miercuri, 18 februarie 2015

1 client, 2 provideri, 3 optiuni - Inter AS VPN Layer 3 Option B

Mai jos va prezint cum reusesc doi provideri (ISP 1 - AS 100 si ISP 2 - AS 200) sa configureze un NNI (Network to Network Interconnection) pentru a permite interconectarea a doua site-uri diferite (CPE 1 - LAN 7.7.7.7 /32 si CPE 2 - LAN 1.1.1.1 /32) a aceluiasi client. Mai mult, acest mod de configurare permite utilizarea legaturii NNI pentru interconectarea mai multor clienti care au site-uri conectate la ambii ISP-isti.

Topologie


Config routerelor CPE

CPE 1

!Loopback0 - LAN
interface Loopback0
ip address 7.7.7.7 255.255.255.255

!Ethernet0/1 - WAN
interface Ethernet0/1
ip address 192.168.78.7 255.255.255.0

!ruta implicita - next hop router-ul PE1
ip route 0.0.0.0 0.0.0.0 192.168.78.8
CPE 2

!Loopback0 - LAN
interface Loopback0
ip address 1.1.1.1 255.255.255.255

!Ethernet0/1 - WAN
interface Ethernet0/1
ip address 192.168.211.1 255.255.255.0

!ruta implicita - next hop router-ul PE2
ip route 0.0.0.0 0.0.0.0 192.168.211.21


Config routerelor P

P1

interface Loopback0
ip address 23.23.23.23 255.255.255.255

!Ethernet0/0.423 - leg cu ASBR 1
interface Ethernet0/0.423
encapsulation dot1Q 423
ip address 10.4.23.23 255.255.255.0
mpls ip

!Ethernet0/0.823 - leg cu PE 1
interface Ethernet0/0.823
encapsulation dot1Q 823
ip address 10.8.23.23 255.255.255.0
mpls ip

router ospf 1
network 10.4.23.23 0.0.0.0 area 0
network 10.8.23.23 0.0.0.0 area 0
network 23.23.23.23 0.0.0.0 area 0
P2

interface Loopback0
ip address 22.22.22.22 255.255.255.255

!Ethernet0/0.322 - leg cu ASBR 2
interface Ethernet0/0.322
encapsulation dot1Q 322
ip address 10.3.22.22 255.255.255.0
mpls ip

!Ethernet0/0.212 - leg cu PE 2
interface Ethernet0/0.212
encapsulation dot1Q 212
ip address 10.21.22.22 255.255.255.0
mpls ip

router ospf 1
network 10.3.22.22 0.0.0.0 area 0
network 10.21.22.22 0.0.0.0 area 0
network 22.22.22.22 0.0.0.0 area 0


Config routerelor PE

PE1

ip vrf Client
rd 100:1
route-target export 100:1
route-target import 100:1

!RT 200:1 il au rutele anuntate din AS 200 route-target import 200:1

interface Loopback0
ip address 8.8.8.8 255.255.255.255

!Ethernet0/0.78 - leg catre CPE 1
interface Ethernet0/0.78
encapsulation dot1Q 78
ip vrf forwarding Client
ip address 192.168.78.8 255.255.255.0

!Ethernet0/0.823 - leg catre P1
interface Ethernet0/0.823
encapsulation dot1Q 823
ip address 10.8.23.8 255.255.255.0
mpls ip

router ospf 1
network 8.8.8.8 0.0.0.0 area 0
network 10.8.23.8 0.0.0.0 area 0

router bgp 100
no bgp default ipv4-unicast

!adiacenta iBGP cu ASBR 1
neighbor 4.4.4.4 remote-as 100
neighbor 4.4.4.4 update-source Loopback0

address-family vpnv4
neighbor 4.4.4.4 activate
neighbor 4.4.4.4 send-community both
exit-address-family

address-family ipv4 vrf Client
redistribute connected
redistribute static
exit-address-family

!ruta statica prin CPE 1 catre LAN 1
ip route vrf Client 7.7.7.7 255.255.255.255 192.168.78.7
PE2

ip vrf Client
rd 200:1
route-target export 200:1
route-target import 200:1

!RT 100:1 il au rutele anuntate din AS 100
route-target import 100:1

interface Loopback0
ip address 21.21.21.21 255.255.255.255

!Ethernet0/0.211 - leg catre CPE 2
interface Ethernet0/0.211
encapsulation dot1Q 211
ip vrf forwarding Client
ip address 192.168.211.21 255.255.255.0

!Ethernet0/0.212 - leg catre P2
interface Ethernet0/0.212
encapsulation dot1Q 212
ip address 10.21.22.21 255.255.255.0
mpls ip

router ospf 1
network 10.21.22.21 0.0.0.0 area 0
network 21.21.21.21 0.0.0.0 area 0

router bgp 200
no bgp default ipv4-unicast

!adiacenta iBGP cu ASBR 2
neighbor 3.3.3.3 remote-as 200
neighbor 3.3.3.3 update-source Loopback0

address-family vpnv4
neighbor 3.3.3.3 activate
neighbor 3.3.3.3 send-community both
exit-address-family

address-family ipv4 vrf Client
redistribute connected
redistribute static
exit-address-family

!ruta statica prin CPE 2 catre LAN 2
ip route vrf Client 1.1.1.1 255.255.255.255 192.168.211.1


Config routerelor ASBR

Pe aceste routere trebuie sa existe toata tabela de adrese VPNv4, la fel ca pe Route Reflector, fara insa sa definim VRF-uri pentru fiecare client, asa cum facem pentru Option A. Se poate aplica un nivel de filtrare ale adreselor VPNv4 pentru a anunta numai retele clientilor care au nevoie de acest NNI. In plus, toate PE-urile unui ISP trebuie sa aibe ca next-hop propriul ASBR pentru adresele VPNv4 invatate de la celalalt ISP.
ASBR1

interface Loopback0
ip address 4.4.4.4 255.255.255.255

!Ethernet0/0.43 - leg catre ASBR2
interface Ethernet0/0.43
encapsulation dot1Q 43
ip address 10.0.43.4 255.255.255.0
mpls bgp forwarding

!Ethernet0/0.423 - leg catre P1
interface Ethernet0/0.423
encapsulation dot1Q 423
ip address 10.4.23.4 255.255.255.0
mpls ip

router ospf 1
network 4.4.4.4 0.0.0.0 area 0
network 10.4.23.4 0.0.0.0 area 0

router bgp 100
no bgp default ipv4-unicast

!comanda de mai jos permite invatarea tuturor adreselor VPNv4, similar cu RR
no bgp default route-target filter

!adiacenta iBGP cu PE1
neighbor 8.8.8.8 remote-as 100
neighbor 8.8.8.8 update-source Loopback0
!adiacenta eBGP cu ASBR2
neighbor 10.0.43.3 remote-as 200

address-family vpnv4
neighbor 8.8.8.8 activate
neighbor 8.8.8.8 send-community both
neighbor 8.8.8.8 next-hop-self
neighbor 10.0.43.3 activate
neighbor 10.0.43.3 send-community both
exit-address-family
ASBR2

interface Loopback0
ip address 3.3.3.3 255.255.255.255

!Ethernet0/0.43 - leg catre ASBR1
interface Ethernet0/0.43
encapsulation dot1Q 43
ip address 10.0.43.3 255.255.255.0
mpls bgp forwarding

!Ethernet0/0.322 - leg catre P2
interface Ethernet0/0.322
encapsulation dot1Q 322
ip address 10.3.22.3 255.255.255.0
mpls ip

router ospf 1
network 3.3.3.3 0.0.0.0 area 0
network 10.3.22.3 0.0.0.0 area 0

router bgp 200
no bgp default ipv4-unicast

!comanda de mai jos permite invatarea tuturor adreselor VPNv4, similar cu RR
no bgp default route-target filter

!adiacenta eBGP cu ASBR1
neighbor 10.0.43.4 remote-as 100
!adiacenta iBGP cu PE2
neighbor 21.21.21.21 remote-as 200
neighbor 21.21.21.21 update-source Loopback0

address-family vpnv4
neighbor 10.0.43.4 activate
neighbor 10.0.43.4 send-community both
neighbor 21.21.21.21 activate
neighbor 21.21.21.21 send-community both
neighbor 21.21.21.21 next-hop-self
exit-address-family

Probleme similare adresam in cadrul cursurilor de CCNA / CCNP de la academia Netschool. Spor la invatat si urmatorul post la fi despre Option C.