示例：在 BGP 层次结构的不同级别应用路由策略
此示例显示了在简单网络拓扑中配置的 BGP，并说明了路由策略在 BGP 配置的不同级别应用时如何生效。
要求
配置此示例之前，不需要除设备初始化之外的特殊配置。
概述
对于 BGP，可以按如下方式应用策略：
BGP 全局
import和export语句 — 在[edit protocols bgp]层次结构级别包括这些语句（对于路由实例，在层次结构级别包括这些语句[edit routing-instances routing-instance-name protocols bgp]）。组
import和export语句 — 在[edit protocols bgp group group-name]层次结构级别包括这些语句（对于路由实例，在层次结构级别包括这些语句[edit routing-instances routing-instance-name protocols bgp group group-name]）。对等
import和export语句 — 在[edit protocols bgp group group-name neighbor address]层次结构级别包括这些语句（对于路由实例，在层次结构级别包括这些语句[edit routing-instances routing-instance-name protocols bgp group group-name neighbor address]）。
对等级别 import 或 export 语句覆盖组 import 或 export 语句。组级别 import 或 export 语句将覆盖全局 BGP import 或 export 语句。
在此示例中，名为 send-direct 的策略在全局级别应用，另一个名为 send-192.168.0.1 的策略应用于组级别，第三个名为 send-192.168.20.1 的策略应用于邻居级别。
user@host# show protocols
bgp {
local-address 172.16.1.1;
export send-direct;
group internal-peers {
type internal;
export send-192.168.0.1;
neighbor 172.16.2.2 {
export send-192.168.20.1;
}
neighbor 172.16.3.3;
}
group other-group {
type internal;
neighbor 172.16.4.4;
}
}
一个经常被误解并可能导致问题的关键点是，在此类配置中，仅应用最明确的策略。邻居级策略比组级策略更显式，而组级策略又比全局策略更明确。
邻居 172.16.2.2 仅受 send-192.168.20.1 策略的约束。邻居 172.16.3.3 缺少更具体的内容，仅受 send-192.168.0.1 策略的约束。同时，组其他组中的邻居 172.16.4.4 没有组或邻居级别的策略，因此它使用 send-direct 策略。
如果需要让邻居 172.16.2.2 执行所有三个策略的功能，则可以编写并应用包含其他三个策略功能的新邻居级策略，也可以将所有三个现有策略作为一个链应用于邻居 172.16.2.2。
配置
CLI 快速配置
要快速配置此示例，请复制以下命令，将其粘贴到文本文件中，删除所有换行符，更改与您的网络配置匹配所需的任何详细信息，然后将命令复制并粘贴到层次结构级别的 CLI [edit] 中。
设备 R1
set interfaces fe-1/2/0 unit 0 description to-R2 set interfaces fe-1/2/0 unit 0 family inet address 10.10.10.1/30 set interfaces lo0 unit 0 family inet address 172.16.1.1/32 set protocols bgp local-address 172.16.1.1 set protocols bgp export send-direct set protocols bgp group internal-peers type internal set protocols bgp group internal-peers export send-static-192.168.0 set protocols bgp group internal-peers neighbor 172.16.2.2 export send-static-192.168.20 set protocols bgp group internal-peers neighbor 172.16.3.3 set protocols bgp group other-group type internal set protocols bgp group other-group neighbor 172.16.4.4 set protocols ospf area 0.0.0.0 interface lo0.0 passive set protocols ospf area 0.0.0.0 interface fe-1/2/0.0 set policy-options policy-statement send-direct term 1 from protocol direct set policy-options policy-statement send-direct term 1 then accept set policy-options policy-statement send-static-192.168.0 term 1 from protocol static set policy-options policy-statement send-static-192.168.0 term 1 from route-filter 192.168.0.0/24 orlonger set policy-options policy-statement send-static-192.168.0 term 1 then accept set policy-options policy-statement send-static-192.168.20 term 1 from protocol static set policy-options policy-statement send-static-192.168.20 term 1 from route-filter 192.168.20.0/24 orlonger set policy-options policy-statement send-static-192.168.20 term 1 then accept set routing-options static route 192.168.0.1/32 discard set routing-options static route 192.168.20.1/32 discard set routing-options router-id 172.16.1.1 set routing-options autonomous-system 17
设备 R2
set interfaces fe-1/2/0 unit 0 description to-R1 set interfaces fe-1/2/0 unit 0 family inet address 10.10.10.2/30 set interfaces fe-1/2/1 unit 0 description to-R3 set interfaces fe-1/2/1 unit 0 family inet address 10.10.10.5/30 set interfaces lo0 unit 0 family inet address 172.16.2.2/32 set protocols bgp group internal-peers type internal set protocols bgp group internal-peers local-address 172.16.2.2 set protocols bgp group internal-peers neighbor 172.16.3.3 set protocols bgp group internal-peers neighbor 172.16.1.1 set protocols bgp group internal-peers neighbor 172.16.4.4 set protocols ospf area 0.0.0.0 interface lo0.0 passive set protocols ospf area 0.0.0.0 interface fe-1/2/0.0 set protocols ospf area 0.0.0.0 interface fe-1/2/1.0 set routing-options router-id 172.16.2.2 set routing-options autonomous-system 17
设备 R3
set interfaces fe-1/2/1 unit 0 description to-R2 set interfaces fe-1/2/1 unit 0 family inet address 10.10.10.6/30 set interfaces fe-1/2/2 unit 0 description to-R4 set interfaces fe-1/2/2 unit 0 family inet address 10.10.10.9/30 set interfaces lo0 unit 0 family inet address 172.16.3.3/32 set protocols bgp group internal-peers type internal set protocols bgp group internal-peers local-address 172.16.3.3 set protocols bgp group internal-peers neighbor 172.16.2.2 set protocols bgp group internal-peers neighbor 172.16.1.1 set protocols bgp group internal-peers neighbor 172.16.4.4 set protocols ospf area 0.0.0.0 interface lo0.0 passive set protocols ospf area 0.0.0.0 interface fe-1/2/1.0 set protocols ospf area 0.0.0.0 interface fe-1/2/2.0 set routing-options router-id 172.16.3.3 set routing-options autonomous-system 17
设备 R4
set interfaces fe-1/2/2 unit 0 description to-R3 set interfaces fe-1/2/2 unit 0 family inet address 10.10.10.10/30 set interfaces lo0 unit 0 family inet address 172.16.4.4/32 set protocols bgp group internal-peers type internal set protocols bgp group internal-peers local-address 172.16.4.4 set protocols bgp group internal-peers neighbor 172.16.2.2 set protocols bgp group internal-peers neighbor 172.16.1.1 set protocols bgp group internal-peers neighbor 172.16.3.3 set protocols ospf area 0.0.0.0 interface lo0.0 passive set protocols ospf area 0.0.0.0 interface fe-1/2/2.0 set routing-options router-id 172.16.4.4 set routing-options autonomous-system 17
程序
分步过程
下面的示例要求您在各个配置层级中进行导航。有关导航 CLI 的信息，请参阅 CLI 用户指南中的在配置模式下使用 CLI 编辑器。
要配置 IS-IS 默认路由策略，请执行以下操作：
配置设备接口。
[edit interfaces] user@R1# set fe-1/2/0 unit 0 description to-R2 user@R1# set fe-1/2/0 unit 0 family inet address 10.10.10.1/30 user@R1# set lo0 unit 0 family inet address 172.16.1.1/32
在接口上启用 OSPF 或其他内部网关协议 （IGP）。
[edit protocols OSPF area 0.0.0.0] user@R1# set interface lo0.0 passive user@R1# set interface fe-1/2/0.0
配置静态路由。
[edit routing-options] user@R1# set static route 192.168.0.1/32 discard user@R1# set static route 192.168.20.1/32 discard
启用路由策略。
[edit protocols policy-options] user@R1# set policy-statement send-direct term 1 from protocol direct user@R1# set policy-statement send-direct term 1 then accept user@R1# set policy-statement send-static-192.168.0 term 1 from protocol static user@R1# set policy-statement send-static-192.168.0 term 1 from route-filter 192.168.0.0/24 orlonger user@R1# set policy-statement send-static-192.168.0 term 1 then accept user@R1# set policy-statement send-static-192.168.20 term 1 from protocol static user@R1# set policy-statement send-static-192.168.20 term 1 from route-filter 192.168.20.0/24 orlonger user@R1# set policy-statement send-static-192.168.20 term 1 then accept
配置 BGP 并应用导出策略。
[edit protocols bgp] user@R1# set local-address 172.16.1.1 user@R1# set protocols bgp export send-direct user@R1# set group internal-peers type internal user@R1# set group internal-peers export send-static-192.168.0 user@R1# set group internal-peers neighbor 172.16.2.2 export send-static-192.168.20 user@R1# set group internal-peers neighbor 172.16.3.3 user@R1# set group other-group type internal user@R1# set group other-group neighbor 172.16.4.4
配置路由器 ID 和自治系统 (AS) 编号。
[edit routing-options] user@R1# set router-id 172.16.1.1 user@R1# set autonomous-system 17
如果完成设备配置，请提交配置。
[edit] user@R1# commit
结果
在配置模式下，通过发出 show interfaces、 show protocols、 show policy-options和 show routing-options 命令来确认您的配置。如果输出未显示预期的配置，请重复此示例中的说明，以便进行更正。
user@R1# show interfaces
fe-1/2/0 {
unit 0 {
description to-R2;
family inet {
address 10.10.10.1/30;
}
}
}
lo0 {
unit 0 {
family inet {
address 172.16.1.1/32;
}
}
}
user@R1# show protocols
bgp {
local-address 172.16.1.1;
export send-direct;
group internal-peers {
type internal;
export send-static-192.168.0;
neighbor 172.16.2.2 {
export send-static-192.168.20;
}
neighbor 172.16.3.3;
}
group other-group {
type internal;
neighbor 172.16.4.4;
}
}
ospf {
area 0.0.0.0 {
interface lo0.0 {
passive;
}
interface fe-1/2/0.0;
}
}
user@R1# show policy-options
policy-statement send-direct {
term 1 {
from protocol direct;
then accept;
}
}
policy-statement send-static-192.168.0 {
term 1 {
from {
protocol static;
route-filter 192.168.0.0/24 orlonger;
}
then accept;
}
}
policy-statement send-static-192.168.20 {
term 1 {
from {
protocol static;
route-filter 192.168.20.0/24 orlonger;
}
then accept;
}
}
user@R1# show routing-options
static {
route 192.168.0.1/32 discard;
route 192.168.20.1/32 discard;
}
router-id 172.16.1.1;
autonomous-system 17;
验证
确认配置工作正常。
验证 BGP 路由学习
目的
通过检查路由表，确保 BGP 导出策略按预期工作。
操作
user@R1> show route protocol direct
inet.0: 11 destinations, 11 routes (11 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
172.16.1.1/32 *[Direct/0] 1d 22:19:47
> via lo0.0
10.10.10.0/30 *[Direct/0] 1d 22:19:47
> via fe-1/2/0.0
user@R1> show route protocol static
inet.0: 11 destinations, 11 routes (11 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
192.168.0.1/32 *[Static/5] 02:20:03
Discard
192.168.20.1/32 *[Static/5] 02:20:03
Discarduser@R2> show route protocol bgp
inet.0: 11 destinations, 11 routes (11 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
192.168.20.1/32 *[BGP/170] 02:02:40, localpref 100, from 172.16.1.1
AS path: I, validation-state: unverified
> to 10.10.10.1 via fe-1/2/0.0user@R3> show route protocol bgp
inet.0: 11 destinations, 11 routes (11 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
192.168.0.1/32 *[BGP/170] 02:02:51, localpref 100, from 172.16.1.1
AS path: I, validation-state: unverified
> to 10.10.10.5 via fe-1/2/1.0user@R4> show route protocol bgp
inet.0: 9 destinations, 11 routes (9 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
172.16.1.1/32 [BGP/170] 1d 20:38:54, localpref 100, from 172.16.1.1
AS path: I, validation-state: unverified
> to 10.10.10.9 via fe-1/2/2.0
10.10.10.0/30 [BGP/170] 1d 20:38:54, localpref 100, from 172.16.1.1
AS path: I, validation-state: unverified
> to 10.10.10.9 via fe-1/2/2.0意义
在设备 R1 上，命令 show route protocol direct 显示两个直接路由：172.16.1.1/32 和 10.10.10.0/30。该 show route protocol static 命令显示两个静态路由：192.168.0.1/32 和 192.168.20.1/32。
在设备 R2 上， show route protocol bgp 命令显示设备 R2 通过 BGP 获知的唯一路由是 192.168.20.1/32 路由。
在设备 R3 上， show route protocol bgp 命令显示设备 R3 通过 BGP 获知的唯一路由是 192.168.0.1/32 路由。
在设备 R4 上， show route protocol bgp 命令显示设备 R4 通过 BGP 获知的唯一路由是 172.16.1.1/32 和 10.10.10.0/30 路由。
验证 BGP 路由接收
目的
通过检查从设备 R1 接收的 BGP 路由，确保 BGP 导出策略按预期工作。
操作
user@R2> show route receive-protocol bgp 172.16.1.1 inet.0: 11 destinations, 11 routes (11 active, 0 holddown, 0 hidden) Prefix Nexthop MED Lclpref AS path * 192.168.20.1/32 172.16.1.1 100 I
user@R3> show route receive-protocol bgp 172.16.1.1 inet.0: 11 destinations, 11 routes (11 active, 0 holddown, 0 hidden) Prefix Nexthop MED Lclpref AS path * 192.168.0.1/32 172.16.1.1 100 I
user@R4> show route receive-protocol bgp 172.16.1.1 inet.0: 9 destinations, 11 routes (9 active, 0 holddown, 0 hidden) Prefix Nexthop MED Lclpref AS path 172.16.1.1/32 172.16.1.1 100 I 10.10.10.0/30 172.16.1.1 100 I
意义
在设备 R2 上， route receive-protocol bgp 172.16.1.1 命令显示设备 R2 仅从设备 R1 接收到一个 BGP 路由 192.168.20.1/32。
在设备 R3 上， route receive-protocol bgp 172.16.1.1 命令显示设备 R3 仅从设备 R1 接收一个 BGP 路由 192.168.0.1/32。
在 route receive-protocol bgp 172.16.1.1 设备 R4 上，命令显示设备 R4 从设备 R1 接收了两个 BGP 路由，即 172.16.1.1/32 和 10.10.10.0/30。
总之，当在 BGP 中的不同 CLI 层次结构中应用多个策略时，仅评估最具体的应用程序，而排除其他不太具体的策略应用程序。尽管这一点似乎很有道理，但在路由器配置期间，当您错误地认为邻居级别策略与全局或组级别策略结合使用时，却发现您的策略行为与预期不符时，很容易忘记这一点。