实验 MPLS组网实验2
一实验拓扑图
二实验需求
企业从安全方面考虑，希望整网生产区（RT6,RT8）与办公区(RT7,RT9)不准相互访问。但生产与生产、办公与办公区必须能相互访问；
三实验分析
这个实验我们可以用策略使RT6 RT7只学到相应的路由来完成，这时候也许通过简单的BGP属性及相关的路由策略就行了，但那样只能做到路由层面的隔离，数据转发层面仍然没有隔离，而且私网地址也会在公网上传，所以可以考虑用下面的方法解决这些问题。 业务隔离
VRF实现，生产用vrf sc,办公用vrf bg. 业务承载：
MP-BGP （广域网链路同时承载生产和办公流量，借助RT实现VRF互访控制，私网标签实现流量数据层面隔离）；
MPLS：防止私网地址外泄，使转发通过标签交换进行不用查路由表 四具体实验
用OSPF将骨干区域拉通，这里主要关心loopback0,因为后面MPLS分配标签时要用到，而BGP又要借助这个标签。 r4(config)#do show ip route
1.0.0.0/32 is subnetted, 1 subnets
O 1.1.1.1 [110/129] via 10.0.24.1, 00:00:16, Serial0/0 2.0.0.0/32 is subnetted, 1 subnets
O 2.2.2.2 [110/65] via 10.0.24.1, 00:00:16, Serial0/0 3.0.0.0/32 is subnetted, 1 subnets
O 3.3.3.3 [110/66] via 10.0.24.1, 00:00:16, Serial0/0 4.0.0.0/32 is subnetted, 1 subnets
C 4.4.4.4 is directly connected, Loopback0
5.0.0.0/32 is subnetted, 1 subnets
O 5.5.5.5 [110/130] via 10.0.24.1, 00:00:16, Serial0/0 10.0.0.0/30 is subnetted, 5 subnets
O 10.0.12.0 [110/128] via 10.0.24.1, 00:00:16, Serial0/0 O 10.0.13.0 [110/129] via 10.0.24.1, 00:00:16, Serial0/0 C 10.0.24.0 is directly connected, Serial0/0
O 10.0.23.0 [110/65] via 10.0.24.1, 00:00:18, Serial0/0 O 10.0.35.0 [110/129] via 10.0.24.1, 00:00:18, Serial0/0
LDP邻居建立，主要在RT1 RT2 RT3 RT4 RT5建立 ip cef
mpls la protocol ldp //利用LDP协议 int s0/1
mpls ip //接口开启MPLS mpls mtu 1520
公网标签分发 主要关心PE的Loopback r4#show mpls forwarding-table
Local Outgoing Prefix Bytes tag Outgoing tag tag or VC or Tunnel Id switched interface 16 16 1.1.1.1/32 0 Se0/0 17 Pop tag 2.2.2.2/32 0 Se0/0 18 17 3.3.3.3/32 0 Se0/0 19 19 5.5.5.5/32 0 Se0/0 20 Pop tag 10.0.12.0/30 0 Se0/0 21 20 10.0.13.0/30 0 Se0/0 22 Pop tag 10.0.23.0/30 0 Se0/0 23 21 10.0.35.0/30 0 Se0/0
本地VPN建立 ip vrf sc
rd 65000:16 //区分路由 route-target export 2:30 route-target import 2:10 exit ip vrf bg rd 65000:17
route-target export 2:40 route-target import 2:20 exit
将接口划入vrf int e3/0
ip vrf forwarding sc
ip add 172.16.5.1 255.255.255.0
Next Hop point2point point2point point2point point2point point2point point2point point2point point2point no shu
查vrf路由表
r4#show ip route vrf sc
172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks C 172.16.46.0/30 is directly connected, Serial0/1 C 172.16.4.0/24 is directly connected, Ethernet3/0 r4#show ip route vrf bg
172.17.0.0/16 is variably subnetted, 2 subnets, 2 masks C 172.17.47.0/30 is directly connected, Serial0/2 C 172.17.4.0/24 is directly connected, Ethernet3/1
MP-BGP连接 router bgp 65000
nei 4.4.4.4 remot 65000
nei 4.4.4.4 update-source lo 0 nei 4.4.4.4 next-hop-s address-family vpnv4
nei 4.4.4.4 activate //开启vpnv4
nei 4.4.4.4 send-community extended //使之能发布团体属性，这样RT, RD等信息才能发布出去
查看VPNV4邻居
r5#show ip bgp vpnv4 all summary
BGP router identifier 5.5.5.5, local AS number 65000 BGP table version is 1, main routing table version 1
Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 4.4.4.4 4 65000 8 9 1 0 0 00:00:46 0
本地私网路由学习，利用RIPv2 router rip ve 2 no au
net 172.16.0.0 net 6.6.6.6 end
r6#show ip route
6.0.0.0/32 is subnetted, 1 subnets
C 6.6.6.6 is directly connected, Loopback0
172.16.0.0/16 is variably subnetted, 3 subnets, 2 masks C 172.16.46.0/30 is directly connected, Serial0/0
R 172.16.4.0/24 [120/1] via 172.16.46.1, 00:00:15, Serial0/0 C 172.16.6.0/24 is di rectly connected, Ethernet3/0
r4(config-router)#do show ip route vrf sc 6.0.0.0/32 is subnetted, 1 subnets
R 6.6.6.6 [120/1] via 172.16.46.2, 00:00:17, Serial0/1 172.16.0.0/16 is variably subnetted, 3 subnets, 2 masks C 172.16.46.0/30 is directly connected, Serial0/1 C 172.16.4.0/24 is directly connected, Ethernet3/0
R 172.16.6.0/24 [120/1] via 172.16.46.2, 00:00:17, Serial0/1
利用静态路由学习内部路由
ip route vrf bg 7.7.7.7 255.255.255.255 s0/2 ip route vrf bg 172.17.7.0 255.255.255.0 s0/2 r4(config)#do show ip route vrf bg
172.17.0.0/16 is variably subnetted, 3 subnets, 2 masks C 172.17.47.0/30 is directly connected, Serial0/2 C 172.17.4.0/24 is directly connected, Ethernet3/1 S 172.17.7.0/24 is directly connected, Serial0/2 7.0.0.0/32 is subnetted, 1 subnets
S 7.7.7.7 is directly connected, Serial0/2
右边生产由OSPF学到，办公由EBGP学到 r5# show ip route vrf sc
172.16.0.0/16 is variably subnetted, 3 subnets, 2 masks C 172.16.58.0/30 is directly connected, Serial0/1
O 172.16.8.0/24 [110/74] via 172.16.58.2, 00:03:19, Serial0/1 C 172.16.5.0/24 is directly connected, Ethernet3/0 8.0.0.0/32 is subnetted, 1 subnets
O 8.8.8.8 [110/65] via 172.16.58.2, 00:03:19, Serial0/1 r5#show ip route vrf bg
172.17.0.0/16 is variably subnetted, 3 subnets, 2 masks C 172.17.59.0/30 is directly connected, Serial0/2 B 172.17.9.0/24 [20/0] via 172.17.59.2, 00:00:04 C 172.17.5.0/24 is directly connected, Ethernet3/1 9.0.0.0/32 is subnetted, 1 subnets
B 9.9.9.9 [20/0] via 172.17.59.2, 00:00:34
将VRF中路由导出到MP-BGP router bgp 65000
address-family ipv4 vrf sc //关于生产的ipv4地址池 redistribut connected metric 1000 redistribute rip metric 1000 exit
address-family ipv4 vrf bg
redistribute connected metric 1000 redistribute static metric 1000 end
router bgp 65000
address-family ipv4 vrf sc
redistribute connected metric 1000 redistribute ospf 10 metric 1000 exit
address-family ipv4 vrf bg
redistribute connected metric 1000
exit //EBGP不用重发布，因为它和BGP属于同进程 这里要注意BGP表和路由表不同，vrf只是有独立的路由表
r4#show mpls forwarding-table
Local Outgoing Prefix Bytes tag Outgoing tag tag or VC or Tunnel Id switched interface 16 16 1.1.1.1/32 0 Se0/0 17 Pop tag 2.2.2.2/32 0 Se0/0 18 17 3.3.3.3/32 0 Se0/0 19 19 5.5.5.5/32 0 Se0/0 20 Pop tag 10.0.12.0/30 0 Se0/0 21 20 10.0.13.0/30 0 Se0/0 22 Pop tag 10.0.23.0/30 0 Se0/0 23 21 10.0.35.0/30 0 Se0/0 24 Aggregate 172.16.46.0/30[V] 0 25 Aggregate 172.16.4.0/24[V] 0 26 Untagged 6.6.6.6/32[V] 0 Se0/1 27 Untagged 172.16.6.0/24[V] 0 Se0/1 28 Aggregate 172.17.47.0/30[V] 0 29 Aggregate 172.17.4.0/24[V] 0 30 Untagged 172.17.7.0/24[V] 0 Se0/2 31 Untagged 7.7.7.7/32[V] 0 Se0/2
r5#show mpls forwarding-table
Next Hop point2point point2point point2point point2point point2point point2point point2point point2point point2point point2point point2point point2point