AR28/AR46系列路由器根据DSCP进行VRF绑定的典型配置

 

AR28/AR46系列路由器根据DSCP进行VRF绑定的典型配置

 

【组网需求】

分支到总部之间有两条物理线路,每条线路建立一条GRE隧道与一个VRF绑定.分支有两个VRF,VRFa和VRFb,但是对于两个VRF中的业务要求VRF内重要的业务走安全性较高的链路Tunnel1,次要的业务走Tunnel2.

这种组网要求设计到两个问题:

1.不同的VRF与不同的GRE隧道的绑定.

2.通过OSPF多实例实现隧道间的路由.

3.按照用户的要求,同一个VRF内用户根据DSCP值走不同的VRF.这样就需要在,分支节点出接口根据DSCP作策略.

【组网图】

 

 

 

 

【配置步骤】

先实现VRF与GRE的绑定,实现VRF内可以互通,不同VRF内不可以互通.既:10.1.1.1和10.1.2.1可以互通,10.1.3.1和10.1.4.1可以互通,但相互之间不可以互通.

在PC机上ping对端不同的VRF如下图:

 

 

如图所示:10.1.1.2可以和10.1.2.1互通,与10.1.4.1不通.

但是ping10.1.4.1显示的是TTL expired in transit原因是两边配置的是默认路由,导致报文在中间循环传递.

 

然后根据DSCP作策略:

在RTA上与PC相连的接口上作基于DSCP的策略,将DSCP为0的报文转到VPN:vpnb中.

# acl number 3000                //添加ACL DSCP=0  rule 0 permit ip vpn-instance vpna source 10.1.1.0 0.0.0.255 dscp be                        # interface Ethernet2/0 ip binding vpn-instance vpna ip address 10.1.1.1 255.255.255.0 ip policy route-policy aaa                                        //应用在接口 # route-policy aaa permit node 10                                   //定义策略 if-match acl 3000 apply access-vpn vpn-instance vpnb # ip route-static vpn-instance vpnb 10.1.1.0 255.255.255.0 vpn-instance vpna 10.1.1.2  preference 60                                           //指定回程路由 #

  

 

 

可以看出对DSCP为0的报文做了VRF转换.同时在RTA上查看ACL匹配情况:

[RTA]dis acl 3000                                                              

Advanced ACL  3000, 1 rule                                                     

Acl's step is 1                                                                

 rule 0 permit ip vpn-instance vpna source 10.1.1.0 0.0.0.255 dscp be (114 times matched)

 

 

【配置脚本】

RTA配置脚本

# sysname RTA # router id 1.1.1.1 # ip vpn-instance vpna route-distinguisher 100:1 vpn-target 100:1 export-extcommunity vpn-target 100:1 import-extcommunity # ip vpn-instance vpnb route-distinguisher 200:1 vpn-target 200:1 export-extcommunity vpn-target 200:1 import-extcommunity # acl number 3000 rule 0 permit ip vpn-instance vpna source 10.1.1.0 0.0.0.255 dscp be # interface Ethernet2/0 ip binding vpn-instance vpna ip address 10.1.1.1 255.255.255.0 ip policy route-policy aaa # interface Ethernet3/0 ip address 10.0.0.1 255.255.255.252 # interface Ethernet3/1 ip address 10.0.0.5 255.255.255.252 # interface Tunnel0 ip binding vpn-instance vpna ip address 192.168.1.1 255.255.255.252 source 10.0.0.1 destination 10.0.0.2 # interface Tunnel1 ip binding vpn-instance vpnb ip address 192.168.1.5 255.255.255.252 source 10.0.0.5 destination 10.0.0.6 # interface LoopBack0 ip address 1.1.1.1 255.255.255.255 # interface LoopBack2 ip binding vpn-instance vpnb ip address 10.1.3.1 255.255.255.0 # ospf 1 vpn-instance vpna vpn-instance-capability simple import-route direct import-route static area 0.0.0.0 network 10.0.0.0 0.0.0.3 network 10.1.1.0 0.0.0.255 # ospf 2 vpn-instance vpnb vpn-instance-capability simple import-route direct import-route static area 0.0.0.0 network 10.0.0.4 0.0.0.3 network 10.1.3.0 0.0.0.255 # route-policy aaa permit node 10 if-match acl 3000 apply access-vpn vpn-instance vpnb # ip route-static vpn-instance vpna 0.0.0.0 0.0.0.0 Tunnel 0 preference 60 ip route-static vpn-instance vpnb 0.0.0.0 0.0.0.0 Tunnel 1 preference 60 ip route-static vpn-instance vpnb 10.1.1.0 255.255.255.0 vpn-instance vpna 10.1.1.2  preference 60 # return

RTB配置脚本

# sysname RTB # router id 2.2.2.2 # ip vpn-instance vpna route-distinguisher 100:1 vpn-target 100:1 export-extcommunity vpn-target 100:1 import-extcommunity # ip vpn-instance vpnb route-distinguisher 200:1 vpn-target 200:1 export-extcommunity vpn-target 200:1 import-extcommunity # interface Ethernet3/0 ip address 10.0.0.2 255.255.255.252 # interface Ethernet3/1 ip address 10.0.0.6 255.255.255.252 # interface Tunnel0 ip binding vpn-instance vpna ip address 192.168.1.2 255.255.255.252 source 10.0.0.2 destination 10.0.0.1 # interface Tunnel1 ip binding vpn-instance vpnb ip address 192.168.1.6 255.255.255.252 source 10.0.0.6 destination 10.0.0.5 # interface LoopBack0 ip address 2.2.2.2 255.255.255.255 # interface LoopBack1 ip binding vpn-instance vpna ip address 10.1.2.1 255.255.255.0 # interface LoopBack2 ip binding vpn-instance vpnb ip address 10.1.4.1 255.255.255.0 # ospf 1 vpn-instance vpna vpn-instance-capability simple import-route direct import-route static area 0.0.0.0 network 10.0.0.0 0.0.0.3 network 10.1.2.0 0.0.0.255 # ospf 2 vpn-instance vpnb vpn-instance-capability simple import-route static area 0.0.0.0 network 10.0.0.4 0.0.0.3 network 10.1.4.0 0.0.0.255 # ip route-static vpn-instance vpna 0.0.0.0 0.0.0.0 Tunnel 0 preference 60 ip route-static vpn-instance vpnb 0.0.0.0 0.0.0.0 Tunnel 1 preference 60 # return