HCIE必考的一個lab題，可以添加小老虎微信 領(lǐng)取實驗壓縮包和實驗圖。（微信號：Tiger_Erik）

?

多的不說了，直接上圖和配置文件。

太真實了，自己敲過才知道，會錯在什么地方。

BGP中：

Ipv4單播鄰居跑公網(wǎng)路由

Vpnv4 跑穿透路由

Vpnv4 instance ?和客戶CE建立鄰居傳遞私網(wǎng)路由。

Vpn-IPv4地址結(jié)構(gòu)

RD（route distinguisher）：64bits，用于區(qū)分使用相同地址空間的IPv4前綴，增加了RD的IPv4地址稱為Vpn-IPv4地址（即Vpnv4地址）。PE從CE接收到IPv4路由后，轉(zhuǎn)換為全局唯一的Vpn-IPv4路，并在公網(wǎng)上發(fā)布。

RD的兩個功能：

1) 與 32bits 的 Ipv4 前綴一起構(gòu)成 96bits 的 Vpnv4 前綴；?

2) 如果不同的 Vpn 客戶，存在相同的 IPv4 地址空間，那么可以通過設(shè)置不同的 RD 值從而保證前綴的唯一性。?

? 每一個VRF有一個全局唯一的RD。

? 同一個Vpn的不同站點可以配置相同的RD，不同Vpn的RD必須唯一。

RT（Route Target）：用來區(qū)分Vpn customer ，是BGP community 的擴展屬性，在VRF 中進(jìn)行配置。它跟在Vpnv4 前綴后面被一起傳遞。一條路由可以附加多個RT 值。

有兩類Vpn Target屬性：

??Export Target：本地PE從直接相連Site學(xué)到IPv4路由后，轉(zhuǎn)換為Vpn-IPv4路由，并為這些路由設(shè)置Export Target屬性。Export Target屬性作為BGP的擴展團體屬性隨路由發(fā)布。

??Import Target：PE收到其它PE發(fā)布的Vpn-IPv4路由時，檢查其Export Target屬性。當(dāng)此屬性與PE上某個Vpn實例的Import Target匹配時，PE就把路由加入到該Vpn實例中。

在BGP/MPLS IP Vpn網(wǎng)絡(luò)中，通過Vpn ?Target屬性來控制Vpn路由信息在各Site之間的發(fā)布和接收。Vpn Export Target和Import ?Target的設(shè)置相互獨立，并且都可以設(shè)置多個值，能夠?qū)崿F(xiàn)靈活的Vpn訪問控制，從而實現(xiàn)多種Vpn組網(wǎng)方案。

?

配置文檔

R1

?

[V200R003C00]

#

?sysname R1

#

?snmp-agent local-engineid 800007DB03000000000000

?snmp-agent?

#

?clock timezone China-StandaRD-Time minus 08:00:00

#

portal local-server load portalpage.zip

#

?drop illegal-mac alarm

#

?set cpu-usage threshold 80 restore 75

#

ip Vpn-instance A

?ipv4-family

??route-distinguisher 10:10

??Vpn-target 10:10 export-extcommunity

#

ip Vpn-instance B

?ipv4-family

??route-distinguisher 11:11

??Vpn-target 20:20 30:30 import-extcommunity

#

mpls lsr-id 1.1.1.1

mpls

#

mpls ldp

#

#

aaa?

?authentication-scheme default

?authorization-scheme default

?accounting-scheme default

?domain default?

?domain default_admin?

?local-user admin passwoRD cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$

?local-user admin service-type http

#

firewall zone Local

?priority 15

#

interface GigabitEthernet0/0/0

?ip address 13.1.1.1 255.255.255.0?

?mpls

?mpls ldp

#

interface GigabitEthernet0/0/1

#

interface GigabitEthernet0/0/1.10

?dot1q termination vid 10

?ip binding Vpn-instance A

?ip address 12.1.1.10 255.255.255.0?

?arp broadcast enable

#

interface GigabitEthernet0/0/1.20

?dot1q termination vid 11

?ip binding Vpn-instance B

?ip address 12.1.2.20 255.255.255.0?

?arp broadcast enable

#

interface GigabitEthernet0/0/2

?ip address 14.1.1.1 255.255.255.0?

?mpls

?mpls ldp

#

interface NULL0

#

interface LoopBack0

?ip address 1.1.1.1 255.255.255.255?

#

bgp 10

?router-id 1.1.1.1

?undo default ipv4-unicast

?peer 3.3.3.3 as-number 10?

?peer 3.3.3.3 connect-interface LoopBack0

?peer 4.4.4.4 as-number 10?

?peer 4.4.4.4 connect-interface LoopBack0

?#

?ipv4-family unicast

??undo synchronization

??undo peer 3.3.3.3 enable

??undo peer 4.4.4.4 enable

?#?

?ipv4-family Vpnv4

??policy Vpn-target

??peer 3.3.3.3 enable

??peer 3.3.3.3 reflect-client

??peer 4.4.4.4 enable

??peer 4.4.4.4 reflect-client

?#

?ipv4-family Vpn-instance A?

??peer 12.1.1.11 as-number 65000?

?#

?ipv4-family Vpn-instance B?

??peer 12.1.2.21 as-number 65000?

#

ospf 10 router-id 1.1.1.1?

?area 0.0.0.0?

??network 1.1.1.1 0.0.0.0?

??network 13.1.1.1 0.0.0.0?

??network 14.1.1.1 0.0.0.0?

#

user-interface con 0

?authentication-mode passwoRD

user-interface vty 0 4

user-interface vty 16 20

#

wlan ac

#

Return

?

R2

?

[V200R003C00]

#

?sysname R2

#

?snmp-agent local-engineid 800007DB03000000000000

?snmp-agent?

#

?clock timezone China-StandaRD-Time minus 08:00:00

#

portal local-server load portalpage.zip

#

?drop illegal-mac alarm

#

?set cpu-usage threshold 80 restore 75

#

aaa?

?authentication-scheme default

?authorization-scheme default

?accounting-scheme default

?domain default?

?domain default_admin?

?local-user admin passwoRD cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$

?local-user admin service-type http

#

firewall zone Local

?priority 15

#

interface GigabitEthernet0/0/0

#

interface GigabitEthernet0/0/0.10

?dot1q termination vid 10

?ip address 12.1.1.11 255.255.255.0?

?arp broadcast enable

#

interface GigabitEthernet0/0/0.20

?dot1q termination vid 11

?ip address 12.1.2.21 255.255.255.0?

?arp broadcast enable

#

interface GigabitEthernet0/0/1

#

interface GigabitEthernet0/0/1.20

#

interface GigabitEthernet0/0/2

#

interface NULL0

#

interface LoopBack0

?ip address 2.2.2.2 255.255.255.0?

#

bgp 65000

?router-id 2.2.2.2

?peer 12.1.1.10 as-number 10?

?peer 12.1.2.20 as-number 10?

?#

?ipv4-family unicast

??undo synchronization

??aggregate 10.0.0.0 255.0.0.0 detail-suppressed?

??import-route direct

??peer 12.1.1.10 enable

??peer 12.1.2.20 enable

??peer 12.1.2.20 allow-as-loop

#

user-interface con 0

?authentication-mode passwoRD

user-interface vty 0 4

user-interface vty 16 20

#

wlan ac

#

Return

R3

?

[V200R003C00]

#

?sysname R3

#

?snmp-agent local-engineid 800007DB03000000000000

?snmp-agent?

#

?clock timezone China-StandaRD-Time minus 08:00:00

#

portal local-server load portalpage.zip

#

?drop illegal-mac alarm

#

?set cpu-usage threshold 80 restore 75

#

ip Vpn-instance A

?ipv4-family

??route-distinguisher 20:20

??Vpn-target 20:20 export-extcommunity

??Vpn-target 10:10 import-extcommunity

#

mpls lsr-id 3.3.3.3

mpls

#

mpls ldp

#

#

aaa?

?authentication-scheme default

?authorization-scheme default

?accounting-scheme default

?domain default?

?domain default_admin?

?local-user admin passwoRD cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$

?local-user admin service-type http

#

firewall zone Local

?priority 15

#

interface GigabitEthernet0/0/0

?ip address 13.1.1.3 255.255.255.0?

?mpls

?mpls ldp

#

interface GigabitEthernet0/0/1

?ip binding Vpn-instance A

?ip address 35.1.1.3 255.255.255.0?

#

interface GigabitEthernet0/0/2

#

interface NULL0

#

interface LoopBack0

?ip address 3.3.3.3 255.255.255.255?

#

bgp 10

?router-id 3.3.3.3

?undo default ipv4-unicast

?peer 1.1.1.1 as-number 10?

?peer 1.1.1.1 connect-interface LoopBack0

?#

?ipv4-family unicast

??undo synchronization

??undo peer 1.1.1.1 enable

?#?

?ipv4-family Vpnv4

??policy Vpn-target

??peer 1.1.1.1 enable

?#

?ipv4-family Vpn-instance A?

??peer 35.1.1.5 as-number 65000?

#

ospf 10 router-id 3.3.3.3?

?area 0.0.0.0?

??network 3.3.3.3 0.0.0.0?

??network 13.1.1.3 0.0.0.0?

#

user-interface con 0

?authentication-mode passwoRD

user-interface vty 0 4

user-interface vty 16 20

#

wlan ac

#

Return

R4

?

[V200R003C00]

#

?sysname R4

#

?snmp-agent local-engineid 800007DB03000000000000

?snmp-agent?

#

?clock timezone China-StandaRD-Time minus 08:00:00

#

portal local-server load portalpage.zip

#

?drop illegal-mac alarm

#

?set cpu-usage threshold 80 restore 75

#

ip Vpn-instance B

?ipv4-family

??route-distinguisher 30:30

??Vpn-target 10:10 30:30 export-extcommunity

??Vpn-target 30:30 10:10 import-extcommunity

#

mpls lsr-id 4.4.4.4

mpls

#

mpls ldp

#

#

aaa?

?authentication-scheme default

?authorization-scheme default

?accounting-scheme default

?domain default?

?domain default_admin?

?local-user admin passwoRD cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$

?local-user admin service-type http

#

firewall zone Local

?priority 15

#

interface GigabitEthernet0/0/0

?ip address 14.1.1.4 255.255.255.0?

?mpls

?mpls ldp

#

interface GigabitEthernet0/0/1

?ip binding Vpn-instance B

?ip address 46.1.1.4 255.255.255.0?

#

interface GigabitEthernet0/0/2

#

interface NULL0

#

interface LoopBack0

?ip address 4.4.4.4 255.255.255.255?

#

bgp 10

?router-id 4.4.4.4

?undo default ipv4-unicast

?peer 1.1.1.1 as-number 10?

?peer 1.1.1.1 connect-interface LoopBack0

?#

?ipv4-family unicast

??undo synchronization

??undo peer 1.1.1.1 enable

?#?

?ipv4-family Vpnv4

??policy Vpn-target

??peer 1.1.1.1 enable

?#

?ipv4-family Vpn-instance B?

??peer 46.1.1.6 as-number 65000?

#

ospf 10 router-id 4.4.4.4?

?area 0.0.0.0?

??network 4.4.4.4 0.0.0.0?

??network 14.1.1.4 0.0.0.0?

#

user-interface con 0

?authentication-mode passwoRD

user-interface vty 0 4

user-interface vty 16 20

#

wlan ac

#

Return

R5

?

[V200R003C00]

#

?sysname R5

#

?snmp-agent local-engineid 800007DB03000000000000

?snmp-agent?

#

?clock timezone China-StandaRD-Time minus 08:00:00

#

portal local-server load portalpage.zip

#

?drop illegal-mac alarm

#

?set cpu-usage threshold 80 restore 75

#

aaa?

?authentication-scheme default

?authorization-scheme default

?accounting-scheme default

?domain default?

?domain default_admin?

?local-user admin passwoRD cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$

?local-user admin service-type http

#

firewall zone Local

?priority 15

#

interface GigabitEthernet0/0/0

?ip address 35.1.1.5 255.255.255.0?

#

interface GigabitEthernet0/0/1

#

interface GigabitEthernet0/0/2

#

interface NULL0

#

interface LoopBack0

?ip address 5.5.5.5 255.255.255.255?

#

interface LoopBack1

?ip address 10.5.5.5 255.255.255.255?

#

bgp 65000

?router-id 5.5.5.5

?peer 35.1.1.3 as-number 10?

?#

?ipv4-family unicast

??undo synchronization

??import-route direct

??peer 35.1.1.3 enable

??peer 35.1.1.3 allow-as-loop

#

user-interface con 0

?authentication-mode passwoRD

user-interface vty 0 4

user-interface vty 16 20

#

wlan ac

#

return

R6

?

[V200R003C00]

#

?sysname R6

#

?snmp-agent local-engineid 800007DB03000000000000

?snmp-agent?

#

?clock timezone China-StandaRD-Time minus 08:00:00

#

portal local-server load portalpage.zip

#

?drop illegal-mac alarm

#

?set cpu-usage threshold 80 restore 75

#

aaa?

?authentication-scheme default

?authorization-scheme default

?accounting-scheme default

?domain default?

?domain default_admin?

?local-user admin passwoRD cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$

?local-user admin service-type http

#

firewall zone Local

?priority 15

#

interface GigabitEthernet0/0/0

?ip address 46.1.1.6 255.255.255.0?

#

interface GigabitEthernet0/0/1

#

interface GigabitEthernet0/0/2

#

interface NULL0

#

interface LoopBack0

?ip address 6.6.6.6 255.255.255.255?

#

bgp 65000

?router-id 6.6.6.6

?peer 46.1.1.4 as-number 10?

?#

?ipv4-family unicast

??undo synchronization

??import-route direct

??peer 46.1.1.4 enable

??peer 46.1.1.4 allow-as-loop

#

user-interface con 0

?authentication-mode passwoRD

user-interface vty 0 4

user-interface vty 16 20

#

wlan ac

#

return