一、MPLS概述
multi protocol label switching多协议标签交换,多协议:支持多种网络层协议
mpls vpn
mpls TE流量工程
CE:customer edge用户网络边缘设备,有接口中直接与服务提供商网络相连,可以是路由器,交换机或主机,通常CE感知不到VPN存在,也不需支持MPLS
PE: provider edge 服务提供商网络的边缘设备,与CE直接相练,在MPLS网络中,对VPN的所有处理在PE上,对PE性能要求较高。
P provider 服务提供商网络中骨干设备,无需与CE直接相连,P设备只需具备MPLS转发能力,不维护VPN场景。
RD:区分实例,标记路由,区分不同站点的相同路由
RT:对路则进行控制,控制路由的导入与导出
(1)RD(route distinguisher 路由标识符值)---VPN实例名字---站点一一对应。作用:在一台路由器上创建多个路由大来隔离路由,VPN实例也称为VRF(VPN ROUTING AND FORWARDING),8字节。
(2)RT (route target)也称为vpn-target,通过RT属性来控制VPN路由器信息在各SITE间的发布和接入,导入导出路由。export target导出RT,随路由发布(携带),import target:导入RT,路由update不携带该数值,用于PE上匹配RT将路由加入VPN实例。每个路由的入、出RT都可以配置多个。
(3)双标签:
公网标签(外):负责数据包在公网的传输
私网标签(内):指导数据包进入相应的实例
公网标签由LDP分配,私网标签由MP-BGP分配。
MPLS VPN基础实验:
实验拓扑图:
(1)MPLS域 IGP路由
(2)MPLS LDP隧道建立
mpls lsr-id 1.1.1.1
mpls
mpls ldp
int g0/0/1
mpls
mpls ldp
(3)CE-PE:CE将路由传递给PE
CE:bgp 300
peer 17.1.1.1 as-number 400
network 7.7.7.7 32
network 192.168.7.0 24
PE:BGP 400
ipv4-family vpn-instance vpn300
peer 17,.1.1.7 as-number 300
(4)PE-PE 建立MP-BGP传递VPNV4路由
bgp 400
ipv4-family vpnv4
policy vpn-target
peer 4.4.4.4 enable
各设备核心配置:
R5:
bgp 100
peer 15.1.1.1 as-number 400
#
ipv4-family unicast
undo synchronization
network 5.5.5.5 255.255.255.255
network 192.168.5.0
peer 15.1.1.1 enable
R1:
ip vpn-instance vpn100
ipv4-family
route-distinguisher 100:100
vpn-target 10:10 export-extcommunity
vpn-target 50:50 import-extcommunity
#
ip vpn-instance vpn200
ipv4-family
route-distinguisher 200:200
vpn-target 20:20 export-extcommunity
vpn-target 50:50 import-extcommunity
#
ip vpn-instance vpn300
ipv4-family
route-distinguisher 300:300
vpn-target 30:30 export-extcommunity
vpn-target 60:60 import-extcommunity
#
mpls lsr-id 1.1.1.1
mpls
#
mpls ldp
interface GigabitEthernet0/0/0
ip binding vpn-instance vpn100
ip address 15.1.1.1 255.255.255.0
#
interface GigabitEthernet0/0/1
ip address 12.1.1.1 255.255.255.0
mpls
mpls ldp
bgp 400
peer 4.4.4.4 as-number 400
peer 4.4.4.4 connect-interface LoopBack0
#
ipv4-family unicast
undo synchronization
peer 4.4.4.4 enable
#
ipv4-family vpnv4
policy vpn-target
peer 4.4.4.4 enable
#
ipv4-family vpn-instance vpn100
peer 15.1.1.5 as-number 100
#
ipv4-family vpn-instance vpn200
peer 19.1.1.9 as-number 200
#
ipv4-family vpn-instance vpn300
peer 17.1.1.7 as-number 300
#
ospf 100
area 0.0.0.0
network 1.1.1.1 0.0.0.0
network 12.1.1.0 0.0.0.255
network 15.1.1.0 0.0.0.255
network 17.1.1.0 0.0.0.255
network 19.1.1.0 0.0.0.255
R2:
mpls lsr-id 2.2.2.2
mpls
#
mpls ldp
interface GigabitEthernet0/0/0
ip address 12.1.1.2 255.255.255.0
mpls
mpls ldp
#
interface GigabitEthernet0/0/1
ip address 23.1.1.2 255.255.255.0
mpls
mpls ldp
ospf 100
area 0.0.0.0
network 2.2.2.2 0.0.0.0
network 12.1.1.0 0.0.0.255
network 23.1.1.0 0.0.0.255
R4:
ip vpn-instance vpn500
ipv4-family
route-distinguisher 500:500
vpn-target 50:50 export-extcommunity
vpn-target 10:10 20:20 import-extcommunity
#
ip vpn-instance vpn600
ipv4-family
route-distinguisher 600:600
vpn-target 60:60 export-extcommunity
vpn-target 30:30 import-extcommunity
#
mpls lsr-id 4.4.4.4
mpls
#
mpls ldp
#
#
interface GigabitEthernet0/0/0
ip address 34.1.1.4 255.255.255.0
mpls
mpls ldp
interface GigabitEthernet0/0/1
ip binding vpn-instance vpn500
ip address 48.1.1.4 255.255.255.0
bgp 400
peer 1.1.1.1 as-number 400
peer 1.1.1.1 connect-interface LoopBack0
#
ipv4-family unicast
undo synchronization
peer 1.1.1.1 enable
#
ipv4-family vpnv4
policy vpn-target
peer 1.1.1.1 enable
#
ipv4-family vpn-instance vpn500
peer 48.1.1.8 as-number 500
#
ipv4-family vpn-instance vpn600
peer 46.1.1.6 as-number 600
#
ospf 100
area 0.0.0.0
network 4.4.4.4 0.0.0.0
network 34.1.1.0 0.0.0.255
network 46.1.1.0 0.0.0.255
network 48.1.1.0 0.0.0.255
重点配置总结
(1)vpn-instance和BGP只需要两头PE配置,中间P无需配置
(2)当vpn跨AS域传递时,需配置ipv4-family vpn-instance vpn100建立连接,当建立MP-BGP时,在ipv4-family vpnv4里建立邻居。