1.背景介绍.

在ISP部署MPLS VPN的时候,通常情况下仅有一个单独的BGP域,也就是我们通常的MPLS VPN配置方法.

在此去介绍一种更为使用的MPLS VPN.就是接下来介绍的跨越多个BGP域的MPLS VPN.同时也是CCIE ISP的考点.

由于配置文件比较多,所以在此将三种解决方案分开去写.

2.工作原理

这种跨域也叫做背靠背跨域，即两个AS的边界路由器ASBR互相作为PE和CE，如上图所示，R3作为R4的PE设备，R4在此看作R3连接的CE设备，反之亦然。

同一AS的PE和PE之间通过正常的MBGP协议传递VPN路由信息，BGP边界之间通过正常的PE和CE之间的路由传递方法传送VPN路由信息，如上图，R1通过IGP协议把路由信息传递给R2，R2通过MBGP协议把R1的信息传递给R3，R4作为R3的CE设备，通过BGP协议把R1的信息传递给R4，R4再通过MBGP协议把R1的信息传递给R5，R5再通过IGP协议把R1的信息传递到R6，至此，VPN信息传递完毕。

在这种跨域方法中，VPN隧道构建比较简单，各个AS单独构建PE到BGP边界的LSP双层隧道，内层标签代表VPN信息，外层标签代表到达VPN路由下一跳PE的公网标签，和在单个AS内LSP隧道的建立过程和方式一样，BGP边界之间通过裸IP转发，没有LSP隧道。
特点
BGP边界需要处理VPN路由信息，并且需要配置VRF实例
BGP边界需要为每个VPN分配一个物理或逻辑链路
每个AS内单独建立双层LSP隧道，BGP边界之间依靠IP连接
适用于VPN业务开展初期，VPN数量较少的情况下

配置如下:

R1:

R1#sh run
Building configuration...

Current configuration : 906 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
ip cef
!
!
!
!
no ip domain lookup
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!        
archive
 log config
  hidekeys
!
!
!
!
!
!
interface Loopback0
 ip address 1.1.1.1 255.255.255.255
!
interface FastEthernet0/0
 ip address 192.168.12.1 255.255.255.0
 duplex auto
 speed auto
!
interface FastEthernet0/1
 no ip address
 shutdown
 duplex auto
 speed auto
!        
router ospf 1
 router-id 1.1.1.1
 log-adjacency-changes
 network 1.1.1.1 0.0.0.0 area 0
 network 192.168.12.1 0.0.0.0 area 0
!
!
!
ip http server
no ip http secure-server
!
!
!
!
!
!
!
control-plane
!
!
!
!
!        
!
!
!
!
!
line con 0
 exec-timeout 0 0
 logging synchronous
line aux 0
line vty 0 4
!
!
end

R2:

R2#sh run
Building configuration...

Current configuration : 1729 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R2
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
ip cef
!
!
!
!
ip vrf vpn
 rd 100:1
 route-target export 100:1
 route-target import 100:1
!
no ip domain lookup
!
mpls label protocol ldp
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!        
!
!
!
!
!
!
archive
 log config
  hidekeys
!
!
!
!
!
!
interface Loopback0
 ip address 2.2.2.2 255.255.255.255
 ip router isis
!
interface FastEthernet0/0
 ip vrf forwarding vpn
 ip address 192.168.12.2 255.255.255.0
 duplex auto
 speed auto
!
interface FastEthernet0/1
 ip address 192.168.23.2 255.255.255.0
 ip router isis
 duplex auto
 speed auto
 mpls ip
!
router ospf 1 vrf vpn
 router-id 2.2.2.2
 log-adjacency-changes
 redistribute bgp 23 subnets
 network 192.168.12.2 0.0.0.0 area 0
!
router isis
 net 49.0023.0000.0000.0002.00
 metric-style wide
!
router bgp 23
 bgp router-id 2.2.2.2
 no bgp default ipv4-unicast
 bgp log-neighbor-changes
 neighbor 3.3.3.3 remote-as 23
 neighbor 3.3.3.3 update-source Loopback0
 !
 address-family ipv4
  neighbor 3.3.3.3 activate
  no auto-summary
  no synchronization
 exit-address-family
 !
 address-family vpnv4
  neighbor 3.3.3.3 activate
  neighbor 3.3.3.3 send-community extended
 exit-address-family
 !
 address-family ipv4 vrf vpn
  redistribute ospf 1 vrf vpn match internal external 1 external 2
  no synchronization
 exit-address-family
!
!
!
ip http server
no ip http secure-server
!
!
!
!
!
mpls ldp router-id Loopback0 force
!
!
control-plane
!
!
!
!
!
!
!
!
!
!
line con 0
 exec-timeout 0 0
 logging synchronous
line aux 0
line vty 0 4
!
!
end
R3:

Building configuration...

Current configuration : 1576 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R3
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
ip cef
!
!
!
!
ip vrf vpn
 rd 100:1
 route-target export 100:1
 route-target import 100:1
!
no ip domain lookup
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!        
!
!
!
!
!
archive
 log config
  hidekeys
!
!
!
!
!
!
interface Loopback0
 ip address 3.3.3.3 255.255.255.255
 ip router isis
!
interface FastEthernet0/0
 ip vrf forwarding vpn
 ip address 192.168.34.3 255.255.255.0
 duplex auto
 speed auto
!
interface FastEthernet0/1
 ip address 192.168.23.3 255.255.255.0
 ip router isis
 duplex auto
 speed auto
 mpls ip
!
router isis
 net 49.0023.0000.0000.0003.00
 metric-style wide
!
router bgp 23
 bgp router-id 3.3.3.3
 no bgp default ipv4-unicast
 bgp log-neighbor-changes
 neighbor 2.2.2.2 remote-as 23
 neighbor 2.2.2.2 update-source Loopback0
 !
 address-family ipv4
  neighbor 2.2.2.2 activate
  no auto-summary
  no synchronization
 exit-address-family
 !
 address-family vpnv4
  neighbor 2.2.2.2 activate
  neighbor 2.2.2.2 send-community extended
 exit-address-family
 !
 address-family ipv4 vrf vpn
  neighbor 192.168.34.4 remote-as 45
  neighbor 192.168.34.4 activate
  no synchronization
 exit-address-family
!
!
!
ip http server
no ip http secure-server
!
!
!
!
!
mpls ldp router-id Loopback0 force
!
!
control-plane
!
!
!
!
!
!
!
!
!
!
line con 0
 exec-timeout 0 0
 logging synchronous
line aux 0
line vty 0 4
!
!
end

R4:

R4#sh run
Building configuration...

Current configuration : 1576 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R4
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
ip cef
!
!
!
!
ip vrf vpn
 rd 100:1
 route-target export 100:1
 route-target import 100:1
!
no ip domain lookup
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!        
!
!
!
!
!
archive
 log config
  hidekeys
!
!
!
!
!
!
interface Loopback0
 ip address 4.4.4.4 255.255.255.255
 ip router isis
!
interface FastEthernet0/0
 ip vrf forwarding vpn
 ip address 192.168.34.4 255.255.255.0
 duplex auto
 speed auto
!
interface FastEthernet0/1
 ip address 192.168.45.4 255.255.255.0
 ip router isis
 duplex auto
 speed auto
 mpls ip
!
router isis
 net 49.0045.0000.0000.0004.00
 metric-style wide
!
router bgp 45
 bgp router-id 4.4.4.4
 no bgp default ipv4-unicast
 bgp log-neighbor-changes
 neighbor 5.5.5.5 remote-as 45
 neighbor 5.5.5.5 update-source Loopback0
 !
 address-family ipv4
  neighbor 5.5.5.5 activate
  no auto-summary
  no synchronization
 exit-address-family
 !
 address-family vpnv4
  neighbor 5.5.5.5 activate
  neighbor 5.5.5.5 send-community extended
 exit-address-family
 !
 address-family ipv4 vrf vpn
  neighbor 192.168.34.3 remote-as 23
  neighbor 192.168.34.3 activate
  no synchronization
 exit-address-family
!
!
!
ip http server
no ip http secure-server
!
!
!
!
!
mpls ldp router-id Loopback0 force
!
!
control-plane
!
!
!
!
!
!
!
!
!
!
line con 0
 exec-timeout 0 0
 logging synchronous
line aux 0
line vty 0 4
!
!
end

R5:

R5#sh run
Building configuration...

Current configuration : 1705 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R5
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
ip cef
!
!
!
!
ip vrf vpn
 rd 100:1
 route-target export 100:1
 route-target import 100:1
!
no ip domain lookup
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!        
!
!
!
!
!
archive
 log config
  hidekeys
!
!
!
!
!
!
interface Loopback0
 ip address 5.5.5.5 255.255.255.255
 ip router isis
!
interface FastEthernet0/0
 ip vrf forwarding vpn
 ip address 192.168.56.5 255.255.255.0
 duplex auto
 speed auto
!
interface FastEthernet0/1
 ip address 192.168.45.5 255.255.255.0
 ip router isis
 duplex auto
 speed auto
 mpls ip
!
router ospf 1 vrf vpn
 router-id 5.5.5.5
 log-adjacency-changes
 redistribute bgp 45 subnets
 network 192.168.56.5 0.0.0.0 area 0
!
router isis
 net 49.0045.0000.0000.0005.00
 metric-style wide
!
router bgp 45
 bgp router-id 5.5.5.5
 no bgp default ipv4-unicast
 bgp log-neighbor-changes
 neighbor 4.4.4.4 remote-as 45
 neighbor 4.4.4.4 update-source Loopback0
 !
 address-family ipv4
  neighbor 4.4.4.4 activate
  no auto-summary
  no synchronization
 exit-address-family
 !
 address-family vpnv4
  neighbor 4.4.4.4 activate
  neighbor 4.4.4.4 send-community extended
 exit-address-family
 !
 address-family ipv4 vrf vpn
  redistribute ospf 1 vrf vpn match internal external 1 external 2
  no synchronization
 exit-address-family
!
!
!
ip http server
no ip http secure-server
!        
!
!
!
!
mpls ldp router-id Loopback0 force
!
!
control-plane
!
!
!
!
!
!
!
!
!
!
line con 0
 exec-timeout 0 0
 logging synchronous
line aux 0
line vty 0 4
!
!
end

R6:

R6#sh run
Building configuration...

Current configuration : 906 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R6
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
ip cef
!
!
!
!
no ip domain lookup
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!        
archive
 log config
  hidekeys
!
!
!
!
!
!
interface Loopback0
 ip address 6.6.6.6 255.255.255.255
!
interface FastEthernet0/0
 ip address 192.168.56.6 255.255.255.0
 duplex auto
 speed auto
!
interface FastEthernet0/1
 no ip address
 shutdown
 duplex auto
 speed auto
!        
router ospf 1
 router-id 6.6.6.6
 log-adjacency-changes
 network 6.6.6.6 0.0.0.0 area 0
 network 192.168.56.6 0.0.0.0 area 0
!
!
!
ip http server
no ip http secure-server
!
!
!
!
!
!
!
control-plane
!
!
!
!
!        
!
!
!
!
!
line con 0
 exec-timeout 0 0
 logging synchronous
line aux 0
line vty 0 4
!
!
end

验证:

R1#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

C    192.168.12.0/24 is directly connected, FastEthernet0/0
     1.0.0.0/32 is subnetted, 1 subnets
C       1.1.1.1 is directly connected, Loopback0
     6.0.0.0/32 is subnetted, 1 subnets
O E2    6.6.6.6 [110/1] via 192.168.12.2, 00:24:53, FastEthernet0/0
O E2 192.168.56.0/24 [110/1] via 192.168.12.2, 00:24:53, FastEthernet0/0

R1#ping 6.6.6.6 source loopback0

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 6.6.6.6, timeout is 2 seconds:
Packet sent with a source address of 1.1.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 164/193/244 ms
R1#traceroute 6.6.6.6

Type escape sequence to abort.
Tracing the route to 6.6.6.6

  1 192.168.12.2 60 msec 92 msec 84 msec
  2 192.168.34.3 [MPLS: Label 18 Exp 0] 160 msec 124 msec 56 msec
  3 192.168.34.4 124 msec 92 msec 40 msec
  4 192.168.56.5 [MPLS: Label 17 Exp 0] 112 msec 76 msec 76 msec
  5 192.168.56.6 220 msec *  160 msec
由此可发现本地CE能够正常的学习到对端CE内部路由.而且在traceroute的时候没有做MPLS TTL的过滤可以正常看到MPLS VPN跨越了2个BGP域.先由左边AS进行MPLS转发,在BGP域间改为正常的IP转发,再经过第二个BGP域是又转变为MPLS转发.