chenjian26841的博客

[原创]跨越BGP域的MPLS VPN(3)

热9已有 1156 次阅读 2010-10-12 14:44 标签: MPLS BGP VPN 原创

1.背景介绍.

在ISP部署MPLS VPN的时候,通常情况下仅有一个单独的BGP域,也就是我们通常的MPLS VPN配置方法.

在此去介绍一种更为使用的MPLS VPN.就是接下来介绍的跨越多个BGP域的MPLS VPN.同时也是CCIE ISP的考点.

由于配置文件比较多,所以在此将三种解决方案分开去写.

2.工作原理.

这种跨域也叫多跳MP-EBGP跨域，由于BGP只要能建立TCP连接，就能成为BGP邻居并传递路由信息，因此，通过多跳的MP-EBGP直接在源、宿端PE之间传递VPN路由信息，然后在源、宿端PE之间构建LSP公网隧道。

这种跨域时VPN信息传递比较简单，即直接在源和宿端PE间通过多跳MP-EBGP传递，如上图，R2和R5之间建立多跳的MP-EBGP连接，VPN信息直接从R2传递到R5。

从VPN信息传递的方式可以看出，VPN从R2到R5之间只有一跳，VPN的下一跳为R5，R5为VPN分配标签，并且一直不会改变。

现在重要的是确定R2到R5的外层LSP怎样建立，首先，R5和R4在一个AS，通过IGP协议，R4会有R5的路由信息，通过正常的LDP协议，R4和R5会构建一个LSP隧道，R3和R5不在一个AS，R3没有R5的路由信息，此时可以通过EBGP协议把R5的路由信息传递给R3，另外，对BGP协议进行扩展（RFC3107）,让BGP在传递路由时同时分配标签，这样，R3和R4之间的LSP形成，并在R4处形成标签SWAP，同样，R3和R2之间也通过扩展的IBGP传送R5的路由信息，同时分配标签，并在R3处形成标签SWAP，但这一段LSP的建立和BGP边界之间LSP的建立不一样，BGP边界之间是直连的，下一跳直接可达，R2和R3之间不是直连的，但R2和R3位于同一个AS，通过LDP可以构建一个LSP隧道，这样，在R2到R3之间的LSP隧道最终包括三层标签，最底层VPN标签（R5分配），中间一层为到R5的标签（R3通过扩展BGP分配）,最外层为到R3的标签（LDP分配），BGP边界之间构建一个双层LSP隧道，底层为VPN标签（R5分配），外层为到R5的标签（R4通过扩展BGP分配），R4到PE2之间为双层LSP隧道，内层为VPN标签（R5分配），外层为到R5的标签（LDP分配）这三段隧道通过在BGP边界处的标签SWAP粘结起来，最终形成端到端的LSP隧道。

特点

BGP边界不需要处理VPN信息，最符合VPN的要求，即中间设备不感知VPN信息
使用BGP扩展来传递公网标签
在宿端AS之外的AS出现三层标签的LSP隧道。
当VPN业务大规模发展时，可以使用这种跨域方法
配置文件如下:

R1:

R1#sh run
Building configuration...

Current configuration : 906 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
ip cef
!
!
!
!
no ip domain lookup
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
archive
log config
hidekeys
!
!
!
!
!
!
interface Loopback0
ip address 1.1.1.1 255.255.255.255
!
interface FastEthernet0/0
ip address 192.168.12.1 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
router ospf 1
router-id 1.1.1.1
log-adjacency-changes
network 1.1.1.1 0.0.0.0 area 0
network 192.168.12.1 0.0.0.0 area 0
!
!
!
ip http server
no ip http secure-server
!
!
!
!
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
!
line con 0
exec-timeout 0 0
logging synchronous
line aux 0
line vty 0 4
!
!
end

R2:

R2#sh run
Building configuration...

Current configuration : 1896 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R2
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
ip cef
!
!
!
!
ip vrf vpn
rd 100:1
route-target export 100:1
route-target import 100:1
!
no ip domain lookup
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
archive
log config
hidekeys
!
!
!
!
!
!
interface Loopback0
ip address 2.2.2.2 255.255.255.255
ip router isis
!
interface FastEthernet0/0
ip vrf forwarding vpn
ip address 192.168.12.2 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet0/1
ip address 192.168.23.2 255.255.255.0
ip router isis
duplex auto
speed auto
mpls ip
!
router ospf 1 vrf vpn
router-id 2.2.2.2
log-adjacency-changes
redistribute bgp 23 subnets
network 192.168.12.2 0.0.0.0 area 0
!
router isis
net 49.0023.0000.0000.0002.00
metric-style wide
!
router bgp 23
no bgp default ipv4-unicast
bgp log-neighbor-changes
neighbor 3.3.3.3 remote-as 23
neighbor 3.3.3.3 update-source Loopback0
neighbor 5.5.5.5 remote-as 45
neighbor 5.5.5.5 ebgp-multihop 255
neighbor 5.5.5.5 update-source Loopback0
!
address-family ipv4
neighbor 3.3.3.3 activate
neighbor 5.5.5.5 activate
no auto-summary
no synchronization
network 2.2.2.2 mask 255.255.255.255
exit-address-family
!
address-family vpnv4
neighbor 5.5.5.5 activate
neighbor 5.5.5.5 send-community extended
neighbor 5.5.5.5 next-hop-unchanged
exit-address-family
!
address-family ipv4 vrf vpn
redistribute ospf 1 vrf vpn match internal external 1 external 2
no synchronization
exit-address-family
!
!
!
ip http server
no ip http secure-server
!
!
!
!
!
mpls ldp router-id Loopback0 force
!
!
control-plane
!
!
!
!
!
!
!
!
!
!
line con 0
exec-timeout 0 0
logging synchronous
line aux 0
line vty 0 4
!
!
end

R3:

R3#sh run
Building configuration...

Current configuration : 1409 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R3
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
ip cef
!
!
!
!
no ip domain lookup
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
archive
log config
hidekeys
!
!
!
!
!
!
interface Loopback0
ip address 3.3.3.3 255.255.255.255
ip router isis
!
interface FastEthernet0/0
ip address 192.168.34.3 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet0/1
ip address 192.168.23.3 255.255.255.0
ip router isis
duplex auto
speed auto
mpls ip
!
router isis
net 49.0023.0000.0000.0003.00
metric-style wide
redistribute bgp 23
!
router bgp 23
no bgp default ipv4-unicast
no bgp default route-target filter
bgp log-neighbor-changes
neighbor 2.2.2.2 remote-as 23
neighbor 2.2.2.2 update-source Loopback0
neighbor 192.168.34.4 remote-as 45
!
address-family ipv4
neighbor 2.2.2.2 activate
neighbor 2.2.2.2 next-hop-self
neighbor 192.168.34.4 activate
neighbor 192.168.34.4 send-label
no auto-summary
no synchronization
network 192.168.34.0
exit-address-family
!
!
!
ip http server
no ip http secure-server
!
!
!
!
!
mpls ldp router-id Loopback0 force
!
!
control-plane
!
!
!
!
!
!
!
!
!
!
line con 0
exec-timeout 0 0
logging synchronous
line aux 0
line vty 0 4
!
!
end

R4:

R4#sh
*Mar 1 01:49:32.207: %SYS-5-CONFIG_I: Configured from console by console
R4#sh run
Building configuration...

Current configuration : 1409 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R4
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
ip cef
!
!
!
!
no ip domain lookup
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
archive
log config
hidekeys
!
!
!
!
!
!
interface Loopback0
ip address 4.4.4.4 255.255.255.255
ip router isis
!
interface FastEthernet0/0
ip address 192.168.34.4 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet0/1
ip address 192.168.45.4 255.255.255.0
ip router isis
duplex auto
speed auto
mpls ip
!
router isis
net 49.0045.0000.0000.0004.00
metric-style wide
redistribute bgp 45
!
router bgp 45
no bgp default ipv4-unicast
no bgp default route-target filter
bgp log-neighbor-changes
neighbor 5.5.5.5 remote-as 45
neighbor 5.5.5.5 update-source Loopback0
neighbor 192.168.34.3 remote-as 23
!
address-family ipv4
neighbor 5.5.5.5 activate
neighbor 5.5.5.5 next-hop-self
neighbor 192.168.34.3 activate
neighbor 192.168.34.3 send-label
no auto-summary
no synchronization
network 192.168.34.0
exit-address-family
!
!
!
ip http server
no ip http secure-server
!
!
!
!
!
mpls ldp router-id Loopback0 force
!
!
control-plane
!
!
!
!
!
!
!
!
!
!
line con 0
exec-timeout 0 0
logging synchronous
line aux 0
line vty 0 4
!
!
end
R5:

R5#sh run
Building configuration...

Current configuration : 1868 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R5
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
ip cef
!
!
!
!
ip vrf vpn
rd 100:2
route-target export 100:1
route-target import 100:1
!
no ip domain lookup
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
archive
log config
hidekeys
!
!
!
!
!
!
interface Loopback0
ip address 5.5.5.5 255.255.255.255
ip router isis
!
interface FastEthernet0/0
ip vrf forwarding vpn
ip address 192.168.56.5 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet0/1
ip address 192.168.45.5 255.255.255.0
ip router isis
duplex auto
speed auto
mpls ip
!
router ospf 1 vrf vpn
router-id 5.5.5.5
log-adjacency-changes
redistribute bgp 45 subnets
network 192.168.56.5 0.0.0.0 area 0
!
router isis
net 49.0045.0000.0000.0005.00
metric-style wide
!
router bgp 45
no bgp default ipv4-unicast
bgp log-neighbor-changes
neighbor 2.2.2.2 remote-as 23
neighbor 2.2.2.2 ebgp-multihop 255
neighbor 2.2.2.2 update-source Loopback0
neighbor 4.4.4.4 remote-as 45
neighbor 4.4.4.4 update-source Loopback0
!
address-family ipv4
neighbor 4.4.4.4 activate
no auto-summary
no synchronization
network 5.5.5.5 mask 255.255.255.255
exit-address-family
!
address-family vpnv4
neighbor 2.2.2.2 activate
neighbor 2.2.2.2 send-community extended
neighbor 2.2.2.2 next-hop-unchanged
exit-address-family
!
address-family ipv4 vrf vpn
redistribute ospf 1 vrf vpn match internal external 1 external 2
no synchronization
exit-address-family
!
!
!
ip http server
no ip http secure-server
!
!
!
!
!
mpls ldp router-id Loopback0 force
!
!
control-plane
!
!
!
!
!
!
!
!
!
!
line con 0
exec-timeout 0 0
logging synchronous
line aux 0
line vty 0 4
!
!
end
R6:

R6#sh run
Building configuration...

Current configuration : 906 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R6
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
ip cef
!
!
!
!
no ip domain lookup
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
archive
log config
hidekeys
!
!
!
!
!
!
interface Loopback0
ip address 6.6.6.6 255.255.255.255
!
interface FastEthernet0/0
ip address 192.168.56.6 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
router ospf 1
router-id 6.6.6.6
log-adjacency-changes
network 6.6.6.6 0.0.0.0 area 0
network 192.168.56.6 0.0.0.0 area 0
!
!
!
ip http server
no ip http secure-server
!
!
!
!
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
!
line con 0
exec-timeout 0 0
logging synchronous
line aux 0
line vty 0 4
!
!
end

验证:

R1#
R1#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

C    192.168.12.0/24 is directly connected, FastEthernet0/0
     1.0.0.0/32 is subnetted, 1 subnets
C       1.1.1.1 is directly connected, Loopback0
     6.0.0.0/32 is subnetted, 1 subnets
O IA    6.6.6.6 [110/21] via 192.168.12.2, 00:18:24, FastEthernet0/0
O IA 192.168.56.0/24 [110/11] via 192.168.12.2, 00:18:24, FastEthernet0/0
R1#ping 6.6.6.6 source loopback0

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 6.6.6.6, timeout is 2 seconds:
Packet sent with a source address of 1.1.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 220/330/392 ms
R1#traceroute 6.6.6.6

Type escape sequence to abort.
Tracing the route to 6.6.6.6

1 192.168.12.2 36 msec 56 msec 108 msec
2 192.168.23.3 [MPLS: Labels 18/19 Exp 0] 184 msec 320 msec 248 msec
3 192.168.34.4 [MPLS: Labels 16/19 Exp 0] 244 msec 276 msec 200 msec
4 192.168.56.5 [MPLS: Label 19 Exp 0] 308 msec 168 msec 260 msec
5 192.168.56.6 288 msec * 260 msec
R1#

分享举报