BGP MPLS VPN配置与排错.ppt
BGP/MPLS VPN配置与排错,主讲：陈萍,目标,1.巩固BGP/MPLS VPN的原理,3.熟悉MPLS VPN网络的排错方法,2.掌握MPLS VPN的配置方法,BGP/MPLS VPN实现原理回顾BGP/MPLS VPN配置步骤与排错方法总结与提要,R-c05(CE1),R8(PE1),R9(P),R-d05(PE2),AS37937,Lo=59.0.0.1,R-c06(CE2),R-CE3,R-CE4,Lo=59.0.0.2,Lo=59.0.0.3,59.0.1.1/30,.2,59.0.1.5/30,.6,Ethernet1/0/0,Ethernet1/0/1,Ethernet2/0/0,Ethernet1/0/2,Ethernet1/0/0,Ethernet1/0/4,Ethernet2/0/1,Ethernet2/0/2,192.168.1.1/2,172.32.1.1/2,Lo=192.168.254.1,Lo=172.32.254.1,192.168.2.1/2,172.32.2.1/2,Lo=192.168.255.1,Lo=172.32.255.1,VPN1,VPN2,一个简单的MPLS VPN组网,BGP/MPLS VPN实现原理回顾BGP/MPLS VPN配置步骤与排错方法总结与提要,1.配置IGP公网路由协议,2.配置MPLS,3.配置BGP,4.配置VPN，配置PE和CE之间的路由,目标：所有PE和P设备可以互相学到32位loopback地址,目标：所有相邻PE和P设备之间建立LDPsession，并为其32位loopback地址分配MPLS标签,目标：所有PE设备之间普通BGP邻居和BGP vpnv4邻居,目标：PE设备可以学习到直连CE侧的私网路由（以OSPF为例）,5.将本端学到的私网路由引入到对应的BGP的VPN实例，将BGP学过来的远端私网路由引入给本端的CE侧。,目标：PE设备可以学习到远端CE侧的私网路由 CE设备可以学习到远端CE侧的私网路由,MPLS VPN的配置步骤与逐步排错方法,1.配置IGP公网路由协议,目标：所有PE和P设备可以互相学到32位loop地址,R8(PE1),R9(P),R-d05(PE2),router id 59.0.0.1 ospf 1 area 0.0.0.0 network 59.0.0.1 0.0.0.0 network 59.0.1.0 0.0.0.3,router id 59.0.0.3 ospf 1 area 0.0.0.0 network 59.0.0.3 0.0.0.0 network 59.0.1.4 0.0.0.3 network 59.0.1.0 0.0.0.3,router id 59.0.0.2 ospf 1 area 0.0.0.0 network 59.0.0.2 0.0.0.0 network 59.0.1.4 0.0.0.3,1.配置IGP公网路由协议,目标：所有PE和P设备可以互相学到32位loop地址,R8(PE1),dis ip routing-table Routing Tables:Public Destinations:11 Routes:11Destination/Mask Proto Pre Cost NextHop Interface 59.0.0.1/32 Direct 0 0 127.0.0.1 InLoopBack0 59.0.0.2/32 OSPF 10 3 59.0.1.2 Ethernet1/0/2 59.0.0.3/32 OSPF 10 2 59.0.1.2 Ethernet1/0/2 59.0.1.0/30 Direct 0 0 59.0.1.1 Ethernet1/0/2 59.0.1.1/32 Direct 0 0 127.0.0.1 InLoopBack0 59.0.1.3/32 Direct 0 0 127.0.0.1 InLoopBack0 59.0.1.4/30 OSPF 10 2 59.0.1.2 Ethernet1/0/2 127.0.0.0/8 Direct 0 0 127.0.0.1 InLoopBack0 127.0.0.1/32 Direct 0 0 127.0.0.1 InLoopBack0127.255.255.255/32 Direct 0 0 127.0.0.1 InLoopBack0255.255.255.255/32 Direct 0 0 127.0.0.1 InLoopBack0,1.配置IGP公网路由协议,目标：所有PE和P设备可以互相学到32位loop地址,R9(P),dis ip routing-table Routing Tables:Public Destinations:13 Routes:13Destination/Mask Proto Pre Cost NextHop Interface 59.0.0.1/32 OSPF 10 2 59.0.1.1 Ethernet1/0/0 59.0.0.2/32 OSPF 10 2 59.0.1.6 Ethernet1/0/1 59.0.0.3/32 Direct 0 0 127.0.0.1 InLoopBack0 59.0.1.0/30 Direct 0 0 59.0.1.2 Ethernet1/0/0 59.0.1.2/32 Direct 0 0 127.0.0.1 InLoopBack0 59.0.1.3/32 Direct 0 0 127.0.0.1 InLoopBack0 59.0.1.4/30 Direct 0 0 59.0.1.5 Ethernet1/0/1 59.0.1.5/32 Direct 0 0 127.0.0.1 InLoopBack0 59.0.1.7/32 Direct 0 0 127.0.0.1 InLoopBack0 127.0.0.0/8 Direct 0 0 127.0.0.1 InLoopBack0 127.0.0.1/32 Direct 0 0 127.0.0.1 InLoopBack0127.255.255.255/32 Direct 0 0 127.0.0.1 InLoopBack0255.255.255.255/32 Direct 0 0 127.0.0.1 InLoopBack0,1.配置IGP公网路由协议,目标：所有PE和P设备可以互相学到32位loop地址,R-d05(PE2),dis ip routing-table Routing Tables:Public Destinations:11 Routes:11Destination/Mask Proto Pre Cost NextHop Interface 59.0.0.1/32 OSPF 10 3 59.0.1.5 Ethernet2/0/0 59.0.0.2/32 Direct 0 0 127.0.0.1 InLoopBack0 59.0.0.3/32 OSPF 10 2 59.0.1.5 Ethernet2/0/0 59.0.1.0/30 OSPF 10 2 59.0.1.5 Ethernet2/0/0 59.0.1.4/30 Direct 0 0 59.0.1.6 Ethernet2/0/0 59.0.1.6/32 Direct 0 0 127.0.0.1 InLoopBack0 59.0.1.7/32 Direct 0 0 127.0.0.1 InLoopBack0 127.0.0.0/8 Direct 0 0 127.0.0.1 InLoopBack0 127.0.0.1/32 Direct 0 0 127.0.0.1 InLoopBack0127.255.255.255/32 Direct 0 0 127.0.0.1 InLoopBack0255.255.255.255/32 Direct 0 0 127.0.0.1 InLoopBack0,2.配置MPLS,目标：所有PE和P设备之间建立LDPsession，并为其32位loopback地址分配MPLS标签,R8(PE1),R9(P),R-d05(PE2),mpls lsr-id 59.0.0.1 mpls mpls ldp,mpls lsr-id 59.0.0.3mplsmpls ldp,mpls lsr-id 59.0.0.2mplsmpls ldp,interface Ethernet1/0/0 description toR8 undo shutdown ip address 59.0.1.2 255.255.255.252 mpls mpls ldp,interface Ethernet1/0/1 description to R-d05 undo shutdown ip address 59.0.1.5 255.255.255.252 mpls mpls ldp,interface Ethernet1/0/2 description toR9 undo shutdown ip address 59.0.1.1 255.255.255.252 mpls mpls ldp,interface Ethernet2/0/0 description toR9 undo shutdown ip address 59.0.1.6 255.255.255.252 mpls mpls ldp,2.配置MPLS,目标：所有相邻PE和P设备之间建立LDPsession，并为其32位loopback地址分配MPLS标签,R8(PE1),R8(PE1)dis mpls ldp session LDP Session(s)in Public Network-Peer-ID Status LAM SsnRole SsnAge KA-Sent/Rcv-59.0.0.3:0 Operational DU Passive 000:00:00 2/2-LAM:Label Advertisement Mode SsnAge Unit:DDD:HH:MMR8(PE1)dis mpls ldp lsp LDP LSP Information-SN DestAddress/Mask In/OutLabel Next-Hop In/Out-Interface-1 59.0.0.1/32 3/NULL 127.0.0.1 Eth1/0/2/InLoop0 2 59.0.0.2/32 NULL/1024 59.0.1.2-/Eth1/0/2 3 59.0.0.3/32 NULL/3 59.0.1.2-/Eth1/0/2-A*before an LSP means the LSP is not established A*before a Label means the USCB or DSCB is stale,2.配置MPLS,目标：所有PE和P设备之间建立LDPsession，并为其32位loopback地址分配MPLS标签,R9(P),dis mpls ldp session LDP Session(s)in Public Network-Peer-ID Status LAM SsnRole SsnAge KA-Sent/Rcv-59.0.0.1:0 Operational DU Active 000:00:01 8/8 59.0.0.2:0 Operational DU Active 000:00:06 28/28-LAM:Label Advertisement Mode SsnAge Unit:DDD:HH:MMdis mpls ldp lsp LDP LSP Information-SN DestAddress/Mask In/OutLabel Next-Hop In/Out-Interface-1 59.0.0.1/32 NULL/3 59.0.1.1-/Eth1/0/0 2 59.0.0.1/32 1025/3 59.0.1.1 Eth1/0/1/Eth1/0/0 3 59.0.0.2/32 NULL/3 59.0.1.6-/Eth1/0/1 4 59.0.0.2/32 1024/3 59.0.1.6 Eth1/0/0/Eth1/0/1 5 59.0.0.3/32 3/NULL 127.0.0.1 Eth1/0/1/InLoop0 6 59.0.0.3/32 3/NULL 127.0.0.1 Eth1/0/0/InLoop0-A*before an LSP means the LSP is not established A*before a Label means the USCB or DSCB is stale,2.配置MPLS,目标：所有PE和P设备之间建立LDPsession，并为其32位loopback地址分配MPLS标签,R-d05(PE2),dis mpls ldp session LDP Session(s)in Public Network-Peer-ID Status LAM SsnRole SsnAge KA-Sent/Rcv-59.0.0.3:0 Operational DU Passive 000:00:06 26/26-LAM:Label Advertisement Mode SsnAge Unit:DDD:HH:MMdis mpls ldp lsp LDP LSP Information-SN DestAddress/Mask In/OutLabel Next-Hop In/Out-Interface-1 59.0.0.1/32 NULL/1025 59.0.1.5-/Eth2/0/0 2 59.0.0.2/32 3/NULL 127.0.0.1 Eth2/0/0/InLoop0 3 59.0.0.3/32 NULL/3 59.0.1.5-/Eth2/0/0-A*before an LSP means the LSP is not established A*before a Label means the USCB or DSCB is stale,3.配置BGP,目标：所有PE设备之间普通BGP邻居和BGP vpnv4邻居,R8(PE1),R-d05(PE2),bgp 37937 peer 59.0.0.2 as-number 37937 peer 59.0.0.2 connect-interface LoopBack0#ipv4-family vpnv4 peer 59.0.0.2 enable,bgp 37937 peer 59.0.0.1 as-number 37937 peer 59.0.0.1 connect-interface LoopBack0#ipv4-family vpnv4 peer 59.0.0.1 enable,bgp 37937Group AS37937 in peer 59.0.0.2 group AS37937 peer 59.0.0.2 connect-interface LoopBack0#ipv4-family vpnv4 peer AS37937 enable peer 59.0.0.2 group AS37937,3.配置BGP,目标：所有PE设备之间普通BGP邻居和BGP vpnv4邻居,R8(PE1),dis bgp peer BGP local router ID:59.0.0.1 Local AS number:37937 Total number of peers:1 Peers in established state:1 Peer V AS MsgRcvd MsgSent OutQ Up/Down State PrefRcv 59.0.0.2 4 37937 3 2 0 00:00:10 Established 0dis bgp vpnv4 all peer BGP local router ID:59.0.0.1 Local AS number:37937 Total number of peers:1 Peers in established state:1 Peer V AS MsgRcvd MsgSent OutQ Up/Down State PrefRcv 59.0.0.2 4 37937 3 2 0 00:00:18 Established 0,3.配置BGP,目标：所有PE设备之间普通BGP邻居和BGP vpnv4邻居,R-d05(PE2),dis bgp peer BGP local router ID:59.0.0.2 Local AS number:37937 Total number of peers:1 Peers in established state:1 Peer V AS MsgRcvd MsgSent OutQ Up/Down State PrefRcv 59.0.0.1 4 37937 4 3 0 00:01:09 Established 0dis bgp vpnv4 all peer BGP local router ID:59.0.0.2 Local AS number:37937 Total number of peers:1 Peers in established state:1 Peer V AS MsgRcvd MsgSent OutQ Up/Down State PrefRcv 59.0.0.1 4 37937 4 3 0 00:01:16 Established 0,4.配置VPN，配置PE和CE之间的路由,目标：PE设备可以学习到直连CE侧的私网路由（以OSPF为例）,R8(PE1),ip vpn-instance vpn1 route-distinguisher 37937:1 vpn-target 37937:1 export-extcommunity vpn-target 37937:1 import-extcommunity#ip vpn-instance vpn2 route-distinguisher 37937:2 vpn-target 37937:2 export-extcommunity vpn-target 37937:2 import-extcommunityinterface Ethernet1/0/0 undo shutdown ip binding vpn-instance vpn1 ip address 192.168.1.1 255.255.255.252 interface Ethernet1/0/4 undo shutdown ip binding vpn-instance vpn2 ip address 172.32.1.1 255.255.255.252ospf 11 vpn-instance vpn1 area 0.0.0.0 network 192.168.1.0 0.0.0.3,ospf 12 vpn-instance vpn2 area 0.0.0.0 network 172.32.1.0 0.0.0.3,R-c05(CE1)ospf 11 area 0.0.0.0 network 192.168.1.0 0.0.0.3 network 192.168.254.1 0.0.0.0,R-c05(CE2)ospf 12 area 0.0.0.0 network 172.32.1.0 0.0.0.3 network 172.32.254.1 0.0.0.0,4.配置VPN，配置PE和CE之间的路由,目标：PE设备可以学习到直连CE侧的私网路由（以OSPF为例）,ip vpn-instance vpn1 route-distinguisher 37937:1 vpn-target 37937:1 export-extcommunity vpn-target 37937:1 import-extcommunity#ip vpn-instance vpn2 route-distinguisher 37937:2 vpn-target 37937:2 export-extcommunity vpn-target 37937:2 import-extcommunityinterface Ethernet2/0/1 undo shutdown ip binding vpn-instance vpn1 ip address 192.168.2.1 255.255.255.252#interface Ethernet2/0/2 undo shutdown ip binding vpn-instance vpn2 ip address 172.32.2.1 255.255.255.252 ospf 11 vpn-instance vpn1 area 0.0.0.0 network 192.168.2.0 0.0.0.3,ospf 12 vpn-instance vpn2 area 0.0.0.0 network 172.32.2.0 0.0.0.3,R-CE1ospf 11 area 0.0.0.0 network 192.168.2.0 0.0.0.3 network 192.168.255.1 0.0.0.0,R-CE2 ospf 12 area 0.0.0.0 network 172.32.2.0 0.0.0.3 network 172.32.255.1 0.0.0.0,R-d05(PE2),4.配置VPN，配置PE和CE之间的路由,目标：PE设备可以学习到直连CE侧的私网路由（以OSPF为例）,R8(PE1),dis ospf peerOSPF Process 11 with Router ID 192.168.1.1 Neighbors Area 0.0.0.0 interface 192.168.1.1(Ethernet1/0/0)s neighbors Router ID:192.168.254.1 Address:192.168.1.2 GR State:Normal State:Full Mode:Nbr is Master Priority:1 DR:192.168.1.1 BDR:192.168.1.2 MTU:0 Dead timer due in 28 sec Neighbor is up for 00:04:49 Authentication Sequence:0 OSPF Process 12 with Router ID 172.32.1.1 Neighbors Area 0.0.0.0 interface 172.32.1.1(Ethernet1/0/4)s neighbors Router ID:172.32.254.1 Address:172.32.1.2 GR State:Normal State:Full Mode:Nbr is Master Priority:1 DR:172.32.1.1 BDR:172.32.1.2 MTU:0 Dead timer due in 33 sec Neighbor is up for 00:02:36 Authentication Sequence:0,dis ip routing-table vpn-instance vpn1Routing Tables:vpn1 Destinations:5 Routes:5Destination/Mask Proto Pre Cost NextHop Interface 192.168.1.0/30 Direct 0 0 192.168.1.1 Ethernet1/0/0 192.168.1.1/32 Direct 0 0 127.0.0.1 InLoopBack0 192.168.1.3/32 Direct 0 0 127.0.0.1 InLoopBack0 192.168.254.1/32 OSPF 10 2 192.168.1.2 Ethernet1/0/0255.255.255.255/32 Direct 0 0 127.0.0.1 InLoopBack0dis ip routing-table vpn-instance vpn2Routing Tables:vpn2 Destinations:5 Routes:5Destination/Mask Proto Pre Cost NextHop Interface 172.32.1.0/30 Direct 0 0 172.32.1.1 Ethernet1/0/4 172.32.1.1/32 Direct 0 0 127.0.0.1 InLoopBack0 172.32.1.3/32 Direct 0 0 127.0.0.1 InLoopBack0 172.32.254.1/32 OSPF 10 2 172.32.1.2 Ethernet1/0/4255.255.255.255/32 Direct 0 0 127.0.0.1 InLoopBack0,dis ip routing-table vpn-instance vpn1Routing Tables:vpn1 Destinations:5 Routes:5Destination/Mask Proto Pre Cost NextHop Interface 192.168.2.0/30 Direct 0 0 192.168.2.1 Ethernet2/0/1 192.168.2.1/32 Direct 0 0 127.0.0.1 InLoopBack0 192.168.2.3/32 Direct 0 0 127.0.0.1 InLoopBack0 192.168.255.1/32 OSPF 10 2 192.168.2.2 Ethernet2/0/1255.255.255.255/32 Direct 0 0 127.0.0.1 InLoopBack0dis ip routing-table vpn-instance vpn2Routing Tables:vpn2 Destinations:5 Routes:5Destination/Mask Proto Pre Cost NextHop Interface 172.32.2.0/30 Direct 0 0 172.32.2.1 Ethernet2/0/2 172.32.2.1/32 Direct 0 0 127.0.0.1 InLoopBack0 172.32.2.3/32 Direct 0 0 127.0.0.1 InLoopBack0 172.32.255.1/32 OSPF 10 2 172.32.2.2 Ethernet2/0/2255.255.255.255/32 Direct 0 0 127.0.0.1 InLoopBack0,4.配置VPN，配置PE和CE之间的路由,目标：PE设备可以学习到直连CE侧的私网路由（以OSPF为例）,OSPF Process 11 with Router ID 192.168.2.1 Neighbors Area 0.0.0.0 interface 192.168.2.1(Ethernet2/0/1)s neighbors Router ID:192.168.255.1 Address:192.168.2.2 GR State:Normal State:Full Mode:Nbr is Master Priority:1 DR:192.168.2.1 BDR:192.168.2.2 MTU:0 Dead timer due in 35 sec Neighbor is up for 00:04:49 Authentication Sequence:0 OSPF Process 12 with Router ID 172.32.2.1 Neighbors Area 0.0.0.0 interface 172.32.2.1(Ethernet2/0/2)s neighbors Router ID:172.32.255.1 Address:172.32.2.2 GR State:Normal State:Full Mode:Nbr is Master Priority:1 DR:172.32.2.2 BDR:172.32.2.1 MTU:0 Dead timer due in 36 sec Neighbor is up for 00:00:08 Authentication Sequence:0,R-d05(PE2),5.将本端学到的私网路由引入到对应的BGP的VPN实例 将BGP学过来的远端私网路由引入给本端的CE侧,R8(PE1),R-d05(PE2),bgp 37937 ipv4-family vpn-instance vpn1 import-route direct import-route ospf 11#ipv4-family vpn-instance vpn2 import-route direct import-route ospf 12,bgp 37937 ipv4-family vpn-instance vpn1 import-route direct import-route ospf 11#ipv4-family vpn-instance vpn2 import-route direct import-route ospf 12,ospf 11 vpn-instance vpn1 import-route bgp area 0.0.0.0 network 192.168.1.0 0.0.0.3#ospf 12 vpn-instance vpn2 import-route bgp area 0.0.0.0 network 172.32.1.0 0.0.0.3,ospf 11 vpn-instance vpn1 import-route bgp area 0.0.0.0 network 192.168.2.0 0.0.0.3#ospf 12 vpn-instance vpn2 import-route bgp area 0.0.0.0 network 172.32.2.0 0.0.0.3,目标：PE设备可以学习到远端CE侧的私网路由 CE设备可以学习到远端CE侧的私网路由,5.将本端学到的私网路由引入到对应的BGP的VPN实例 将BGP学过来的远端私网路由引入给本端的CE侧,R8(PE1),dis ip routing-table vpn-instance vpn1Routing Tables:vpn1 Destinations:7 Routes:7Destination/Mask Proto Pre Cost NextHop Interface 192.168.1.0/30 Direct 0 0 192.168.1.1 Ethernet1/0/0 192.168.1.1/32 Direct 0 0 127.0.0.1 InLoopBack0 192.168.1.3/32 Direct 0 0 127.0.0.1 InLoopBack0 192.168.2.0/30 BGP 255 0 59.0.0.2 Ethernet1/0/2 192.168.254.1/32 OSPF 10 2 192.168.1.2 Ethernet1/0/0 192.168.255.1/32 BGP 255 3 59.0.0.2 Ethernet1/0/2255.255.255.255/32 Direct 0 0 127.0.0.1 InLoopBack0dis ip routing-table vpn-instance vpn2Routing Tables:vpn2 Destinations:7 Routes:7Destination/Mask Proto Pre Cost NextHop Interface 172.32.1.0/30 Direct 0 0 172.32.1.1 Ethernet1/0/4 172.32.1.1/32 Direct 0 0 127.0.0.1 InLoopBack0 172.32.1.3/32 Direct 0 0 127.0.0.1 InLoopBack0 172.32.2.0/30 BGP 255 0 59.0.0.2 Ethernet1/0/2 172.32.254.1/32 OSPF 10 2 172.32.1.2 Ethernet1/0/4 172.32.255.1/32 BGP 255 3 59.0.0.2 Ethernet1/0/2255.255.255.255/32 Direct 0 0 127.0.0.1 InLoopBack0,目标：PE设备可以学习到远端CE侧的私网路由 CE设备可以学习到远端CE侧的私网路由,5.将本端学到的私网路由引入到对应的BGP的VPN实例 将BGP学过来的远端私网路由引入给本端的CE侧,dis ip routing-table vpn-instance vpn1Routing Tables:vpn1 Destinations:7 Routes:7Destination/Mask Proto Pre Cost NextHop Interface 192.168.1.0/30 BGP 255 0 59.0.0.1 Ethernet2/0/0 192.168.2.0/30 Direct 0 0 192.168.2.1 Ethernet2/0/1 192.168.2.1/32 Direct 0 0 127.0.0.1 InLoopBack0 192.168.2.3/32 Direct 0 0 127.0.0.1 InLoopBack0 192.168.254.1/32 BGP 255 3 59.0.0.1 Ethernet2/0/0 192.168.255.1/32 OSPF 10 2 192.168.2.2 Ethernet2/0/1255.255.255.255/32 Direct 0 0 127.0.0.1 InLoopBack0dis ip routing-table vpn-instance vpn2Routing Tables:vpn2 Destinations:7 Routes:7Destination/Mask Proto Pre Cost NextHop Interface 172.32.1.0/30 BGP 255 0 59.0.0.1 Ethernet2/0/0 172.32.2.0/30 Direct 0 0 172.32.2.1 Ethernet2/0/2 172.32.2.1/32 Direct 0 0 127.0.0.1 InLoopBack0 172.32.2.3/32 Direct 0 0 127.0.0.1 InLoopBack0 172.32.254.1/32 BGP 255 3 59.0.0.1 Ethernet2/0/0 172.32.255.1/32 OSPF 10 2 172.32.2.2 Ethernet2/0/2255.255.255.255/32 Direct 0 0 127.0.0.1 InLoopBack0,R-d05(PE2),目标：PE设备可以学习到远端CE侧的私网路由 CE设备可以学习到远端CE侧的私网路由,5.将本端学到的私网路由引入到对应的BGP的VPN实例 将BGP学过来的远端私网路由引入给本端的CE侧,dis ip routing-table Routing Table:public netDestination/Mask Prot
