华为设备配置CE使用穿越VPN的GRE隧道接入VPN

华为设备配置CE使用穿越VPN的GRE隧道接入VPN

1. 配置各接口IP地址

[CE3-GigabitEthernet0/0/0]ip add 20.1.1.1 24

[CE3-GigabitEthernet0/0/1]ip add 10.1.1.1 24

[CE1-GigabitEthernet0/0/0]ip add 20.1.1.2 24

[CE1-GigabitEthernet0/0/1]ip add 30.1.1.2 24

[PE1-GigabitEthernet0/0/0]ip add 30.1.1.3 24

[PE1-GigabitEthernet0/0/1]ip add 40.1.1.3 24

[PE1-LoopBack0]ip add 3.3.3.3 32

[PE2-GigabitEthernet0/0/0]ip add 40.1.1.4 24

[PE2-GigabitEthernet0/0/1]ip add 50.1.1.4 24

[PE2-LoopBack0]ip add 4.4.4.4 32

[CE2-GigabitEthernet0/0/0]ip add 50.1.1.5 24

[CE2-GigabitEthernet0/0/1]ip add 10.2.1.5 24

2. 配置骨干网PE的路由及MPLS：使能MPLS LDP，并使用进程为10的OSPF路由，使PE间路由可达，自动建立LSP

[PE1]mpls lsr-id 3.3.3.3

[PE1]mpls

[PE1-mpls]lsp-trigger all

[PE1]mpls ldp

[PE1]ospf 10

[PE1-ospf-10]area 0

[PE1-ospf-10-area-0.0.0.0]network 3.3.3.3 0.0.0.0

[PE1-ospf-10-area-0.0.0.0]network 40.1.1.0 0.0.0.255

[PE1-GigabitEthernet0/0/1]mpls

[PE1-GigabitEthernet0/0/1]mpls ldp

[PE2]mpls lsr-id 4.4.4.4

[PE2]mpls

[PE2-mpls]lsp-trigger all

[PE2]mpls ldp

[PE2]ospf 10

[PE2-ospf-10]area 0

[PE2-ospf-10-area-0.0.0.0]network 4.4.4.4 0.0.0.0

[PE2-ospf-10-area-0.0.0.0]network 40.1.1.0 0.0.0.255

[PE2-GigabitEthernet0/0/0]mpls

[PE2-GigabitEthernet0/0/0]mpls ldp

3. 在PE1创建VPN实例vpn2并与CE1接口绑定

[PE1]ip vpn-instance vpn2

[PE1-vpn-instance-vpn2]route-distinguisher 100:2

[PE1-vpn-instance-vpn2-af-ipv4]vpn-target 222:2 export-extcommunity

[PE1-vpn-instance-vpn2-af-ipv4]vpn-target 222:2 import-extcommunity

[PE1-GigabitEthernet0/0/0]ip binding vpn-instance vpn2

[PE1-GigabitEthernet0/0/0]ip add 30.1.1.3 24

4. 在PE1创建VPN实例vpn1并与GRE隧道绑定

[PE1]ip vpn-instance vpn1

[PE1-vpn-instance-vpn1]route-distinguisher 100:1

[PE1-vpn-instance-vpn1-af-ipv4]vpn-target 111:1 export-extcommunity

[PE1-vpn-instance-vpn1-af-ipv4]vpn-target 111:1 import-extcommunity

[PE1]int Tunnel 0/0/1

[PE1-Tunnel0/0/1]ip binding vpn-instance vpn1

[PE1-Tunnel0/0/1]ip add 2.2.2.2 24

5. 在PE2创建VPN实例vpn1并与用户侧接口绑定

[PE2]ip vpn-instance vpn1

[PE2-vpn-instance-vpn1]route-distinguisher 200:1

[PE2-vpn-instance-vpn1-af-ipv4]vpn-target 111:1 export-extcommunity

[PE2-vpn-instance-vpn1-af-ipv4]vpn-target 111:1 import-extcommunity

[PE2-GigabitEthernet0/0/1]ip binding  vpn-instance vpn1

[PE2-GigabitEthernet0/0/1]ip add 50.1.1.4 24

6. 配置GRE隧道的Tunnel接口

[CE3]int Tunnel 0/0/1

[CE3-Tunnel0/0/1]tunnel-protocol gre

[CE3-Tunnel0/0/1]source 20.1.1.1

[CE3-Tunnel0/0/1]destination 30.1.1.3

[CE3-Tunnel0/0/1]ip add 2.2.2.1 24

[PE1]int Tunnel 0/0/1

[PE1-Tunnel0/0/1]tunnel-protocol gre

[PE1-Tunnel0/0/1]source 30.1.1.3

[PE1-Tunnel0/0/1]destination vpn-instance vpn2 20.1.1.1

7. 配置CE3、CE1和PE1之间的路由协议

[CE3]ospf 20

[CE3-ospf-20]area 0

[CE3-ospf-20-area-0.0.0.0]network 20.1.1.0 0.0.0.255

[CE1]ospf 20

[CE1-ospf-20]area 0

[CE1-ospf-20-area-0.0.0.0]network 20.1.1.0 0.0.0.255

[CE1-ospf-20-area-0.0.0.0]network 30.1.1.0 0.0.0.255

[PE1]ospf 20 vpn-instance vpn2

[PE1-ospf-20]area 0

[PE1-ospf-20-area-0.0.0.0]network 30.1.1.0 0.0.0.255

8. 配置CE3与PE1之间的IS-IS路由

[CE3]isis 10

[CE3-isis-10]network-entity 10.0000.0000.0001.00

[CE3-GigabitEthernet0/0/0]isis enable 10

[CE3]int Tunnel 0/0/1

[CE3-Tunnel0/0/1]isis enable 10

[PE1]isis 10 vpn-instance vpn1

[PE1-isis-10]network-entity 10.0000.0000.0003.00

[PE1]int Tunnel 0/0/1

[PE1-Tunnel0/0/1]isis enable 10

9. 配置CE2与PE2之间的IS-IS路由

[CE2]isis 10

[CE2-isis-10]network-entity 10.0000.0000.0005.00

[CE2-GigabitEthernet0/0/0]isis enable 10

[CE2-GigabitEthernet0/0/1]isis enable 10

[PE2]isis 10 vpn-instance vpn1

[PE2-isis-10]network-entity 10.0000.0000.0004.00

[PE2-GigabitEthernet0/0/1]isis enable 10

10. 在PE之间建立MP-IBGP对等体

[PE1]bgp 100

[PE1-bgp]peer 4.4.4.4 as-number 100

[PE1-bgp]peer 4.4.4.4 connect-interface LoopBack 0

[PE1-bgp]ipv4-family vpnv4  //启动对等体交换VPN-IPv4路由信息

[PE1-bgp-af-vpnv4]peer 4.4.4.4 enable

[PE1-bgp]ipv4-family vpn-instance vpn1  //进入BGP的vpn1实例

[PE1-bgp-vpn1]import-route isis 10  //引入IS-IS路由

[PE2]bgp 100

[PE2-bgp]peer 3.3.3.3 as-number 100

[PE2-bgp]peer 3.3.3.3 connect-interface LoopBack 0

[PE2-bgp]ipv4-family vpnv4

[PE2-bgp-af-vpnv4]peer 3.3.3.3 enable

[PE2-bgp]ipv4-family vpn-instance vpn1

[PE2-bgp-vpn1]import-route isis 10

11. 在IS-IS中引入BGP路由

[PE1]isis 10

[PE1-isis-10]import-route bgp

[PE2]isis 10

[PE2-isis-10]import-route bgp

12. 检查配置

版权声明：本文内容由网络用户投稿，版权归原作者所有，本站不拥有其著作权，亦不承担相应法律责任。如果您发现本站中有涉嫌抄袭或描述失实的内容，请联系我们jiasou666@gmail.com 处理，核实后本网站将在24小时内删除侵权内容。