所选语种没有对应资源,请选择:

本站点使用Cookies,继续浏览表示您同意我们使用Cookies。Cookies和隐私政策>

提示

尊敬的用户,您的IE浏览器版本过低,为获取更好的浏览体验,请升级您的IE浏览器。

升级

S9300, S9300E, S9300X V200R010C00 配置指南-MPLS

本文档介绍了设备支持的MPLS相关配置。主要内容包括静态LSP的基本原理和配置过程、MPLS LDP的基本原理和配置过程、MPLS QoS的基本原理和配置过程、MPLS TE的基本原理和配置过程、MPLS OAM的基本原理和配置过程、Seamless MPLS的基本原理和配置过程,并提供相关的配置案例。
评分并提供意见反馈 :
华为采用机器翻译与人工审校相结合的方式将此文档翻译成不同语言,希望能帮助您更容易理解此文档的内容。 请注意:即使是最好的机器翻译,其准确度也不及专业翻译人员的水平。 华为对于翻译的准确性不承担任何责任,并建议您参考英文文档(已提供链接)。
配置LDP安全认证示例

配置LDP安全认证示例

组网需求

图3-25所示,PE_1与P之间、PE_2与P之间均建立LDP会话,以便建立用于承载业务的LDP LSP。其中,PE_1和PE_2连接的客户网络存在重要业务,所以它们与P之间的LDP会话都具有较高的安全性要求。

图3-25  配置LDP安全认证组网

配置思路

为了满足LDP会话的安全需求,在PE_1、PE_2与P之间配置LDP Keychain认证。采用如下配置思路:

  1. 在PE、P上配置OSPF,实现骨干网的IP连通性。
  2. 在PE、P之间配置LDP本地会话,实现创建LDP LSP来承载网络业务。
  3. 在PE_1、PE_2与P之间配置LDP Keychain认证,满足安全性较高的要求。

操作步骤

  1. 交换机上创建VLAN、VLANIF接口,配置VLANIF接口的IP地址,并将相应的物理接口加入到VLAN

    # 配置PE_1。P和PE_2的配置与PE_1类似,不再赘述。

    <Quidway> system-view
    [Quidway] sysname PE_1
    [PE_1] interface loopback 1
    [PE_1-LoopBack1] ip address 1.1.1.9 32
    [PE_1-LoopBack1] quit
    [PE_1] vlan batch 100
    [PE_1] interface vlanif 100
    [PE_1-Vlanif100] ip address 172.1.1.1 24
    [PE_1-Vlanif100] quit
    [PE_1] interface gigabitethernet 1/0/1
    [PE_1-GigabitEthernet1/0/1] port link-type trunk
    [PE_1-GigabitEthernet1/0/1] port trunk allow-pass vlan 100
    [PE_1-GigabitEthernet1/0/1] quit

  2. 配置OSPF协议发布各节点接口所连网段和LSR ID的主机路由

    # 配置PE_1。P和PE_2的配置与PE_1类似,不再赘述。

    [PE_1] ospf 1
    [PE_1-ospf-1] area 0
    [PE_1-ospf-1-area-0.0.0.0] network 1.1.1.9 0.0.0.0
    [PE_1-ospf-1-area-0.0.0.0] network 172.1.1.0 0.0.0.255
    [PE_1-ospf-1-area-0.0.0.0] quit
    [PE_1-ospf-1] quit

    # 配置完成后,在各节点上执行display ip routing-table命令,可以看到相互之间都学到了彼此的路由。

  3. 配置LDP本地会话

    # 配置PE_1。P和PE_2的配置与PE_1类似,不再赘述。

    [PE_1] mpls lsr-id 1.1.1.9
    [PE_1] mpls
    [PE_1-mpls] quit
    [PE_1] mpls ldp
    [PE_1-mpls-ldp] quit
    [PE_1] interface vlanif 100 
    [PE_1-Vlanif100] mpls
    [PE_1-Vlanif100] mpls ldp
    [PE_1-Vlanif100] quit
    

  4. 配置PE_1与P之间TCP应用程序的Keychain

    # 配置PE_1。

    [PE_1] keychain kforldp1 mode periodic weekly
    [PE_1-keychain-kforldp1] tcp-kind 180
    [PE_1-keychain-kforldp1] tcp-algorithm-id sha-256 8
    [PE_1-keychain-kforldp1] receive-tolerance 15
    [PE_1-keychain-kforldp1] key-id 1
    [PE_1-keychain-kforldp1-keyid-1] algorithm sha-256
    [PE_1-keychain-kforldp1-keyid-1] key-string cipher huaweiwork
    [PE_1-keychain-kforldp1-keyid-1] send-time day mon to thu
    [PE_1-keychain-kforldp1-keyid-1] receive-time day mon to thu
    [PE_1-keychain-kforldp1-keyid-1] quit
    [PE_1-keychain-kforldp1] key-id 2
    [PE_1-keychain-kforldp1-keyid-2] algorithm sha-256
    [PE_1-keychain-kforldp1-keyid-2] key-string cipher testpass
    [PE_1-keychain-kforldp1-keyid-2] send-time day fri to sun
    [PE_1-keychain-kforldp1-keyid-2] receive-time day fri to sun
    [PE_1-keychain-kforldp1-keyid-2] quit
    [PE_1-keychain-kforldp1] quit

    # 配置P。

    [P] keychain kforldp1 mode periodic weekly
    [P-keychain-kforldp1] tcp-kind 180
    [P-keychain-kforldp1] tcp-algorithm-id sha-256 8
    [P-keychain-kforldp1] receive-tolerance 15
    [P-keychain-kforldp1] key-id 1
    [P-keychain-kforldp1-keyid-1] algorithm sha-256
    [P-keychain-kforldp1-keyid-1] key-string cipher huaweiwork
    [P-keychain-kforldp1-keyid-1] send-time day mon to thu
    [P-keychain-kforldp1-keyid-1] receive-time day mon to thu
    [P-keychain-kforldp1-keyid-1] quit
    [P-keychain-kforldp1] key-id 2
    [P-keychain-kforldp1-keyid-2] algorithm sha-256
    [P-keychain-kforldp1-keyid-2] key-string cipher testpass
    [P-keychain-kforldp1-keyid-2] send-time day fri to sun
    [P-keychain-kforldp1-keyid-2] receive-time day fri to sun
    [P-keychain-kforldp1-keyid-2] quit
    [P-keychain-kforldp1] quit

  5. 配置PE_1与P的LDP Keychain认证

    # 配置PE_1。

    [PE_1] mpls ldp
    [PE_1-mpls-ldp] authentication key-chain peer 2.2.2.9 name kforldp1
    [PE_1-mpls-ldp] quit

    # 配置P。

    [P] mpls ldp
    [P-mpls-ldp] authentication key-chain peer 1.1.1.9 name kforldp1
    [P-mpls-ldp] quit

  6. 配置PE_2与P之间TCP应用程序的Keychain

    # 配置PE_2。

    [PE_2] keychain kforldp2 mode periodic weekly
    [PE_2-keychain-kforldp2] tcp-kind 180
    [PE_2-keychain-kforldp2] tcp-algorithm-id sha-256 8
    [PE_2-keychain-kforldp2] receive-tolerance 15
    [PE_2-keychain-kforldp2] key-id 1
    [PE_2-keychain-kforldp2-keyid-1] algorithm sha-256
    [PE_2-keychain-kforldp2-keyid-1] key-string cipher huaweiwork
    [PE_2-keychain-kforldp2-keyid-1] send-time day mon to thu
    [PE_2-keychain-kforldp2-keyid-1] receive-time day mon to thu
    [PE_2-keychain-kforldp2-keyid-1] quit
    [PE_2-keychain-kforldp2] key-id 2
    [PE_2-keychain-kforldp2-keyid-2] algorithm sha-256
    [PE_2-keychain-kforldp2-keyid-2] key-string cipher testpass
    [PE_2-keychain-kforldp2-keyid-2] send-time day fri to sun
    [PE_2-keychain-kforldp2-keyid-2] receive-time day fri to sun
    [PE_2-keychain-kforldp2-keyid-2] quit
    [PE_2-keychain-kforldp2] quit

    # 配置P。

    [P] keychain kforldp2 mode periodic weekly
    [P-keychain-kforldp2] tcp-kind 180
    [P-keychain-kforldp2] tcp-algorithm-id sha-256 8
    [P-keychain-kforldp2] receive-tolerance 15
    [P-keychain-kforldp2] key-id 1
    [P-keychain-kforldp2-keyid-1] algorithm sha-256
    [P-keychain-kforldp2-keyid-1] key-string cipher huaweiwork
    [P-keychain-kforldp2-keyid-1] send-time day mon to thu
    [P-keychain-kforldp2-keyid-1] receive-time day mon to thu
    [P-keychain-kforldp2-keyid-1] quit
    [P-keychain-kforldp2] key-id 2
    [P-keychain-kforldp2-keyid-2] algorithm sha-256
    [P-keychain-kforldp2-keyid-2] key-string cipher testpass
    [P-keychain-kforldp2-keyid-2] send-time day fri to sun
    [P-keychain-kforldp2-keyid-2] receive-time day fri to sun
    [P-keychain-kforldp2-keyid-2] quit
    [P-keychain-kforldp2] quit

  7. 配置PE_2与P的LDP Keychain认证

    # 配置PE_2。

    [PE_2] mpls ldp
    [PE_2-mpls-ldp] authentication key-chain peer 2.2.2.9 name kforldp2
    [PE_2-mpls-ldp] quit

    # 配置P。

    [P] mpls ldp
    [P-mpls-ldp] authentication key-chain peer 3.3.3.9 name kforldp2
    [P-mpls-ldp] quit

  8. 检查配置结果

    # 在P上执行命令display mpls ldp session verbose,可以看到P与PE_1、PE_2的LDP会话配置了LDP Keychain认证以及引用的Keychain名称。
    [P] display mpls ldp session verbose
    
    LDP Session(s) in Public Network
     ------------------------------------------------------------------------------
     Peer LDP ID     : 1.1.1.9:0          Local LDP ID   : 2.2.2.9:0
     TCP Connection  : 2.2.2.9 -> 1.1.1.9
     Session State   : Operational        Session Role   : Active
     Session FT Flag : Off                MD5 Flag       : Off
     Reconnect Timer : ---                Recovery Timer : ---
     Keychain Name   : kforldp1
     Authentication applied : Peer
    
     Negotiated Keepalive Hold Timer   : 45 Sec
     Configured Keepalive Send Timer   : ---
     Keepalive Message Sent/Rcvd       : 19/19 (Message Count)
     Label Advertisement Mode          : Downstream Unsolicited
     Label Resource Status(Peer/Local) : Available/Available
     Session Age                       : 0000:00:04 (DDDD:HH:MM)
     Session Deletion Status           : No
    
     Capability:
       Capability-Announcement         : Off 
       mLDP P2MP Capability            : Off
       mLDP MP2MP Capability           : Off
       mLDP MBB Capability             : Off 
    
     Outbound&Inbound Policies applied : NULL
    
     Addresses received from peer: (Count: 2)
     1.1.1.9             172.1.1.1
     ------------------------------------------------------------------------------
     Peer LDP ID     : 3.3.3.9:0          Local LDP ID   : 2.2.2.9:0
     TCP Connection  : 2.2.2.9 <- 3.3.3.9
     Session State   : Operational        Session Role   : Active
     Session FT Flag : Off                MD5 Flag       : Off
     Reconnect Timer : ---                Recovery Timer : ---
     Keychain Name   : kforldp2
     Authentication applied : Peer
    
     Negotiated Keepalive Hold Timer   : 45 Sec
     Configured Keepalive Send Timer   : ---
     Keepalive Message Sent/Rcvd       : 18/18 (Message Count)
     Label Advertisement Mode          : Downstream Unsolicited
     Label Resource Status(Peer/Local) : Available/Available
     Session Age                       : 0000:00:04 (DDDD:HH:MM)
     Session Deletion Status           : No
    
     Capability:
       Capability-Announcement         : Off 
       mLDP P2MP Capability            : Off
       mLDP MP2MP Capability           : Off
       mLDP MBB Capability             : Off 
    
     Outbound&Inbound Policies applied : NULL
    
     Addresses received from peer: (Count: 2)
     3.3.3.9             172.2.1.2
     ------------------------------------------------------------------------------ 

配置文件

  • PE_1的配置文件

    #
    sysname PE_1
    #
    vlan batch 100
    #
    mpls lsr-id 1.1.1.9 
    mpls
    #
    mpls ldp
     authentication key-chain peer 2.2.2.9 name kforldp1
    #
    keychain kforldp1 mode periodic weekly 
     receive-tolerance 15   
     tcp-kind 180    
     key-id 1       
      algorithm sha-256      
      key-string cipher %^%#RHk(LEvyUBmkls=i(>8L9i=M!}mM4FCvcuVu&@-G%^%#
      send-time day mon to thu    
      receive-time day mon to thu 
     key-id 2                      
      algorithm sha-256        
      key-string cipher %^%#="+W)uY+N$8',5Lhem%H4ZyT@h{24%Lm6A'HAnS!%^%#
      send-time day fri to sun
      receive-time day fri to sun
    #
    interface Vlanif100
     ip address 172.1.1.1 255.255.255.0
     mpls
     mpls ldp
    #
    interface GigabitEthernet1/0/1
     port link-type trunk 
     port trunk allow-pass vlan 100 
    #
    interface LoopBack1
     ip address 1.1.1.9 255.255.255.255
    #
    ospf 1
     area 0.0.0.0
      network 1.1.1.9 0.0.0.0
      network 172.1.1.0 0.0.0.255
    #
    return
  • P的配置文件

    #
    sysname P
    #
    vlan batch 100 200
    #
    mpls lsr-id 2.2.2.9
    mpls
    #
    mpls ldp
     authentication key-chain peer 1.1.1.9 name kforldp1
     authentication key-chain peer 3.3.3.9 name kforldp2
    #
    keychain kforldp1 mode periodic weekly 
     receive-tolerance 15 
     tcp-kind 180 
     key-id 1   
      algorithm sha-256 
      key-string cipher %^%#Se}$HiYed".qRuT,/=~2X47R:*Yl,Nx5&[8_p$kP%^%#
     send-time day mon to thu  
      receive-time day mon to thu 
     key-id 2   
      algorithm sha-256 
      key-string cipher %^%#vse|>n^<W6R&=p20J7*8'7'+KTBI8Rs_eX7#'Q_<%^%#
      send-time day fri to sun 
      receive-time day fri to sun 
    #
    keychain kforldp2 mode periodic weekly
     receive-tolerance 15
     tcp-kind 180
     key-id 1
      algorithm sha-256
      key-string cipher %^%#WTl)$zT5!X#LH[~.zr9Y@8k#<h"wF)pJLv"!U~A1%^%#
      send-time day mon to thu
      receive-time day mon to thu
     key-id 2
      algorithm sha-256
      key-string cipher %^%#:N6U5oq@^+,c0P/mh,OC&P}r3_L)~N8~2IXq5$iP%^%#
      send-time day fri to sun
      receive-time day fri to sun
    #
    interface Vlanif100
     ip address 172.1.1.2 255.255.255.0
     mpls
     mpls ldp
    #
    interface Vlanif200
     ip address 172.2.1.1 255.255.255.0
     mpls
     mpls ldp
    #
    interface GigabitEthernet1/0/1
     port link-type trunk 
     port trunk allow-pass vlan 100
    #
    interface GigabitEthernet2/0/2
     port link-type trunk 
     port trunk allow-pass vlan 200 
    #
    interface LoopBack1
     ip address 2.2.2.9 255.255.255.255
    #
    ospf 1
     area 0.0.0.0
      network 2.2.2.9 0.0.0.0
      network 172.1.1.0 0.0.0.255
      network 172.2.1.0 0.0.0.255
    #
    return
  • PE_2的配置文件

    #
    sysname PE_2
    #
    vlan batch 200
    #
    mpls lsr-id 3.3.3.9 
    mpls
    #
    mpls ldp
     authentication key-chain peer 2.2.2.9 name kforldp2
    #
    keychain kforldp2 mode periodic weekly 
     receive-tolerance 15   
     tcp-kind 180    
     key-id 1       
      algorithm sha-256      
      key-string cipher %^%#]~3=Y;alm>(cdcV<;`+O1}M`0Pd!GKCb#<9S+ovC%^%#
    
      send-time day mon to thu    
      receive-time day mon to thu 
     key-id 2                      
      algorithm sha-256        
      key-string cipher %^%#C$UBYKU7=,:(\iI_3dyH^C#5Trq~wRQc.3I$&Hj*%^%#
      send-time day fri to sun
      receive-time day fri to sun
    #
    interface Vlanif200
     ip address 172.2.1.2 255.255.255.0
     mpls
     mpls ldp
    #
    interface GigabitEthernet1/0/1
     port link-type trunk 
     port trunk allow-pass vlan 200 
    #
    interface LoopBack1
     ip address 3.3.3.9 255.255.255.255
    #
    ospf 1
     area 0.0.0.0
      network 3.3.3.9 0.0.0.0
      network 172.2.1.0 0.0.0.255
    #
    return
翻译
下载文档
更新时间:2019-08-20

文档编号:EDOC1000141521

浏览量:8766

下载量:344

平均得分:
本文档适用于这些产品
相关文档
相关版本
Share
上一页 下一页