MPLS VPN

MPLS VPN一般是运营商提供的虚拟专用网络服务，由于是运营商提供的服务，所以带宽和稳定性都是可以得到保障的。

MPLS VPN名词

• PE
  • 运营商边缘设备
• CE
  • 客户边缘设备
• P
  • 运营商内部设备
• VRF(虚拟路由转发)
  • 可以理解为虚拟路由器，有独立的路由表，有专属的接口
  • VRF是配置在PE上的
  • 可以将接口划入VRF中，然后连接客户网络
  • 客户网络的路由条目就回被VRF学习到，然后再由VRF包装成vpn专用的格式传递出去
• RT
  • 可以理解为VRF的入场券，每个VPNv4的条目都必须携带一个RT
  • VRF只会放行允许进入VPNv4条目到VRF的路由表
  • 有出站RT，意味着从这个VRF出去的条目携带的RT值
  • 有入站RT，意味着想进入这个VRF，就必须携带的RT值
• RD
  • 区别路由用的一个数值。ASN:NN
  • 和用户的路由条目组成VPNv4的条目，ASN:NN.x.x.x.x
  • 如果多个客户的IP网段是冲突的，RD可以避免

由于MPLS VPN一般是运营商提供的，所以主要的配置和研究设备是PE和P

MPLS VPN解决了两个站点之间的如下问题：

• 两个站点之间路由条目的学习
• 两个站点之间流量的传递

MPLS VPN基本配置

运营商基础配置

R2
mpls label range 200 299
!
interface Loopback0
 ip address 2.2.2.2 255.255.255.255
 ip ospf 1 area 0
!
interface Ethernet0/0
 no ip address
 shutdown
!
interface Ethernet0/1
 ip address 192.168.23.2 255.255.255.0
 ip ospf 1 area 0
 mpls ip
==================================
R3
mpls label range 300 399
!
interface Loopback0
 ip address 3.3.3.3 255.255.255.255
 ip ospf 1 area 0
!
interface Ethernet0/0
 ip address 192.168.23.3 255.255.255.0
 ip ospf 1 area 0
 mpls ip
!
interface Ethernet0/1
 ip address 192.168.34.3 255.255.255.0
 ip ospf 1 area 0
 mpls ip 
==================================
R4
mpls label range 400 499
!
interface Loopback0
 ip address 4.4.4.4 255.255.255.255
 ip ospf 1 area 0
!
interface Ethernet0/0
 ip address 192.168.34.4 255.255.255.0
 ip ospf 1 area 0
 mpls ip
!
interface Ethernet0/1
 ip address 192.168.45.4 255.255.255.0
 ip ospf 1 area 0
 mpls ip
==================================
R5
mpls label range 500 599
!
interface Loopback0
 ip address 5.5.5.5 255.255.255.255
 ip ospf 1 area 0
!
interface Ethernet0/0
 ip address 192.168.45.5 255.255.255.0
 ip ospf 1 area 0
 mpls ip

建立bgp vpnv4邻居

mpls vpn主要使用BGP来传递路由条目，解决两个站点之间条目学习的问题

R2
router bgp 200
 bgp log-neighbor-changes
 no bgp default ipv4-unicast
 neighbor 5.5.5.5 remote-as 200
 neighbor 5.5.5.5 update-source Loopback0
 !
 address-family vpnv4
  neighbor 5.5.5.5 activate
  neighbor 5.5.5.5 send-community extended
 exit-address-family
========================
R5
router bgp 200
 bgp log-neighbor-changes
 no bgp default ipv4-unicast
 neighbor 2.2.2.2 remote-as 200
 neighbor 2.2.2.2 update-source Loopback0
 !
 address-family vpnv4
  neighbor 2.2.2.2 activate
  neighbor 2.2.2.2 send-community extended
 exit-address-family

查看bgp vpnv4邻居关系

R2#sh ip bgp vpnv4 all summary 
BGP router identifier 1.1.1.1, local AS number 200
BGP table version is 1, main routing table version 1

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
5.5.5.5         4          200       5       5        1    0    0 00:01:51        0

分配给客户连接的VRF

R2
ip vrf Blue
 rd 100:123
 route-target export 200:5
 route-target import 200:2
interface Ethernet0/0
 ip vrf forwarding Blue
 ip address 192.168.12.2 255.255.255.0
======================================
R5
ip vrf Blue
 rd 100:123
 route-target export 200:2
 route-target import 200:5
interface Ethernet0/1
 ip vrf forwarding Blue
 ip address 192.168.56.5 255.255.255.0

配置CE-PE之间的IGP协议

R1
interface Loopback0
 ip address 1.1.1.1 255.255.255.0
 ip ospf 1 area 0
!
interface Ethernet0/0
 ip address 192.168.12.1 255.255.255.0
 ip ospf 1 area 0
=============================
R2
interface Ethernet0/0
 ip ospf 2 area 0
==============================
R5
interface Ethernet0/1
 ip ospf 2 area 0
=================================
interface Loopback0
 ip address 6.6.6.6 255.255.255.0
 ip ospf 1 area 0
!
interface Ethernet0/0
 ip address 192.168.56.6 255.255.255.0
 ip ospf 1 area 0

将vrf路由注入bgp vpnv4

R2
router bgp 200
 address-family ipv4 vrf Blue
  redistribute ospf 2 match internal external 1 external 2
router ospf 2 vrf Blue
 redistribute bgp 200 subnets
==========================
R5
router bgp 200
 address-family ipv4 vrf Blue
  redistribute ospf 2 match internal external 1 external 2
router ospf 2 vrf Blue
 redistribute bgp 200 subnets

最终检查

路由条目的传递

R1#sh ip route
      1.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        1.1.1.0/24 is directly connected, Loopback0
L        1.1.1.1/32 is directly connected, Loopback0
      6.0.0.0/32 is subnetted, 1 subnets
O IA     6.6.6.6 [110/21] via 192.168.12.2, 00:01:54, Ethernet0/0
      192.168.12.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.12.0/24 is directly connected, Ethernet0/0
L        192.168.12.1/32 is directly connected, Ethernet0/0
O IA  192.168.56.0/24 [110/11] via 192.168.12.2, 00:01:54, Ethernet0/0

数据流量的转发

R1#ping 6.6.6.6
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 6.6.6.6, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

MPLS VPN原理

路由层面

• CE-PE

  • CE和PE之间运行正常的IGP协议
  • CE将路由传递给PE对应的接口
  • PE将路由学习到对应的VRF中

• PE-P-PE

  • PE和PE之间建立BGP VPNv4邻居
  • 将VRF中的VPNv4条目重发布到BGP中
  • BGP更新给VPNv4邻居
  • 邻居收到之后，根据携带的RT值，将路由加入对应的VRF路由表中

• PE-CE

  • 将BGP条目重发布进IGP

流量层面

• CE-PE
  • 正常的路由转发
  • PE在收到CE的流量之后，会加上两层标签
  • 其中最底层的标签是BGP所提供
  • 顶层标签是LDP提供的
• PE-P-PE
  • 通过最外层的LDP标签进行传递
  • 并且在最终到达PE之前弹出顶层标签
  • 只有底层标签的数据最终被PE收到，然后从对应的VRF接口发出
• PE-CE
  • 正常的路由转发