H3C S9500交换机MPLS BGP VPN之Extranet功能的配置

S9500交换机MPLS BGP VPN之Extranet功能的配置

一、组网需求：

公司A和公司B通过VPN互联，两个公司的总部都在城市C，VPN号分别为VPN1和VPN2。通过MPLS给用户提供VPN功能，两个VPN之间有一部分共享资源在城市C，两个VPN内的用户都可以访问位于城市C的资源，但城市A和B的VPN用户不能互相访问。

二、组网图

三、配置步骤：

软件版本：S9500交换机1200以后软件版本

硬件版本：S9500交换机支持MPLS VPN业务板（C/CA/CB类业务板）

配置PE-A设备

1）在PE-A上创建一个VPN-instance1，能够收发VPN-target为111:1的VPN路由信息

[PE-A] ip vpn-instance vpn-instance1

[PE-A-vpn-1] route-distinguisher 100:1

[PE-A-vpn-1] vpn-target 111:1 both

2）PE-A与CE-A间建立MP-EBGP邻居，并将学到的CE-A内部VPN路由引入VPN实例子地址族

[PE-A] bgp 100

[PE-A-bgp] ipv4-family vpn-instance vpn-instance1

[PE-A-bgp-af-vpn-instance] import-route direct

[PE-A-bgp-af-vpn-instance] import-route static

[PE-A-bgp-af-vpn-instance] group 172 external

[PE-A-bgp-af-vpn-instance] peer 172.15.1.1 group 172 as-number 65011

3）将与CE-A连接的VLAN301的接口与VPN-instance1绑定

[PE-A] vlan 301

[PE-A-vlan301] port gigabitethernet 3/1/1

[PE-A] interface vlan-interface 301

[PE-A-vlan-interface301] ip binding vpn-instance vpn-instance1

[PE-A-vlan-interface301] ip address 172.15.0.1 255.255.0.0

4）配置LoopBack接口

[PE-A] interface loopback 0

[PE-A-LoopBack0] ip address 10.1.1.1 255.255.255.255

5）配置MPLS基本能力

[PE-A] mpls lsr-id 10.1.1.1

[PE-A] mpls

[PE-A] mpls ldp

6）在PE与PE之间建立MP-IBGP邻居，进行PE内部的VPN路由信息交换。并在VPNv4子地址族视图下激活MP-IBGP对等体

[PE-A] bgp 100

[PE-A-bgp] group 20 internal

[PE-A-bgp] peer 20.1.1.1 group 20

[PE-A-bgp] peer 20.1.1.1 connect-interface loopback 0

[PE-A-bgp] ipv4-family vpnv4

[PE-A-bgp-af-vpn] peer 20 enable

[PE-A-bgp-af-vpn] peer 20.1.1.1 group 20

配置PE-C设备

1）在PE-C上创建一个VPN-instance2，能够收发VPN-target为111:1和222:2的VPN路由信息

[PE-C] ip vpn-instance vpn-instance2

[PE-C-vpn-2] route-distinguisher 100:2

[PE-C-vpn-2] vpn-target 111:1 both

[PE-C-vpn-2] vpn-target 222:2 both

2）PE-C与CE-C间建立MP-EBGP邻居，并将学到的CE-C内部VPN路由引入VPN实例子地址族

[PE-C] bgp 100

[PE-C-bgp] ipv4-family vpn-instance vpn-instance2

[PE-C-bgp-af-vpn-instance] import-route direct

[PE-C-bgp-af-vpn-instance] import-route static

[PE-C-bgp-af-vpn-instance] group 172 external

[PE-C-bgp-af-vpn-instance] peer 172.16.1.1 group 172 as-number 65012

3）将与CE-C相连的VLAN301的接口与VPN-instance2绑定

[PE-C] vlan 301

[PE-C-vlan301] port gigabitethernet 3/1/1

[PE-C] interface vlan-interface 301

[PE-C-vlan-interface301] ip binding vpn-instance vpn-instance2

4）配置LoopBack接口

[PE-C] interface loopback 0

[PE-C-LoopBack0] ip address 20.1.1.1 255.255.255.255

5）配置MPLS基本能力

[PE-C] mpls lsr-id 20.1.1.1

[PE-C] mpls

[PE-C] mpls ldp

6）在PE与PE之间建立MP-IBGP邻居，进行PE内部的VPN路由信息交换。并在VPNv4子地址族视图下激活MP-IBGP对等体

[PE-C] bgp 100

[PE-C-bgp] group 10

[PE-C-bgp] peer 10.1.1.1 group 10

[PE-C-bgp] peer 10.1.1.1 connect-interface loopback 0

[PE-C-bgp] group 30

[PE-C-bgp] peer 30.1.1.1 group 30

[PE-C-bgp] peer 30.1.1.1 connect-interface loopback 0

[PE-C-bgp] ipv4-family vpnv4

[PE-C-bgp-af-vpn] peer 10 enable

[PE-C-bgp-af-vpn] peer 10.1.1.1 group 10

[PE-C-bgp-af-vpn] peer 30 enable

[PE-C-bgp-af-vpn] peer 30.1.1.1 group 30

配置PE-B设备

1）在PE-B上创建VPN2的VPN-instance3，能够收发VPN-target为222:2的VPN路由信息

[PE-B] ip vpn-instance vpn-instance3

[PE-B-vpn-3] route-distinguisher 100:3

[PE-B-vpn-3] vpn-target 222:2 both

2）PE-B与CE-B间建立MP-EBGP邻居，并将学到的CE-B内部VPN路由引入VPN实例子地址族

[PE-B] bgp 100

[PE-B-bgp] ipv4-family vpn-instance vpn-instance3

[PE-B-bgp-af-vpn-instance] import-route direct

[PE-B-bgp-af-vpn-instance] import-route static

[PE-B-bgp-af-vpn-instance] group 172 external

[PE-B-bgp-af-vpn-instance] peer 172.17.1.1 group 172 as-number 65013

3）将与CE-B相连的VLAN301的接口与VPN-instance3绑定

[PE-B] vlan 301

[PE-B-vlan301] port gigabitethernet 3/1/1

[PE-B] interface vlan-interface 301

[PE-B-vlan-interface301] ip binding vpn-instance vpn-instance3

[PE-B-vlan-interface301] ip address 172.17.0.1 255.255.0.0

4）配置LoopBack接口

[PE-B] interface loopback 0

[PE-B-LoopBack0] ip address 30.1.1.1 255.255.255.255

5）配置MPLS基本能力

[PE-B] mpls lsr-id 30.1.1.1

[PE-B] mpls

[PE-B] mpls ldp

6）在PE与PE之间建立MP-IBGP邻居，进行PE内部的VPN路由信息交换。并在VPNv4子地址族视图下激活MP-IBGP对等体

[PE-B] bgp 100

[PE-B-bgp] group 20

[PE-B-bgp] peer 20.1.1.1 group 20

[PE-B-bgp] peer 20.1.1.1 connect-interface loopback 0

[PE-B-bgp] ipv4-family vpnv4

[PE-B-bgp-af-vpn] peer 20 enable

[PE-B-bgp-af-vpn] peer 20.1.1.1 group 20

四、配置关键点：

两个公司在PE-C上共用一个VPN-instance，所以两个公司使用的IP地址空间不能重叠。