配置Hub and Spoke示例（Hub-PE和Hub-CE单链路接入场景二）

NetEngine 8000 X V800R012C00SPC300 配置指南 - VPN 04

评分并提供意见反馈 :

华为采用机器翻译与人工审校相结合的方式将此文档翻译成不同语言，希望能帮助您更容易理解此文档的内容。请注意：即使是最好的机器翻译，其准确度也不及专业翻译人员的水平。华为对于翻译的准确性不承担任何责任，并建议您参考英文文档（已提供链接）。

Hub and Spoke是在VPN中设置中心访问控制设备，其它用户的互访都通过中心访问控制设备进行。

组网需求

如图7-29所示，Spoke-CE之间的通信通过中心站点Hub-CE控制，即Spoke-CE之间的流量经过Hub-CE转发，而不是只经过Hub-PE转发。同时Hub-PE和Hub-CE、Hub-PE和Spoke-CE3都是通过单链路接入。

图7-29 Hub and Spoke组网图（Hub-PE和Hub-CE单链路接入场景二）

本例中interface1、interface2、interface3、interface4分别代表GE1/0/0、GE2/0/0、GE3/0/0、4/0/0。

配置注意事项

在配置过程中，需注意以下事项：

Spoke-PE上配置的Import Target和Export Target应不同。
Hub-PE上创建一个VPN实例（vpnhub）。vpnhub接收的VPN-target团体属性为两个Spoke-PE发布的VPN-target团体属性值；vpnhub发布的VPN-target团体属性值与接收的VPN-target团体属性不同，且为两个Spoke-PE接收的VPN-target团体属性值。

配置思路

采用如下思路配置Hub and Spoke：

Hub-PE与Spoke-PE建立MP-IBGP对等体关系。（Spoke-PE之间不建立MP-IBGP对等体关系，不交换VPN路由信息）
PE上创建VPN实例，并在Hub-PE上配置pop-go功能。
CE和PE之间配置EBGP连接。其中Hub-CE上配置向Hub-PE发布缺省路由。

数据准备

为完成此配置例，需准备如下的数据：

PE上的MPLS LSR ID。
Hub-PE和Spoke-PE的VPN实例名、路由标志（Route-Distinguisher）及VPN-Target。

操作步骤

在骨干网上配置IGP协议，实现骨干网Hub-PE和Spoke-PE的互通
本例中采用OSPF，具体配置过程请参见后面的配置文件。

配置完成后，Hub-PE和Spoke-PE之间应能建立OSPF邻居关系，执行display ospf peer命令可以看到邻居状态为Full。执行display ip routing-table命令可以看到Hub-PE和Spoke-PE之间学习到对方的Loopback路由。
在骨干网上配置MPLS基本能力和MPLS LDP，建立LDP LSP
具体配置过程请参见后面的配置文件。

配置完成后，Hub-PE和Spoke-PE之间应该建立起LDP对等体关系，在各路由器上执行display mpls ldp session命令可以看到显示结果中Session State项为“Operational”。

在各PE设备上配置使能IPv4地址族的VPN实例，将CE接入PE

Hub-PE上其中一个VPN的Import-Target列表必须包含所有Spoke-PE的Export-Target属性。

Hub-PE上另一个VPN的Export-Target列表必须包含所有Spoke-PE的Import-Target属性。

# 配置Spoke-PE1。

<Spoke-PE1> system-view

[~Spoke-PE1] ip vpn-instance vpna

[*Spoke-PE1-vpn-instance-vpna] ipv4-family

[*Spoke-PE1-vpn-instance-vpna-af-ipv4] route-distinguisher 100:1

[*Spoke-PE1-vpn-instance-vpna-af-ipv4] vpn-target 100:1 export-extcommunity

[*Spoke-PE1-vpn-instance-vpna-af-ipv4] vpn-target 200:1 import-extcommunity

[*Spoke-PE1-vpn-instance-vpna-af-ipv4] quit

[*Spoke-PE1-vpn-instance-vpna] quit

[*Spoke-PE1] interface gigabitethernet 1/0/0

[*Spoke-PE1-GigabitEthernet1/0/0] ip binding vpn-instance vpna

[*Spoke-PE1-GigabitEthernet1/0/0] ip address 10.1.1.2 24

[*Spoke-PE1-GigabitEthernet1/0/0] commit

[~Spoke-PE1-GigabitEthernet1/0/0] quit

# 配置Spoke-PE2。

<Spoke-PE2> system-view

[~Spoke-PE2] ip vpn-instance vpna

[*Spoke-PE2-vpn-instance-vpna] ipv4-family

[*Spoke-PE2-vpn-instance-vpna-af-ipv4] route-distinguisher 100:3

[*Spoke-PE2-vpn-instance-vpna-af-ipv4] vpn-target 100:1 export-extcommunity

[*Spoke-PE2-vpn-instance-vpna-af-ipv4] vpn-target 200:1 import-extcommunity

[*Spoke-PE2-vpn-instance-vpna-af-ipv4] quit

[*Spoke-PE2] interface gigabitethernet 1/0/0

[*Spoke-PE2-GigabitEthernet1/0/0] ip binding vpn-instance vpna

[*Spoke-PE2-GigabitEthernet1/0/0] ip address 10.4.1.2 24

[*Spoke-PE2-GigabitEthernet1/0/0] commit

[~Spoke-PE2-GigabitEthernet1/0/0] quit

# 配置Hub-PE。

<Hub-PE> system-view

[~Hub-PE] ip ip-prefix defaultip index 10 permit 0.0.0.0 0

[*Hub-PE] route-policy policy_in permit node 1

[*Hub-PE-route-policy] if-match ip-prefix defaultip

[*Hub-PE-route-policy] quit

[*Hub-PE] route-policy policy_in deny node 2

[*Hub-PE-route-policy] quit

[*Hub-PE] ip vpn-instance vpnhub

[*Hub-PE-vpn-instance-vpnhub] ipv4-family

[*Hub-PE-vpn-instance-vpnhub-af-ipv4] route-distinguisher 100:21

[*Hub-PE-vpn-instance-vpnhub-af-ipv4] export route-policy policy_in

[*Hub-PE-vpn-instance-vpnhub-af-ipv4] vpn-target 200:1 export-extcommunity

[*Hub-PE-vpn-instance-vpnhub-af-ipv4] vpn-target 100:1 import-extcommunity

[*Hub-PE-vpn-instance-vpnhub-af-ipv4] apply-label per-route pop-go

[*Hub-PE-vpn-instance-vpnhub-af-ipv4] quit

[*Hub-PE-vpn-instance-vpnhub] quit

[*Hub-PE] interface gigabitethernet 3/0/0

[*Hub-PE-GigabitEthernet3/0/0] ip binding vpn-instance vpnhub

[*Hub-PE-GigabitEthernet3/0/0] ip address 10.2.1.2 24

[*Hub-PE-GigabitEthernet3/0/0] quit

[*Hub-PE] ip vpn-instance vpna

[*Hub-PE-vpn-instance-vpna] ipv4-family

[*Hub-PE-vpn-instance-vpna-af-ipv4] route-distinguisher 100:3

[*Hub-PE-vpn-instance-vpna-af-ipv4] vpn-target 100:1 export-extcommunity

[*Hub-PE-vpn-instance-vpna-af-ipv4] vpn-target 200:1 import-extcommunity

[*Hub-PE-vpn-instance-vpna-af-ipv4] quit

[*Hub-PE] interface gigabitethernet 4/0/0

[*Hub-PE-GigabitEthernet4/0/0] ip binding vpn-instance vpna

[*Hub-PE-GigabitEthernet4/0/0] ip address 10.3.1.2 24

[*Hub-PE-GigabitEthernet4/0/0] commit

[~Hub-PE-GigabitEthernet4/0/0] quit

# 按图7-29配置各CE的接口IP地址，配置过程请参见后面的配置文件。

配置完成后，在PE设备上执行display ip vpn-instance verbose命令可以看到VPN实例的配置情况。各PE能用ping -vpn-instance vpn-name ip-address 命令ping通自己接入的CE。

当PE上有多个绑定了同一个VPN的接口，则使用ping -vpn-instance 命令ping对端PE接入的CE时，要指定源IP地址，即要指定ping -vpn-instance vpn-instance-name -a source-ip-address dest-ip-address命令中的参数-a source-ip-address，否则可能ping不通。

在PE与CE之间建立EBGP对等体关系，引入VPN路由

# 配置Spoke-CE1。

[~Spoke-CE1] interface loopback 1

[*Spoke-CE1-Loopback1] ip address 11.11.11.11 32

[*Spoke-CE1-Loopback1] quit

[*Spoke-CE1] bgp 65410

[*Spoke-CE1-bgp] peer 10.1.1.2 as-number 100

[*Spoke-CE1-bgp] network 11.11.11.11 32

[*Spoke-CE1-bgp] quit

[*Spoke-CE1] commit

# 配置Spoke-PE1。

[~Spoke-PE1] bgp 100

[*Spoke-PE1-bgp] ipv4-family vpn-instance vpna

[*Spoke-PE1-bgp-vpna] peer 10.1.1.1 as-number 65410

[*Spoke-PE1-bgp-vpna] commit

[~Spoke-PE1-bgp-vpna] quit

[~Spoke-PE1-bgp] quit

# 配置Spoke-CE2。

[~Spoke-CE2] interface loopback 1

[*Spoke-CE2-Loopback1] ip address 22.22.22.22 32

[*Spoke-CE2-Loopback1] quit

[*Spoke-CE2] bgp 65420

[*Spoke-CE2-bgp] peer 10.4.1.2 as-number 100

[*Spoke-CE2-bgp] network 22.22.22.22 32

[*Spoke-CE2-bgp] commit

[~Spoke-CE2-bgp] quit

# 配置Spoke-PE2。

[~Spoke-PE2] bgp 100

[*Spoke-PE2-bgp] ipv4-family vpn-instance vpna

[*Spoke-PE2-bgp-vpna] peer 10.4.1.1 as-number 65420

[*Spoke-PE2-bgp-vpna] commit

[~Spoke-PE2-bgp-vpna] quit

[~Spoke-PE2-bgp] quit

# 配置Hub-CE。

[~Hub-CE] interface loopback 1

[*Hub-CE-Loopback1] ip address 33.33.33.33 32

[*Hub-CE-Loopback1] quit

[*Hub-CE] bgp 65430

[*Hub-CE-bgp] peer 10.2.1.2 as-number 100

[*Hub-CE-bgp] peer 10.2.1.2 default-route-advertis

[*Hub-CE-bgp] network 33.33.33.33 32

[*Hub-CE-bgp] quit

[*Hub-CE] commit

# 配置Hub-PE。

[~Hub-PE] bgp 100

[*Hub-PE-bgp] ipv4-family vpn-instance vpnhub

[*Hub-PE-bgp-vpnhub] peer 10.2.1.1 as-number 65430

[*Hub-PE-bgp-vpnhub] quit

[*Hub-PE-bgp] ipv4-family vpn-instance vpna

[*Hub-PE-bgp-vpna] peer 10.3.1.1 as-number 65440

[*Hub-PE-bgp-vpna] quit

[*Hub-PE-bgp] commit

[~Hub-PE-bgp] quit

配置完成后，在各PE设备上执行display bgp vpnv4 all peer命令，可以看到PE与CE之间的BGP对等体关系已建立，并达到Established状态。

在PE之间建立MP-IBGP对等体关系

# 配置Spoke-PE1。

[~Spoke-PE1] bgp 100

[~Spoke-PE1-bgp] peer 2.2.2.9 as-number 100

[*Spoke-PE1-bgp] peer 2.2.2.9 connect-interface loopback 1

[*Spoke-PE1-bgp] ipv4-family vpnv4

[*Spoke-PE1-bgp-af-vpnv4] peer 2.2.2.9 enable

[*Spoke-PE1-bgp-af-vpnv4] commit

[~Spoke-PE1-bgp-af-vpnv4] quit

# 配置Spoke-PE2。

[~Spoke-PE2] bgp 100

[~Spoke-PE2-bgp] peer 2.2.2.9 as-number 100

[*Spoke-PE2-bgp] peer 2.2.2.9 connect-interface loopback 1

[*Spoke-PE2-bgp] ipv4-family vpnv4

[*Spoke-PE2-bgp-af-vpnv4] peer 2.2.2.9 enable

[*Spoke-PE2-bgp-af-vpnv4] commit

[~Spoke-PE2-bgp-af-vpnv4] quit

# 配置Hub-PE。

[~Hub-PE] bgp 100

[~Hub-PE-bgp] peer 1.1.1.9 as-number 100

[*Hub-PE-bgp] peer 1.1.1.9 connect-interface loopback 1

[*Hub-PE-bgp] peer 3.3.3.9 as-number 100

[*Hub-PE-bgp] peer 3.3.3.9 connect-interface loopback 1

[*Hub-PE-bgp] ipv4-family vpnv4

[*Hub-PE-bgp-af-vpnv4] peer 1.1.1.9 enable

[*Hub-PE-bgp-af-vpnv4] peer 3.3.3.9 enable

[*Hub-PE-bgp-af-vpnv4] commit

[~Hub-PE-bgp-af-vpnv4] quit

配置完成后，在各PE设备上执行display bgp peer或display bgp vpnv4 all peer命令，可以看到PE之间的BGP对等体关系已建立，并达到Established状态。

检查配置结果

完成上述配置后，Spoke-CE之间可以相互Ping通。

以Spoke-CE1的显示为例：

<Spoke-CE1> ping -a 11.11.11.11 22.22.22.22

  PING 22.22.22.22: 56  data bytes, press CTRL_C to break

    Reply from 22.22.22.22: bytes=56 Sequence=1 ttl=250 time=80 ms

    Reply from 22.22.22.22: bytes=56 Sequence=2 ttl=250 time=129 ms

    Reply from 22.22.22.22: bytes=56 Sequence=3 ttl=250 time=132 ms

    Reply from 22.22.22.22: bytes=56 Sequence=4 ttl=250 time=92 ms

    Reply from 22.22.22.22: bytes=56 Sequence=5 ttl=250 time=126 ms

  --- 22.22.22.22 ping statistics ---

    5 packet(s) transmitted

    5 packet(s) received

    0.00% packet loss

    round-trip min/avg/max = 80/111/132 ms

在Spoke-CE上执行display bgp routing-table命令，可以看到Spoke-CE的BGP路由表。

以Spoke-CE1的显示为例：

<Spoke-CE1> display bgp routing-table

 
 BGP Local router ID is 10.1.1.1
 Status codes: * - valid, > - best, d - damped, x - best external, a - add path,
               h - history,  i - internal, s - suppressed, S - Stale
               Origin : i - IGP, e - EGP, ? - incomplete
 RPKI validation codes: V - valid, I - invalid, N - not-found


 Total Number of Routes: 2 
        Network            NextHop                       MED        LocPrf    PrefVal Path/Ogn

 *>     0.0.0.0/0          10.1.1.2                                             0      100 65430i
 *>     11.11.11.11/32     0.0.0.0                        0                     0       i

配置文件

Spoke-CE1的配置文件

#
sysname Spoke-CE1
#
interface GigabitEthernet1/0/0
 undo shutdown
 ip address 10.1.1.1 255.255.255.0
#
interface LoopBack1
 ip address 11.11.11.11 255.255.255.255
#
bgp 65410
 peer 10.1.1.2 as-number 100
 #
 ipv4-family unicast
  undo synchronization
  network 11.11.11.11 255.255.255.255
  peer 10.1.1.2 enable
#
return

Spoke-PE1的配置文件

#
sysname Spoke-PE1
#
ip vpn-instance vpna
 ipv4-family
  route-distinguisher 100:1
  apply-label per-instance
  vpn-target 100:1 export-extcommunity
  vpn-target 200:1 import-extcommunity
#
mpls lsr-id 1.1.1.9
#
mpls
#               
mpls ldp
#
interface GigabitEthernet1/0/0
 undo shutdown
 ip binding vpn-instance vpna
 ip address 10.1.1.2 255.255.255.0
#
interface GigabitEthernet2/0/0
 undo shutdown
 ip address 20.1.1.1 255.255.255.0
 mpls
 mpls ldp
#
interface LoopBack1
 ip address 1.1.1.9 255.255.255.255
#
bgp 100
 peer 2.2.2.9 as-number 100
 peer 2.2.2.9 connect-interface LoopBack1
 #
 ipv4-family unicast
  undo synchronization
  peer 2.2.2.9 enable
 #
 ipv4-family vpnv4
  policy vpn-target
  peer 2.2.2.9 enable
 #
 ipv4-family vpn-instance vpna
  peer 10.1.1.1 as-number 65410
#
ospf 1
 area 0.0.0.0
  network 1.1.1.9 0.0.0.0
  network 20.1.1.0 0.0.0.255
#               
return

Spoke-PE2的配置文件

#
sysname Spoke-PE2
#
ip vpn-instance vpna
 ipv4-family
  route-distinguisher 100:3
  apply-label per-instance
  vpn-target 100:1 export-extcommunity
  vpn-target 200:1 import-extcommunity
#
mpls lsr-id 3.3.3.9
#
mpls
#               
mpls ldp
#
interface GigabitEthernet1/0/0
 undo shutdown
 ip binding vpn-instance vpna
 ip address 10.4.1.2 255.255.255.0
#
interface GigabitEthernet2/0/0
 undo shutdown
 ip address 11.1.1.1 255.255.255.0
 mpls
 mpls ldp
#
interface LoopBack1
 ip address 3.3.3.9 255.255.255.255
#
bgp 100
 peer 2.2.2.9 as-number 100
 peer 2.2.2.9 connect-interface LoopBack1
 #
 ipv4-family unicast
  undo synchronization
  peer 2.2.2.9 enable
 #
 ipv4-family vpnv4
  policy vpn-target
  peer 2.2.2.9 enable
 #
 ipv4-family vpn-instance vpna
  peer 10.4.1.1 as-number 65420
#
ospf 1
 area 0.0.0.0
  network 3.3.3.9 0.0.0.0
  network 11.1.1.0 0.0.0.255
#               
return

Spoke-CE2的配置文件

#
sysname Spoke-CE2
#
interface GigabitEthernet1/0/0
 undo shutdown
 ip address 10.4.1.1 255.255.255.0
#
interface LoopBack1
 ip address 22.22.22.22 255.255.255.255
#
bgp 65420
 peer 10.4.1.2 as-number 100
 #
 ipv4-family unicast
  undo synchronization
  network 22.22.22.22 255.255.255.255
  peer 10.4.1.2 enable
#
return

Spoke-CE3的配置文件

# 
sysname Spoke-CE3
#
interface GigabitEthernet1/0/0
 undo shutdown
 ip address 10.3.1.1 255.255.255.0
#
interface Loopback 1
 undo shutdown
 ip address 44.44.44.44 255.255.255.255
#
bgp 65440
 peer 10.3.1.2 as-number 100
 #
 ipv4-family unicast
  network 44.44.44.44 255.255.255.255
  undo synchronization
  peer 10.3.1.2 enable
#
return

Hub-CE的配置文件

#
sysname Hub-CE
#
interface GigabitEthernet1/0/0
 undo shutdown
 ip address 10.2.1.1 255.255.255.0
#
interface LoopBack1
 ip address 33.33.33.33 255.255.255.255
#
bgp 65430
 peer 10.2.1.2 as-number 100
 #
 ipv4-family unicast
  undo synchronization
  network 33.33.33.33 255.255.255.255
  peer 10.2.1.2 enable
  peer 10.2.1.2 default-route-advertise
#               
return

Hub-PE的配置文件

#
sysname Hub-PE
#
ip vpn-instance vpna
 ipv4-family
  route-distinguisher 100:3
  apply-label per-instance
  vpn-target 100:1 export-extcommunity
  vpn-target 200:1 import-extcommunity
#
ip vpn-instance vpnhub
 ipv4-family
  route-distinguisher 100:21
  export route-policy policy_in
  apply-label per-route pop-go
  vpn-target 200:1 export-extcommunity
  vpn-target 100:1 import-extcommunity
#
mpls lsr-id 2.2.2.9
#               
mpls
#
mpls ldp
#
interface GigabitEthernet1/0/0
 undo shutdown
 ip address 20.1.1.2 255.255.255.0
 mpls
 mpls ldp
#
interface GigabitEthernet2/0/0
 undo shutdown
 ip address 11.1.1.2 255.255.255.0
 mpls           
 mpls ldp
#
interface GigabitEthernet3/0/0
 undo shutdown
 ip binding vpn-instance vpnhub
 ip address 10.2.1.2 255.255.255.0
#
interface GigabitEthernet4/0/0
 undo shutdown
 ip binding vpn-instance vpna
 ip address 10.3.1.2 255.255.255.0
#
interface LoopBack1
 ip address 2.2.2.9 255.255.255.255
#
bgp 100
 peer 1.1.1.9 as-number 100
 peer 1.1.1.9 connect-interface LoopBack1
 peer 3.3.3.9 as-number 100
 peer 3.3.3.9 connect-interface LoopBack1
 #
 ipv4-family unicast
  undo synchronization
  peer 1.1.1.9 enable
  peer 3.3.3.9 enable
 #
 ipv4-family vpnv4
  policy vpn-target
  peer 1.1.1.9 enable
  peer 3.3.3.9 enable
 #              
 ipv4-family vpn-instance vpna
  peer 10.3.1.1 as-number 65440
 ipv4-family vpn-instance vpnhub
  peer 10.2.1.1 as-number 65430
#
ospf 1
 area 0.0.0.0
  network 2.2.2.9 0.0.0.0
  network 11.1.1.0 0.0.0.255
  network 20.1.1.0 0.0.0.255
#               
route-policy policy_in permit node 1
 if-match ip-prefix defaultip
#
route-policy policy_in deny node 2
#
ip ip-prefix defaultip index 10 permit 0.0.0.0 0
#
return

翻译

English

下载文档

更新时间：2020-06-20

文档编号：EDOC1100143312

浏览量：60918

下载量：128

平均得分:

本文档适用于这些产品

组网需求

配置注意事项

配置思路

数据准备

操作步骤

配置文件

相关版本

相关文档