MPLS VPN的配置示例.docx

1、MPLS VPN的配置示例MPLS VPN的配置示例 (2009-07-23 23:11:10) 标签： it 分类： IT 介绍MPLS 准许多个Site 通过Service Provider 的网络透明互联。一个ISP 的网络可以支持多个不同的IP VPN，每个VPN对客户来说，是个单独的私有网络，和其它的客户都是独立的。在一个VPN里面，每个site 可以发送IP 包给同一个VPN 里的其它Site。换句话来说，MPLS/VPN对于客户来说，相当于一个透明的三层传输网络，以前可以通过租用Leased Line 互联，现在可以租用MPLS/VPN 链路互联。每个VPN和一个或多个VRF(V

2、PN Routing or forwarding instance)关联。一个VRF 包括一个路由表、一个CEF 表和一组使用这个转发表的接口。路由器为每个VRF维护着独立的路由表和CEF 表。这可以防止信息被发送到VPN 之外，并且每个VPN 可以使用重叠的IP 地址。路由器通过MP-BGP的扩展community 标签来分发VPN 路由信息实验环境本例在下面的软件和硬件环境下实现：P 和PE路由器 Cisco IOS. Release 12.2(6h)，支持MPLS VPN feature. P 路由器：Cisco 7200 系列路由器. PE 路由器：Cisco 2691, 或者3640

3、 系列路由器.C 和CE 路由器 任何可以和PE 交换路由信息的路由器都可以作为C 和CE 路由器.缩写约定 P - Providers core router. PE - Providers edge router. CE - Customers edge router. C - Customers router.我们将用下面的拓扑图进行举例说明： 配置网络拓扑图本文档使用下面的拓扑图，网络中有3 台P 路由器、2 台PE 路由器（Pescara 和Pesaro），2 个VPN 客户分别是Customer_A 和Customer_B：配置网络拓扑图本文档使用下面的拓扑图，网络中有3 台P 路

4、由器、2 台PE 路由器（Pescara 和Pesaro），2 个VPN 客户分别是Customer_A 和Customer_B： 配置过程启用ip cef使用下面的过程启用ip cef.，为了提高性能，可以在支持的路由器上使用ip cef distributed命令。当在接口上配置了MPLS 后(在接口上配置 tag-switching ip).，还要在PE 上完成下面的步骤： 1. 在路由器上为每个相连的VPN创建一个VRF，使用命令 ip vrf配置ip vrf 的时候:o 为每个VPN指定正确的RD.这是为了扩展IP 地址之用，以便你可以识别IP 地址属于哪个VPN. rdo 配置MP

5、-BGP的扩展communities 的import 和export 值. 这是用于过滤import 和export 过程的. route-target export|import|both 2. 在VPN 各自的接口下使用ip vrf forwarding 命令，别忘了还需要配置IP 地址3. 配置PE-CE 间使用的路由协议，可是使用静态路由或者动态路由(RIP、OSPF、BGP).配置MP-BGP在PE 路由器之间配置MP-BGP.有几种办法来配置BGP,例如路由反射器或者联盟.我们这儿使用直连的邻居进行举例.1. 声明彼此的邻居2. 为这台PE 上的每个VPN配置address-fam

6、ily ipv4 vrf VPN routing/forwarding instance name 命令.如果需要的话，完成下面的步骤 o 重分布静态、RIP、或者OSPF 路由 o 重分布直连的路由 o Activate 和CE 路由器间的BGP 邻居3. 进入address-family vpnv4 模式，完成下面的配置： o Activate the neighbors. Activate 邻居 o 指定必须使用扩展community，这是必须的. 配置本例中的5 台路由器配置如下： PescaraCurrent configuration:!version 12.2!hostname

7、Pescara!ip cef!- Customer_A 的配置.ip vrf Customer_A!-启用Customer_A 的VPN 路由和转发表 (VRF).rd 100:110 !- Route distinguisher creates routing and forwarding!- tables for a VRF.route-target export 100:1000!- Creates lists of import and export route-target extended!- communities for the specified VRF.route-targ

8、et import 100:1000!- Customer_B 配置.ip vrf Customer_Brd 100:120route-target export 100:2000route-target import 100:2000!interface Loopback0ip address 10.10.10.4 255.255.255.255ip router isis!- Customer_A 的配置.interface Loopback101ip vrf forwarding Customer_A!-将一个接口或者自接口和一个VRF 实例关联起来.ip address 200.0.4

9、.1 255.255.255.0!- Loopback101 和 102 使用相同的IP 地址 200.0.4.1.这是准许的，因为它们属于2 个不用客户的VRFno ip directed-broadcast!- Customer_B 的配置.interface Loopback102ip vrf forwarding Customer_Bip address 200.0.4.1 255.255.255.0!- Loopback101 和 102 使用相同的IP 地址 200.0.4.1.这是准许的，因为它们属于2 个不用客户的VRFno ip directed-broadcast!inte

10、rface Serial2/0no ip addressno ip directed-broadcastencapsulation frame-relayno fair-queue!interface Serial2/0.1 point-to-pointdescription link to Pauillacbandwidth 512ip address 10.1.1.14 255.255.255.252no ip directed-broadcastip router isistag-switching ipframe-relay interface-dlci 401!router isis

11、net 49.0001.0000.0000.0004.00is-type level-1!router bgp 100bgp log-neighbor-changes!- 启用BGP 邻居关系中断的记录.neighbor 10.10.10.6 remote-as 100neighbor 10.10.10.6 update-source Loopback0!- 配置BGP 邻居.!- Customer A and B commands.address-family vpnv4!- 进入address-family vpnv4 配置模式，配置和PE/P 路由器间的MP-BGP 路由会话。neigh

12、bor 10.10.10.6 activateneighbor 10.10.10.6 send-community both!- Sends the community attribute to a BGP neighbor.exit-address-family!- Customer B commands.address-family ipv4 vrf Customer_B!- 进入address-family ipv4 的配置模式下，配置和CE 间的路由会话，redistribute connectedno auto-summaryno synchronizationexit-addres

13、s-family!- Customer A commands.address-family ipv4 vrf Customer_Aredistribute connectedno auto-summaryno synchronizationexit-address-family!ip classless!end Pesaro Current configuration:!version 12.1!hostname Pesaro!- Customer A commands.ip vrf Customer_Ard 100:110route-target export 100:1000route-t

14、arget import 100:1000!- Customer B commands.ip vrf Customer_Brd 100:120route-target export 100:2000route-target import 100:2000!ip cef!interface Loopback0ip address 10.10.10.6 255.255.255.255ip router isis!- Customer A commands.interface Loopback101ip vrf forwarding Customer_Aip address 200.0.6.1 25

15、5.255.255.0!- Customer B commands.interface Loopback102ip vrf forwarding Customer_Bip address 200.0.6.1 255.255.255.0!- Customer A commands.interface Loopback111ip vrf forwarding Customer_Aip address 200.1.6.1 255.255.255.0!interface Serial0/0no ip addressencapsulation frame-relayno ip mroute-cacher

16、andom-detect!interface Serial0/0.1 point-to-pointdescription link to Pomerolbandwidth 512ip address 10.1.1.22 255.255.255.252ip router isistag-switching ipframe-relay interface-dlci 603!router isisnet 49.0001.0000.0000.0006.00is-type level-1!router bgp 100neighbor 10.10.10.4 remote-as 100neighbor 10

17、.10.10.4 update-source Loopback0!- Customer B commands.address-family ipv4 vrf Customer_Bredistribute connectedno auto-summaryno synchronizationexit-address-family!- Customer A commands.address-family ipv4 vrf Customer_Aredistribute connectedno auto-summaryno synchronizationexit-address-family!- Cus

18、tomer A and B commands.address-family vpnv4neighbor 10.10.10.4 activateneighbor 10.10.10.4 send-community bothexit-address-family!ip classless!end Pomerol Current configuration:!version 12.0!hostname Pomerol!ip cef!interface Loopback0ip address 10.10.10.3 255.255.255.255ip router isis!interface Seri

19、al0/1no ip addressno ip directed-broadcastencapsulation frame-relayrandom-detect!interface Serial0/1.1 point-to-pointdescription link to Pauillacip address 10.1.1.6 255.255.255.252no ip directed-broadcastip router isistag-switching mtu 1520tag-switching ipframe-relay interface-dlci 301!interface Ser

20、ial0/1.2 point-to-pointdescription link to Pullignyip address 10.1.1.9 255.255.255.252no ip directed-broadcastip router isistag-switching ipframe-relay interface-dlci 303!interface Serial0/1.3 point-to-pointdescription link to Pesaroip address 10.1.1.21 255.255.255.252no ip directed-broadcastip rout

21、er isistag-switching ipframe-relay interface-dlci 306!router isisnet 49.0001.0000.0000.0003.00is-type level-1!ip classless!end Pulligny Current configuration:!version 12.1!hostname Pulligny!ip cef!interface Loopback0ip address 10.10.10.2 255.255.255.255!interface Serial0/1no ip addressencapsulation

22、frame-relayrandom-detect!interface Serial0/1.1 point-to-pointdescription link to Pauillacip address 10.1.1.2 255.255.255.252ip router isistag-switching ipframe-relay interface-dlci 201!interface Serial0/1.2 point-to-pointdescription link to Pomerolip address 10.1.1.10 255.255.255.252ip router isista

23、g-switching ipframe-relay interface-dlci 203!router isispassive-interface Loopback0net 49.0001.0000.0000.0002.00is-type level-1!ip classless!end PauillacCurrent configuration:!version 12.1!hostname pauillac!ip cef!interface Loopback0ip address 10.10.10.1 255.255.255.255ip router isis!interface Seria

24、l0/0no ip addressencapsulation frame-relayno ip mroute-cachetag-switching ipno fair-queue!interface Serial0/0.1 point-to-pointdescription link to Pomerolbandwith 512ip address 10.1.1.1 255.255.255.252ip router isistag-switching ipframe-relay interface-dlci 102!interface Serial0/0.2 point-to-pointdes

25、cription link to Pulligny ip address 10.1.1.5 255.255.255.252ip router isistag-switching ipframe-relay interface-dlci 103!interface Serial0/0.3 point-to-pointdescription link to Pescarabandwidth 512ip address 10.1.1.13 255.255.255.252ip router isistag-switching ipframe-relay interface-dlci 104!route

26、r isisnet 49.0001.0000.0000.0001.00is-type level-1!ip classless!end 检验本节讲述了如何检查你的配置是否工作正常. show ip vrf - Verifies that the correct VRF exists. show ip vrf interfaces - Verifies the activated interfaces. show ip route vrf Customer_A - Verifies the routing information on the PE routers. traceroute vrf

27、 Customer_A 200.0.6.1 - Verifies the routing information on the PE routers. show ip bgp vpnv4 tag - Verifies the BGP. show ip cef vrf Customer_A 200.0.6.1 detail - Verifies the routing information on the PE routers.更多的排错命令详见： MPLS VPN Solution Troubleshooting Guide.下面的输出是命令 show ip vrf 的结果 Pescara#s

28、how ip vrf Name Default RD Interfaces Customer_A 100:110 Loopback101 Customer_B 100:120 Loopback102下面的输出是命令show ip vrf interfaces 的结果.Pesaro#show ip vrf interfaces Interface IP-Address VRF Protocol Loopback101 200.0.6.1 Customer_A up Loopback111 200.1.6.1 Customer_A up Loopback102 200.0.6.1 Customer

29、_B up下面的 show ip route vrf 命令的结果显示在2 个VPNl 里面都有相同的网段 200.0.6.0/24. 这是因为两个VPN客户 Customer_A 和Customer_B 使用了重叠的IP 地址.Pescara#show ip route vrf Customer_ACodes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGPD - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter areaN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGPi - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area* - candidate default, U - per-user static route, o - ODRGateway of last resort is not setC 200.