HCIP-Datacom-Advanced Routing Switching Technology V1.0 Lab Guide
HCIP-Datacom-Advanced Routing Switching Technology V1.0 Lab Guide
and other Huawei trademarks are trademarks of Huawei Technologies Co., Ltd.
All other trademarks and trade names mentioned in this document are the property of their respective
holders.
Notice
The purchased products, services and features are stipulated by the contract made between Huawei and
the customer. All or part of the products, services and features described in this document may not be
within the purchase scope or the usage scope. Unless otherwise specified in the contract, all statements,
information, and recommendations in this document are provided "AS IS" without warranties, guarantees
or representations of any kind, either express or implied.
The information in this document is subject to change without notice. Every effort has been made in
the preparation of this document to ensure accuracy of the contents, but all statements,
information, and recommendations in this document do not constitute a warranty of any kind,
express or implied.
Bantian, Longgang
Shenzhen 518129
Website: https://e.huawei.com/
1
Overview
This document is an HCIP-Datacom-Advanced Routing & Switching Technology training
course and is intended for trainees who are going to take the HCIP-Datacom-Advanced
Routing & Switching Technology exam or readers who want to understand advanced
Interior Gateway Protocol (IGP), advanced Border Gateway Protocol (BGP), IPv6 routing,
advanced Virtual Local Area Network (VLAN) technologies, Ethernet switching security,
Multiprotocol Label Switching (MPLS) principles, network O&M, network fault
troubleshooting, and network migration.
5. Be familiar with the basic working principles of Ethernet switches and routers.
Symbol Conventions
1
Lab Environment
Network Description
This lab environment is intended for datacom engineers who are preparing for the HCIP-
Datacom-Advanced Routing & Switching Technology exam. Each lab environment
includes three switches (PoE not supported), two PoE switches, and five routers.
Device Requirements
To meet exercise requirements, the recommended configurations of the environment are
as follows.
Contents
Overview ................................................................................................................................................................................. 3
Background Knowledge Required ............................................................................................................................... 3
Symbol Conventions .......................................................................................................................................................... 3
Lab Environment ................................................................................................................................................................. 4
● Deploy Fast Reroute (FRR) and Bidirectional Forwarding Detection (BFD) to speed up
Open Shortest Path First (OSPF) convergence.
● Filter outgoing OSPF Link State Advertisements (LSAs).
● Deploy inter-area route filtering to reduce the OSPF link state database (LSDB) size.
Figure 1-1 shows interconnected interfaces and their IP addresses. Loopback0 interfaces
are created on all devices, and their IP addresses are 10.0.x.x/24, where x indicates the
device number.
Interconnected interfaces of R1, R2, and R3 belong to OSPF area 0. Loopback0 interfaces
of R1, R2, and R3 also belong to OSPF area 0, and interconnected interfaces of R3 and R4
and the Loopback0 interface of R4 belong to OSPF area 1.
1.1.1.2 Background
There are four AR routers running OSPF on the intranet. To control the number of OSPF
LSDBs, the four AR routers are assigned to different areas. IS-IS runs between R4 (ASBR)
in OSPF area 1 and R5 in the branch.
To speed up OSPF convergence, the network administrator deploys OSPF IP FRR and
association between OSPF and BFD.
The branch needs to access the headquarters network. The network administrator has
delivered the default IS-IS routes to the branch instead of importing OSPF routes to the
IS-IS routing table.
6. Create Loopback2 interfaces with the same IP address on R1 and R2, activate OSPF
on the interfaces, and check whether equal-cost routes exist in the OSPF routing
table on R3. Then limit the number of equal-cost routes to 1. Create Loopback3 on
R4 and activate OSPF. Configure inter-area route filtering on R3 (ABR) to prevent
Loopback3 on R4 from advertising routes to OSPF area 0.
# Configure IP addresses for GE0/0/1, GE0/0/2, GE0/0/3, and a loopback interface on R3.
[R3]interface GigabitEthernet0/0/1
[R3-GigabitEthernet0/0/1] ip address 10.0.13.3 255.255.255.0
[R3-GigabitEthernet0/0/1] quit
[R3]interface GigabitEthernet0/0/2
[R3-GigabitEthernet0/0/2] ip address 10.0.34.3 255.255.255.0
[R3-GigabitEthernet0/0/2]quit
[R3]interface GigabitEthernet0/0/3
[R3-GigabitEthernet0/0/3] ip address 10.0.23.3 255.255.255.0
[R3-GigabitEthernet0/0/3] quit
[R3]interface LoopBack0
[R3-LoopBack0] ip address 10.0.3.3 255.255.255.0
[R3-LoopBack0] quit
<R1>ping -c 1 10.0.13.3
PING 10.0.13.3: 56 data bytes, press CTRL_C to break
Reply from 10.0.13.3: bytes=56 Sequence=1 ttl=255 time=50 ms
<R2>ping -c 1 10.0.23.3
PING 10.0.23.3: 56 data bytes, press CTRL_C to break
Reply from 10.0.23.3: bytes=56 Sequence=1 ttl=255 time=60 ms
<R4>ping -c 1 10.0.34.3
PING 10.0.34.3: 56 data bytes, press CTRL_C to break
Reply from 10.0.34.3: bytes=56 Sequence=1 ttl=255 time=40 ms
<R4>ping -c 1 10.0.45.5
PING 10.0.45.5: 56 data bytes, press CTRL_C to break
Reply from 10.0.45.5: bytes=56 Sequence=1 ttl=255 time=80 ms
Configure OSPF on R1, R2, R3, and R4, use the IP address of Loopback0 as the router ID,
set the OSPF process ID to 1, and activate OSPF on the corresponding interfaces.
1
# Configure IP addresses of Loopback0 interfaces as OSPF router IDs of R1, R2, R3, and
R4 and set the OSPF process ID to 1.
[R1]ospf 1 router-id 10.0.1.1
Total Nets: 9
Intra Area: 7 Inter Area: 2 ASE: 0 NSSA: 0
R1 has learned OSPF routes on the entire network.
1
Configure IS-IS processes on routers one by one according to the topology design. Set the
process ID to 1 and NET to the device ID. Here, the NET of R4 is
49.0001.0000.0000.0004.00.
# Check the IS-IS neighbor relationship and IS-IS routing table on R4.
[R4]display isis peer
Total Peer(s): 1
An IS-IS Level-1 neighbor relationship has been established between R4 and R5.
[R4]display isis route
To back up the path from R1 to Loopback0 on R4, enable OSPF IP FRR on R1.
Destination : 10.0.4.4/32
AdverRouter : 10.0.3.3 Area : 0.0.0.0
Cost :2 Type : Inter-area
NextHop : 10.0.13.3 Interface : GigabitEthernet0/0/1
Priority : Medium Age : 00h35m44s
In this case, the next hop of the OSPF route 10.0.4.4/32 is 10.0.13.3.
Destination : 10.0.4.4/32
AdverRouter : 10.0.3.3 Area : 0.0.0.0
Cost :2 Type : Inter-area
NextHop : 10.0.13.3 Interface : GigabitEthernet0/0/1
Priority : Medium Age : 00h01m00s
Backup Nexthop : 10.0.12.2 Backup Interface : GigabitEthernet0/0/2
Backup Type : LFA LINK
A backup route destined for R4's Loopback0 interface has been generated on R1, with the
next hop address being 10.0.12.2 and outbound interface being GE0/0/2. The backup
route is destined for R4's Loopback0 interface through R2.
1
To speed up OSPF convergence, enable BFD on all routers in the OSPF domain, configure
BFD on interconnected interfaces, and disable GE0/0/1 on R3. Check whether R1 can
quickly detect the BFD session termination and trigger OSPF route switching.
[R2]bfd
[R2-bfd] quit
[R2]ospf 1
[R2-ospf-1] bfd all-interfaces enable
[R2-ospf-1] quit
[R3]bfd
[R3-bfd] quit
[R3]ospf 1
[R3-ospf-1] bfd all-interfaces enable
[R3-ospf-1] quit
[R4]bfd
[R4-bfd] quit
[R4]ospf 1
[R4-ospf-1] bfd all-interfaces enable
[R4-ospf-1] quit
# Configure BFD on R1, set the minimum intervals for sending and receiving packets to
500 ms, and the local detection multiplier to 4.
[R1]interface GigabitEthernet0/0/1
[R1-GigabitEthernet0/0/1] ospf bfd enable
[R1-GigabitEthernet0/0/1] ospf bfd min-tx-interval 500 min-rx-interval 500 detect-multiplier 4
[R1-GigabitEthernet0/0/1] quit
[R1]interface GigabitEthernet0/0/2
[R1-GigabitEthernet0/0/2] ospf bfd enable
[R1-GigabitEthernet0/0/2] ospf bfd min-tx-interval 500 min-rx-interval 500 detect-multiplier 4
[R1-GigabitEthernet0/0/2] quit
# Configure BFD on R2, set the minimum intervals for sending and receiving packets to
500 ms, and the local detection multiplier to 4.
[R2]interface GigabitEthernet0/0/2
[R2-GigabitEthernet0/0/2] ospf bfd enable
[R2-GigabitEthernet0/0/2] ospf bfd min-tx-interval 500 min-rx-interval 500 detect-multiplier 4
[R2-GigabitEthernet0/0/2] quit
[R2]interface GigabitEthernet0/0/3
1
# Configure BFD on R3, set the minimum intervals for sending and receiving packets to
500 ms, and the local detection multiplier to 4.
[R3]interface GigabitEthernet0/0/1
[R3-GigabitEthernet0/0/1] ospf bfd enable
[R3-GigabitEthernet0/0/1] ospf bfd min-tx-interval 500 min-rx-interval 500 detect-multiplier 4
[R3-GigabitEthernet0/0/1] quit
[R3]interface GigabitEthernet0/0/2
[R3-GigabitEthernet0/0/2] ospf bfd enable
[R3-GigabitEthernet0/0/2] ospf bfd min-tx-interval 500 min-rx-interval 500 detect-multiplier 4
[R3-GigabitEthernet0/0/2] quit
[R3]interface GigabitEthernet0/0/3
[R3-GigabitEthernet0/0/3] ospf bfd enable
[R3-GigabitEthernet0/0/3] ospf bfd min-tx-interval 500 min-rx-interval 500 detect-multiplier 4
[R3-GigabitEthernet0/0/3] quit
# Configure BFD on R4, set the minimum intervals for sending and receiving packets to
500 ms, and the local detection multiplier to 4.
[R4]interface GigabitEthernet0/0/3
[R4-GigabitEthernet0/0/3] ospf bfd enable
[R4-GigabitEthernet0/0/3] ospf bfd min-tx-interval 500 min-rx-interval 500 detect-multiplier 4
[R4-GigabitEthernet0/0/3] quit
The BFD sessions between R1 and R2 and between R1 and R3 are up.
[R3]display ospf bfd session all
The BFD sessions between R3 and R1, R2, and R4 are Up.
# Shut down GE0/0/1 of R3 and test the association between BFD and OSPF.
[R3]interface GigabitEthernet0/0/1
[R3-GigabitEthernet0/0/1] shutdown
[R3-GigabitEthernet0/0/1] quit
R1 and R3 are connected through S5. After GE0/0/1 on R3 is shut down, GE0/0/1 on R1 is
still Up and cannot detect the connectivity interruption between R1 and R3.
The OSPF neighbor relationship between R1 and R3 has been terminated, and the time of
shutting down GE0/0/1 on R3 is smaller than the OSPF dead interval.
# Run the display ospf peer last-nbr-down command on R1 to check the reason why the
neighbor relationship is interrupted.
1
The command output shows that the neighbor relationship between R1 and R3 is
interrupted because the BFD session is Down.
Destination : 10.0.4.4/32
AdverRouter : 10.0.3.3 Area : 0.0.0.0
Cost :3 Type : Inter-area
NextHop : 10.0.12.2 Interface : GigabitEthernet0/0/2
Priority : Medium Age : 00h01m25s
The next hop of the route to R4's Loopback0 interface is changed to 10.0.12.2, and the
outbound interface is GE0/0/2.
On R4, create the loopback 3 interface with the IP address on network segment
172.16.3.1/24, change the OSPF interface type to broadcast, activate OSPF on the
Loopback3 interface, and perform inter-area Type 3 LSA filtering on R3 (ABR) to prevent
the OSPF inter-area route 172.16.3.0/24 from being transmitted to OSPF area 0.
[R2]interface LoopBack2
[R2-LoopBack2] ip address 172.16.2.1 255.255.255.0
[R2-LoopBack2] quit
[R2]ospf 1
[R2-ospf-1]area 0.0.0.0
[R2-ospf-1-area-0.0.0.0] network 172.16.2.1 0.0.0.0
[R2-ospf-1-area-0.0.0.0] quit
[R2-ospf-1]quit
# After the OSPF neighbor relationship between R1 and R3 is reestablished, check the
OSPF routing table of R3.
[R3-ospf-1]display ospf routing
Total Nets: 11
Intra Area: 11 Inter Area: 0 ASE: 0 NSSA: 0
The OSPF route 172.16.2.1/32 on R3 is used for load balancing, with R1 and R2 as next
hops.
# Set the maximum number of equal-cost routes for load balancing to 1 on R3.
[R3]ospf 1
[R3-ospf-1] maximum load-balancing 1
Total Nets: 9
Intra Area: 9 Inter Area: 0 ASE: 0 NSSA: 0
There is only one OSPF route 172.16.2.1/32 on R3, and the next hop is R2.
When the number of equal-cost routes is greater than number specified in the maximum
load-balancing command, valid routes are selected for load balancing based on the
following criteria:
1. Route priority: Routes with the highest priority (lowest weight) are selected for load
balancing.
2. Interface index: If routes have the same priority, the routes with the largest interface
index are selected for load balancing.
3. Next-hop IP address: If routes have the same priority and interface index, the routes
with the largest next-hop IP addresses are selected for load balancing.
[R4]ospf 1
[R4-ospf-1]area 1
[R4-ospf-1-area-0.0.0.1] network 172.16.3.1 0.0.0.0
[R4-ospf-1-area-0.0.0.1] quit
[R4-ospf-1] quit
Total Nets: 11
Intra Area: 8 Inter Area: 3 ASE: 0 NSSA: 0
Area: 0.0.0.0
Type LinkState ID AdvRouter Age Len Sequence Metric
Router 10.0.3.3 10.0.3.3 599 60 8000001E 1
Router 10.0.2.2 10.0.2.2 761 72 80000014 1
Router 10.0.1.1 10.0.1.1 602 72 80000014 1
Network 10.0.23.3 10.0.3.3 1693 32 80000002 0
Network 10.0.13.1 10.0.1.1 602 32 80000002 0
Network 10.0.12.2 10.0.2.2 373 32 80000008 0
Sum-Net 10.0.34.0 10.0.3.3 535 28 80000007 1
Sum-Net 172.16.3.0 10.0.3.3 455 28 80000001 1
Sum-Net 10.0.4.4 10.0.3.3 39 28 80000007 1
Area: 0.0.0.1
Type LinkState ID AdvRouter Age Len Sequence Metric
Router 10.0.3.3 10.0.3.3 337 36 8000000B 1
Router 10.0.4.4 10.0.4.4 418 60 80000010 1
Network 10.0.34.3 10.0.3.3 337 32 80000008 0
Sum-Net 10.0.13.0 10.0.3.3 640 28 80000003 1
Sum-Net 10.0.12.0 10.0.3.3 1693 28 80000002 2
Sum-Net 172.16.2.1 10.0.3.3 1398 28 80000001 1
Sum-Net 10.0.3.3 10.0.3.3 1680 28 80000006 0
Sum-Net 10.0.2.2 10.0.3.3 1693 28 80000002 1
Sum-Net 10.0.1.1 10.0.3.3 599 28 80000003 1
Sum-Net 10.0.23.0 10.0.3.3 1739 28 80000002 1
In the LSDB of OSPF area 0 on R3 (ABR), you can view the Type 3 LSA 172.16.3.0.
# Configure Type 3 LSA filtering on R3 (ABR) to prevent the OSPF inter-area route
172.16.3.0/24 from being transmitted to OSPF area 0.
[R3]ip ip-prefix 1 index 10 deny 172.16.3.0 24 greater-equal 24 less-equal 24
[R3]ip ip-prefix 1 index 20 permit 0.0.0.0 0 less-equal 32
[R3]ospf 1
[R3-ospf-1] area 1
[R3-ospf-1-area-0.0.0.1] filter ip-prefix 1 export
1
Area: 0.0.0.0
Type LinkState ID AdvRouter Age Len Sequence Metric
Router 10.0.3.3 10.0.3.3 966 60 8000001E 1
Router 10.0.2.2 10.0.2.2 1128 72 80000014 1
Router 10.0.1.1 10.0.1.1 969 72 80000014 1
Network 10.0.23.3 10.0.3.3 259 32 80000003 0
Network 10.0.13.1 10.0.1.1 969 32 80000002 0
Network 10.0.12.2 10.0.2.2 740 32 80000008 0
Sum-Net 10.0.34.0 10.0.3.3 13 28 80000001 1
Sum-Net 10.0.4.4 10.0.3.3 13 28 80000001 1
Area: 0.0.0.1
Type LinkState ID AdvRouter Age Len Sequence Metric
Router 10.0.3.3 10.0.3.3 704 36 8000000B 1
Router 10.0.4.4 10.0.4.4 785 60 80000010 1
Network 10.0.34.3 10.0.3.3 704 32 80000008 0
Sum-Net 10.0.13.0 10.0.3.3 1007 28 80000003 1
Sum-Net 10.0.12.0 10.0.3.3 259 28 80000003 2
Sum-Net 172.16.2.1 10.0.3.3 1765 28 80000001 1
Sum-Net 10.0.3.3 10.0.3.3 246 28 80000007 0
Sum-Net 10.0.2.2 10.0.3.3 259 28 80000003 1
Sum-Net 10.0.1.1 10.0.3.3 966 28 80000003 1
Sum-Net 10.0.23.0 10.0.3.3 307 28 80000003 1
The Type 3 LSA 172.16.3.0 cannot be found in the LSDB of OSPF area 0 on R3.
Advertise the default route on R4 (IS-IS Level-1-2) and check whether the default route is
generated on R5 (IS-IS Level-1).
Total LSP(s): 4
*(In TLV)-Leaking Route, *(By LSPID)-Self LSP, +-Self LSP(Extended),
ATT-Attached, P-Partition, OL-Overload
1.1.3 Quiz
Why can the filter ip-prefix ip-prefix-name export command be used on an ABR to filter
OSPF inter-area routes but cannot be used on a router in an OSPF area to filter OSPF
intra-area routes?
Configuration on R2
#
sysname R2
#
bfd
#
interface GigabitEthernet0/0/2
ip address 10.0.23.2 255.255.255.0
ospf bfd enable
1
Configuration on R3
#
sysname R3
#
bfd
#
interface GigabitEthernet0/0/1
ip address 10.0.13.3 255.255.255.0
ospf bfd enable
ospf bfd min-tx-interval 500 min-rx-interval 500 detect-multiplier 4
#
interface GigabitEthernet0/0/2
ip address 10.0.34.3 255.255.255.0
ospf bfd enable
ospf bfd min-tx-interval 500 min-rx-interval 500 detect-multiplier 4
#
interface GigabitEthernet0/0/3
ip address 10.0.23.3 255.255.255.0
ospf bfd enable
ospf bfd min-tx-interval 500 min-rx-interval 500 detect-multiplier 4
#
interface LoopBack0
ip address 10.0.3.3 255.255.255.0
#
ospf 1 router-id 10.0.3.3
bfd all-interfaces enable
maximum load-balancing 1
area 0.0.0.0
network 10.0.13.3 0.0.0.0
network 10.0.23.3 0.0.0.0
1
Configuration on R4
#
sysname R4
#
bfd
#
isis 1
network-entity 49.0001.0000.0000.0004.00
default-route-advertise always level-1-2
#
interface GigabitEthernet0/0/2
ip address 10.0.45.4 255.255.255.0
isis enable 1
#
interface GigabitEthernet0/0/3
ip address 10.0.34.4 255.255.255.0
ospf bfd enable
ospf bfd min-tx-interval 500 min-rx-interval 500 detect-multiplier 4
#
interface LoopBack0
ip address 10.0.4.4 255.255.255.0
#
interface LoopBack3
ip address 172.16.3.1 255.255.255.0
ospf network-type broadcast
#
ospf 1 router-id 10.0.4.4
bfd all-interfaces enable
area 0.0.0.1
network 10.0.34.4 0.0.0.0
network 10.0.4.4 0.0.0.0
network 172.16.3.1 0.0.0.0
#
return
Configuration on R5
#
sysname R5
#
isis 1
is-level level-1
1
network-entity 49.0001.0000.0000.0005.00
#
interface GigabitEthernet0/0/3
ip address 10.0.45.5 255.255.255.0
isis enable 1
#
interface LoopBack0
ip address 10.0.5.5 255.255.255.0
isis enable 1
#
return
1
OA: IP addresses of Loopback0 interfaces on S1, S2, and S5 are on the OA service
network segment. OA data can be transmitted between branches and between branches
and the headquarters. The routes related to OA services must be marked as originating
ASs.
1
Finance: IP addresses of Loopback1 interfaces of S1, S2, and S5 belong to the financial
service network segment. Confidential financial data can be transmitted only between
branches and the headquarters.
The network administrator needs to build a secure network that meets these
requirements.
4. Configure R1, R3, and R5 to establish Internal BGP (IBGP) peer relationships with R2
and R4, and configure R1, R3, and R5 as RR clients of R2 and R4.
5. Configure R3 as a level-1 RR, establish IBGP peer relationships with R2 and R4, and
configure R2 and R4 as RR clients of R3.
6. Configure R1, R2, and R3 to add the community attribute to the routes of Loopback0
interfaces to mark the originating AS of the OA service.
7. Configure a routing policy on R1, R3, and R5 and use the AS-Path Filter tool to filter
routes of Loopback1 interfaces.
[R2]interface LoopBack0
[R2-LoopBack0] ip address 10.10.10.2 255.255.255.255
[R2-LoopBack0] quit
[R2]interface GigabitEthernet0/0/2
[R2-GigabitEthernet0/0/2] ip address 10.0.23.2 255.255.255.0
[R2-GigabitEthernet0/0/2] quit
[R2]interface GigabitEthernet0/0/3
[R2-GigabitEthernet0/0/3] ip address 10.0.12.2 255.255.255.0
[R2-GigabitEthernet0/0/3] quit
# Configure the VLAN to which GE0/0/1 of S1 belongs and IP addresses for VLANIF 1,
Loopback0, and Loopback1.
[S1]interface LoopBack0
[S1-LoopBack0] ip address 10.0.1.1 255.255.255.255
[S1-LoopBack0] quit
[S1]interface LoopBack1
[S1-LoopBack1] ip address 10.1.1.1 255.255.255.255
1
[S1-LoopBack1] quit
[S1]interface GigabitEthernet0/0/1
[S1-GigabitEthernet0/0/1] port link-type access
[S1-GigabitEthernet0/0/1] port default vlan 1
[S1-GigabitEthernet0/0/1] quit
[S1]interface Vlanif 1
[S1-Vlanif1] ip address 10.0.11.1 24
[S1-Vlanif1] quit
# Configure the VLAN to which GE0/0/5 of S2 belongs and IP addresses for VLANIF 1,
Loopback0, and Loopback1.
[S2]interface LoopBack0
[S2-LoopBack0] ip address 10.0.2.1 255.255.255.255
[S2-LoopBack0] quit
[S2]interface LoopBack1
[S2-LoopBack1] ip address 10.1.2.1 255.255.255.255
[S2-LoopBack1] quit
[S2]interface GigabitEthernet0/0/5
[S2-GigabitEthernet0/0/5] port link-type access
[S2-GigabitEthernet0/0/5] port default vlan 1
[S2-GigabitEthernet0/0/5] quit
[S2]interface Vlanif 1
[S2-Vlanif1] ip address 10.0.25.2 24
[S2-Vlanif1] quit
# Configure the VLAN to which GE0/0/3 of S5 belongs and IP addresses for VLANIF 1,
Loopback0, and Loopback1.
[S5]interface LoopBack0
[S5-LoopBack0] ip address 10.0.3.1 255.255.255.255
[S5-LoopBack0] quit
[S5]interface LoopBack1
[S5-LoopBack1] ip address 10.1.3.1 255.255.255.255
[S5-LoopBack1] quit
[S5]interface GigabitEthernet0/0/3
[S5-GigabitEthernet0/0/3] port link-type access
[S5-GigabitEthernet0/0/3] port default vlan 1
[S5-GigabitEthernet0/0/3] quit
[S5]interface Vlanif 1
[S5-Vlanif1] ip address 10.0.35.5 24
[S5-Vlanif1] quit
# Check the connectivity of IP addresses of interconnection interfaces on R1, R3, and R5.
<R1>ping -c 1 10.0.11.1
PING 10.0.11.1: 56 data bytes, press CTRL_C to break
Reply from 10.0.11.1: bytes=56 Sequence=1 ttl=255 time=90 ms
<R1>ping -c 1 10.0.12.2
PING 10.0.12.2: 56 data bytes, press CTRL_C to break
1
<R3>ping -c 1 10.0.23.2
PING 10.0.23.2: 56 data bytes, press CTRL_C to break
Reply from 10.0.23.2: bytes=56 Sequence=1 ttl=255 time=70 ms
<R3>ping -c 1 10.0.34.4
PING 10.0.34.4: 56 data bytes, press CTRL_C to break
Reply from 10.0.34.4: bytes=56 Sequence=1 ttl=255 time=60 ms
<R3>ping -c 1 10.0.35.5
PING 10.0.35.5: 56 data bytes, press CTRL_C to break
Reply from 10.0.35.5: bytes=56 Sequence=1 ttl=255 time=50 ms
<R5>ping -c 1 10.0.45.4
PING 10.0.45.4: 56 data bytes, press CTRL_C to break
Reply from 10.0.45.4: bytes=56 Sequence=1 ttl=255 time=60 ms
<R5>ping -c 1 10.0.25.2
PING 10.0.25.2: 56 data bytes, press CTRL_C to break
Reply from 10.0.25.2: bytes=56 Sequence=1 ttl=255 time=50 ms
Configure an OSPF process on each router according to the topology design. Set the
process ID to 1, area ID to 0, and router ID to the loopback interface's IP address of the
router. R1 with the router ID of 10.10.10.1 is used as an example.
# Configure R1.
[R1]router id 10.10.10.1
[R1]ospf 1
[R1-ospf-1] area 0
[R1-ospf-1-area-0.0.0.0] network 10.10.10.1 0.0.0.0
[R1-ospf-1-area-0.0.0.0] network 10. 0.12.1 0.0.0.0
# Configure R2.
[R2]router id 10.10.10.2
[R2]ospf 1
[R2-ospf-1] area 0
[R2-ospf-1-area-0.0.0.0] network 10.10.10.2 0.0.0.0
[R2-ospf-1-area-0.0.0.0] network 10.0.12.2 0.0.0.0
[R2-ospf-1-area-0.0.0.0] network 10.0.23.2 0.0.0.0
# Configure R3.
[R3]router id 10.10.10.3
[R3]ospf 1
[R3-ospf-1] area 0
[R3-ospf-1-area-0.0.0.0] network 10.10.10.3 0.0.0.0
[R3-ospf-1-area-0.0.0.0] network 10.0.23.3 0.0.0.0
[R3-ospf-1-area-0.0.0.0] network 10.0.34.3 0.0.0.0
[R3-ospf-1-area-0.0.0.0] network 10.0.35.3 0.0.0.0
# Configure R4.
[R4]router id 10.10.10.4
[R4]ospf 1
[R4-ospf-1] area 0
[R4-ospf-1-area-0.0.0.0] network 10.10.10.4 0.0.0.0
[R4-ospf-1-area-0.0.0.0] network 10.0.34.4 0.0.0.0
[R4-ospf-1-area-0.0.0.0] network 10.0.45.4 0.0.0.0
# Configure R5.
[R5]router id 10.10.10.5
[R5]ospf 1
[R5-ospf-1] area 0
[R5-ospf-1-area-0.0.0.0] network 10.10.10.5 0.0.0.0
[R5-ospf-1-area-0.0.0.0] network 10.0.45.5 0.0.0.0
Total Nets: 10
Intra Area: 10 Inter Area: 0 ASE: 0 NSSA: 0
[R2]display ip routing-table
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: Public
Destinations : 18 Routes : 18
The preceding command output shows that the OSPF process of R2 has learned all routes
in AS 65100 and the routes are preferentially selected in the IP routing table.
Establish EBGP peer relationships between S1 and R1, between S5 and R3, and between
S2 and R5. Configure BGP authentication, set the authentication password to
Huawei@123, and set the TTL in GTSM to 255.
# Configure EBGP peers on S1 and R1, and configure BGP authentication and GTSM.
GTSM only needs to be configured on the backbone network side.
[R1]bgp 65100
[R1-bgp] peer 10.0.11.1 as-number 65001
[R1-bgp] peer 10.0.11.1 password cipher Huawei@123
[R1-bgp] peer 10.0.11.1 valid-ttl-hops 255
[S1]bgp 65001
[S1-bgp] peer 10.0.11.2 as-number 65100
[S1-bgp] peer 10.0.11.2 password cipher Huawei@123
# Configure EBGP peers on S5 and R3, and configure BGP authentication and GTSM.
GTSM only needs to be configured on the backbone network side.
[R3]bgp 65100
[R3-bgp] peer 10.0.35.5 as-number 65003
[R3-bgp] peer 10.0.35.5 password cipher Huawei@123
[R3-bgp] peer 10.0.35.5 valid-ttl-hops 255
[S5]bgp 65003
[S5-bgp] peer 10.0.35.3 as-number 65100
[S5-bgp] peer 10.0.35.3 password cipher Huawei@123
# Configure EBGP peers on S2 and R5, and configure BGP authentication and GTSM.
GTSM only needs to be configured on the backbone network side.
[R5]bgp 65100
[R5-bgp] peer 10.0.25.2 as-number 65002
[R5-bgp] peer 10.0.25.2 password cipher Huawei@123
[R5-bgp] peer 10.0.25.2 valid-ttl-hops 255
1
[S2]bgp 65002
[S2-bgp] peer 10.0.25.5 as-number 65100
[S2-bgp] peer 10.0.25.5 password cipher Huawei@123
# Check the BGP peer relationship status on R1, R3, and R5.
[R1]display bgp peer
The neighbor relationships between R1, R3, and R5 and their peers are in Established
state.
R2 and R4 are level-2 RRs, and R1, R3, and R5 are clients of R2 and R4. To prevent route
transmission between RRs in the same cluster, you need to change the cluster ID to
24.24.24.24.
Deploy IBGP peers based on the topology and establish IBGP peer relationships based on
loopback interface addresses. Because there are a large number of IBGP peers, configure
a peer group.
# Configure R1.
[R1]bgp 65100
1
# Configure R2.
[R2]bgp 65100
[R2-bgp] group IBGP internal
[R2-bgp] peer IBGP connect-interface LoopBack0
[R2-bgp] peer 10.10.10.1 group IBGP
[R2-bgp] peer 10.10.10.3 group IBGP
[R2-bgp] peer 10.10.10.4 group IBGP
[R2-bgp] peer 10.10.10.5 group IBGP
# Configure R3.
[R3]bgp 65100
[R3-bgp] group IBGP internal
[R3-bgp] peer IBGP connect-interface LoopBack0
[R3-bgp] peer IBGP next-hop-local
[R3-bgp] peer 10.10.10.2 group IBGP
[R3-bgp] peer 10.10.10.4 group IBGP
# Configure R4.
[R4]bgp 65100
[R4-bgp] roup IBGP internal
[R4-bgp] peer IBGP connect-interface LoopBack0
[R4-bgp] peer 10.10.10.1 group IBGP
[R4-bgp] peer 10.10.10.2 group IBGP
[R4-bgp] peer 10.10.10.3 group IBGP
[R4-bgp] peer 10.10.10.5 group IBGP
# Configure R5.
[R5]bgp 65100
[R5-bgp] group IBGP internal
[R5-bgp] peer IBGP connect-interface LoopBack0
[R5-bgp] peer IBGP next-hop-local
[R5-bgp] peer 10.10.10.2 group IBGP
[R5-bgp] peer 10.10.10.4 group IBGP
Based on peer tables of R2 and R4, you can find that IBGP peer relationships have been
established between routers in AS 65100.
R2 and R4 are level-2 RRs, and R1, R3, and R5 are clients of R2 and R4. The same cluster
ID is configured for R2 and R4.
# Configure R2.
[R2]bgp 65100
[R2-bgp] peer IBGP reflect-client
[R2-bgp] reflector cluster-id 24.24.24.24
# Configure R4.
[R4]bgp 65100
[R4-bgp] peer IBGP reflect-client
[R4-bgp] reflector cluster-id 24.24.24.24
# Configure R3.
[R3]bgp 65100
[R3-bgp] peer IBGP reflect-client
PeerSession Members:
10.10.10.1 10.10.10.3 10.10.10.4 10.10.10.5
It's route-reflector-client
Peer Preferred Value: 0
No routing policy is configured
Peer Members:
Peer V AS MsgRcvd MsgSent OutQ Up/Down State PrefRcv
It's route-reflector-client
Peer Preferred Value: 0
No routing policy is configured
Peer Members:
Peer V AS MsgRcvd MsgSent OutQ Up/Down State PrefRcv
The routes of Loopback0, Loopback1, and Loopback2 on S1, S2, and S5 need to be
advertised to BGP. After the routes are advertised, the backbone network controls route
advertisement through routing policies.
BGP routes can be advertised using the import-route or network command. In this
experiment, there are only a few network segments. Therefore, you can use the network
command.
# Configure S1.
[R1]bgp 65001
[R1-bgp] network 10.0.1.1 32
[R1-bgp] network 10.1.1.1 32
# Configure S2.
[R2]bgp 65002
[R2-bgp] network 10.0.2.1 32
[R2-bgp] network 10.1.2.1 32
# Configure S5.
[R5]bgp 65003
[R5-bgp] network 10.0.3.1 32
[R5-bgp] network 10.1.3.1 32
# Check route advertisement results on S1, S2, and S5. S1 is used as an example. The
configurations of S2 and S5 are similar.
[S1]display bgp routing-table
The command output shows that S1, S2, and S5 have learned routes from each other.
The community attribute can be used to label a route so that the network administrator
can know the AS from which the route comes.
In this experiment, you only need to add attributes to the routes of Loopback0 interfaces
on S1, S2, and S5.
By default, the community attribute is not sent to peers. You need to manually configure
devices to advertise the community attribute.
Generally, the community attribute is in the format of AS:NN. In this experiment, the
community attribute is defined as AS:01.
# Configure R1, R2, R3, R4, and R5 to advertise the community attribute to their peers.
[R1]bgp 65100
[R1-bgp] peer IBGP advertise-community
[R1-bgp] peer 10.0.11.1 advertise-community
[R2]bgp 65100
[R2-bgp] peer IBGP advertise-community
[R3]bgp 65100
[R3-bgp] peer IBGP advertise-community
[R3-bgp] peer 10.0.35.5 advertise-community
[R4]bgp 65100
[R4-bgp] peer IBGP advertise-community
[R5]bgp 65100
[R5-bgp] peer IBGP advertise-community
[R5-bgp] peer 10.0.25.2 advertise-community
# Configure S1, S2, and S5 to advertise the community attribute to their peers.
[S1]bgp 65001
[S1-bgp] peer 10.0.11.2 advertise-community
[S2]bgp 65001
[S2-bgp] peer 10.0.25.5 advertise-community
[S5]bgp 65001
[S5-bgp] peer 10.0.35.3 advertise-community
Configure routing policies on S1, S2, and S5 to add the community attribute to routes of
Loopback0 interfaces.
# Configure S1.
[S1]ip ip-prefix Com index 10 permit 10.0.1.1 32
1
# Configure S2.
[S2]ip ip-prefix Com index 10 permit 10.0.2.1 32
[S2]route-policy Attr permit node 10
[S2-route-policy] if-match ip-prefix Com
[S2-route-policy] apply community 65002:2
[S2-route-policy] quit
[S2]route-policy Attr permit node 100
[S2-route-policy quit
[S2]bgp 65002
[S2-bgp] peer 10.0.25.5 route-policy Attr export
# Configure S5.
[S5]ip ip-prefix Com index 10 permit 10.0.3.1 32
[S5]route-policy Attr permit node 10
[S5-route-policy] if-match ip-prefix Com
[S5-route-policy] apply community 65003:1
[S5-route-policy] quit
[S5]route-policy Attr permit node 100
[S5-route-policy] quit
[S5]bgp 65003
[S5-bgp] peer 10.0.35.3 route-policy Attr export
# Check the configurations on S1, S2, and S5. S1 is used as an example. The
configurations of S2 and S5 are similar to that of S1.
[S1]display bgp routing-table 10.0.3.1
Traffic of confidential financial services can be forwarded only between S1 and S5 and
between S2 and S5. If no VPN is deployed, you can only control route sending and
receiving.
To simplify filtering configuration, you can use the AS_Path filter and routing policy to
filter routes on R1 and R2.
For route control, do not filter the routes of Loopback0 interfaces. You can use the
community attribute to allow routes of Loopback0 interfaces in advance and then filter
routes of Loopback1 interfaces.
# Configure R1.
[R1]ip community-filter basic OA permit 65002:1
[R1]ip as-path-filter Finance permit 65002$
[R1]route-policy Finance permit node 10
[R1-route-policy] if-match community-filter OA
[R1-route-policy] quit
[R1]route-policy Finance deny node 20
[R1-route-policy] if-match as-path-filter Finance
[R1-route-policy] quit
[R1]route-policy Finance permit node 100
[R1-route-policy] quit
[R1]bgp 65100
[R1-bgp] peer 10.0.11.1
[R1-bgp] route-policy Finance export
# Configure R5.
[R5]ip community-filter basic OA permit 65001:1
[R5]ip as-path-filter Finance permit 65001$
[R5]route-policy Finance permit node 10
[R5-route-policy] if-match community-filter OA
[R5-route-policy] quit
[R5]route-policy Finance deny node 20
[R5-route-policy] if-match as-path-filter Finance
[R5-route-policy] quit
[R5]route-policy Finance permit node 100
[R5-route-policy] quit
[R5]bgp 65100
[R5-bgp] peer 10.0.25.2
[R5-bgp] route-policy Finance export
The command output shows that the route 10.1.2.1/32 of Loopback1 on S2 has been
filtered out in the BGP routing table of S1, the route 10.1.1.1/32 of Loopback1 on S1 has
been filtered out in the BGP routing table of S2, and the BGP routing table of S5 remains
unchanged.
2.1.3 Quiz
How can I prevent a BGP peer from receiving a large number of unnecessary routes?
#
sysname R1
#
router id 10.10.10.1
#
interface GigabitEthernet0/0/2
ip address 10.0.12.1 255.255.255.0
#
interface GigabitEthernet0/0/3
ip address 10.0.11.2 255.255.255.0
#
interface LoopBack0
ip address 10.10.10.1 255.255.255.255
#
bgp 65100
peer 10.0.11.1 as-number 65001
peer 10.0.11.1 password cipher Huawei@123
peer 10.0.11.1 valid-ttl-hops 255
group IBGP internal
peer IBGP connect-interface LoopBack0
peer 10.10.10.2 as-number 65100
peer 10.10.10.2 group IBGP
peer 10.10.10.4 as-number 65100
peer 10.10.10.4 group IBGP
#
ipv4-family unicast
undo synchronization
peer 10.0.11.1 enable
peer 10.0.11.1 route-policy Finance export
peer 10.0.11.1 advertise-community
peer IBGP enable
peer IBGP next-hop-local
peer IBGP advertise-community
peer 10.10.10.2 enable
peer 10.10.10.2 group IBGP
peer 10.10.10.4 enable
peer 10.10.10.4 group IBGP
#
ospf 1
area 0.0.0.0
network 10.0.12.1 0.0.0.0
network 10.10.10.1 0.0.0.0
#
route-policy Finance permit node 10
if-match community-filter OA
#
route-policy Finance deny node 20
if-match as-path-filter Finance
#
route-policy Finance permit node 100
#
ip as-path-filter Finance permit 65002$
#
ip community-filter basic OA permit 65002:1
#
1
return
Configuration on R2
#
sysname R2
#
router id 10.10.10.2
#
interface GigabitEthernet0/0/2
ip address 10.0.23.2 255.255.255.0
#
interface GigabitEthernet0/0/3
ip address 10.0.12.2 255.255.255.0
#
interface LoopBack0
ip address 10.10.10.2 255.255.255.255
#
bgp 65100
group IBGP internal
peer IBGP connect-interface LoopBack0
peer 10.10.10.1 as-number 65100
peer 10.10.10.1 group IBGP
peer 10.10.10.3 as-number 65100
peer 10.10.10.3 group IBGP
peer 10.10.10.4 as-number 65100
peer 10.10.10.4 group IBGP
peer 10.10.10.5 as-number 65100
peer 10.10.10.5 group IBGP
#
ipv4-family unicast
undo synchronization
reflector cluster-id 24.24.24.24
peer IBGP enable
peer IBGP reflect-client
peer IBGP advertise-community
peer 10.10.10.1 enable
peer 10.10.10.1 group IBGP
peer 10.10.10.3 enable
peer 10.10.10.3 group IBGP
peer 10.10.10.4 enable
peer 10.10.10.4 group IBGP
peer 10.10.10.5 enable
peer 10.10.10.5 group IBGP
#
ospf 1
area 0.0.0.0
network 10.0.12.2 0.0.0.0
network 10.0.23.2 0.0.0.0
network 10.10.10.2 0.0.0.0
#
return
Configuration on R3
#
sysname R3
1
#
router id 10.10.10.3
#
interface GigabitEthernet0/0/1
ip address 10.0.35.3 255.255.255.0
#
interface GigabitEthernet0/0/2
ip address 10.0.34.3 255.255.255.0
#
interface GigabitEthernet0/0/3
ip address 10.0.23.3 255.255.255.0
#
interface LoopBack0
ip address 10.10.10.3 255.255.255.255
#
bgp 65100
peer 10.0.35.5 as-number 65003
peer 10.0.35.5 password cipher Huawei@123
peer 10.0.35.5 valid-ttl-hops 255
group IBGP internal
peer IBGP connect-interface LoopBack0
peer 10.10.10.2 as-number 65100
peer 10.10.10.2 group IBGP
peer 10.10.10.4 as-number 65100
peer 10.10.10.4 group IBGP
#
ipv4-family unicast
undo synchronization
peer 10.0.35.5 enable
peer 10.0.35.5 advertise-community
peer IBGP enable
peer IBGP reflect-client
peer IBGP next-hop-local
peer IBGP advertise-community
peer 10.10.10.2 enable
peer 10.10.10.2 group IBGP
peer 10.10.10.4 enable
peer 10.10.10.4 group IBGP
#
ospf 1
area 0.0.0.0
network 10.0.23.3 0.0.0.0
network 10.0.34.3 0.0.0.0
network 10.0.35.3 0.0.0.0
network 10.10.10.3 0.0.0.0
#
return
Configuration on R4
#
sysname R4
#
router id 10.10.10.4
#
interface GigabitEthernet0/0/2
1
Configuration on R5
#
sysname R5
#
router id 10.10.10.5
#
firewall zone Local
priority 15
#
interface GigabitEthernet0/0/3
ip address 10.0.45.5 255.255.255.0
#
1
interface GigabitEthernet0/0/4
ip address 10.0.25.5 255.255.255.0
#
interface LoopBack0
ip address 10.10.10.5 255.255.255.255
#
bgp 65100
peer 10.0.25.2 as-number 65002
peer 10.0.25.2 password cipher Huawei@123
peer 10.0.25.2 valid-ttl-hops 255
group IBGP internal
peer IBGP connect-interface LoopBack0
peer 10.10.10.2 as-number 65100
peer 10.10.10.2 group IBGP
peer 10.10.10.4 as-number 65100
peer 10.10.10.4 group IBGP
#
ipv4-family unicast
undo synchronization
peer 10.0.25.2 enable
peer 10.0.25.2 route-policy Finance export
peer 10.0.25.2 advertise-community
peer IBGP enable
peer IBGP next-hop-local
peer IBGP advertise-community
peer 10.10.10.2 enable
peer 10.10.10.2 group IBGP
peer 10.10.10.4 enable
peer 10.10.10.4 group IBGP
#
ospf 1
area 0.0.0.0
network 10.0.45.5 0.0.0.0
network 10.10.10.5 0.0.0.0
#
route-policy Finance permit node 10
if-match community-filter OA
#
route-policy Finance deny node 20
if-match as-path-filter Finance
#
route-policy Finance permit node 100
#
ip as-path-filter Finance permit 65001$
#
ip community-filter basic OA permit 65001:1
#
return
Configuration on S1
#
sysname S1
#
interface Vlanif1
ip address 10.0.11.1 255.255.255.0
1
#
interface GigabitEthernet0/0/1
port link-type access
#
interface LoopBack0
ip address 10.0.1.1 255.255.255.255
#
interface LoopBack1
ip address 10.1.1.1 255.255.255.255
#
bgp 65001
peer 10.0.11.2 as-number 65100
peer 10.0.11.2 password cipher Huawei@123
#
ipv4-family unicast
undo synchronization
network 10.0.1.1 255.255.255.255
network 10.1.1.1 255.255.255.255
peer 10.0.11.2 enable
peer 10.0.11.2 route-policy Attr export
peer 10.0.11.2 advertise-community
#
route-policy Attr permit node 10
if-match ip-prefix Com
apply community 65001:1
#
route-policy Attr permit node 100
#
ip ip-prefix Com index 10 permit 10.0.1.1 32
#
return
Configuration on S2
#
sysname S2
#
interface Vlanif1
ip address 10.0.25.2 255.255.255.0
#
interface GigabitEthernet0/0/5
port link-type access
interface LoopBack0
ip address 10.0.2.1 255.255.255.255
#
interface LoopBack1
ip address 10.1.2.1 255.255.255.255
#
bgp 65002
peer 10.0.25.5 as-number 65100
peer 10.0.25.5 password cipher Huawei@123
#
ipv4-family unicast
undo synchronization
network 10.0.2.1 255.255.255.255
network 10.1.2.1 255.255.255.255
1
Configuration on S5
#
sysname S5
#
interface Vlanif1
ip address 10.0.35.5 255.255.255.0
#
interface GigabitEthernet0/0/1
port link-type access
#
interface LoopBack0
ip address 10.0.3.1 255.255.255.255
#
interface LoopBack1
ip address 10.1.3.1 255.255.255.255
#
bgp 65003
peer 10.0.35.3 as-number 65100
peer 10.0.35.3 password cipher Huawei@123
#
ipv4-family unicast
undo synchronization
network 10.0.3.1 255.255.255.255
network 10.1.3.1 255.255.255.255
network 10.2.3.1 255.255.255.255
peer 10.0.35.3 enable
peer 10.0.35.3 route-policy Attr export
peer 10.0.35.3 advertise-community
#
route-policy Attr permit node 10
if-match ip-prefix Com
apply community 65003:1
#
route-policy Attr permit node 100
#
ip ip-prefix Com index 10 permit 10.0.3.1 32
#
return
1
3 IPv6 Routing
● Configure MP-BGP.
● Configure IS-IS dual-stack.
● Configure OSPF dual-stack.
The enterprise has a large-scale backbone network. The access layer of the backbone
network uses OSPF or Open Shortest Path First Version 3 (OSPFv3), and the core layer
uses IPv4 or IPv6 IS-IS.
Some pure IPv4 networks exist at the core layer of the backbone network, and IPv6
cannot be deployed.
3. Deploy IPv4 or IPv6 IS-IS at the core layer of the backbone network.
4. Configure IPv4 IS-IS and OSPF to import routes from each other, and IPv6 IS-IS and
OSPFv3 to import routes from each other.
5. Configure R1, R2, R4, and R5 to establish External BGP (EBGP) peer relationships
with the RR, and configure R3 as the RR.
# Configure IPv4 addresses for GE0/0/1, GE0/0/2, GE0/0/3, and Loopback0 on R2.
[R2]interface LoopBack0
[R2-LoopBack0] ip address 10.10.10.2 255.255.255.255
[R2-LoopBack0] quit
[R2]interface GigabitEthernet0/0/1
[R2-GigabitEthernet0/0/1] ip address 10.0.24.2 255.255.255.0
[R2-GigabitEthernet0/0/1] quit
[R2]interface GigabitEthernet0/0/2
[R2-GigabitEthernet0/0/2] ip address 10.0.23.2 255.255.255.0
[R2-GigabitEthernet0/0/2] quit
[R2]interface GigabitEthernet0/0/3
[R2-GigabitEthernet0/0/3] ip address 10.0.12.2 255.255.255.0
[R2-GigabitEthernet0/0/3] quit
# Configure IPv6 addresses for GE0/0/2, GE0/0/3, and Loopback0 on R2. GE0/0/1
supports only IPv4 and does not need to be configured with an IPv6 address.
1
[R2]ipv6
[R2]interface LoopBack0
[R2-LoopBack0] ipv6 enable
[R2-LoopBack0] ipv6 address 2::2/128
[R2-LoopBack0] quit
[R2]interface GigabitEthernet0/0/2
[R2-GigabitEthernet0/0/2] ipv6 enable
[R2-GigabitEthernet0/0/2] ipv6 address 2001:DB8:23::2/64
[R2-GigabitEthernet0/0/2] quit
[R2]interface GigabitEthernet0/0/3
[R2-GigabitEthernet0/0/3] ipv6 enable
[R2-GigabitEthernet0/0/3] ipv6 address 2001:DB8:12::2/64
[R2-GigabitEthernet0/0/3] quit
# Configure IPv4 addresses for GE0/0/1, GE0/0/2, GE0/0/3, and Loopback0 on R4.
[R4]interface LoopBack0
[R4-LoopBack0] ip address 10.10.10.4 255.255.255.255
[R4-LoopBack0] quit
[R4]interface GigabitEthernet0/0/1
[R4-GigabitEthernet0/0/1] ip address 10.0.24.4 255.255.255.0
[R4-GigabitEthernet0/0/1] quit
[R4]interface GigabitEthernet0/0/2
[R4-GigabitEthernet0/0/2] ip address 10.0.45.4 255.255.255.0
[R4-GigabitEthernet0/0/2] quit
[R4]interface GigabitEthernet0/0/3
[R4-GigabitEthernet0/0/3] ip address 10.0.34.4 255.255.255.0
[R4-GigabitEthernet0/0/3] quit
1
# Configure IPv6 addresses for GE0/0/2, GE0/0/3, and Loopback0 on R4. GE0/0/1
supports only IPv4 and does not need to be configured with an IPv6 address.
[R4]ipv6
[R4]interface LoopBack0
[R4-LoopBack0] ipv6 enable
[R4-LoopBack0] ipv6 address 4::4/128
[R4-LoopBack0] quit
[R4]interface GigabitEthernet0/0/2
[R4-GigabitEthernet0/0/2] ipv6 enable
[R4-GigabitEthernet0/0/2] ipv6 address 2001:DB8:45::4/64
[R4-GigabitEthernet0/0/2] quit
[R4]interface GigabitEthernet0/0/3
[R4-GigabitEthernet0/0/3] ipv6 enable
[R4-GigabitEthernet0/0/3] ipv6 address 2001:DB8:34::4/64
[R4-GigabitEthernet0/0/3] quit
# Configure the VLAN to which GE0/0/1 of S1 belongs and IPv4 addresses of VLANIF 1
and Loopback0.
[S1]interface LoopBack0
[S1-LoopBack0] ip address 10.0.1.1 255.255.255.255
[S1-LoopBack0] quit
[S1]interface GigabitEthernet0/0/1
[S1-GigabitEthernet0/0/1] port link-type access
[S1-GigabitEthernet0/0/1] port default vlan 1
[S1-GigabitEthernet0/0/1] quit
[S1]interface Vlanif 1
[S1-Vlanif1] ip address 10.1.11.1 24
1
[S1-Vlanif1] quit
# Configure the VLAN to which GE0/0/1 of S1 belongs and IPv6 addresses for VLANIF 1
and Loopback0.
[S1]ipv6
[S1]interface LoopBack0
[S1-LoopBack0] ipv6 enable
[S1-LoopBack0] ipv6 address 2001:DB8::1/128
[S1-LoopBack0] quit
[S1]interface GigabitEthernet0/0/1
[S1-GigabitEthernet0/0/1] ipv6 enable
[S1-GigabitEthernet0/0/1] ipv6 address 2001:DB8:11::1/64
[S1-GigabitEthernet0/0/1] quit
# Configure the VLAN to which GE0/0/5 of S2 belongs and IPv4 addresses of VLANIF 1
and Loopback0.
[S2]interface LoopBack0
[S2-LoopBack0] ip address 10.0.2.1 255.255.255.255
[S2-LoopBack0] quit
[S2]interface GigabitEthernet0/0/5
[S2-GigabitEthernet0/0/5] port link-type access
[S2-GigabitEthernet0/0/5] port default vlan 1
[S2-GigabitEthernet0/0/5] quit
[S2]interface Vlanif 1
[S2-Vlanif1] ip address 10.0.25.2 24
[S2-Vlanif1] quit
# Configure the VLAN to which GE0/0/5 of S2 belongs and IPv6 addresses for VLANIF 1
and Loopback0.
[S2]ipv6
[S2]interface LoopBack0
[S2-LoopBack0] ipv6 enable
[S2-LoopBack0] ipv6 address 2001:DB8::2/128
[S2-LoopBack0] quit
[S2]interface GigabitEthernet0/0/1
[S2-GigabitEthernet0/0/5] ipv6 enable
[S2-GigabitEthernet0/0/5] ipv6 address 2001:DB8:25::2/64
[S2-GigabitEthernet0/0/5] quit
# Check the connectivity of IP addresses of interconnection interfaces on R1, R3, and R5.
(IPv6 addresses are used as an example.)
<R1>ping ipv6 2001:0db8:11::1
PING 2001:0db8:11::1 : 56 data bytes, press CTRL_C to break
Reply from 2001:DB8:11::1
bytes=56 Sequence=1 hop limit=64 time = 20 ms
Deploy OSPF processes on R1, R2, R4, and R5 according to the topology design. Set the
process ID to 1, area ID to 0, and router ID to the loopback interface's IP address of the
router. R1 with the router ID of 10.10.10.1 is used as an example.
The configuration of OSPFv3 is similar to the configuration of OSPF. Set the process ID to
1, area ID to 0, instance ID to 1, and router ID to the loopback interface's address of the
router. R1 with the router ID of 10.10.10.1 is used as an example.
Total Nets: 2
Intra Area: 2 Inter Area: 0 ASE: 0 NSSA: 0
The command output shows that IPv4 and IPv6 routes have been learned by the router.
Deploy IS-IS processes on R2, R3, and R4 based on the topology design. Set the process
ID to 1, configure R2, R3, and R4 as Level-2 routers, set the cost type to wide, set the
area ID of the NET to 49.0001, set the system ID based on the loopback interface, and set
the IS-IS host name to be the same as the device name.
Because a pure IPv4 network exists between R2 and R4, the multi-topology function
needs to be deployed when dual-stack IS-IS is deployed.
# Deploy dual-stack IS-IS on R2. GE0/0/1 supports only IPv4, so the route of GE0/0/1
does not need to be advertised to IPv6 IS-IS.
[R2]isis 1
[R2-isis-1] is-level level-2
[R2-isis-1] cost-style wide
[R2-isis-1] network-entity 49.0001.0100.1001.0002.00
[R2-isis-1] is-name R2
[R2-isis-1] ipv6 enable topology ipv6
[R2-isis-1] quit
[R2]interface LoopBack0
[R2-LoopBack0] isis enable 1
[R2-LoopBack0] isis ipv6 enable 1
[R2-LoopBack0] quit
[R2]interface GigabitEthernet0/0/1
[R2-GigabitEthernet0/0/1] isis enable 1
[R2-GigabitEthernet0/0/1] quit
[R2]interface GigabitEthernet0/0/2
1
# Deploy dual-stack IS-IS on R4. GE0/0/1 supports only IPv4, so the route of GE0/0/1
does not need to be advertised to IPv6 IS-IS.
[R4]isis 1
[R4-isis-1] is-level level-2
[R4-isis-1] cost-style wide
[R4-isis-1] network-entity 49.0001.0100.1001.0004.00
[R4-isis-1] is-name R4
[R4-isis-1] ipv6 enable topology ipv6
[R4-isis-1] quit
[R4]interface LoopBack0
[R4-LoopBack0] isis enable 1
[R4-LoopBack0] isis ipv6 enable 1
[R4-LoopBack0] quit
[R4]interface GigabitEthernet0/0/1
[R4-GigabitEthernet0/0/1] isis enable 1
[R4-GigabitEthernet0/0/1] quit
[R4]interface GigabitEthernet0/0/3
[R4-GigabitEthernet0/0/3] isis enable 1
[R4-GigabitEthernet0/0/3] isis ipv6 enable 1
[R4-GigabitEthernet0/0/3] quit
-------------------------------------------------------------------------------
R4* GE0/0/2 R4.02 Up 8s L2 64
R2* GE0/0/3 R2.02 Up 9s L2 64
Total Peer(s): 2
# Check IPv4 and IPv6 IS-IS routing tables on each router. R3 is used as an example.
[R3]display isis route
The command output shows that IPv4 and IPv6 routes have been learned by the router.
Configure IS-IS and OSPF to import routes from each other on R2 and R4, implementing
connectivity of the underlying network of the backbone network and preparing for BGP
deployment.
1
R2 and R4 need to import routes from both IPv4 and IPv6 networks.
# Configure IS-IS and OSPF to import routes from each other on R2.
[R2]isis 1
[R2-isis-1] import-route ospf 1
[R2-isis-1] ipv6 import-route ospfv3 1
[R2-isis-1] quit
[R2]ospf 1
[R2-ospf-1] import-route isis 1
[R2-ospf-1] quit
[R2]ospfv3 1
[R2-ospfv3-1] import-route isis 1
# Configure IS-IS and OSPF to import routes from each other on R4.
[R4]isis 1
[R4-isis-1] import-route ospf 1
[R4-isis-1] ipv6 import-route ospfv3 1
[R4-isis-1] quit
[R4]ospf 1
[R4-ospf-1] import-route isis 1
[R4-ospf-1] quit
[R4]ospfv3 1
[R4-ospfv3-1] import-route isis 1
NextHop : :: Preference : 10
Cost :1 Protocol : OSPFv3
RelayNextHop : :: TunnelID : 0x0
Interface : GigabitEthernet0/0/2 Flags :
The routing table of R1 shows that the underlying network in AS 65100 has been
established.
Establish an IBGP peer relationship in AS 65100. Configure R3 as the RR, and R1, R2, R4,
and R5 as clients of R3.
The command output shows that both IPv4 and IPv6 IBGP peer relationships have been
established.
IPv4 and IPv6 EBGP peer relationships have been established between the branch and
backbone network, and routes of loopback interfaces on S1 and S2 are imported to BGP.
# Establish IPv4 and IPv6 EBGP peer relationships between R1 and S1 and advertise
routes.
[R1]bgp 65100
[R1-bgp] peer 10.0.11.1 as-number 65001
[R1-bgp] peer 2001:DB8:11::1 as-number 65001
[R1-bgp] ipv4-family unicast
[R1-bgp-af-ipv4] peer 10.0.11.1 enable
[R1-bgp-af-ipv4] quit
[R1-bgp] ipv6-family unicast
[R1-bgp-af-ipv6] peer 2001:DB8:11::1 enable
[R1-bgp-af-ipv6] quit
[S1]bgp 65001
[S1-bgp] peer 10.0.11.2 as-number 65100
[S1-bgp] peer 2001:DB8:11::2 as-number 65100
[S1-bgp] ipv4-family unicast
[S1-bgp-af-ipv4] peer 10.0.11.2 enable
[S1-bgp-af-ipv4] network 10.0.1.1 255.255.255.255
[S1-bgp-af-ipv4] quit
[S1-bgp] ipv6-family unicast
[S1-bgp-af-ipv6] peer 2001:DB8:11::2 enable
[S1-bgp-af-ipv6] network 2001:DB8::1 128
[S1-bgp-af-ipv6] quit
1
# Establish IPv4 and IPv6 EBGP peer relationships between R5 and S2 and advertise
routes.
[R5]bgp 65100
[R5-bgp] peer 10.0.25.2 as-number 65002
[R5-bgp] peer 2001:DB8:25::2 as-number 65002
[R5-bgp] ipv4-family unicast
[R5-bgp-af-ipv4]p eer 10.0.25.2 enable
[R5-bgp-af-ipv4] quit
[R5-bgp] ipv6-family unicast
[R5-bgp-af-ipv6] peer 2001:DB8:25::2 enable
[R5-bgp-af-ipv6] quit
[S2]bgp 65002
[S2-bgp] peer 10.0.25.5 as-number 65100
[S2-bgp] peer 2001:DB8:25::5 as-number 65100
[S2-bgp] ipv4-family unicast
[S2-bgp-af-ipv4] peer 10.0.25.5 enable
[S2-bgp-af-ipv4] network 10.0.2.1 255.255.255.255
[S2-bgp-af-ipv4] quit
[S2-bgp] ipv6-family unicast
[S2-bgp-af-ipv6] peer 2001:DB8:25::5 enable
[S2-bgp-af-ipv6] network 2001:DB8::2 128
[S2-bgp-af-ipv6] quit
# Check the IPv4 and IPv6 EBGP peer relationships on S1 and S2. S1 is used as an
example.
[S1]display bgp peer
The preceding command output shows that IPv4 and IPv6 BGP peer relationships have
been established.
# Check the route transmission result. Check IPv4 and IPv6 routing tables on S1 and S2.
S1 is used as an example.
1
The command output shows that S1 has received the route of Loopback0 on S2.
The ping operation is successful, indicating that the lab configuration is successful.
3.1.3 Quiz
If IS-IS multi-topology is not deployed, can IPv4 and IPv6 networks communicate with
each other?
Configuration on R2
#
sysname R2
#
ipv6
#
router id 10.10.10.2
#
isis 1
is-level level-2
cost-style wide
network-entity 49.0001.0100.1001.0002.00
is-name R2
import-route ospf 1
#
ipv6 enable topology ipv6
ipv6 import-route ospfv3 1
#
#
ospfv3 1
router-id 10.10.10.2
import-route isis 1
#
interface GigabitEthernet0/0/1
ip address 10.0.24.2 255.255.255.0
isis enable 1
#
interface GigabitEthernet0/0/2
ipv6 enable
ip address 10.0.23.2 255.255.255.0
ipv6 address 2001:DB8:23::2/64
isis enable 1
isis ipv6 enable 1
#
interface GigabitEthernet0/0/3
ipv6 enable
ip address 10.0.12.2 255.255.255.0
ipv6 address 2001:DB8:12::2/64
ospfv3 1 area 0.0.0.0
#
interface LoopBack0
ipv6 enable
ip address 10.10.10.2 255.255.255.255
ipv6 address 2::2/128
isis enable 1
1
Configuration on R3
#
sysname R3
#
ipv6
#
router id 10.10.10.3
#
isis 1
is-level level-2
cost-style wide
network-entity 49.0001.0100.1001.0003.00
is-name R3
#
ipv6 enable topology ipv6
#
#
interface GigabitEthernet0/0/2
ipv6 enable
ip address 10.0.34.3 255.255.255.0
ipv6 address 2001:DB8:34::3/64
isis enable 1
isis ipv6 enable 1
#
interface GigabitEthernet0/0/3
ipv6 enable
ip address 10.0.23.3 255.255.255.0
ipv6 address 2001:DB8:23::3/64
isis enable 1
isis ipv6 enable 1
#
interface LoopBack0
1
ipv6 enable
ip address 10.10.10.3 255.255.255.255
ipv6 address 3::3/128
isis enable 1
isis ipv6 enable 1
#
bgp 65100
group IBGP internal
peer IBGP connect-interface LoopBack0
peer 10.10.10.1 as-number 65100
peer 10.10.10.1 group IBGP
peer 10.10.10.2 as-number 65100
peer 10.10.10.2 group IBGP
peer 10.10.10.4 as-number 65100
peer 10.10.10.4 group IBGP
peer 10.10.10.5 as-number 65100
peer 10.10.10.5 group IBGP
peer 1::1 as-number 65100
peer 1::1 group IBGP
peer 2::2 as-number 65100
peer 2::2 group IBGP
peer 4::4 as-number 65100
peer 4::4 group IBGP
peer 5::5 as-number 65100
peer 5::5 group IBGP
#
ipv4-family unicast
undo synchronization
peer IBGP enable
peer IBGP reflect-client
peer 10.10.10.1 enable
peer 10.10.10.1 group IBGP
peer 10.10.10.2 enable
peer 10.10.10.2 group IBGP
peer 10.10.10.4 enable
peer 10.10.10.4 group IBGP
peer 10.10.10.5 enable
peer 10.10.10.5 group IBGP
#
ipv6-family unicast
undo synchronization
peer IBGP enable
peer IBGP reflect-client
peer 1::1 enable
peer 1::1 group IBGP
peer 2::2 enable
peer 2::2 group IBGP
peer 4::4 enable
peer 4::4 group IBGP
peer 5::5 enable
peer 5::5 group IBGP
#
return
Configuration on R4
1
#
sysname R4
#
ipv6
#
router id 10.10.10.4
#
isis 1
is-level level-2
cost-style wide
network-entity 49.0001.0100.1001.0004.00
is-name R4
import-route ospf 1
#
ipv6 enable topology ipv6
ipv6 import-route ospfv3 1
#
#
ospfv3 1
router-id 10.10.10.4
import-route isis 1
#
interface GigabitEthernet0/0/1
ip address 10.0.24.4 255.255.255.0
isis enable 1
#
interface GigabitEthernet0/0/2
ipv6 enable
ip address 10.0.45.4 255.255.255.0
ipv6 address 2001:DB8:45::4/64
ospfv3 1 area 0.0.0.0 instance 1
#
interface GigabitEthernet0/0/3
ipv6 enable
ip address 10.0.34.4 255.255.255.0
ipv6 address 2001:DB8:34::4/64
isis enable 1
isis ipv6 enable 1
#
interface LoopBack0
ipv6 enable
ip address 10.10.10.4 255.255.255.255
ipv6 address 4::4/128
isis enable 1
isis ipv6 enable 1
#
bgp 65100
peer 10.10.10.3 as-number 65100
peer 10.10.10.3 connect-interface LoopBack0
peer 3::3 as-number 65100
peer 3::3 connect-interface LoopBack0
#
ipv4-family unicast
undo synchronization
peer 10.10.10.3 enable
1
#
ipv6-family unicast
undo synchronization
peer 3::3 enable
#
ospf 1
import-route isis 1
area 0.0.0.0
network 10.0.45.4 0.0.0.0
#
return
Configuration on R5
#
sysname R5
#
ipv6
#
router id 10.10.10.5
#
ospfv3 1
router-id 10.10.10.5
#
interface GigabitEthernet0/0/3
ipv6 enable
ip address 10.0.45.5 255.255.255.0
ipv6 address 2001:DB8:45::5/64
ospfv3 1 area 0.0.0.0 instance 1
#
interface GigabitEthernet0/0/4
ipv6 enable
ip address 10.0.25.5 255.255.255.0
ipv6 address 2001:DB8:25::5/64
#
interface LoopBack0
ipv6 enable
ip address 10.10.10.5 255.255.255.255
ipv6 address 5::5/128
ospfv3 1 area 0.0.0.0 instance 1
#
bgp 65100
peer 10.0.25.2 as-number 65002
peer 10.10.10.3 as-number 65100
peer 10.10.10.3 connect-interface LoopBack0
peer 3::3 as-number 65100
peer 3::3 connect-interface LoopBack0
peer 2001:DB8:25::2 as-number 65002
#
ipv4-family unicast
undo synchronization
peer 10.0.25.2 enable
peer 10.10.10.3 enable
peer 10.10.10.3 next-hop-local
#
ipv6-family unicast
1
undo synchronization
peer 3::3 enable
peer 3::3 next-hop-local
peer 2001:DB8:25::2 enable
#
ospf 1
area 0.0.0.0
network 10.0.45.5 0.0.0.0
network 10.10.10.5 0.0.0.0
#
return
Configuration on S1
#
sysname S1
#
ipv6
#
interface Vlanif1
ipv6 enable
ip address 10.0.11.1 255.255.255.0
ipv6 address 2001:DB8:11::1/64
#
interface GigabitEthernet0/0/1
port link-type access
#
interface LoopBack0
ipv6 enable
ip address 10.0.1.1 255.255.255.255
ipv6 address 2001:DB8::1/128
#
bgp 65001
peer 10.0.11.2 as-number 65100
peer 2001:DB8:11::2 as-number 65100
#
ipv4-family unicast
undo synchronization
network 10.0.1.1 255.255.255.255
peer 10.0.11.2 enable
#
ipv6-family unicast
undo synchronization
network 2001:DB8::1 128
peer 2001:DB8:11::2 enable
#
return
Configuration on S2
#
sysname SW2
#
ipv6
#
interface Vlanif1
ipv6 enable
1
VLAN aggregation is configured on S1 and S2, VLAN 100 is configured as the super-
VLAN, the VLANIF interface on S3 is used as the gateway of R1 and R2, and VLAN 10 and
VLAN 20 are configured as sub-VLANs.
MUX VLAN is configured on S2, and VLAN 200 is configured as the principal VLAN, VLAN
201 as the group VLAN, and VLAN 202 as the separate VLAN.
2. Enable proxy ARP on VLANIF 100 of the super-VLAN on S3 and observe the
communication between R1 and R2.
3. Configure VLAN 200 on S1, S2, and S3 to simulate the communication between the
external network and sub-VLANs.
Create sub-VLANs 10 and 20 on S1, add the interfaces connected to R1 and R2 to sub-
VLAN 10 and sub-VLAN 20, create super-VLAN 100 on S3, and create VLANIF 100 as the
gateway. Configure the interconnection interfaces between S1 and S3 as trunk interfaces
and configure the interfaces to allow packets from VLAN 10 and VLAN 20 to pass
through. Configure IP addresses for interfaces on R1 and R2 to simulate terminal users.
[S1]interface GigabitEthernet0/0/2
[S1-GigabitEthernet0/0/2] port link-type access
[S1-GigabitEthernet0/0/2] port default vlan 20
[S1-GigabitEthernet0/0/2] quit
# Create super-VLAN 100 on S3 and associate it with sub-VLANs 10 and 20. (VLANs 10
and 20 must exist on S3.)
[S3]vlan batch 10 20 100
[S3]vlan 100
[S3-vlan100] aggregate-vlan
[S3-vlan100] access-vlan 10 20
[S3-vlan100] quit
[S3]interface GigabitEthernet0/0/1
[S3-GigabitEthernet0/0/1] port link-type trunk
[S3-GigabitEthernet0/0/1] port trunk allow-pass vlan 10 20
[S3-GigabitEthernet0/0/1] quit
[R2]interface GigabitEthernet0/0/4
[R2-GigabitEthernet0/0/4] ip address 172.16.1.20 255.255.255.0
[R2-GigabitEthernet0/0/4] quit
# Check the connectivity between R1 and the gateway and between R2 and the gateway.
<S3>ping -c 1 172.16.1.10
PING 172.16.1.10: 56 data bytes, press CTRL_C to break
Reply from 172.16.1.10: bytes=56 Sequence=1 ttl=255 time=110 ms
<S3>ping -c 1 172.16.1.20
PING 172.16.1.20: 56 data bytes, press CTRL_C to break
Reply from 172.16.1.20: bytes=56 Sequence=1 ttl=255 time=80 ms
Enable proxy ARP on VLANIF 100 of S3 and observe the communication between sub-
VLANs.
In this case, R1 can learn only the ARP entry of VLANIF 100.
<S3>display arp all
IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-
INSTANCE
VLAN/CEVLAN PVC
------------------------------------------------------------------------------
172.16.1.254 4c1f-ccea-53ea I- Vlanif100
172.16.1.10 5489-98bf-6225 15 D-0 GE0/0/1
10
172.16.1.20 5489-982a-0ad0 13 D-0 GE0/0/1
20
------------------------------------------------------------------------------
Total:3 Dynamic:2 Static:0 Interface:1
1
S3 has ARP entries of R1 and R2. The MAC address of VLANIF 100 is 4c1f-ccea-53ea.
# Configure debugging arp process, debugging arp packet, and debugging arp-proxy on
S3 to check the ARP proxy process.
<S3>terminal debugging
<S3>terminal monitor
Jul 13 2020 14:44:04.730.3-08:00 S3 ARP/7/eth_proxy_reply:The interface Vlanif100 outputs a proxy reply, origin
VLAN ID is 10, type of proxy is inter-sub-vlan-proxy
Jul 13 2020 14:44:04.730.4-08:00 S3 ARP/7/arp_proxy:Send an ARP Proxy Packet, operation : 2, sender_eth_addr :
4c1f-ccea-53ea,sender_ip_addr : 172.16.1.20, target_eth_addr : 5489-98bf-6225, target_ip_addr : 172.16.1.10
S3 receives the ARP Request packet from R1 at 172.16.1.10 and requests to resolve the
MAC address of R2 at 172.16.1.20. Proxy ARP allows VLANIF 100 on S3 to respond to the
ARP Request packet from R1. The source MAC address in the ARP Reply packet is 4c1f-
ccea-53ea (MAC address of VLANIF 100), and the source IP address is 172.16.1.20.
After R1 receives the ARP Reply packet, it sends an ICMP packet with destination IP
address 172.16.1.20 and destination MAC address 4c1f-ccea-53ea (MAC address of
VLANIF 100). After receiving the ICMP packet, S3 forwards the packet.
Jul 13 2020 14:44:04.840.1-08:00 S3 ARP/7/arp_rcv:Receive an ARP Packet, operation : 1, sender_eth_addr : 5489-
982a-0ad0, sender_ip_addr : 172.16.1.20, target_eth_addr : 0000-0000-0000, target_ip_addr : 172.16.1.10
Jul 13 2020 14:44:04.840.2-08:00 S3 ARP/7/arp_info:ETHARP_ArpInput() Update an ARP entry, IP = 0x140110ac.
Jul 13 2020 14:44:04.840.3-08:00 S3 ARP/7/eth_proxy_reply:The interface Vlanif100 outputs a proxy reply, origin
VLAN ID is 20, type of proxy is inter-sub-vlan-proxy
Jul 13 2020 14:44:04.840.4-08:00 S3 ARP/7/arp_proxy:Send an ARP Proxy Packet, operation : 2, sender_eth_addr :
4c1f-ccea-53ea,sender_ip_addr : 172.16.1.10, target_eth_addr : 5489-982a-0ad0, target_ip_addr : 172.16.1.20
After receiving the ICMP packet from R1, R2 sends an ARP request to R1 at 172.16.1.20.
After S3 receives the ARP request, proxy ARP enables VLANIF 100 on S3 to respond to the
ARP Request packet from R2. In this case, the source MAC address of the ARP packet is
4c1f-ccea-53ea (MAC address of VLANIF 100), and the source IP address is 172.16.1.10.
The peer MAC addresses in the ARP entries learned by R1 and R2 are the MAC address of
VLANIF 100 on S3.
1
Create VLAN 200 on S1, S2, and S3 and create VLANIF 200 on S3 to simulate Layer 3
communication between sub-VLANs and the external network.
[S2]vlan 200
[S3]vlan 200
[S1]interface GigabitEthernet0/0/12
[S1-GigabitEthernet0/0/12] port link-type trunk
[S1-GigabitEthernet0/0/12] port trunk allow-pass vlan 200
[S1-GigabitEthernet0/0/12] quit
[S1]interface GigabitEthernet0/0/10
[S1-GigabitEthernet0/0/10] port link-type access
[S1-GigabitEthernet0/0/10] port default vlan 200
[S1-GigabitEthernet0/0/10] quit
# Create VLANIF 200 on S3 and set its IP address to 172.16.200.xx/24 (x indicates the
device number).
[S3]interface Vlanif200
[S3-Vlanif200] ip address 172.16.200.33 255.255.255.0
[S3-Vlanif200] quit
Configure MUX VLAN on S2, configure VLAN 200 as the principal VLAN, configure VLAN
201 as the group VLAN, configure VLAN 202 as the separate VLAN, and configure IP
addresses for interfaces on R3 and R4 to verify isolation through MUX VLAN.
# Configure VLAN 200 as the principal VLAN, VLAN 201 as the group VLAN, and VLAN
202 as the separate VLAN.
[S2]vlan 200
[S2-vlan200] mux-vlan
1
# Add interfaces to the VLANs and enable the MUX VLAN function.
[S2]interface GigabitEthernet0/0/10
[S2-GigabitEthernet0/0/10] port link-type access
[S2-GigabitEthernet0/0/10] port default vlan 200
[S2-GigabitEthernet0/0/10] port mux-vlan enable
[S2-GigabitEthernet0/0/10] quit
[S2]interface GigabitEthernet0/0/3
[S2-GigabitEthernet0/0/3] port link-type access
[S2-GigabitEthernet0/0/3] port default vlan 201
[S2-GigabitEthernet0/0/3] port mux-vlan enable
[S2-GigabitEthernet0/0/3]quit
[S2]interface GigabitEthernet0/0/4
[S2-GigabitEthernet0/0/4] port link-type access
[S2-GigabitEthernet0/0/4] port default vlan 202
[S2-GigabitEthernet0/0/4] port mux-vlan enable
[S2-GigabitEthernet0/0/4]quit
[R4]interface GigabitEthernet0/0/5
[R4-GigabitEthernet0/0/5] ip address 172.16.200.4 255.255.255.0
[R4-GigabitEthernet0/0/5] quit
<R3>ping -c 1 172.16.200.4
PING 172.16.200.4: 56 data bytes, press CTRL_C to break
Request time out
R3 in the group VLAN can communicate with R1 through the principal VLAN, but cannot
communicate with R4 in the separate VLAN.
<R4>ping -c 1 172.16.1.10
PING 172.16.1.10: 56 data bytes, press CTRL_C to break
Reply from 172.16.1.10: bytes=56 Sequence=1 ttl=254 time=190 ms
<R4>ping -c 1 172.16.200.3
PING 172.16.200.3: 56 data bytes, press CTRL_C to break
Request time out
R4 in the separate VLAN can communicate with R1 through the principal VLAN, but
cannot communicate with R3 in the group VLAN.
<R1>ping -c 1 172.16.200.3
PING 172.16.200.3: 56 data bytes, press CTRL_C to break
Reply from 172.16.200.3: bytes=56 Sequence=1 ttl=254 time=110 ms
<R1>ping -c 1 172.16.200.4
PING 172.16.200.4: 56 data bytes, press CTRL_C to break
Reply from 172.16.200.4: bytes=56 Sequence=1 ttl=254 time=120 ms
R1 can communicate with R3 and R4 in the group VLAN and separate VLAN through the
principal VLAN.
4.1.3 Quiz
After inter-VLAN proxy ARP is enabled on a VLANIF interface in a super-VLAN, in which
situation will the VLANIF interface respond to ARP Request packets?
Configuration on R2
#
sysname R2
#
interface GigabitEthernet0/0/4
ip address 172.16.1.20 255.255.255.0
#
ip route-static 172.16.200.0 255.255.255.0 172.16.1.254
#
return
Configuration on R3
#
sysname R3
#
interface GigabitEthernet0/0/5
ip address 172.16.200.3 255.255.255.0
#
ip route-static 172.16.1.0 255.255.255.0 172.16.200.33
#
return
Configuration on R4
#
sysname R4
#
interface GigabitEthernet0/0/5
ip address 172.16.200.4 255.255.255.0
#
ip route-static 172.16.1.0 255.255.255.0 172.16.200.33
#
return
1
Configuration on S1
#
sysname S1
#
vlan batch 10 20 200
#
interface GigabitEthernet0/0/1
port link-type access
port default vlan 10
#
interface GigabitEthernet0/0/2
port link-type access
port default vlan 20
#
interface GigabitEthernet0/0/10
port link-type access
port default vlan 200
#
interface GigabitEthernet0/0/12
port link-type trunk
port trunk allow-pass vlan 10 20 200
#
return
Configuration on S2
#
sysname S2
#
vlan batch 200 to 202
#
vlan 200
mux-vlan
subordinate separate 202
subordinate group 201
#
interface GigabitEthernet0/0/3
port link-type access
port default vlan 201
port mux-vlan enable
#
interface GigabitEthernet0/0/4
port link-type access
port default vlan 202
port mux-vlan enable
#
interface GigabitEthernet0/0/10
port link-type access
port default vlan 200
port mux-vlan enable
#
ip route-static 172.16.1.0 255.255.255.0 172.16.200.3
#
return
1
Configuration on S3
#
sysname S3
#
vlan batch 10 20 100 200
#
vlan 100
aggregate-vlan
access-vlan 10 20
#
interface Vlanif100
ip address 172.16.1.254 255.255.255.0
arp-proxy inter-sub-vlan-proxy enable
#
interface Vlanif200
ip address 172.16.200.33 255.255.255.0
#
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 10 20 200
#
return
1
R1 and R2 are connected to GE0/0/1 and GE0/0/2 of S1 and are assigned to VLAN 10.
The interfaces connecting S1 and S3 are configured as trunk interfaces and configured to
allow packets from VLAN 10 to pass through.
The DHCP server is configured on S3 to statically assign fixed IP addresses to R1 and R2,
and DHCP snooping, IPSG, port security, and port isolation are configured on S1.
4. Configure port security on S1 to limit the number of MAC addresses learned by the
interface.
Create VLAN 10 on S1 and add the interfaces connected to R1, R2, and S3 to VLAN 10.
Configure the interfaces connected to R1 and R2 as access interfaces and the interface
connected to S3 as the trunk interface.
[S3]vlan 10
# On S1, configure GE0/0/1 and GE0/0/2 as access interfaces and set the PVID to VLAN
10.
[S1]interface GigabitEthernet0/0/1
[S1-GigabitEthernet0/0/1] port link-type access
[S1-GigabitEthernet0/0/1] port default vlan 10
[S1-GigabitEthernet0/0/1] quit
[S1]interface GigabitEthernet0/0/2
[S1-GigabitEthernet0/0/2] port link-type access
[S1-GigabitEthernet0/0/2] port default vlan 10
[S1-GigabitEthernet0/0/2] quit
# Configure GE0/0/12 of S1 as the trunk interface and configure it to allow packets from
VLAN 10 to pass through.
[S1]interface GigabitEthernet0/0/12
[S1-GigabitEthernet0/0/12] port link-type trunk
[S1-GigabitEthernet0/0/12] port trunk allow-pass vlan 10
[S1-GigabitEthernet0/0/12] quit
# Configure GE0/0/1 of S3 as the trunk interface and configure it to allow packets from
VLAN 10 to pass through.
[S3]interface GigabitEthernet0/0/1
[S3-GigabitEthernet0/0/1] port link-type trunk
1
# Enable the DHCP service on S3 and configure a global address pool to assign fixed IP
addresses to R1 and R2.
[S3]dhcp enable
[R2]dhcp enable
[R2]interface GigabitEthernet0/0/4
[R2-GigabitEthernet0/0/4] ip address dhcp-alloc
[R2-GigabitEthernet0/0/4] quit
^down: standby
(l): loopback
(s): spoofing
(d): Dampening Suppressed
The number of interface that is UP in Physical is 2
The number of interface that is DOWN in Physical is 9
The number of interface that is UP in Protocol is 2
The number of interface that is DOWN in Protocol is 9
# Shut down interfaces on R1 and R2, wait for a period of time, and enable the interfaces
again to obtain IP addresses through DHCP.
[R1]interface GigabitEthernet0/0/3
[R1-GigabitEthernet0/0/3] shutdown
[R2]interface GigabitEthernet0/0/4
[R2-GigabitEthernet0/0/4] shutdown
[R1]interface GigabitEthernet0/0/3
[R1-GigabitEthernet0/0/3] undo shutdown
[R2]interface GigabitEthernet0/0/4
[R2-GigabitEthernet0/0/4] undo shutdown
--------------------------------------------------------------------------------
172.16.10.1 5489-98bf-6225 10 /-- /-- GE0/0/1 2020.07.14-22:42
172.16.10.2 5489-982a-0ad0 10 /-- /-- GE0/0/2 2020.07.14-22:46
--------------------------------------------------------------------------------
print count: 2 total count: 2
Enable IPSG on S1 to prevent terminal users from configuring static IP addresses without
permission, allow hosts to use only the IP addresses allocated by the DHCP server, and
prevent access of unauthorized users.
Enable the alarm function for IP packet check and set the alarm threshold for the
number of discarded IP packets to 3.
The packets from R1 are discarded by IPSG, and the number of discarded packets is 4,
which exceeds the alarm threshold. An alarm log is generated and can be viewed in the
log buffer.
Because the static binding entry exists, R1 can communicate with the gateway.
To allow only one terminal to connect to an interface of an access switch, enable port
security on the interface of S1 connected to only one terminal. When the number of
terminals connected to the interface exceeds the limit, the packets whose source MAC
addresses are not in the secure MAC address list are discarded and an alarm is generated.
# R2 communicates with the gateway to trigger the generation of a sticky MAC address
entry.
<R2>ping -c 1 172.16.10.254
PING 172.16.10.254: 56 data bytes, press CTRL_C to break
Reply from 172.16.10.254: bytes=56 Sequence=1 ttl=255 time=60 ms
There is still only one sticky MAC address entry, and the MAC address manually changed
on the interface of R2 is not learned.
# Change the maximum number of MAC addresses that can be learned by GE0/0/2 of S1
to 2.
[S1]interface GigabitEthernet 0/0/2
[S1-GigabitEthernet0/0/2] port-security max-mac-num 2
[S1-GigabitEthernet0/0/2] quit
In this case, R2 cannot communicate with the gateway due to IPSG configuration.
After the MAC address entry is manually changed on the interface of R2, the interface
learns the sticky MAC address entry.
# Test the connectivity between R1 and R2 before restricting mutual access between R1
and R2.
<R1>ping -c 1 172.16.10.2
PING 172.16.10.2: 56 data bytes, press CTRL_C to break
Reply from 172.16.10.2: bytes=56 Sequence=1 ttl=255 time=70 ms
# Enable port isolation on S1 and set the isolation mode to Layer 2 isolation and Layer 3
interconnection.
[S1]port-isolate mode l2
[S1]interface GigabitEthernet 0/0/1
1
In this case, R1 and R2 learn ARP entries again. Because proxy ARP is enabled on the
gateway, R1 and R2 can communicate with each other through the gateway.
------------------------------------------------------------------------------
172.16.10.11 5489-98bf-6225 I- GE0/0/3
172.16.10.254 4c1f-ccea-53ea 14 D-0 GE0/0/3
172.16.10.2 4c1f-ccea-53ea 14 D-0 GE0/0/3
------------------------------------------------------------------------------
Total:3 Dynamic:2 Static:0 Interface:1
The command output shows that MAC addresses mapping 172.16.10.2 and 172.16.10.254
in the ARP entries are the same.
5.1.3 Quiz
After port isolation is configured, the gateway functions as a proxy to implement
communication on the same network segment. What are the advantages and
disadvantages of this mode?
Configuration on R2
#
sysname R2
#
interface GigabitEthernet0/0/4
mac-address 0000-0000-0002
ip address dhcp-alloc
#
return
Configuration on S1
#
sysname S1
#
vlan batch 10
#
port-isolate mode all
#
dhcp enable
#
dhcp snooping enable ipv4
user-bind static ip-address 172.16.10.11 mac-address 5489-98bf-6225 interface GigabitEthernet0/0/1 vlan 10
user-bind static ip-address 172.16.10.2 mac-address 0000-0000-0002 interface GigabitEthernet0/0/2 vlan 10
#
interface GigabitEthernet0/0/1
port link-type access
1
Configuration on S3
#
sysname S3
#
vlan batch 10
#
dhcp enable
#
ip pool vlan10
gateway-list 172.16.10.254
network 172.16.10.0 mask 255.255.255.0
static-bind ip-address 172.16.10.1 mac-address 5489-98bf-6225
static-bind ip-address 172.16.10.2 mac-address 5489-982a-0ad0
dns-list 172.16.10.254
#
interface Vlanif10
ip address 172.16.10.254 255.255.255.0
arp-proxy inner-sub-vlan-proxy enable
dhcp select global
#
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 10
#
return
1
6 BGP/MPLS IP VPN
● Configure MPLS.
● Configure MPLS LDP.
● Configure MPLS VPN.
R2 and R4 are PEs of the MPLS VPN network, R1 and R5 are CEs of the finance VPN, and
R1, S1, and S2 are CEs of the OA VPN.
The enterprise headquarters needs to receive routing entries of Branch1, Branch2, and
Branch3. Branch1 is not allowed to receive routing entries of Branch2 and Branch3.
The enterprise backbone network is large, so the VPN RR needs to be used to simplify the
configuration.
3. Properly plan the RT and RD of the VPN instance and bind the VPN to the
corresponding interface on the PE.
# Configure IP addresses for GE0/0/1, GE0/0/2, and Loopback0 on R2. GE0/0/3 and
GE0/0/4 need to be bound to a VPN instance, so no IP address is assigned to them.
[R2]interface LoopBack0
[R2-LoopBack0] ip address 10.10.10.2 255.255.255.255
[R2-LoopBack0] quit
[R2]interface GigabitEthernet0/0/1
[R2-GigabitEthernet0/0/1] ip address 10.0.24.2 255.255.255.0
[R2-GigabitEthernet0/0/1] quit
[R2]interface GigabitEthernet0/0/2
[R2-GigabitEthernet0/0/2] ip address 10.0.23.2 255.255.255.0
1
[R2-GigabitEthernet0/0/2] quit
# Assign IP addresses to GE0/0/1, GE0/0/3, and Loopback0 on R4. GE0/0/2 and GE0/0/5
need to be bound to a VPN instance, so no IP address is assigned to them.
[R4]interface LoopBack0
[R4-LoopBack0] ip address 10.10.10.4 255.255.255.255
[R4-LoopBack0] quit
[R4]interface GigabitEthernet0/0/1
[R4-GigabitEthernet0/0/1] ip address 10.0.24.4 255.255.255.0
[R4-GigabitEthernet0/0/1] quit
[R4]interface GigabitEthernet0/0/3
[R4-GigabitEthernet0/0/3] ip address 10.0.34.4 255.255.255.0
[R4-GigabitEthernet0/0/3] quit
# Configure the VLAN to which GE0/0/2 of S1 belongs and IP addresses for VLANIF 1 and
Loopback0.
[S1]interface LoopBack0
[S1-LoopBack0] ip address 10.0.2.1 255.255.255.255
[S1-LoopBack0] quit
[S1]interface GigabitEthernet0/0/2
[S1-GigabitEthernet0/0/2] port link-type access
[S1-GigabitEthernet0/0/2] port default vlan 1
[S1-GigabitEthernet0/0/2] quit
[S1]interface Vlanif 1
[S1-Vlanif1] ip address 10.1.21.1 24
[S1-Vlanif1] quit
# Configure the VLAN to which GE0/0/4 of S2 belongs and IP addresses for VLANIF 1 and
Loopback0.
[S2]interface LoopBack0
[S2-LoopBack0] ip address 10.0.2.2 255.255.255.255
[S2-LoopBack0] quit
[S2]interface GigabitEthernet0/0/4
[S2-GigabitEthernet0/0/4] port link-type access
1
Deploy IS-IS processes on R2, R3, and R4 based on the topology design. Set the process
ID to 1, configure R2, R3, and R4 as Level-2 routers, set the cost type to wide, set the
area ID of the NET to 49.0001, set the system ID based on the loopback interface, and set
the IS-IS host name to be the same as the device name.
[R4]interface LoopBack0
[R4-LoopBack0] isis enable 1
[R4-LoopBack0] quit
[R4]interface GigabitEthernet0/0/1
[R4-GigabitEthernet0/0/1] isis enable 1
[R4-GigabitEthernet0/0/1] quit
[R4]interface GigabitEthernet0/0/3
[R4-GigabitEthernet0/0/3] isis enable 1
[R4-GigabitEthernet0/0/3] quit
Total Peer(s): 2
# Check the IPv4 IS-IS routing table on each router. R3 is used as the example.
[R3]display isis route
The command output shows that IPv4 and IPv6 routes have been learned by the router.
RDs can be used to identify duplicate routes and identify the areas from which routes are
originated.
The export RTs of the routes from the headquarters are 65100:12 and 65001:65002, and
import RTs are 65100:12 and 65001:65002.
The export RT and IRT of the routes from Branch1 are 65100:12 and 65100:12,
respectively.
The export RT and import RT of the routes from Branch2 are 65001:65002 and
65001:65002, respectively.
The export RT and import RT of the routes from Branch3 are 65001:65002 and
65001:65002, respectively.
# On R2, configure VPN instances, bind interfaces to VPN instances, and configure IP
addresses for the interfaces.
[R2]ip vpn-instance Finance&OA
[R2-vpn-instance-Finance&OA] route-distinguisher 65100:12
[R2-vpn-instance-Finance&OA-af-ipv4] vpn-target 65100:12 65001:65002
[R2-vpn-instance-Finance&OA-af-ipv4] quit
[R2]ip vpn-instance OA
[R2-vpn-instance-OA]
[R2-vpn-instance-OA] route-distinguisher 65001:2
[R2-vpn-instance-OA-af-ipv4] vpn-target 65001:65002
[R2-vpn-instance-OA-af-ipv4] quit
[R2]interface GigabitEthernet0/0/3
[R2-GigabitEthernet0/0/3] ip binding vpn-instance Finance&OA
[R2-GigabitEthernet0/0/3] ip address 10.0.12.2 255.255.255.0
[R2-GigabitEthernet0/0/3] quit
[R2]interface GigabitEthernet0/0/4
[R2-GigabitEthernet0/0/4] ip binding vpn-instance OA
[R2-GigabitEthernet0/0/4] ip address 10.0.21.2 255.255.255.0
[R2-GigabitEthernet0/0/4] quit
# On R4, configure VPN instances, bind interfaces to VPN instances, and configure IP
addresses for the interfaces.
1
The preceding command output helps you can check whether VPN instances are correctly
configured and whether interfaces are correctly bound to VPN instances.
MPLS and MPLS LDP need to be configured on the BGP/MPLS IP VPN data forwarding
path.
1
In this experiment, the path R2 -> R4 is the active path, and the path R2 -> R3 -> R4 is
the standby path. Therefore, MPLS and MPLS LDP must be enabled on R2, R3, R4, and
interfaces connecting R2, R3, and R4.
The IP address of the loopback interface is used as the MPLS LSR ID.
The command output shows that an LDP LSP has been established.
Establish IBGP VPNv4 peer relationships in AS 65100, configure R3 as the VPN RR, and
configure R2 and R4 as clients of R3.
As AS 65100 only needs to transmit VPNv4 routes, so IPv4 IBGP peer relationships can be
not established.
When R3 functions as a VPN RR, the RT filtering function needs to be disabled because
no VPN instance is configured.
# Configure a VPNv4 IBGP peer on R3. The RT filtering function needs to be disabled on
R3 that functions as the VPN RR.
[R3]bgp 65100
[R3-bgp] undo default ipv4-unicast
[R3-bgp] peer 10.10.10.2 as-number 65100
[R3-bgp] peer 10.10.10.2 connect-interface LoopBack0
[R3-bgp] peer 10.10.10.4 as-number 65100
[R3-bgp] peer 10.10.10.4 connect-interface LoopBack0
1
The command output shows that an IBGP VPNv4 peer relationship has been established.
R1 and R5 function as CEs and use OSPF to send routes of Loopback0 to PEs. Then PEs
exchange routes.
Set the process ID to 1, area ID to 0, and router ID to the loopback interface's IP address
of the router. R2 with the router ID of 10.10.10.2 is used as an example.
[R2]router id 10.10.10.2
[R2]ospf 1 vpn-instance Finance&OA
[R2-ospf-1] area 0
[R2-ospf-1-area-0.0.0.0] network 10.0.12.2 0.0.0.0
[R2-ospf-1-area-0.0.0.0] quit
[R5]router id 10.10.10.5
[R5]ospf 1
[R5-ospf-1] area 0
[R5-ospf-1-area-0.0.0.0] network 10.0.1.2 0.0.0.0
[R5-ospf-1-area-0.0.0.0] network 10.0.45.5 0.0.0.0
[R4]router id 10.10.10.4
[R4]ospf 1 vpn-instance Finance
[R4-ospf-1] area 0
[R4-ospf-1-area-0.0.0.0] network 10.0.45.4 0.0.0.0
[R4-ospf-1-area-0.0.0.0] quit
1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 30/40/60 ms
The preceding information shows that connectivity on the network segment of the
finance VPN is achieved.
S1 and S2 function as CEs and use BGP to send routes of Loopback0 interfaces to PEs.
The PEs then advertise routes to each other.
# Establish a BGP peer relationship between S1 (CE) and R2 (PE) and advertise routes.
[S1]bgp 65001
[S1-bgp] peer 10.0.21.2 enable
[S1-bgp] network 10.0.2.1 32
[S1-bgp] quit
[R2]bgp 65100
[R2-bgp] ipv4 vpn-instance OA
[R2-bgp-OA] peer 10.0.21.1 as-number 65001
[R2-bgp-OA] quit
# Establish a BGP peer relationship between S2 (CE) and R4 (PE) and advertise routes.
[S2]bgp 65002
[S2-bgp] peer 10.0.42.4 enable
[S2-bgp] network 10.0.2.2 32
[S2-bgp] quit
[R4]bgp 65100
[R4-bgp] ipv4 vpn-instance OA
[R4-bgp-OA] peer 10.0.42.2 as-number 65002
[R4-bgp-OA] quit
6.1.3 Quiz
If R5 needs to communicate with S1 and S2, how do we modify the VPN instance
configuration?
sysname R1
#
router id 10.10.10.1
#
interface GigabitEthernet0/0/2
ip address 10.0.12.1 255.255.255.0
#
interface LoopBack0
ip address 10.0.1.1 255.255.255.255
#
ospf 1
area 0.0.0.0
network 10.0.1.1 0.0.0.0
network 10.0.12.1 0.0.0.0
#
return
Configuration on R2
#
sysname R2
#
router id 10.10.10.2
#
ip vpn-instance Finance&OA
ipv4-family
route-distinguisher 65100:12
vpn-target 65100:12 65001:65002 export-extcommunity
vpn-target 65100:12 65001:65002 import-extcommunity
#
ip vpn-instance OA
ipv4-family
route-distinguisher 65001:2
vpn-target 65001:65002 export-extcommunity
vpn-target 65001:65002 import-extcommunity
#
mpls lsr-id 10.10.10.2
mpls
#
mpls ldp
#
isis 1
is-level level-2
cost-style wide
network-entity 49.0001.0100.1001.0002.00
is-name R2
#
interface GigabitEthernet0/0/1
ip address 10.0.24.2 255.255.255.0
isis enable 1
mpls
mpls ldp
#
interface GigabitEthernet0/0/2
ip address 10.0.23.2 255.255.255.0
isis enable 1
1
mpls
mpls ldp
#
interface GigabitEthernet0/0/3
ip binding vpn-instance Finance&OA
ip address 10.0.12.2 255.255.255.0
#
interface GigabitEthernet0/0/4
ip binding vpn-instance OA
ip address 10.0.21.2 255.255.255.0
#
interface LoopBack0
ip address 10.10.10.2 255.255.255.255
isis enable 1
#
bgp 65100
undo default ipv4-unicast
peer 10.10.10.3 as-number 65100
peer 10.10.10.3 connect-interface LoopBack0
#
ipv4-family unicast
undo synchronization
undo peer 10.10.10.3 enable
#
ipv4-family vpnv4
policy vpn-target
peer 10.10.10.3 enable
#
ipv4-family vpn-instance Finance&OA
network 10.0.1.1 255.255.255.255
#
ipv4-family vpn-instance OA
peer 10.0.21.1 as-number 65001
#
ospf 1 vpn-instance Finance&OA
import-route bgp
area 0.0.0.0
network 10.0.12.2 0.0.0.0
#
return
Configuration on R3
#
sysname R3
#
router id 10.10.10.3
#
mpls lsr-id 10.10.10.3
mpls
#
mpls ldp
#
isis 1
is-level level-2
cost-style wide
1
network-entity 49.0001.0100.1001.0003.00
is-name R3
#
interface GigabitEthernet0/0/2
ip address 10.0.34.3 255.255.255.0
isis enable 1
mpls
mpls ldp
#
interface GigabitEthernet0/0/3
ip address 10.0.23.3 255.255.255.0
isis enable 1
mpls
mpls ldp
#
interface LoopBack0
ip address 10.10.10.3 255.255.255.255
isis enable 1
#
bgp 65100
undo default ipv4-unicast
peer 10.10.10.2 as-number 65100
peer 10.10.10.2 connect-interface LoopBack0
peer 10.10.10.4 as-number 65100
peer 10.10.10.4 connect-interface LoopBack0
#
ipv4-family unicast
undo synchronization
undo peer 10.10.10.2 enable
undo peer 10.10.10.4 enable
#
ipv4-family vpnv4
undo policy vpn-target
peer 10.10.10.2 enable
peer 10.10.10.2 reflect-client
peer 10.10.10.4 enable
peer 10.10.10.4 reflect-client
#
return
Configuration on R4
#
sysname R4
#
router id 10.10.10.4
#
ip vpn-instance Finance
ipv4-family
route-distinguisher 65100:1
vpn-target 65100:12 export-extcommunity
vpn-target 65100:12 import-extcommunity
#
ip vpn-instance OA
ipv4-family
route-distinguisher 65002:2
1
Configuration on R5
#
sysname R5
#
router id 10.10.10.5
#
interface GigabitEthernet0/0/3
ip address 10.0.45.5 255.255.255.0
#
interface LoopBack0
ip address 10.0.1.2 255.255.255.255
#
ospf 1
area 0.0.0.0
network 10.0.1.2 0.0.0.0
network 10.0.45.5 0.0.0.0
#
return
Configuration on S1
#
sysname S1
#
interface Vlanif1
ip address 10.0.21.1 255.255.255.0
#
interface GigabitEthernet0/0/2
port link-type access
#
interface LoopBack0
ip address 10.0.2.1 255.255.255.255
#
bgp 65001
peer 10.0.21.2 as-number 65100
#
ipv4-family unicast
undo synchronization
network 10.0.2.1 255.255.255.255
peer 10.0.21.2 enable
#
return
Configuration on S2
#
sysname S2
1
#
interface Vlanif1
ip address 10.0.42.2 255.255.255.0
#
interface GigabitEthernet0/0/4
port link-type access
#
interface LoopBack0
ip address 10.0.2.2 255.255.255.255
#
bgp 65002
peer 10.0.42.4 as-number 65100
#
ipv4-family unicast
undo synchronization
network 10.0.2.2 255.255.255.255
peer 10.0.42.4 enable
#
Return
1
Reference Answers
Answers to the advanced IGP
Note that the filter command in the OSPF area view can be executed only on ABRs
and takes effect only for Type 3 LSAs. The internal route calculation in an OSPF area
depends on Type 1 and Type 2 LSAs, so this command cannot be used to filter these
LSAs.
1. When a BGP peer receives a route, it adds the route to the BGP Adj-IN routing table
and processes the route based on the inbound BGP routing policy.
If a BGP peer needs to receive only some routes, the peer does not need to send all
routes. To solve this problem, use either of the following methods:
a) Configure a routing policy on the peer to filter the routes to be sent to the BGP
peer. This method requires the cooperation of the peer and has poor flexibility.
b) With the outbound route filtering (ORF) function enabled, the BGP peer notifies
the peer that only some routes are sent. This method is flexible, but both ends
must support ORF.
1. IS-IS uses LSPs in the type-length-value (TLV) structure. Therefore, no new protocol
framework needs to be developed when IS-IS is used to deploy a dual-stack network.
However, by default, IS-IS uses only the shortest path tree (SPT) constructed on an
IPv4 network to calculate the topology.
If a dual-stack IS-IS network needs to be deployed but some devices do not support
IPv6, IS-IS still uses the SPT constructed based on the IPv4 network by default. As a
result, IPv6 packets may be sent to the devices that do not support IPv6, causing
packet loss. Therefore, the multi-topology feature is required.
OSPFv3 has developed for IPv6 networks. OSPFv3 can form SPTs based on IPv6
networks, and therefore multi-topology is not required.
If the ARP entry of the requested host can be found in local ARP entries (dynamic
learned or statically bound entries), the VLANIF interface of the super-VLAN
responds to the ARP Request packet.
1. All terminals on the same network segment communicate with each other through
the gateway. The gateway can restrict and monitor the communication between
terminals. However, the traffic that should be forwarded by the switch at Layer 2 is
forwarded by the gateway at Layer 3, which increases the load of the gateway.
1. Multiple ERTs and IRTs can be configured in a VPN instance. After the peer receives a
route, it accepts the route as long as one ERT in the route matches the locally
configured IRT.
To enable R5 to receive routes from S1 and S2, add Import RT 65001:65002 to the
finance VPN on R4.