MPLSVPN典型配置案例.ppt

MPLSVPN典型配置案例 日期 杭州华三通信技术有限公司版权所有 未经授权不得使用与传播 MPLS基本配置 静态建立LSP 组网需求RouterA RouterB和RouterC均支持MPLS 运行OSPF作为MPLS骨干网上的IGP 在RouterA和RouterC之间建立双向静态LSP 并检测LSP的有效性和可达性 1 配置各接口的IP地址配置各接口的IP地址和掩码 包括Loopback接口 具体配置过程略 2 配置OSPF 以保证各路由器之间路由可达 配置RouterA system view RouterA ospf RouterA ospf 1 area0 RouterA ospf 1 area 0 0 0 0 network1 1 1 90 0 0 0 RouterA ospf 1 area 0 0 0 0 network10 1 1 00 0 0 255 RouterA ospf 1 area 0 0 0 0 quit RouterA ospf 1 quit 配置RouterB system view RouterB ospf RouterB ospf 1 area0 RouterB ospf 1 area 0 0 0 0 network2 2 2 90 0 0 0 RouterB ospf 1 area 0 0 0 0 network10 1 1 00 0 0 255 RouterB ospf 1 area 0 0 0 0 network20 1 1 00 0 0 255 RouterB ospf 1 area 0 0 0 0 quit RouterB ospf 1 quit 配置RouterC system view RouterC ospf RouterC ospf 1 area0 RouterC ospf 1 area 0 0 0 0 network3 3 3 90 0 0 0 RouterC ospf 1 area 0 0 0 0 network20 1 1 00 0 0 255 RouterC ospf 1 area 0 0 0 0 quit RouterC ospf 1 quit 配置完成后 在各路由器上执行displayiprouting table命令 可以看到相互之间都学到了到对方的主机路由 以RouterA为例 RouterA displayiprouting tableRoutingTables PublicDestinations 9Routes 9Destination MaskProtoPreCostNextHopInterface1 1 1 9 32Direct00127 0 0 1InLoop02 2 2 9 32OSPF10156210 1 1 2S2 03 3 3 9 32OSPF10312410 1 1 2S2 010 1 1 0 24Direct0010 1 1 1S2 010 1 1 1 32Direct00127 0 0 1InLoop010 1 1 2 32Direct0010 1 1 2S2 020 1 1 0 24OSPF10312410 1 1 2S2 0127 0 0 0 8Direct00127 0 0 1InLoop0127 0 0 1 32Direct00127 0 0 1InLoop0 3 使能MPLS功能 配置RouterA RouterA mplslsr id1 1 1 9 RouterA mpls RouterA mpls quit RouterA interfaceserial2 0 RouterA Serial2 0 mpls RouterA Serial2 0 quit 配置RouterB RouterB mplslsr id2 2 2 9 RouterB mpls RouterB mpls quit RouterB interfaceserial2 0 RouterB Serial2 0 mpls RouterB Serial2 0 quit RouterB interfaceserial2 1 RouterB Serial2 1 mpls RouterB Serial2 1 quit 配置RouterC RouterC mplslsr id3 3 3 9 RouterC mpls RouterC mpls quit RouterC interfaceserial2 0 RouterC Serial2 0 mpls RouterC Serial2 0 quit 4 创建从RouterA到RouterC的静态LSP 配置IngressRouterA RouterA static lspingressAtoCdestination3 3 3 932nexthop10 1 1 2out label30 配置TransitRouterB RouterB static lsptransitAtoCincoming interfaceserial2 0in label30nexthop20 1 1 2out label50 配置EgressRouterC RouterC static lspegressAtoCincoming interfaceserial2 0in label50 5 创建从RouterC到RouterA的静态LSP 配置IngressRouterC RouterC static lspingressCtoAdestination1 1 1 932nexthop20 1 1 1out label40 配置TransitRouterB RouterB static lsptransitCtoAincoming interfaceserial2 1in label40nexthop10 1 1 1out label70 配置EgressRouterA RouterA static lspegressCtoAincoming interfaceserial2 0in label70 6 检查配置结果 配置完成后 可以在各路由器上通过displaymplsstatic lsp命令查看静态LSP的信息 以RouterA的显示信息为例 RouterA displaymplsstatic lsptotalstatics lsp 2NameFECI OLabelI OIfStateAtoC3 3 3 9 32NULL 30 S2 0UpCtoA 70 NULLS2 0 Up 在RouterA上检测RouterA到RouterC静态LSP的可达性 RouterA pinglspipv43 3 3 932LSPPingFEC LDPIPV4PREFIX3 3 3 9 32 100databytes pressCTRL CtobreakReplyfrom20 1 1 2 bytes 100Sequence 1time 76msReplyfrom20 1 1 2 bytes 100Sequence 2time 75msReplyfrom20 1 1 2 bytes 100Sequence 3time 75msReplyfrom20 1 1 2 bytes 100Sequence 4time 75msReplyfrom20 1 1 2 bytes 100Sequence 5time 75ms FEC LDPIPV4PREFIX3 3 3 9 32pingstatistics 5packet s transmitted5packet s received0 00 packetlossround tripmin avg max 75 75 76ms 在RouterC上检测RouterC到RouterA静态LSP的可达性 RouterC pinglspipv41 1 1 932LSPPingFEC LDPIPV4PREFIX1 1 1 9 32 100databytes pressCTRL CtobreakReplyfrom10 1 1 1 bytes 100Sequence 1time 75msReplyfrom10 1 1 1 bytes 100Sequence 2time 75msReplyfrom10 1 1 1 bytes 100Sequence 3time 75msReplyfrom10 1 1 1 bytes 100Sequence 4time 74msReplyfrom10 1 1 1 bytes 100Sequence 5time 75ms FEC LDPIPV4PREFIX1 1 1 9 32pingstatistics 5packet s transmitted5packet s received0 00 packetlossround tripmin avg max 74 74 75ms MPLS基本配置 LDP动态建立LSP 组网需求RouterA RouterB和RouterC均支持MPLS 运行OSPF作为MPLS骨干网上的IGP 在RouterA到RouterC之间使用LDP动态建立LSP 并检测LSP的有效性和可达性 1 配置各接口的IP地址配置各接口IP地址和掩码 包括Loopback接口 具体配置过程略 2 配置OSPF 以保证各路由器之间路由可达 配置RouterA system view RouterA ospf RouterA ospf 1 area0 RouterA ospf 1 area 0 0 0 0 network1 1 1 90 0 0 0 RouterA ospf 1 area 0 0 0 0 network10 1 1 00 0 0 255 RouterA ospf 1 area 0 0 0 0 quit RouterA ospf 1 quit 配置RouterB system view RouterB ospf RouterB ospf 1 area0 RouterB ospf 1 area 0 0 0 0 network2 2 2 90 0 0 0 RouterB ospf 1 area 0 0 0 0 network10 1 1 00 0 0 255 RouterB ospf 1 area 0 0 0 0 network20 1 1 00 0 0 255 RouterB ospf 1 area 0 0 0 0 quit RouterB ospf 1 quit 配置RouterC system view RouterC ospf RouterC ospf 1 area0 RouterC ospf 1 area 0 0 0 0 network3 3 3 90 0 0 0 RouterC ospf 1 area 0 0 0 0 network20 1 1 00 0 0 255 RouterC ospf 1 area 0 0 0 0 quit RouterC ospf 1 quit 配置完成后 在各路由器上执行displayiprouting table命令 可以看到相互之间都学到了到对方的主机路由 以RouterA为例 RouterA displayiprouting tableRoutingTables PublicDestinations 9Routes 9Destination MaskProtoPreCostNextHopInterface1 1 1 9 32Direct00127 0 0 1InLoop02 2 2 9 32OSPF10156210 1 1 2S2 03 3 3 9 32OSPF10312410 1 1 2S2 010 1 1 0 24Direct0010 1 1 1S2 010 1 1 1 32Direct00127 0 0 1InLoop010 1 1 2 32Direct0010 1 1 2S2 020 1 1 0 24OSPF10312410 1 1 2S2 0127 0 0 0 8Direct00127 0 0 1InLoop0127 0 0 1 32Direct00127 0 0 1InLoop0 3 使能MPLS和MPLSLDP功能 配置RouterA RouterA mplslsr id1 1 1 9 RouterA mpls RouterA mpls quit RouterA mplsldp RouterA mpls ldp quit RouterA interfaceserial2 0 RouterA Serial2 0 mpls RouterA Serial2 0 mplsldp RouterA Serial2 0 quit 配置RouterB RouterB mplslsr id2 2 2 9 RouterB mpls RouterB mpls quit RouterB mplsldp RouterB mpls ldp quit RouterB interfaceserial2 0 RouterB Serial2 0 mpls RouterB Serial2 0 mplsldp RouterB Serial2 0 quit RouterB interfaceserial2 1 RouterB Serial2 1 mpls RouterB Serial2 1 mplsldp RouterB Serial2 1 quit 配置RouterC RouterC mplslsr id3 3 3 9 RouterC mpls RouterC mpls quit RouterC mplsldp RouterC mpls ldp quit RouterC interfaceserial2 0 RouterC Serial2 0 mpls RouterC Serial2 0 mplsldp RouterC Serial2 0 quit 完成上述配置后 RouterA和RouterB RouterB和RouterC之间的本地LDP会话建立成功 在各路由器上执行displaymplsldpsession命令 可以看到LDP会话的建立情况 执行displaymplsldppeer命令 可以看到LDP的对等体情况 以RouterA为例 RouterA displaymplsldpsessionLDPSession s inPublicNetworkTotalnumberofsessions 1 Peer IDStatusLAMSsnRoleFTMD5KA Sent Rcv 2 2 2 9 0OperationalDUPassiveOffOff5 5 LAM LabelAdvertisementModeFT FaultTolerance RouterA displaymplsldppeerLDPPeerInformationinPublicnetworkTotalnumberofpeers 1 Peer IDTransport AddressDiscovery Source 2 2 2 9 02 2 2 9Serial2 0 4 配置LSP的触发建立策略为所有静态路由和IGP路由项都触发LDP建立LSP 配置RouterA RouterA mpls RouterA mpls lsp triggerall RouterA mpls quit 配置RouterB RouterB mpls RouterB mpls lsp triggerall RouterB mpls quit 配置RouterC RouterC mpls RouterC mpls lsp triggerall RouterC mpls quit 配置完成后 在各设备上执行displaymplsldplsp命令 可以看到LDPLSP的建立情况 以RouterA为例 RouterA displaymplsldplspLDPLSPInformation SNDestAddress MaskIn OutLabelNext HopIn Out Interface 11 1 1 9 323 NULL127 0 0 1 InLoop022 2 2 9 32NULL 310 1 1 2 S2 033 3 3 9 32NULL 102410 1 1 2 S2 0420 1 1 0 24NULL 310 1 1 2 S2 0 A beforeanLSPmeanstheLSPisnotestablishedA beforeaLabelmeanstheUSCBorDSCBisstale 在RouterA上检测RouterA到RouterC的LDPLSP的有效性和可达性 RouterA pinglspipv43 3 3 932LSPPingFEC LDPIPV4PREFIX3 3 3 9 32 100databytes pressCTRL CtobreakReplyfrom20 1 1 2 bytes 100Sequence 1time 75msReplyfrom20 1 1 2 bytes 100Sequence 2time 75msReplyfrom20 1 1 2 bytes 100Sequence 3time 74msReplyfrom20 1 1 2 bytes 100Sequence 4time 75msReplyfrom20 1 1 2 bytes 100Sequence 5time 74ms FEC LDPIPV4PREFIX3 3 3 9 32pingstatistics 5packet s transmitted5packet s received0 00 packetlossround tripmin avg max 74 74 75ms 在RouterC上检测RouterA到RouterC的LDPLSP的有效性和可达性 RouterC pinglspipv41 1 1 932LSPPingFEC LDPIPV4PREFIX1 1 1 9 32 100databytes pressCTRL CtobreakReplyfrom10 1 1 1 bytes 100Sequence 1time 75msReplyfrom10 1 1 1 bytes 100Sequence 2time 75msReplyfrom10 1 1 1 bytes 100Sequence 3time 74msReplyfrom10 1 1 1 bytes 100Sequence 4time 74msReplyfrom10 1 1 1 bytes 100Sequence 5time 74ms FEC LDPIPV4PREFIX1 1 1 9 32pingstatistics 5packet s transmitted5packet s received0 00 packetlossround tripmin avg max 74 74 75ms MPLSVPN典型配置举例 组网需求CE1 CE3属于VPN1 CE2 CE4属于VPN2 VPN1使用的VPNTarget属性为111 1 VPN2使用的VPNTarget属性为222 2 不同VPN用户之间不能互相访问 CE与PE之间配置EBGP交换VPN路由信息 PE与PE之间配置OSPF实现PE内部的互通 配置MP IBGP交换VPN路由信息 1 在MPLS骨干网上配置IGP协议 实现骨干网PE和P的互通 配置PE1 system view PE1 interfaceloopback0 PE1 LoopBack0 ipaddress1 1 1 932 PE1 LoopBack0 quit PE1 interfacepos5 0 PE1 POS5 0 ipaddress172 1 1 124 PE1 POS5 0 quit PE1 ospf PE1 ospf 1 area0 PE1 ospf 1 area 0 0 0 0 network172 1 1 00 0 0 255 PE1 ospf 1 area 0 0 0 0 network1 1 1 90 0 0 0 PE1 ospf 1 area 0 0 0 0 quit PE1 ospf 1 quit 配置P system view P interfaceloopback0 P LoopBack0 ipaddress2 2 2 932 P LoopBack0 quit P interfacepos5 0 P POS5 0 ipaddress172 1 1 224 P POS5 0 quit P interfacepos5 1 P POS5 1 ipaddress172 2 1 124 P POS5 1 quit P ospf P ospf 1 area0 P ospf 1 area 0 0 0 0 network172 1 1 00 0 0 255 P ospf 1 area 0 0 0 0 network172 2 1 00 0 0 255 P ospf 1 area 0 0 0 0 network2 2 2 90 0 0 0 P ospf 1 area 0 0 0 0 quit P ospf 1 quit 配置PE2 system view PE2 interfaceloopback0 PE2 LoopBack0 ipaddress3 3 3 932 PE2 LoopBack0 quit PE2 interfacepos5 0 PE2 POS5 0 ipaddress172 2 1 224 PE2 POS5 0 quit PE2 ospf PE2 ospf 1 area0 PE2 ospf 1 area 0 0 0 0 network172 2 1 00 0 0 255 PE2 ospf 1 area 0 0 0 0 network3 3 3 90 0 0 0 PE2 ospf 1 area 0 0 0 0 quit PE2 ospf 1 quit 配置完成后 PE1 P PE2之间应能建立OSPF邻居 执行displayospfpeer命令可以看到邻居达到FULL状态 执行displayiprouting table命令可以看到PE之间学习到对方的Loopback路由 以PE1为例 PE1 displayiprouting tableRoutingTables PublicDestinations 9Routes 9Destination MaskProtoPreCostNextHopInterface1 1 1 9 32Direct00127 0 0 1InLoop02 2 2 9 32OSPF101172 1 1 2POS5 03 3 3 9 32OSPF102172 1 1 2POS5 0127 0 0 0 8Direct00127 0 0 1InLoop0127 0 0 1 32Direct00127 0 0 1InLoop0172 1 1 0 24Direct00172 1 1 1POS5 0172 1 1 1 32Direct00127 0 0 1InLoop0172 1 1 2 32Direct00172 1 1 2POS5 0172 2 1 0 24OSPF101172 1 1 2POS5 0 PE1 displayospfpeerverboseOSPFProcess1withRouterID1 1 1 9NeighborsArea0 0 0 0interface172 1 1 1 POS5 0 sneighborsRouterID 172 1 1 2Address 172 1 1 2GRState NormalState FullMode NbrisMasterPriority 1DR NoneBDR NoneMTU 1500Deadtimerduein38secNeighborisupfor00 02 44AuthenticationSequence 0 Neighborstatechangecount 5 2 在MPLS骨干网上配置MPLS基本能力和MPLSLDP 建立LDPLSP 配置PE1 PE1 mplslsr id1 1 1 9 PE1 mpls PE1 mpls quit PE1 mplsldp PE1 mpls ldp quit PE1 interfacepos5 0 PE1 POS5 0 mpls PE1 POS5 0 mplsldp PE1 POS5 0 quit 配置P P mplslsr id2 2 2 9 P mpls P mpls quit P mplsldp P mpls ldp quit P interfacepos5 0 P POS5 0 mpls P POS5 0 mplsldp P POS5 0 quit P interfacepos5 1 P POS5 1 mpls P POS5 1 mplsldp P POS5 1 quit 配置PE2 PE2 mplslsr id3 3 3 9 PE2 mpls PE2 mpls quit PE2 mplsldp PE2 mpls ldp quit PE2 interfacepos5 0 PE2 POS5 0 mpls PE2 POS5 0 mplsldp PE2 POS5 0 quit 上述配置完成后 PE1 P PE2之间应能建立LDP会话 执行displaymplsldpsession命令可以看到显示结果中SessionState项为Operational 执行displaymplsldplsp命令 可以看到LDPLSP的建立情况 以PE1为例 PE1 displaymplsldpsessionLDPSession s inPublicNetwork Peer IDStatusLAMSsnRoleFTMD5KA Sent Rcv 2 2 2 9 0OperationalDUPassiveOffOff5 5 LAM LabelAdvertisementModeFT FaultTolerance PE1 displaymplsldplspLDPLSPInformation SNDestAddress MaskIn OutLabelNext HopIn Out Interface 11 1 1 9 323 NULL127 0 0 1POS5 0 InLoop022 2 2 9 32NULL 3172 1 1 2 POS5 033 3 3 9 32NULL 1024172 1 1 2 POS5 0 A beforeanLSPmeanstheLSPisnotestablishedA beforeaLabelmeanstheUSCBorDSCBisstale 3 在PE设备上配置VPN实例 将CE接入PE 配置PE1 PE1 ipvpn instancevpn1 PE1 vpn instance vpn1 route distinguisher100 1 PE1 vpn instance vpn1 vpn target111 1 PE1 vpn instance vpn1 quit PE1 ipvpn instancevpn2 PE1 vpn instance vpn2 route distinguisher100 2 PE1 vpn instance vpn2 vpn target222 2 PE1 vpn instance vpn2 quit PE1 interfaceethernet1 1 PE1 Ethernet1 1 ipbindingvpn instancevpn1 PE1 Ethernet1 1 ipaddress10 1 1 224 PE1 Ethernet1 1 quit PE1 interfaceethernet1 2 PE1 Ethernet1 2 ipbindingvpn instancevpn2 PE1 Ethernet1 2 ipaddress10 2 1 224 PE1 Ethernet1 2 quit 配置PE2 PE2 ipvpn instancevpn1 PE2 vpn instance vpn1 route distinguisher200 1 PE2 vpn instance vpn1 vpn target111 1 PE2 vpn instance vpn1 quit PE2 ipvpn instancevpn2 PE2 vpn instance vpn2 route distinguisher200 2 PE2 vpn instance vpn2 vpn target222 2 PE2 vpn instance vpn2 quit PE2 interfaceethernet1 1 PE2 Ethernet1 1 ipbindingvpn instancevpn1 PE2 Ethernet1 1 ipaddress10 3 1 224 PE2 Ethernet1 1 quit PE2 interfaceethernet1 2 PE2 Ethernet1 2 ipbindingvpn instancevpn2 PE2 Ethernet1 2 ipaddress10 4 1 224 PE2 Ethernet1 2 quit 按图配置各CE的接口IP地址 配置过程略 配置完成后 在PE设备上执行displayipvpn instance命令可以看到VPN实例的配置情况 各PE能ping通自己接入的CE 以PE1和CE1为例 PE1 displayipvpn instanceTotalVPN Instancesconfigured 2VPN InstanceNameRDCreateTimevpn1100 12006 08 1309 32 45vpn2100 22006 08 1309 42 59 PE1 ping vpn instancevpn110 1 1 1PING10 1 1 1 56databytes pressCTRL CtobreakReplyfrom10 1 1 1 bytes 56Sequence 1ttl 255time 56msReplyfrom10 1 1 1 bytes 56Sequence 2ttl 255time 4msReplyfrom10 1 1 1 bytes 56Sequence 3ttl 255time 4msReplyfrom10 1 1 1 bytes 56Sequence 4ttl 255time 52msReplyfrom10 1 1 1 bytes 56Sequence 5ttl 255time 3ms 10 1 1 1pingstatistics 5packet s transmitted5packet s received0 00 packetlossround tripmin avg max 3 23 56ms 4 在PE与CE之间建立EBGP对等体 引入VPN路由 配置CE1 system view CE1 bgp65410 CE1 bgp peer10 1 1 2as number100 CE1 bgp import routedirect CE1 bgp quit另外3个CE设备 CE2 CE4 配置与CE1设备配置类似 配置过程省略 配置PE1 PE1 bgp100 PE1 bgp ipv4 familyvpn instancevpn1 PE1 bgp vpn1 peer10 1 1 1as number65410 PE1 bgp vpn1 import routedirect PE1 bgp vpn1 quit PE1 bgp ipv4 familyvpn instancevpn2 PE1 bgp vpn2 peer10 2 1 1as number65420 PE1 bgp vpn2 import routedirect PE1 bgp vpn2 quit PE1 bgp quitPE2的配置与PE1类似 配置过程省略 配置完成后 在PE设备上执行displaybgpvpnv4vpn instancepeer命令 可以看到PE与CE之间的BGP对等体关系已建立 并达到Established状态 以PE1与CE1的对等体关系为例 PE1 displaybgpvpnv4vpn instancevpn1peerBGPlocalrouterID 1 1 1 9LocalASnumber 100Totalnumberofpeers 1Peersinestablishedstate 1PeerASMsgRcvdMsgSentOutQPrefRcvUp DownState10 1 1 1654101190100 06 37Established 5 在PE之间建立MP IBGP对等体 配置PE1 PE1 bgp100 PE1 bgp peer3 3 3 9as number100 PE1 bgp peer3 3 3 9connect interfaceloopback0 PE1 bgp ipv4 familyvpnv4 PE1 bgp af vpnv4 peer3 3 3 9enable PE1 bgp af vpnv4 quit PE1 bgp quit 配置PE2 PE2 bgp100 PE2 bgp peer1 1 1 9as number100 PE2 bgp peer1 1 1 9connect interfaceloopback0 PE2 bgp ipv4 familyvpnv4 PE2 bgp af vpnv4 peer1 1 1 9