示例:为 VPN 配置代理 BGP 路由目标过滤
此示例说明如何配置代理 BGP 路由目标过滤(也称为代理路由目标约束或代理 RTC)。
要求
此示例使用以下硬件和软件组件:
四个瞻博网络设备,可以组合使用 M 系列、MX 系列或 T 系列路由器。
为代理 BGP 路由过滤配置的一个或多个设备上的 Junos OS 12.2 或更高版本。在此示例中,您可以在路由反射器上显式配置代理 BGP 路由过滤。
在配置代理 BGP 路由目标过滤之前,请确保您熟悉并理解以下概念:
概述
路由目标过滤减少了网络中接收不需要的 VPN 路由的设备数量。代理 BGP 路由目标过滤允许网络在当前不支持此功能的位置利用路由目标过滤。通过配置此功能,如果您的网络完全支持 BGP 路由目标过滤,则可以节省许多网络资源。
要配置代理 BGP 路由目标过滤,请在设备上包括该 family route-target proxy-generate
语句,以便为不支持 BGP 路由目标过滤的设备分配代理路由目标成员资格(RT 成员资格)公告。然后,代理 BGP 路由目标过滤路由存储在 bgp.rtarget.0 路由表中。
代理 BGP 路由目标过滤旨在为不支持 BGP 路由目标过滤功能的设备创建 RT 成员资格公告。 proxy-generate
如果语句存在,但路由目标家族与 BGP 对等方协商,则代理生成功能将被禁用。这允许简化 BGP 对等组的配置,其中组的一部分对等方支持路由目标过滤,而其他对等方则不支持。在这种情况下,语句 family route-target proxy-generate
可能是 BGP 对等组配置的一部分。
在网络中部署代理 BGP 路由目标过滤时, advertise-default
BGP 路由目标过滤的语句会使设备播发默认路由目标路由 (0:0:0/0),并抑制所有更具体的路由。如果您在一台设备上配置了代理 BGP 路由目标过滤,而一个或多个对等方已将 advertise-default
语句配置为其 BGP 路由目标过滤配置的一部分,则播发默认配置将被忽略。
拓扑图
图 1 显示了此示例中使用的拓扑。
在此示例中,BGP 路由目标过滤配置在路由反射器(设备 RR1 和设备 RR2)和提供商边缘 (PE) 设备 PE2 上,但另一个 PE(设备 PE1)不支持 BGP 路由目标过滤功能。设备 PE2 配置了四个 VPN(vpn1、vpn2、vpn3 和 vpn4)。设备 PE1 配置了两个 VPN(vpn1 和 vpn2),因此此设备仅对接收 vpn1 和 vpn2 的路由更新感兴趣。目前,这是不可能的,因为路由反射器(设备 RR1 和设备 RR2)学习并共享有关设备 PE1 的所有传入 VPN 路由(vpn1 到 vpn4)的信息。在示例拓扑中,所有设备都参与自治系统 (AS) 203,OSPF 是已配置的内部网关协议 (IGP),LDP 是 VPN 使用的信令协议。在此示例中,我们使用 VPN 路由和转发 (VRF) 实例中的静态路由来生成 VPN 路由。这是为了取代使用 PE 到客户边缘 (CE) 协议,如 OSPF 或 BGP。
要最大限度地减少设备 PE1 处理的 VPN 路由更新数量,请包括该 family route-target proxy-generate
语句,以在每个路由反射器上配置代理 BGP 路由目标过滤。每个路由反射器都有一个与设备 PE1 的对等会话,并支持路由目标过滤到核心。但是,设备 PE1 不支持路由目标过滤,因此设备 PE1 无法实现网络资源节省,因为它会接收所有 VPN 更新。通过在面向设备 PE1 的对等会话上配置代理 BGP 路由目标过滤,可以限制设备 PE1 处理的 VPN 更新数量,路由反射器将在整个网络中为设备 PE1 生成代理 BGP 路由目标路由。
配置
CLI 快速配置
要快速配置此示例,请复制以下命令,将其粘贴到文本文件中,删除所有换行符,更改详细信息,以便与网络配置匹配,然后将命令复制并粘贴到层级的 [edit]
CLI 中。
设备 PE1
set interfaces ge-1/0/0 unit 0 description PE1-to-RR1 set interfaces ge-1/0/0 unit 0 family inet address 10.49.0.1/30 set interfaces ge-1/0/0 unit 0 family mpls set interfaces ge-1/0/1 unit 0 description PE1-to-RR2 set interfaces ge-1/0/1 unit 0 family inet address 10.49.10.1/30 set interfaces ge-1/0/1 unit 0 family mpls set protocols ldp interface ge-1/0/0 set protocols ldp interface ge-1/0/1 set protocols bgp group internal type internal set protocols bgp group internal local-address 10.255.163.58 set protocols bgp group internal neighbor 10.255.165.220 family inet-vpn unicast set protocols bgp group internal neighbor 10.255.165.28 family inet-vpn unicast set protocols ospf area 0.0.0.0 interface ge-1/0/0 set protocols ospf area 0.0.0.0 interface ge-1/0/1 set protocols ospf area 0.0.0.0 interface lo0.0 passive set routing-options route-distinguisher-id 10.255.163.58 set routing-options autonomous-system 203 set routing-instances vpn1 instance-type vrf set routing-instances vpn1 vrf-target target:203:100 set routing-instances vpn1 routing-options static route 203.0.113.1/24 discard set routing-instances vpn2 instance-type vrf set routing-instances vpn2 vrf-target target:203:101 set routing-instances vpn2 routing-options static route 203.0.113.2/24 discard
设备 RR1
set interfaces ge-1/0/0 unit 0 description RR1-to-PE1 set interfaces ge-1/0/0 unit 0 family inet address 10.49.0.2/30 set interfaces ge-1/0/0 unit 0 family mpls set interfaces ge-1/0/1 unit 0 description RR1-to-PE2 set interfaces ge-1/0/1 unit 0 family inet address 10.50.0.2/30 set interfaces ge-1/0/1 unit 0 family mpls set protocols ldp interface ge-1/0/0 set protocols ldp interface ge-1/0/1 set protocols bgp group internal type internal set protocols bgp group internal local-address 198.51.100.1 set protocols bgp group internal cluster 198.51.100.1 set protocols bgp group internal neighbor 10.255.163.58 description vpn1-to-pe1 family inet-vpn unicast set protocols bgp group internal neighbor 10.255.163.58 family route-target proxy-generate set protocols bgp group internal neighbor 10.255.168.42 description vpn1-to-pe2 family inet-vpn unicast set protocols bgp group internal neighbor 10.255.168.42 family route-target set protocols ospf area 0.0.0.0 interface ge-1/0/0 set protocols ospf area 0.0.0.0 interface ge-1/0/1 set protocols ospf area 0.0.0.0 interface lo0.0 passive set routing-options route-distinguisher-id 10.255.165.220 set routing-options autonomous-system 203
设备 RR2
set interfaces ge-1/0/0 unit 0 description RR2-to-PE1 set interfaces ge-1/0/0 unit 0 family inet address 10.49.10.2/30 set interfaces ge-1/0/0 unit 0 family mpls set interfaces ge-1/0/1 unit 0 description RR2-to-PE2 set interfaces ge-1/0/1 unit 0 family inet address 10.50.10.2/30 set interfaces ge-1/0/1 unit 0 family mpls set protocols ldp interface ge-1/0/0 set protocols ldp interface ge-1/0/1 set protocols bgp group internal type internal set protocols bgp group internal local-address 10.255.165.28 set protocols bgp group internal cluster 198.51.100.1 set protocols bgp group internal neighbor 10.255.163.58 description vpn2-to-pe1 family inet-vpn unicast set protocols bgp group internal neighbor 10.255.163.58 family route-target proxy-generate set protocols bgp group internal neighbor 10.255.168.42 description vpn2-to-pe2 family inet-vpn unicast set protocols bgp group internal neighbor 10.255.168.42 family route-target set protocols ospf area 0.0.0.0 interface ge-1/0/0 set protocols ospf area 0.0.0.0 interface ge-1/0/1 set protocols ospf area 0.0.0.0 interface lo0.0 passive set routing-options route-distinguisher-id 10.255.165.28 set routing-options autonomous-system 203
设备 PE2
set interfaces ge-1/0/0 unit 0 description PE2-to-RR1 set interfaces ge-1/0/0 unit 0 family inet address 10.50.0.1/30 set interfaces ge-1/0/0 unit 0 family mpls set interfaces ge-1/0/1 unit 0 description PE2-to-RR2 set interfaces ge-1/0/1 unit 0 family inet address 10.50.10.1/30 set interfaces ge-1/0/1 unit 0 family mpls set protocols ldp interface ge-1/0/0 set protocols ldp interface ge-1/0/1 set protocols bgp group internal type internal set protocols bgp group internal local-address 10.255.168.42 set protocols bgp group internal family inet-vpn unicast set protocols bgp group internal family route-target set protocols bgp group internal neighbor 10.255.165.220 set protocols bgp group internal neighbor 10.255.165.28 set protocols ospf area 0.0.0.0 interface ge-1/0/0 set protocols ospf area 0.0.0.0 interface ge-1/0/1 set protocols ospf area 0.0.0.0 interface lo0.0 passive set routing-options route-distinguisher-id 10.255.168.42 set routing-options autonomous-system 203 set routing-instances vpn1 instance-type vrf set routing-instances vpn1 vrf-target target:203:100 set routing-instances vpn1 routing-options static route 203.0.113.1/24 discard set routing-instances vpn2 instance-type vrf set routing-instances vpn2 vrf-target target:203:101 set routing-instances vpn2 routing-options static route 203.0.113.2/24 discard set routing-instances vpn3 instance-type vrf set routing-instances vpn3 vrf-target target:203:103 set routing-instances vpn3 routing-options static route 203.0.113.3/24 discard set routing-instances vpn4 instance-type vrf set routing-instances vpn4 vrf-target target:203:104 set routing-instances vpn4 routing-options static route 203.0.113.4/24 discard
配置设备 PE1
逐步过程
以下示例要求您在配置层次结构中的各个级别上导航。有关导航 CLI 的信息,请参阅 在配置模式下使用 CLI 编辑器。
要配置设备 PE1:
配置接口。
[edit interfaces] user@PE1# set ge-1/0/0 unit 0 description PE1-to-RR1 user@PE1# set ge-1/0/0 unit 0 family inet address 10.49.0.1/30 user@PE1# set ge-1/0/0 unit 0 family mpls user@PE1# set ge-1/0/1 unit 0 description PE1-to-RR2 user@PE1# set ge-1/0/1 unit 0 family inet address 10.49.10.1/30 user@PE1# set ge-1/0/1 unit 0 family mpls
配置路由识别码和 AS 编号。
[edit routing-options] user@PE1# set route-distinguisher-id 10.255.163.58 user@PE1# set autonomous-system 203
将 LDP 配置为 VPN 使用的信令协议。
[edit protocols ldp] user@PE1# set interface ge-1/0/0 user@PE1# set interface ge-1/0/1
配置 BGP。
[edit protocols bgp group internal] user@PE1# set type internal user@PE1# set local-address 10.255.163.58 user@PE1# set neighbor 10.255.165.220 family inet-vpn unicast user@PE1# set neighbor 10.255.165.28 family inet-vpn unicast
配置 OSPF。
[edit protocols ospf area 0.0.0.0] user@PE1# set interface ge-1/0/0 user@PE1# set interface ge-1/0/1 user@PE1# set interface lo0.0 passive
配置 VPN 路由实例。
[edit routing-instances vpn1] user@PE1# set instance-type vrf user@PE1# set vrf-target target:203:100 user@PE1# set routing-options static route 203.0.113.1/24 discard
[edit routing-instances vpn2] user@PE1# set instance-type vrf user@PE1# set vrf-target target:203:101 user@PE1# set routing-options static route 203.0.113.2/24 discard
完成设备配置后,提交配置。
[edit] user@PE1# commit
结果
在配置模式下,输入 show interfaces
、 show protocols
、 show routing-options
和 show routing-instances
命令,以确认您的配置。如果输出未显示预期的配置,请重复此示例中的说明,以更正配置。
user@PE1# show interfaces ge-1/0/0 { unit 0 { description PE1-to-RR1; family inet { address 10.49.0.1/30; } family mpls; } } ge-1/0/1 { unit 0 { description PE1-to-RR2; family inet { address 10.49.10.1/30; } family mpls; } }
user@PE1# show protocols bgp { group internal { type internal; local-address 10.255.163.58; neighbor 10.255.165.220 { family inet-vpn { unicast; } } neighbor 10.255.165.28 { family inet-vpn { unicast; } } } } ospf { area 0.0.0.0 { interface ge-1/0/0.0; interface ge-1/0/1.0; interface lo0.0 { passive; } } } ldp { interface ge-1/0/0.0; interface ge-1/0/1.0; }
user@PE1# show routing-options route-distinguisher-id 10.255.14.182; autonomous-system 203;
user@PE1# show routing-instances vpn1 { instance-type vrf; vrf-target target:203:100; routing-options { static { route 203.0.113.1/24 discard; } } } vpn2 { instance-type vrf; vrf-target target:203:101; routing-options { static { route 203.0.113.2/24 discard; } } }
配置设备 RR1
逐步过程
以下示例要求您在配置层次结构中的各个级别上导航。有关导航 CLI 的信息,请参阅 在配置模式下使用 CLI 编辑器。
要配置设备 RR1:
配置接口。
[edit interfaces] user@RR1# set ge-1/0/0 unit 0 description RR1-to-PE1 user@RR1# set ge-1/0/0 unit 0 family inet address 10.49.0.2/30 user@RR1# set ge-1/0/0 unit 0 family mpls user@RR1# set ge-1/0/1 unit 0 description RR1-to-PE2 user@RR1# set ge-1/0/1 unit 0 family inet address 10.50.0.2/30 user@RR1# set ge-1/0/1 unit 0 family mpls
配置路由识别码和 AS 编号。
[edit routing-options] user@RR1# set route-distinguisher-id 10.255.165.220 user@RR1# set autonomous-system 203
将 LDP 配置为 VPN 使用的信令协议。
[edit protocols ldp] user@RR1# set interface ge-1/0/0 user@RR1# set interface ge-1/0/1
配置 BGP。
[edit protocols bgp group internal] user@RR1# set type internal user@RR1# set local-address 10.255.165.220 user@RR1# set cluster 198.51.100.1 user@RR1# set neighbor 10.255.163.58 description vpn1-to-pe1 family inet-vpn unicast user@RR1# set neighbor 10.255.168.42 description vpn1-to-pe2 family inet-vpn unicast
在与设备 PE2 的对等会话上配置 BGP 路由目标过滤。
[edit protocols bgp group internal] user@RR1# set neighbor 10.255.168.42 family route-target
在与设备 PE1 的对等会话上配置代理 BGP 路由目标过滤。
[edit protocols bgp group internal] user@RR1# set neighbor 10.255.163.58 family route-target proxy-generate
配置 OSPF。
[edit protocols ospf area 0.0.0.0] user@RR1# set interface ge-1/0/0 user@RR1# set interface ge-1/0/1 user@RR1# set interface lo0.0 passive
完成设备配置后,提交配置。
[edit] user@RR1# commit
结果
在配置模式下,输入 、 show protocols
和 show routing-options
命令,show interfaces
以确认您的配置。如果输出未显示预期的配置,请重复此示例中的说明,以更正配置。
user@RR1# show interfaces ge-1/0/0 { unit 0 { description RR1-to-PE1; family inet { address 10.49.0.2/30; } family mpls; } } ge-1/0/1 { unit 0 { description RR1-to-PE2; family inet { address 10.50.0.2/30; } family mpls; } }
user@RR1# show protocols bgp { group internal { type internal; local-address 198.51.100.1; cluster 198.51.100.1; neighbor 10.255.163.58 { description vpn1-to-pe1; family inet-vpn { unicast; } family route-target { proxy-generate; } } neighbor 10.255.168.42 { description vpn1-to-pe2; family inet-vpn { unicast; } family route-target; } } } ospf { area 0.0.0.0 { interface ge-1/0/0.0; interface ge-1/0/1.0; interface lo0.0 { passive; } } } ldp { interface ge-1/0/0.0; interface ge-1/0/1.0; }
user@RR1# show routing-options route-distinguisher-id 10.255.165.220; autonomous-system 203;
配置设备 RR2
逐步过程
以下示例要求您在配置层次结构中的各个级别上导航。有关导航 CLI 的信息,请参阅 在配置模式下使用 CLI 编辑器。
要配置设备 RR2:
配置接口。
[edit interfaces] user@RR2# set ge-1/0/0 unit 0 description RR2-to-PE1 user@RR2# set ge-1/0/0 unit 0 family inet address 10.49.10.2/30 user@RR2# set ge-1/0/0 unit 0 family mpls user@RR2# set ge-1/0/1 unit 0 description RR2-to-PE2 user@RR2# set ge-1/0/1 unit 0 family inet address 10.50.10.2/30 user@RR2# set ge-1/0/1 unit 0 family mpls
配置路由识别码和 AS 编号。
[edit routing-options] user@RR2# set route-distinguisher-id 10.255.165.28 user@RR2# set autonomous-system 203
将 LDP 配置为 VPN 使用的信令协议。
[edit protocols ldp] user@RR2# set interface ge-1/0/0 user@RR2# set interface ge-1/0/1
配置 BGP。
[edit protocols bgp group internal] user@RR2# set type internal user@RR2# set local-address 10.255.165.28 user@RR2# set cluster 198.51.100.1 user@RR2# set neighbor 10.255.163.58 description vpn2-to-pe1 family inet-vpn unicast user@RR2# set neighbor 10.255.168.42 description vpn2-to-pe2 family inet-vpn unicast
在与设备 PE2 的对等会话上配置 BGP 路由目标过滤。
[edit protocols bgp group internal] user@RR2# set neighbor 10.255.168.42 family route-target
在与设备 PE1 的对等会话上配置代理 BGP 路由目标过滤。
[edit protocols bgp group internal] user@RR2# set neighbor 10.255.163.58 family route-target proxy-generate
配置 OSPF。
[edit protocols ospf area 0.0.0.0] user@RR2# set interface ge-1/0/0 user@RR2# set interface ge-1/0/1 user@RR2# set interface lo0.0 passive
完成设备配置后,提交配置。
[edit] user@RR2# commit
结果
在配置模式下,输入 、 show protocols
和show routing-options
命令,show interfaces
以确认您的配置。如果输出未显示预期的配置,请重复此示例中的说明,以更正配置。
user@RR2# show interfaces ge-1/0/0 { unit 0 { description RR2-to-PE1; family inet { address 10.49.10.2/30; } family mpls; } } ge-1/0/1 { unit 0 { description RR2-to-PE2; family inet { address 10.50.10.2/30; } family mpls; } }
user@RR2# show protocols bgp { group internal { local-address 10.255.165.28; cluster 198.51.100.1; neighbor 10.255.163.58 { description vpn2-to-pe1; family inet-vpn { unicast; } family route-target { proxy-generate; } } neighbor 10.255.168.42 { description vpn2-to-pe2; family inet-vpn { unicast; } family route-target; } } } ospf { area 0.0.0.0 { interface ge-1/0/0.0; interface ge-1/0/1.0; interface lo0.0 { passive; } } } ldp { interface ge-1/0/0.0; interface ge-1/0/1.0; }
user@RR2# show routing-options route-distinguisher-id 10.255.165.28; autonomous-system 203;
配置设备 PE2
逐步过程
以下示例要求您在配置层次结构中的各个级别上导航。有关导航 CLI 的信息,请参阅 在配置模式下使用 CLI 编辑器。
要配置设备 PE2:
配置接口。
[edit interfaces] user@PE2# set ge-1/0/0 unit 0 description PE2-to-RR1 user@PE2# set ge-1/0/0 unit 0 family inet address 10.50.0.1/30 user@PE2# set ge-1/0/0 unit 0 family mpls user@PE2# set ge-1/0/1 unit 0 description PE2-to-RR2 user@PE2# set ge-1/0/1 unit 0 family inet address 10.50.10.1/30 user@PE2# set ge-1/0/1 unit 0 family mpls
配置路由识别码和 AS 编号。
[edit routing-options] user@PE2# set route-distinguisher-id 10.255.168.42 user@PE2# set autonomous-system 203
将 LDP 配置为 VPN 使用的信令协议。
[edit protocols ldp] user@PE2# set interface ge-1/0/0 user@PE2# set interface ge-1/0/1
配置 BGP。
[edit protocols bgp group internal] user@PE2# set type internal user@PE2# set local-address 10.255.168.42 user@PE2# set family inet-vpn unicast user@PE2# set family route-target user@PE2# set neighbor 10.255.165.220 user@PE2# set neighbor 10.255.165.28
配置 OSPF。
[edit protocols ospf area 0.0.0.0] user@PE2# set interface ge-1/0/0 user@PE2# set interface ge-1/0/1 user@PE2# set interface lo0.0 passive
配置 VPN 路由实例。
[edit routing-instances vpn1] user@PE2# set instance-type vrf user@PE2# set vrf-target target:203:100 user@PE2# set routing-options static route 203.0.113.1/24 discard
[edit routing-instances vpn2] user@PE2# set instance-type vrf user@PE2# set vrf-target target:203:101 user@PE2# set routing-options static route 203.0.113.2/24 discard
[edit routing-instances vpn3] user@PE2# set instance-type vrf user@PE2# set vrf-target target:203:103 user@PE2# set routing-options static route 203.0.113.3/24 discard
[edit routing-instances vpn4] user@PE2# set instance-type vrf user@PE2# set vrf-target target:203:104 user@PE2# set routing-options static route 203.0.113.4/24 discard
完成设备配置后,提交配置。
[edit] user@PE2# commit
结果
在配置模式下,输入 show interfaces
、 show protocols
、 show routing-options
和 show routing-instances
命令,以确认您的配置。如果输出未显示预期的配置,请重复此示例中的说明,以更正配置。
user@PE2# show interfaces ge-1/0/0 { unit 0 { description PE2-to-RR1; family inet { address 10.50.0.1/30; } family mpls; } } ge-1/0/1 { unit 0 { description PE2-to-RR2; family inet { address 10.50.10.1/30; } family mpls; } }
user@PE2# show protocols bgp { group internal { type internal; local-address 10.255.168.42; family inet-vpn { unicast; } family route-target; neighbor 10.255.165.220; neighbor 10.255.165.28; } } ospf { area 0.0.0.0 { interface ge-1/0/0.0; interface ge-1/0/1.0; interface lo0.0 { passive; } } } ldp { interface ge-1/0/0.0; interface ge-1/0/1.0; }
user@PE2# show routing-options route-distinguisher-id 10.255.168.42; autonomous-system 203;
user@PE2# show routing-instances vpn1 { instance-type vrf; vrf-target target:203:100; routing-options { static { route 203.0.113.1/24 discard; } } } vpn2 { instance-type vrf; vrf-target target:203:101; routing-options { static { route 203.0.113.2/24 discard; } } } vpn3 { instance-type vrf; vrf-target target:203:103; routing-options { static { route 203.0.113.3/24 discard; } } } vpn4 { instance-type vrf; vrf-target target:203:104; routing-options { static { route 203.0.113.4/24 discard; } } }
验证
确认配置工作正常。
验证代理 BGP 路由目标路由
目的
验证代理 BGP 路由目标路由是否显示在设备 RR1 上的 bgp.rtarget.0 表中。
行动
在操作模式下,输入 show route table bgp.rtartget.0
命令以显示代理 BGP 路由目标。
user@RR1# show route table bgp.rtarget.0 4 destinations, 6 routes (4 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both 203:203:100/96 *[RTarget/5] 00:01:22 Type Proxy for 10.255.163.58 Local [BGP/170] 00:04:55, localpref 100, from 10.255.168.42 AS path: I, validation-state: unverified > to 10.50.0.1 via ge-1/0/1 203:203:101/96 *[RTarget/5] 00:01:22 Type Proxy for 10.255.163.58 Local [BGP/170] 00:04:55, localpref 100, from 10.255.168.42 AS path: I, validation-state: unverified > to 10.50.0.1 via ge-1/0/1 203:203:103/96 *[BGP/170] 00:04:55, localpref 100, from 10.255.168.42 AS path: I, validation-state: unverified > to 10.50.0.1 via ge-1/0/1 203:203:104/96 *[BGP/170] 00:04:55, localpref 100, from 10.255.168.42 AS path: I, validation-state: unverified > to 10.50.0.1 via ge-1/0/1
意义
设备 RR1 正在代表对等设备 PE1 生成代理 BGP 路由目标路由。代理 BGP 路由目标路由使用协议和优先级 [RTarget/5]
以及路由目标类型 Proxy
进行标识。