华为MPLS VPN配置实例
总公司与下属分公司需要建立MPLS VPN进行互联,总公司与分公司都包含三个业务,分别为:办公网、财务网、视频网。要求在总公司内部、分公司内部、总公司与分公司之间实现办公网与视频网可互访,财务网与办公网、视频网之间不能互访,总公司财务网只能和分公司的财务网互访。
网络拓扑如图:
每个业务对应的VPN实例分别为
Lookback地址规划
PE1、P、PE2互联地址规划
PE1与总部各业务CE互联地址规划
PE2与分公司各业务CE互联地址规划
总公司业务地址规划
分公司业务地址规划
VPN实例route-distinguisher规划
VPN实例vpn-target规划
各业务测试终端地址规划
1、配置MPSL骨干网OSPF协议,使得 PE1、P、PE2之间互通
配置PE1
int loo 0
ip add 1.1.1.1 32
#
interface GigabitEthernet0/0/0
ip add 10.10.10.1 30
ospf network-type p2p
#
ospf
area 0
network 10.10.10.0 0.0.0.3
network 1.1.1.1 0.0.0.0
配置P
int loo 0
ip add 2.2.2.2 32
#
interface GigabitEthernet0/0/0
ip add 10.10.10.2 30
ospf network-type p2p
#
interface GigabitEthernet0/0/1
ip add 20.20.20.2 30
ospf network-type p2p
#
ospf
area 0
network 10.10.10.0 0.0.0.3
network 20.20.20.0 0.0.0.3
network 2.2.2.2 0.0.0.0
配置PE2
int loo 0
ip add 3.3.3.3 32
#
interface GigabitEthernet0/0/1
ip add 20.20.20.1 30
ospf network-type p2p
#
ospf
area 0
network 20.20.20.0 0.0.0.3
network 3.3.3.3 0.0.0.0
完成配置后,查看各设备OSPF邻居状态
PE1上OSPF邻居状态
P上OSPF邻居状态
PE2上OSPF邻居状态
在P上测试路由联通
2、配置MPLS骨干网上配置MPLS LDP,建立LSP标签转发通道
配置PE1
mpls lsr-id 1.1.1.1
mpls
mpls ldp
#
interface GigabitEthernet0/0/0
mpls
mpls ldp
配置P
mpls lsr-id 2.2.2.2
mpls
mpls ldp
#
interface GigabitEthernet0/0/0
mpls
mpls ldp
#
interface GigabitEthernet0/0/1
mpls
mpls ldp
配置PE2
mpls lsr-id 3.3.3.3
mpls
mpls ldp
#
interface GigabitEthernet0/0/1
mpls
mpls ldp
在P上查看MPLS LDP会话与LSP建立信息
3、配置PE1与PE2之间的MP-IBGP,建立对等体关系
配置PE1
bgp 100
peer 3.3.3.3 as-number 100
peer 3.3.3.3 connect-interface LoopBack0
ipv4-family vpnv4
peer 3.3.3.3 enable
配置PE2
bgp 100
peer 1.1.1.1 as-number 100
peer 1.1.1.1 connect-interface LoopBack0
ipv4-family vpnv4
peer 1.1.1.1 enable
查看BGP对等体建立情况
4、配置PE1、PE2上的VPN实例
配置PE1
ip vpn-instance VPN-A
ipv4-family
route-distinguisher 10:100
vpn-target 10:100 export-extcommunity
vpn-target 10:100 import-extcommunity
vpn-target 30:300 import-extcommunity
#
ip vpn-instance VPN-B
ipv4-family
route-distinguisher 20:200
vpn-target 20:200 export-extcommunity
vpn-target 20:200 import-extcommunity
#
ip vpn-instance VPN-C
ipv4-family
route-distinguisher 30:300
vpn-target 30:300 export-extcommunity
vpn-target 30:300 import-extcommunity
vpn-target 10:100 import-extcommunity
配置PE2
ip vpn-instance VPN-A
ipv4-family
route-distinguisher 10:100
vpn-target 10:100 export-extcommunity
vpn-target 10:100 import-extcommunity
vpn-target 30:300 import-extcommunity
#
ip vpn-instance VPN-B
ipv4-family
route-distinguisher 20:200
vpn-target 20:200 export-extcommunity
vpn-target 20:200 import-extcommunity
#
ip vpn-instance VPN-C
ipv4-family
route-distinguisher 30:300
vpn-target 30:300 export-extcommunity
vpn-target 30:300 import-extcommunity
vpn-target 10:100 import-extcommunity
将与业务CE互联端口绑定到对应的VPN实例上
配置PE1
int g0/0/1
ip binding vpn-instance VPN-A
ip add 70.70.70.1 30
#
int g0/0/2
ip binding vpn-instance VPN-B
ip add 60.60.60.1 30
#
int g3/0/0
ip binding vpn-instance VPN-C
ip add 50.50.50.1 30
配置PE2
int g0/0/0
ip binding vpn-instance VPN-A
ip add 80.80.80.1 30
#
int g0/0/2
ip binding vpn-instance VPN-B
ip add 30.30.30.1 30
#
int g3/0/0
ip binding vpn-instance VPN-C
ip add 40.40.40.1 30
5、配置PE与各业务CE互联
把从对端PE学到的VPNv4路由引入到OSPF中,发布给本端CE
配置PE1
ospf 100 vpn-instance VPN-A
import-route bgp
area 0
network 70.70.70.0 0.0.0.3
#
ospf 200 vpn-instance VPN-B
import-route bgp
area 0
network 60.60.60.0 0.0.0.3
#
ospf 300 vpn-instance VPN-C
import-route bgp
area 0
network 50.50.50.0 0.0.0.3
配置PE2
ospf 100 vpn-instance VPN-A
import-route bgp
area 0
network 80.80.80.0 0.0.0.3
#
ospf 200 vpn-instance VPN-B
import-route bgp
area 0
network 30.30.30.0 0.0.0.3
#
ospf 300 vpn-instance VPN-C
import-route bgp
area 0
network 40.40.40.0 0.0.0.3
把从本端CE学到的VPN路由引入BGP中,形成VPNv4路由发布给对端PE
配置PE1
bgp 100
ipv4-family vpn-instance VPN-A
import-route ospf 100
ipv4-family vpn-instance VPN-B
import-route ospf 200
ipv4-family vpn-instance VPN-C
import-route ospf 300
配置PE2
bgp 100
ipv4-family vpn-instance VPN-A
import-route ospf 100
ipv4-family vpn-instance VPN-B
import-route ospf 200
ipv4-family vpn-instance VPN-C
import-route ospf 300
配置总部办公网CE与PE1互联
int g0/0/0
ip add 70.70.70.2 30
#
int g0/0/1
ip add 171.7.7.254 24
#
ospf 100
area 0
network 70.70.70.0 0.0.0.3
network 171.7.7.0 0.0.0.255
配置总部财务网CE与PE1互联
int g0/0/0
ip add 60.60.60.2 30
#
int g0/0/1
ip add 161.6.6.254 24
#
ospf 200
area 0
network 60.60.60.0 0.0.0.3
network 161.6.6.0 0.0.0.255
配置总部视频网CE与PE1互联
int g0/0/0
ip add 50.50.50.2 30
#
int g0/0/1
ip add 151.5.5.254 24
#
ospf 300
area 0
network 50.50.50.0 0.0.0.3
network 151.5.5.0 0.0.0.255
配置分公司办公网CE与PE2互联
int g0/0/0
ip add 80.80.80.2 30
#
int g0/0/1
ip add 181.8.8.254 24
#
ospf 100
area 0
network 80.80.80.0 0.0.0.3
network 181.8.8.0 0.0.0.255
配置分公司财务网CE与PE2互联
int g0/0/0
ip add 30.30.30.2 30
#
int g0/0/1
ip add 131.3.3.254 24
#
ospf 200
area 0
network 30.30.30.0 0.0.0.3
network 131.3.3.0 0.0.0.255
配置分公司视频网CE与PE2互联
int g0/0/0
ip add 40.40.40.2 30
#
int g0/0/1
ip add 141.4.4.254 24
#
ospf 300
area 0
network 40.40.40.0 0.0.0.3
network 141.4.4.0 0.0.0.255
6、测试结果
查看PE上各VPN实例路由表
PE1办公网VPN实例路由表
PE1财务网VPN实例路由表
PE1视频网VPN实例路由表
PE2办公网VPN实例路由表
PE2财务网VPN实例路由表
PE2视频网VPN实例路由表
终端互访测试
根据预期规划,总部办公网可访问总部的视频网,分公司的办公网、视频网三个业务。总部财务网只能与分公司财务网能互访
总部办公网与总部的视频网
总部办公网与分公司办公网
总部办公网与分公司视频网
总部财务网与分公司财务网
总部财务网与其他业务网
测试结果符合预期规划
感谢楼主分享,学习了