe-bgp-A_shanghai]q
[R9-pe-bgp]q

[R10-ce]bgp 10
[R10-ce-bgp]router-id 10.10.10.10
[R10-ce-bgp]peer 192.168.109.9 as-number 6789
[R10-ce-bgp]import-route direct 
[R10-ce-bgp]q

两地运营商互联的ASBR

9、配置北京和上海的边界ASBR的虚拟PE，一个客户一条线，或者一个客户一个子接口连接

# 配置北京边界和上海边界的虚拟PE的BGP关系
[R1-asbr-bgp]ipv4-family vpn-instance A_shanghai	
[R1-asbr-bgp-A_shanghai]peer 16.1.1.6 as-number 6789
[R1-asbr-bgp-A_shanghai]q
[R1-asbr-bgp]q

# 配置上海边界和北京边界的虚拟PE的BGP关系
[R6-asbr-bgp]ipv4-family vpn-instance A_beijing
[R6-asbr-bgp-A_beijing]peer 16.1.1.1 as-number 1234
[R6-asbr-bgp-A_beijing]q
[R6-asbr-bgp]q

# 使用子接口方式方式配置
[R1-asbr]int g0/0/0.16
[R1-asbr-GigabitEthernet0/0/0.16]dot1q termination vid 16	
[R1-asbr-GigabitEthernet0/0/0.16]arp broadcast enable 
[R1-asbr-GigabitEthernet0/0/0.16]ip binding vpn-instance A_shanghai
[R1-asbr-GigabitEthernet0/0/0.16]ip addr 16.1.1.1 24
[R1-asbr-GigabitEthernet0/0/0.16]q

[R6-asbr]int g0/0/0.16	
[R6-asbr-GigabitEthernet0/0/0.16]dot1q termination vid 16
[R6-asbr-GigabitEthernet0/0/0.16]arp broadcast enable 
[R6-asbr-GigabitEthernet0/0/0.16]ip binding vpn-instance A_beijing
[R6-asbr-GigabitEthernet0/0/0.16]ip addr 16.1.1.6 24
[R6-asbr-GigabitEthernet0/0/0.16]q