实验拓扑
实验需求及解法
本实验模拟多个AS使用BGP协议传递路由的网络环境,根据选路需求修改BGP属性。
预配:
各设备物理接口和环回口配置必要的IPv4和IPv6地址。
R1
sysname R1
interface GigabitEthernet0/0/0
ipv6 enable
ip address 12.1.1.1 255.255.255.0
ipv6 address auto link-local
#
interface GigabitEthernet0/0/1
ipv6 enable
ip address 13.1.1.1 255.255.255.0
ipv6 address auto link-local
#
interface GigabitEthernet0/0/2
ipv6 enable
ipv6 address auto link-local
#
interface LoopBack0
ipv6 enable
ip address 1.1.1.1 255.255.255.255
ipv6 address 2000::1/128
#
interface LoopBack10
ipv6 enable
ip address 10.1.1.1 255.255.255.0
ipv6 address 2000:1::1/64
R2
sysname R2
interface GigabitEthernet0/0/0
ipv6 enable
ip address 12.1.1.2 255.255.255.0
ipv6 address auto link-local
#
interface GigabitEthernet0/0/1
ipv6 enable
ip address 23.1.1.2 255.255.255.0
ipv6 address auto link-local
#
interface GigabitEthernet0/0/2
ipv6 enable
ip address 25.1.1.2 255.255.255.0
ipv6 address 2000:25::2/64
ipv6 address auto link-local
#
interface GigabitEthernet1/0/0
ipv6 enable
ip address 24.1.1.2 255.255.255.0
ipv6 address 2000:24::2/64
#
interface LoopBack0
ipv6 enable
ip address 2.2.2.2 255.255.255.255
ipv6 address 2000::2/128
R3
sysname R3
interface GigabitEthernet0/0/0
ipv6 enable
ip address 13.1.1.3 255.255.255.0
ipv6 address auto link-local
#
interface GigabitEthernet0/0/1
ipv6 enable
ip address 23.1.1.3 255.255.255.0
ipv6 address auto link-local
#
interface GigabitEthernet0/0/2
ipv6 enable
ip address 35.1.1.3 255.255.255.0
ipv6 address 2000:35::3/64
ipv6 address auto link-local
#
interface LoopBack0
ipv6 enable
ip address 3.3.3.3 255.255.255.255
ipv6 address 2000::3/128
R4
sysname R4
interface GigabitEthernet0/0/0
ipv6 enable
ip address 24.1.1.4 255.255.255.0
ipv6 address 2000:24::4/64
#
interface GigabitEthernet0/0/1
ipv6 enable
ip address 46.1.1.4 255.255.255.0
ipv6 address 2000:46::4/64
ipv6 address auto link-local
#
interface GigabitEthernet0/0/2
ipv6 enable
ipv6 address auto link-local
#
interface LoopBack0
ipv6 enable
ip address 4.4.4.4 255.255.255.255
ipv6 address 2000::4/128
R5
sysname R5
interface GigabitEthernet0/0/0
ipv6 enable
ip address 35.1.1.5 255.255.255.0
ipv6 address 2000:35::5/64
ipv6 address auto link-local
#
interface GigabitEthernet0/0/1
ipv6 enable
ip address 56.1.1.5 255.255.255.0
ipv6 address 2000:56::5/64
ipv6 address auto link-local
#
interface GigabitEthernet0/0/2
ipv6 enable
ip address 25.1.1.5 255.255.255.0
ipv6 address 2000:25::5/64
ipv6 address auto link-local
#
interface LoopBack0
ip address 5.5.5.5 255.255.255.255
R6
sysname R6
interface GigabitEthernet0/0/0
ipv6 enable
ip address 56.1.1.6 255.255.255.0
ipv6 address 2000:56::6/64
ipv6 address auto link-local
#
interface GigabitEthernet0/0/1
ipv6 enable
ip address 46.1.1.6 255.255.255.0
ipv6 address 2000:46::6/64
ipv6 address auto link-local
#
interface GigabitEthernet0/0/2
ipv6 enable
ip address 67.1.1.6 255.255.255.0
ipv6 address auto link-local
#
interface GigabitEthernet1/0/0
ipv6 enable
ip address 68.1.1.6 255.255.255.0
ipv6 address 2000:68::6/64
ipv6 address auto link-local
#
interface LoopBack0
ipv6 enable
ip address 6.6.6.6 255.255.255.255
ipv6 address 2000::6/128
R7
sysname R7
interface GigabitEthernet0/0/0
ipv6 enable
ip address 67.1.1.7 255.255.255.0
ipv6 address auto link-local
#
interface GigabitEthernet0/0/1
ipv6 enable
ip address 78.1.1.7 255.255.255.0
ipv6 address 2000:78::7/64
ipv6 address auto link-local
#
interface GigabitEthernet0/0/2
ipv6 enable
ipv6 address auto link-local
#
interface LoopBack0
ipv6 enable
ip address 7.7.7.7 255.255.255.255
ipv6 address 2000::7/128
#
interface LoopBack10
ipv6 enable
ip address 10.7.7.7 255.255.255.0
ipv6 address 2000:7::7/64
ipv6 address 2000:17::7/64
R8
sysname R8
interface GigabitEthernet0/0/0
ipv6 enable
ip address 68.1.1.8 255.255.255.0
ipv6 address 2000:68::8/64
ipv6 address auto link-local
#
interface GigabitEthernet0/0/1
ipv6 enable
ip address 78.1.1.8 255.255.255.0
ipv6 address 2000:78::8/64
ipv6 address auto link-local
#
interface GigabitEthernet0/0/2
ipv6 enable
ipv6 address auto link-local
#
interface LoopBack0
ip address 8.8.8.8 255.255.255.255
一、部署IGP
1.1 部署OSPF
1.1.1 在 AS100 和AS400中部署OSPF,进程1,RID使用Loopback0地址。
1.1.2 全部划入区域0,通配符0.0.0.0
1.1.3 不宣告与其他AS互联的地址。
R1:
ospf 1 router-id 1.1.1.1
area 0.0.0.0
network 1.1.1.1 0.0.0.0
network 10.1.1.1 0.0.0.0
network 12.1.1.1 0.0.0.0
network 13.1.1.1 0.0.0.0
#
R2:
ospf 1 router-id 2.2.2.2
area 0.0.0.0
network 2.2.2.2 0.0.0.0
network 12.1.1.2 0.0.0.0
network 23.1.1.2 0.0.0.0
#
R3:
ospf 1 router-id 3.3.3.3
area 0.0.0.0
network 3.3.3.3 0.0.0.0
network 13.1.1.3 0.0.0.0
network 23.1.1.3 0.0.0.0
#
R6:
ospf 1 router-id 6.6.6.6
area 0.0.0.0
network 6.6.6.6 0.0.0.0
network 67.1.1.6 0.0.0.0
#
R7:
ospf 1 router-id 7.7.7.7
area 0.0.0.0
network 7.7.7.7 0.0.0.0
network 67.1.1.7 0.0.0.0
1.1.4 确认OSPF邻居关系。
1.1.5 确认环回口互通。
1.2 部署OSPFv3
2.1.1 在 AS100 和AS400中部署OSPFv3,进程1,RID使用Loopback0地址。
2.1.2 全部划入区域0
2.1.3 与其他AS互联的接口不运行OSPFv3。
R1:
ospfv3 1
router-id 1.1.1.1
#
interface GigabitEthernet0/0/0
ospfv3 1 area 0.0.0.0
#
interface GigabitEthernet0/0/1
ospfv3 1 area 0.0.0.0
#
interface LoopBack0
ospfv3 1 area 0.0.0.0
R2:
ospfv3 1
router-id 2.2.2.2
#
interface GigabitEthernet0/0/0
ospfv3 1 area 0.0.0.0
#
interface GigabitEthernet0/0/1
ospfv3 1 area 0.0.0.0
#
interface LoopBack0
ospfv3 1 area 0.0.0.0
R3:
ospfv3 1
router-id 3.3.3.3
#
interface GigabitEthernet0/0/0
ospfv3 1 area 0.0.0.0
#
interface GigabitEthernet0/0/1
ospfv3 1 area 0.0.0.0
#
interface LoopBack0
ospfv3 1 area 0.0.0.0
R6:
ospfv3 1
router-id 6.6.6.6
#
interface GigabitEthernet0/0/2
ospfv3 1 area 0.0.0.0
#
interface LoopBack0
ospfv3 1 area 0.0.0.0
R7:
ospfv3 1
router-id 7.7.7.7
#
interface GigabitEthernet0/0/0
ospfv3 1 area 0.0.0.0
#
interface LoopBack0
ospfv3 1 area 0.0.0.0
2.1.4 确认OSPFv3邻居关系。
2.1.5 确认环回口互通。
二、部署BGP
2.1 部署EBGP
2.1.1 如图所示,配置各AS之间的EBGP邻居关系。
2.1.2 Router-id 使用 Loopback0 地址。
2.1.2 使用物理接口建立邻居。
2.1.3 同时建立IPv4和IPv6邻居。
R2:
bgp 100
router-id 2.2.2.2
peer 24.1.1.4 as-number 200
peer 25.1.1.5 as-number 300
peer 2000:24::4 as-number 200
peer 2000:25::5 as-number 300
#
ipv4-family unicast
undo synchronization
peer 24.1.1.4 enable
peer 25.1.1.5 enable
#
ipv6-family unicast
undo synchronization
peer 2000:24::4 enable
peer 2000:25::5 enable
#
R3:
bgp 100
router-id 3.3.3.3
peer 35.1.1.5 as-number 300
peer 2000:35::5 as-number 300
#
ipv4-family unicast
undo synchronization
peer 35.1.1.5 enable
#
ipv6-family unicast
undo synchronization
peer 2000:35::5 enable
#
R4:
bgp 200
router-id 4.4.4.4
peer 24.1.1.2 as-number 100
peer 46.1.1.6 as-number 400
peer 2000:24::2 as-number 100
peer 2000:46::6 as-number 400
#
ipv4-family unicast
undo synchronization
peer 24.1.1.2 enable
peer 46.1.1.6 enable
#
ipv6-family unicast
undo synchronization
peer 2000:24::2 enable
peer 2000:46::6 enable
#
R5:
bgp 300
router-id 5.5.5.5
peer 25.1.1.2 as-number 100
peer 35.1.1.3 as-number 100
peer 56.1.1.6 as-number 400
peer 2000:25::2 as-number 100
peer 2000:35::3 as-number 100
peer 2000:56::6 as-number 400
#
ipv4-family unicast
undo synchronization
peer 25.1.1.2 enable
peer 35.1.1.3 enable
peer 56.1.1.6 enable
#
ipv6-family unicast
undo synchronization
peer 2000:25::2 enable
peer 2000:35::3 enable
peer 2000:56::6 enable
#
R6:
bgp 400
router-id 6.6.6.6
peer 46.1.1.4 as-number 200
peer 56.1.1.5 as-number 300
peer 68.1.1.8 as-number 500
peer 2000:46::4 as-number 200
peer 2000:56::5 as-number 300
peer 2000:68::8 as-number 500
#
ipv4-family unicast
undo synchronization
peer 46.1.1.4 enable
peer 56.1.1.5 enable
peer 68.1.1.8 enable
#
ipv6-family unicast
undo synchronization
peer 2000:46::4 enable
peer 2000:56::5 enable
peer 2000:68::8 enable
#
R7:
bgp 400
router-id 7.7.7.7
peer 78.1.1.8 as 500
peer 2000:78::8 as 500
#
ipv4-family unicast
undo synchronization
peer 78.1.1.8 enable
#
ipv6-family unicast
undo synchronization
peer 2000:78::8 enable
#
R8:
bgp 500
router-id 8.8.8.8
peer 68.1.1.6 as-number 400
peer 78.1.1.7 as-number 400
peer 2000:68::6 as-number 400
peer 2000:78::7 as-number 400
#
ipv4-family unicast
undo synchronization
peer 68.1.1.6 enable
peer 78.1.1.7 enable
#
ipv6-family unicast
undo synchronization
peer 2000:68::6 enable
peer 2000:78::7 enable
2.2 部署IBGP
2.2.1 在 AS100 和AS400中部署IBGP
2.2.2 Router-ID 使用 Loopback0 地址。
2.2.2 使用Loopback0 建立邻居。
2.2.3 同时建立IPv4和IPv6邻居,必要时修改下一跳为本地。
R1:
bgp 100
router-id 1.1.1.1
peer 2.2.2.2 as-number 100
peer 2.2.2.2 connect-interface LoopBack0
peer 3.3.3.3 as-number 100
peer 3.3.3.3 connect-interface LoopBack0
peer 2000::2 as-number 100
peer 2000::2 connect-interface LoopBack0
peer 2000::3 as-number 100
peer 2000::3 connect-interface LoopBack0
#
ipv4-family unicast
undo synchronization
peer 2.2.2.2 enable
peer 3.3.3.3 enable
#
ipv6-family unicast
undo synchronization
peer 2000::2 enable
peer 2000::3 enable
#
R2:
bgp 100
router-id 2.2.2.2
peer 1.1.1.1 as-number 100
peer 1.1.1.1 connect-interface LoopBack0
peer 3.3.3.3 as-number 100
peer 3.3.3.3 connect-interface LoopBack0
peer 2000::1 as-number 100
peer 2000::1 connect-interface LoopBack0
peer 2000::3 as-number 100
peer 2000::3 connect-interface LoopBack0
#
ipv4-family unicast
undo synchronization
peer 1.1.1.1 enable
peer 1.1.1.1 next-hop-local
peer 3.3.3.3 enable
peer 3.3.3.3 next-hop-local
#
ipv6-family unicast
undo synchronization
peer 2000::1 enable
peer 2000::1 next-hop-local
peer 2000::3 enable
peer 2000::3 next-hop-local
#
R3:
bgp 100
router-id 3.3.3.3
peer 1.1.1.1 as-number 100
peer 1.1.1.1 connect-interface LoopBack0
peer 2.2.2.2 as-number 100
peer 2.2.2.2 connect-interface LoopBack0
peer 2000::1 as-number 100
peer 2000::1 connect-interface LoopBack0
peer 2000::2 as-number 100
peer 2000::2 connect-interface LoopBack0
#
ipv4-family unicast
undo synchronization
peer 1.1.1.1 enable
peer 1.1.1.1 next-hop-local
peer 2.2.2.2 enable
peer 2.2.2.2 next-hop-local
#
ipv6-family unicast
undo synchronization
peer 2000::1 enable
peer 2000::1 next-hop-local
peer 2000::2 enable
peer 2000::2 next-hop-local
#
R6:
bgp 400
router-id 6.6.6.6
peer 7.7.7.7 as-number 400
peer 7.7.7.7 connect-interface LoopBack0
peer 2000::7 as-number 400
peer 2000::7 connect-interface LoopBack0
#
ipv4-family unicast
undo synchronization
peer 7.7.7.7 enable
peer 7.7.7.7 next-hop-local
#
ipv6-family unicast
undo synchronization
peer 2000::7 enable
peer 2000::7 next-hop-local
#
R7:
bgp 400
router-id 7.7.7.7
peer 6.6.6.6 as-number 400
peer 6.6.6.6 connect-interface LoopBack0
peer 2000::6 as-number 400
peer 2000::6 connect-interface LoopBack0
#
ipv4-family unicast
undo synchronization
peer 6.6.6.6 enable
#
ipv6-family unicast
undo synchronization
peer 2000::6 enable
2.2.4 确认各设备的邻居关系。
2.3 宣告路由
2.3.1 在 R1 上使用BGP宣告Loopback10的IPv4和IPv6网段。
2.3.2 在 R7 上使用BGP宣告Loopback10的IPv4和IPv6网段。
R1:
bgp 100
ipv4-family unicast
network 10.1.1.0 255.255.255.0
ipv6-family unicast
network 2000:1:: 64
#
R7:
bgp 400
ipv4-family unicast
network 10.7.7.0 255.255.255.0
ipv6-family unicast
network 2000:7:: 64
network 2000:17:: 64
2.3.3 确认R1和R7可以使用IPv4和IPv6通信。
三、部署策略
3.1 PrefVal
3.1.1 确认R1去往10.7.7.0/24 和 2000:7::/64 的最佳下一跳为R2,分析原因。
分析: R2与R3发送给R1的路由属性基本一致,只有RID不同。根据选路原则,选择RID小的邻居作为最佳下一跳。
3.1.2 修改PrefVal,使得R1去往2000:7::/64 的最佳下一跳为R3。
3.1.3 使用ipv6前缀列表,名称为7,index 10。
R1
ip ipv6-prefix 7 index 10 permit 2000:7:: 64
3.1.4 使用路由策略,名称为fromR3,node 10修改PrefVal为3,node 100 允许其他路由。
route-policy fromR3 permit node 10
if-match ipv6 address prefix-list 7
apply preferred-value 3
#
route-policy fromR3 permit node 100
3.1.5 在 R1 与对等体R3的输入策略中调用。
bgp 100
ipv6-family unicast
peer 2000::3 route-policy fromR3 import
3.1.6 确认策略生效。
[R1]dis bgp ipv6 routing-table
如上图策略已生效,PrefVal修改为3,已选择2000::3作为最佳下一跳。
3.2 Local_Pref
3.2.1 确认R1去往2000:17::/64 的最佳下一跳为R2。
3.2.2 R3 修改 Local_Pref,让 R1去往10.7.7.0/24 和 2000:17::/64 都走 R3。
3.2.3 ipv4 前缀列表匹配10.7.7.0/24,名称7,index 10
R3
ip ip-prefix 7 index 10 permit 10.7.7.0 24
3.2.4 ipv6 前缀列表匹配2000:17::/64,名称 17,index 10
ip ipv6-prefix 17 index 10 permit 2000:17:: 64
3.2.5 路由策略 toR1v4,node 10 修改 ipv4 路由 Local_Pref 为 200,node 100 允许其他路 由。
route-policy toR1v4 permit node 10
if-match ip-prefix 7
apply local-preference 200
#
route-policy toR1v4 permit node 100
3.2.6 路由策略toR1v6,node 10 修改 ipv6 路由 Local_Pref 为 200,node 100 允许其他路 由。
route-policy toR1v6 permit node 10
if-match ipv6 address prefix-list 17
apply local-preference 200
#
route-policy toR1v6 permit node 100
3.2.7 在 R3 与对等体R1的输出策略中调用。
bgp 100
ipv4-family unicast
peer 1.1.1.1 route-policy toR1v4 export
#
ipv6-family unicast
peer 2000::1 route-policy toR1v6 export
3.2.8 确认策略生效
[R1]dis bgp routing-table
[R1]dis bgp ipv6 routing-table
如上图策略已生效,Local_Pref被修改为200,最佳下一跳为R3。
3.3 MED
3.3.1 查看R5去往AS100的选路,分析目前网络存在的问题。
分析:R5去往AS100的网段下一跳都是R2。 而从AS100去往AS400的流量全部都是从R3走的。(需求3.1和3.2)来回路径不一致会导致将来故障排查,流量监管,安全策略等一系列问题。
3.3.2 R2 修改 MED,影响R5去往AS100选路走R3。
3.3.3 ipv4 前缀列表匹配10.1.1.0/24,名称1,index 10
R2
ip ip-prefix 1 index 10 permit 10.1.1.0 24
3.3.4 ipv6 前缀列表匹配2000:1::/64,名称 1,index 10
ip ipv6-prefix 1 index 10 permit 2000:1:: 64
3.3.5 路由策略toR5v4,node 10修改ipv4路由MED为100,node 100允许其他路由。
route-policy toR5v4 permit node 10
if-match ip-prefix 1
apply cost 100
#
route-policy toR5v4 permit node 100
3.3.6 路由策略toR5v6,node 10修改ipv6路由MED为100,node 100允许其他路由。
route-policy toR5v6 permit node 10
if-match ipv6 address prefix-list 1
apply cost 100
#
route-policy toR5v6 permit node 100
3.3.7 在 R2 与对等体R5的输出策略中调用。
bgp 100
ipv4-family unicast
peer 25.1.1.5 route-policy toR5v4 export
#
ipv6-family unicast
peer 2000:25::5 route-policy toR5v6 export
[R5]dis bgp routing-table
[R5]dis bgp ipv6 routing-table
如上图,MED成功修改为100,R5去往AS100选路走R3。
3.4 AS-path
3.4.1 查看R6去往AS100的选路,分析网络中存在的问题。
分析:R6 去往AS100选路走R4,原因是R4的RID小于R5。此时从AS400去往AS100的流量并不会经过AS300,而是走AS200从R2进入AS100,而回向流量又会从R3离开AS100。依旧存在来回路径不一致的情况。
3.4.2 AS200 的 R4 上增加AS-path,使得R6选路走AS300。
3.4.3 使用AS-path过滤工具,名称AS100,匹配起源于AS 100的路由。
R4
ip as-path-filter AS100 permit _100$
#正则表达式_100$,匹配AS-path最右边的AS号是100的路径属性,表示起源于AS100。
3.4.4 路由策略名称toR6,node 10,所有起源于AS100的路由都增加AS 4000。node 100 允许其他路由且不做修改。
route-policy toR6 permit node 10
if-match as-path-filter AS100
apply as-path 4000 additive
#
route-policy toR6 permit node 100
3.4.5 在 R4 与对等体R6的输出策略中调用。
bgp 200
ipv4-family unicast
peer 46.1.1.6 route-policy toR6 export
#
ipv6-family unicast
peer 2000:46::6 route-policy toR6 export
#因为路由策略匹配的是AS-path属性,所以同一个策略可以给v4和v6共用。
3.4.6 确认策略生效
<R6>dis bgp routing-table
<R6>dis bgp ipv6 routing-table
如上图,策略生效,增加了AS4000,R6选路走R5。
3.5 Load-balance
3.5.1 在 AS500 中的 R8上查看去往AS100的BGP路由,发现AS-path中没有AS4000,分 析原因。
分析:在需求3.4中,R4增加了AS4000发送给R6,R6选择了as-path较少的R5作为最佳下一 跳。BGP路由只会将最佳路径传递给邻居,所以R6只把走R5这个路径的属性传递给了R8, 并不会传递走R4的路径属性。所以R8上看不到AS4000。
3.5.2 R8 开启负载均衡,使得全局路由表中去往AS100的路由有两个下一跳。
R8:
bgp 500
ipv4-family unicast
maximum load-balancing 2
#
ipv6-family unicast
maximum load-balancing 2
[R8]dis ip routing-table
[R8]dis ipv6 routing-table
标签:0.0,enable,HCIE,address,BGP,2000,选路,ipv6,peer From: https://blog.csdn.net/weixin_59151049/article/details/144442551