SRv6 Traffic-Engineering Policy模拟实验（H3C Cloud Lab）

本次实验模拟SRv6 TE的建立过程，并通过color的方式来进行引流，因为模拟器会有bug，所以实验中有些问题我们没办法解决，本次实验主要是理解SRv6 Policy的通信过程，所以我们不用太在意实验中遇到的问题，这个问题我会在后面讲出来。

下面我们开始实验

拓扑图：

在图中我已经将Locator和Function规划好了，大家跟着我这么配置就好了，如果有其他想法的可以自己规划，本次实验使用ospfv3来承载IGB网络，也可以使用is-is，看个人意愿，在项目中的话就要进行酌情考虑了

接着我们开始实验

1、为全网添加IPv6地址，并在相应接口启用ospfv3，同时也需要在ospfv3视图手工配置Router-id

[VSR-88_1]ospfv3 1 //进入ospfv3视图
[VSR-88_1-ospfv3-1] router-id 1.1.1.1 //配置Router-id
[VSR-88_1-ospfv3-1] area 0.0.0.0 //启用区域0（默认区域0）
[VSR-88_1-ospfv3-1] quit
[VSR-88_1]interface LoopBack0 //进入环回口1视图
[VSR-88_1-LoopBack0] ospfv3 1 area 0.0.0.0 //启用接口视图内的ospfv3功能
[VSR-88_1-LoopBack0] ipv6 address 2001::1/128 //为接口添加ipv6地址
[VSR-88_1-LoopBack0] quit
[VSR-88_1]interface GigabitEthernet0/0/0 //进入物理接口视图
[VSR-88_1-GigabitEthernet0/0/0] ospfv3 1 area 0.0.0.0 启用接口视图内的ospfv3功能
[VSR-88_1-GigabitEthernet0/0/0] ipv6 address 2013::1/124 //为接口添加ipv6地址

[VSR-88_2]ospfv3 1 //进入ospfv3视图
[VSR-88_2-ospfv3-1] router-id 1.1.1.2 //配置Router-id
[VSR-88_2-ospfv3-1] area 0.0.0.0 //启用区域0（默认区域0）
[VSR-88_2-ospfv3-1] quit
[VSR-88_2]interface LoopBack0
[VSR-88_2-LoopBack0] ospfv3 1 area 0.0.0.0
[VSR-88_2-LoopBack0] ipv6 address 2001::2/128
[VSR-88_2-LoopBack0] quit
[VSR-88_2]interface GigabitEthernet0/0/0
[VSR-88_2-GigabitEthernet0/0/0] port link-mode route
[VSR-88_2-GigabitEthernet0/0/0] ospfv3 1 area 0.0.0.0
[VSR-88_2-GigabitEthernet0/0/0] ipv6 address 2023::1/124
[VSR-88_2-GigabitEthernet0/0/0] quit
[VSR-88_2]interface GigabitEthernet0/0/1
[VSR-88_2-GigabitEthernet0/0/1] port link-mode route
[VSR-88_2-GigabitEthernet0/0/1] ospfv3 1 area 0.0.0.0
[VSR-88_2-GigabitEthernet0/0/1] ipv6 address 2024::2/124
[VSR-88_2-GigabitEthernet0/0/1] quit
[VSR-88_2]interface GigabitEthernet0/0/2
[VSR-88_2-GigabitEthernet0/0/2] port link-mode route 
[VSR-88_2-GigabitEthernet0/0/2] ospfv3 1 area 0.0.0.0
[VSR-88_2-GigabitEthernet0/0/2] ipv6 address 2025::2/124

[VSR-88_3]ospfv3 1 //进入ospfv3视图
[VSR-88_3-ospfv3-1] router-id 1.1.1.3 //配置Router-id
[VSR-88_3-ospfv3-1] area 0.0.0.0 //启用区域0（默认区域0）
[VSR-88_3-ospfv3-1] quit
[VSR-88_3]interface LoopBack0
[VSR-88_3-LoopBack0] ospfv3 1 area 0.0.0.0
[VSR-88_3-LoopBack0] ipv6 address 2001::3/128
[VSR-88_3-LoopBack0] quit
[VSR-88_3]interface GigabitEthernet0/0/0
[VSR-88_3-GigabitEthernet0/0/0] port link-mode route
[VSR-88_3-GigabitEthernet0/0/0] ospfv3 1 area 0.0.0.0
[VSR-88_3-GigabitEthernet0/0/0] ipv6 address 2013::3/124
[VSR-88_3-GigabitEthernet0/0/0] quit
[VSR-88_3]interface GigabitEthernet0/0/1
[VSR-88_3-GigabitEthernet0/0/1] port link-mode route
[VSR-88_3-GigabitEthernet0/0/1] ospfv3 1 area 0.0.0.0
[VSR-88_3-GigabitEthernet0/0/1] ipv6 address 2023::3/124
[VSR-88_3-GigabitEthernet0/0/1] quit
[VSR-88_3]interface GigabitEthernet0/0/2
[VSR-88_3-GigabitEthernet0/0/2] port link-mode route
[VSR-88_3-GigabitEthernet0/0/2] ospfv3 1 area 0.0.0.0
[VSR-88_3-GigabitEthernet0/0/2] ipv6 address 2034::3/124

[VSR-88_4]ospfv3 1 //进入ospfv3视图
[VSR-88_4-ospfv3-1] router-id 1.1.1.4 //配置Router-id
[VSR-88_4-ospfv3-1] area 0.0.0.0 //启用区域0（默认区域0）
[VSR-88_4-ospfv3-1] quit
[VSR-88_4]interface LoopBack0
[VSR-88_4-LoopBack0] ospfv3 1 area 0.0.0.0
[VSR-88_4-LoopBack0] ipv6 address 2001::4/128
[VSR-88_4-LoopBack0] quit
[VSR-88_4]interface GigabitEthernet0/0/0
[VSR-88_4-GigabitEthernet0/0/0] port link-mode route
[VSR-88_4-GigabitEthernet0/0/0] ospfv3 1 area 0.0.0.0
[VSR-88_4-GigabitEthernet0/0/0] ipv6 address 2024::4/124
[VSR-88_4-GigabitEthernet0/0/0] quit
[VSR-88_4]interface GigabitEthernet0/0/1
[VSR-88_4-GigabitEthernet0/0/1] port link-mode route
[VSR-88_4-GigabitEthernet0/0/1] ospfv3 1 area 0.0.0.0
[VSR-88_4-GigabitEthernet0/0/1] ipv6 address 2023::4/124
[VSR-88_4-GigabitEthernet0/0/1] quit
[VSR-88_4]interface GigabitEthernet0/0/2
[VSR-88_4-GigabitEthernet0/0/2] port link-mode route
[VSR-88_4-GigabitEthernet0/0/2] ospfv3 1 area 0.0.0.0
[VSR-88_4-GigabitEthernet0/0/2] ipv6 address 2045::4/124

[VSR-88_5]interface LoopBack0
[VSR-88_5-LoopBack0] ospfv3 1 area 0.0.0.0
[VSR-88_5-LoopBack0] ipv6 address 2001::5/128
[VSR-88_5-LoopBack0] quit
[VSR-88_5]interface GigabitEthernet0/0/0
[VSR-88_5-GigabitEthernet0/0/0] port link-mode route
[VSR-88_5-GigabitEthernet0/0/0] ospfv3 1 area 0.0.0.0
[VSR-88_5-GigabitEthernet0/0/0] ipv6 address 2045::5/124
[VSR-88_5-GigabitEthernet0/0/0]  quit
[VSR-88_5]interface GigabitEthernet0/0/1
[VSR-88_5-GigabitEthernet0/0/1] port link-mode route
[VSR-88_5-GigabitEthernet0/0/1] ospfv3 1 area 0.0.0.0
[VSR-88_5-GigabitEthernet0/0/1] ipv6 address 2025::5/124

配置完成后我们查看ospfv3邻居关系及路由

 

因为路由表太长了，这里我就不截图出来了，大家可以自己去查看路由表，我这里只查看了ospfv3的lsdb数据库，所有设备的router-id已经学到了。

接下来我们先配置SRv6 BE，然后查看BE的建立情况

2、进入SRv6手工创建Locator、然后静态配置基于链路的SID、节点的SID

[VSR-88_1]segment-routing ipv6 //进入SRv6视图
[VSR-88_1-segment-routing-ipv6] encapsulation source-address 2001::1 //封装源地址为环回地址
[VSR-88_1-segment-routing-ipv6] locator h3c ipv6-prefix A100:: 96 static 16 //创建Locator并配置IPv6前缀为A100::掩码为96，静态和动态分别为16位
[VSR-88_1-segment-routing-ipv6-locator-h3c]  opcode 1 end //配置节点的SID为A100::1
[VSR-88_1-segment-routing-ipv6-locator-h3c]  opcode 12 end-x interface GigabitEthernet0/0/0 nexthop 2013::3 //配置链路的SID，此Function的行为表示将报文从指定接口（G0/0/0），转发给对应的邻居节点（2013::3）。

[VSR-88_2]segment-routing ipv6
[VSR-88_2-segment-routing-ipv6] encapsulation source-address 2001::2
[VSR-88_2-segment-routing-ipv6] locator h3c ipv6-prefix A200:: 96 static 16
[VSR-88_2-segment-routing-ipv6-locator-h3c]  opcode 1 end
[VSR-88_2-segment-routing-ipv6-locator-h3c]  opcode 23 end-x interface GigabitEthernet0/0/0 nexthop 2023::3
[VSR-88_2-segment-routing-ipv6-locator-h3c]  opcode 24 end-x interface GigabitEthernet0/0/1 nexthop 2024::4
[VSR-88_2-segment-routing-ipv6-locator-h3c]  opcode 25 end-x interface GigabitEthernet0/0/2 nexthop 2025::5

[VSR-88_3]segment-routing ipv6
[VSR-88_3-segment-routing-ipv6] encapsulation source-address 2001::3
[VSR-88_3-segment-routing-ipv6] locator h3c ipv6-prefix A300:: 96 static 16
[VSR-88_3-segment-routing-ipv6-locator-h3c]  opcode 1 end
[VSR-88_3-segment-routing-ipv6-locator-h3c]  opcode 31 end-x interface GigabitEthernet0/0/0 nexthop 2013::1
[VSR-88_3-segment-routing-ipv6-locator-h3c]  opcode 32 end-x interface GigabitEthernet0/0/1 nexthop 2023::2
[VSR-88_3-segment-routing-ipv6-locator-h3c]  opcode 34 end-x interface GigabitEthernet0/0/2 nexthop 2034::4

[VSR-88_4]segment-routing ipv6
[VSR-88_4-segment-routing-ipv6] encapsulation source-address 2001::4
[VSR-88_4-segment-routing-ipv6] locator h3c ipv6-prefix A400:: 96 static 16
[VSR-88_4-segment-routing-ipv6-locator-h3c]  opcode 1 end
[VSR-88_4-segment-routing-ipv6-locator-h3c]  opcode 42 end-x interface GigabitEthernet0/0/0 nexthop 2024::2
[VSR-88_4-segment-routing-ipv6-locator-h3c]  opcode 43 end-x interface GigabitEthernet0/0/1 nexthop 2034::3
[VSR-88_4-segment-routing-ipv6-locator-h3c]  opcode 45 end-x interface GigabitEthernet0/0/2 nexthop 2045::5

[VSR-88_5]segment-routing ipv6
[VSR-88_5-segment-routing-ipv6] encapsulation source-address 2001::5
[VSR-88_5-segment-routing-ipv6] locator h3c ipv6-prefix A500:: 96 static 16
[VSR-88_5-segment-routing-ipv6-locator-h3c]  opcode 1 end
[VSR-88_5-segment-routing-ipv6-locator-h3c]  opcode 52 end-x interface GigabitEthernet0/0/1 nexthop 2025::2
[VSR-88_5-segment-routing-ipv6-locator-h3c]  opcode 54 end-x interface GigabitEthernet0/0/0 nexthop 2045::4

3、配置完成后在VSR1上创建TE Policy

[VSR-88_1]segment-routing ipv6  //进入SRv6视图
[VSR-88_1-segment-routing-ipv6]traffic-engineering //进入TE的视图
[VSR-88_1-srv6-te]  srv6-policy locator h3c //关联locator
[VSR-88_1-srv6-te]  segment-list 1 //创建段路由
[VSR-88_1-srv6-te-sl-1] index 10 ipv6 A300::1 //通过配置索引来指导转发，索引的地址为End
[VSR-88_1-srv6-te-sl-1] index 20 ipv6 A200::1
[VSR-88_1-srv6-te-sl-1] index 30 ipv6 A400::1
[VSR-88_1-srv6-te-sl-1] index 40 ipv6 A500::1
[VSR-88_1-srv6-te-sl-1] quit
[VSR-88_1-srv6-te]  policy h3c //创建TE的动作
[VSR-88_1-srv6-te-policy-h3c] binding-sid ipv6 A100::10 //将这个策略绑定到A100::10，在此实验中不做标签粘连，可以忽略这条命令
[VSR-88_1-srv6-te-policy-h3c] color 100 end-point ipv6 2001::5 //匹配color值为100，尾节点为2001::5
[VSR-88_1-srv6-te-policy-h3c] candidate-paths //配置候选路径
[VSR-88_1-srv6-te-policy-h3c-path] preference 200 //进入优先级视图
[VSR-88_1-srv6-te-policy-h3c-path-pref-200] explicit segment-list 1 //关联segment-list 1

 创建完成后查看TE Policy建立情况

可以看我们配置的color 和尾节点的IPv6地址，另外可以看到这个策略是UP的

4、、接着我们在VSR1和VSR5上创建VRF，然后建立BGP vpnv4的邻居

[VSR-88_1]ip vpn-instance h3c //创建vpn实例h3c
[VSR-88_1-vpn-instance-h3c] route-distinguisher 100:1 //将RD值设为100:1
[VSR-88_1-vpn-instance-h3c] vpn-target 100:1 import-extcommunity //将RT入方向的值配置为100:1
[VSR-88_1-vpn-instance-h3c] vpn-target 100:1 export-extcommunity //将RT出方向的值配置为100:1

[VSR-88_1]interface LoopBack1
[VSR-88_1-LoopBack1] ip binding vpn-instance h3c //环回口绑定VPN实例
[VSR-88_1-LoopBack1] ip address 11.11.11.11 255.255.255.255

[VSR-88_1]ip vpn-instance h3c //创建vpn实例h3c
[VSR-88_1-vpn-instance-h3c] route-distinguisher 100:1 //将RD值设为100:1
[VSR-88_1-vpn-instance-h3c] vpn-target 100:1 import-extcommunity //将RT入方向的值配置为100:1
[VSR-88_1-vpn-instance-h3c] vpn-target 100:1 export-extcommunity //将RT出方向的值配置为100:1

[VSR-88_1]interface LoopBack1
[VSR-88_5-LoopBack1] ip binding vpn-instance h3c
[VSR-88_5-LoopBack1] ip address 55.55.55.55 255.255.255.255

建立BGP邻居并关联SRv6的TE功能，VSR1访问VSR5我们使用TE隧道，VSR5访问VSR1使用BE隧道

[VSR-88_1]bgp 100
[VSR-88_1-bgp-default] router-id 1.1.1.1 //配置BGP的Router-id为1.1.1.1
[VSR-88_1-bgp-default] peer 2001::5 as-number 100
[VSR-88_1-bgp-default] peer 2001::5 connect-interface LoopBack0
[VSR-88_1-bgp-default] address-family vpnv4
[VSR-88_1-bgp-default-vpnv4]  peer 2001::5 enable
[VSR-88_1-bgp-default-vpnv4]  peer 2001::5 prefix-sid //与指定对等体交换前缀段id
[VSR-88_1-bgp-default-vpnv4] quit
[VSR-88_1-bgp-default] ip vpn-instance h3c
[VSR-88_1-bgp-default-h3c]  address-family ipv4 unicast
[VSR-88_1-bgp-default-ipv4-h3c]  segment-routing ipv6 traffic-engineering //开启SRv6的TE功能
[VSR-88_1-bgp-default-ipv4-h3c]  segment-routing ipv6 locator h3c //关联SRv6的Locator
[VSR-88_1-bgp-default-ipv4-h3c]  import-route direct

[VSR-88_5]bgp 100
[VSR-88_5-bgp-default] router-id 1.1.1.5
[VSR-88_5-bgp-default] peer 2001::1 as-number 100
[VSR-88_5-bgp-default] peer 2001::1 connect-interface LoopBack0
[VSR-88_5-bgp-default] address-family vpnv4
[VSR-88_5-bgp-default-vpnv4] peer 2001::1 enable
[VSR-88_5-bgp-default-vpnv4] peer 2001::1 prefix-sid
[VSR-88_5-bgp-default-vpnv4] quit
[VSR-88_5-bgp-default] ip vpn-instance h3c
[VSR-88_5-bgp-default-h3c] address-family ipv4 unicast
[VSR-88_5-bgp-default-ipv4-h3c] segment-routing ipv6 best-effort
[VSR-88_5-bgp-default-ipv4-h3c] segment-routing ipv6 locator h3c
[VSR-88_5-bgp-default-ipv4-h3c] import-route direct

5、创建路由策略将对方发来的路由打上color，这样就能命中到我们的TE策略 ，根据TE来转发了

[VSR-88_1]route-policy color permit node 10
[VSR-88_1-route-policy-color-10] apply extcommunity color 00:100 //添加拓展团体属性，动作为打上Color值100

接着我们在BGP里面通告这条路由策略

[VSR-88_1]bgp 100
[VSR-88_1-bgp-default] address-family vpnv4
[VSR-88_1-bgp-default-vpnv4] peer 2001::5 route-policy color import //在入方向针对邻居发来的路由应用路由策略

最后我们查看BGP的邻居关系和路由表

 可以看到已经学到了对方的路由，接着我们查看vpn的路由表查看路由选路

可以看到去往VSR5的路由已经命中了我们创建的TE Policy

 注：能加路由表说明该路由有效，根据BGP的选路规则也能得出，此条路由是有效的，否则也不可能进行路由加表。

 我们尝试ping一下

发现完全不通

我们抓包来看一下

可以看到没有出现任何关于ICMP的报文

在华三的官网查到

在华三的设备中，缺省PE是不会将私网路由迭代到End.DT4 SID的路由表上去的，需要这么一条命令来配置私网路由迭代

还有另一种情况，就是如果将两边的vpn实例的RD值配置成不一样，那么路由就变成了无效路由了，学过VRF的小伙伴应该知道RD值在不同的设备上配置成不一样是完全不会影响路由的转发的，在这里就会出现这个问题，感兴趣的小伙伴可以自己去尝试

最好我们再查看一下BGP的路由详细信息

从图中我们可以看到，这条End.DT4的路由已经被迭代了，并且也能看到我们打上的Color值

还有就是ping我们配置的End的地址和End.X的地址都不通，抓包也发现没有包出来，主要就是熟悉配置的过程，至于不通也没有非常大的影响，下次遇到需要搭建SRv6的情况也不至于啥都不懂，本次实验就到这里了。