CCIE-15-MPLS-VPN

烈火蜓蜻2024-04-22 16:09

目录

实验条件

网络拓朴

实验目标

  1. 让A1、A2可以互相访问
  2. 让B1、B2可以互相访问
  3. A、B之间不可以互访

环境配置

在我的资源里可以下载（就在这篇文章的开头也可以下载）

开始配置

配置交换机，隔离R1、R7

java 复制代码 
SW：
vlan 12,27
interface e0/0
 switchport mode access
 switchport access vlan 12
interface e0/1
 switchport mode access
 switchport access vlan 27
interface e0/2
 switchport trunk encapsulation dot1q
 switchport mode trunk
R2:
default interface e0/0
interface e0/0.12
 encapsulation dot1Q 12
interface e0/0.27
 encapsulation dot1Q 27

与SW的Trunk口相连的E0/0需要创建子接口，并且指定封装的VLAN_ID，否则无法通信（R2是路由器，所以e0/0口发出的包是不带VLAN，ID标识的，这样的话，到交换机之后该包就无法投递到对应的VLAN去了，所以需要指定封装的VLAN_ID）

配置VRF

配置了VRF后，ip地址会被重置需要重配，所以地址在这里配置

java 复制代码 
R2:
ip vrf Area-A
 rd 12345:12
ip vrf Area-B
 rd 12345:27
interface e0/0.12
 ip vrf forwarding Area-A
 ip address 12.1.1.2 255.255.255.0 
interface e0/0.27
 ip vrf forwarding Area-B
 ip address 27.1.1.2 255.255.255.0
java 复制代码 
R5:
ip vrf Area-A
 rd 12345:56
ip vrf Area-B
 rd 12345:58
interface e0/0
 ip vrf forwarding Area-A
 ip address 56.1.1.5 255.255.255.0 
interface e0/2
 ip vrf forwarding Area-B
 ip address 58.1.1.5 255.255.255.0

配置各小区域的路由协议

配置IGP协议时，要建立邻居的两台路由器需要对他们所在的共同的网段进行声明（否则的话是不会建立邻居的，即只声明lo0路由那么是不会有邻居，也不会交换路由的），只有被声明的接口（网段）才会发出Hello包去建邻居。这点需要注意一下

RIP协议

java 复制代码 
R1：
conf t
router rip
 network 1.1.1.1
 network 12.0.0.0

R2：
conf t
router rip
 address-family ipv4 vrf Area-A
 network 2.2.2.2
 network 12.0.0.0

OSPF协议

java 复制代码 
R2：
conf t
router ospf 27 vrf Area-B
 router-id 2.2.2.22
 network 2.2.2.2 0.0.0.0 area 0
 network 27.1.1.0 0.0.0.255 area 0

R7：
conf t
interface e0/1
 ip address 27.1.1.7 255.255.255.0
 no shutdown
interface lo0
 ip address 7.7.7.7 255.255.255.255
 no shutdown
router ospf 27
 router-id 7.7.7.7
 network 7.7.7.7 0.0.0.0 area 0
 network 27.1.1.0 0.0.0.255 area 0

EIGRP协议

java 复制代码 
R5：
conf t
router eigrp NAME_mode
 address-family ipv4 vrf Area-A autonomous-system 56
  network 5.5.5.5 0.0.0.0
  network 56.1.1.0 0.0.0.255

R6：
conf t
router eigrp 56
 router-id 6.6.6.6
 network 6.6.6.6 0.0.0.0
 network 56.1.1.0 0.0.0.255

BGP协议

java 复制代码 
R5：
conf t
router bgp 25
 bgp router-id 5.5.5.5
 address-family ipv4 vrf Area-B
  neighbor 58.1.1.8 remote-as 58
  neighbor 58.1.1.8 next-hop-self
  neighbor 58.1.1.8 activate
 

R8：
conf t
interface lo0
 ip address 8.8.8.8 255.255.255.255
 no shutdown
router bgp 58
 bgp router-id 8.8.8.8
 neighbor 58.1.1.5 remote-as 25
 neighbor 58.1.1.5 next-hop-self
 network 8.8.8.8 mask 255.255.255.255
 network 58.1.1.0 mask 255.255.255.0

配置MPLS区域的协议

配置MPLS协议（R2到R5）

MPLS区域内各个路由器分配不同的标签段，便于观察标签交换的过程。

java 复制代码 
R2：
conf t
mpls ldp router-id lo0
mpls label range 200 299
interface e0/1
 mpls ip
 
R3：
mpls ldp router-id Loopback0
mpls label range 300 399
router ospf 1
 mpls ldp autoconfig
 router-id 3.3.3.3
 network 0.0.0.0 255.255.255.255 area 0
 
R4：
mpls ldp router-id Loopback0
mpls label range 400 499
router ospf 1
 mpls ldp autoconfig
 router-id 4.4.4.4
 network 0.0.0.0 255.255.255.255 area 0
 
R5：
conf t
mpls ldp router-id lo0
mpls label range 500 599
interface e0/1
 mpls ip

R2 和 R5 之间配置MP-BGP协议

java 复制代码 
R2：
conf t
router bgp 25
 bgp router-id 2.2.2.2
 no bgp default ipv4-unicast
 neighbor 5.5.5.5 remote-as 25
 neighbor 5.5.5.5 update-source lo 0
 address-family vpnv4
  neighbor 5.5.5.5 activate

R5：
conf t
router bgp 25
 no bgp default ipv4-unicast
 neighbor 2.2.2.2 remote-as 25
 neighbor 2.2.2.2 update-source lo 0
 address-family vpnv4
  neighbor 2.2.2.2 activate

验证邻居关系

java 复制代码 
R2#show ip bgp all summary
For address family: VPNv4 Unicast
BGP router identifier 2.2.2.2, local AS number 25
BGP table version is 1, main routing table version 1

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
5.5.5.5         4           25      13      13        1    0    0 00:08:55        0
R2#

R5#show ip bgp all summary      
For address family: IPv4 Unicast
BGP router identifier 5.5.5.5, local AS number 25
BGP table version is 3, main routing table version 3
2 network entries using 288 bytes of memory
2 path entries using 168 bytes of memory
1/1 BGP path/bestpath attribute entries using 160 bytes of memory
1 BGP AS-PATH entries using 24 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
BGP using 640 total bytes of memory
BGP activity 2/0 prefixes, 2/0 paths, scan interval 60 secs

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
58.1.1.8        4           58      97      97        3    0    0 01:25:41        2

For address family: VPNv4 Unicast
BGP router identifier 5.5.5.5, local AS number 25
BGP table version is 1, main routing table version 1

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
2.2.2.2         4           25      13      13        1    0    0 00:09:05        0
58.1.1.8        4           58       0       0        1    0    0 never    (NoNeg)

配置VRF，RT

PE之间只可以传递BGP的VPNv4路由，所以现在必须让IPv4路由带上RD值和RT属性才能成为VPNv4路由，接下来应该在PE路由器上为各VRF设置RD和RT，为了方便抓包分辨路由方向，不同方向配置不同的RT值，现在规化RT值如下：

java 复制代码 
R2：
VRF Aera-A：RD----12345:12  RT----export 12:56  import 56:12
VRF Aera-B：RD----12345:27  RT----export 27:58  import 58:27

R5：
VRF Aera-A：RD----12345:56  RT----export 56:12  import 12:56
VRF Aera-B：RD----12345:58  RT----export 58:27  import 27:58

配置如下：

java 复制代码 
R2：
ip vrf Area-A
 rd 12345:12
 route-target export 12:56
 route-target import 56:12
ip vrf Area-B
 rd 12345:27
 route-target export 27:58
 route-target import 58:27

R5：
ip vrf Area-A
 rd 12345:56
 route-target export 56:12
 route-target import 12:56
ip vrf Area-B
 rd 12345:58
 route-target export 58:27
 route-target import 27:58

重分布路由

On R2: RIP<->BGP 25

把RIP的路由重分布进BGP，再把BGP的路由重分布进RIP中

java 复制代码 
R2：
conf t
router bgp 25
 address-family ipv4 vrf Area-A
  redistribute rip
router rip
 !
 address-family ipv4 vrf Area-A
  redistribute bgp 25 metric 5

On R2: OSPF 27 <->BGP 25

java 复制代码 
R2：
conf t
router bgp 25
 address-family ipv4 vrf Area-B
  redistribute ospf 27
router ospf 27 vrf Area-B
 redistribute bgp 25 subnets

On R5: EIGRP <->BGP 25

java 复制代码 
R5：
conf t
router bgp 25
 address-family ipv4 vrf Area-A
  redistribute eigrp 56
router eigrp NAME_mode
 address-family ipv4 unicast vrf Area-A autonomous-system 56
  topology base
   redistribute bgp 25 metric 10000 10 255 1 1500
  exit-af-topology

验证路由

R2上的BGP路由

java 复制代码 
R2#show ip bgp vpnv4 vrf Area-A
......
     Network          Next Hop            Metric LocPrf Weight Path
Route Distinguisher: 12345:12 (default for vrf Area-A)
 *>   1.0.0.0          12.1.1.1                 1         32768 ?
 *>i  6.6.6.6/32       5.5.5.5            3584000    100      0 ?
 *>   12.1.1.0/24      0.0.0.0                  0         32768 ?
 *>i  56.1.1.0/24      5.5.5.5                  0    100      0 ?
 
R2#show ip bgp vpnv4 vrf Area-B
......
     Network          Next Hop            Metric LocPrf Weight Path
Route Distinguisher: 12345:27 (default for vrf Area-B)
 *>   7.7.7.7/32       27.1.1.7                11         32768 ?
 *>i  8.8.8.8/32       5.5.5.5                  0    100      0 58 i
 *>   27.1.1.0/24      0.0.0.0                  0         32768 ?
 *>i  58.1.1.0/24      5.5.5.5                  0    100      0 58 i

R2#show ip bgp all             
For address family: IPv4 Unicast
For address family: VPNv4 Unicast
......
     Network          Next Hop            Metric LocPrf Weight Path
Route Distinguisher: 12345:12 (default for vrf Area-A)
 *>   1.0.0.0          12.1.1.1                 1         32768 ?
 *>i  6.6.6.6/32       5.5.5.5            3584000    100      0 ?
 *>   12.1.1.0/24      0.0.0.0                  0         32768 ?
 *>i  56.1.1.0/24      5.5.5.5                  0    100      0 ?
Route Distinguisher: 12345:27 (default for vrf Area-B)
 *>   7.7.7.7/32       27.1.1.7                11         32768 ?
 *>i  8.8.8.8/32       5.5.5.5                  0    100      0 58 i
 *>   27.1.1.0/24      0.0.0.0                  0         32768 ?
 *>i  58.1.1.0/24      5.5.5.5                  0    100      0 58 i
Route Distinguisher: 12345:56
 *>i  6.6.6.6/32       5.5.5.5            3584000    100      0 ?
 *>i  56.1.1.0/24      5.5.5.5                  0    100      0 ?
     Network          Next Hop            Metric LocPrf Weight Path
Route Distinguisher: 12345:58
 *>i  8.8.8.8/32       5.5.5.5                  0    100      0 58 i
 *>i  58.1.1.0/24      5.5.5.5                  0    100      0 58 i
For address family: IPv4 Multicast
For address family: L2VPN E-VPN
For address family: VPNv4 Multicast
For address family: MVPNv4 Unicast

R5的路由表信息

java 复制代码 
R5#show ip bgp vpnv4 vrf Area-A
......
     Network          Next Hop            Metric LocPrf Weight Path
Route Distinguisher: 12345:56 (default for vrf Area-A)
 *>i  1.0.0.0          2.2.2.2                  1    100      0 ?
 *>   6.6.6.6/32       56.1.1.6           3584000         32768 ?
 *>i  12.1.1.0/24      2.2.2.2                  0    100      0 ?
 *>   56.1.1.0/24      0.0.0.0                  0         32768 ?
R5#show ip bgp vpnv4 vrf Area-B 
......
     Network          Next Hop            Metric LocPrf Weight Path
Route Distinguisher: 12345:58 (default for vrf Area-B)
 *>i  7.7.7.7/32       2.2.2.2                 11    100      0 ?
 *>   8.8.8.8/32       58.1.1.8                 0             0 58 i
 *>i  27.1.1.0/24      2.2.2.2                  0    100      0 ?
 r>   58.1.1.0/24      58.1.1.8                 0             0 58 i
R5#show ip bgp all             
For address family: IPv4 Unicast
For address family: VPNv4 Unicast
......
     Network          Next Hop            Metric LocPrf Weight Path
Route Distinguisher: 12345:12
 *>i  1.0.0.0          2.2.2.2                  1    100      0 ?
 *>i  12.1.1.0/24      2.2.2.2                  0    100      0 ?
Route Distinguisher: 12345:27
 *>i  7.7.7.7/32       2.2.2.2                 11    100      0 ?
 *>i  27.1.1.0/24      2.2.2.2                  0    100      0 ?
Route Distinguisher: 12345:56 (default for vrf Area-A)
 *>i  1.0.0.0          2.2.2.2                  1    100      0 ?
 *>   6.6.6.6/32       56.1.1.6           3584000         32768 ?
 *>i  12.1.1.0/24      2.2.2.2                  0    100      0 ?
 *>   56.1.1.0/24      0.0.0.0                  0         32768 ?
Route Distinguisher: 12345:58 (default for vrf Area-B)
 *>i  7.7.7.7/32       2.2.2.2                 11    100      0 ?
     Network          Next Hop            Metric LocPrf Weight Path
 *>   8.8.8.8/32       58.1.1.8                 0             0 58 i
 *>i  27.1.1.0/24      2.2.2.2                  0    100      0 ?
 r>   58.1.1.0/24      58.1.1.8                 0             0 58 i
For address family: IPv4 Multicast
For address family: L2VPN E-VPN
For address family: VPNv4 Multicast
For address family: MVPNv4 Unicast

Area-A区域之间的路由有了

Area-B区域之间的路由也有了，接下来验证网络

验证效果

R1访问R6，R1访问R8

java 复制代码 
R1#traceroute 6.6.6.6 source lo 0
Type escape sequence to abort.
Tracing the route to 6.6.6.6
VRF info: (vrf in name/id, vrf out name/id)
  1 12.1.1.2 1 msec 1 msec 0 msec
  2 23.1.1.3 [MPLS: Labels 300/506 Exp 0] 1 msec 1 msec 1 msec
  3 34.1.1.4 [MPLS: Labels 400/506 Exp 0] 0 msec 1 msec 0 msec
  4 56.1.1.5 [MPLS: Label 506 Exp 0] 1 msec 0 msec 1 msec
  5 56.1.1.6 0 msec *  1 msec
R1#ping 8.8.8.8 source lo 0      
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
Packet sent with a source address of 1.1.1.1 
.....
Success rate is 0 percent (0/5)
R1#ping 7.7.7.7 source lo0 
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 7.7.7.7, timeout is 2 seconds:
Packet sent with a source address of 1.1.1.1 
.....
Success rate is 0 percent (0/5)

R1和R6相通，和R8、R7不通

R7访问R6，R7访问R1

java 复制代码 
R7#traceroute 8.8.8.8 source lo 0
Type escape sequence to abort.
Tracing the route to 8.8.8.8
VRF info: (vrf in name/id, vrf out name/id)
  1 27.1.1.2 0 msec 1 msec 0 msec
  2 23.1.1.3 [MPLS: Labels 300/508 Exp 0] 1 msec 1 msec 1 msec
  3 34.1.1.4 [MPLS: Labels 400/508 Exp 0] 1 msec 0 msec 1 msec
  4 58.1.1.5 [MPLS: Label 508 Exp 0] 1 msec 0 msec 0 msec
  5 58.1.1.8 1 msec *  2 msec
R7#ping 1.1.1.1 source lo 0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
Packet sent with a source address of 7.7.7.7 
.....
Success rate is 0 percent (0/5)
R7#ping 6.6.6.6 source lo 0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 6.6.6.6, timeout is 2 seconds:
Packet sent with a source address of 7.7.7.7 
.....
Success rate is 0 percent (0/5)

R7和R8相通，和R1、R6不通 ，达到实验的目的。

关闭IP TTL复制功能，再次观察效果

java 复制代码 
R2：
conf t
no mpls ip propagate-ttl


R5：
conf t
no mpls ip propagate-ttl

检查效果

java 复制代码 
R1#traceroute 6.6.6.6 source lo 0
Type escape sequence to abort.
Tracing the route to 6.6.6.6
VRF info: (vrf in name/id, vrf out name/id)
  1 12.1.1.2 0 msec 1 msec 0 msec
  2 56.1.1.5 [MPLS: Label 506 Exp 0] 1 msec 1 msec 0 msec
  3 56.1.1.6 1 msec *  2 msec


R7#traceroute 8.8.8.8 source lo 0
Type escape sequence to abort.
Tracing the route to 8.8.8.8
VRF info: (vrf in name/id, vrf out name/id)
  1 27.1.1.2 1 msec 0 msec 1 msec
  2 58.1.1.5 [MPLS: Label 508 Exp 0] 1 msec 1 msec 1 msec
  3 58.1.1.8 0 msec *  2 msec
相关推荐
小诸葛的博客4 小时前
华为ensp实现跨vlan通信
网络·华为·智能路由器
pp-周子晗（努力赶上课程进度版）6 小时前
【计算机网络】NAT技术、内网穿透与代理服务器全解析：原理、应用及实践
网络·计算机网络·智能路由器
风格65412 小时前
OSPF的四种特殊区域（Stub、Totally Stub、NSSA、Totally NSSA）详解
智能路由器
ax一号街阿楠16 小时前
华为FAT AP配置 真机
网络·华为·智能路由器
驱动小百科1 天前
WiFi出现感叹号上不了网怎么办 轻松恢复网络
网络·智能路由器·wifi出现感叹号怎么解决·wifi无法上网·电脑wifi
好多知识都想学1 天前
协议路由与路由协议
网络·智能路由器
SZ1701102311 天前
中继器的作用
服务器·网络·智能路由器
寒..1 天前
OSPF综合实验
网络·智能路由器
天蓝不会忘记021 天前
OSPF综合实验
网络·智能路由器
Fanmeang2 天前
BGP选路原则实验案例
运维·网络·华为·bgp·路由选路·路由选路原则·route-policy
热门推荐
01YOLOv8入门 | 重要性能衡量指标、训练结果评价及分析及影响mAP的因素【发论文关注的指标】02从零安装 LLaMA-Factory 微调 Qwen 大模型成功及所有的坑03KGG转MP3工具|非KGM文件|解密音频04组基轨迹建模 GBTM的介绍与实现（Stata 或 R）05【SpeedAI科研小助手】2分钟极速解决知网维普重复率、AIGC率过高，一键全文降！文件格式不变，公式都保留的！06Coze扣子平台完整体验和实践（附国内和国际版对比）07YOLOv5改进 | 添加CA注意力机制 + 增加预测层 + 更换损失函数之GIoU08苍穹外卖面试总结09DeepSeek各版本说明与优缺点分析10【操作系统】Linux之网络编程(TCP)（头歌作业）