配置IPv6路由和VPNv6路由混合FRR示例
CE双归组网中,PE上配置混合FRR可以保护PE去往CE的链路,当PE向CE转发不通时,流量可以通过PE-PE-CE的路径到达。
组网需求
IPv6 VPN站点的CE双归到不同的PE,且PE之间建立了VPNv6对等体的情况下,为了保护其中的一条PE-CE链路,可以配置IPv6路由和VPNv6路由的混合FRR。
配置IPv6路由和VPNv6路由混合FRR后,当PE向CE出现转发故障时流量能够迅速切换到备份下一跳PE上。
IPv6路由和VPNv6路由混合FRR,只适用于CE采用BGP方式接入PE的组网中。
如图8-23所示,CE双归属到PE2和PE3,PE2和PE3之间部署MPLS公网隧道并建立了VPNv6邻居。PE2-CE、PE3-CE之间均EBGP方式交换路由。PE3上从CE学到了去往CE的Loopback1的路由,并向其他的VPNv6对等体发送。这样PE2上将有两条去往CE的Loopback1的BGP路由:其中一条是CE通过EBGP协议发来的,另一条是PE3通过MP-IBGP发来的。
现在要求在PE2上进行适当的配置,使得PE2优选从CE发来的EBGP路由,而从PE3上发来的VPNv6路由作为备份路由。当PE2-CE之间的链路出现转发故障时,PE2上去往CE的流量切换到备份下一跳PE3上。
配置注意事项
VPN 混合FRR场景,主路径故障恢复后,会进行路径回切。在这个过程中,可能由于各个节点IGP收敛时序不同,造成回切丢包。为了解决这个问题,需要执行route-select delay delay-value命令,配置选路延迟功能,保证在主路径设备上的转发表项刷新稳定后再进行回切。具体的回切延迟时间delay-value与设备上实际路由数量等因素有关,用户需要根据实际情况合理配置。
配置思路
采用如下的思路配置
在MPLS骨干网上(PE1/PE2/PE3)配置OSPF,实现骨干网互通
MPLS骨干网上配置MPLS基本能力,并使能MPLS LDP,建立LDP LSP
各PE之间建立MP-IBGP对等体,也包括PE2和PE3之间
在PE设备上配置支持IPv6地址族的VPN实例,将CE接入PE2和PE3
PE与CE之间建立EBGP对等体关系,CE引入Loopback接口路由到BGP中
PE2的BGP VPN实例IPv6地址族下配置Auto FRR功能,实现从PE3上发来的VPNv6路由作为备份路由
操作步骤
- 配置VPN骨干网各接口的IP地址和VPN site中各接口的IPv6地址(略)
- 在MPLS骨干网上配置OSPF协议,实现骨干网PE互通(略)
- 在MPLS骨干网上配置MPLS基本能力和MPLS LDP,建立LDP LSP
# 配置PE1。
<PE1> system-view
[~PE1] mpls lsr-id 1.1.1.1
[*PE1] mpls
[*PE1-mpls] quit
[*PE1] mpls ldp
[*PE1-mpls-ldp] quit
[*PE1] interface gigabitEthernet2/0/0
[*PE1-GigabitEthernet2/0/0] mpls
[*PE1-GigabitEthernet2/0/0] mpls ldp
[*PE1-GigabitEthernet2/0/0] quit
[*PE1] interface gigabitEthernet3/0/0
[*PE1-GigabitEthernet3/0/0] mpls
[*PE1-GigabitEthernet3/0/0] mpls ldp
[*PE1-GigabitEthernet3/0/0] quit
[*PE1] commit
# 配置PE2。
<PE2> system-view
[~PE2] mpls lsr-id 2.2.2.2
[*PE2] mpls
[*PE2-mpls] quit
[*PE2] mpls ldp
[*PE2-mpls-ldp] quit
[*PE2] interface gigabitEthernet1/0/0
[*PE2-GigabitEthernet1/0/0] mpls
[*PE2-GigabitEthernet1/0/0] mpls ldp
[*PE2-GigabitEthernet1/0/0] quit
[*PE2] interface gigabitEthernet3/0/0
[*PE2-GigabitEthernet3/0/0] mpls
[*PE2-GigabitEthernet3/0/0] mpls ldp
[*PE2-GigabitEthernet3/0/0] quit
[*PE2] commit
# 配置PE3。
<PE3> system-view
[~PE3] mpls lsr-id 3.3.3.3
[*PE3] mpls
[*PE3-mpls] quit
[*PE3] mpls ldp
[*PE3-mpls-ldp] quit
[*PE3] interface gigabitEthernet1/0/0
[*PE3-GigabitEthernet1/0/0] mpls
[*PE3-GigabitEthernet1/0/0] mpls ldp
[*PE3-GigabitEthernet1/0/0] quit
[*PE3] interface gigabitEthernet3/0/0
[*PE3-GigabitEthernet3/0/0] mpls
[*PE3-GigabitEthernet3/0/0] mpls ldp
[*PE3-GigabitEthernet3/0/0] quit
[*PE3] commit
此时在PE上执行命令display mpls lsp,可看到PE1与PE2、PE1与PE3之间的LSP建立成功。以PE1的显示为例:
[*PE1] display mpls lsp
----------------------------------------------------------------------
LSP Information: LDP LSP
----------------------------------------------------------------------
FEC In/Out Label In/Out IF Vrf Name
2.2.2.2/32 NULL/3 -/GE2/0/0
2.2.2.2/32 1024/3 -/GE2/0/0
3.3.3.3/32 NULL/3 -/GE3/0/0
3.3.3.3/32 1025/3 -/GE3/0/0
- 在PE之间建立MP-IBGP对等体
# 配置PE1。
[~PE1] bgp 100
[*PE1-bgp] peer 2.2.2.2 as-number 100
[*PE1-bgp] peer 2.2.2.2 connect-interface loopback 1
[*PE1-bgp] peer 3.3.3.3 as-number 100
[*PE1-bgp] peer 3.3.3.3 connect-interface loopback 1
[*PE1-bgp] ipv6-family vpnv6
[*PE1-bgp-af-vpnv6] peer 2.2.2.2 enable
[*PE1-bgp-af-vpnv6] peer 3.3.3.3 enable
[*PE1-bgp-af-vpnv6] quit
[*PE1-bgp] quit
[*PE1] commit
# 配置PE2。
[~PE2] bgp 100
[*PE2-bgp] peer 1.1.1.1 as-number 100
[*PE2-bgp] peer 1.1.1.1 connect-interface loopback 1
[*PE2-bgp] peer 3.3.3.3 as-number 100
[*PE2-bgp] peer 3.3.3.3 connect-interface loopback 1
[*PE2-bgp] ipv6-family vpnv6
[*PE2-bgp-af-vpnv6] peer 1.1.1.1 enable
[*PE2-bgp-af-vpnv6] peer 3.3.3.3 enable
[*PE2-bgp-af-vpnv6] quit
[*PE2-bgp] quit
[*PE2] commit
# 配置PE3。
[~PE3] bgp 100
[*PE3-bgp] peer 1.1.1.1 as-number 100
[*PE3-bgp] peer 1.1.1.1 connect-interface loopback 1
[*PE3-bgp] peer 2.2.2.2 as-number 100
[*PE3-bgp] peer 2.2.2.2 connect-interface loopback 1
[*PE3-bgp] ipv6-family vpnv6
[*PE3-bgp-af-vpnv6] peer 1.1.1.1 enable
[*PE3-bgp-af-vpnv6] peer 2.2.2.2 enable
[*PE3-bgp-af-vpnv6] quit
[*PE3-bgp] quit
[*PE3] commit
完成此步骤后,在PE上执行display bgp vpnv6 all peer命令,可看到MP-IBGP对等体建立成功,其状态为“Established”。
以PE1的显示为例:
[~PE1] display bgp vpnv6 all peer
BGP local router ID : 1.1.1.1
Local AS number : 100
Total number of peers : 2 Peers in established state : 2
Peer V AS MsgRcvd MsgSent OutQ Up/Down State PrefRcv
2.2.2.2 4 100 20 17 0 00:13:26 Established 5
3.3.3.3 4 100 24 19 0 00:17:18 Established 5
- 在PE设备上配置支持IPv6地址族的VPN实例,将CE接入PE2和PE3
# 配置PE1。
[~PE1] ip vpn-instance vpn1
[*PE1-vpn-instance-vpn1] ipv6-family
[*PE1-vpn-instance-vpn1-af-ipv6] route-distinguisher 100:1
[*PE1-vpn-instance-vpn1-af-ipv6] vpn-target 111:1
[*PE1-vpn-instance-vpn1-af-ipv6] quit
[*PE1-vpn-instance-vpn1] quit
[*PE1] commit
# 配置PE2。
[~PE2] ip vpn-instance vpn1
[*PE2-vpn-instance-vpn1] ipv6-family
[*PE2-vpn-instance-vpn1-af-ipv6] route-distinguisher 100:2
[*PE2-vpn-instance-vpn1-af-ipv6] vpn-target 111:1
[*PE2-vpn-instance-vpn1-af-ipv6] quit
[*PE2-vpn-instance-vpn1] quit
[*PE2] interface gigabitethernet2/0/0
[*PE2-GigabitEthernet2/0/0] ip binding vpn-instance vpn1
[*PE2-GigabitEthernet2/0/0] ipv6 enable
[*PE2-GigabitEthernet2/0/0] ipv6 address 2001:db8:1::2 64
[*PE2-GigabitEthernet2/0/0] quit
[*PE2] commit
# 配置PE3。
[~PE3] ip vpn-instance vpn1
[*PE3-vpn-instance-vpn1] ipv6-family
[*PE3-vpn-instance-vpn1-af-ipv6] route-distinguisher 100:3
[*PE3-vpn-instance-vpn1-af-ipv6] vpn-target 111:1
[*PE3-vpn-instance-vpn1-af-ipv6] quit
[*PE3-vpn-instance-vpn1] quit
[*PE3] interface gigabitethernet2/0/0
[*PE3-GigabitEthernet2/0/0] ip binding vpn-instance vpn1
[*PE3-GigabitEthernet2/0/0] ipv6 enable
[*PE3-GigabitEthernet2/0/0] ipv6 address 2001:db8:3::2 64
[*PE3-GigabitEthernet2/0/0] quit
[*PE3] commit
- PE2、PE3与CE之间配置EBGP对等体关系,并将CE上的Loopback接口路由引入到BGP中
# 配置PE2。
[~PE2] bgp 100
[*PE2-bgp] ipv6-family vpn-instance vpn1
[*PE2-bgp6-vpn1] peer 2001:db8:1::1 as-number 65410
[*PE2-bgp6-vpn1] quit
[*PE2-bgp] quit
[*PE2] commit
# 配置PE3。
[~PE3] bgp 100
[*PE3-bgp] ipv6-family vpn-instance vpn1
[*PE3-bgp6-vpn1] peer 2001:db8:3::1 as-number 65410
[*PE3-bgp6-vpn1] quit
[*PE3-bgp] quit
[*PE3] commit
# 配置CE
[~CE] bgp 65410
[*CE-bgp] router-id 10.10.10.10
[*CE-bgp] peer 2001:db8:1::2 as-number 100
[*CE-bgp] peer 2001:db8:3::2 as-number 100
[*CE-bgp] ipv6-family unicast
[*CE-bgp-af-ipv6] peer 2001:db8:1::2 enable
[*CE-bgp-af-ipv6] peer 2001:db8:3::2 enable
[*CE-bgp-af-ipv6] network 2001:db8:0:1:2::1 128
[*CE-bgp-af-ipv6] quit
[*CE-bgp] quit
[*CE] commit
配置完成后,PE2上运行命令display ipv6 routing-table vpn-instance,可以看到去往CE的Loopback接口的路由。<PE2> display ipv6 routing-table vpn-instance vpn1 2001:db8:0:1:2::1 128 Routing Table : vpn1 Summary Count : 1 Destination : 2001:db8:0:1:2::1 PrefixLength : 128 NextHop : 2001:db8:1::1 Preference : 255 Cost : 0 Protocol : EBGP RelayNextHop : 2001:db8:1::1 TunnelID : 0x0 Interface : GigabitEthernet2/0/0 Flags : RD
- PE2上配置VPNv6 Auto FRR功能,并调整EBGP路由的优先级,使PE2优选EBGP路由
# 配置PE2。
[~PE2] bgp 100
[~PE2-bgp] ipv6-family vpn-instance vpn1
[*PE2-bgp6-vpn1] preference 100 255 255
[*PE2-bgp6-vpn1] auto-frr
[*PE2-bgp6-vpn1] route-select delay 300
[*PE2-bgp6-vpn1] quit
[*PE2-bgp] quit
[*PE2] commit
- 检查配置结果
以上配置完成后,PE2上执行命令display ipv6 routing-table vpn-instance verbose,可以查看VPN实例IPv6地址族路由表中到CE的Loopback接口的主备路由信息。因为EBGP路由的优先级要比IBGP路由的优先级高,所以PE2上会优选从CE发来的EBGP路由,从PE3上发来的IBGP路由作为备份路由。显示信息中加粗字体是备份路由的下一跳、备份标签和备份Tunnel ID信息,表明混合FRR表项生成。
<PE2> display ipv6 routing-table vpn-instance vpn1 2001:db8:0:1:2::1 verbose Routing Table : vpn1 Summary Count : 1 Destination : 2001:db8:0:1:2::1 PrefixLength : 128 NextHop : 2001:db8:1::1 Preference : 100 Neighbour : :: ProcessID : 0 Label : NULL Protocol : BGP State : Active Adv Relied Cost : 0 Entry ID : 14 EntryFlags : 0x00000000 Reference Cnt: 0 Tag : 0 IndirectID : 0x8a9 Age : 3sec RelayNextHop : 2001:db8:1::1 TunnelID : 0x0 Interface : GigabitEthernet2/0/0 Flags : RD BkNextHop : :: BkInterface : LDP LSP BkLabel : 17 BkTunnelID : 0x0 BkPETunnelID : 0x0000000001004c4b44 BkIndirectID : 0xae
PE2的GE2/0/0接口下执行命令shutdown,然后再执行display ipv6 routing-table vpn-instance verbose命令,可以发现PE2到CE上Loopback接口路由的下一跳切换到PE3上。
<PE2> display ipv6 routing-table vpn-instance vpn1 2001:db8:0:1:2::1 verbose Routing Table : vpn1 Summary Count : 1 Destination : 2001:db8::0:1:2::1 PrefixLength : 128 NextHop : ::FFFF:3.3.3.3 Preference : 255 Neighbour : :: ProcessID : 0 Label : 17 Protocol : BGP State : Active Adv Relied Cost : 0 Entry ID : 0 EntryFlags : 0x00000000 Reference Cnt: 0 Tag : 0 IndirectID : 0xa5 Age : 9sec RelayNextHop : :: TunnelID : 0x0000000001004c4b42 Interface : GigabitEthernet2/0/0 Flags : RD
综合以上显示信息可知,PE2上IPv6路由和VPNv6路由的FRR已经生效。
配置文件
PE1的配置文件
#
sysname PE1
#
ip vpn-instance vpn1
ipv6-family
route-distinguisher 100:1
apply-label per-instance
vpn-target 111:1 export-extcommunity
vpn-target 111:1 import-extcommunity
#
mpls lsr-id 1.1.1.1
#
mpls
#
mpls ldp
#
interface GigabitEthernet2/0/0
undo shutdown
ip address 10.10.1.1 255.255.255.252
mpls
mpls ldp
#
interface GigabitEthernet3/0/0
undo shutdown
ip address 10.20.1.1 255.255.255.252
mpls
mpls ldp
#
interface LoopBack1
ip address 1.1.1.1 255.255.255.255
#
bgp 100
peer 2.2.2.2 as-number 100
peer 2.2.2.2 connect-interface LoopBack1
peer 3.3.3.3 as-number 100
peer 3.3.3.3 connect-interface LoopBack1
#
ipv4-family unicast
undo synchronization peer 2.2.2.2 enable
peer 3.3.3.3 enable
#
ipv6-family vpnv6
policy vpn-target
peer 2.2.2.2 enable
peer 3.3.3.3 enable
#
ipv6-family vpn-instance vpn1
import-route direct
#
ospf 1
area 0.0.0.0
network 10.10.1.0 0.0.0.3
network 10.20.1.0 0.0.0.3
network 1.1.1.1 0.0.0.0
#
return
PE2的配置文件
#
sysname PE2
#
ip vpn-instance vpn1
ipv6-family
route-distinguisher 100:2
apply-label per-instance
vpn-target 111:1 export-extcommunity
vpn-target 111:1 import-extcommunity
#
mpls lsr-id 2.2.2.2
#
mpls
#
mpls ldp
#
interface GigabitEthernet1/0/0
undo shutdown
ip address 10.10.1.2 255.255.255.252
mpls
mpls ldp
#
interface GigabitEthernet2/0/0
undo shutdown
ipv6 enable
ip binding vpn-instance vpn1
ipv6 address 2001:db8:1::2/64
#
interface GigabitEthernet3/0/0
undo shutdown
ip address 10.11.1.1 255.255.255.252
mpls
mpls ldp
#
interface LoopBack1
ip address 2.2.2.2 255.255.255.255
#
bgp 100
peer 1.1.1.1 as-number 100
peer 1.1.1.1 connect-interface LoopBack1
peer 3.3.3.3 as-number 100
peer 3.3.3.3 connect-interface LoopBack1
#
ipv4-family unicast
undo synchronization peer 1.1.1.1 enable
peer 3.3.3.3 enable
#
ipv6-family vpnv6
policy vpn-target
peer 1.1.1.1 enable
peer 3.3.3.3 enable
#
ipv6-family vpn-instance vpn1
preference 100 255 255
auto-frr
route-select delay 300
peer 2001:db8:1::1 as-number 65410
#
ospf 1
area 0.0.0.0
network 10.10.1.0 0.0.0.3
network 10.11.1.0 0.0.0.3
network 2.2.2.2 0.0.0.0
#
return
PE3的配置文件
#
sysname PE3
#
ip vpn-instance vpn1
ipv6-family
route-distinguisher 100:3
apply-label per-instance
vpn-target 111:1 export-extcommunity
vpn-target 111:1 import-extcommunity
#
mpls lsr-id 3.3.3.3
#
mpls
#
mpls ldp
#
interface GigabitEthernet1/0/0
undo shutdown
ip address 10.20.1.2 255.255.255.252
mpls
mpls ldp
#
interface GigabitEthernet2/0/0
undo shutdown
ipv6 enable
ip binding vpn-instance vpn1
ipv6 2001:db8:3::2/64
#
interface GigabitEthernet3/0/0
undo shutdown
ip address 10.11.1.2 255.255.255.252
mpls
mpls ldp
#
interface LoopBack1
ip address 3.3.3.3 255.255.255.255
#
bgp 100
peer 1.1.1.1 as-number 100
peer 1.1.1.1 connect-interface LoopBack1
peer 2.2.2.2 as-number 100
peer 2.2.2.2 connect-interface LoopBack1
#
ipv4-family unicast
undo synchronization peer 1.1.1.1 enable peer 2.2.2.2 enable
#
ipv6-family vpnv6
policy vpn-target
peer 1.1.1.1 enable
peer 2.2.2.2 enable
#
ipv6-family vpn-instance vpn1
preference 100 255 255
auto-frr
peer 2001:db8:3::1 as-number 65410
#
ospf 1
area 0.0.0.0
network 10.20.1.0 0.0.0.3
network 10.11.1.0 0.0.0.3
network 3.3.3.3 0.0.0.0
#
Return
CE的配置文件
#
sysname CE
#
interface GigabitEthernet1/0/0
undo shutdown
ipv6 enable
ipv6 address 2001:db8:1::1/64
#
interface GigabitEthernet2/0/0
undo shutdown
ipv6 enable
ipv6 address 2001:db8:3::1/64
#
interface LoopBack1
ipv6 enable
ipv6 address 2001:db8:0:1:2::1/128
#
bgp 65410 router-id 10.10.10.10 peer 2001:db8:1::2 as-number 100 peer 2001:db8:3::2 as-number 100 # ipv4-family unicast undo synchronization # ipv6-family unicast undo synchronization network 2001:db8:0:1:2::1 128 peer 2001:db8:1::2 enable peer 2001:db8:3::2 enable # return