配置BGP IPv6 Flowspec

简介

本文档介绍如何在ASR1K上配置边界网关协议(BGP)IPv6流规范。

先决条件

要求

Cisco 建议您了解以下主题：

• 独立于平台

使用的组件

本文档中的信息基于以下软件和硬件版本：

• IOS-XE
• ASR1000
• ASR9K 
• ASR1K 
• 调试输出中显示“BGP
• 流规范
• IPv6

本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始（默认）配置。如果您的网络处于活动状态，请确保您了解所有命令的潜在影响。

背景信息

Flowspec指定通过BGP分配流规范规则的过程，并定义将流规范规则编码为边界网关协议网络层可达性信息(BGP NLRI)的过程，该信息可用于任何应用。它还定义用于数据包过滤的应用，以缓解（分布式）拒绝服务攻击。

限制

以下是配置的限制：

• flowspec规则中不允许混合地址系列。
• 在多个匹配场景中，仅应用第一个匹配的流规则。
• 每个系统最多支持3000个flowspec规则。

配置

在本示例中，我们将ASR9K配置为控制器，将ASR1K配置为PE、RR和Flowspec客户端。

这是IPv6 Flowspec工作所需的最低配置。

On controller to push the policy to PE/client:
class-map type traffic match-all FLOWSPEC
 match destination-address ipv6 2001:db8::/32   <<<<< Match destination address/subnet.
 end-class-map
!
policy-map type pbr FS_P
 class type traffic FLOWSPEC                    <<<<< Apply class-map under policy-map.
  drop
 !
flowspec
 address-family ipv4
  service-policy type pbr FSP_V4
 !
 address-family ipv6
  service-policy type pbr FS_P                  <<<<< Apply policy-map inside Flowspec under AF.
 !

On PE/client is to enable IPv6 flowspec AF under BGP.
 address-family ipv6 flowspec                   <<<<< Under ipv6 flowspec AF, activate the neighbor.
  neighbor 10.192.202.5 activate
  neighbor 10.192.202.5 validation off

To apply the flowspec policy on interface, "local-install interface-all" command is must under flowspec.
flowspec
 local-install interface-all                    <<<<< Push the policy on interface.

• 根据控制器配置，发往2001:db8::/32的所有流量都应根据策略被丢弃。
  
  
• 在ipv6 address-family下保持对邻居的验证关闭，以便ASR1K不检查下一跳。
  
  
• 理想情况下，如果策略正在运行，则在控制器中看到计数器，但如果您想在任何其他设备上看到它，请在所有用户接口上安装flowspec策略，在flowspec下需要local-install interface-all命令。

故障排除过程中的挑战

• 如果底层网络是IPv4，并且BGP flowspec为IPv6运行，则每一跳都会出现验证检查问题，并导致IPv6 Flowspec策略问题。因此，请保持验证关闭，以便邻居不执行验证检查。
  
  
• 除控制器外，您无法看到flowspec策略匹配/操作计数器。要检查计数器，本地安装接口 — 全部必须在Flowspec下（在AF下）。 此命令推送IPv4和IPv6地址系列设备的所有接口以及VRF实例内的接口上的流规范策略配置。

网络图

+----------------+              +-----------------+            +------------------+             +-----------------+
|                |              |                 |            |                  |             |                 |
|   Controller   +--------------+     PE/RR1      +------------+      PE/RR2      +-------------+      End-PE     |
|     ASR9K      |              |     CRR01       |            |      CRR02       |             |      DCPR01     |
+----------------+              +-----------------+            +------------------+             +-----------------+

配置

此配置基于网络图，与设置相同。

Controller:
RP/0/RSP0/CPU0:Controller# show running-config
Mon Apr  8 16:33:36.578 UTC
Building configuration...
!! IOS XR Configuration 5.3.4
!! Last configuration change at Wed Apr  3 17:34:59 2019 by admin
!
hostname Controller
cdp
cdp advertise v1
!
class-map type traffic match-all FLOWSPEC
 match destination-address ipv6 2001:db8::/32
 end-class-map
!
class-map type traffic match-all V4_FLOWSPEC
 match source-address ipv4 102.102.102.102 255.255.255.255
 end-class-map
!
policy-map type pbr FS_P
 class type traffic FLOWSPEC
  drop
 !
 class type traffic class-default
 !
 end-policy-map
!
policy-map type pbr FSP_V4
 class type traffic V4_FLOWSPEC
  set dscp ef
 !
 class type traffic class-default
 !
 end-policy-map
!
interface Loopback0
 ipv4 address 10.192.202.5 255.255.255.255
!
interface Loopback100
 ipv4 address 102.102.102.102 255.255.255.255
 ipv6 address 2001:db8::1/32
!
interface TenGigE0/0/0/0
 ipv4 address 10.10.12.1 255.255.255.0
 ipv6 address 2001:10:10:12::1/64
!
route-policy ALL
  pass
end-policy
!
router static
 address-family ipv4 unicast
  203.202.143.33/32 TenGigE0/0/0/0
 !
 address-family ipv6 unicast
  2003::/64 2001:10:10:12::2
 !
!
router ospfv3 1
 area 0
  interface TenGigE0/0/0/0
   network point-to-point
  !
 !
!
router bgp 64696
 bgp router-id 10.192.202.5
 address-family ipv4 unicast
  network 102.102.102.102/32
 !
 address-family vpnv4 unicast
 !
 address-family ipv4 flowspec
 !
 address-family ipv6 flowspec
 !
 neighbor 203.202.143.33
  remote-as 7474
  ebgp-multihop 10
  update-source Loopback0
  address-family ipv4 unicast
   route-policy ALL in
   route-policy ALL out
  !
  address-family vpnv4 unicast
  !
  address-family ipv4 flowspec
   route-policy ALL in
   route-policy ALL out
  !
  address-family ipv6 flowspec
   route-policy ALL in
   route-policy ALL out
  !
 !
!
flowspec
 local-install interface-all
 address-family ipv4
  service-policy type pbr FSP_V4
 !
 address-family ipv6
  service-policy type pbr FS_P
 !
!
end

PE/RR1:
CRR01#show running-config
Building configuration...

!
ipv6 unicast-routing
mpls label protocol ldp
!
spanning-tree extend system-id
flowspec
 local-install interface-all
diagnostic bootup level minimal
!
interface Loopback0
 ip address 203.202.143.33 255.255.255.255
 ip ospf 1 area 0
!
interface Loopback1010
 no ip address
 ipv6 address 2001:DB8::10/32
!
interface TenGigabitEthernet0/0/0
 ip address 10.10.12.2 255.255.255.0
 ip ospf network point-to-point
 cdp enable
 ipv6 address 2001:10:10:12::2/64
!
interface TenGigabitEthernet0/0/3
 ip address 10.10.23.2 255.255.255.0
 ip ospf network point-to-point
 ip ospf 1 area 0
 cdp enable
 ipv6 address 2003::1/64
 mpls ip
!
router ospf 1
 mpls ldp autoconfig
!
router bgp 7474
 bgp router-id 203.202.143.33
 bgp log-neighbor-changes
 neighbor 10.192.202.5 remote-as 64696
 neighbor 10.192.202.5 ebgp-multihop 10
 neighbor 10.192.202.5 update-source Loopback0
 neighbor 2001:10:10:12::1 remote-as 64696
 neighbor 203.202.143.44 remote-as 7474
 neighbor 203.202.143.44 update-source Loopback0
 !
 address-family ipv4
  neighbor 10.192.202.5 activate
  no neighbor 2001:10:10:12::1 activate
  neighbor 203.202.143.44 activate
  neighbor 203.202.143.44 route-reflector-client
 exit-address-family
 !
 address-family ipv4 flowspec
  neighbor 10.192.202.5 activate
  neighbor 203.202.143.44 activate
  neighbor 203.202.143.44 send-community both
  neighbor 203.202.143.44 route-reflector-client
 exit-address-family
 !
 address-family ipv6
  neighbor 10.192.202.5 activate
  neighbor 203.202.143.44 activate
  neighbor 203.202.143.44 route-reflector-client
  neighbor 203.202.143.44 send-label
 exit-address-family
 !
 address-family ipv6 flowspec
  neighbor 10.192.202.5 activate
  neighbor 10.192.202.5 validation off
  neighbor 203.202.143.44 activate
  neighbor 203.202.143.44 send-community both
  neighbor 203.202.143.44 route-reflector-client
  neighbor 203.202.143.44 next-hop-self
 exit-address-family
!
ip route 10.192.202.5 255.255.255.255 10.10.12.1
!
!
ipv6 route 2001:DB8::1/128 2001:10:10:12::1
!
end

PE/RR2:
CRR02#show running-config
Building configuration...

Current configuration : 7227 bytes
!
! Last configuration change at 18:21:29 UTC Mon Apr 8 2019
!
hostname CRR02
!
boot-start-marker
boot system flash bootflash:asr1000rpx86-universalk9.16.10.01a.SPA.bin
boot-end-marker
!
ipv6 unicast-routing
multilink bundle-name authenticated
!
spanning-tree extend system-id
flowspec
diagnostic bootup level minimal
!
interface Loopback0
 ip address 203.202.143.44 255.255.255.255
 ip ospf 1 area 0
!
interface TenGigabitEthernet1/0/0
 ip address 10.10.23.3 255.255.255.0
 ip ospf network point-to-point
 ip ospf 1 area 0
 cdp enable
 ipv6 address 2003::2/64
 mpls ip
!
interface TenGigabitEthernet1/0/1
 ip address 10.10.34.3 255.255.255.0
 ip ospf network point-to-point
 ip ospf 1 area 0
 cdp enable
!
router ospf 1
 mpls ldp autoconfig
!
router bgp 7474
 bgp router-id 203.202.143.44
 bgp log-neighbor-changes
 neighbor 203.202.143.33 remote-as 7474
 neighbor 203.202.143.33 update-source Loopback0
 neighbor 203.202.143.45 remote-as 7474
 neighbor 203.202.143.45 update-source Loopback0
 !
 address-family ipv4
  neighbor 203.202.143.33 activate
  neighbor 203.202.143.45 activate
 exit-address-family
 !
 address-family ipv4 flowspec
  neighbor 203.202.143.33 activate
  neighbor 203.202.143.45 activate
  neighbor 203.202.143.45 send-community both
  neighbor 203.202.143.45 route-reflector-client
 exit-address-family
 !
 address-family ipv6
  neighbor 203.202.143.33 activate
  neighbor 203.202.143.33 send-label
 exit-address-family
 !
 address-family ipv6 flowspec
  neighbor 203.202.143.33 activate
  neighbor 203.202.143.33 validation off
  neighbor 203.202.143.45 activate
  neighbor 203.202.143.45 send-community both
  neighbor 203.202.143.45 route-reflector-client
 exit-address-family
!
ipv6 route 2001:10:10:12::/64 2003::1
ipv6 route 2001:DB8::1/128 2003::1
!
end

End-PE:
DCPR01#show running-config
Building configuration...
!
hostname DCPR01
!
subscriber templating
!
ipv6 unicast-routing
!
flowspec
diagnostic bootup level minimal
!
interface Loopback0
 ip address 203.202.143.45 255.255.255.255
 ip ospf 1 area 0
!
interface TenGigabitEthernet1/3/0
 ip address 10.10.34.4 255.255.255.0
 ip ospf network point-to-point
 ip ospf 1 area 0
 cdp enable
 ipv6 address 2001::1/64
!
router ospf 1
 mpls ldp autoconfig
!
router bgp 7474
 bgp router-id 203.202.143.45
 bgp log-neighbor-changes
 neighbor 203.202.143.44 remote-as 7474
 neighbor 203.202.143.44 update-source Loopback0
 !
 address-family ipv4 flowspec
  neighbor 203.202.143.44 activate
 exit-address-family
 !
 address-family ipv6 flowspec
  neighbor 203.202.143.44 activate
  neighbor 203.202.143.44 validation off
 exit-address-family
!
ipv6 route ::/0 TenGigabitEthernet1/3/0
!
end

验证

PE/RR2:
CRR02#ping 2001:db8::1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:DB8::1, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
CRR02#

Controller:
RP/0/RSP0/CPU0:Controller#show bgp ipv6 flowspec
Mon Apr  8 17:55:17.041 UTC
BGP router identifier 10.192.202.5, local AS number 64696
BGP generic scan interval 60 secs
Non-stop routing is enabled
BGP table state: Active
Table ID: 0x0   RD version: 20
BGP main routing table version 20
BGP NSR Initial initsync version 0 (Reached)
BGP NSR/ISSU Sync-Group versions 0/0
BGP scan interval 60 secs

Status codes: s suppressed, d damped, h history, * valid, > best
              i - internal, r RIB-failure, S stale, N Nexthop-discard
Origin codes: i - IGP, e - EGP, ? - incomplete
   Network            Next Hop            Metric LocPrf Weight Path
*> Dest:2001:db8::/0-32/56
                      ::                                     0 i

Processed 1 prefixes, 1 paths
RP/0/RSP0/CPU0:Controller#show flowspec ipv6 detail
Mon Apr  8 17:55:36.786 UTC

AFI: IPv6
  Flow           :Dest:2001:db8::/0-32
    Actions      :Traffic-rate: 0 bps  (policy.1.FS_P.FLOWSPEC)
    Statistics                        (packets/bytes)
      Matched             :                  14/1652
      Dropped             :                  14/1652
RP/0/RSP0/CPU0:BGL14.1.J.05-ASR-9000-1#

PE/RR1:
CRR01#show bgp ipv6 flowspec
BGP table version is 2, local router ID is 203.202.143.33
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
              x best-external, a additional-path, c RIB-compressed,
              t secondary path,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found

     Network          Next Hop            Metric LocPrf Weight Path
 *>   Dest:2001:DB8::/0-32
                      ::                                     0 64696 i
CRR01#
CRR01#show flowspec ipv6 detail
AFI: IPv6
  Flow           :Dest:2001:DB8::/0-32
    Actions      :Traffic-rate: 0 bps  (bgp.1)
    Statistics                        (packets/bytes)
      Matched             :                   4/456
      Dropped             :                   4/456

CRR01#

故障排除

目前没有针对此配置的故障排除信息。

提示：如果您使用3.16.5S打开案例并点击CSCva55510 Bug ID。虽然未在Bug中记录它，但它适用于IPv6。这从ASR1K BGP BU中确认，并经过验证。另一个Bug CSCvp18767 也为show命令归档，该命令在16.12.1中已修复，因此最好使用此版本。但是，IPv6 flowspec可在任何16.x版本中运行。