【方案】基于ensp的mpls vpn跨域optionA方案（分公司之间不能互访但是能访问总部场景）

天亮之前_ict

已于 2024-02-05 10:31:38 修改

阅读量1.7k

点赞数 5

文章标签：网络运维安全

于 2023-05-15 15:03:40 首次发布

本文链接：https://blog.csdn.net/weixin_51338719/article/details/130684818

版权

4.1完成正常ip地址配置，ISP内部使用ospf协议和mpls ldp协议

4.2 PE和CE之间起ebgp邻居

4.3 PE和PE之间起mpbgp邻居

4.4 PE和CE、ASBR之间设置VRF来进行RT值的过滤，选择合适的RT值来完成需求

一实验拓扑

二实验要求

使用mpls 跨域场景，其中R1是总公司，R8,R9是分公司，要求R8和R9可以访问R1，但是R8和R9之间不能互访。
PE和CE之间使用BGP建立邻居

三实验分析

首先完成ip的正常配置，Isp使用IBG协议ospf，开启mpls ldp
PE和CE之间设置VRF，并起bgp邻居
PE和PE之间起MPBGP邻居
ASBR之间设置VRF
设置合适的RT值，让分部之间无法互访，但只能访问总部，要想满足需求，可以将两个分部的导入和导出设置为一样的，这样就一定无法互访了，然后再在靠近分部的asbr上的导出和导入值和PE上的正好相反，即导出等于导入，这样分部就可访问总部

四实验配置说明

4.1完成正常ip地址配置，ISP内部使用ospf协议和mpls ldp协议

R2：

mpls lsr-id 2.2.2.2
mpls
mpls ldp
ospf 1 
 area 0.0.0.0
interface GigabitEthernet0/0/1
 ip address 23.1.1.2 255.255.255.0 
 ospf enable 1 area 0.0.0.0
 mpls
 mpls ldp
interface LoopBack0
 ip address 2.2.2.2 255.255.255.255 
 ospf enable 1 area 0.0.0.0

R3:

mpls lsr-id 3.3.3.3
mpls
mpls ldp
ospf 1 
 area 0.0.0.0
interface GigabitEthernet0/0/0
 ip address 23.1.1.3 255.255.255.0 
 ospf enable 1 area 0.0.0.0
 mpls
 mpls ldp
interface GigabitEthernet0/0/1
 ip address 34.1.1.3 255.255.255.0 
 ospf enable 1 area 0.0.0.0
 mpls
 mpls ldp
interface LoopBack0
 ip address 3.3.3.3 255.255.255.255 
 ospf enable 1 area 0.0.0.0

R4:

mpls lsr-id 4.4.4.4
mpls
mpls ldp
ospf 1 
 area 0.0.0.0
interface GigabitEthernet0/0/0
 ip address 24.1.1.4 255.255.255.0 
 ospf enable 1 area 0.0.0.0
 mpls
 mpls ldp
interface LoopBack0
 ip address 4.4.4.4 255.255.255.255 
 ospf enable 1 area 0.0.0.0

R5:

mpls lsr-id 5.5.5.5
mpls
mpls ldp
ospf 1 
 area 0.0.0.0
interface GigabitEthernet0/0/1
 ip address 56.1.1.5 255.255.255.0 
 ospf enable 1 area 0.0.0.0
 mpls
 mpls ldp
interface LoopBack0
 ip address 5.5.5.5 255.255.255.255 
 ospf enable 1 area 0.0.0.0

R6:

mpls lsr-id 6.6.6.6
mpls
mpls ldp
ospf 1 
 area 0.0.0.0
interface GigabitEthernet0/0/0
 ip address 56.1.1.6 255.255.255.0 
 ospf enable 1 area 0.0.0.0
 mpls
 mpls ldp
interface GigabitEthernet0/0/1
 ip address 67.1.1.6 255.255.255.0 
 ospf enable 1 area 0.0.0.0
 mpls
 mpls ldp
interface LoopBack0
 ip address 6.6.6.6 255.255.255.255 
 ospf enable 1 area 0.0.0.0

R7:

mpls lsr-id 7.7.7.7
mpls
mpls ldp
ospf 1 
 area 0.0.0.0
interface GigabitEthernet0/0/0
 ip address 67.1.1.7 255.255.255.0 
 ospf enable 1 area 0.0.0.0
 mpls
 mpls ldp
interface LoopBack0
 ip address 7.7.7.7 255.255.255.255 
 ospf enable 1 area 0.0.0.0

4.2 PE和CE之间起ebgp邻居

R1:

bgp 100
 peer 12.1.1.2 as-number 200 
 #
 ipv4-family unicast
  undo synchronization
  network 1.1.1.1 255.255.255.255 
  peer 12.1.1.2 enable

R2：

ip vpn-instance aaa
 ipv4-family
  route-distinguisher 1:1
  vpn-target 100:1 export-extcommunity
  vpn-target 100:1 import-extcommunity
bgp 200
 ipv4-family vpn-instance aaa 
  peer 12.1.1.1 as-number 100

R8:

bgp 400
 peer 78.1.1.7 as-number 300 
 #
 ipv4-family unicast
  undo synchronization
  network 8.8.8.8 255.255.255.255 
  peer 78.1.1.7 enable

R9:

bgp 400
 peer 79.1.1.7 as-number 300 
 #
 ipv4-family unicast
  undo synchronization
  network 9.9.9.9 255.255.255.255 
  peer 79.1.1.7 enable

R7:

ip vpn-instance ddd
 ipv4-family
  route-distinguisher 1:4
  vpn-target 300:1 export-extcommunity
  vpn-target 400:1 import-extcommunity
#
ip vpn-instance eee
 ipv4-family
  route-distinguisher 1:5
  vpn-target 300:1 export-extcommunity
  vpn-target 400:1 import-extcommunity
#
bgp 300
 ipv4-family vpn-instance ddd 
  peer 78.1.1.8 as-number 400 
 #
 ipv4-family vpn-instance eee 
  peer 79.1.1.9 as-number 400 
#

4.3 PE和PE之间起mpbgp邻居

R2：

bgp 200
 peer 4.4.4.4 as-number 200 
 peer 4.4.4.4 connect-interface LoopBack0
 #
 ipv4-family unicast
  undo synchronization
  peer 4.4.4.4 enable
 # 
 ipv4-family vpnv4
  policy vpn-target
  peer 4.4.4.4 enable

R4：

bgp 200
 peer 2.2.2.2 as-number 200 
 peer 2.2.2.2 connect-interface LoopBack0
 #
 ipv4-family unicast
  undo synchronization
  peer 2.2.2.2 enable
 # 
 ipv4-family vpnv4
  policy vpn-target
  peer 2.2.2.2 enable
 #

R5：

bgp 300
 peer 7.7.7.7 as-number 300 
 peer 7.7.7.7 connect-interface LoopBack0
 #
 ipv4-family unicast
  undo synchronization
  peer 7.7.7.7 enable
 # 
 ipv4-family vpnv4
  policy vpn-target
  peer 7.7.7.7 enable
 #

R7：

bgp 300
 peer 5.5.5.5 as-number 300 
 peer 5.5.5.5 connect-interface LoopBack0
 #
 ipv4-family unicast
  undo synchronization
  peer 5.5.5.5 enable
 # 
 ipv4-family vpnv4
  policy vpn-target
  peer 5.5.5.5 enable
 #

4.4 PE和CE、ASBR之间设置VRF来进行RT值的过滤，选择合适的RT值来完成需求

R4：

ip vpn-instance bbb
 ipv4-family
  route-distinguisher 1:2
  vpn-target 100:1 export-extcommunity
  vpn-target 100:1 import-extcommunity
#
bgp 200
 ipv4-family vpn-instance bbb 
  peer 45.1.1.5 as-number 300 
#

R5：

ip vpn-instance ccc
 ipv4-family
  route-distinguisher 1:3
  vpn-target 400:1 export-extcommunity
  vpn-target 300:1 import-extcommunity
#
bgp 300
 peer 45.1.1.4 as-number 200 
 ipv4-family vpn-instance ccc 
  peer 45.1.1.4 as-number 200 
#

检查连通性：

R8和R1: