• 软件测试技术
  • 软件测试博客
  • 软件测试视频
  • 开源软件测试技术
  • 软件测试论坛
  • 软件测试沙龙
  • 软件测试资料下载
  • 软件测试杂志
  • 软件测试人才招聘
    暂时没有公告

字号: | 推荐给好友 上一篇 | 下一篇

一个基本的MPLSBGPVPN配置

发布: 2007-6-23 18:14 | 作者:   | 来源:   | 查看: 12次 | 进入软件测试论坛讨论

领测软件测试网

   
  ip vrf vrf00001
  rd 888:1
  route-target both 888:1
  ip vrf vrf00002
  rd 888:2
  route-target both 888:2
  route-target import 888:1
  import map vrf00002-import-map
  

  route-map vrf00002-import-map permit 10
  match ...
  
  It is important to note that the route map is only needed for fine tuning. Normal import/export with VRFs can just extended communities. The thought of security depending on getting route maps built right rather scares me. Luckily, basic security is provided at the extended community level, making route hiding the normal situation. Then route maps can be used to limit connectivity to extranet partner sites, if the customers don't wish to do that for themselves by speaking BGP to the PE routers.
  These VRFs would typically then be associated with interfaces:
  
  interface Fastethernet 0/2
  ip vrf forwarding vrf00001
  ip address ...
  interface Fastethernet 0/3
  ip vrf forwarding vrf00002
  ip address ...
  interface Fastethernet 0/4
  ip vrf forwarding vrf00002
  ip address ...
  VRF vrf00002 is associated with two interfaces that connect to two sites for Customer B. I'm deliberately showing FastEthernet, since some people now think that's how we'll be connecting to SPs in metropolitan settings. (Think BLEC: Building Local Exchange Carrier, providing VPN, Internet, and Voice connectivity).
  We need to be speaking MBGP to carry VPN-IPv4 routes and attributes to peer PE routers. We don't need ordinary BGP routes to PE peers however. (On a larger scale, we might use route reflectors vice iMBGP full-mesh peering):
  
  router bgp 888
  no synchronization ! don't do IGP synchronization (since
  ! the IGP won't carry the right routes anyway)
  no bgp default ipv4-activate ! don't do ordinary BGP
  neighbor 10.60.0.5 remote-as 888 ! identify an iBGP neighbor and AS
  neighbor 10.61.0.1 remote-as 888 ! identify another
  address-family vpnv4 unicast
  neighbor 10.60.0.5 activate ! activate session to some MBGP peer
  neighbor 10.61.0.1 activate ! some other MBGP peer
  exit-address-family
  
  Our design might use eBGP to communicate routes to CE routers in a controlled way, to get routes into each VRF. Or it might use static routing, or some other mix. We can also define per-VRF static routes as shown below.
  address-family ipv4 unicast vrf vrf00001
  redistribute static
  redistribute connected
  neighbor 10.20.1.1 remote-as 65535 ! private AS number
  neighbor 10.20.1.1 activate
  no auto-summary
  exit-address-family
  address-family ipv4 unicast vrf vrf00002
  redistribute static
  redistribute connected
  neighbor 10.20.2.2 remote-as 65535
  neighbor 10.20.2.2 activate
  no auto-summary
  exit-address-family
  
  ip route vrf vrf00001 15.0.0.0 255.0.0.0 e0/2 10.20.1.1

延伸阅读

文章来源于领测软件测试网 https://www.ltesting.net/


关于领测软件测试网 | 领测软件测试网合作伙伴 | 广告服务 | 投稿指南 | 联系我们 | 网站地图 | 友情链接
版权所有(C) 2003-2010 TestAge(领测软件测试网)|领测国际科技(北京)有限公司|软件测试工程师培训网 All Rights Reserved
北京市海淀区中关村南大街9号北京理工科技大厦1402室 京ICP备10010545号-5
技术支持和业务联系:info@testage.com.cn 电话:010-51297073

软件测试 | 领测国际ISTQBISTQB官网TMMiTMMi认证国际软件测试工程师认证领测软件测试网