跨域VPN的解决方案主要是为了解决客户不同AS之间的站点的互通问题，即客户的VPN路由可以在两个AS之间进行传递。RFC4364介绍了三种解决方案，我会在接下来的文章中一一介绍。本文先说第一种解决方案：Option A,这种解决方案需要在两个AS之间的ASBR上使用专门的接口去传递路由信息，所以我们也称这种为VRF-to-VRF。
写在最前面
配置步骤如下：
- 配置IP地址以及VRF
- 配置两个AS中的IGP协议_ISIS
- 配置AS中的标签分配协议（LDP）
- 配置CE与PE,PE与ASBR之间的BGP邻居
- 配置ASRB之间路由互相引入
- 验证连通性
配置IP地址以及VRF
1
```2
R1:3
interface Loopback04
ipv4 address 10.1.1.1 255.255.255.2555
interface GigabitEthernet0/0/0/06
ipv4 address 10.1.12.1 255.255.255.07
```8
```9
R2:10
vrf VIP11
address-family ipv4 unicast12
import route-target13
100:10014
export route-target15
100:10016
17
interface Loopback018
ipv4 address 10.1.2.2 255.255.255.25519
interface GigabitEthernet0/0/0/020
vrf VIP21
ipv4 address 10.1.12.2 255.255.255.022
interface GigabitEthernet0/0/0/123
ipv4 address 10.1.23.2 255.255.255.024
```25
```26
R3:27
interface Loopback028
ipv4 address 10.1.3.3 255.255.255.25529
interface GigabitEthernet0/0/0/030
ipv4 address 10.1.34.3 255.255.255.031
interface GigabitEthernet0/0/0/132
ipv4 address 10.1.23.3 255.255.255.033
```34
```35
R4:36
vrf VIP37
address-family ipv4 unicast38
import route-target39
100:10040
export route-target41
100:10042
43
interface Loopback044
ipv4 address 10.1.4.4 255.255.255.25545
interface GigabitEthernet0/0/0/046
ipv4 address 10.1.34.4 255.255.255.047
interface GigabitEthernet0/0/0/1 <<<这个就是前文所说的ASBR上特殊的接口48
vrf VIP49
ipv4 address 10.1.45.4 255.255.255.050
```51
```52
R5:53
vrf VIP54
address-family ipv4 unicast55
import route-target56
100:10057
export route-target58
100:10059
60
interface Loopback061
ipv4 address 10.1.5.5 255.255.255.25562
interface GigabitEthernet0/0/0/063
ipv4 address 10.1.56.5 255.255.255.064
interface GigabitEthernet0/0/0/165
vrf VIP66
ipv4 address 10.1.45.5 255.255.255.067
```68
```69
R6:70
interface Loopback071
ipv4 address 10.1.6.6 255.255.255.25572
interface GigabitEthernet0/0/0/073
ipv4 address 10.1.56.6 255.255.255.074
interface GigabitEthernet0/0/0/175
ipv4 address 10.1.67.6 255.255.255.076
```77
```78
R7:79
vrf VIP80
address-family ipv4 unicast81
import route-target82
100:10083
export route-target84
100:10085
86
interface Loopback087
ipv4 address 10.1.7.7 255.255.255.25588
interface GigabitEthernet0/0/0/089
vrf VIP90
ipv4 address 10.1.78.7 255.255.255.091
interface GigabitEthernet0/0/0/192
ipv4 address 10.1.67.7 255.255.255.093
```94
```95
R8:96
interface Loopback097
ipv4 address 10.1.8.8 255.255.255.25598
interface GigabitEthernet0/0/0/099
ipv4 address 10.1.78.8 255.255.255.0100
```配置两个AS中的IGP协议_ISIS
1
```2
R2:3
router isis 14
is-type level-2-only5
net 49.0000.0000.0000.0001.006
address-family ipv4 unicast7
metric-style wide8
!9
interface Loopback010
passive11
address-family ipv4 unicast12
!13
!14
interface GigabitEthernet0/0/0/115
point-to-point16
address-family ipv4 unicast17
!18
```19
```20
R3:21
router isis 122
is-type level-2-only23
net 49.0000.0000.0000.0002.0024
address-family ipv4 unicast25
metric-style wide26
!27
interface Loopback028
passive29
address-family ipv4 unicast30
!31
!32
interface GigabitEthernet0/0/0/033
point-to-point34
address-family ipv4 unicast35
!36
!37
interface GigabitEthernet0/0/0/138
point-to-point39
address-family ipv4 unicast40
!41
!42
!43
```44
```45
R4:46
router isis 147
is-type level-2-only48
net 49.0000.0000.0000.0004.0049
address-family ipv4 unicast50
metric-style wide51
!52
interface Loopback053
passive54
address-family ipv4 unicast55
!56
!57
interface GigabitEthernet0/0/0/058
point-to-point59
address-family ipv4 unicast60
!61
!62
!63
```64
```65
R5:66
router isis 167
is-type level-2-only68
net 49.0001.0000.0000.0005.0069
address-family ipv4 unicast70
metric-style wide71
!72
interface Loopback073
passive74
address-family ipv4 unicast75
!76
!77
interface GigabitEthernet0/0/0/078
point-to-point79
address-family ipv4 unicast80
!81
!82
! 83
```84
```85
R6:86
router isis 187
is-type level-2-only88
net 49.0001.0000.0000.0006.0089
address-family ipv4 unicast90
metric-style wide91
!92
interface Loopback093
passive94
address-family ipv4 unicast95
!96
!97
interface GigabitEthernet0/0/0/098
point-to-point99
address-family ipv4 unicast100
!101
!102
interface GigabitEthernet0/0/0/1103
point-to-point104
address-family ipv4 unicast105
!106
!107
!108
```109
```110
R7:111
router isis 1112
is-type level-2-only113
net 49.0001.0000.0000.0007.00114
address-family ipv4 unicast115
metric-style wide116
!117
interface Loopback0118
passive119
address-family ipv4 unicast120
!121
!122
interface GigabitEthernet0/0/0/1123
point-to-point124
address-family ipv4 unicast125
!126
!127
!128
```配置AS中的标签分配协议（LDP）
1
```2
R2:3
mpls ldp4
log5
neighbor6
!7
router-id 10.1.2.28
address-family ipv49
label10
local11
allocate for host-routes12
!13
!14
!15
interface GigabitEthernet0/0/0/116
!17
!18
```19
```20
R3:21
mpls ldp22
log23
neighbor24
!25
router-id 10.1.3.326
address-family ipv427
label28
local29
allocate for host-routes30
!31
!32
!33
interface GigabitEthernet0/0/0/034
!35
interface GigabitEthernet0/0/0/136
!37
!38
```39
```40
R4:41
mpls ldp42
log43
neighbor44
!45
router-id 10.1.4.446
address-family ipv447
label48
local49
allocate for host-routes50
!51
!52
!53
interface GigabitEthernet0/0/0/054
!55
!56
```57
```58
R5:59
mpls ldp60
log61
neighbor62
!63
router-id 10.1.5.564
address-family ipv465
label66
local67
allocate for host-routes68
!69
!70
!71
interface GigabitEthernet0/0/0/072
!73
!74
```75
```76
R6:77
mpls ldp78
log79
neighbor80
!81
router-id 10.1.6.682
address-family ipv483
label84
local85
allocate for host-routes86
!87
!88
!89
interface GigabitEthernet0/0/0/090
!91
interface GigabitEthernet0/0/0/192
!93
!94
```95
```96
R7:97
mpls ldp98
log99
neighbor100
!101
router-id 10.1.7.7102
address-family ipv4103
label104
local105
allocate for host-routes106
!107
!108
!109
interface GigabitEthernet0/0/0/1110
!111
!112
```配置CE与PE,PE与ASBR之间的BGP邻居
需要提前了解到的是，在IOS XR中, IBGP可以不用配置router-policy,但是对于EBGP，一定需要配置router-policy,入向和出向都需要配置，即使router-policy只有一个关键字pass.入向不配置，会drop对端发来的update；出向不配置，不会发布update
1
```2
R1:3
route-policy EBGP_PASS4
pass5
end-policy6
!7
router bgp 650008
bgp router-id 10.1.1.19
address-family ipv4 unicast10
network 10.1.1.1/3211
!12
neighbor 10.1.12.213
remote-as 114
address-family ipv4 unicast15
route-policy EBGP_PASS in16
route-policy EBGP_PASS out17
!18
!19
!20
```21
```22
R2:23
router bgp 124
bgp router-id 10.1.2.225
address-family vpnv4 unicast26
!27
neighbor 10.1.4.428
remote-as 129
update-source Loopback030
address-family vpnv4 unicast31
next-hop-self32
!33
!34
vrf VIP35
rd auto36
address-family ipv4 unicast37
!38
neighbor 10.1.12.139
remote-as 6500040
address-family ipv4 unicast41
route-policy EBGP_PASS in42
route-policy EBGP_PASS out43
!44
!45
!46
!47
```48
```49
R450
router bgp 151
bgp router-id 10.1.4.452
address-family vpnv4 unicast53
!54
neighbor 10.1.2.255
remote-as 156
update-source Loopback057
address-family vpnv4 unicast58
next-hop-self59
!60
!61
vrf VIP <<<配置VRF的原因是为了能让受到的VPNv4路由加入路由表，否则我们只会在BGP 路由表中看到62
rd auto 63
address-family ipv4 unicast64
!65
!66
!67
```68
```69
R5:70
router bgp 271
bgp router-id 10.1.5.572
address-family vpnv4 unicast73
!74
neighbor 10.1.7.775
remote-as 276
update-source Loopback077
address-family vpnv4 unicast78
next-hop-self79
!80
!81
vrf VIP82
rd auto 83
address-family ipv4 unicast84
!85
!86
!87
```88
```89
R7:90
router bgp 291
bgp router-id 10.1.7.792
address-family vpnv4 unicast93
!94
neighbor 10.1.5.595
remote-as 296
update-source Loopback097
address-family vpnv4 unicast98
next-hop-self99
!100
!101
vrf VIP102
rd auto103
address-family ipv4 unicast104
!105
neighbor 10.1.78.8106
remote-as 65001107
address-family ipv4 unicast108
route-policy EBGP_PASS in109
route-policy EBGP_PASS out110
!111
!112
!113
!114
```115
```116
R8:117
router bgp 65001118
bgp router-id 10.1.8.8119
address-family ipv4 unicast120
network 10.1.8.8/32121
!122
neighbor 10.1.78.7123
remote-as 2124
address-family ipv4 unicast125
route-policy EBGP_PASS in126
route-policy EBGP_PASS out127
!128
!129
!130
```配置ASRB之间路由互相引入
1
```2
R4:3
router ospf VIP4
vrf VIP5
capability vrf-lite6
redistribute bgp 17
area 08
interface GigabitEthernet0/0/0/19
!10
!11
!12
!13
router bgp 114
vrf VIP15
rd auto 16
address-family ipv4 unicast17
redistribute ospf VIP18
!19
!20
!21
```22
```23
R5:24
router ospf VIP25
vrf VIP26
capability vrf-lite27
redistribute bgp 228
area 029
interface GigabitEthernet0/0/0/130
!31
!32
!33
!34
router bgp 235
vrf VIP36
rd auto 37
address-family ipv4 unicast38
redistribute ospf VIP39
!40
!41
!42
```验证连通性
1
```2
RP/0/0/CPU0:R1#traceroute 10.1.8.8 source 10.1.1.13
Mon Jun 24 01:24:28.393 UTC4
5
Type escape sequence to abort.6
Tracing the route to 10.1.8.87
8
1 10.1.12.2 0 msec 0 msec 0 msec 9
2 10.1.23.3 [MPLS: Labels 24001/24002 Exp 0] 9 msec 19 msec 9 msec 10
3 10.1.34.4 [MPLS: Label 24002 Exp 0] 19 msec 19 msec 9 msec 11
4 10.1.45.5 9 msec 9 msec 9 msec 12
5 10.1.56.6 [MPLS: Labels 24000/24002 Exp 0] 29 msec 19 msec 29 msec 13
6 10.1.67.7 [MPLS: Label 24002 Exp 0] 29 msec 19 msec 29 msec 14
7 10.1.78.8 29 msec * 19 msec 15
RP/0/0/CPU0:R1#Q&A
为什么需要配置这个命令”capability vrf-lite”?
主要目的是为了能将收到的路由顺利加表，原理如下:R4对于R5而言是个PE设备，PE在决定将Type3, 5, 7的LSA发布给对端的CE时，都会置为一个DN bit，如下所示，对端CE收到DN bit的LSA是不会加表的，主要目的是为了防止环路。所以在这种情景下，使用这条命令可以不产生DN bit，使收到的路由能顺利的加表.
1
```2
RP/0/0/CPU0:R4#show ospf vrf VIP database external 3
Sat Jun 22 13:53:37.752 UTC4
5
6
OSPF Router with ID (10.1.4.4) (Process ID VIP, VRF VIP)7
8
Type-5 AS External Link States9
10
LS age: 2811
Options: (No TOS-capability, DC, DN)12
LS Type: AS External Link13
Link State ID: 10.1.1.1 (External Network Number)14
Advertising Router: 10.1.4.415
LS Seq Number: 8000000416
Checksum: 0xaf8e17
Length: 3618
Network Mask: /3219
Metric Type: 2 (Larger than any link state path)20
TOS: 0 21
Metric: 1 22
Forward Address: 0.0.0.023
External Route Tag: 348966092924
```配置文件:
https://mega.nz/#F!xKg1VSJQ!MOGudG5349kecCxBY52LRA
This Blog from Xuxing's Blog;
Link: http://imxing.cn/?p=147
No comments:
Post a Comment