华为ensp MPLS-VPN 实验

实验拓扑图：

CE设备：AR4、AR5、AR6、AR7

PE设备：AR1、AR3

P设备：AR2

AR1的实例1：RD值1:1 、RT值入和出都是1:1

AR1的实例2：RD值3:3 、RT值入和出都是2:2

AR3的实例1：RD值2:2 、RT值入和出都是1:1

AR3的实例1：RD值4:4、RT值入和出都是2:2

四个站点的CE设备分别使用BGP、OSPF、静态路由、ISIS来进行私网路由的传递

----------------------------------------------MPSL VPN原理部分省略--------------------------------------------------

1、先配置接口IP地址

[ar4]interface GigabitEthernet0/0/0
[ar4-GigabitEthernet0/0/0] ip address 192.168.1.1 24
[ar4]interface LoopBack 0
[ar4-LoopBack0]ip address 172.16.1.1 32

[ar6]interface GigabitEthernet0/0/0
[ar6-GigabitEthernet0/0/0]ip address 192.168.5.1 24
[ar6]interface LoopBack 0
[ar6-LoopBack0]ip address 172.16.2.1 32

[ar5]interface GigabitEthernet0/0/0
[ar5-GigabitEthernet0/0/0]ip address 192.168.1.1 24
[ar5]interface LoopBack 0
[ar5-LoopBack0]ip address 172.16.1.1 32

[ar7]interface GigabitEthernet0/0/0
[ar7-GigabitEthernet0/0/0]ip address 192.168.6.1 24
[ar7]interface LoopBack 0
[ar7-LoopBack0]ip address 172.16.3.1 32

[ar3]interface GigabitEthernet0/0/1
[ar3-GigabitEthernet0/0/1]ip address 192.168.5.2 24
[ar3]interface GigabitEthernet0/0/2
[ar3-GigabitEthernet0/0/2]ip address 192.168.6.2 24
[ar3]interface GigabitEthernet 0/0/0	
[ar3-GigabitEthernet0/0/0]ip address 222.1.4.2 24
[ar3]interface LoopBack 0
[ar3-LoopBack0]ip address 3.3.3.3 32

[ar2]interface GigabitEthernet 0/0/0	
[ar2-GigabitEthernet0/0/0]ip address 222.1.3.2 24
[ar2]interface GigabitEthernet0/0/1	
[ar2-GigabitEthernet0/0/1]ip address 222.1.4.1 24
[ar2]interface LoopBack 0
[ar2-LoopBack0]ip address 2.2.2.2 32

[ar1]interface GigabitEthernet 0/0/0
[ar1-GigabitEthernet0/0/1]ip address 192.168.1.2 24
[ar1]interface GigabitEthernet 0/0/1
[ar1-GigabitEthernet0/0/1]ip address 192.168.1.3 24
[ar1]interface GigabitEthernet0/0/2
[ar1-GigabitEthernet0/0/2]ip address 222.1.3.1 24
[ar1]interface LoopBack 0
[ar1-LoopBack0]ip address 1.1.1.1 32

 2、使用不同的路由协议配置各个站点的CE设备

[ar4]bgp 400	
[ar4-bgp]peer 192.168.1.2 as-number 200
[ar4-bgp]peer 192.168.1.2 ebgp-max-hop 
[ar4-bgp]network 172.16.1.1 32
[ar4-bgp]network  192.168.1.0 24

[ar5]ip route-static 192.168.6.0 24 192.168.1.3 
[ar5]ip route-static 172.16.3.1 32 192.168.1.3

[ar6]ospf 6  router-id 6.6.6.6	
[ar6-ospf-6]area 0.0.0.0	
[ar6-ospf-6-area-0.0.0.0]network 172.16.2.1 0.0.0.0	
[ar6-ospf-6-area-0.0.0.0]network 192.168.5.0 0.0.0.255

[ar7]isis  7 
[ar7-isis-7]network-entity 49.0001.0000.0000.0001.00
[ar7-isis-7]is-level level-2
[ar7]interface GigabitEthernet 0/0/0
[ar7-GigabitEthernet0/0/0]isis enable 7
[ar7]interface LoopBack 0	
[ar7-LoopBack0]isis enable 7

 3、配置中间的PE设备和VPN实例及绑定，RD值用来区分是哪个VPN用户发过来的私网路由，让私网路由变得全局唯一。RT值根据import和export来把私网流量转发到正确的私网用户，用来区分不同VPN用户。

[ar1]ip vpn-instance 1
[ar1-vpn-instance-1]route-distinguisher 1:1	
[ar1-vpn-instance-1-af-ipv4]vpn-target 1:1
[ar1]ip vpn-instance 2 
[ar1-vpn-instance-2]route-distinguisher 3:3
[ar1-vpn-instance-2-af-ipv4]vpn-target 2:2
[ar1]interface GigabitEthernet0/0/0
[ar1-GigabitEthernet0/0/0]ip binding vpn-instance 1      //接口绑定VPN实例后，IP地址会清除，需要重新配置一下IP地址
[ar1-GigabitEthernet0/0/1]ip address 192.168.1.2 24
[ar1]interface GigabitEthernet 0/0/1
[ar1-GigabitEthernet0/0/1]ip binding vpn-instance 2
[ar1-GigabitEthernet0/0/1]ip address 192.168.1.3 255.255.255.0

[ar3]ip vpn-instance 1
[ar3-vpn-instance-1]route-distinguisher 2:2
[ar3-vpn-instance-1-af-ipv4]vpn-target 1:1
[ar3]ip vpn-instance 2
[ar3-vpn-instance-2]route-distinguisher 4:4
[ar3-vpn-instance-2-af-ipv4]vpn-target 2:2
[ar3]interface GigabitEthernet0/0/1	
[ar3-GigabitEthernet0/0/1]ip binding vpn-instance 1
[ar3-GigabitEthernet0/0/1]ip add 192.168.5.2 24
[ar3]interface GigabitEthernet0/0/2
[ar3-GigabitEthernet0/0/2]ip binding vpn-instance 2
[ar3-GigabitEthernet0/0/2]ip add 192.168.6.2 24

 4、配置VPN实例下的PE设备，使得CE设备下发的私网路由走VPN实例通道，不会在全局路由表显示

[ar1]bgp 200
[ar1-bgp]ipv4-family vpn-instance 1
[ar1-bgp-1]peer 192.168.1.1 as-number 400	
[ar1-bgp-1]peer 192.168.1.1 ebgp-max-hop 

[ar1]ip route-static vpn-instance 2 172.16.1.1 255.255.255.255 192.168.1.1

[ar3]ospf 6 router-id 3.3.3.3 vpn-instance 1
[ar3-ospf-6]area 0.0.0.0
[ar3-ospf-6-area-0.0.0.0]network 192.168.5.0 0.0.0.255

[ar3]isis 7 vpn-instance 2 
[ar3-isis-7]network-entity 49.0001.0000.0000.0002.00
[ar3-isis-7]is-level level-2
[ar3]interface GigabitEthernet 0/0/2	
[ar3-GigabitEthernet0/0/2]isis enable 7

5、配置中间PE和P设备使用OSPF来模拟公网互通

[ar1]ospf 1 router-id 11.11.11.11
[ar1-ospf-1]area 0.0.0.0	
[ar1-ospf-1-area-0.0.0.0]network 222.1.3.0 0.0.0.255
[ar1-ospf-1-area-0.0.0.0]network 1.1.1.1 0.0.0.0

[ar2]ospf 1 router-id 22.22.22.22
[ar2-ospf-1]area 0.0.0.0
[ar2-ospf-1-area-0.0.0.0]network 222.1.3.0 0.0.0.255
[ar2-ospf-1-area-0.0.0.0]network 222.1.4.0 0.0.0.255
[ar2-ospf-1-area-0.0.0.0]network 2.2.2.2 0.0.0.0

[ar3]ospf 1 router-id 33.33.33.33
[ar3-ospf-1]area 0.0.0.0
[ar3-ospf-1-area-0.0.0.0]network 222.1.4.0 0.0.0.255
[ar3-ospf-1-area-0.0.0.0]network 3.3.3.3 0.0.0.0

6、配置中间PE和P设备使用MPLS动态模式进行标签代替路由在公网实现快速转发，（由LDP生成外层标签）

[ar1]mpls lsr-id 1.1.1.1
[ar1]mpls 
[ar1-mpls]mpls ldp
[ar1]interface GigabitEthernet 0/0/2
[ar1-GigabitEthernet0/0/2]mpls 
[ar1-GigabitEthernet0/0/2]mpls ldp

[ar2]mpls lsr-id 2.2.2.2
[ar2]mpls 
[ar2-mpls]mpls ldp
[ar2]interface GigabitEthernet 0/0/0
[ar2-GigabitEthernet0/0/0]mpls 
[ar2-GigabitEthernet0/0/0]mpls ldp
[ar2]interface GigabitEthernet 0/0/1
[ar2-GigabitEthernet0/0/1]mpls 
[ar2-GigabitEthernet0/0/1]mpls ldp

[ar3]mpls lsr-id 3.3.3.3
[ar3]mpls 
[ar3-mpls]mpls ldp
[ar3]interface GigabitEthernet 0/0/0
[ar3-GigabitEthernet0/0/0]mpls 
[ar3-GigabitEthernet0/0/0]mpls ldp

7、配置中间PE设备使用MP-BGP来传递CE和公网之间的路由，（由MP-BGP生成内层标签）

[ar1]bgp 200	
[ar1-bgp]peer 3.3.3.3 as-number 200	
[ar1-bgp]peer 3.3.3.3 connect-interface LoopBack 0	
[ar1-bgp]ipv4-family vpnv4	
[ar1-bgp-af-vpnv4]peer 3.3.3.3 enable 

[ar3]bgp 200
[ar3-bgp]peer 1.1.1.1 as-number 200	
[ar3-bgp]peer 1.1.1.1 connect-interface LoopBack 0	
[ar3-bgp]ipv4-family vpnv4
[ar3-bgp-af-vpnv4]peer 1.1.1.1 enable 

 8、配置中间PE设备在VPN实例下和两端CE设备进行路由的互相引入

BGP 不用引入

[ar1]bgp 200
[ar1-bgp]ipv4-family vpn-instance 2
[ar1-bgp-2]import-route  direct 
[ar1-bgp-2]import-route static 

[ar3]bgp 200
[ar3-bgp]ipv4-family vpn-instance 1	
[ar3-bgp-1]import-route ospf 6	

[ar3]bgp 200
[ar3-bgp]ipv4-family vpn-instance 2	
[ar3-bgp-2]import-route  isis 7


[ar3]ospf 6 vpn-instance 1
[ar3-ospf-6]import-route  bgp 200

[ar3]isis 7 vpn-instance 2
[ar3-isis-7]import-route bgp 

9、查看命令：

[ar1]dis bgp vpnv4 all routing-table    
//可以发现AR1路由表传递2个路由，
一个vpnv4路由，一个vpn-instence x路由，都不是普通的路由
vpnv4路由和普通路由区别是vpnv4路由可以携带RD和RT值，普通路由没法携带。
有RD和RT才能判断私网传递的方向

 BGP Local router ID is 1.1.1.1 
 Status codes: * - valid, > - best, d - damped,
               h - history,  i - internal, s - suppressed, S - Stale
               Origin : i - IGP, e - EGP, ? - incomplete



 Total number of routes from all PE: 9
 Route Distinguisher: 1:1 


      Network            NextHop        MED        LocPrf    PrefVal Path/Ogn

 *>   172.16.1.1/32      192.168.1.1     0                     0      400i
 *>   192.168.1.0        192.168.1.1     0                     0      400i

 Route Distinguisher: 2:2 


      Network            NextHop        MED        LocPrf    PrefVal Path/Ogn

 *>i  172.16.2.1/32      3.3.3.3         2          100        0      ?
 *>i  192.168.5.0        3.3.3.3         0          100        0      ?

 Route Distinguisher: 3:3 


      Network            NextHop        MED        LocPrf    PrefVal Path/Ogn

 *>   172.16.1.1/32      0.0.0.0         0                     0      ?
 *>   192.168.1.0        0.0.0.0         0                     0      ?
 *>   192.168.1.3/32     0.0.0.0         0                     0      ?

 Route Distinguisher: 4:4 


      Network            NextHop        MED        LocPrf    PrefVal Path/Ogn

 *>i  172.16.3.1/32      3.3.3.3         10         100        0      ?
 *>i  192.168.6.0        3.3.3.3         0          100        0      ?

 VPN-Instance 1, Router ID 1.1.1.1:

 Total Number of Routes: 4
      Network            NextHop        MED        LocPrf    PrefVal Path/Ogn

 *>   172.16.1.1/32      192.168.1.1     0                     0      400i
 *>i  172.16.2.1/32      3.3.3.3         2          100        0      ?
      192.168.1.0        192.168.1.1     0                     0      400i
 *>i  192.168.5.0        3.3.3.3         0          100        0      ?

 VPN-Instance 2, Router ID 1.1.1.1:

 Total Number of Routes: 5
      Network            NextHop        MED        LocPrf    PrefVal Path/Ogn

 *>   172.16.1.1/32      0.0.0.0         0                     0      ?
 *>i  172.16.3.1/32      3.3.3.3         10         100        0      ?
 *>   192.168.1.0        0.0.0.0         0                     0      ?
 *>   192.168.1.3/32     0.0.0.0         0                     0      ?
 *>i  192.168.6.0        3.3.3.3         0          100        0      ?




[ar1]dis ip routing-table vpn-instance 1          //查看VPN实例1路由表
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: 1
         Destinations : 5        Routes : 5        

Destination/Mask    Proto   Pre  Cost      Flags NextHop         Interface

     172.16.1.1/32  EBGP    255  0          RD   192.168.1.1     GigabitEthernet
0/0/0
    192.168.1.0/24  Direct  0    0           D   192.168.1.2     GigabitEthernet
0/0/0
    192.168.1.2/32  Direct  0    0           D   127.0.0.1       GigabitEthernet
0/0/0
  192.168.1.255/32  Direct  0    0           D   127.0.0.1       GigabitEthernet
0/0/0
255.255.255.255/32  Direct  0    0           D   127.0.0.1       InLoopBack0




[ar1]dis ip routing-table vpn-instance 2         //查看VPN实例2路由表
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: 2
         Destinations : 7        Routes : 7        

Destination/Mask    Proto   Pre  Cost      Flags NextHop         Interface

     172.16.1.1/32  Static  60   0          RD   192.168.1.1     GigabitEthernet
0/0/1
     172.16.3.1/32  IBGP    255  10         RD   3.3.3.3         GigabitEthernet
0/0/2
    192.168.1.0/24  Direct  0    0           D   192.168.1.3     GigabitEthernet
0/0/1
    192.168.1.3/32  Direct  0    0           D   127.0.0.1       GigabitEthernet
0/0/1
  192.168.1.255/32  Direct  0    0           D   127.0.0.1       GigabitEthernet
0/0/1
    192.168.6.0/24  IBGP    255  0          RD   3.3.3.3         GigabitEthernet
0/0/2
255.255.255.255/32  Direct  0    0           D   127.0.0.1       InLoopBack0

 10、实验效果：

左边的CE站点AR4可以ping通右边的CE站点AR6，
左边的CE站点AR5可以ping通右边的CE站点AR7，
实现私网路由的互通

[ar4]ping 172.16.2.1

[ar4]ping 192.168.5.1

[ar5]ping 172.16.3.1

[ar5]ping 192.168.6.1