本文档提供了在客户端存在开放最短路径优先(OSPF)时,无区域0的ATM上多协议标签交换(MPLS)VPN的示例配置。
虚拟专用网络(VPN)功能与MPLS配合使用时,允许多个站点通过服务提供商的网络透明地互连。一个服务提供商网络可以支持多个不同的 IP VPN。其中每一个 VPN 均向其用户显示为与所有其他网络分离的专用网络。在一个 VPN 内,每个站点都可以向该 VPN 的其他任何站点发送 IP 数据包。
每个 VPN 均与一个或多个 VPN 路由或转发实例 (VRF) 相关联。VRF包括IP路由表、派生的思科快速转发(CEF)、表和使用此转发表的一组接口。
路由器针对每个 VRF 维护一个单独的路由和 CEF 表。这样,信息不能在VPN外部发送,但同一子网可以用于多个VPN,而不会出现重复的IP地址问题。
使用边界网关协议(BGP)的路由器将VPN路由信息与BGP扩展社区分发。
有关通过VPN传播更新的详细信息,请参阅以下URL:
这些字母表示使用的路由器和交换机的不同类型:
P:提供商核心路由器
PE:供应商边缘路由器
CE:客户边缘路由器
C:客户路由器
我们开发并测试了以下软件和硬件版本的配置:
PE路由器:
软件:Cisco IOS®软件版本12.1(3)T 。MPLS VPN功能在版本12.0(5)T中显示。OSPF作为PE-CE路由协议在版本12.0(7)T中显示。
Hardware:Cisco 3660或7206路由器。有关可使用的其他硬件的详细信息,请参阅为ATM设计MPLS指南。
CE路由器:使用能够与其PE路由器交换路由信息的任何路由器。
P路由器和切换:MPLS VPN集成功能仅驻留在MPLS网络边缘,因此使用任何支持MPLS的交换机。在示例配置中,MPLS云由8540 MSR和LightStream 1010组成。如果您使用LightStream 1010,我们建议您使用软件版本WA4.8d或更高版本。您还可以在ATM核心网络中使用其他ATM交换机,如Cisco BPX 8650或MGX 8850。
此图显示了使用以下约定的典型配置:
有关文档规则的详细信息,请参阅 Cisco 技术提示规则。
传统上,复杂的OSPF网络由主干区域(区域0)和通过区域边界路由器(ABR)连接到此主干的许多区域组成。
在客户站点上为VPN提供OSPF的MPLS主干,您可以在OSPF模型的层次结构中引入第三级。第三级称为MPLS VPN超级主干。
在简单情况下,MPLS VPN超主干与传统区域0主干结合。这意味着客户网络上没有区域0主干,因为MPLS VPN超级主干与区域0主干的角色相同。如下图所示:
下图说明了以下信息:
提供商边缘(PE)路由器是ABR和自治系统边界路由器(ASBR)路由器。
客户边缘(CE)路由器是简单的OSPF路由器。
VPN信息通过BGP扩展社区从PE传输到其他PE,并作为总结网络(第3类)链路状态通告(LSA)重新注入到OSPF区域。
MPLS VPN超级主干还使客户能够在其站点上使用多个区域0主干。每个站点可以有一个单独的区域0,只要它连接到MPLS VPN超级主干。结果与分区区域0主干相同。如下图所示:
在这种情况下,会发生以下情况:
PE路由器是ABR和ASBR路由器。
CE路由器是ABR路由器。
包含VPN信息的LSA通过BGP扩展社区从PE传输到其他PE。在总结网络(第3类)LSA中,信息在PE和CE之间传输。
此示例配置基于图中所示的第一个设置。您可以找到使用MPLS VPN over ATM中的第二个设置的示例配置:在客户端使用OSPF(区域0)。
OSPF信息使用BGP扩展社区属性(包括标识OSPF网络的属性)传输。 每个VPN必须有自己的OSPF进程。要指定此项,可以使用以下命令:
router ospfvrf
本部分提供有关如何配置本文档所述功能的信息。
注意:使用命令查找工具(仅限注册客户)可查找有关本文档中使用的命令的详细信息。
本文档使用以下网络设置:
Cisco IOS文档(MPLS虚拟专用网络)也描述了此配置过程。
确保已启用ip cef。如果使用Cisco 7500路由器,则必须确保已启用ip cef distributed。在PE上,一旦设置MPLS,请执行以下任务:
使用ip vrf <VPN routing/forwarding instance name>命令为连接的每个VPN创建一个VRF。执行此操作时:
指定用于该 VPN 的正确路由区分符。这用于扩展IP地址,以便您能识别IP地址所属的VPN。
rd
设置BGP扩展社区的导入和导出属性。这些用于过滤导入和导出过程。
route-target [export|import|both]
使用以下命令配置各接口的转发详细信息:
ip vrf forwarding切记在完成此操作后设置IP地址。
根据您使用的PE-CE路由协议,您现在必须执行以下一项或多项操作:
配置静态路由:
ip route vrf vrf-name prefix mask [next-hop-address] [interface {interface-number}]使用以下命令配置RIP:
address-family ipv4 vrf完成此部分后,输入正常的RIP配置命令。
注意:这仅适用于当前VRF的转发接口。
注意:您必须将正确的BGP重新分发到RIP。执行此操作时,还要记住指定使用的度量。
宣称BGP邻居信息。
使用新的IOS命令配置OSPF:
router ospfvrf 注意:这仅适用于当前VRF的转发接口。
注意:您必须将正确的BGP重新分发到OSPF。执行此操作时,还要记住指定使用的度量。
注意:一旦将OSPF进程属性为VRF,则此进程编号始终用于此特定VRF。即使您在命令行不指定它,这也将应用。
配置步骤II
配置在PE路由器之间的BGP。配置BGP有多种方法,例如使用路由反射器或联盟方法。此处使用的方法 — 直接邻居配置 — 是最简单且可扩展性最低的方法。
声明不同的邻居。
为此PE路由器上存在的每个VPN输入地址系列ipv4 vrf <VPN路由/转发实例名称>。根据需要执行以下一个或多个步骤:
重新分配静态路由信息。
重新分发RIP路由信息。
重新分配OSPF路由信息。
使用CE路由器激活BGP邻居。
进入address-family vpnv4模式,然后执行以下任务:
激活邻居。
指定必须使用扩展团体。这是强制性的。
配置
注意:此处仅包括输出的相关部分。
阿尔卡萨巴 ip cef ! ip vrf vpn1 rd 1:101 route-target export 1:101 route-target import 1:101 ! interface Loopback0 ip address 223.0.0.3 255.255.255.255 ! interface Loopback1 ip vrf forwarding vpn1 ip address 222.0.0.10 255.255.255.255 ! interface Ethernet1/1 ip vrf forwarding vpn1 ip address 150.150.0.1 255.255.255.0 no ip mroute-cache ! interface ATM4/0 no ip address no ip mroute-cache atm sonet stm-1 no atm ilmi-keepalive ! interface ATM4/0.1 tag-switching ip address 10.0.0.13 255.255.255.252 tag-switching atm vpi 2-4 tag-switching ip ! router ospf 1 log-adjacency-changes network 10.0.0.0 0.0.0.255 area 0 network 150.150.0.0 0.0.0.255 area 0 network 223.0.0.3 0.0.0.0 area 0 ! router ospf 2 vrf vpn1 log-adjacency-changes redistribute bgp 1 metric-type 1 subnets network 150.150.0.0 0.0.0.255 area 1 network 222.0.0.0 0.0.0.255 area 1 ! router bgp 1 neighbor 223.0.0.21 remote-as 1 neighbor 223.0.0.21 update-source Loopback0 ! address-family ipv4 vrf vpn1 redistribute ospf 2 no auto-summary no synchronization exit-address-family ! address-family vpnv4 neighbor 223.0.0.21 activate neighbor 223.0.0.21 send-community extended exit-address-family !
科泽尔 ! ip cef ! ip vrf vpn1 rd 1:101 route-target export 1:101 route-target import 1:101 ! interface Loopback0 ip address 223.0.0.21 255.255.255.255 ! interface Loopback1 ip vrf forwarding vpn1 ip address 222.0.0.30 255.255.255.255 ! interface Ethernet1/1 ip vrf forwarding vpn1 ip address 69.69.0.1 255.255.255.252 no ip mroute-cache tag-switching ip ! interface ATM4/0 no ip address no atm scrambling cell-payload no atm ilmi-keepalive pvc qsaal 0/5 qsaal ! pvc ilmi 0/16 ilmi ! ! interface ATM4/0.1 tag-switching ip address 11.0.0.6 255.255.255.252 tag-switching atm vpi 2-4 tag-switching ip ! router ospf 1 log-adjacency-changes network 11.0.0.0 0.0.0.255 area 0 network 223.0.0.21 0.0.0.0 area 0 mpls traffic-eng router-id Loopback0 mpls traffic-eng area 0 ! router ospf 2 vrf vpn1 log-adjacency-changes redistribute bgp 1 metric-type 1 subnets network 69.69.0.0 0.0.0.255 area 3 network 222.0.0.0 0.0.0.255 area 3 ! router bgp 1 neighbor 223.0.0.3 remote-as 1 neighbor 223.0.0.3 update-source Loopback0 neighbor 223.0.0.11 remote-as 1 neighbor 223.0.0.11 update-source Loopback0 ! address-family ipv4 vrf vpn1 redistribute ospf 2 no auto-summary no synchronization exit-address-family ! address-family vpnv4 neighbor 223.0.0.3 activate neighbor 223.0.0.3 send-community extended neighbor 223.0.0.11 activate neighbor 223.0.0.11 send-community extended exit-address-family !
迅速 ! interface Loopback0 ip address 222.0.0.1 255.255.255.255 ! interface Loopback2 ip address 7.7.7.7 255.255.255.0 ! interface FastEthernet0/1 ip address 150.150.0.2 255.255.255.0 duplex auto speed auto ! router ospf 1 network 7.7.7.7 0.0.0.0 area 1 network 150.150.0.0 0.0.0.255 area 1 network 222.0.0.1 0.0.0.0 area 1 !
皮弗内克 ! interface Loopback0 ip address 222.0.0.3 255.255.255.255 ! interface Loopback1 ip address 6.6.6.6 255.255.255.255 ! interface FastEthernet0/1 ip address 69.69.0.2 255.255.255.252 duplex auto speed auto ! router ospf 1 log-adjacency-changes network 6.6.6.6 0.0.0.0 area 3 network 69.69.0.0 0.0.0.255 area 3 network 222.0.0.3 0.0.0.0 area 3 !验证
显示命令
命令输出解释程序(仅限注册用户)(OIT) 支持某些 show 命令。使用 OIT 可查看对 show 命令输出的分析。
show ip route vrf <VPN routing or forwarding instance name>
show ip bgp vpnv4 vrf <VPN路由或转发实例名称> <A.B.C.D>
show ip ospf <process ID number>
show ip ospf <process ID number> interface
show ip ospf <process ID number> database
show tag-switching forwarding-table vrf <VPN路由或转发实例名称>
此命令显示PE路由器上特定VPN的VRF:
Alcazaba#show ip route vrf vpn1 Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area * - candidate default, U - per-user static route, o - ODR P - periodic downloaded static route Gateway of last resort is not set 69.0.0.0/30 is subnetted, 1 subnets B 69.69.0.0 [200/0] via 223.0.0.21, 00:19:39 222.0.0.0/32 is subnetted, 4 subnets B 222.0.0.30 [200/0] via 223.0.0.21, 00:19:39 C 222.0.0.10 is directly connected, Loopback1 B 222.0.0.3 [200/11] via 223.0.0.21, 00:20:39 O 222.0.0.1 [110/11] via 150.150.0.2, 00:20:59, Ethernet1/1 6.0.0.0/32 is subnetted, 1 subnets B 6.6.6.6 [200/11] via 223.0.0.21, 00:20:39 7.0.0.0/32 is subnetted, 1 subnets O 7.7.7.7 [110/11] via 150.150.0.2, 00:21:00, Ethernet1/1 150.150.0.0/24 is subnetted, 1 subnets C 150.150.0.0 is directly connected, Ethernet1/1您还可以使用show ip bgp vpnv4 vrf命令显示特定VRF的BGP信息。内部BGP(IBGP)的PE-PE结果用i表示。
Alcazaba#show ip bgp vpnv4 vrf vpn1 BGP table version is 21, local router ID is 223.0.0.3 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path Route Distinguisher: 1:101 (default for vrf vpn1) *>i6.6.6.6/32 223.0.0.21 11 100 0 ? *> 7.7.7.7/32 150.150.0.2 11 32768 ? *>i69.69.0.0/30 223.0.0.21 0 100 0 ? *> 150.150.0.0/24 0.0.0.0 0 32768 ? *> 222.0.0.1/32 150.150.0.2 11 32768 ? *>i222.0.0.3/32 223.0.0.21 11 100 0 ? *> 222.0.0.10/32 0.0.0.0 0 32768 ? *>i222.0.0.30/32 223.0.0.21 0 100 0 ?您可以检查条目的详细信息。为了显示此信息,路由区分器为“1:101”。
Alcazaba#show ip bgp vpnv4 vrf vpn1 6.6.6.6 BGP routing table entry for 1:101:6.6.6.6/32, version 28 Paths: (1 available, best #1, table vpn1) Not advertised to any peer Local 223.0.0.21 (metric 4) from 223.0.0.21 (223.0.0.21) Origin incomplete, metric 11, localpref 100, valid, internal, best Extended Community: RT:1:101 OSPF RT:3:2:0 Alcazaba#show ip bgp vpnv4 vrf vpn1 7.7.7.7 BGP routing table entry for 1:101:7.7.7.7/32, version 20 Paths: (1 available, best #1, table vpn1) Advertised to non peer-group peers: 223.0.0.21 Local 150.150.0.2 from 0.0.0.0 (223.0.0.3) Origin incomplete, metric 11, localpref 100, weight 32768, valid, sourced, best Extended Community: RT:1:101 OSPF RT:1:2:0CE路由器上show ip route命令是检验路由表的主要方法:
rapid#show ip route Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area * - candidate default, U - per-user static route, o - ODR P - periodic downloaded static route Gateway of last resort is not set 69.0.0.0/30 is subnetted, 1 subnets O IA 69.69.0.0 [110/11] via 150.150.0.1, 00:20:25, FastEthernet0/1 222.0.0.0/32 is subnetted, 4 subnets O IA 222.0.0.30 [110/11] via 150.150.0.1, 00:20:25, FastEthernet0/1 O 222.0.0.10 [110/11] via 150.150.0.1, 00:21:46, FastEthernet0/1 O IA 222.0.0.3 [110/21] via 150.150.0.1, 00:21:25, FastEthernet0/1 C 222.0.0.1 is directly connected, Loopback0 6.0.0.0/32 is subnetted, 1 subnets O IA 6.6.6.6 [110/21] via 150.150.0.1, 00:21:25, FastEthernet0/1 7.0.0.0/24 is subnetted, 1 subnets C 7.7.7.0 is directly connected, Loopback2 10.0.0.0/22 is subnetted, 1 subnets C 10.200.8.0 is directly connected, FastEthernet0/0 150.150.0.0/24 is subnetted, 1 subnets C 150.150.0.0 is directly connected, FastEthernet0/1 S 158.0.0.0/8 is directly connected, Null0OSPF 特有的命令
您可以使用所有show ip ospf命令。执行此操作时,请记住指示进程ID。我们已在斜体文本中标记下面输出的最重要部分。
第9类、第10类和第11类OSPF LSA(也称为不透明LSA)用于工程流量。
PE路由器的命令
Alcazaba#show ip ospf 2 Routing Process "ospf 2" with ID 222.0.0.10 Supports only single TOS(TOS0) routes Supports opaque LSA Connected to MPLS VPN super backbone It is an area border and autonomous system boundary router Redistributing External Routes from, bgp 1, includes subnets in redistribution SPF schedule delay 5 secs, Hold time between two SPFs 10 secs Minimum LSA interval 5 secs. Minimum LSA arrival 1 secs Number of external LSA 0. Checksum Sum 0x0 Number of opaque AS LSA 0. Checksum Sum 0x0 Number of DCbitless external and opaque AS LSA 0 Number of DoNotAge external and opaque AS LSA 0 Number of areas in this router is 1. 1 normal 0 stub 0 nssa External flood list length 0 Area 1 Number of interfaces in this area is 2 Area has no authentication SPF algorithm executed 4 times Area ranges are Number of LSA 7. Checksum Sum 0x420BE Number of opaque link LSA 0. Checksum Sum 0x0 Number of DCbitless LSA 0 Number of indication LSA 0 Number of DoNotAge LSA 0 Flood list length 0 Alcazaba#show ip ospf 2 interface Loopback1 is up, line protocol is up Internet Address 222.0.0.10/32, Area 1 Process ID 2, Router ID 222.0.0.10, Network Type LOOPBACK, Cost: 1 Loopback interface is treated as a stub Host Ethernet1/1 is up, line protocol is up Internet Address 150.150.0.1/24, Area 1 Process ID 2, Router ID 222.0.0.10, Network Type BROADCAST, Cost: 10 Transmit Delay is 1 sec, State DR, Priority 1 Designated Router (ID) 222.0.0.10, Interface address 150.150.0.1 Backup Designated router (ID) 222.0.0.1, Interface address 150.150.0.2 Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 Hello due in 00:00:07 Index 1/1, flood queue length 0 Next 0x0(0)/0x0(0) Last flood scan length is 2, maximum is 3 Last flood scan time is 0 msec, maximum is 0 msec Neighbor Count is 1, Adjacent neighbor count is 1 Adjacent with neighbor 222.0.0.1 (Backup Designated Router) Suppress hello for 0 neighbor(s) Alcazaba#show ip ospf 2 database OSPF Router with ID (222.0.0.10) (Process ID 2) Router Link States (Area 1) Link ID ADV Router Age Seq# Checksum Link count 222.0.0.1 222.0.0.1 1364 0x80000013 0x7369 3 222.0.0.10 222.0.0.10 1363 0x80000002 0xFEFE 2 Net Link States (Area 1) Link ID ADV Router Age Seq# Checksum 150.150.0.1 222.0.0.10 1363 0x80000001 0xEC6D Summary Net Link States (Area 1) Link ID ADV Router Age Seq# Checksum 6.6.6.6 222.0.0.10 1328 0x80000001 0x4967 69.69.0.0 222.0.0.10 1268 0x80000001 0x2427 222.0.0.3 222.0.0.10 1328 0x80000001 0xEEF7 222.0.0.30 222.0.0.10 1268 0x80000001 0x7B5ACE路由器的命令
rapid#show ip ospf interface FastEthernet0/1 is up, line protocol is up Internet Address 150.150.0.2/24, Area 1 Process ID 1, Router ID 222.0.0.1, Network Type BROADCAST, Cost: 10 Transmit Delay is 1 sec, State BDR, Priority 1 Designated Router (ID) 222.0.0.10, Interface address 150.150.0.1 Backup Designated router (ID) 222.0.0.1, Interface address 150.150.0.2 Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 Hello due in 00:00:04 Index 2/2, flood queue length 0 Next 0x0(0)/0x0(0) Last flood scan length is 1, maximum is 2 Last flood scan time is 0 msec, maximum is 0 msec Neighbor Count is 1, Adjacent neighbor count is 1 Adjacent with neighbor 222.0.0.10 (Designated Router) Suppress hello for 0 neighbor(s) Loopback0 is up, line protocol is up Internet Address 222.0.0.1/32, Area 1 Process ID 1, Router ID 222.0.0.1, Network Type LOOPBACK, Cost: 1 Loopback interface is treated as a stub Host Loopback2 is up, line protocol is up Internet Address 7.7.7.7/24, Area 1 Process ID 1, Router ID 222.0.0.1, Network Type LOOPBACK, Cost: 1 Loopback interface is treated as a stub Host rapid#show ip ospf database OSPF Router with ID (222.0.0.1) (Process ID 1) Router Link States (Area 1) Link ID ADV Router Age Seq# Checksum Link count 222.0.0.1 222.0.0.1 1350 0x80000013 0x7369 3 222.0.0.10 222.0.0.10 1350 0x80000002 0xFEFE 2 Net Link States (Area 1) Link ID ADV Router Age Seq# Checksum 150.150.0.1 222.0.0.10 1351 0x80000001 0xEC6D Summary Net Link States (Area 1) Link ID ADV Router Age Seq# Checksum 6.6.6.6 222.0.0.10 1316 0x80000001 0x4967 69.69.0.0 222.0.0.10 1256 0x80000001 0x2427 222.0.0.3 222.0.0.10 1316 0x80000001 0xEEF7 222.0.0.30 222.0.0.10 1256 0x80000001 0x7B5A Alcazaba#show tag-switching forwarding-table vrf vpn1 Local Outgoing Prefix Bytes tag Outgoing Next Hop tag tag or VC or Tunnel Id switched interface 24 Aggregate 222.0.0.10/32[V] 0 25 Aggregate 150.150.0.0/24[V] 0 27 Untagged 7.7.7.7/32[V] 1710 Et1/1 150.150.0.2 28 Untagged 222.0.0.1/32[V] 0 Et1/1 150.150.0.2MPLS 标签
您可以检查用于特定路由的标签堆栈:
Alcazaba#show tag-switching forwarding-table vrf vpn1 6.6.6.6 detail Local Outgoing Prefix Bytes tag Outgoing Next Hop tag tag or VC or Tunnel Id switched interface None 2/41 6.6.6.6/32 0 AT4/0.1 point2point MAC/Encaps=4/12, MTU=4466, Tag Stack{2/41(vcd=10) 16} 000A8847 0000A00000010000调试输出
这是来自路由交换调试信息的摘录。这显示如何导入特定路由。
Alcazaba#debug ip bgp vpnv4 import Tag VPN import processing debugging is on *Aug 5 05:10:09.283: vpn: Start import processing for: 1:101:222.0.0.3 *Aug 5 05:10:09.283: vpn: Import check for vpn1; flags mtch, impt *Aug 5 05:10:09.283: vpn: Import for vpn1 permitted; import flags mtch, impt *Aug 5 05:10:09.283: vpn: Same RD import for vpn1 *Aug 5 05:10:09.283: vpn: 1:101:222.0.0.3 (ver 29), imported as: *Aug 5 05:10:09.283: vpn: 1:101:222.0.0.3 (ver 29) *Aug 5 05:10:09.287: VPN: Scanning for import check is done.测试输出
现在,您可以使用ping测试一切正常:
Pivrnec#ping 7.7.7.7 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 7.7.7.7, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 mstraceroute命令显示以下输出:
Pivrnec#traceroute 7.7.7.7 Type escape sequence to abort. Tracing the route to 7.7.7.7 1 69.69.0.1 0 msec 0 msec 0 msec 2 150.150.0.1 0 msec 0 msec 20 msec 3 150.150.0.2 0 msec 0 msec *MLPS主机不在此处,因为它们看不到IP报头。MPLS主机只检查入站标签或接口,然后转发。
对IP生存时间(TTL)字段的操作仅在边缘LSR上执行。显示的跳数小于实际跳数。
相关信息
版本 | 发布日期 | 备注 |
---|---|---|
1.0 |
05-Jun-2005 |
初始版本 |