实现通过IS-IS完成PE之间的路由可达实现手动配置SR-MPLS TE隧道实现CE之间互访使用的L3VPN 隧道迭代到SR-MPLS TE隧道观察SR-MPLS TE隧道转发报文时的标签变化一、拓扑及规划1、拓扑2、规划设备互联接口的IP地址使用10.0.0.X/30Loopback 0 IP地址规划PE110.0.1.1/32PE210.0.2.2/32PE310.0.3.3/32PE410.0.4.4/32P110.0.5.5/32P210.0.6.6/32Loopback 1 IP地址PE110.1.1.1/32PE410.1.4.4/32设备互通使用IS-IS协议BGP AS号65100邻接标签设备编号本端IP对端IP标签值P110.0.0.610.0.0.5322336P110.0.0.1310.0.0.14322337P110.0.0.1710.0.0.18322338P210.0.0.1010.0.0.9322336P210.0.0.1410.0.0.13322337P210.0.0.2110.0.0.223223383、目标 PE1和PE4上的Loopback 1接口流量通过 SR-MPLS TE 实现互访二、配置思路1、设备基础IP配置2、IS-IS配置实现互通3、使能MPLS、MPLS TE4、使能SR在IS-IS中开启对SR的扩展能力、开启流量工程配置Node SID5、PE1、PE4上配置显式路径以及TE隧道接口6、配置VPN实例将PE1、PE4的Loopback 1接口划分到实例中并在PE1、PE4与P1、P2之间建立VPNv4对等体关系7、配置隧道选择策略将VPN流量引入TE隧道三、配置过程实验使用的是EVE-NG中的NetEngine 40E设备在开始配置前需要关闭 dcn功能。如果不关闭可能会很卡顿。1、基础IP略、IS-IS配置PE1# PE1 IS-IS配置 isis 1 is-level level-2 cost-style wide network-entity 49.0001.0001.0001.0001.00 is-name PE1 interface Ethernet1/0/0 ip address 10.0.0.1 255.255.255.252 isis enable 1 isis circuit-type p2p interface Ethernet1/0/1 ip address 10.0.0.5 255.255.255.252 isis enable 1 isis circuit-type p2p interface LoopBack0 ip address 10.0.1.1 255.255.255.255 isis enable 1PE2# PE2 IS-IS配置 isis 1 is-level level-2 cost-style wide network-entity 49.0001.0002.0002.0002.00 is-name PE2 interface Ethernet1/0/0 ip address 10.0.0.2 255.255.255.252 isis enable 1 isis circuit-type p2p interface Ethernet1/0/1 ip address 10.0.0.9 255.255.255.252 isis enable 1 isis circuit-type p2p interface LoopBack0 ip address 10.0.2.2 255.255.255.255 isis enable 1P1# P1 IS-IS配置 isis 1 is-level level-2 cost-style wide network-entity 49.0001.0005.0005.0005.00 is-name P1 interface Ethernet1/0/0 ip address 10.0.0.13 255.255.255.252 isis enable 1 isis circuit-type p2p interface Ethernet1/0/1 ip address 10.0.0.6 255.255.255.252 isis enable 1 isis circuit-type p2p interface Ethernet1/0/2 ip address 10.0.0.17 255.255.255.252 isis enable 1 isis circuit-type p2p interface LoopBack0 ip address 10.0.5.5 255.255.255.255 isis enable 1P2# P2 IS-IS配置 isis 1 is-level level-2 cost-style wide network-entity 49.0001.0006.0006.0006.00 is-name P2 interface Ethernet1/0/0 ip address 10.0.0.14 255.255.255.252 isis enable 1 isis circuit-type p2p interface Ethernet1/0/1 ip address 10.0.0.10 255.255.255.252 isis enable 1 isis circuit-type p2p interface Ethernet1/0/2 ip address 10.0.0.21 255.255.255.252 isis enable 1 isis circuit-type p2p interface LoopBack0 ip address 10.0.6.6 255.255.255.255 isis enable 1PE3# PE3 IS-IS配置 isis 1 is-level level-2 cost-style wide network-entity 49.0001.0003.0003.0003.00 is-name PE3 interface Ethernet1/0/0 ip address 10.0.0.25 255.255.255.252 isis enable 1 isis circuit-type p2p interface Ethernet1/0/1 ip address 10.0.0.18 255.255.255.252 isis enable 1 isis circuit-type p2p interface LoopBack0 ip address 10.0.3.3 255.255.255.255 isis enable 1PE4# PE4 IS-IS配置 isis 1 is-level level-2 cost-style wide network-entity 49.0001.0004.0004.0004.00 is-name PE4 interface Ethernet1/0/0 ip address 10.0.0.26 255.255.255.252 isis enable 1 isis circuit-type p2p interface Ethernet1/0/1 ip address 10.0.0.22 255.255.255.252 isis enable 1 isis circuit-type p2p interface LoopBack0 ip address 10.0.4.4 255.255.255.255 isis enable 1结果验证2、MPLS配置全局使能MPLS因为只实现PE1和PE4的Loopback 1接口互通所以只需要在PE1和PE4的MPLS中使用MPLS TE# PE1 MPLS配置 mpls lsr-id 10.0.1.1 mpls mpls te # PE2 MPLS配置 mpls lsr-id 10.0.2.2 mpls # P1 MPLS配置 mpls lsr-id 10.0.5.5 mpls # P2 MPLS配置 mpls lsr-id 10.0.6.6 mpls # PE3 MPLS配置 mpls lsr-id 10.0.3.3 mpls # PE4 MPLS配置 mpls lsr-id 10.0.4.4 mpls mpls te3、SR配置全局使能SR在IS-IS中开启对SR的扩展能力、开启流量工程能力配置Loopback 0 的SID配置全局标签范围同时在P1、P2上配置静态邻接标签# PE1的SR配置 segment-routing isis 1 segment-routing mpls segment-routing global-block 16000 17000 interface LoopBack0 isis prefix-sid index 1# PE2的SR配置 segment-routing isis 1 segment-routing mpls segment-routing global-block 16000 17000 interface LoopBack0 isis prefix-sid index 2# P1的SR配置 segment-routing ipv4 adjacency local-ip-addr 10.0.0.6 remote-ip-addr 10.0.0.5 sid 322336 ipv4 adjacency local-ip-addr 10.0.0.13 remote-ip-addr 10.0.0.14 sid 322337 ipv4 adjacency local-ip-addr 10.0.0.17 remote-ip-addr 10.0.0.18 sid 322338 isis 1 segment-routing mpls segment-routing global-block 16000 17000 interface LoopBack0 isis prefix-sid index 5# P2的SR配置 segment-routing ipv4 adjacency local-ip-addr 10.0.0.10 remote-ip-addr 10.0.0.9 sid 322336 ipv4 adjacency local-ip-addr 10.0.0.14 remote-ip-addr 10.0.0.13 sid 322337 ipv4 adjacency local-ip-addr 10.0.0.21 remote-ip-addr 10.0.0.22 sid 322338 isis 1 segment-routing mpls segment-routing global-block 16000 17000 interface LoopBack0 isis prefix-sid index 6# PE3的SR配置 segment-routing isis 1 segment-routing mpls segment-routing global-block 16000 17000 interface LoopBack0 isis prefix-sid index 3# PE4的SR配置 segment-routing isis 1 segment-routing mpls segment-routing global-block 16000 17000 interface LoopBack0 isis prefix-sid index 44、PE1、PE4上配置显式路径及TE隧道接口配置显示路径之前需要使能 MPLS TE如果未配置则会Error报错# PE1 显式路径及TE隧道接口配置 explicit-path PE1_PE4 next sid label 16005 type prefix next sid label 322337 type adjacency next sid label 322338 type adjacency interface Tunnel10 ip address unnumbered interface LoopBack0 tunnel-protocol mpls te destination 10.0.4.4 mpls te signal-protocol segment-routing mpls te tunnel-id 10 mpls te path explicit-path PE1_PE4# PE4 显式路径及TE隧道接口 配置 explicit-path PE4_PE1 next sid label 16003 type prefix next sid label 16005 type prefix next sid label 322337 type adjacency next sid label 322336 type adjacency next sid label 16001 type prefix interface Tunnel10 ip address unnumbered interface LoopBack0 tunnel-protocol mpls te destination 10.0.1.1 mpls te signal-protocol segment-routing mpls te tunnel-id 10 mpls te path explicit-path PE4_PE15、结果验证6、配置VPN实例在PE1、PE4之间建立VPNv4对等体关系PE1、PE2、PE3、PE4 作为客户端均与P1、P2建立MP-BGP VPNv4对等体关系P1、P2为RR。PE1、PE4创建VPN实例 vpna绑定 Loopback 1接口PE1 Loopback 1 10.1.1.1/32PE4 Loopback 1 10.1.4.4/32# PE1 vpn-instance vpna配置 ip vpn-instance vpna ipv4-family route-distinguisher 100:10 vpn-target 100:1020 export-extcommunity vpn-target 100:1020 import-extcommunity # BGP 配置 bgp 65100 router-id 10.0.1.1 peer 10.0.5.5 as-number 65100 peer 10.0.5.5 connect-interface LoopBack0 peer 10.0.6.6 as-number 65100 peer 10.0.6.6 connect-interface LoopBack0 ipv4-family vpnv4 peer 10.0.5.5 enable peer 10.0.6.6 enable ipv4-family vpn-instance vpna import-route direct# PE3 BGP配置 bgp 65100 router-id 10.0.2.2 peer 10.0.5.5 as-number 65100 peer 10.0.5.5 connect-interface LoopBack0 peer 10.0.6.6 as-number 65100 peer 10.0.6.6 connect-interface LoopBack0 ipv4-family vpnv4 peer 10.0.5.5 enable peer 10.0.6.6 enable# P1 BGP配置 bgp 65100 router-id 10.0.5.5 peer 10.0.1.1 as-number 65100 peer 10.0.1.1 connect-interface LoopBack0 peer 10.0.2.2 as-number 65100 peer 10.0.2.2 connect-interface LoopBack0 peer 10.0.3.3 as-number 65100 peer 10.0.3.3 connect-interface LoopBack0 peer 10.0.4.4 as-number 65100 peer 10.0.4.4 connect-interface LoopBack0 ipv4-family vpnv4 undo policy vpn-target peer 10.0.1.1 enable peer 10.0.1.1 reflect-client peer 10.0.2.2 enable peer 10.0.2.2 reflect-client peer 10.0.3.3 enable peer 10.0.3.3 reflect-client peer 10.0.4.4 enable peer 10.0.4.4 reflect-client# P2 BGP配置 bgp 65100 router-id 10.0.6.6 peer 10.0.1.1 as-number 65100 peer 10.0.1.1 connect-interface LoopBack0 peer 10.0.2.2 as-number 65100 peer 10.0.2.2 connect-interface LoopBack0 peer 10.0.3.3 as-number 65100 peer 10.0.3.3 connect-interface LoopBack0 peer 10.0.4.4 as-number 65100 peer 10.0.4.4 connect-interface LoopBack0 ipv4-family vpnv4 undo policy vpn-target peer 10.0.1.1 enable peer 10.0.1.1 reflect-client peer 10.0.2.2 enable peer 10.0.2.2 reflect-client peer 10.0.3.3 enable peer 10.0.3.3 reflect-client peer 10.0.4.4 enable peer 10.0.4.4 reflect-client PE3 BGP配置 bgp 65100 router-id 10.0.3.3 peer 10.0.5.5 as-number 65100 peer 10.0.5.5 connect-interface LoopBack0 peer 10.0.6.6 as-number 65100 peer 10.0.6.6 connect-interface LoopBack0 ipv4-family vpnv4 peer 10.0.5.5 enable peer 10.0.6.6 enable# PE4 vpn-instance vpna配置 ip vpn-instance vpna ipv4-family route-distinguisher 100:40 vpn-target 100:1020 export-extcommunity vpn-target 100:1020 import-extcommunity interface LoopBack1 ip binding vpn-instance vpna ip address 10.1.4.4 255.255.255.255 # PE4 BGP配置 bgp 65100 router-id 10.0.4.4 peer 10.0.5.5 as-number 65100 peer 10.0.5.5 connect-interface LoopBack0 peer 10.0.6.6 as-number 65100 peer 10.0.6.6 connect-interface LoopBack0 ipv4-family vpnv4 peer 10.0.5.5 enable peer 10.0.6.6 enable ipv4-family vpn-instance vpna import-route direct7、结果验证MP-BGP VPNv4邻居关系VPNv4路由vpn实例路由此时可以看到PE1上关于10.1.4.4的路由为两条分别由两个物理接口发出7、配置隧道策略将VPN流量引入TE隧道# PE1配置 tunnel-policy p1 tunnel select-seq sr-te load-balance-number 1 ip vpn-instance vpna ipv4-family tnl-policy p1# PE4 配置 tunnel-policy p1 tunnel select-seq sr-te load-balance-number 1 ip vpn-instance vpna ipv4-family tnl-policy p1结果验证配置隧道策略引流后经由Tunnel 10 接口发出四、结果验证1、测试 PE1 Loopback1 与PE4 Loopback 1连通性2、分别抓取PE1的Eth1/0/1和PE4的Eth1/0/0接口数据包PE1至PE4PE4至PE1实验复刻《HCIE-Datacom V1.0 实验手册》