所选语种没有对应资源,请选择:

本站点使用Cookies,继续浏览表示您同意我们使用Cookies。Cookies和隐私政策>

提示

尊敬的用户,您的IE浏览器版本过低,为获取更好的浏览体验,请升级您的IE浏览器。

升级
S7700, S9700 V200R010C00 配置指南-以太网交换

本文档针对设备的以太网业务,主要包括链路聚合配置、VLAN配置、Voice VLAN配置、VLAN mapping配置、QinQ配置、GVRP配置、MAC表配置、STP/RSTP/MSTP配置和SEP配置等。

评分并提供意见反馈 :
华为采用机器翻译与人工审校相结合的方式将此文档翻译成不同语言,希望能帮助您更容易理解此文档的内容。 请注意:即使是最好的机器翻译,其准确度也不及专业翻译人员的水平。 华为对于翻译的准确性不承担任何责任,并建议您参考英文文档(已提供链接)。
配置基于VSI的MAC地址学习限制示例

配置基于VSI的MAC地址学习限制示例

组网需求

图2-17,某企业机构,自建骨干网。为了保证骨干网的安全,在PE设备上通过配置基于VSI的MAC地址学习限制功能,实现对CE的接入控制。

图2-17  配置基于VSI的MAC地址学习限制组网图

配置思路

采用如下的思路配置基于VSI的MAC地址学习限制:

  1. 在骨干网上配置路由协议实现互通。

  2. 在PE之间建立远端LDP会话。

  3. 在PE间建立传输业务数据所使用的隧道。

  4. 在PE上使能MPLS L2VPN。

  5. 在PE上创建VSI,指定信令为LDP。

  6. 在PE设备基于VSI配置MAC地址学习限制,完成对CE的接入控制。

操作步骤

  1. 配置各接口所属的VLAN以及相关接口IP地址

    # 配置CE1。

    <HUAWEI> system-view
    [HUAWEI] sysname CE1
    [CE1] vlan 10
    [CE1-vlan10] quit
    [CE1] interface vlanif 10
    [CE1-Vlanif10] ip address 10.1.1.1 255.255.255.0
    [CE1-Vlanif10] quit
    [CE1] interface gigabitethernet 1/0/0
    [CE1-GigabitEthernet1/0/0] port link-type trunk
    [CE1-GigabitEthernet1/0/0] port trunk allow-pass vlan 10
    [CE1-GigabitEthernet1/0/0] quit

    # 配置CE2。

    <HUAWEI> system-view
    [HUAWEI] sysname CE2
    [CE2] vlan 40
    [CE2-vlan40] quit
    [CE2] interface vlanif 40
    [CE2-Vlanif40] ip address 10.1.1.2 255.255.255.0
    [CE2-Vlanif40] quit
    [CE2] interface gigabitethernet 1/0/0
    [CE2-GigabitEthernet1/0/0] port link-type trunk
    [CE2-GigabitEthernet1/0/0] port trunk allow-pass vlan 40
    [CE2-GigabitEthernet1/0/0] quit

    # 配置PE1。

    <HUAWEI> system-view
    [HUAWEI] sysname PE1
    [PE1] vlan batch 10 20
    [PE1] interface vlanif 20
    [PE1-Vlanif20] ip address 4.4.4.4 255.255.255.0
    [PE1-Vlanif20] quit
    [PE1] interface gigabitethernet 1/0/0
    [PE1-GigabitEthernet1/0/0] port link-type trunk
    [PE1-GigabitEthernet1/0/0] port trunk allow-pass vlan 10
    [PE1-GigabitEthernet1/0/0] quit
    [PE1] interface gigabitethernet 2/0/0
    [PE1-GigabitEthernet2/0/0] port link-type trunk
    [PE1-GigabitEthernet2/0/0] port trunk allow-pass vlan 20
    [PE1-GigabitEthernet2/0/0] quit

    # 配置P。

    <HUAWEI> system-view
    [HUAWEI] sysname P
    [P] vlan batch 20 30
    [P] interface vlanif 20
    [P-Vlanif20] ip address 4.4.4.2 255.255.255.0
    [P-Vlanif20] quit
    [P] interface vlanif 30
    [P-Vlanif30] ip address 5.5.5.5 255.255.255.0
    [P-Vlanif30] quit
    [P] interface gigabitethernet 1/0/0
    [P-GigabitEthernet1/0/0] port link-type trunk
    [P-GigabitEthernet1/0/0] port trunk allow-pass vlan 20
    [P-GigabitEthernet1/0/0] quit
    [P] interface gigabitethernet 2/0/0
    [P-GigabitEthernet2/0/0] port link-type trunk
    [P-GigabitEthernet2/0/0] port trunk allow-pass vlan 30
    [P-GigabitEthernet2/0/0] quit

    # 配置PE2。

    <HUAWEI> system-view
    [HUAWEI] sysname PE2
    [PE2] vlan batch 30 40
    [PE2] interface vlanif 30
    [PE2-Vlanif30] ip address 5.5.5.2 255.255.255.0
    [PE2-Vlanif30] quit
    [PE2] interface gigabitethernet 1/0/0
    [PE2-GigabitEthernet1/0/0] port link-type trunk
    [PE2-GigabitEthernet1/0/0] port trunk allow-pass vlan 30
    [PE2-GigabitEthernet1/0/0] quit
    [PE2] interface gigabitethernet 2/0/0
    [PE2-GigabitEthernet2/0/0] port link-type trunk
    [PE2-GigabitEthernet2/0/0] port trunk allow-pass vlan 40
    [PE2-GigabitEthernet2/0/0] quit

  2. 配置IGP,本例中使用OSPF。

    配置OSPF时,注意需要发布PE1、P和PE2的32位Loopback接口地址(LSR-ID)。

    # 配置PE1。

    [PE1] router id 1.1.1.1
    [PE1] interface loopback 1
    [PE1-LoopBack1] ip address 1.1.1.1 32
    [PE1-LoopBack1] quit
    [PE1] ospf 1
    [PE1-ospf-1] area 0
    [PE1-ospf-1-area-0.0.0.0] network 1.1.1.1 0.0.0.0
    [PE1-ospf-1-area-0.0.0.0] network 4.4.4.4 0.0.0.255
    [PE1-ospf-1-area-0.0.0.0] quit
    [PE1-ospf-1] quit

    # 配置P。

    [P] router id 2.2.2.2
    [P] interface loopback 1
    [P-LoopBack1] ip address 2.2.2.2 32
    [P-LoopBack1] quit
    [P] ospf 1
    [P-ospf-1] area 0
    [P-ospf-1-area-0.0.0.0] network 2.2.2.2 0.0.0.0
    [P-ospf-1-area-0.0.0.0] network 4.4.4.2 0.0.0.255
    [P-ospf-1-area-0.0.0.0] network 5.5.5.5 0.0.0.255
    [P-ospf-1-area-0.0.0.0] quit
    [P-ospf-1] quit

    # 配置PE2。

    [PE2] router id 3.3.3.3
    [PE2] interface loopback 1
    [PE2-LoopBack1] ip address 3.3.3.3 32
    [PE2-LoopBack1] quit
    [PE2] ospf 1
    [PE2-ospf-1] area 0
    [PE2-ospf-1-area-0.0.0.0] network 3.3.3.3 0.0.0.0
    [PE2-ospf-1-area-0.0.0.0] network 5.5.5.2 0.0.0.255
    [PE2-ospf-1-area-0.0.0.0] quit
    [PE2-ospf-1] quit

    配置完成后,在PE1、P和PE2上执行display ip routing-table命令可以看到已学到彼此的路由。以PE1的显示为例:

    [PE1] display ip routing-table                                                   
    Route Flags: R - relay, D - download to fib                                     
    ------------------------------------------------------------------------------  
    Routing Tables: Public                                                          
             Destinations : 8       Routes : 8                                      
                                                                                    
    Destination/Mask    Proto   Pre  Cost      Flags NextHop         Interface      
                                                                                    
            1.1.1.1/32  Direct  0    0           D   127.0.0.1       LoopBack1      
            2.2.2.2/32  OSPF    10   1           D   4.4.4.2         Vlanif20       
            3.3.3.3/32  OSPF    10   2           D   4.4.4.2         Vlanif20       
            4.4.4.0/24  Direct  0    0           D   4.4.4.4         Vlanif20       
            4.4.4.4/32  Direct  0    0           D   127.0.0.1       Vlanif20       
            5.5.5.0/24  OSPF    10   2           D   4.4.4.2         Vlanif20       
          127.0.0.0/8   Direct  0    0           D   127.0.0.1       InLoopBack0    
          127.0.0.1/32  Direct  0    0           D   127.0.0.1       InLoopBack0    
    

  3. 配置MPLS基本能力和LDP

    # 配置PE1

    [PE1] mpls lsr-id 1.1.1.1
    [PE1] mpls
    [PE1-mpls] quit
    [PE1] mpls ldp
    [PE1-mpls-ldp] quit
    [PE1] interface vlanif 20
    [PE1-Vlanif20] mpls
    [PE1-Vlanif20] mpls ldp
    [PE1-Vlanif20] quit

    # 配置P

    [P] mpls lsr-id 2.2.2.2
    [P] mpls
    [P-mpls] quit
    [P] mpls ldp
    [P-mpls-ldp] quit
    [P] interface vlanif 20
    [P-Vlanif20] mpls
    [P-Vlanif20] mpls ldp
    [P-Vlanif20] quit
    [P] interface vlanif 30
    [P-Vlanif30] mpls
    [P-Vlanif30] mpls ldp
    [P-Vlanif30] quit

    # 配置PE2

    [PE2] mpls lsr-id 3.3.3.3
    [PE2] mpls
    [PE2-mpls] quit
    [PE2] mpls ldp
    [PE2-mpls-ldp] quit
    [PE2] interface vlanif 30
    [PE2-Vlanif30] mpls
    [PE2-Vlanif30] mpls ldp
    [PE2-Vlanif30] quit

    配置完成后,在PE1、P和PE2上执行display mpls ldp session命令可以看到PE1和P之间或PE2和P之间的对等体的Status项为“Operational”,即对等体关系已建立。执行display mpls lsp命令可以看到LSP的建立情况。以PE1的显示为例:

    [PE1] display mpls ldp session
    
     LDP Session(s) in Public Network
     Codes: LAM(Label Advertisement Mode), SsnAge Unit(DDDD:HH:MM)
     A '*' before a session means the session is being deleted.
     ------------------------------------------------------------------------------
     PeerID            Status      LAM  SsnRole  SsnAge      KASent/Rcv
     ------------------------------------------------------------------------------
     2.2.2.2:0          Operational DU Passive  000:15:29   3717/3717
     ------------------------------------------------------------------------------
     TOTAL: 1 session(s) Found.
    

  4. 在PE之间建立远端LDP会话

    # 配置PE1。

    [PE1] mpls ldp remote-peer 3.3.3.3
    [PE1-mpls-ldp-remote-3.3.3.3] remote-ip 3.3.3.3
    [PE1-mpls-ldp-remote-3.3.3.3] quit

    # 配置PE2。

    [PE2] mpls ldp remote-peer 1.1.1.1
    [PE2-mpls-ldp-remote-1.1.1.1] remote-ip 1.1.1.1
    [PE2-mpls-ldp-remote-1.1.1.1] quit

    配置完成后,在PE1或PE2上执行display mpls ldp session命令可以看到PE1和PE2之间的对等体的Status项为“Operational”,即远端对等体关系已建立。

  5. 在PE上使能MPLS L2VPN

    # 配置PE1。

    [PE1] mpls l2vpn
    [PE1-l2vpn] quit

    # 配置PE2。

    [PE2] mpls l2vpn
    [PE2-l2vpn] quit

  6. 在PE上配置VSI

    # 配置PE1。

    [PE1] vsi a2 static
    [PE1-vsi-a2] pwsignal ldp
    [PE1-vsi-a2-ldp] vsi-id 2
    [PE1-vsi-a2-ldp] peer 3.3.3.3
    [PE1-vsi-a2-ldp] quit
    [PE1-vsi-a2] quit

    # 配置PE2。

    [PE2] vsi a2 static
    [PE2-vsi-a2] pwsignal ldp
    [PE2-vsi-a2-ldp] vsi-id 2
    [PE2-vsi-a2-ldp] peer 1.1.1.1
    [PE2-vsi-a2-ldp] quit
    [PE2-vsi-a2] quit

  7. 在PE上配置VSI与接口的绑定

    # 配置PE1。

    [PE1] interface vlanif 10
    [PE1-Vlanif10] l2 binding vsi a2
    [PE1-Vlanif10] quit

    # 配置PE2。

    [PE2] interface vlanif 40
    [PE2-Vlanif40] l2 binding vsi a2
    [PE2-Vlanif40] quit

  8. 验证配置结果

    完成上述配置后,在PE1上执行display vsi name a2 verbose命令,可以看到名字为a2的VSI建立了一条PW到PE2,VSI状态为UP。

    [PE1] display vsi name a2 verbose
    
     ***VSI Name               : a2
        Administrator VSI      : no
        Isolate Spoken         : disable
        VSI Index              : 0
        PW Signaling           : ldp
        Member Discovery Style : static
        PW MAC Learn Style     : unqualify
        Encapsulation Type     : vlan
        MTU                    : 1500
        Diffserv Mode          : uniform
        Mpls Exp               : --
        DomainId               : 255
        Domain Name            :
        Ignore AcState         : disable
        P2P VSI                : disable
        Create Time            : 0 days, 0 hours, 5 minutes, 1 seconds
        VSI State              : up
    
        VSI ID                 : 2
       *Peer Router ID         : 3.3.3.3
        Negotiation-vc-id      : 2
        primary or secondary   : primary
        ignore-standby-state   : no
        VC Label               : 4098
        Peer Type              : dynamic
        Session                : up
        Tunnel ID              : 0x1
        Broadcast Tunnel ID    : 0x1
        Broad BackupTunnel ID  : 0x0
        CKey                   : 2
        NKey                   : 1
        Stp Enable             : 0
        PwIndex                : 0
        Control Word           : disable
    
        Interface Name         : Vlanif10
        State                  : up
        Access Port            : false
        Last Up Time           : 2010/12/30 11:31:18
        Total Up Time          : 0 days, 0 hours, 1 minutes, 35 seconds
    
        **PW Information:
    
       *Peer Ip Address        : 3.3.3.3
        PW State               : up
        Local VC Label         : 4098
        Remote VC Label        : 4098
        Remote Control Word    : disable
        PW Type                : label
        Local  VCCV            : alert lsp-ping bfd
        Remote VCCV            : alert lsp-ping bfd
        Tunnel ID              : 0x1
        Broadcast Tunnel ID    : 0x1
        Broad BackupTunnel ID  : 0x0
        Ckey                   : 0x2
        Nkey                   : 0x1
        Main PW Token          : 0x1
        Slave PW Token         : 0x0
        Tnl Type               : LSP
        OutInterface           : Vlanif20
        Backup OutInterface    :
        Stp Enable             : 0
        PW Last Up Time        : 2010/12/30 11:32:03
        PW Total Up Time       : 0 days, 0 hours, 1 minutes, 35 seconds

    在CE1(10.1.1.1)上能够ping通CE2(10.1.1.2)。

    [CE1] ping 10.1.1.2
      PING 10.1.1.2: 56  data bytes, press CTRL_C to break
        Reply from 10.1.1.2: bytes=56 Sequence=1 ttl=255 time=90 ms
        Reply from 10.1.1.2: bytes=56 Sequence=2 ttl=255 time=77 ms
        Reply from 10.1.1.2: bytes=56 Sequence=3 ttl=255 time=34 ms
        Reply from 10.1.1.2: bytes=56 Sequence=4 ttl=255 time=46 ms
        Reply from 10.1.1.2: bytes=56 Sequence=5 ttl=255 time=94 ms
    
      --- 10.1.1.2 ping statistics ---
        5 packet(s) transmitted
        5 packet(s) received
        0.00% packet loss
        round-trip min/avg/max = 34/68/94 ms 

  9. 在PE1的VSI上配置MAC地址学习限制

    # 在VSI上配置MAC地址学习限制规则:最多可以学习300个MAC地址,超过最大MAC地址学习数量的报文直接丢弃并进行告警提示。

    [PE1] vsi a2 static
    [PE1-vsi-a2] mac-limit maximum 300 action discard alarm enable
    [PE1-vsi-a2] return

  10. 验证配置结果

    # 在任意视图下执行display mac-limit命令,查看MAC地址学习限制规则是否配置成功。

    <PE1> display mac-limit
    MAC limit is enabled
    Total MAC limit rule count : 1
    
    PORT                 VLAN/VSI      SLOT Maximum Rate(ms) Action  Alarm
    ----------------------------------------------------------------------------
    -                    a2            -    300     -        discard enable 
    

配置文件

  • CE1的配置文件

    #
    sysname CE1
    #
    vlan batch 10
    #
    interface Vlanif10
     ip address 10.1.1.1 255.255.255.0
    #
    interface GigabitEthernet1/0/0
     port link-type trunk
     port trunk allow-pass vlan 10
    #
    return
  • CE2的配置文件

    #
    sysname CE2
    #
    vlan batch 40
    #
    interface Vlanif40
     ip address 10.1.1.2 255.255.255.0
    #
    interface GigabitEthernet1/0/0
     port link-type trunk
     port trunk allow-pass vlan 40
    #
    return
  • PE1的配置文件

    #
    sysname PE1
    #
    router id 1.1.1.1
    #
    vlan batch 10 20
    #
    mpls lsr-id 1.1.1.1
    mpls
    #
    mpls l2vpn
    #
    vsi a2 static 
     mac-limit maximum 300
     pwsignal ldp 
      vsi-id 2    
      peer 3.3.3.3
    # 
    mpls ldp
    #
    mpls ldp remote-peer 3.3.3.3
     remote-ip 3.3.3.3
    #
    interface Vlanif10
     l2 binding vsi a2
    #
    interface Vlanif20
     ip address 4.4.4.4 255.255.255.0
     mpls
     mpls ldp
    #
    interface GigabitEthernet1/0/0
     port link-type trunk
     port trunk allow-pass vlan 10
    #
    interface GigabitEthernet2/0/0
     port link-type trunk
     port trunk allow-pass vlan 20
    #
    interface LoopBack1
     ip address 1.1.1.1 255.255.255.255
    #
    ospf 1
     area 0.0.0.0
      network 1.1.1.1 0.0.0.0
      network 4.4.4.0 0.0.0.255
    #
    return
  • P的配置文件

    #
    sysname P
    #
    router id 2.2.2.2
    #
    vlan batch 20 30
    #
    mpls lsr-id 2.2.2.2
    mpls
    #
    mpls ldp
    #
    interface Vlanif20
     ip address 4.4.4.2 255.255.255.0
     mpls
     mpls ldp
    #
    interface Vlanif30
     ip address 5.5.5.5 255.255.255.0
     mpls
     mpls ldp
    #
    interface GigabitEthernet1/0/0
     port link-type trunk
     port trunk allow-pass vlan 20
    #
    interface GigabitEthernet2/0/0
     port link-type trunk
     port trunk allow-pass vlan 30
    #
    interface LoopBack1
     ip address 2.2.2.2 255.255.255.255
    #
    ospf 1
     area 0.0.0.0
      network 2.2.2.2 0.0.0.0
      network 4.4.4.0 0.0.0.255
      network 5.5.5.0 0.0.0.255
    #
    return
  • PE2的配置文件

    #
    sysname PE2
    #
    router id 3.3.3.3
    #
    vlan batch 30 40
    #
    mpls lsr-id 3.3.3.3
    mpls
    #
    mpls l2vpn
    #
    vsi a2 static
     pwsignal ldp
      vsi-id 2
      peer 1.1.1.1
    #
    mpls ldp
    #
    mpls ldp remote-peer 1.1.1.1
     remote-ip 1.1.1.1
    #
    interface Vlanif30
     ip address 5.5.5.2 255.255.255.0
     mpls
     mpls ldp
    #
    interface Vlanif40
     l2 binding vsi a2
    #
    interface GigabitEthernet1/0/0
     port link-type trunk
     port trunk allow-pass vlan 30
    #
    interface GigabitEthernet2/0/0
     port link-type trunk
     port trunk allow-pass vlan 40
    #
    interface LoopBack1
     ip address 3.3.3.3 255.255.255.255
    #
    ospf 1
     area 0.0.0.0
      network 3.3.3.3 0.0.0.0
      network 5.5.5.0 0.0.0.255
    #
    return
翻译
下载文档
更新时间:2019-12-27

文档编号:EDOC1000141467

浏览量:90993

下载量:1017

平均得分:
本文档适用于这些产品

相关版本

相关文档

Share
上一页 下一页