mpls 公网私网渗透实例

**黄色区域为公网，蓝色区域为私网区域，当我们想要PC1与PC2/PC4互通时候需要私网与公网渗透，很多人知道私网(vpn)到公网(ipv4):ip route-static vpn-instance vpn-source-name destination-address mask nexthop-address public
公网(ipv4)到私网(vpn):ip route-static destination-address mask vpn-instance vpn-source-name nexthop-address
但是很多人不知如何填写IP地址，当我们要把公网地址渗透到私网的时候，我们要查看私网与公网在一起的路由器AR3。查看一下公网路由表

ip route-static vpn-instance 1 公网IP地址 +公网掩码 下一条出口地址（公网传递过来接口对端地址）public后面public必须添加上
这条命令就是把私网地址渗透到公网上
ip route-static 私网地址 私网掩码 VPN实例 名称 下一下·下一条为私网出口地址
这条命令就是把公网地址渗透到私网上去

ip vpn-instance 1
ipv4-family
route-distinguisher 1:1
vpn-target 10:10 export-extcommunity
vpn-target 10:10 import-extcommunity

mpls lsr-id 3.3.3.3
mpls

mpls ldp

aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher % % K8m.Nt84DZ}e#<0`8bmE3Uw}% %
local-user admin service-type http

isis 1
is-level level-2
network-entity 49.0000.0000.0003.00
import-route direct
import-route static

firewall zone Local
priority 15

interface GigabitEthernet0/0/0
ip address 172.168.1.2 255.255.255.252
isis enable 1
isis circuit-level level-2
mpls
mpls ldp

interface GigabitEthernet0/0/1
ip address 172.168.2.1 255.255.255.252

interface GigabitEthernet0/0/2
ip binding vpn-instance 1
ip address 172.168.9.1 255.255.255.252

interface NULL0

interface LoopBack0
ip address 3.3.3.3 255.255.255.255
isis enable 1
isis circuit-level level-2

bgp 100
peer 1.1.1.1 as-number 100
peer 1.1.1.1 connect-interface LoopBack0
peer 2.2.2.2 as-number 100
peer 2.2.2.2 connect-interface LoopBack0

ipv4-family unicast
undo synchronization
peer 1.1.1.1 enable
peer 2.2.2.2 enable

ipv4-family vpnv4
policy vpn-target
peer 1.1.1.1 enable
peer 2.2.2.2 enable

ipv4-family vpn-instance 1
import-route direct

ip route-static 172.168.9.0 255.255.255.252 vpn-instance 1 172.168.9.2
ip route-static vpn-instance 1 172.168.2.0 255.255.255.252 172.168.1.1 public
ip route-static vpn-instance 1 172.168.10.0 255.255.255.252 172.168.1.1 public

user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20

wlan ac

return
如有不才，请多多见谅