实验背景
实验目的
1.使用AS_PATH属性,确保R4通过R3到达192.168.11.0/24
2.使用LOCAL_PREF属性,确保R1通过R2到达192.168.1.0/24
3.使用MED属性,确认R4通过R3到达192.168.12.0/24
4.使用LOCAL_PREF属性,确保R1通过R3到达192.168.2.0/24
5.使用AS策略,AS 500不接受任何始发于AS 123的路由
6.使用自定义COMMUNITY属性,确保192.168.3.0/24路由不会被发布到AS500
实验思路
分析题目要求 R4和R2 R4和R3 R1和R2 R1和R3 R1和R5 两两做bgp对等体,as123内部IGP使用ospf, 使用import-route在BGP里通告
注意 : EBGP通告的最大跳数问题 ,IBGP通告的下一跳问题 EBGP通过直连接口 创建对等体的情况下不用去设置最大跳数 但是为了保险起见 我还是设置了
在这里我们先看一下BGP的优选规则 当前一条规则的值一样时比较下一条规则
具体每条规则的属性和特征请看我上一篇博文
实验开始
第一步 配置IGP 这里必须通告本地环回接口 因为bgp是建立在tcp可达的基础上
R2
<AR2>sy
Enter system view, return user view with Ctrl+Z.
[AR2]router id 2.2.2.2
[AR2]ospf 1
[AR2-ospf-1]a 0
[AR2-ospf-1-area-0.0.0.0]net 192.168.20.0 0.0.0.255
[AR2-ospf-1-area-0.0.0.0]net 2.2.2.2 0.0.0.0
[AR2-ospf-1-area-0.0.0.0]net 12.0.0.0 0.0.0.7
R3
<AR3>sy
Enter system view, return user view with Ctrl+Z.
[AR3]router id 3.3.3.3
[AR3]ospf 1
[AR3-ospf-1]a 0
[AR3-ospf-1-area-0.0.0.0]net 192.168.100.0 0.0.0.255
[AR3-ospf-1-area-0.0.0.0]net 1.1.1.1 0.0.0.0
[AR3-ospf-1-area-0.0.0.0]net 13.0.0.0 0.0.0.7
R1
<AR1>sy
Enter system view, return user view with Ctrl+Z.
[AR1]router id 1.1.1.1
[AR1]ospf 1
[AR1-ospf-1]a 0
[AR1-ospf-1-area-0.0.0.0]net 192.168.30.0 0.0.0.255
[AR1-ospf-1-area-0.0.0.0]net 3.3.3.3 0.0.0.0
[AR1-ospf-1-area-0.0.0.0]net 13.0.0.0 0.0.0.7
[AR3-ospf-1-area-0.0.0.0]net 12.0.0.0 0.0.0.7
第二步配置BGP对等体
R4
<AR4>sy
Enter system view, return user view with Ctrl+Z.
[AR4]router id 4.4.4.4
[AR4]bgp 400
[AR4-bgp]peer 24.0.0.2 as 123
[AR4-bgp]peer 24.0.0.2 ebgp-max-hop 10
[AR4-bgp]peer 34.0.0.3 as 123
[AR4-bgp]peer 34.0.0.3 ebgp-max-hop 10
R2
[AR2]bgp 123
[AR2-bgp]peer 24.0.0.4 as-number 400
[AR2-bgp]peer 24.0.0.4 connect-interface GigabitEthernet0/0/0
[AR2-bgp]peer 1.1.1.1 as-number 123
[AR2-bgp]peer 1.1.1.1 connect-interface LoopBack0
[AR2-bgp]peer 1.1.1.1 next-hop-local
R3
[AR3]bgp 123
[AR3-bgp]peer 24.0.0.4 as-number 400
[AR3-bgp]peer 34.0.0.4 connect-interface GigabitEthernet0/0/0
[AR3-bgp]peer 1.1.1.1 as-number 123
[AR3-bgp]peer 1.1.1.1 connect-interface LoopBack0
[AR3-bgp]peer 1.1.1.1 next-hop-local
R1
[AR1]bgp 123
[AR1-bgp]peer 2.2.2.2 as-number 123
[AR1-bgp]peer 2.2.2.2 connect-interface LoopBack0
[AR1-bgp]peer 3.3.3.3 as-number 123
[AR1-bgp]peer 3.3.3.3 connect-interface LoopBack0
[AR1-bgp]peer 15.0.0.5 as-number 500
[AR1-bgp]peer 15.0.0.5 connect-interface GigabitEthernet0/0/2
[AR1-bgp]peer 2.2.2.2 next-hop-local
[AR1-bgp]peer 3.3.3.3 next-hop-local
R5
[AR5]bgp 500
[AR5-bgp]peer 15.0.0.1 as-number 123
[AR5-bgp]peer 15.0.0.1 ebgp-max-hop 10
[AR5-bgp]peer 15.0.0.1 connect-interface GigabitEthernet0/0/0
第三步 路由注入
R2
[AR2]bgp 123
[AR2-bgp]import-route ospf 1
题目没有要求 我又懒的情况下 bgp的路由注入全部使用import-route方式
R4
[AR4-bgp]import-route direct
R5
[AR5-bgp]import-route direct
现在查看BGP路由表发现在都学习到了(此截图是实验完成后截的与你现在的回显有出入 懒的再做一遍 将就看吧)
这里开始 根据题目要求对BGP路由进行优选
1.使用AS_PATH属性,确保R4通过R3到达192.168.11.0/24
11.0这条路由传递的方向是从右往左到R4的<<<<
根据 AS-Path属性规则(我之前的文章里写过 这里不做赘述) 我们可以增加11.0这个网段到R2的AS-Path路径值 使得R2传递的AS-Path属性值大于R3 ,R4就会选择R3这条路了
R2
[AR2]ip ip-prefix 11 permit 192.168.11.0 24
[AR2]route-policy a11 permit node 10
[AR2-route-policy]if-match ip-prefix 11
[AR2-route-policy]apply as-path 200 additive
[AR2-route-policy]q
[AR2]route-policy a11 permit node 20
[AR2]bgp 123
[AR2]peer 24.0.0.4 route-policy a11 export
此时查看BGP路由表(等32秒 默认32秒刷新)就会看到 *>的最优路由走的是34.0.0.3这条路
2.使用LOCAL_PREF属性,确保R1通过R2到达192.168.1.0/24
此属性默认值100 越大越优 所以调整R2的lp值为200 他就会走R2 还是使用前缀列表加路由策略的方式
R2
[AR2]ip ip-prefix 1 permit 192.168.1.0 24
[AR2]route-policy a1 permit node 10
[AR2-route-policy]if-match ip-prefix 1
[AR2-route-policy]apply local-preference 200
[AR2-route-policy]q
[AR2]route-policy a1 permit node 20
[AR2]bgp 123
[AR2]peer 1.1.1.1 route-policy a1 export
3.使用MED属性,确认R4通过R3到达192.168.12.0/24
MED属性 越小越优 我们把R2的MED值设大就会 他就会选R3 还是用路由策略
R2
[AR2]ip ip-prefix 12 permit 192.168.1.0 24
[AR2]route-policy a11 permit node 20
[AR2-route-policy]if-match ip-prefix 12
[AR2-route-policy]apply cost 100
[AR2-route-policy]q
[AR2]route-policy a11 permit node 30
[AR2]bgp 123
[AR2]peer 24.0.0.4 route-policy a11 export
4.使用LOCAL_PREF属性,确保R1通过R3到达192.168.2.0/24
和上述第二题同理
R3
[AR3]ip ip-prefix 2 permit 192.168.2.0 24
[AR3]route-policy a2 permit node 10
[AR3-route-policy]if-match ip-prefix 2
[AR3-route-policy]apply local-preference 200
[AR3-route-policy]q
[AR3]route-policy a11 permit node 20
[AR3]bgp 123
[AR3]peer 1.1.1.1 route-policy a2 export
5.使用AS策略,AS 500不接受任何始发于AS 123的路由
使用AS策略 和正则表达式 来过滤
R5
[AR5]ip as-path-filter 123 deny 123$
[AR5]ip as-path-filter 123 permit .*
[AR5]bgp 500
[AR5-bgp]peer 15.0.0.1 as-path-filter 123 import
常用的正则表达式:
`.`(点):匹配任意单个字符。
`\d`:匹配数字(0-9)。
`\D`:匹配非数字。
`\w`:匹配字母、数字或下划线。
`\W`:匹配非字母、数字或下划线。
`^`:匹配字符串开始。
`$`:匹配字符串结束。
`*`:匹配前面的元素零次或多次。
`+`:匹配前面的元素一次或多次。
`?`:匹配前面的元素零次或一次。
`{n}`:精确匹配前元素n次。
`{n,}`:匹配前元素至少n次。
`{n,m}`:匹配前元素n到m次。
6.使用自定义COMMUNITY属性,确保192.168.3.0/24路由不会被发布到AS500
使用自定义团体属性 你可以理解为打标签 之后阻止这个标签的通过
方法有很多 我只讲我写的这种
我在R1 把来自R2和R3的3.0路由信息打上500:1这个COMMUNITY属性 然后创建一个路由策略筛选出来带团体属性500:1的路由加上AS-path 500的属性 在R1去往R5的出口上应用 使得R5不会学习 以达到实验目的
R1
[AR1]ip ipv6-prefix 333 permit 192.168.3.0 24
[AR1]route-policy 333 permit node 10
[AR1-route-policy]if-match ip-prefix 333
[AR1-route-policy]apply community 500:1
[AR1-route-policy]q
[AR1]route-policy 333 permit node 20
[AR1]bgp 123
[AR1-bgp]peer 2.2.2.2 route-policy 333 import
[AR1-bgp]peer 3.3.3.3 route-policy 333 import
[AR1]ip community-filter 33 permit 500:1
[AR1]route-policy 33 permit node 10
[AR1-route-policy]if-match community-filter 33
[AR1-route-policy]apply as-path 500 additive
[AR1-route-policy]q
[AR1]route-policy 333 permit node 20
[AR1]bgp 123
[AR1]peer 15.0.0.5 route-policy 33 export
查看路由表
实验结束 所有题目均以达到要求
下述的配置信息有点小问题(是我第一遍测试的配置) 仅供参考 问题在R2的路由策略应用上 按照上述配置就没问题
分享所有设备配置信息:
R1
<AR1>dis cu
[V200R003C00]
#
sysname AR1
#
snmp-agent local-engineid 800007DB03000000000000
snmp-agent
#
clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
drop illegal-mac alarm
#
undo info-center enable
#
router id 1.1.1.1
#
wlan ac-global carrier id other ac id 0
#
set cpu-usage threshold 80 restore 75
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
local-user admin service-type http
#
firewall zone Local
priority 15
#
interface GigabitEthernet0/0/0
ip address 12.0.0.1 255.255.255.248
#
interface GigabitEthernet0/0/1
ip address 13.0.0.1 255.255.255.248
#
interface GigabitEthernet0/0/2
ip address 15.0.0.1 255.255.255.248
#
interface NULL0
#
interface LoopBack0
ip address 1.1.1.1 255.255.255.255
#
interface LoopBack1
ip address 192.168.100.1 255.255.255.0
ip forward-broadcast
#
bgp 123
peer 2.2.2.2 as-number 123
peer 2.2.2.2 connect-interface LoopBack0
peer 3.3.3.3 as-number 123
peer 3.3.3.3 connect-interface LoopBack0
peer 15.0.0.5 as-number 500
peer 15.0.0.5 connect-interface GigabitEthernet0/0/2
#
ipv4-family unicast
undo synchronization
peer 2.2.2.2 enable
peer 2.2.2.2 route-policy 333 import
peer 2.2.2.2 next-hop-local
peer 2.2.2.2 advertise-community
peer 3.3.3.3 enable
peer 3.3.3.3 route-policy 333 import
peer 3.3.3.3 next-hop-local
peer 3.3.3.3 advertise-ext-community
peer 15.0.0.5 enable
peer 15.0.0.5 route-policy 33 export
peer 15.0.0.5 advertise-community
#
ospf 1
area 0.0.0.0
network 1.1.1.1 0.0.0.0
network 12.0.0.0 0.0.0.7
network 13.0.0.0 0.0.0.7
network 192.168.100.0 0.0.0.255
#
route-policy c3 deny node 10
if-match community-filter 3
#
route-policy c3 permit node 20
#
route-policy 333 permit node 10
if-match ip-prefix 333
apply community 500:1
#
route-policy 333 permit node 20
#
route-policy 33 permit node 10
if-match community-filter 33
apply as-path 500 additive
#
route-policy 33 permit node 20
#
ip ip-prefix 333 index 10 permit 192.168.3.0 24
#
ip community-filter 3 deny no-export
ip community-filter 33 permit 500:1
#
user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return
R2
<AR2>dis cu
[V200R003C00]
#
sysname AR2
#
snmp-agent local-engineid 800007DB03000000000000
snmp-agent
#
clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
drop illegal-mac alarm
#
undo info-center enable
#
router id 2.2.2.2
#
wlan ac-global carrier id other ac id 0
#
set cpu-usage threshold 80 restore 75
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
local-user admin service-type http
#
firewall zone Local
priority 15
#
interface GigabitEthernet0/0/0
ip address 24.0.0.2 255.255.255.248
#
interface GigabitEthernet0/0/1
ip address 12.0.0.2 255.255.255.248
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
ip address 2.2.2.2 255.255.255.255
#
interface LoopBack1
ip address 192.168.20.2 255.255.255.0
ip forward-broadcast
#
bgp 123
peer 1.1.1.1 as-number 123
peer 1.1.1.1 connect-interface LoopBack0
peer 24.0.0.4 as-number 400
peer 24.0.0.4 connect-interface GigabitEthernet0/0/0
#
ipv4-family unicast
undo synchronization
import-route ospf 1
peer 1.1.1.1 enable
peer 1.1.1.1 next-hop-local
peer 24.0.0.4 enable
peer 24.0.0.4 route-policy a12 export
#
ospf 1
area 0.0.0.0
network 2.2.2.2 0.0.0.0
network 12.0.0.0 0.0.0.7
network 192.168.20.0 0.0.0.255
#
route-policy a11 permit node 10
if-match ip-prefix 11
apply as-path 200 additive
#
route-policy a11 permit node 20
#
route-policy a1 permit node 10
if-match ip-prefix 1
apply local-preference 200
#
route-policy a1 permit node 20
#
route-policy a12 permit node 10
if-match ip-prefix 12
apply cost 100
#
route-policy a12 permit node 20
#
ip ip-prefix 11 index 10 permit 192.168.11.0 24
ip ip-prefix 1 index 10 permit 192.168.1.0 24
ip ip-prefix 12 index 10 permit 192.168.12.0 24
#
user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return
R3
<AR3>dis cu
[V200R003C00]
#
sysname AR3
#
snmp-agent local-engineid 800007DB03000000000000
snmp-agent
#
clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
drop illegal-mac alarm
#
undo info-center enable
#
router id 3.3.3.3
#
wlan ac-global carrier id other ac id 0
#
set cpu-usage threshold 80 restore 75
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
local-user admin service-type http
#
firewall zone Local
priority 15
#
interface GigabitEthernet0/0/0
ip address 34.0.0.3 255.255.255.248
#
interface GigabitEthernet0/0/1
ip address 13.0.0.3 255.255.255.248
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
ip address 3.3.3.3 255.255.255.255
#
interface LoopBack1
ip address 192.168.30.3 255.255.255.0
ip forward-broadcast
#
bgp 123
peer 1.1.1.1 as-number 123
peer 1.1.1.1 connect-interface LoopBack0
peer 34.0.0.4 as-number 400
peer 34.0.0.4 connect-interface GigabitEthernet0/0/0
#
ipv4-family unicast
undo synchronization
peer 1.1.1.1 enable
peer 1.1.1.1 route-policy a2 export
peer 1.1.1.1 next-hop-local
peer 34.0.0.4 enable
#
ospf 1
area 0.0.0.0
network 3.3.3.3 0.0.0.0
network 13.0.0.0 0.0.0.7
network 192.168.30.0 0.0.0.255
#
route-policy a2 permit node 10
if-match ip-prefix 2
apply local-preference 200
#
route-policy a2 permit node 20
#
ip ip-prefix 2 index 10 permit 192.168.2.0 24
#
ip as-path-filter 123 deny 123$
ip as-path-filter 123 permit .*
#
user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return
R4
<AR4>dis cu
[V200R003C00]
#
sysname AR4
#
snmp-agent local-engineid 800007DB03000000000000
snmp-agent
#
clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
drop illegal-mac alarm
#
undo info-center enable
#
router id 4.4.4.4
#
wlan ac-global carrier id other ac id 0
#
set cpu-usage threshold 80 restore 75
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
local-user admin service-type http
#
firewall zone Local
priority 15
#
interface GigabitEthernet0/0/0
ip address 24.0.0.4 255.255.255.248
#
interface GigabitEthernet0/0/1
ip address 34.0.0.4 255.255.255.248
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
ip address 192.168.1.4 255.255.255.0
#
interface LoopBack1
ip address 192.168.2.4 255.255.255.0
#
interface LoopBack2
ip address 192.168.3.4 255.255.255.0
#
bgp 400
peer 24.0.0.2 as-number 123
peer 24.0.0.2 ebgp-max-hop 10
peer 24.0.0.2 connect-interface GigabitEthernet0/0/0
peer 34.0.0.3 as-number 123
peer 34.0.0.3 ebgp-max-hop 10
peer 34.0.0.3 connect-interface GigabitEthernet0/0/1
#
ipv4-family unicast
undo synchronization
import-route direct
peer 24.0.0.2 enable
peer 24.0.0.2 route-policy a3 export
peer 24.0.0.2 advertise-community
peer 34.0.0.3 enable
peer 34.0.0.3 route-policy a3 export
peer 34.0.0.3 advertise-community
#
route-policy a3 permit node 10
if-match ip-prefix 3
apply community no-export
#
route-policy a3 permit node 20
#
ip ip-prefix 3 index 10 permit 192.168.3.0 24
#
user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return
R5
<AR5>dis cu
[V200R003C00]
#
sysname AR5
#
snmp-agent local-engineid 800007DB03000000000000
snmp-agent
#
clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load flash:/portalpage.zip
#
drop illegal-mac alarm
#
undo info-center enable
#
router id 5.5.5.5
#
wlan ac-global carrier id other ac id 0
#
set cpu-usage threshold 80 restore 75
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
local-user admin service-type http
#
firewall zone Local
priority 15
#
interface GigabitEthernet0/0/0
ip address 15.0.0.5 255.255.255.248
#
interface GigabitEthernet0/0/1
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
ip address 192.168.10.5 255.255.255.0
#
interface LoopBack1
ip address 192.168.11.5 255.255.255.0
#
interface LoopBack2
ip address 192.168.12.5 255.255.255.0
#
bgp 500
peer 15.0.0.1 as-number 123
peer 15.0.0.1 ebgp-max-hop 10
peer 15.0.0.1 connect-interface GigabitEthernet0/0/0
#
ipv4-family unicast
undo synchronization
import-route direct
peer 15.0.0.1 enable
peer 15.0.0.1 as-path-filter 123 import
#
route-policy 33 permit node 10
if-match community-filter 33
apply as-path 500 additive
#
route-policy 33 permit node 20
#
ip as-path-filter 10 deny 123$
ip as-path-filter 10 permit .*
ip as-path-filter 123 deny 123$
ip as-path-filter 123 permit .*
#
ip community-filter 33 permit 500:1
#
user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return
<AR5>
标签:bgp,AR2,0.0,route,Community,BGP,peer,policy,路由
From: https://blog.csdn.net/weixin_56548356/article/details/139639465