本產品的文件集力求使用無偏見用語。針對本文件集的目的,無偏見係定義為未根據年齡、身心障礙、性別、種族身分、民族身分、性別傾向、社會經濟地位及交織性表示歧視的用語。由於本產品軟體使用者介面中硬式編碼的語言、根據 RFP 文件使用的語言,或引用第三方產品的語言,因此本文件中可能會出現例外狀況。深入瞭解思科如何使用包容性用語。
思科已使用電腦和人工技術翻譯本文件,讓全世界的使用者能夠以自己的語言理解支援內容。請注意,即使是最佳機器翻譯,也不如專業譯者翻譯的內容準確。Cisco Systems, Inc. 對這些翻譯的準確度概不負責,並建議一律查看原始英文文件(提供連結)。
本檔案介紹如何設定和驗證AS間第3層多重協定標籤交換(MPLS)VPN選項C功能。Cisco IOS®和Cisco IOS-XR平台用於說明和驗證。文中提供一個範例網路情境及其組態和輸出,以便更好瞭解。
本文件沒有特定需求。不過,瞭解MPLS的基本知識和Cisco IOS-XR平台的工作知識將很有幫助。
本文件所述內容不限於特定軟體和硬體版本。
本文中的資訊是根據特定實驗室環境內的裝置所建立。文中使用到的所有裝置皆從已清除(預設)的組態來啟動。如果您的網路正在作用,請確保您已瞭解任何指令可能造成的影響。
MPLS在全球網際網路服務提供商(ISP)中廣泛部署。ISP為客戶提供大量服務,其中一項服務是MPLS第3層VPN。MPLS第3層VPN主要將客戶的路由邊界從一個地理位置延伸到另一個地理位置。ISP主要用於中轉。完成在一個地理位置和在另一個地理位置與ISP的對等操作,然後在客戶邊緣(CE)裝置上從PE(提供商邊緣/ISP)裝置接收客戶特定路由。
如果客戶需要針對兩個不同ISP所在的兩個不同地理位置擴展路由邊界,則兩個ISP需要協調,以便向最終客戶提供MPLS第3層VPN。此類解決方案稱為Inter-AS Layer 3 MPLS VPN。
Inter-AS第3層MPLS VPN可以四種不同方式部署,分別稱為選項A、選項B、選項C和選項D。本文檔將介紹使用選項C的實施。
AS間選項C交換的拓撲,如下圖所示。
編址方案非常簡單。每台路由器都有描述為192.168.255.X的loopback1介面,其中X=1(當路由器1遇到問題時)。介面地址屬於192.168.XY.X型別。假設考慮使用R1和R2,路由器R1下的介面配置為192.168.12.1(此處X =1,Y = 2)。
CE — 客戶邊緣
PE — 提供商邊緣
RR — 路由反射器
ASBR — 自治系統邊界路由器
在本文檔中,術語CE表示客戶邊緣裝置。如果必須針對特定裝置做出特定引用,則將其引用為CE1。這也適用於PE、RR和ASBR。
所有裝置都運行Cisco IOS,而ASBR2/R11和PE2/R12運行Cisco IOS-XR。
兩個ISP分別使用自治系統(AS)65000和AS 65001進行引用。使用AS 65000的ISP位於拓撲的左側,使用AS 65001的ISP位於拓撲的右側,使用ISP B。
描述了裝置的配置。
CE1
interface Loopback1 #Customer Edge configuration.
ip address 192.168.255.1 255.255.255.255 !
interface FastEthernet0/0
ip address 192.168.12.1 255.255.255.0
!
router eigrp 1
network 0.0.0.0
!
PE1
vrf definition A #Provider Edge Configuration.
rd 192.168.255.2:65000
!
address-family ipv4
route-target export 99:99
route-target import 99:99
exit-address-family
!
interface Loopback1
ip address 192.168.255.2 255.255.255.255
ip ospf 1 area 0
!
interface FastEthernet0/0
vrf forwarding A
ip address 192.168.12.2 255.255.255.0
!
interface FastEthernet1/0
ip address 192.168.24.2 255.255.255.0
ip ospf 1 area 0
mpls ip
!
router eigrp 65000 #EIGRP is PE-CE routing
! #protocol.
address-family ipv4 vrf A autonomous-system 1
redistribute bgp 65000 metric 10000 10 255 1 1500
network 192.168.12.2 0.0.0.0
exit-address-family
!
router ospf 1
!
router bgp 65000
bgp log-neighbor-changes
no bgp default ipv4-unicast
neighbor 192.168.255.3 remote-as 65000
neighbor 192.168.255.3 update-source Loopback1
!
address-family ipv4
exit-address-family
!
address-family vpnv4 #Advertising vpnv4 routes
neighbor 192.168.255.3 activate #from PE1 to RR1.
neighbor 192.168.255.3 send-community both
exit-address-family
!
address-family ipv4 vrf A
redistribute eigrp 1
exit-address-family
!
P1
interface Loopback1 #P router configuration.
ip address 192.168.255.4 255.255.255.255
ip ospf 1 area 0
!
interface FastEthernet0/0
ip address 192.168.24.4 255.255.255.0
ip ospf 1 area 0
duplex half
mpls ip
!
interface FastEthernet1/0
ip address 192.168.34.4 255.255.255.0
ip ospf 1 area 0
mpls ip
!
interface FastEthernet1/1
ip address 192.168.45.4 255.255.255.0
ip ospf 1 area 0
mpls ip
!
router ospf 1
!
RR1
interface Loopback1 #Route-Reflector configuration.
ip address 192.168.255.3 255.255.255.255
ip ospf 1 area 0
!
interface FastEthernet0/0
ip address 192.168.34.3 255.255.255.0
ip ospf 1 area 0
mpls ip
!
router ospf 1
!
router bgp 65000
bgp log-neighbor-changes
neighbor 192.168.255.2 remote-as 65000
neighbor 192.168.255.2 update-source Loopback1
neighbor 192.168.255.7 remote-as 65001
neighbor 192.168.255.7 ebgp-multihop 255 #EBGP-Multihop vpnv4
neighbor 192.168.255.7 update-source Loopback1 #peering with RR2.
!
address-family vpnv4
neighbor 192.168.255.2 activate
neighbor 192.168.255.2 send-community both
neighbor 192.168.255.2 route-reflector-client
neighbor 192.168.255.7 activate
neighbor 192.168.255.7 send-community both
neighbor 192.168.255.7 next-hop-unchanged
exit-address-family
!
ASBR1
interface Loopback1 #Autonomous-System boundary-
ip address 192.168.255.5 255.255.255.255 #router configuration.
ip ospf 1 area 0
!
interface FastEthernet0/0
ip address 192.168.45.5 255.255.255.0
ip ospf 1 area 0
mpls ip
!
interface FastEthernet1/0
ip address 192.168.115.5 255.255.255.0
mpls bgp forwarding
!
router ospf 1
redistribute bgp 65000 subnets route-map REDISTRIBUTE_IN_IGP
! #Redistributing the loopbacks of
router bgp 65000 #RR2 and PE2 in AS 65000.
bgp log-neighbor-changes
network 192.168.255.2 mask 255.255.255.255
network 192.168.255.3 mask 255.255.255.255
neighbor 192.168.115.11 remote-as 65001
neighbor 192.168.115.11 send-label
!
ip prefix-list FOREIGN_PREFIXES seq 5 permit 192.168.255.12/32
ip prefix-list FOREIGN_PREFIXES seq 10 permit 192.168.255.7/32
!
route-map REDISTRIBUTE_IN_IGP permit 10
match ip address prefix-list FOREIGN_PREFIXES
!
ASBR2
interface Loopback1 #Autonomous System boundary
ipv4 address 192.168.255.11 255.255.255.255 #configuration.
!
interface GigabitEthernet0/0/0/0
ipv4 address 192.168.115.11 255.255.255.0
!
interface GigabitEthernet0/0/0/1
ipv4 address 192.168.116.11 255.255.255.0
!
prefix-set FOREIGN_PREFIXES
192.168.255.2/32,
192.168.255.3/32
end-set
!
route-policy DEFAULT
pass
end-policy
!
route-policy REDISTRIBUTE_IN_IGP
if destination in FOREIGN_PREFIXES then
pass
endif
end-policy
!
router static
address-family ipv4 unicast
192.168.115.5/32 GigabitEthernet0/0/0/0
!
router ospf 1
redistribute bgp 65001 route-policy REDISTRIBUTE_IN_IGP
area 0 #Redistributing the loopback
interface Loopback1 #of RR1 and PE1 in AS 65001.
!
interface GigabitEthernet0/0/0/1
!
router bgp 65001
address-family ipv4 unicast
network 192.168.255.7/32
network 192.168.255.12/32
allocate-label all
!
neighbor 192.168.115.5
remote-as 65000
address-family ipv4 labeled-unicast
route-policy DEFAULT in
route-policy DEFAULT out
!
mpls ldp
address-family ipv4
!
interface GigabitEthernet0/0/0/1
!
RR2
interface Loopback1 #Route-Refector Configuration.
ip address 192.168.255.7 255.255.255.255
ip ospf 1 area 0
!
interface FastEthernet0/0
ip address 192.168.67.7 255.255.255.0
ip ospf 1 area 0
mpls ip
!
router ospf 1
!
router bgp 65001
bgp log-neighbor-changes
neighbor 192.168.255.3 remote-as 65000 #EBGP-Multihop vpnv4 peering
neighbor 192.168.255.3 ebgp-multihop 255 #with RR1 in AS 65000.
neighbor 192.168.255.3 update-source Loopback1
neighbor 192.168.255.12 remote-as 65001
neighbor 192.168.255.12 update-source Loopback1
!
address-family vpnv4
neighbor 192.168.255.3 activate
neighbor 192.168.255.3 send-community both
neighbor 192.168.255.3 next-hop-unchanged
neighbor 192.168.255.12 activate
neighbor 192.168.255.12 send-community both
neighbor 192.168.255.12 route-reflector-client
exit-address-family
!
P2
interface Loopback1 #P router configuration.
ip address 192.168.255.6 255.255.255.255
ip ospf 1 area 0
!
interface FastEthernet0/0
ip address 192.168.116.6 255.255.255.0
ip ospf 1 area 0
mpls ip
!
interface FastEthernet1/0
ip address 192.168.67.6 255.255.255.0
ip ospf 1 area 0
mpls ip
!
interface FastEthernet1/1
ip address 192.168.126.6 255.255.255.0
ip ospf 1 area 0
mpls ip
!
router ospf 1
!
PE2
vrf A #Provider Edge Configuration.
address-family ipv4 unicast
import route-target
99:99
!
export route-target
99:99
!
!
interface Loopback1
ipv4 address 192.168.255.12 255.255.255.255
!
interface GigabitEthernet0/0/0/0
ipv4 address 192.168.126.12 255.255.255.0
!
interface GigabitEthernet0/0/0/1
vrf A
ipv4 address 192.168.128.2 255.255.255.0
!
router ospf 1
address-family ipv4
area 0
interface Loopback1
!
interface GigabitEthernet0/0/0/0
!
router bgp 65001
address-family vpnv4 unicast
!
neighbor 192.168.255.7 #Advertising vpnv4 routes from
remote-as 65001 #PE2 to RR2.
update-source Loopback1
address-family vpnv4 unicast
!
!
vrf A
rd 192.168.255.12:65001
address-family ipv4 unicast
redistribute eigrp 1
!
mpls ldp
address-family ipv4
!
interface GigabitEthernet0/0/0/0
!
router eigrp 65001 #EIGRP as PE-CE protocol
vrf A
address-family ipv4
autonomous-system 1
redistribute bgp 65001
interface GigabitEthernet0/0/0/1
!
CE2
interface Loopback1 #Customer-Edge Configuration.
ip address 192.168.255.8 255.255.255.255
!
interface FastEthernet1/0
ip address 192.168.128.8 255.255.255.0
!
router eigrp 1
network 0.0.0.0
!
從CE1 ping CE2(以loopback1介面作為源)的輸出為:
R1#ping 192.168.255.8 source lo1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.255.8, timeout is 2 seconds:
Packet sent with a source address of 192.168.255.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 104/300/420 ms
從CE2 ping CE1(以loopback1介面作為源)的輸出為:
R8#ping 192.168.255.1 source lo1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.255.1, timeout is 2 seconds:
Packet sent with a source address of 192.168.255.8
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 168/303/664 ms
R1#show ip route 192.168.255.8
Routing entry for 192.168.255.8/32
Known via "eigrp 1", distance 90, metric 156416, type internal
R2#show bgp vpnv4 unicast all labels
Network Next Hop In label/Out label
Route Distinguisher: 192.168.255.2:65000 (A)
192.168.12.0 0.0.0.0 24/nolabel(A)
192.168.128.0 192.168.255.12 nolabel/24000
192.168.255.1/32 192.168.12.1 25/nolabel
192.168.255.8/32 192.168.255.12 nolabel/24007
R2#show mpls forwarding-table
Local Outgoing Prefix Bytes Label Outgoing Next Hop
Label Label or Tunnel Id Switched interface
22 20 192.168.255.12/32 0 Fa1/0 192.168.24.4
25 No Label 192.168.255.1/32[V]5976 Fa0/0 192.168.12.1
R3#show bgp vpnv4 unicast all labels
Network Next Hop In label/Out label
Route Distinguisher: 192.168.255.2:65000
192.168.255.1/32 192.168.255.2 nolabel/25
Route Distinguisher: 192.168.255.12:65001
192.168.255.8/32 192.168.255.12 nolabel/24007
R4#show mpls forwarding-table
Local Outgoing Pefix Bytes Label Outgoing Next Hop
Label Label or Tunnel Id Switched interface
20 22 192.168.255.12/32 5172 Fa1/1 192.168.45.5
R5#show mpls forwarding-table
Local Outgoing Prefix Bytes Label Outgoing Next Hop
Label Label or Tunnel Id Switched interface
22 24002 192.168.255.12/32 5928 Fa1/0 192.168.115.11
RP/0/0/CPU0:ios#show mpls forwarding
Local Outgoing Prefix Outgoing Next Hop Bytes
Label Label or ID Interface Switched
24002 19 192.168.255.12/32 Gi0/0/0/1 192.168.116.6 7092
R6#show mpls forwarding-table
Local Outgoing Prefix Bytes Label Outgoing Next Hop
Label Label or Tunnel Id Switched interface
19 Pop Label 192.168.255.12/32 9928 Fa1/1 192.168.126.12
RP/0/0/CPU0:ios#show mpls forwarding
Local Outgoing Prefix Outgoing Next Hop Bytes
Label Label or ID Interface Switched
24007 Unlabelled 192.168.255.8/32[V] Gi0/0/0/1 192.168.128.6 7992
24008 18 192.168.255.2/32 Gi0/0/0/0 192.168.126.6 673200
RP/0/0/CPU0:ios#show bgp vpnv4 unicast labels
Network Next Hop Rcvd Label Local Label
Route Distinguisher: 192.168.255.12:65001 (default for vrf A)
*>i192.168.255.1/32 192.168.255.2 25 nolabel
*> 192.168.255.8/32 192.168.128.8 nolabel 24007
R1#traceroute 192.168.255.8 source lo1
Type escape sequence to abort.
Tracing the route to 192.168.255.8
VRF info: (vrf in name/id, vrf out name/id)
1 192.168.12.2 8 msec 36 msec 16 msec
2 192.168.24.4 [MPLS: Labels 20/24007 Exp 0] 828 msec 628 msec 2688 msec
3 192.168.45.5 [MPLS: Labels 22/24007 Exp 0] 1456 msec * 1528 msec
4 192.168.115.11 [MPLS: Labels 24002/24007 Exp 0] 1544 msec 2452 msec 2164 msec
5 192.168.116.6 [MPLS: Labels 19/24007 Exp 0] 1036 msec 908 msec 1648 msec
6 192.168.126.12 [MPLS: Label 24007 Exp 0] 2864 msec 1676 msec 1648 msec
7 192.168.128.8 2008 msec 400 msec 572 msec
LSP中的VPN標24007名稱始終保持一致。
R8#traceroute 192.168.255.1 source lo1
Type escape sequence to abort.
Tracing the route to 192.168.255.1
VRF info: (vrf in name/id, vrf out name/id)
1 192.168.128.2 1228 msec 68 msec 152 msec
2 192.168.126.6 [MPLS: Labels 18/25 Exp 0] 1188 msec 816 msec 1316 msec
3 192.168.116.11 [MPLS: Labels 24007/25 Exp 0] 1384 msec 1816 msec 504 msec
4 192.168.115.5 [MPLS: Labels 23/25 Exp 0] 284 msec 900 msec 972 msec
5 192.168.45.4 [MPLS: Labels 17/25 Exp 0] 436 msec 608 msec 292 msec
6 192.168.12.2 [MPLS: Label 25 Exp 0] 292 msec 108 msec 536 msec
7 192.168.12.1 224 msec 212 msec 620 msec
VPN標籤25在整個LSP中始終保持一致。
目前尚無適用於此組態的具體疑難排解資訊。