MPLS VPN综合实验
- MPLS VPN综合实验
- 实验要求
- 实验拓扑分析
- IP地址规划
- 实验过程
- 总结
MPLS VPN综合实验
实验要求
运用MPLS VPN技术使其全网可达！
实验拓扑分析
IP地址规划
实验过程
1.分别在R1、R5、R6、R7上配置AB两公司的私网环境！
2.搭建R2、R3、R4之间的公网环境并打通MPLS VPN！
（1）基础IP地址配置；
（2）启用动态路由协议；
[R2]ospf 1 router-id 2.2.2.2
[R2-ospf-1]area 0
[R2-ospf-1-area-0.0.0.0]network 2.2.2.2 0.0.0.0
[R2-ospf-1-area-0.0.0.0]network 23.1.1.0 0.0.0.255
[R3]ospf 1 router-id 3.3.3.3
[R3-ospf-1]area 0
[R3-ospf-1-area-0.0.0.0]network 23.1.1.0 0.0.0.255
[R3-ospf-1-area-0.0.0.0]network 3.3.3.3 0.0.0.0
[R3-ospf-1-area-0.0.0.0]network 34.1.1.0 0.0.0.255
[R4]ospf 1 router-id 4.4.4.4
[R4-ospf-1]area 0
[R4-ospf-1-area-0.0.0.0]network 34.1.1.0 0.0.0.255
[R4-ospf-1-area-0.0.0.0]network 4.4.4.4 0.0.0.0
（3）启用MPLS协议；
[R2]mpls lsr-id 2.2.2.2
[R2]mpls
Info: Mpls starting, please wait... OK!
[R2-mpls]mpls ldp
[R2-mpls-ldp]q
[R2]interface GigabitEthernet 0/0/1
[R2-GigabitEthernet0/0/1]mpls
[R2-GigabitEthernet0/0/1]mpls ldp
[R3]mpls lsr-id 3.3.3.3
[R3]mpls
Info: Mpls starting, please wait... OK!
[R3-mpls]mpls ldp
[R3-mpls-ldp]q
[R3]interface GigabitEthernet 0/0/0
[R3-GigabitEthernet0/0/0]mpls
[R3-GigabitEthernet0/0/0]mpls ldp
[R3-GigabitEthernet0/0/0]q
[R3]interface GigabitEthernet 0/0/1
[R3-GigabitEthernet0/0/1]mpls
[R3-GigabitEthernet0/0/1]mpls ldp
[R4]mpls lsr-id 4.4.4.4
[R4]mpls
Info: Mpls starting, please wait... OK!
[R4-mpls]mpls ldp
[R4-mpls-ldp]q
[R4]interface GigabitEthernet 0/0/0
[R4-GigabitEthernet0/0/0]mpls
[R4-GigabitEthernet0/0/0]mpls ldp
查看MPLS邻居关系：
测试：
（4）在R2和R4上启用虚拟空间VRF；
[R2]ip vpn-instance a
[R2-vpn-instance-a]route-distinguisher 1:1
[R2-vpn-instance-a-af-ipv4]q
[R2-vpn-instance-a]vpn-target 1:1
IVT Assignment result:
Info: VPN-Target assignment is successful.
EVT Assignment result:
Info: VPN-Target assignment is successful.
[R2-vpn-instance-a]q
[R2]interface GigabitEthernet 0/0/0
[R2-GigabitEthernet0/0/0]ip binding vpn-instance a
Info: All IPv4 related configurations on this interface are removed!
Info: All IPv6 related configurations on this interface are removed!
[R2-GigabitEthernet0/0/0]ip address 192.168.2.2 24
[R2-GigabitEthernet0/0/0]q
[R2]ip vpn-instance b
[R2-vpn-instance-b]route-distinguisher 2:2
[R2-vpn-instance-b-af-ipv4]q
[R2-vpn-instance-b]vpn-target 2:2
IVT Assignment result:
Info: VPN-Target assignment is successful.
EVT Assignment result:
Info: VPN-Target assignment is successful.
[R2-vpn-instance-b]q
[R2]interface GigabitEthernet 0/0/2
[R2-GigabitEthernet0/0/2]ip binding vpn-instance b
Info: All IPv4 related configurations on this interface are removed!
Info: All IPv6 related configurations on this interface are removed!
[R2-GigabitEthernet0/0/2]ip address 192.168.2.2 24
[R4]ip vpn-instance a
[R4-vpn-instance-a]route-distinguisher 1:1
[R4-vpn-instance-a-af-ipv4]q
[R4-vpn-instance-a]vpn-target 1:1
IVT Assignment result:
Info: VPN-Target assignment is successful.
EVT Assignment result:
Info: VPN-Target assignment is successful.
[R4-vpn-instance-a]q
[R4]interface GigabitEthernet 0/0/1
[R4-GigabitEthernet0/0/1]ip binding vpn-instance a
Info: All IPv4 related configurations on this interface are removed!
Info: All IPv6 related configurations on this interface are removed!
[R4-GigabitEthernet0/0/1]ip address 192.168.3.1 24
[R4]ip vpn-instance b
[R4-vpn-instance-b]route-distinguisher 2:2
[R4-vpn-instance-b-af-ipv4]q
[R4-vpn-instance-b]vpn-target 2:2
IVT Assignment result:
Info: VPN-Target assignment is successful.
EVT Assignment result:
Info: VPN-Target assignment is successful.
[R4-vpn-instance-b]q
[R4]interface Ethernet 4/0/0
[R4-Ethernet4/0/0]ip binding vpn-instance b
Info: All IPv4 related configurations on this interface are removed!
Info: All IPv6 related configurations on this interface are removed!
[R4-Ethernet4/0/0]ip address 192.168.3.1 24
测试：
这里ping不通的原因是在R4上没有去往R5和R7的路由！
解决方案：
方案一：静态路由；
方案二：动态路由；
（5）在R2 和R4上启用BGP协议；
[R2]bgp 1
[R2-bgp]router-id 2.2.2.2
[R2-bgp]peer 4.4.4.4 as-number 1
[R2-bgp]peer 4.4.4.4 connect-interface LoopBack 0
[R2-bgp]ipv4-family vpnv4
[R2-bgp-af-vpnv4]peer 4.4.4.4 enable
[R4]bgp 1
[R4-bgp]router-id 4.4.4.4
[R4-bgp]peer 2.2.2.2 as-number 1
[R4-bgp]peer 2.2.2.2 connect-interface LoopBack 0
[R4-bgp]ipv4-family vpnv4
[R4-bgp-af-vpnv4]peer 2.2.2.2 enable
（6）在R1、R2、R6之间和R4、R5、R7之间启用动态路由协议，使其可以互相通信；
[R1]rip 1
[R1-rip-1]version 2
[R1-rip-1]network 192.168.1.0
[R1-rip-1]network 192.168.2.0
[R2]rip 1 vpn-instance a
[R2-rip-1]version 2
[R2-rip-1]network 192.168.2.0
在R2上查看路由表发现已经学到R1的路由：
测试：
[R6]rip 2
[R6-rip-2]version 2
[R6-rip-2]network 192.168.1.0
[R6-rip-2]network 192.168.2.0
[R2]rip 2 vpn-instance b
[R2-rip-2]version 2
[R2-rip-2]network 192.168.2.0
R4、R5、R7之间也是同样的做法：
我们在R4、R5、R7之间启用OSPF协议：
[R5]ospf 2
[R5-ospf-2]area 0
[R5-ospf-2-area-0.0.0.0]network 192.168.3.0 0.0.0.255
[R5-ospf-2-area-0.0.0.0]network 192.168.4.0 0.0.0.255
[R4]ospf 2 vpn-instance a
[R4-ospf-2]area 0
[R4-ospf-2-area-0.0.0.0]network 192.168.3.0 0.0.0.255
[R7]ospf 3
[R7-ospf-3]area 0
[R7-ospf-3-area-0.0.0.0]network 192.168.3.0 0.0.0.255
[R7-ospf-3-area-0.0.0.0]network 192.168.4.0 0.0.0.255
[R4]ospf 3 vpn-instance b
[R4-ospf-3]area 0
[R4-ospf-3-area-0.0.0.0]network 192.168.3.0 0.0.0.255
（7）做单点双向重发布，将ospf的路由发布到BGP当中去，同时将BGP的路由也发布到ospf当中去；
[R4]bgp 1
[R4-bgp]ipv4-family vpn-instance a
[R4-bgp-a]import-route ospf 2
[R4-bgp-a]q
[R4-bgp]ipv4-family vpn-instance b
[R4-bgp-b]import-route ospf 3
[R4-bgp-b]q
[R4-bgp]q
[R4]ospf 2
[R4-ospf-2]import-route bgp
[R4-ospf-2]q
[R4]ospf 3
[R4-ospf-3]import-route bgp
然后在R2上亦是同理：
[R2]bgp 1
[R2-bgp]ipv4-family vpn-instance a
[R2-bgp-a]import-route rip 1
[R2-bgp-a]q
[R2-bgp]ipv4-family vpn-instance b
[R2-bgp-b]import-route rip 2
[R2-bgp-b]q
[R2-bgp]q
[R2]rip 1
[R2-rip-1]import-route bgp
[R2-rip-1]q
[R2]rip 2
[R2-rip-2]import-route bgp
在R1和R6上查看路由表，检验其是否都学到了其他路由？
测试：
MPLS VPN到此就已经全部配置完成！
3.解决私网和公网环境通信问题！
（1）给用户私网和公网通信的链路接口配置IP地址；
[R4]interface GigabitEthernet 0/0/2
[R4-GigabitEthernet0/0/2]ip address 100.1.1.1 24
[R7]interface GigabitEthernet 0/0/0
[R7-GigabitEthernet0/0/0]ip address 100.1.1.2 24
（2）在边界路由器上下放缺省；
必须先在边界路由器R7上指一条缺省指向公网：
[R7]ip route-static 0.0.0.0 0 100.1.1.1
然后再下放缺省：
[R7-ospf-3]default-route-advertise
在R4的虚拟空间里查看路由表，看是否有缺省路由？
在R2和R6上同理：
由于BGP里面不传递缺省路由，所以要在R2上向R6下放缺省；
[R2]rip 2 vpn-instance b
[R2-rip-2]default-route originate
现在R6上就有了缺省路由：
（3）特殊指令：将R4的缺省路由引入到R2虚拟空间VRF当中去；
[R4]bgp 1
[R4-bgp]ipv4-family vpn-instance b
[R4-bgp-b]default-route imported
现在我们看到已经将缺省从R4引入到R这边来了！
（4）在R7上配置NAT；
[R7]acl 2000
[R7-acl-basic-2000]rule 1 permit source 192.168.1.0 0.0.0.255
[R7-acl-basic-2000]q
[R7]interface GigabitEthernet 0/0/0
[R7-GigabitEthernet0/0/0]nat outbound 2000
测试：
（5）在R4上宣告公网网段，使其通过BGP传递给R2；
R2没有公网网段的路由，所以要在R4上宣告公网网段，使其通过BGP传递给R2：
[R4-bgp]network 100.1.1.0 24
（6）给R3向最近的BGP指缺省；
[R3]ip route-static 0.0.0.0 0 34.1.1.4
实验完成！
（7）测试；
总结
此实验最后需要在R4上将缺省越过BGP直接引入到R2！