实验需求

本实验使用Option B完成跨域的MPLS-VPN，R9/10是CE，R1/7是PE，R3/5是ASBR，R2/6是P设备，R4/8是反射器RR。
所有涉及到Router-id的协议，全部手动指定Loopback0地址为RID。
所有BGP协议全部关闭自动建立ipv4单播邻居，若有需要手动建立邻居。
所有要求建立邻居关系的需求，请配置完成后自行检查，正文不再赘述。

一、ISP公网

1.1 部署IGP

1.1.1 AS100和AS200内运行OSPF，进程1.
1.1.2 除与其他AS互联的接口外，全部使用精确通告，划入区域0.
1.1.3 确认各AS内互通。

1.2 部署IBGP

1.2.1 R1/3/4启用BGP，AS100。R2不启用BGP。
1.2.2 R4作为反射器RR，R1/3作为客户端。
1.2.3 R4使用按组打包方式配置邻居关系，组名称ibgp
1.2.4 使用Loopback0建立vpnv4邻居关系。
1.2.5 AS200需求与AS100相同，请对照配置。

1.3 部署EBGP

1.3.1 R3和R5使用物理接口建立vpnv4邻居关系。

1.4 部署MPLS

1.4.1 在AS100和AS200内所有设备上启用MPLS
1.4.2 LSR-ID使用Loopback0地址。
1.4.3 启用LDP协议
1.4.4 在R3/5之间仅启用MPLS，不使用LDP。

二、部署VPN

2.1 创建VRF

2.1.1 在R1上创建VRF，名称9，RD 9:9 ,出向RT 9:10,配置合适的入向RT。
2.1.2 在R7上创建VRF，名称10，RD10:10,出向RT10:9,配置合适的入向RT。
2.1.3 R1的G0/0/1划入VRF9，并配置IP地址192.168.1.1/24
2.1.4 R7的G0/0/1划入VRF10，并配置IP地址192.168.7.7/24

2.2 部署CE-PE协议

2.2.1 R9是AS9的CE设备，和R1建立BGP邻居关系。
2.2.2 R10是AS10的CE设备，和R7建立BGP邻居关系。

2.3 传递VPN路由

2.3.1 R9和R10分别使用BGP宣告Loopback0地址。
2.3.2 确认RR和ASBR可以正常传递vpnv4路由。
2.3.3 确认R9和R10可以互通。

三. 代码

<R1>dis cu
[V200R003C00]
#
 sysname R1
#
 snmp-agent local-engineid 800007DB03000000000000
 snmp-agent 
#
 clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
 drop illegal-mac alarm
#
 wlan ac-global carrier id other ac id 0
#
 set cpu-usage threshold 80 restore 75
#
ip vpn-instance 9
 ipv4-family
  route-distinguisher 9:9
  vpn-target 9:10 export-extcommunity
  vpn-target 10:9 import-extcommunity
#
mpls lsr-id 1.1.1.1
mpls
#
mpls ldp
#
#
aaa 
 authentication-scheme default
 authorization-scheme default
 accounting-scheme default
 domain default 
 domain default_admin 
 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
 local-user admin service-type http
#
firewall zone Local
 priority 15
#
interface GigabitEthernet0/0/0
 ip address 12.1.1.1 255.255.255.0 
 mpls
 mpls ldp
#
interface GigabitEthernet0/0/1
 ip binding vpn-instance 9
 ip address 192.168.1.1 255.255.255.0 
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
 ip address 1.1.1.1 255.255.255.255 
#
bgp 100
 router-id 1.1.1.1
 undo default ipv4-unicast
 peer 4.4.4.4 as-number 100 
 peer 4.4.4.4 connect-interface LoopBack0
 #
 ipv4-family unicast
  undo synchronization
  undo peer 4.4.4.4 enable
 # 
 ipv4-family vpnv4
  policy vpn-target
  peer 4.4.4.4 enable
 #
 ipv4-family vpn-instance 9 
  peer 192.168.1.9 as-number 9 
#
ospf 1 router-id 1.1.1.1 
 area 0.0.0.0 
  network 1.1.1.1 0.0.0.0 
  network 12.1.1.1 0.0.0.0 
#
user-interface con 0
 authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return

<R2>dis cu
[V200R003C00]
#
 sysname R2
#
 snmp-agent local-engineid 800007DB03000000000000
 snmp-agent 
#
 clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
 drop illegal-mac alarm
#
 wlan ac-global carrier id other ac id 0
#
 set cpu-usage threshold 80 restore 75
#
mpls lsr-id 2.2.2.2
mpls
#
mpls ldp
#
#
aaa 
 authentication-scheme default
 authorization-scheme default
 accounting-scheme default
 domain default 
 domain default_admin 
 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
 local-user admin service-type http
#
firewall zone Local
 priority 15
#
interface GigabitEthernet0/0/0
 ip address 12.1.1.2 255.255.255.0 
 mpls
 mpls ldp
#
interface GigabitEthernet0/0/1
 ip address 23.1.1.2 255.255.255.0 
 mpls
 mpls ldp
#
interface GigabitEthernet0/0/2
 ip address 24.1.1.2 255.255.255.0 
#
interface NULL0
#
interface LoopBack0
 ip address 2.2.2.2 255.255.255.255 
#
ospf 1 router-id 2.2.2.2 
 area 0.0.0.0 
  network 2.2.2.2 0.0.0.0 
  network 12.1.1.2 0.0.0.0 
  network 23.1.1.2 0.0.0.0 
  network 24.1.1.2 0.0.0.0 
#
user-interface con 0
 authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return

<R3>dis cu
[V200R003C00]
#
 sysname R3
#
 snmp-agent local-engineid 800007DB03000000000000
 snmp-agent 
#
 clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
 drop illegal-mac alarm
#
 wlan ac-global carrier id other ac id 0
#
 set cpu-usage threshold 80 restore 75
#
mpls lsr-id 3.3.3.3
mpls
#
mpls ldp
#
#
aaa 
 authentication-scheme default
 authorization-scheme default
 accounting-scheme default
 domain default 
 domain default_admin 
 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
 local-user admin service-type http
#
firewall zone Local
 priority 15
#
interface GigabitEthernet0/0/0
 ip address 23.1.1.3 255.255.255.0 
 mpls
 mpls ldp
#
interface GigabitEthernet0/0/1
 ip address 35.1.1.3 255.255.255.0 
 mpls
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
 ip address 3.3.3.3 255.255.255.255 
#
bgp 100
 router-id 3.3.3.3
 undo default ipv4-unicast
 peer 4.4.4.4 as-number 100 
 peer 4.4.4.4 connect-interface LoopBack0
 peer 35.1.1.5 as-number 200 
 #
 ipv4-family unicast
  undo synchronization
  undo peer 4.4.4.4 enable
  undo peer 35.1.1.5 enable
 # 
 ipv4-family vpnv4
  undo policy vpn-target
  peer 4.4.4.4 enable
  peer 35.1.1.5 enable
#
ospf 1 router-id 3.3.3.3 
 area 0.0.0.0 
  network 3.3.3.3 0.0.0.0 
  network 23.1.1.3 0.0.0.0 
#
user-interface con 0
 authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return

<R4>dis cu
[V200R003C00]
#
 sysname R4
#
 snmp-agent local-engineid 800007DB03000000000000
 snmp-agent 
#
 clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
 drop illegal-mac alarm
#
 wlan ac-global carrier id other ac id 0
#
 set cpu-usage threshold 80 restore 75
#
mpls lsr-id 4.4.4.4
mpls
#
mpls ldp
#
#
aaa 
 authentication-scheme default
 authorization-scheme default
 accounting-scheme default
 domain default 
 domain default_admin 
 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
 local-user admin service-type http
#
firewall zone Local
 priority 15
#
interface GigabitEthernet0/0/0
 ip address 24.1.1.4 255.255.255.0 
#
interface GigabitEthernet0/0/1
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
 ip address 4.4.4.4 255.255.255.255 
#
bgp 100
 router-id 4.4.4.4
 undo default ipv4-unicast
 group ibgp internal
 peer ibgp connect-interface LoopBack0
 peer 1.1.1.1 as-number 100 
 peer 1.1.1.1 group ibgp 
 peer 3.3.3.3 as-number 100 
 peer 3.3.3.3 group ibgp 
 #
 ipv4-family unicast
  undo synchronization
  undo peer ibgp enable
  undo peer 1.1.1.1 enable
  undo peer 3.3.3.3 enable
 # 
 ipv4-family vpnv4
  undo policy vpn-target
  peer ibgp enable
  peer ibgp reflect-client
  peer 1.1.1.1 enable
  peer 1.1.1.1 group ibgp 
  peer 3.3.3.3 enable
  peer 3.3.3.3 group ibgp 
#
ospf 1 router-id 4.4.4.4 
 area 0.0.0.0 
  network 4.4.4.4 0.0.0.0 
  network 24.1.1.4 0.0.0.0 
#
user-interface con 0
 authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return

<R5>dis cu
[V200R003C00]
#
 sysname R5
#
 snmp-agent local-engineid 800007DB03000000000000
 snmp-agent 
#
 clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
 drop illegal-mac alarm
#
 wlan ac-global carrier id other ac id 0
#
 set cpu-usage threshold 80 restore 75
#
mpls lsr-id 5.5.5.5
mpls
#
mpls ldp
#
#
aaa 
 authentication-scheme default
 authorization-scheme default
 accounting-scheme default
 domain default 
 domain default_admin 
 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
 local-user admin service-type http
#
firewall zone Local
 priority 15
#
interface GigabitEthernet0/0/0
 ip address 56.1.1.5 255.255.255.0 
 mpls
 mpls ldp
#
interface GigabitEthernet0/0/1
 ip address 35.1.1.5 255.255.255.0 
 mpls
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
 ip address 5.5.5.5 255.255.255.255 
#
bgp 200
 router-id 5.5.5.5
 undo default ipv4-unicast
 peer 8.8.8.8 as-number 200 
 peer 8.8.8.8 connect-interface LoopBack0
 peer 35.1.1.3 as-number 100 
 #
 ipv4-family unicast
  undo synchronization
  undo peer 8.8.8.8 enable
  undo peer 35.1.1.3 enable
 # 
 ipv4-family vpnv4
  undo policy vpn-target
  peer 8.8.8.8 enable
  peer 35.1.1.3 enable
#
ospf 1 router-id 5.5.5.5 
 area 0.0.0.0 
  network 5.5.5.5 0.0.0.0 
  network 56.1.1.5 0.0.0.0 
#
user-interface con 0
 authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return

<R6>dis cu
[V200R003C00]
#
 sysname R6
#
 snmp-agent local-engineid 800007DB03000000000000
 snmp-agent 
#
 clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
 drop illegal-mac alarm
#
 wlan ac-global carrier id other ac id 0
#
 set cpu-usage threshold 80 restore 75
#
mpls lsr-id 6.6.6.6
mpls
#
mpls ldp
#
#
aaa 
 authentication-scheme default
 authorization-scheme default
 accounting-scheme default
 domain default 
 domain default_admin 
 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
 local-user admin service-type http
#
firewall zone Local
 priority 15
#
interface GigabitEthernet0/0/0
 ip address 56.1.1.6 255.255.255.0 
 mpls
 mpls ldp
#
interface GigabitEthernet0/0/1
 ip address 67.1.1.6 255.255.255.0 
 mpls
 mpls ldp
#
interface GigabitEthernet0/0/2
 ip address 68.1.1.6 255.255.255.0 
#
interface NULL0
#
interface LoopBack0
 ip address 6.6.6.6 255.255.255.255 
#
ospf 1 router-id 6.6.6.6 
 area 0.0.0.0 
  network 6.6.6.6 0.0.0.0 
  network 56.1.1.6 0.0.0.0 
  network 67.1.1.6 0.0.0.0 
  network 68.1.1.6 0.0.0.0 
#
user-interface con 0
 authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return

<R7>dis cu
[V200R003C00]
#
 sysname R7
#
 snmp-agent local-engineid 800007DB03000000000000
 snmp-agent 
#
 clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
 drop illegal-mac alarm
#
 wlan ac-global carrier id other ac id 0
#
 set cpu-usage threshold 80 restore 75
#
ip vpn-instance 10
 ipv4-family
  route-distinguisher 10:10
  vpn-target 10:9 export-extcommunity
  vpn-target 9:10 import-extcommunity
#
mpls lsr-id 7.7.7.7
mpls
#
mpls ldp
#
#
aaa 
 authentication-scheme default
 authorization-scheme default
 accounting-scheme default
 domain default 
 domain default_admin 
 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
 local-user admin service-type http
#
firewall zone Local
 priority 15
#
interface GigabitEthernet0/0/0
 ip address 67.1.1.7 255.255.255.0 
 mpls
 mpls ldp
#
interface GigabitEthernet0/0/1
 ip binding vpn-instance 10
 ip address 192.168.7.7 255.255.255.0 
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
 ip address 7.7.7.7 255.255.255.255 
#
bgp 200
 router-id 7.7.7.7
 undo default ipv4-unicast
 peer 8.8.8.8 as-number 200 
 peer 8.8.8.8 connect-interface LoopBack0
 #
 ipv4-family unicast
  undo synchronization
  undo peer 8.8.8.8 enable
 # 
 ipv4-family vpnv4
  policy vpn-target
  peer 8.8.8.8 enable
 #
 ipv4-family vpn-instance 10 
  peer 192.168.7.10 as-number 10 
#
ospf 1 router-id 7.7.7.7 
 area 0.0.0.0 
  network 7.7.7.7 0.0.0.0 
  network 67.1.1.7 0.0.0.0 
#
user-interface con 0
 authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return

<R8>dis cu
[V200R003C00]
#
 sysname R8
#
 snmp-agent local-engineid 800007DB03000000000000
 snmp-agent 
#
 clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
 drop illegal-mac alarm
#
 wlan ac-global carrier id other ac id 0
#
 set cpu-usage threshold 80 restore 75
#
mpls lsr-id 8.8.8.8
mpls
#
mpls ldp
#
#
aaa 
 authentication-scheme default
 authorization-scheme default
 accounting-scheme default
 domain default 
 domain default_admin 
 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
 local-user admin service-type http
#
firewall zone Local
 priority 15
#
interface GigabitEthernet0/0/0
 ip address 68.1.1.8 255.255.255.0 
#
interface GigabitEthernet0/0/1
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
 ip address 8.8.8.8 255.255.255.255 
#
bgp 200
 router-id 8.8.8.8
 undo default ipv4-unicast
 group ibgp internal
 peer ibgp connect-interface LoopBack0
 peer 5.5.5.5 as-number 200 
 peer 5.5.5.5 group ibgp 
 peer 7.7.7.7 as-number 200 
 peer 7.7.7.7 group ibgp 
 #
 ipv4-family unicast
  undo synchronization
  undo peer ibgp enable
  undo peer 5.5.5.5 enable
  undo peer 7.7.7.7 enable
 # 
 ipv4-family vpnv4
  undo policy vpn-target
  peer ibgp enable
  peer ibgp reflect-client
  peer 5.5.5.5 enable
  peer 5.5.5.5 group ibgp 
  peer 7.7.7.7 enable
  peer 7.7.7.7 group ibgp 
#
ospf 1 router-id 8.8.8.8 
 area 0.0.0.0 
  network 8.8.8.8 0.0.0.0 
  network 68.1.1.8 0.0.0.0 
#
user-interface con 0
 authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return

<R9>dis cu
[V200R003C00]
#
 sysname R9
#
 snmp-agent local-engineid 800007DB03000000000000
 snmp-agent 
#
 clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
 drop illegal-mac alarm
#
 wlan ac-global carrier id other ac id 0
#
 set cpu-usage threshold 80 restore 75
#
aaa 
 authentication-scheme default
 authorization-scheme default
 accounting-scheme default
 domain default 
 domain default_admin 
 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
 local-user admin service-type http
#
firewall zone Local
 priority 15
#
interface GigabitEthernet0/0/0
 ip address 192.168.1.9 255.255.255.0 
#
interface GigabitEthernet0/0/1
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
 ip address 192.168.9.9 255.255.255.255 
#
bgp 9
 router-id 192.168.9.9
 peer 192.168.1.1 as-number 100 
 #
 ipv4-family unicast
  undo synchronization
  network 192.168.9.9 255.255.255.255 
  peer 192.168.1.1 enable
#
user-interface con 0
 authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return

<R10>dis cu
[V200R003C00]
#
 sysname R10
#
 snmp-agent local-engineid 800007DB03000000000000
 snmp-agent 
#
 clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
 drop illegal-mac alarm
#
 wlan ac-global carrier id other ac id 0
#
 set cpu-usage threshold 80 restore 75
#
aaa 
 authentication-scheme default
 authorization-scheme default
 accounting-scheme default
 domain default 
 domain default_admin 
 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
 local-user admin service-type http
#
firewall zone Local
 priority 15
#
interface GigabitEthernet0/0/0
 ip address 192.168.7.10 255.255.255.0 
#
interface GigabitEthernet0/0/1
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
 ip address 192.168.10.10 255.255.255.255 
#
bgp 10
 router-id 192.168.10.10
 peer 192.168.7.7 as-number 200 
 #
 ipv4-family unicast
  undo synchronization
  network 192.168.10.10 255.255.255.255 
  peer 192.168.7.7 enable
#
user-interface con 0
 authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return