BGP路由优选实验(包含as策略,Community属性等)

实验背景

实验目的

1.使用AS_PATH属性，确保R4通过R3到达192.168.11.0/24
2.使用LOCAL_PREF属性，确保R1通过R2到达192.168.1.0/24
3.使用MED属性，确认R4通过R3到达192.168.12.0/24
4.使用LOCAL_PREF属性，确保R1通过R3到达192.168.2.0/24
5.使用AS策略，AS 500不接受任何始发于AS 123的路由
6.使用自定义COMMUNITY属性，确保192.168.3.0/24路由不会被发布到AS500

实验思路

分析题目要求 R4和R2 R4和R3 R1和R2 R1和R3 R1和R5 两两做bgp对等体,as123内部IGP使用ospf, 使用import-route在BGP里通告

注意 : EBGP通告的最大跳数问题 ,IBGP通告的下一跳问题 EBGP通过直连接口 创建对等体的情况下不用去设置最大跳数 但是为了保险起见 我还是设置了

在这里我们先看一下BGP的优选规则 当前一条规则的值一样时比较下一条规则
具体每条规则的属性和特征请看我上一篇博文

实验开始

第一步 配置IGP 这里必须通告本地环回接口 因为bgp是建立在tcp可达的基础上

R2

<AR2>sy
Enter system view, return user view with Ctrl+Z.
[AR2]router id 2.2.2.2
[AR2]ospf 1
[AR2-ospf-1]a 0
[AR2-ospf-1-area-0.0.0.0]net 192.168.20.0 0.0.0.255
[AR2-ospf-1-area-0.0.0.0]net 2.2.2.2 0.0.0.0
[AR2-ospf-1-area-0.0.0.0]net 12.0.0.0 0.0.0.7

R3

<AR3>sy
Enter system view, return user view with Ctrl+Z.
[AR3]router id 3.3.3.3
[AR3]ospf 1
[AR3-ospf-1]a 0
[AR3-ospf-1-area-0.0.0.0]net 192.168.100.0 0.0.0.255
[AR3-ospf-1-area-0.0.0.0]net 1.1.1.1 0.0.0.0
[AR3-ospf-1-area-0.0.0.0]net 13.0.0.0 0.0.0.7

R1

<AR1>sy
Enter system view, return user view with Ctrl+Z.
[AR1]router id 1.1.1.1
[AR1]ospf 1
[AR1-ospf-1]a 0
[AR1-ospf-1-area-0.0.0.0]net 192.168.30.0 0.0.0.255
[AR1-ospf-1-area-0.0.0.0]net 3.3.3.3 0.0.0.0
[AR1-ospf-1-area-0.0.0.0]net 13.0.0.0 0.0.0.7
[AR3-ospf-1-area-0.0.0.0]net 12.0.0.0 0.0.0.7

第二步配置BGP对等体

R4

<AR4>sy
Enter system view, return user view with Ctrl+Z.
[AR4]router id 4.4.4.4
[AR4]bgp 400
[AR4-bgp]peer 24.0.0.2 as 123
[AR4-bgp]peer 24.0.0.2 ebgp-max-hop 10
[AR4-bgp]peer 34.0.0.3 as 123
[AR4-bgp]peer 34.0.0.3 ebgp-max-hop 10

R2

[AR2]bgp 123
[AR2-bgp]peer 24.0.0.4 as-number 400 
[AR2-bgp]peer 24.0.0.4 connect-interface GigabitEthernet0/0/0
[AR2-bgp]peer 1.1.1.1 as-number 123 
[AR2-bgp]peer 1.1.1.1 connect-interface LoopBack0
[AR2-bgp]peer 1.1.1.1 next-hop-local

R3

[AR3]bgp 123
[AR3-bgp]peer 24.0.0.4 as-number 400 
[AR3-bgp]peer 34.0.0.4 connect-interface GigabitEthernet0/0/0
[AR3-bgp]peer 1.1.1.1 as-number 123 
[AR3-bgp]peer 1.1.1.1 connect-interface LoopBack0
[AR3-bgp]peer 1.1.1.1 next-hop-local

R1

[AR1]bgp 123
[AR1-bgp]peer 2.2.2.2 as-number 123 
[AR1-bgp]peer 2.2.2.2 connect-interface LoopBack0
[AR1-bgp]peer 3.3.3.3 as-number 123
[AR1-bgp]peer 3.3.3.3 connect-interface LoopBack0
[AR1-bgp]peer 15.0.0.5 as-number 500
[AR1-bgp]peer 15.0.0.5 connect-interface GigabitEthernet0/0/2
[AR1-bgp]peer 2.2.2.2 next-hop-local
[AR1-bgp]peer 3.3.3.3 next-hop-local

R5

[AR5]bgp 500
[AR5-bgp]peer 15.0.0.1 as-number 123
[AR5-bgp]peer 15.0.0.1 ebgp-max-hop 10 
[AR5-bgp]peer 15.0.0.1 connect-interface GigabitEthernet0/0/0

第三步 路由注入

R2

[AR2]bgp 123
[AR2-bgp]import-route ospf 1

题目没有要求 我又懒的情况下 bgp的路由注入全部使用import-route方式

R4

[AR4-bgp]import-route direct

R5

[AR5-bgp]import-route direct

现在查看BGP路由表发现在都学习到了(此截图是实验完成后截的与你现在的回显有出入 懒的再做一遍 将就看吧)

这里开始 根据题目要求对BGP路由进行优选

1.使用AS_PATH属性，确保R4通过R3到达192.168.11.0/24

11.0这条路由传递的方向是从右往左到R4的<<<<

根据 AS-Path属性规则(我之前的文章里写过 这里不做赘述) 我们可以增加11.0这个网段到R2的AS-Path路径值 使得R2传递的AS-Path属性值大于R3 ,R4就会选择R3这条路了

R2

[AR2]ip ip-prefix 11 permit 192.168.11.0 24
[AR2]route-policy a11 permit node 10
[AR2-route-policy]if-match ip-prefix 11
[AR2-route-policy]apply as-path 200 additive 
[AR2-route-policy]q
[AR2]route-policy a11 permit node 20
[AR2]bgp 123
[AR2]peer 24.0.0.4 route-policy a11 export

此时查看BGP路由表(等32秒 默认32秒刷新)就会看到 *>的最优路由走的是34.0.0.3这条路

2.使用LOCAL_PREF属性，确保R1通过R2到达192.168.1.0/24

此属性默认值100 越大越优 所以调整R2的lp值为200 他就会走R2 还是使用前缀列表加路由策略的方式

R2

[AR2]ip ip-prefix 1 permit 192.168.1.0 24
[AR2]route-policy a1 permit node 10
[AR2-route-policy]if-match ip-prefix 1
[AR2-route-policy]apply local-preference 200
[AR2-route-policy]q
[AR2]route-policy a1 permit node 20
[AR2]bgp 123  
[AR2]peer 1.1.1.1 route-policy a1 export

3.使用MED属性，确认R4通过R3到达192.168.12.0/24

MED属性 越小越优 我们把R2的MED值设大就会 他就会选R3 还是用路由策略

R2

[AR2]ip ip-prefix 12 permit 192.168.1.0 24
[AR2]route-policy a11 permit node 20
[AR2-route-policy]if-match ip-prefix 12
[AR2-route-policy]apply cost 100 
[AR2-route-policy]q
[AR2]route-policy a11 permit node 30
[AR2]bgp 123  
[AR2]peer 24.0.0.4 route-policy a11 export

4.使用LOCAL_PREF属性，确保R1通过R3到达192.168.2.0/24

和上述第二题同理

R3

[AR3]ip ip-prefix 2 permit 192.168.2.0 24
[AR3]route-policy a2 permit node 10
[AR3-route-policy]if-match ip-prefix 2
[AR3-route-policy]apply local-preference 200
[AR3-route-policy]q
[AR3]route-policy a11 permit node 20
[AR3]bgp 123  
[AR3]peer 1.1.1.1 route-policy a2 export

5.使用AS策略，AS 500不接受任何始发于AS 123的路由

使用AS策略 和正则表达式 来过滤

R5

[AR5]ip as-path-filter 123  deny 123$
[AR5]ip as-path-filter 123 permit .*
[AR5]bgp 500
[AR5-bgp]peer 15.0.0.1 as-path-filter 123 import

常用的正则表达式:
`.`（点）：匹配任意单个字符。
`\d`：匹配数字（0-9）。
`\D`：匹配非数字。
`\w`：匹配字母、数字或下划线。
`\W`：匹配非字母、数字或下划线。
`^`：匹配字符串开始。
`$`：匹配字符串结束。
`*`：匹配前面的元素零次或多次。
`+`：匹配前面的元素一次或多次。
`?`：匹配前面的元素零次或一次。
`{n}`：精确匹配前元素n次。
`{n,}`：匹配前元素至少n次。
`{n,m}`：匹配前元素n到m次。

6.使用自定义COMMUNITY属性，确保192.168.3.0/24路由不会被发布到AS500

使用自定义团体属性 你可以理解为打标签 之后阻止这个标签的通过

方法有很多 我只讲我写的这种

我在R1 把来自R2和R3的3.0路由信息打上500:1这个COMMUNITY属性 然后创建一个路由策略筛选出来带团体属性500:1的路由加上AS-path 500的属性 在R1去往R5的出口上应用 使得R5不会学习 以达到实验目的

R1

[AR1]ip ipv6-prefix 333 permit 192.168.3.0 24
[AR1]route-policy 333 permit node 10
[AR1-route-policy]if-match ip-prefix 333
[AR1-route-policy]apply community 500:1 
[AR1-route-policy]q
[AR1]route-policy 333 permit node 20
[AR1]bgp 123
[AR1-bgp]peer 2.2.2.2 route-policy 333 import
[AR1-bgp]peer 3.3.3.3 route-policy 333 import

[AR1]ip community-filter 33 permit 500:1
[AR1]route-policy 33 permit node 10
[AR1-route-policy]if-match community-filter 33
[AR1-route-policy]apply as-path 500 additive
[AR1-route-policy]q
[AR1]route-policy 333 permit node 20
[AR1]bgp 123
[AR1]peer 15.0.0.5 route-policy 33 export

查看路由表

实验结束 所有题目均以达到要求

下述的配置信息有点小问题(是我第一遍测试的配置) 仅供参考 问题在R2的路由策略应用上 按照上述配置就没问题

分享所有设备配置信息:

R1

<AR1>dis cu
[V200R003C00]
#
 sysname AR1
#
 snmp-agent local-engineid 800007DB03000000000000
 snmp-agent 
#
 clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
 drop illegal-mac alarm
#
 undo info-center enable
#
router id 1.1.1.1 
#
 wlan ac-global carrier id other ac id 0
#
 set cpu-usage threshold 80 restore 75
#
aaa 
 authentication-scheme default
 authorization-scheme default
 accounting-scheme default
 domain default 
 domain default_admin 
 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
 local-user admin service-type http
#
firewall zone Local
 priority 15
#
interface GigabitEthernet0/0/0
 ip address 12.0.0.1 255.255.255.248 
#
interface GigabitEthernet0/0/1
 ip address 13.0.0.1 255.255.255.248 
#
interface GigabitEthernet0/0/2
 ip address 15.0.0.1 255.255.255.248 
#
interface NULL0
#
interface LoopBack0
 ip address 1.1.1.1 255.255.255.255 
#
interface LoopBack1
 ip address 192.168.100.1 255.255.255.0 
 ip forward-broadcast 
#
bgp 123
 peer 2.2.2.2 as-number 123 
 peer 2.2.2.2 connect-interface LoopBack0
 peer 3.3.3.3 as-number 123 
 peer 3.3.3.3 connect-interface LoopBack0
 peer 15.0.0.5 as-number 500 
 peer 15.0.0.5 connect-interface GigabitEthernet0/0/2
 #
 ipv4-family unicast
  undo synchronization
  peer 2.2.2.2 enable
  peer 2.2.2.2 route-policy 333 import
  peer 2.2.2.2 next-hop-local 
  peer 2.2.2.2 advertise-community
  peer 3.3.3.3 enable
  peer 3.3.3.3 route-policy 333 import
  peer 3.3.3.3 next-hop-local 
  peer 3.3.3.3 advertise-ext-community
  peer 15.0.0.5 enable
  peer 15.0.0.5 route-policy 33 export
  peer 15.0.0.5 advertise-community
#
ospf 1 
 area 0.0.0.0 
  network 1.1.1.1 0.0.0.0 
  network 12.0.0.0 0.0.0.7 
  network 13.0.0.0 0.0.0.7 
  network 192.168.100.0 0.0.0.255 
#
route-policy c3 deny node 10 
 if-match community-filter 3 
#
route-policy c3 permit node 20 
#
route-policy 333 permit node 10 
 if-match ip-prefix 333 
 apply community 500:1 
#
route-policy 333 permit node 20 
#
route-policy 33 permit node 10 
 if-match community-filter 33 
 apply as-path 500 additive
#
route-policy 33 permit node 20 
#
ip ip-prefix 333 index 10 permit 192.168.3.0 24
#
ip community-filter 3 deny no-export
ip community-filter 33 permit 500:1
#
user-interface con 0
 authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return

R2

<AR2>dis cu
[V200R003C00]
#
 sysname AR2
#
 snmp-agent local-engineid 800007DB03000000000000
 snmp-agent 
#
 clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
 drop illegal-mac alarm
#
 undo info-center enable
#
router id 2.2.2.2 
#
 wlan ac-global carrier id other ac id 0
#
 set cpu-usage threshold 80 restore 75
#
aaa 
 authentication-scheme default
 authorization-scheme default
 accounting-scheme default
 domain default 
 domain default_admin 
 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
 local-user admin service-type http
#
firewall zone Local
 priority 15
#
interface GigabitEthernet0/0/0
 ip address 24.0.0.2 255.255.255.248 
#
interface GigabitEthernet0/0/1
 ip address 12.0.0.2 255.255.255.248 
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
 ip address 2.2.2.2 255.255.255.255 
#
interface LoopBack1
 ip address 192.168.20.2 255.255.255.0 
 ip forward-broadcast 
#
bgp 123
 peer 1.1.1.1 as-number 123 
 peer 1.1.1.1 connect-interface LoopBack0
 peer 24.0.0.4 as-number 400 
 peer 24.0.0.4 connect-interface GigabitEthernet0/0/0
 #
 ipv4-family unicast
  undo synchronization
  import-route ospf 1
  peer 1.1.1.1 enable
  peer 1.1.1.1 next-hop-local 
  peer 24.0.0.4 enable
  peer 24.0.0.4 route-policy a12 export
#
ospf 1 
 area 0.0.0.0 
  network 2.2.2.2 0.0.0.0 
  network 12.0.0.0 0.0.0.7 
  network 192.168.20.0 0.0.0.255 
#
route-policy a11 permit node 10 
 if-match ip-prefix 11 
 apply as-path 200 additive
#
route-policy a11 permit node 20 
#
route-policy a1 permit node 10 
 if-match ip-prefix 1 
 apply local-preference 200 
#
route-policy a1 permit node 20 
#
route-policy a12 permit node 10 
 if-match ip-prefix 12 
 apply cost 100 
#
route-policy a12 permit node 20 
#
ip ip-prefix 11 index 10 permit 192.168.11.0 24
ip ip-prefix 1 index 10 permit 192.168.1.0 24
ip ip-prefix 12 index 10 permit 192.168.12.0 24
#
user-interface con 0
 authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return

R3

<AR3>dis cu
[V200R003C00]
#
 sysname AR3
#
 snmp-agent local-engineid 800007DB03000000000000
 snmp-agent 
#
 clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
 drop illegal-mac alarm
#
 undo info-center enable
#
router id 3.3.3.3 
#
 wlan ac-global carrier id other ac id 0
#
 set cpu-usage threshold 80 restore 75
#
aaa 
 authentication-scheme default
 authorization-scheme default
 accounting-scheme default
 domain default 
 domain default_admin 
 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
 local-user admin service-type http
#
firewall zone Local
 priority 15
#
interface GigabitEthernet0/0/0
 ip address 34.0.0.3 255.255.255.248 
#
interface GigabitEthernet0/0/1
 ip address 13.0.0.3 255.255.255.248 
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
 ip address 3.3.3.3 255.255.255.255 
#
interface LoopBack1
 ip address 192.168.30.3 255.255.255.0 
 ip forward-broadcast 
#
bgp 123
 peer 1.1.1.1 as-number 123 
 peer 1.1.1.1 connect-interface LoopBack0
 peer 34.0.0.4 as-number 400 
 peer 34.0.0.4 connect-interface GigabitEthernet0/0/0
 #
 ipv4-family unicast
  undo synchronization
  peer 1.1.1.1 enable
  peer 1.1.1.1 route-policy a2 export
  peer 1.1.1.1 next-hop-local 
  peer 34.0.0.4 enable
#
ospf 1 
 area 0.0.0.0 
  network 3.3.3.3 0.0.0.0 
  network 13.0.0.0 0.0.0.7 
  network 192.168.30.0 0.0.0.255 
#
route-policy a2 permit node 10 
 if-match ip-prefix 2 
 apply local-preference 200 
#
route-policy a2 permit node 20 
#
ip ip-prefix 2 index 10 permit 192.168.2.0 24
#
ip as-path-filter 123 deny 123$
ip as-path-filter 123 permit .*
#
user-interface con 0
 authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return

R4

<AR4>dis cu
[V200R003C00]
#
 sysname AR4
#
 snmp-agent local-engineid 800007DB03000000000000
 snmp-agent 
#
 clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
 drop illegal-mac alarm
#
 undo info-center enable
#
router id 4.4.4.4 
#
 wlan ac-global carrier id other ac id 0
#
 set cpu-usage threshold 80 restore 75
#
aaa 
 authentication-scheme default
 authorization-scheme default
 accounting-scheme default
 domain default 
 domain default_admin 
 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
 local-user admin service-type http
#
firewall zone Local
 priority 15
#
interface GigabitEthernet0/0/0
 ip address 24.0.0.4 255.255.255.248 
#
interface GigabitEthernet0/0/1
 ip address 34.0.0.4 255.255.255.248 
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
 ip address 192.168.1.4 255.255.255.0 
#
interface LoopBack1
 ip address 192.168.2.4 255.255.255.0 
#
interface LoopBack2
 ip address 192.168.3.4 255.255.255.0 
#
bgp 400
 peer 24.0.0.2 as-number 123 
 peer 24.0.0.2 ebgp-max-hop 10 
 peer 24.0.0.2 connect-interface GigabitEthernet0/0/0
 peer 34.0.0.3 as-number 123 
 peer 34.0.0.3 ebgp-max-hop 10 
 peer 34.0.0.3 connect-interface GigabitEthernet0/0/1
 #
 ipv4-family unicast
  undo synchronization
  import-route direct
  peer 24.0.0.2 enable
  peer 24.0.0.2 route-policy a3 export
  peer 24.0.0.2 advertise-community
  peer 34.0.0.3 enable
  peer 34.0.0.3 route-policy a3 export
  peer 34.0.0.3 advertise-community
#
route-policy a3 permit node 10 
 if-match ip-prefix 3 
 apply community no-export 
#
route-policy a3 permit node 20 
#
ip ip-prefix 3 index 10 permit 192.168.3.0 24
#
user-interface con 0
 authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return

R5

<AR5>dis cu
[V200R003C00]
#
 sysname AR5
#
 snmp-agent local-engineid 800007DB03000000000000
 snmp-agent 
#
 clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
 drop illegal-mac alarm
#
 undo info-center enable
#
router id 5.5.5.5 
#
 wlan ac-global carrier id other ac id 0
#
 set cpu-usage threshold 80 restore 75
#
aaa 
 authentication-scheme default
 authorization-scheme default
 accounting-scheme default
 domain default 
 domain default_admin 
 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
 local-user admin service-type http
#
firewall zone Local
 priority 15
#
interface GigabitEthernet0/0/0
 ip address 15.0.0.5 255.255.255.248 
#
interface GigabitEthernet0/0/1
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
 ip address 192.168.10.5 255.255.255.0 
#
interface LoopBack1
 ip address 192.168.11.5 255.255.255.0 
#
interface LoopBack2
 ip address 192.168.12.5 255.255.255.0 
#
bgp 500
 peer 15.0.0.1 as-number 123 
 peer 15.0.0.1 ebgp-max-hop 10 
 peer 15.0.0.1 connect-interface GigabitEthernet0/0/0
 #
 ipv4-family unicast
  undo synchronization
  import-route direct
  peer 15.0.0.1 enable
  peer 15.0.0.1 as-path-filter 123 import 
#
route-policy 33 permit node 10 
 if-match community-filter 33 
 apply as-path 500 additive
#
route-policy 33 permit node 20 
#
ip as-path-filter 10 deny 123$
ip as-path-filter 10 permit .*
ip as-path-filter 123 deny 123$
ip as-path-filter 123 permit .*
#
ip community-filter 33 permit 500:1
#
user-interface con 0
 authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return
<AR5>