100% found this document useful (2 votes)
1K views127 pages

HCIP-Datacom-Advanced Routing Switching Technology V1.0 Lab Guide

HCIP-Datacom-Advanced Routing Switching Technology V1.0 Lab Guide

Uploaded by

Ghallab Alsadeh
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
100% found this document useful (2 votes)
1K views127 pages

HCIP-Datacom-Advanced Routing Switching Technology V1.0 Lab Guide

HCIP-Datacom-Advanced Routing Switching Technology V1.0 Lab Guide

Uploaded by

Ghallab Alsadeh
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 127

Huawei Certification Training Courses

HCIP-Datacom-Advanced Routing &


Switching Technology

Data Communication Senior Engineer


Lab Guide
Issue: 1.0

Huawei Technologies Co., Ltd.


Copyright © Huawei Technologies Co., Ltd. 2020. All rights reserved.
No part of this document may be reproduced or transmitted in any form or by any means without prior
written consent of Huawei Technologies Co., Ltd.

Trademarks and Permissions

and other Huawei trademarks are trademarks of Huawei Technologies Co., Ltd.

All other trademarks and trade names mentioned in this document are the property of their respective
holders.

Notice
The purchased products, services and features are stipulated by the contract made between Huawei and
the customer. All or part of the products, services and features described in this document may not be
within the purchase scope or the usage scope. Unless otherwise specified in the contract, all statements,
information, and recommendations in this document are provided "AS IS" without warranties, guarantees
or representations of any kind, either express or implied.

The information in this document is subject to change without notice. Every effort has been made in
the preparation of this document to ensure accuracy of the contents, but all statements,
information, and recommendations in this document do not constitute a warranty of any kind,
express or implied.

Huawei Technologies Co., Ltd.

Address: Huawei Industrial Base

Bantian, Longgang

Shenzhen 518129

People's Republic of China

Website: https://e.huawei.com/
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 1


23

Huawei Certification System


Huawei Certification follows the "platform + ecosystem" development strategy,
which is a new collaborative architecture of ICT infrastructure based on "Cloud-Pipe-
Terminal". Huawei has set up a complete certification system consisting of three
categories: ICT infrastructure certification, platform and service certification, and ICT
vertical certification. It is the only certification system that covers all ICT technical fields
in the industry. Huawei offers three levels of certification: Huawei Certified ICT
Associate (HCIA), Huawei Certified ICT Professional (HCIP), and Huawei Certified ICT
Expert (HCIE). Huawei Certification covers all ICT fields and adapts to the industry
trend of ICT convergence. With its leading talent development system and certification
standards, it is committed to fostering new ICT talent in the digital era, and building a
sound ICT talent ecosystem.
HCIP-Datacom-Advanced Routing & Switching Technology V1.0 certification covers
advanced IGP features, advanced BGP features, IPv6 routing, advanced VLAN
technologies, Ethernet switching security, MPLS principles, network O&M, network fault
troubleshooting, and network migration. HCIP-Datacom-Advanced Routing & Switching
Technology V1.0 certification is designed for medium- or large-sized enterprise network
engineers that master characteristics and common technologies of medium-or large-
sized enterprise networks. They have capabilities of planning and design, deployment
and O&M, and fault location of medium- or large-sized enterprise networks using
Huawei datacom devices, and can design high security, availability, reliability solutions.
The Huawei certification system introduces the industry, fosters innovation, and
imparts cutting-edge datacom knowledge.
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 2


23
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 3


23

About This Document

Overview
This document is an HCIP-Datacom-Advanced Routing & Switching Technology training
course and is intended for trainees who are going to take the HCIP-Datacom-Advanced
Routing & Switching Technology exam or readers who want to understand advanced
Interior Gateway Protocol (IGP), advanced Border Gateway Protocol (BGP), IPv6 routing,
advanced Virtual Local Area Network (VLAN) technologies, Ethernet switching security,
Multiprotocol Label Switching (MPLS) principles, network O&M, network fault
troubleshooting, and network migration.

Background Knowledge Required


This course is for Huawei's advanced certification. To better understand this course,
familiarize yourself with the following requirements:

1. Have basic computer skills.

2. Have participated in HCIA-Datacom training.

3. Have passed the HCIA-Datacom exams.

4. Be familiar with the principles of the TCP/IP protocol stack.

5. Be familiar with the basic working principles of Ethernet switches and routers.

Symbol Conventions
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 4


23

Lab Environment
Network Description
This lab environment is intended for datacom engineers who are preparing for the HCIP-
Datacom-Advanced Routing & Switching Technology exam. Each lab environment
includes three switches (PoE not supported), two PoE switches, and five routers.

Device Requirements
To meet exercise requirements, the recommended configurations of the environment are
as follows.

The following table lists required devices.

Device Name Device Model Software version

Switch CloudEngine S5731-H24T4XC V200R019C00 or later

PoE switch CloudEngine S5731-H24P4XC V200R019C00 or later

Router NetEngine AR6120 V300R019 or later

The port, output, and configuration information of devices in this document is


provided based on the recommended topology. The actual information may vary
according to the lab environment.
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 5


23

Contents

Overview ................................................................................................................................................................................. 3
Background Knowledge Required ............................................................................................................................... 3
Symbol Conventions .......................................................................................................................................................... 3
Lab Environment ................................................................................................................................................................. 4

1 Advanced IGP Features ......................................................................................................... 7


1.1 Advanced IGP Features ................................................................................................................................................ 7
1.1.1 Introduction .................................................................................................................................................................. 7
1.1.2 Lab Configuration ...................................................................................................................................................... 8
1.1.3 Quiz ............................................................................................................................................................................... 24
1.1.4 Configuration Reference ........................................................................................................................................ 24

2 Advanced BGP Features ......................................................................................................28


2.1 Advanced BGP Features ............................................................................................................................................ 28
2.1.1 Introduction ................................................................................................................................................................ 28
2.1.2 Lab Configuration .................................................................................................................................................... 30
2.1.3 Quiz ............................................................................................................................................................................... 45
2.1.4 Configuration Reference ........................................................................................................................................ 45

3 IPv6 Routing ..........................................................................................................................53


3.1 IPv4/IPv6 Dual Stack Experiment ........................................................................................................................... 53
3.1.1 Introduction ................................................................................................................................................................ 53
3.1.2 Lab Configuration .................................................................................................................................................... 54
3.1.3 Quiz ............................................................................................................................................................................... 72
3.1.4 Configuration Reference .................................................................................................................................... 72

4 Advanced VLAN Technologies ...........................................................................................80


4.1 Advanced VLAN Technologies ................................................................................................................................ 80
4.1.1 Introduction ................................................................................................................................................................ 80
4.1.2 Lab Configuration .................................................................................................................................................... 81
4.1.3 Quiz ............................................................................................................................................................................... 89
4.1.4 Configuration Reference ........................................................................................................................................ 89

5 Ethernet Switching Security ..............................................................................................92


5.1 Ethernet Switching Security ..................................................................................................................................... 92
5.1.1 Introduction ................................................................................................................................................................ 92
5.1.2 Lab Configuration .................................................................................................................................................... 93
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 6


23

5.1.3 Quiz ............................................................................................................................................................................ 103


5.1.4 Configuration Reference ..................................................................................................................................... 103

6 BGP/MPLS IP VPN .............................................................................................................. 105


6.1 BGP/MPLS IP VPN..................................................................................................................................................... 105
6.1.1 Introduction ............................................................................................................................................................. 105
6.1.2 Lab Configuration ................................................................................................................................................. 106
6.1.3 Quiz ............................................................................................................................................................................ 117
6.1.4 Configuration Reference ..................................................................................................................................... 117

Reference Answers ............................................................................................................... 124


1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 7


23

1 Advanced IGP Features

1.1 Advanced IGP Features


1.1.1 Introduction
1.1.1.1 Objectives
Upon completion of this task, you will be able to:

● Deploy Fast Reroute (FRR) and Bidirectional Forwarding Detection (BFD) to speed up
Open Shortest Path First (OSPF) convergence.
● Filter outgoing OSPF Link State Advertisements (LSAs).
● Deploy inter-area route filtering to reduce the OSPF link state database (LSDB) size.

1.1.1.1 Networking Topology

Networking of advanced IGP

Figure 1-1 shows interconnected interfaces and their IP addresses. Loopback0 interfaces
are created on all devices, and their IP addresses are 10.0.x.x/24, where x indicates the
device number.

Interconnected interfaces of R1, R2, and R3 belong to OSPF area 0. Loopback0 interfaces
of R1, R2, and R3 also belong to OSPF area 0, and interconnected interfaces of R3 and R4
and the Loopback0 interface of R4 belong to OSPF area 1.

R4 and R5 belong to Intermediate System-to-Intermediate System (IS-IS) area 49.0001.


R5 is an IS-IS Level-1 router, and R4 is an IS-IS Level-1-2 router.
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 8


23

1.1.1.2 Background
There are four AR routers running OSPF on the intranet. To control the number of OSPF
LSDBs, the four AR routers are assigned to different areas. IS-IS runs between R4 (ASBR)
in OSPF area 1 and R5 in the branch.

To speed up OSPF convergence, the network administrator deploys OSPF IP FRR and
association between OSPF and BFD.

To control the number of routes on the headquarters network, route filtering is


configured on R3 (ABR) to limit the number of routes that can enter OSPF area 0.

The branch needs to access the headquarters network. The network administrator has
delivered the default IS-IS routes to the branch instead of importing OSPF routes to the
IS-IS routing table.

1.1.2 Lab Configuration


1.1.2.1 Configuration Roadmap
1. Configure IP addresses for devices.

2. Configure OSPF according to the planning.

3. Configure IS-IS according to the planning.

4. Enable OSPF IP FRR on R1 to generate a backup path to R4.

5. Enable BFD globally on all OSPF-enabled devices, enable BFD on interconnected


interfaces, and shut down GE0/0/1 on R3. On R1, check whether the status of the
OSPF neighbor relationship with R3 and route status can be rapidly switched.

6. Create Loopback2 interfaces with the same IP address on R1 and R2, activate OSPF
on the interfaces, and check whether equal-cost routes exist in the OSPF routing
table on R3. Then limit the number of equal-cost routes to 1. Create Loopback3 on
R4 and activate OSPF. Configure inter-area route filtering on R3 (ABR) to prevent
Loopback3 on R4 from advertising routes to OSPF area 0.

7. Advertise the default route in IS-IS process 1 of R4.

1.1.1.2 Configuration Procedure

# Name the devices.

The configuration details are not provided.

# Disable the interfaces that are not used in this experiment.

The configuration details are not provided.

# Configure IP addresses for GE0/0/1, GE0/0/2, and a loopback interface on R1.


[R1]interface GigabitEthernet0/0/1
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 9


23

[R1-GigabitEthernet0/0/1] ip address 10.0.13.1 255.255.255.0


[R1-GigabitEthernet0/0/1] quit
[R1]interface GigabitEthernet0/0/2
[R1-GigabitEthernet0/0/2] ip address 10.0.12.1 255.255.255.0
[R1-GigabitEthernet0/0/2] quit
[R1]interface LoopBack 0
[R1-LoopBack0] ip address 10.0.1.1 24
[R1-LoopBack0] quit
# Configure IP addresses for GE0/0/2, GE0/0/3, and a loopback interface on R2.
[R2]interface GigabitEthernet0/0/2
[R2-GigabitEthernet0/0/2] ip address 10.0.23.2 255.255.255.0
[R2-GigabitEthernet0/0/2] quit
[R2]interface GigabitEthernet0/0/3
[R2-GigabitEthernet0/0/3] ip address 10.0.12.2 255.255.255.0
[R2-GigabitEthernet0/0/3] quit
[R2]interface LoopBack0
[R2-LoopBack0] ip address 10.0.2.2 255.255.255.0
[R2-LoopBack0] quit

# Configure IP addresses for GE0/0/1, GE0/0/2, GE0/0/3, and a loopback interface on R3.
[R3]interface GigabitEthernet0/0/1
[R3-GigabitEthernet0/0/1] ip address 10.0.13.3 255.255.255.0
[R3-GigabitEthernet0/0/1] quit
[R3]interface GigabitEthernet0/0/2
[R3-GigabitEthernet0/0/2] ip address 10.0.34.3 255.255.255.0
[R3-GigabitEthernet0/0/2]quit
[R3]interface GigabitEthernet0/0/3
[R3-GigabitEthernet0/0/3] ip address 10.0.23.3 255.255.255.0
[R3-GigabitEthernet0/0/3] quit
[R3]interface LoopBack0
[R3-LoopBack0] ip address 10.0.3.3 255.255.255.0
[R3-LoopBack0] quit

# Configure IP addresses for GE0/0/2, GE0/0/3, and a loopback interface on R4.


[R4]interface GigabitEthernet0/0/2
[R4-GigabitEthernet0/0/2] ip address 10.0.45.4 255.255.255.0
[R4-GigabitEthernet0/0/2] quit
[R4]interface GigabitEthernet0/0/3
[R4-GigabitEthernet0/0/3] ip address 10.0.34.4 255.255.255.0
[R4-GigabitEthernet0/0/3] quit
[R4]interface LoopBack0
[R4-LoopBack0] ip address 10.0.4.4 255.255.255.0
[R4-LoopBack0] quit

# Configure IP addresses for GE0/0/3 and a loopback interface on R5.


[R5]interface GigabitEthernet0/0/3
[R5-GigabitEthernet0/0/3] ip address 10.0.45.5 255.255.255.0
[R5-GigabitEthernet0/0/3] quit
[R5]interface LoopBack0
[R5-LoopBack0] ip address 10.0.5.5 255.255.255.0
[R5-LoopBack0] quit

# Check the connectivity on R1, R2, and R4.


<R1>ping -c 1 10.12.2
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 10


23

Error: Unknown host 10.12.2.


<R1>ping -c 1 10.0.12.2
PING 10.0.12.2: 56 data bytes, press CTRL_C to break
Reply from 10.0.12.2: bytes=56 Sequence=1 ttl=255 time=60 ms

--- 10.0.12.2 ping statistics ---


1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 60/60/60 ms

<R1>ping -c 1 10.0.13.3
PING 10.0.13.3: 56 data bytes, press CTRL_C to break
Reply from 10.0.13.3: bytes=56 Sequence=1 ttl=255 time=50 ms

--- 10.0.13.3 ping statistics ---


1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 50/50/50 ms

<R2>ping -c 1 10.0.23.3
PING 10.0.23.3: 56 data bytes, press CTRL_C to break
Reply from 10.0.23.3: bytes=56 Sequence=1 ttl=255 time=60 ms

--- 10.0.23.3 ping statistics ---


1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 60/60/60 ms

<R4>ping -c 1 10.0.34.3
PING 10.0.34.3: 56 data bytes, press CTRL_C to break
Reply from 10.0.34.3: bytes=56 Sequence=1 ttl=255 time=40 ms

--- 10.0.34.3 ping statistics ---


1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 40/40/40 ms

<R4>ping -c 1 10.0.45.5
PING 10.0.45.5: 56 data bytes, press CTRL_C to break
Reply from 10.0.45.5: bytes=56 Sequence=1 ttl=255 time=80 ms

--- 10.0.45.5 ping statistics ---


1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 80/80/80 ms

Configure OSPF on R1, R2, R3, and R4, use the IP address of Loopback0 as the router ID,
set the OSPF process ID to 1, and activate OSPF on the corresponding interfaces.
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 11


23

# Configure IP addresses of Loopback0 interfaces as OSPF router IDs of R1, R2, R3, and
R4 and set the OSPF process ID to 1.
[R1]ospf 1 router-id 10.0.1.1

[R2]ospf 1 router-id 10.0.2.2

[R3]ospf 1 router-id 10.0.3.3

[R4]ospf 1 router-id 10.0.4.4

# Configure OSPF on R1 and activate OSPF on GE0/0/1, GE0/0/2, and Loopback0.


[R1]ospf 1
[R1-ospf-1] area 0.0.0.0
[R1-ospf-1-area-0.0.0.0] network 10.0.13.1 0.0.0.0
[R1-ospf-1-area-0.0.0.0] network 10.0.12.1 0.0.0.0
[R1-ospf-1-area-0.0.0.0] network 10.0.1.1 0.0.0.0
[R1-ospf-1-area-0.0.0.0] quit
[R1-ospf-1] quit

# Configure OSPF on R2 and activate OSPF on GE0/0/2, GE0/0/3, and Loopback0.


[R2]ospf 1
[R2-ospf-1] area 0.0.0.0
[R2-ospf-1-area-0.0.0.0] network 10.0.12.2 0.0.0.0
[R2-ospf-1-area-0.0.0.0] network 10.0.23.2 0.0.0.0
[R2-ospf-1-area-0.0.0.0] network 10.0.2.2 0.0.0.0
[R2-ospf-1-area-0.0.0.0] quit
[R2-ospf-1] quit

# Configure OSPF on R3 and activate OSPF on GE0/0/1, GE0/0/2, and Loopback0.


[R3]ospf 1
[R3-ospf-1] area 0.0.0.0
[R3-ospf-1-area-0.0.0.0] network 10.0.13.3 0.0.0.0
[R3-ospf-1-area-0.0.0.0] network 10.0.23.3 0.0.0.0
[R3-ospf-1-area-0.0.0.0] network 10.0.3.3 0.0.0.0
[R3-ospf-1-area-0.0.0.0] area 0.0.0.1
[R3-ospf-1-area-0.0.0.1] network 10.0.34.3 0.0.0.0
[R3-ospf-1-area-0.0.0.1] quit
[R3-ospf-1] quit

# Configure OSPF on R4 and activate OSPF on GE0/0/3 and Loopback0.


[R4]ospf 1
[R4-ospf-1] area 0.0.0.1
[R4-ospf-1-area-0.0.0.1] network 10.0.34.4 0.0.0.0
[R4-ospf-1-area-0.0.0.1] network 10.0.4.4 0.0.0.0
[R4-ospf-1-area-0.0.0.1] quit
[R4-ospf-1] quit
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 12


23

# Check the OSPF neighbor relationship status on R2 and R3.


<R2>display ospf peer brief

OSPF Process 1 with Router ID 10.0.2.2


Peer Statistic Information
----------------------------------------------------------------------------
Area Id Interface Neighbor id State
0.0.0.0 GigabitEthernet0/0/2 10.0.3.3 Full
0.0.0.0 GigabitEthernet0/0/3 10.0.1.1 Full
----------------------------------------------------------------------------

<R3>display ospf peer brief

OSPF Process 1 with Router ID 10.0.3.3


Peer Statistic Information
----------------------------------------------------------------------------
Area Id Interface Neighbor id State
0.0.0.0 GigabitEthernet0/0/1 10.0.1.1 Full
0.0.0.0 GigabitEthernet0/0/3 10.0.2.2 Full
0.0.0.1 GigabitEthernet0/0/2 10.0.4.4 Full
----------------------------------------------------------------------------

All OSPF neighbor relationships have been established.

# Check the OSPF routing table on R1.


<R1>display ospf routing

OSPF Process 1 with Router ID 10.0.1.1


Routing Tables

Routing for Network


Destination Cost Type NextHop AdvRouter Area
10.0.1.1/32 0 Stub 10.0.1.1 10.0.1.1 0.0.0.0
10.0.12.0/24 1 Transit 10.0.12.1 10.0.1.1 0.0.0.0
10.0.13.0/24 1 Transit 10.0.13.1 10.0.1.1 0.0.0.0
10.0.2.2/32 1 Stub 10.0.12.2 10.0.2.2 0.0.0.0
10.0.3.3/32 1 Stub 10.0.13.3 10.0.3.3 0.0.0.0
10.0.4.4/32 2 Inter-area 10.0.13.3 10.0.3.3 0.0.0.0
10.0.23.0/24 2 Transit 10.0.13.3 10.0.2.2 0.0.0.0
10.0.23.0/24 2 Transit 10.0.12.2 10.0.2.2 0.0.0.0
10.0.34.0/24 2 Inter-area 10.0.13.3 10.0.3.3 0.0.0.0

Total Nets: 9
Intra Area: 7 Inter Area: 2 ASE: 0 NSSA: 0
R1 has learned OSPF routes on the entire network.
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 13


23

Configure IS-IS processes on routers one by one according to the topology design. Set the
process ID to 1 and NET to the device ID. Here, the NET of R4 is
49.0001.0000.0000.0004.00.

# Configure IS-IS on R4.


[R4]isis 1
[R4-isis-1] is-level level-1-2
[R4-isis-1] network-entity 49.0001.0000.0000.0004.00
[R4-isis-1] quit
[R4]interface GigabitEthernet0/0/2
[R4-GigabitEthernet0/0/2] isis enable 1
[R4-GigabitEthernet0/0/2] quit

# Configure IS-IS on R5.


[R5]isis 1
[R5-isis-1] is-level level-1
[R5-isis-1] network-entity 49.0001.0000.0000.0005.00
[R5-isis-1] quit
[R5]interface LoopBack 0
[R5-LoopBack0] isis enable 1
[R5-LoopBack0] quit
[R5]interface GigabitEthernet0/0/3
[R5-GigabitEthernet0/0/3] isis enable 1
[R5-GigabitEthernet0/0/3] quit

# Check the IS-IS neighbor relationship and IS-IS routing table on R4.
[R4]display isis peer

Peer information for ISIS(1)

System Id Interface Circuit Id State HoldTime Type PRI


-------------------------------------------------------------------------------
0000.0000.0005 GE0/0/2 0000.0000.0005.01 Up 8s L1 64

Total Peer(s): 1

An IS-IS Level-1 neighbor relationship has been established between R4 and R5.
[R4]display isis route

Route information for ISIS(1)


-----------------------------

ISIS(1) Level-1 Forwarding Table


--------------------------------

IPV4 Destination IntCost ExtCost ExitInterface NextHop Flags


-------------------------------------------------------------------------------
10.0.45.0/24 10 NULL GE0/0/2 Direct D/-/L/-
10.0.5.0/24 10 NULL GE0/0/2 10.0.45.5 A/-/L/-
Flags: D-Direct, A-Added to URT, L-Advertised in LSPs, S-IGP Shortcut,U-Up/Down Bit Set
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 14


23

ISIS(1) Level-2 Forwarding Table


--------------------------------

IPV4 Destination IntCost ExtCost ExitInterface NextHop Flags


-------------------------------------------------------------------------------
10.0.45.0/24 10 NULL GE0/0/2 Direct D/-/L/-
Flags: D-Direct, A-Added to URT, L-Advertised in LSPs, S-IGP Shortcut,U-Up/Down Bit Set

R4 has learned the route to the Loopback0 interface of R5.

To back up the path from R1 to Loopback0 on R4, enable OSPF IP FRR on R1.

# Check the OSPF route 10.0.4.4/32 on R1.


<R1>display ospf routing 10.0.4.4 24

OSPF Process 1 with Router ID 10.0.1.1


<R1>display ospf routing 10.0.4.4 32

OSPF Process 1 with Router ID 10.0.1.1

Destination : 10.0.4.4/32
AdverRouter : 10.0.3.3 Area : 0.0.0.0
Cost :2 Type : Inter-area
NextHop : 10.0.13.3 Interface : GigabitEthernet0/0/1
Priority : Medium Age : 00h35m44s

In this case, the next hop of the OSPF route 10.0.4.4/32 is 10.0.13.3.

# Enable FRR on R1.


[R1]ospf 1
[R1-ospf-1] frr
[R1-ospf-1-frr] loop-free-alternate
[R1-ospf-1-frr] quit
[R1-ospf-1] quit

# Check the OSPF route 10.0.4.4/32 on R1.


<R1>display ospf routing 10.0.4.4 32

OSPF Process 1 with Router ID 10.0.1.1

Destination : 10.0.4.4/32
AdverRouter : 10.0.3.3 Area : 0.0.0.0
Cost :2 Type : Inter-area
NextHop : 10.0.13.3 Interface : GigabitEthernet0/0/1
Priority : Medium Age : 00h01m00s
Backup Nexthop : 10.0.12.2 Backup Interface : GigabitEthernet0/0/2
Backup Type : LFA LINK

A backup route destined for R4's Loopback0 interface has been generated on R1, with the
next hop address being 10.0.12.2 and outbound interface being GE0/0/2. The backup
route is destined for R4's Loopback0 interface through R2.
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 15


23

To speed up OSPF convergence, enable BFD on all routers in the OSPF domain, configure
BFD on interconnected interfaces, and disable GE0/0/1 on R3. Check whether R1 can
quickly detect the BFD session termination and trigger OSPF route switching.

# Enable BFD globally on R1, R2, R3, and R4.


[R1]bfd
[R1-bfd] quit
[R1]ospf 1
[R1-ospf-1] bfd all-interfaces enable
[R1-ospf-1] quit

[R2]bfd
[R2-bfd] quit
[R2]ospf 1
[R2-ospf-1] bfd all-interfaces enable
[R2-ospf-1] quit

[R3]bfd
[R3-bfd] quit
[R3]ospf 1
[R3-ospf-1] bfd all-interfaces enable
[R3-ospf-1] quit

[R4]bfd
[R4-bfd] quit
[R4]ospf 1
[R4-ospf-1] bfd all-interfaces enable
[R4-ospf-1] quit

# Configure BFD on R1, set the minimum intervals for sending and receiving packets to
500 ms, and the local detection multiplier to 4.
[R1]interface GigabitEthernet0/0/1
[R1-GigabitEthernet0/0/1] ospf bfd enable
[R1-GigabitEthernet0/0/1] ospf bfd min-tx-interval 500 min-rx-interval 500 detect-multiplier 4
[R1-GigabitEthernet0/0/1] quit
[R1]interface GigabitEthernet0/0/2
[R1-GigabitEthernet0/0/2] ospf bfd enable
[R1-GigabitEthernet0/0/2] ospf bfd min-tx-interval 500 min-rx-interval 500 detect-multiplier 4
[R1-GigabitEthernet0/0/2] quit

# Configure BFD on R2, set the minimum intervals for sending and receiving packets to
500 ms, and the local detection multiplier to 4.
[R2]interface GigabitEthernet0/0/2
[R2-GigabitEthernet0/0/2] ospf bfd enable
[R2-GigabitEthernet0/0/2] ospf bfd min-tx-interval 500 min-rx-interval 500 detect-multiplier 4
[R2-GigabitEthernet0/0/2] quit
[R2]interface GigabitEthernet0/0/3
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 16


23

[R2-GigabitEthernet0/0/3] ospf bfd enable


[R2-GigabitEthernet0/0/3] ospf bfd min-tx-interval 500 min-rx-interval 500 detect-multiplier 4
[R2-GigabitEthernet0/0/3] quit

# Configure BFD on R3, set the minimum intervals for sending and receiving packets to
500 ms, and the local detection multiplier to 4.
[R3]interface GigabitEthernet0/0/1
[R3-GigabitEthernet0/0/1] ospf bfd enable
[R3-GigabitEthernet0/0/1] ospf bfd min-tx-interval 500 min-rx-interval 500 detect-multiplier 4
[R3-GigabitEthernet0/0/1] quit
[R3]interface GigabitEthernet0/0/2
[R3-GigabitEthernet0/0/2] ospf bfd enable
[R3-GigabitEthernet0/0/2] ospf bfd min-tx-interval 500 min-rx-interval 500 detect-multiplier 4
[R3-GigabitEthernet0/0/2] quit
[R3]interface GigabitEthernet0/0/3
[R3-GigabitEthernet0/0/3] ospf bfd enable
[R3-GigabitEthernet0/0/3] ospf bfd min-tx-interval 500 min-rx-interval 500 detect-multiplier 4
[R3-GigabitEthernet0/0/3] quit

# Configure BFD on R4, set the minimum intervals for sending and receiving packets to
500 ms, and the local detection multiplier to 4.
[R4]interface GigabitEthernet0/0/3
[R4-GigabitEthernet0/0/3] ospf bfd enable
[R4-GigabitEthernet0/0/3] ospf bfd min-tx-interval 500 min-rx-interval 500 detect-multiplier 4
[R4-GigabitEthernet0/0/3] quit

# Check the BFD session status on R1 and R3.


[R1]display ospf bfd session all

OSPF Process 1 with Router ID 10.0.1.1


Area 0.0.0.0 interface10.0.13.1(GigabitEthernet0/0/1)'s BFD Sessions

NeighborId :10.0.3.3 AreaId :0.0.0.0 Interface :GigabitEthernet0/0/1


BFDState :up rx :500 tx :500
Multiplier :4 BFD Local Dis :8193 LocalIpAdd :10.0.13.1
RemoteIpAdd:10.0.13.3 Diagnostic Info :No diagnostic information

Area 0.0.0.0 interface10.0.12.1(GigabitEthernet0/0/2)'s BFD Sessions

NeighborId :10.0.2.2 AreaId :0.0.0.0 Interface :GigabitEthernet0/0/2


BFDState :up rx :500 tx :500
Multiplier :4 BFD Local Dis :8192 LocalIpAdd:10.0.12.1
RemoteIpAdd :10.0.12.2 Diagnostic Info :No diagnostic information

The BFD sessions between R1 and R2 and between R1 and R3 are up.
[R3]display ospf bfd session all

OSPF Process 1 with Router ID 10.0.3.3


Area 0.0.0.0 interface10.0.13.3(GigabitEthernet0/0/1)'s BFD Sessions

NeighborId :10.0.1.1 AreaId :0.0.0.0 Interface :GigabitEthernet0/0/1


BFDState :up rx :500 tx :500
Multiplier :4 BFD Local Dis :8192 LocalIpAdd :10.0.13.3
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 17


23

RemoteIpAdd :10.0.13.1 Diagnostic Info :No diagnostic information

Area 0.0.0.0 interface10.0.23.3(GigabitEthernet0/0/3)'s BFD Sessions

NeighborId :10.0.2.2 AreaId :0.0.0.0 Interface :GigabitEthernet0/0/3


BFDState :up rx :500 tx :500
Multiplier :4 BFD Local Dis :8193 LocalIpAdd :10.0.23.3
RemoteIpAdd :10.0.23.2 Diagnostic Info :No diagnostic information

Area 0.0.0.1 interface10.0.34.3(GigabitEthernet0/0/2)'s BFD Sessions

NeighborId :10.0.4.4 AreaId :0.0.0.1 Interface :GigabitEthernet0/0/2


BFDState :up rx :500 tx :500
Multiplier :4 BFD Local Dis :8194 LocalIpAdd :10.0.34.3
RemoteIpAdd :10.0.34.4 Diagnostic Info :No diagnostic information

The BFD sessions between R3 and R1, R2, and R4 are Up.

# Shut down GE0/0/1 of R3 and test the association between BFD and OSPF.
[R3]interface GigabitEthernet0/0/1
[R3-GigabitEthernet0/0/1] shutdown
[R3-GigabitEthernet0/0/1] quit

# Check the status of GE0/0/1 on R1.


[R1]display interface GigabitEthernet 0/0/1
GigabitEthernet0/0/1 current state : UP
Line protocol current state : UP

R1 and R3 are connected through S5. After GE0/0/1 on R3 is shut down, GE0/0/1 on R1 is
still Up and cannot detect the connectivity interruption between R1 and R3.

# Check the BFD session status on GE0/0/1 of R1.


[R1]display ospf bfd session GigabitEthernet 0/0/1

OSPF Process 1 with Router ID 10.0.1.1

There is no BFD session.

# Check the OSPF neighbor relationship status on R1.


<R1>display ospf peer brief

OSPF Process 1 with Router ID 10.0.1.1


Peer Statistic Information
----------------------------------------------------------------------------
Area Id Interface Neighbor id State
0.0.0.0 GigabitEthernet0/0/2 10.0.2.2 Full
----------------------------------------------------------------------------

The OSPF neighbor relationship between R1 and R3 has been terminated, and the time of
shutting down GE0/0/1 on R3 is smaller than the OSPF dead interval.

# Run the display ospf peer last-nbr-down command on R1 to check the reason why the
neighbor relationship is interrupted.
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 18


23

<R1>display ospf peer last-nbr-down

OSPF Process 1 with Router ID 10.0.1.1

Last Down OSPF Peer

Neighbor Ip Address : 10.0.13.3


Neighbor Area Id : 0.0.0.0
Neighbor Router Id : 10.0.3.3
Interface : GigabitEthernet0/0/1
Immediate Reason : Neighbor Down Due to Kill Neighbor
Primary Reason : BFD Session Down
Down Time : 2020-07-09 18:54:48-08:00

The command output shows that the neighbor relationship between R1 and R3 is
interrupted because the BFD session is Down.

# Check OSPF route 10.0.4.4/32 on R1.


[R1]display ospf routing 10.0.4.4 32

OSPF Process 1 with Router ID 10.0.1.1

Destination : 10.0.4.4/32
AdverRouter : 10.0.3.3 Area : 0.0.0.0
Cost :3 Type : Inter-area
NextHop : 10.0.12.2 Interface : GigabitEthernet0/0/2
Priority : Medium Age : 00h01m25s

The next hop of the route to R4's Loopback0 interface is changed to 10.0.12.2, and the
outbound interface is GE0/0/2.

On R1 and R2, create Loopback2 interfaces on R1 and R2 and assign IP addresses on


network segment 172.16.2.1/24 to Loopback2 interfaces. Activate OSPF on Loopback2
interfaces and set the number of equal-cost routes to 1 on R3.

On R4, create the loopback 3 interface with the IP address on network segment
172.16.3.1/24, change the OSPF interface type to broadcast, activate OSPF on the
Loopback3 interface, and perform inter-area Type 3 LSA filtering on R3 (ABR) to prevent
the OSPF inter-area route 172.16.3.0/24 from being transmitted to OSPF area 0.

# Create Loopback2 interfaces on R1 and R2.


[R1]interface LoopBack2
[R1-LoopBack2] ip address 172.16.2.1 255.255.255.0
[R1-LoopBack2] quit

[R2]interface LoopBack2
[R2-LoopBack2] ip address 172.16.2.1 255.255.255.0
[R2-LoopBack2] quit

# Activate OSPF on Loopback 2 interfaces of R1 and R2.


[R1]ospf 1
[R1-ospf-1]area 0.0.0.0
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 19


23

[R1-ospf-1-area-0.0.0.0] network 172.16.2.1 0.0.0.0


[R1-ospf-1-area-0.0.0.0] quit
[R1-ospf-1] quit

[R2]ospf 1
[R2-ospf-1]area 0.0.0.0
[R2-ospf-1-area-0.0.0.0] network 172.16.2.1 0.0.0.0
[R2-ospf-1-area-0.0.0.0] quit
[R2-ospf-1]quit

# Enable GE0/0/1 of R3.


[R3]interface GigabitEthernet0/0/1
[R3-GigabitEthernet0/0/1] undo shutdown

# After the OSPF neighbor relationship between R1 and R3 is reestablished, check the
OSPF routing table of R3.
[R3-ospf-1]display ospf routing

OSPF Process 1 with Router ID 10.0.3.3


Routing Tables

Routing for Network


Destination Cost Type NextHop AdvRouter Area
10.0.3.3/32 0 Stub 10.0.3.3 10.0.3.3 0.0.0.0
10.0.13.0/24 1 Transit 10.0.13.3 10.0.3.3 0.0.0.0
10.0.23.0/24 1 Transit 10.0.23.3 10.0.3.3 0.0.0.0
10.0.34.0/24 1 Transit 10.0.34.3 10.0.3.3 0.0.0.1
10.0.1.1/32 1 Stub 10.0.13.1 10.0.1.1 0.0.0.0
10.0.2.2/32 1 Stub 10.0.23.2 10.0.2.2 0.0.0.0
10.0.4.4/32 1 Stub 10.0.34.4 10.0.4.4 0.0.0.1
10.0.12.0/24 2 Transit 10.0.23.2 10.0.2.2 0.0.0.0
10.0.12.0/24 2 Transit 10.0.13.1 10.0.2.2 0.0.0.0
172.16.2.1/32 1 Stub 10.0.23.2 10.0.2.2 0.0.0.0
172.16.2.1/32 1 Stub 10.0.13.1 10.0.1.1 0.0.0.0

Total Nets: 11
Intra Area: 11 Inter Area: 0 ASE: 0 NSSA: 0

The OSPF route 172.16.2.1/32 on R3 is used for load balancing, with R1 and R2 as next
hops.

# Set the maximum number of equal-cost routes for load balancing to 1 on R3.
[R3]ospf 1
[R3-ospf-1] maximum load-balancing 1

# Check the routing table on R3 again.


[R3]display ospf routing

OSPF Process 1 with Router ID 10.0.3.3


Routing Tables

Routing for Network


Destination Cost Type NextHop AdvRouter Area
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 20


23

10.0.3.3/32 0 Stub 10.0.3.3 10.0.3.3 0.0.0.0


10.0.13.0/24 1 Transit 10.0.13.3 10.0.3.3 0.0.0.0
10.0.23.0/24 1 Transit 10.0.23.3 10.0.3.3 0.0.0.0
10.0.34.0/24 1 Transit 10.0.34.3 10.0.3.3 0.0.0.1
10.0.1.1/32 1 Stub 10.0.13.1 10.0.1.1 0.0.0.0
10.0.2.2/32 1 Stub 10.0.23.2 10.0.2.2 0.0.0.0
10.0.4.4/32 1 Stub 10.0.34.4 10.0.4.4 0.0.0.1
10.0.12.0/24 2 Transit 10.0.23.2 10.0.2.2 0.0.0.0
172.16.2.1/32 1 Stub 10.0.23.2 10.0.2.2 0.0.0.0

Total Nets: 9
Intra Area: 9 Inter Area: 0 ASE: 0 NSSA: 0

There is only one OSPF route 172.16.2.1/32 on R3, and the next hop is R2.

When the number of equal-cost routes is greater than number specified in the maximum
load-balancing command, valid routes are selected for load balancing based on the
following criteria:

1. Route priority: Routes with the highest priority (lowest weight) are selected for load
balancing.

2. Interface index: If routes have the same priority, the routes with the largest interface
index are selected for load balancing.

3. Next-hop IP address: If routes have the same priority and interface index, the routes
with the largest next-hop IP addresses are selected for load balancing.

The index of GE0/0/3 on R3 connected to R2 is greater than that of GE0/0/1 on R1, so


the OSPF route 172.16.2.1/32 from R2 becomes valid.

# Create Loopback3 on R4 and activate OSPF.


[R4]interface LoopBack 3
[R4-LoopBack3] ip address 172.16.3.1 24
[R4-LoopBack3] ospf network-type broadcast
[R4-LoopBack3] quit

[R4]ospf 1
[R4-ospf-1]area 1
[R4-ospf-1-area-0.0.0.1] network 172.16.3.1 0.0.0.0
[R4-ospf-1-area-0.0.0.1] quit
[R4-ospf-1] quit

# Check OSPF routing information on R1.


<R1>display ospf routing

OSPF Process 1 with Router ID 10.0.1.1


Routing Tables

Routing for Network


Destination Cost Type NextHop AdvRouter Area
10.0.1.1/32 0 Stub 10.0.1.1 10.0.1.1 0.0.0.0
10.0.12.0/24 1 Transit 10.0.12.1 10.0.1.1 0.0.0.0
10.0.13.0/24 1 Transit 10.0.13.1 10.0.1.1 0.0.0.0
172.16.2.1/32 0 Stub 172.16.2.1 10.0.1.1 0.0.0.0
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 21


23

10.0.2.2/32 1 Stub 10.0.12.2 10.0.2.2 0.0.0.0


10.0.3.3/32 1 Stub 10.0.13.3 10.0.3.3 0.0.0.0
10.0.4.4/32 2 Inter-area 10.0.13.3 10.0.3.3 0.0.0.0
10.0.23.0/24 2 Transit 10.0.12.2 10.0.3.3 0.0.0.0
10.0.23.0/24 2 Transit 10.0.13.3 10.0.3.3 0.0.0.0
10.0.34.0/24 2 Inter-area 10.0.13.3 10.0.3.3 0.0.0.0
172.16.3.0/24 2 Inter-area 10.0.13.3 10.0.3.3 0.0.0.0

Total Nets: 11
Intra Area: 8 Inter Area: 3 ASE: 0 NSSA: 0

R1 has learned the route to the Loopback3 interface of R4.

# Check the OSPF LSDB on R3.


[R3]display ospf lsdb
[R3]display ospf lsdb

OSPF Process 1 with Router ID 10.0.3.3


Link StateDatabase

Area: 0.0.0.0
Type LinkState ID AdvRouter Age Len Sequence Metric
Router 10.0.3.3 10.0.3.3 599 60 8000001E 1
Router 10.0.2.2 10.0.2.2 761 72 80000014 1
Router 10.0.1.1 10.0.1.1 602 72 80000014 1
Network 10.0.23.3 10.0.3.3 1693 32 80000002 0
Network 10.0.13.1 10.0.1.1 602 32 80000002 0
Network 10.0.12.2 10.0.2.2 373 32 80000008 0
Sum-Net 10.0.34.0 10.0.3.3 535 28 80000007 1
Sum-Net 172.16.3.0 10.0.3.3 455 28 80000001 1
Sum-Net 10.0.4.4 10.0.3.3 39 28 80000007 1

Area: 0.0.0.1
Type LinkState ID AdvRouter Age Len Sequence Metric
Router 10.0.3.3 10.0.3.3 337 36 8000000B 1
Router 10.0.4.4 10.0.4.4 418 60 80000010 1
Network 10.0.34.3 10.0.3.3 337 32 80000008 0
Sum-Net 10.0.13.0 10.0.3.3 640 28 80000003 1
Sum-Net 10.0.12.0 10.0.3.3 1693 28 80000002 2
Sum-Net 172.16.2.1 10.0.3.3 1398 28 80000001 1
Sum-Net 10.0.3.3 10.0.3.3 1680 28 80000006 0
Sum-Net 10.0.2.2 10.0.3.3 1693 28 80000002 1
Sum-Net 10.0.1.1 10.0.3.3 599 28 80000003 1
Sum-Net 10.0.23.0 10.0.3.3 1739 28 80000002 1

In the LSDB of OSPF area 0 on R3 (ABR), you can view the Type 3 LSA 172.16.3.0.

# Configure Type 3 LSA filtering on R3 (ABR) to prevent the OSPF inter-area route
172.16.3.0/24 from being transmitted to OSPF area 0.
[R3]ip ip-prefix 1 index 10 deny 172.16.3.0 24 greater-equal 24 less-equal 24
[R3]ip ip-prefix 1 index 20 permit 0.0.0.0 0 less-equal 32

[R3]ospf 1
[R3-ospf-1] area 1
[R3-ospf-1-area-0.0.0.1] filter ip-prefix 1 export
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 22


23

# Check the OSPF LSDB on R3 again.


[R3]display ospf lsdb

OSPF Process 1 with Router ID 10.0.3.3


Link StateDatabase

Area: 0.0.0.0
Type LinkState ID AdvRouter Age Len Sequence Metric
Router 10.0.3.3 10.0.3.3 966 60 8000001E 1
Router 10.0.2.2 10.0.2.2 1128 72 80000014 1
Router 10.0.1.1 10.0.1.1 969 72 80000014 1
Network 10.0.23.3 10.0.3.3 259 32 80000003 0
Network 10.0.13.1 10.0.1.1 969 32 80000002 0
Network 10.0.12.2 10.0.2.2 740 32 80000008 0
Sum-Net 10.0.34.0 10.0.3.3 13 28 80000001 1
Sum-Net 10.0.4.4 10.0.3.3 13 28 80000001 1

Area: 0.0.0.1
Type LinkState ID AdvRouter Age Len Sequence Metric
Router 10.0.3.3 10.0.3.3 704 36 8000000B 1
Router 10.0.4.4 10.0.4.4 785 60 80000010 1
Network 10.0.34.3 10.0.3.3 704 32 80000008 0
Sum-Net 10.0.13.0 10.0.3.3 1007 28 80000003 1
Sum-Net 10.0.12.0 10.0.3.3 259 28 80000003 2
Sum-Net 172.16.2.1 10.0.3.3 1765 28 80000001 1
Sum-Net 10.0.3.3 10.0.3.3 246 28 80000007 0
Sum-Net 10.0.2.2 10.0.3.3 259 28 80000003 1
Sum-Net 10.0.1.1 10.0.3.3 966 28 80000003 1
Sum-Net 10.0.23.0 10.0.3.3 307 28 80000003 1

The Type 3 LSA 172.16.3.0 cannot be found in the LSDB of OSPF area 0 on R3.

# Check the OSPF route 172.6.3.1/24 on R1.


<R1>display ospf routing 172.16.3.1 24

OSPF Process 1 with Router ID 10.0.1.1

The OSPF route 172.6.3.1/24 does not exist.

Advertise the default route on R4 (IS-IS Level-1-2) and check whether the default route is
generated on R5 (IS-IS Level-1).

# Advertise a default route on R4.


[R4]isis 1
[R4-isis-1] default-route-advertise always level-1-2

# Check IS-IS routes on R5.


<R5>display isis route

Route information for ISIS(1)


-----------------------------
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 23


23

ISIS(1) Level-1 Forwarding Table


--------------------------------

IPV4 Destination IntCost ExtCost ExitInterface NextHop Flags


-------------------------------------------------------------------------------
0.0.0.0/0 10 NULL GE0/0/3 10.0.45.4 A/-/-/-
10.0.45.0/24 10 NULL GE0/0/3 Direct D/-/L/-
10.0.5.0/24 0 NULL Loop0 Direct D/-/L/-
Flags: D-Direct, A-Added to URT, L-Advertised in LSPs, S-IGP Shortcut,U-Up/Down Bit Set

R5 has learned the default route advertised by R4.

# Check the IS-IS LSDB on R5.


<R5>display isis lsdb verbose

Database information for ISIS(1)


--------------------------------

Level-1 Link State Database

LSPID Seq Num Checksum Holdtime Length ATT/P/OL


-------------------------------------------------------------------------------
0000.0000.0004.00-00 0x0000000f 0xc0d4 723 70 0/0/0
SOURCE 0000.0000.0004.00
NLPID IPV4
AREA ADDR 49.0001
INTF ADDR 10.0.45.4
NBR ID 0000.0000.0005.01 COST: 10
IP-Internal 10.0.45.0 255.255.255.0 COST: 10

0000.0000.0004.00-01 0x00000001 0x9df 974 41 0/0/0


SOURCE 0000.0000.0004.00
IP-Internal 0.0.0.0 0.0.0.0 COST: 0

0000.0000.0005.00-00* 0x00000012 0x9d40 472 86 0/0/0


SOURCE 0000.0000.0005.00
NLPID IPV4
AREA ADDR 49.0001
INTF ADDR 10.0.5.5
INTF ADDR 10.0.45.5
NBR ID 0000.0000.0005.01 COST: 10
IP-Internal 10.0.5.0 255.255.255.0 COST: 0
IP-Internal 10.0.45.0 255.255.255.0 COST: 10

0000.0000.0005.01-00* 0x0000000e 0xf77e 472 55 0/0/0


SOURCE 0000.0000.0005.01
NLPID IPV4
NBR ID 0000.0000.0005.00 COST: 0
NBR ID 0000.0000.0004.00 COST: 0

Total LSP(s): 4
*(In TLV)-Leaking Route, *(By LSPID)-Self LSP, +-Self LSP(Extended),
ATT-Attached, P-Partition, OL-Overload

The LSP 0000.0000.0004.00-01 from R4 carries the default route.


1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 24


23

1.1.3 Quiz
Why can the filter ip-prefix ip-prefix-name export command be used on an ABR to filter
OSPF inter-area routes but cannot be used on a router in an OSPF area to filter OSPF
intra-area routes?

1.1.4 Configuration Reference


Configuration on R1
#
sysname R1
#
bfd
#
interface GigabitEthernet0/0/1
ip address 10.0.13.1 255.255.255.0
ospf bfd enable
ospf bfd min-tx-interval 500 min-rx-interval 500 detect-multiplier 4
#
interface GigabitEthernet0/0/2
ip address 10.0.12.1 255.255.255.0
ospf bfd enable
ospf bfd min-tx-interval 500 min-rx-interval 500 detect-multiplier 4
#
interface LoopBack1
ip address 10.0.1.1 255.255.255.0
#
interface LoopBack2
ip address 172.16.2.1 255.255.255.0
#
ospf 1 router-id 10.0.1.1
bfd all-interfaces enable
frr
loop-free-alternate
area 0.0.0.0
network 10.0.13.1 0.0.0.0
network 10.0.12.1 0.0.0.0
network 10.0.1.1 0.0.0.0
network 172.16.2.1 0.0.0.0
#
return

Configuration on R2
#
sysname R2
#
bfd
#
interface GigabitEthernet0/0/2
ip address 10.0.23.2 255.255.255.0
ospf bfd enable
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 25


23

ospf bfd min-tx-interval 500 min-rx-interval 500 detect-multiplier 4


#
interface GigabitEthernet0/0/3
ip address 10.0.12.2 255.255.255.0
ospf bfd enable
ospf bfd min-tx-interval 500 min-rx-interval 500 detect-multiplier 4
#
interface LoopBack0
ip address 10.0.2.2 255.255.255.0
#
interface LoopBack2
ip address 172.16.2.1 255.255.255.0
#
ospf 1 router-id 10.0.2.2
bfd all-interfaces enable
area 0.0.0.0
network 10.0.12.2 0.0.0.0
network 10.0.23.2 0.0.0.0
network 10.0.2.2 0.0.0.0
network 172.16.2.1 0.0.0.0
#
return

Configuration on R3
#
sysname R3
#
bfd
#
interface GigabitEthernet0/0/1
ip address 10.0.13.3 255.255.255.0
ospf bfd enable
ospf bfd min-tx-interval 500 min-rx-interval 500 detect-multiplier 4
#
interface GigabitEthernet0/0/2
ip address 10.0.34.3 255.255.255.0
ospf bfd enable
ospf bfd min-tx-interval 500 min-rx-interval 500 detect-multiplier 4
#
interface GigabitEthernet0/0/3
ip address 10.0.23.3 255.255.255.0
ospf bfd enable
ospf bfd min-tx-interval 500 min-rx-interval 500 detect-multiplier 4
#
interface LoopBack0
ip address 10.0.3.3 255.255.255.0
#
ospf 1 router-id 10.0.3.3
bfd all-interfaces enable
maximum load-balancing 1
area 0.0.0.0
network 10.0.13.3 0.0.0.0
network 10.0.23.3 0.0.0.0
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 26


23

network 10.0.3.3 0.0.0.0


area 0.0.0.1
filter ip-prefix 1 export
network 10.0.34.3 0.0.0.0
#
ip ip-prefix 1 index 10 deny 172.16.3.0 24 greater-equal 24 less-equal 24
ip ip-prefix 1 index 20 permit 0.0.0.0 0 less-equal 32
#
return

Configuration on R4
#
sysname R4
#
bfd
#
isis 1
network-entity 49.0001.0000.0000.0004.00
default-route-advertise always level-1-2
#
interface GigabitEthernet0/0/2
ip address 10.0.45.4 255.255.255.0
isis enable 1
#
interface GigabitEthernet0/0/3
ip address 10.0.34.4 255.255.255.0
ospf bfd enable
ospf bfd min-tx-interval 500 min-rx-interval 500 detect-multiplier 4
#
interface LoopBack0
ip address 10.0.4.4 255.255.255.0
#
interface LoopBack3
ip address 172.16.3.1 255.255.255.0
ospf network-type broadcast
#
ospf 1 router-id 10.0.4.4
bfd all-interfaces enable
area 0.0.0.1
network 10.0.34.4 0.0.0.0
network 10.0.4.4 0.0.0.0
network 172.16.3.1 0.0.0.0
#
return

Configuration on R5
#
sysname R5
#
isis 1
is-level level-1
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 27


23

network-entity 49.0001.0000.0000.0005.00
#
interface GigabitEthernet0/0/3
ip address 10.0.45.5 255.255.255.0
isis enable 1
#
interface LoopBack0
ip address 10.0.5.5 255.255.255.0
isis enable 1
#
return
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 28


23

2 Advanced BGP Features

2.1 Advanced BGP Features


2.1.1 Introduction
2.1.1.1 Objectives
Upon completion of this task, you will be able to:

● Establish BGP peer relationships based on peer groups.


● Configure BGP routing policies.
● Configure BGP security features.
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 29


23

2.1.1.2 Networking Topology

Networking of advanced BGP

Error! Reference source not found. shows IP addresses of interconnection interfaces,


BGP autonomous system (AS) numbers, and BGP peer relationships. R2 and R4 are level-
2 route reflectors (RRs), and R1 and R5 are clients of level-2 RRs. R3 is a level-1 RR and
receives routes from level-2 RRs. Loopback interfaces on S1, S2, and S5 are used to
simulate users.

2.1.1.3 Lab Background


An enterprise has two branches and one headquarters. The enterprise has the following
services:

OA: IP addresses of Loopback0 interfaces on S1, S2, and S5 are on the OA service
network segment. OA data can be transmitted between branches and between branches
and the headquarters. The routes related to OA services must be marked as originating
ASs.
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 30


23

Finance: IP addresses of Loopback1 interfaces of S1, S2, and S5 belong to the financial
service network segment. Confidential financial data can be transmitted only between
branches and the headquarters.

The network administrator needs to build a secure network that meets these
requirements.

2.1.2 Lab Configuration


2.1.2.1 Configuration Roadmap
1. Configure IP addresses for devices.

2. Configure OSPF in the backbone area to build the underlying network.

3. Deploy Generalized TTL Security Mechanism (GTSM) and BGP authentication


between branches and the backbone network to ensure BGP network security.

4. Configure R1, R3, and R5 to establish Internal BGP (IBGP) peer relationships with R2
and R4, and configure R1, R3, and R5 as RR clients of R2 and R4.

5. Configure R3 as a level-1 RR, establish IBGP peer relationships with R2 and R4, and
configure R2 and R4 as RR clients of R3.

6. Configure R1, R2, and R3 to add the community attribute to the routes of Loopback0
interfaces to mark the originating AS of the OA service.

7. Configure a routing policy on R1, R3, and R5 and use the AS-Path Filter tool to filter
routes of Loopback1 interfaces.

2.1.2.2 Configuration Procedure

# Name the devices.

The configuration details are not provided.

# Disable the interfaces that are not used in this experiment.

The configuration details are not provided.

# Configure IP addresses for GE0/0/2, GE0/0/3, and Loopback0 on R1.


[R1]interface LoopBack0
[R1-LoopBack0] ip address 10.10.10.1 255.255.255.255
[R1-LoopBack0] quit
[R1]interface GigabitEthernet0/0/2
[R1-GigabitEthernet0/0/2] ip address 10.0.12.1 255.255.255.0
[R1-GigabitEthernet0/0/2] quit
[R1]interface GigabitEthernet0/0/3
[R1-GigabitEthernet0/0/3] ip address 10.0.11.2 255.255.255.0
[R1-GigabitEthernet0/0/3] quit

# Configure IP addresses for GE0/0/2, GE0/0/3, and Loopback0 on R2.


1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 31


23

[R2]interface LoopBack0
[R2-LoopBack0] ip address 10.10.10.2 255.255.255.255
[R2-LoopBack0] quit
[R2]interface GigabitEthernet0/0/2
[R2-GigabitEthernet0/0/2] ip address 10.0.23.2 255.255.255.0
[R2-GigabitEthernet0/0/2] quit
[R2]interface GigabitEthernet0/0/3
[R2-GigabitEthernet0/0/3] ip address 10.0.12.2 255.255.255.0
[R2-GigabitEthernet0/0/3] quit

# Configure IP addresses for GE0/0/1, GE0/0/2, GE0/0/3, and Loopback0 on R3.


[R3]interface LoopBack0
[R3-LoopBack0] ip address 10.10.10.3 255.255.255.255
[R3-LoopBack0] quit
[R3]interface GigabitEthernet0/0/1
[R3-GigabitEthernet0/0/1] ip address 10.0.35.3 255.255.255.0
[R3-GigabitEthernet0/0/1] quit
[R3]interface GigabitEthernet0/0/2
[R3-GigabitEthernet0/0/2] ip address 10.0.34.3 255.255.255.0
[R3-GigabitEthernet0/0/2] quit
[R3]interface GigabitEthernet0/0/3
[R3-GigabitEthernet0/0/3] ip address 10.0.23.3 255.255.255.0
[R3-GigabitEthernet0/0/3] quit

# Configure IP addresses for GE0/0/2, GE0/0/3, GE0/0/5, and Loopback0 on R4.


[R4]interface LoopBack0
[R4-LoopBack0] ip address 10.10.10.4 255.255.255.255
[R4-LoopBack0] quit
[R4]interface GigabitEthernet0/0/2
[R4-GigabitEthernet0/0/2] ip address 10.0.45.4 255.255.255.0
[R4-GigabitEthernet0/0/2] quit
[R4]interface GigabitEthernet0/0/3
[R4-GigabitEthernet0/0/3] ip address 10.0.34.4 255.255.255.0
[R4-GigabitEthernet0/0/3] quit

# Configure IP addresses for GE0/0/3, GE0/0/4, and Loopback0 on R5.


[R5]interface LoopBack0
[R5-LoopBack0] ip address 10.10.10.5 255.255.255.255
[R5-LoopBack0] quit
[R5]interface GigabitEthernet0/0/3
[R5-GigabitEthernet0/0/3] ip address 10.0.45.5 255.255.255.0
[R5-GigabitEthernet0/0/3] quit
[R5]interface GigabitEthernet0/0/4
[R5-GigabitEthernet0/0/4] ip address 10.0.25.5 255.255.255.0
[R5-GigabitEthernet0/0/4] quit

# Configure the VLAN to which GE0/0/1 of S1 belongs and IP addresses for VLANIF 1,
Loopback0, and Loopback1.
[S1]interface LoopBack0
[S1-LoopBack0] ip address 10.0.1.1 255.255.255.255
[S1-LoopBack0] quit
[S1]interface LoopBack1
[S1-LoopBack1] ip address 10.1.1.1 255.255.255.255
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 32


23

[S1-LoopBack1] quit
[S1]interface GigabitEthernet0/0/1
[S1-GigabitEthernet0/0/1] port link-type access
[S1-GigabitEthernet0/0/1] port default vlan 1
[S1-GigabitEthernet0/0/1] quit
[S1]interface Vlanif 1
[S1-Vlanif1] ip address 10.0.11.1 24
[S1-Vlanif1] quit

# Configure the VLAN to which GE0/0/5 of S2 belongs and IP addresses for VLANIF 1,
Loopback0, and Loopback1.
[S2]interface LoopBack0
[S2-LoopBack0] ip address 10.0.2.1 255.255.255.255
[S2-LoopBack0] quit
[S2]interface LoopBack1
[S2-LoopBack1] ip address 10.1.2.1 255.255.255.255
[S2-LoopBack1] quit
[S2]interface GigabitEthernet0/0/5
[S2-GigabitEthernet0/0/5] port link-type access
[S2-GigabitEthernet0/0/5] port default vlan 1
[S2-GigabitEthernet0/0/5] quit
[S2]interface Vlanif 1
[S2-Vlanif1] ip address 10.0.25.2 24
[S2-Vlanif1] quit

# Configure the VLAN to which GE0/0/3 of S5 belongs and IP addresses for VLANIF 1,
Loopback0, and Loopback1.
[S5]interface LoopBack0
[S5-LoopBack0] ip address 10.0.3.1 255.255.255.255
[S5-LoopBack0] quit
[S5]interface LoopBack1
[S5-LoopBack1] ip address 10.1.3.1 255.255.255.255
[S5-LoopBack1] quit
[S5]interface GigabitEthernet0/0/3
[S5-GigabitEthernet0/0/3] port link-type access
[S5-GigabitEthernet0/0/3] port default vlan 1
[S5-GigabitEthernet0/0/3] quit
[S5]interface Vlanif 1
[S5-Vlanif1] ip address 10.0.35.5 24
[S5-Vlanif1] quit

# Check the connectivity of IP addresses of interconnection interfaces on R1, R3, and R5.
<R1>ping -c 1 10.0.11.1
PING 10.0.11.1: 56 data bytes, press CTRL_C to break
Reply from 10.0.11.1: bytes=56 Sequence=1 ttl=255 time=90 ms

--- 10.0.11.1ping statistics ---


1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 90/90/90 ms

<R1>ping -c 1 10.0.12.2
PING 10.0.12.2: 56 data bytes, press CTRL_C to break
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 33


23

Reply from 10.0.12.2: bytes=56 Sequence=1 ttl=255 time=140 ms

--- 10.0.12.2 ping statistics ---


1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 140/140/140 ms

<R3>ping -c 1 10.0.23.2
PING 10.0.23.2: 56 data bytes, press CTRL_C to break
Reply from 10.0.23.2: bytes=56 Sequence=1 ttl=255 time=70 ms

--- 10.0.23.2ping statistics ---


1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 70/70/70 ms

<R3>ping -c 1 10.0.34.4
PING 10.0.34.4: 56 data bytes, press CTRL_C to break
Reply from 10.0.34.4: bytes=56 Sequence=1 ttl=255 time=60 ms

--- 10.0.34.4ping statistics ---


1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 60/60/60 ms

<R3>ping -c 1 10.0.35.5
PING 10.0.35.5: 56 data bytes, press CTRL_C to break
Reply from 10.0.35.5: bytes=56 Sequence=1 ttl=255 time=50 ms

--- 10.0.35.5 ping statistics ---


1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 50/50/50 ms

<R5>ping -c 1 10.0.45.4
PING 10.0.45.4: 56 data bytes, press CTRL_C to break
Reply from 10.0.45.4: bytes=56 Sequence=1 ttl=255 time=60 ms

--- 10.0.45.4 ping statistics ---


1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 60/60/60 ms

<R5>ping -c 1 10.0.25.2
PING 10.0.25.2: 56 data bytes, press CTRL_C to break
Reply from 10.0.25.2: bytes=56 Sequence=1 ttl=255 time=50 ms

--- 10.0.25.2 ping statistics ---


1 packet(s) transmitted
1 packet(s) received
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 34


23

0.00% packet loss


round-trip min/avg/max = 50/50/50 ms

Configure an OSPF process on each router according to the topology design. Set the
process ID to 1, area ID to 0, and router ID to the loopback interface's IP address of the
router. R1 with the router ID of 10.10.10.1 is used as an example.

Configure routes of OSPF interfaces in AS 65100 to be accurately advertised.

# Configure R1.
[R1]router id 10.10.10.1
[R1]ospf 1
[R1-ospf-1] area 0
[R1-ospf-1-area-0.0.0.0] network 10.10.10.1 0.0.0.0
[R1-ospf-1-area-0.0.0.0] network 10. 0.12.1 0.0.0.0

# Configure R2.
[R2]router id 10.10.10.2
[R2]ospf 1
[R2-ospf-1] area 0
[R2-ospf-1-area-0.0.0.0] network 10.10.10.2 0.0.0.0
[R2-ospf-1-area-0.0.0.0] network 10.0.12.2 0.0.0.0
[R2-ospf-1-area-0.0.0.0] network 10.0.23.2 0.0.0.0

# Configure R3.
[R3]router id 10.10.10.3
[R3]ospf 1
[R3-ospf-1] area 0
[R3-ospf-1-area-0.0.0.0] network 10.10.10.3 0.0.0.0
[R3-ospf-1-area-0.0.0.0] network 10.0.23.3 0.0.0.0
[R3-ospf-1-area-0.0.0.0] network 10.0.34.3 0.0.0.0
[R3-ospf-1-area-0.0.0.0] network 10.0.35.3 0.0.0.0

# Configure R4.
[R4]router id 10.10.10.4
[R4]ospf 1
[R4-ospf-1] area 0
[R4-ospf-1-area-0.0.0.0] network 10.10.10.4 0.0.0.0
[R4-ospf-1-area-0.0.0.0] network 10.0.34.4 0.0.0.0
[R4-ospf-1-area-0.0.0.0] network 10.0.45.4 0.0.0.0

# Configure R5.
[R5]router id 10.10.10.5
[R5]ospf 1
[R5-ospf-1] area 0
[R5-ospf-1-area-0.0.0.0] network 10.10.10.5 0.0.0.0
[R5-ospf-1-area-0.0.0.0] network 10.0.45.5 0.0.0.0

Check the OSPF configuration.

# Check OSPF neighbor relationship information on R2 and R4.


1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 35


23

[R2]display ospf peer brief

OSPF Process 1 with Router ID 10.10.10.2


Peer Statistic Information
-----------------------------------------------------------------------------------------------------
Area Id Interface Neighbor id State
0.0.0.0 GigabitEthernet0/0/3 10.10.10.1 Full
0.0.0.0 GigabitEthernet0/0/2 10.10.10.3 Full
-----------------------------------------------------------------------------------------------------

[R4]display ospf peer brief

OSPF Process 1 with Router ID 10.10.10.4


Peer Statistic Information
-----------------------------------------------------------------------------------------------------
Area Id Interface Neighbor id State
0.0.0.0 GigabitEthernet0/0/3 10.10.10.3 Full
0.0.0.0 GigabitEthernet0/0/2 10.10.10.5 Full
-----------------------------------------------------------------------------------------------------

# Check the OSPF routing table and IP routing table on R2.


[R2]display ospf routing

OSPF Process 1 with Router ID 10.10.10.2


Routing Tables

Routing for Network


Destination Cost Type NextHop AdvRouter Area
10.0.12.0/24 1 Transit 10.0.12.2 10.10.10.2 0.0.0.0
10.0.23.0/24 1 Transit 10.0.23.1 10.10.10.2 0.0.0.0
10.10.10.2/32 0 Stub 10.10.10.2 10.10.10.2 0.0.0.0
10.0.34.0/24 2 Transit 10.0.23.2 10.10.10.4 0.0.0.0
10.0.35.0/24 2 Stub 10.0.23.2 10.10.10.3 0.0.0.0
10.0.45.0/24 3 Transit 10.0.23.2 10.10.10.5 0.0.0.0
10.10.10.1/32 1 Stub 10.0.12.1 10.10.10.1 0.0.0.0
10.10.10.3/32 1 Stub 10.0.23.2 10.10.10.3 0.0.0.0
10.10.10.4/32 2 Stub 10.0.23.2 10.10.10.4 0.0.0.0
10.10.10.5/32 3 Stub 10.0.23.2 10.10.10.5 0.0.0.0

Total Nets: 10
Intra Area: 10 Inter Area: 0 ASE: 0 NSSA: 0

[R2]display ip routing-table
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: Public
Destinations : 18 Routes : 18

Destination/Mask Proto Pre Cost Flags NextHop Interface

10.0.12.0/24 Direct 0 0 D 10.0.12.2 GigabitEthernet0/0/3


10.0.12.2/32 Direct 0 0 D 127.0.0.1 GigabitEthernet0/0/3
10.0.12.255/32 Direct 0 0 D 127.0.0.1 GigabitEthernet0/0/3
10.0.23.0/24 Direct 0 0 D 10.0.23.1 GigabitEthernet0/0/2
10.0.23.2/32 Direct 0 0 D 127.0.0.1 GigabitEthernet0/0/2
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 36


23

10.0.23.255/32 Direct 0 0 D 127.0.0.1 GigabitEthernet0/0/2


10.0.34.0/24 OSPF 10 2 D 10.0.23.2 GigabitEthernet0/0/2
10.0.35.0/24 OSPF 10 2 D 10.0.23.2 GigabitEthernet0/0/2
10.0.45.0/24 OSPF 10 3 D 10.0.23.2 GigabitEthernet0/0/2
10.10.10.1/32 OSPF 10 1 D 10.0.12.1 GigabitEthernet0/0/3
10.10.10.2/32 Direct 0 0 D 127.0.0.1 LoopBack0
10.10.10.3/32 OSPF 10 1 D 10.0.23.2 GigabitEthernet0/0/2
10.10.10.4/32 OSPF 10 2 D 10.0.23.2 GigabitEthernet0/0/2
10.10.10.5/32 OSPF 10 3 D 10.0.23.2 GigabitEthernet0/0/2
127.0.0.0/8 Direct 0 0 D 127.0.0.1 InLoopBack0
127.0.0.1/32 Direct 0 0 D 127.0.0.1 InLoopBack0
127.255.255.255/32 Direct 0 0 D 127.0.0.1 InLoopBack0
255.255.255.255/32 Direct 0 0 D 127.0.0.1 InLoopBack0

The preceding command output shows that the OSPF process of R2 has learned all routes
in AS 65100 and the routes are preferentially selected in the IP routing table.

Establish EBGP peer relationships between S1 and R1, between S5 and R3, and between
S2 and R5. Configure BGP authentication, set the authentication password to
Huawei@123, and set the TTL in GTSM to 255.

In this experiment, S1 belongs to AS 65001, S2 belongs to AS 65002, S5 belongs to AS


65003, R1, R3, and R5 belongs to AS 65100.

# Configure EBGP peers on S1 and R1, and configure BGP authentication and GTSM.
GTSM only needs to be configured on the backbone network side.
[R1]bgp 65100
[R1-bgp] peer 10.0.11.1 as-number 65001
[R1-bgp] peer 10.0.11.1 password cipher Huawei@123
[R1-bgp] peer 10.0.11.1 valid-ttl-hops 255

[S1]bgp 65001
[S1-bgp] peer 10.0.11.2 as-number 65100
[S1-bgp] peer 10.0.11.2 password cipher Huawei@123

# Configure EBGP peers on S5 and R3, and configure BGP authentication and GTSM.
GTSM only needs to be configured on the backbone network side.
[R3]bgp 65100
[R3-bgp] peer 10.0.35.5 as-number 65003
[R3-bgp] peer 10.0.35.5 password cipher Huawei@123
[R3-bgp] peer 10.0.35.5 valid-ttl-hops 255

[S5]bgp 65003
[S5-bgp] peer 10.0.35.3 as-number 65100
[S5-bgp] peer 10.0.35.3 password cipher Huawei@123

# Configure EBGP peers on S2 and R5, and configure BGP authentication and GTSM.
GTSM only needs to be configured on the backbone network side.
[R5]bgp 65100
[R5-bgp] peer 10.0.25.2 as-number 65002
[R5-bgp] peer 10.0.25.2 password cipher Huawei@123
[R5-bgp] peer 10.0.25.2 valid-ttl-hops 255
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 37


23

[S2]bgp 65002
[S2-bgp] peer 10.0.25.5 as-number 65100
[S2-bgp] peer 10.0.25.5 password cipher Huawei@123

Check the EBGP configuration.

# Check the BGP peer relationship status on R1, R3, and R5.
[R1]display bgp peer

BGP local router ID : 10.10.10.1


Local AS number : 65100
Total number of peers : 1 Peers in established state : 1

Peer V AS MsgRcvd MsgSent OutQ Up/Down State PrefRcv

10.0.11.1 4 65001 12 15 0 00:10:16 Established 0

[R3]display bgp peer

BGP local router ID : 10.10.10.3


Local AS number : 65100
Total number of peers : 1 Peers in established state : 1

Peer V AS MsgRcvd MsgSent OutQ Up/Down State PrefRcv

10.0.35.5 4 65003 14 12 0 00:10:48 Established 0

[R5]display bgp peer

BGP local router ID : 10.10.10.5


Local AS number : 65100
Total number of peers : 1 Peers in established state : 1

Peer V AS MsgRcvd MsgSent OutQ Up/Down State PrefRcv

10.0.25.2 4 65002 13 13 0 00:11:34 Established 0

The neighbor relationships between R1, R3, and R5 and their peers are in Established
state.

R2 and R4 are level-2 RRs, and R1, R3, and R5 are clients of R2 and R4. To prevent route
transmission between RRs in the same cluster, you need to change the cluster ID to
24.24.24.24.

R3 is a level-1 RR, and R2 and R4 are clients of R3.

Deploy IBGP peers based on the topology and establish IBGP peer relationships based on
loopback interface addresses. Because there are a large number of IBGP peers, configure
a peer group.

# Configure R1.
[R1]bgp 65100
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 38


23

[R1-bgp] group IBGP internal


[R1-bgp] peer IBGP connect-interface LoopBack0
[R1-bgp] peer IBGP next-hop-local
[R1-bgp] peer 10.10.10.2 group IBGP
[R1-bgp] peer 10.10.10.4 group IBGP

# Configure R2.
[R2]bgp 65100
[R2-bgp] group IBGP internal
[R2-bgp] peer IBGP connect-interface LoopBack0
[R2-bgp] peer 10.10.10.1 group IBGP
[R2-bgp] peer 10.10.10.3 group IBGP
[R2-bgp] peer 10.10.10.4 group IBGP
[R2-bgp] peer 10.10.10.5 group IBGP

# Configure R3.
[R3]bgp 65100
[R3-bgp] group IBGP internal
[R3-bgp] peer IBGP connect-interface LoopBack0
[R3-bgp] peer IBGP next-hop-local
[R3-bgp] peer 10.10.10.2 group IBGP
[R3-bgp] peer 10.10.10.4 group IBGP

# Configure R4.
[R4]bgp 65100
[R4-bgp] roup IBGP internal
[R4-bgp] peer IBGP connect-interface LoopBack0
[R4-bgp] peer 10.10.10.1 group IBGP
[R4-bgp] peer 10.10.10.2 group IBGP
[R4-bgp] peer 10.10.10.3 group IBGP
[R4-bgp] peer 10.10.10.5 group IBGP

# Configure R5.
[R5]bgp 65100
[R5-bgp] group IBGP internal
[R5-bgp] peer IBGP connect-interface LoopBack0
[R5-bgp] peer IBGP next-hop-local
[R5-bgp] peer 10.10.10.2 group IBGP
[R5-bgp] peer 10.10.10.4 group IBGP

Check the IBGP configuration.

# Check the BGP peer relationship status on R2 and R4.


[R2]display bgp peer

BGP local router ID : 10.10.10.2


Local AS number : 65100
Total number of peers : 4 Peers in established state : 4

Peer V AS MsgRcvd MsgSent OutQ Up/Down State PrefRcv

10.10.10.1 4 65100 25 25 0 00:23:16 Established 0


10.10.10.3 4 65100 23 24 0 00:21:52 Established 0
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 39


23

10.10.10.4 4 65100 18 19 0 00:16:58 Established 0


10.10.10.5 4 65100 16 17 0 00:14:50 Established 0

[R4]display bgp peer

BGP local router ID : 10.10.10.4


Local AS number : 65100
Total number of peers : 4 Peers in established state : 4

Peer V AS MsgRcvd MsgSent OutQ Up/Down State PrefRcv

10.10.10.1 4 65100 20 20 0 00:18:33 Established 0


10.10.10.2 4 65100 20 20 0 00:18:25 Established 0
10.10.10.3 4 65100 20 20 0 00:18:16 Established 0
10.10.10.5 4 65100 18 19 0 00:16:06 Established 0

Based on peer tables of R2 and R4, you can find that IBGP peer relationships have been
established between routers in AS 65100.

Deploy hierarchical RRs.

R2 and R4 are level-2 RRs, and R1, R3, and R5 are clients of R2 and R4. The same cluster
ID is configured for R2 and R4.

R3 is a level-1 RR, and R2 and R4 are clients of R3.

# Configure R2.
[R2]bgp 65100
[R2-bgp] peer IBGP reflect-client
[R2-bgp] reflector cluster-id 24.24.24.24

# Configure R4.
[R4]bgp 65100
[R4-bgp] peer IBGP reflect-client
[R4-bgp] reflector cluster-id 24.24.24.24

# Configure R3.
[R3]bgp 65100
[R3-bgp] peer IBGP reflect-client

Check the RR configuration.

# Check the RR configuration on R2, R3, and R4.


[R2]display bgp group IBGP

BGP peer-group: IBGP


Remote AS: 65100
Authentication type configured: None
Type : internal
Configured hold timer value: 180
Keepalive timer value: 60
Connect-retry timer value: 32
Minimum route advertisement interval is 15 seconds
Connect-interface has been configured
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 40


23

PeerSession Members:
10.10.10.1 10.10.10.3 10.10.10.4 10.10.10.5

It's route-reflector-client
Peer Preferred Value: 0
No routing policy is configured
Peer Members:
Peer V AS MsgRcvd MsgSent OutQ Up/Down State PrefRcv

10.10.10.1 4 65100 46 47 0 00:44:30 Established 0


10.10.10.3 4 65100 45 47 0 00:43:06 Established 0
10.10.10.4 4 65100 41 42 0 00:38:12 Established 0
10.10.10.5 4 65100 38 40 0 00:36:04 Established 0

[R4]display bgp group IBGP

BGP peer-group: IBGP


Remote AS: 65100
Authentication type configured: None
Type : internal
Configured hold timer value: 180
Keepalive timer value: 60
Connect-retry timer value: 32
Minimum route advertisement interval is 15 seconds
Connect-interface has been configured
PeerSession Members:
10.10.10.1 10.10.10.2 10.10.10.3 10.10.10.5

It's route-reflector-client
Peer Preferred Value: 0
No routing policy is configured
Peer Members:
Peer V AS MsgRcvd MsgSent OutQ Up/Down State PrefRcv

10.10.10.1 4 65100 50 51 0 00:48:18 Established 0


10.10.10.2 4 65100 51 51 0 00:48:10 Established 0
10.10.10.3 4 65100 50 51 0 00:48:01 Established 0
10.10.10.5 4 65100 47 49 0 00:45:51 Established 0

[R3]display bgp group IBGP

BGP peer-group: IBGP


Remote AS: 65100
Authentication type configured: None
Type : internal
Configured hold timer value: 180
Keepalive timer value: 60
Connect-retry timer value: 32
Minimum route advertisement interval is 15 seconds
Connect-interface has been configured
PeerSession Members:
10.10.10.2 10.10.10.4
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 41


23

Nexthop self has been configured


It's route-reflector-client
Peer Preferred Value: 0
No routing policy is configured
Peer Members:
Peer V AS MsgRcvd MsgSent OutQ Up/Down State PrefRcv

10.10.10.2 4 65100 57 56 0 00:54:36 Established 0


10.10.10.4 4 65100 52 52 0 00:49:34 Established 0

Clients of the RR are correctly configured.

The routes of Loopback0, Loopback1, and Loopback2 on S1, S2, and S5 need to be
advertised to BGP. After the routes are advertised, the backbone network controls route
advertisement through routing policies.

BGP routes can be advertised using the import-route or network command. In this
experiment, there are only a few network segments. Therefore, you can use the network
command.

# Configure S1.
[R1]bgp 65001
[R1-bgp] network 10.0.1.1 32
[R1-bgp] network 10.1.1.1 32

# Configure S2.
[R2]bgp 65002
[R2-bgp] network 10.0.2.1 32
[R2-bgp] network 10.1.2.1 32

# Configure S5.
[R5]bgp 65003
[R5-bgp] network 10.0.3.1 32
[R5-bgp] network 10.1.3.1 32

Check route advertisement results.

# Check route advertisement results on S1, S2, and S5. S1 is used as an example. The
configurations of S2 and S5 are similar.
[S1]display bgp routing-table

BGP Local router ID is 10.1.11.1


Status codes: * - valid, > - best, d - damped,
h - history, i - internal, s - suppressed, S - Stale
Origin : i - IGP, e - EGP, ? - incomplete

Total Number of Routes: 9


Network NextHop MED LocPrf PrefVal Path/Ogn

*> 10.0.1.1/32 0.0.0.0 0 0 i


*> 10.0.2.1/32 10.0.11.2 0 65100 65002i
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 42


23

*> 10.0.3.1/32 10.0.11.2 0 65100 65003i


*> 10.1.1.1/32 0.0.0.0 0 0 i
*> 10.1.2.1/32 10.0.11.2 0 65100 65002i
*> 10.1.3.1/32 10.0.11.2 0 65100 65003i

The command output shows that S1, S2, and S5 have learned routes from each other.

The community attribute can be used to label a route so that the network administrator
can know the AS from which the route comes.

In this experiment, you only need to add attributes to the routes of Loopback0 interfaces
on S1, S2, and S5.

By default, the community attribute is not sent to peers. You need to manually configure
devices to advertise the community attribute.

Generally, the community attribute is in the format of AS:NN. In this experiment, the
community attribute is defined as AS:01.

# Configure R1, R2, R3, R4, and R5 to advertise the community attribute to their peers.
[R1]bgp 65100
[R1-bgp] peer IBGP advertise-community
[R1-bgp] peer 10.0.11.1 advertise-community

[R2]bgp 65100
[R2-bgp] peer IBGP advertise-community

[R3]bgp 65100
[R3-bgp] peer IBGP advertise-community
[R3-bgp] peer 10.0.35.5 advertise-community

[R4]bgp 65100
[R4-bgp] peer IBGP advertise-community

[R5]bgp 65100
[R5-bgp] peer IBGP advertise-community
[R5-bgp] peer 10.0.25.2 advertise-community

# Configure S1, S2, and S5 to advertise the community attribute to their peers.
[S1]bgp 65001
[S1-bgp] peer 10.0.11.2 advertise-community

[S2]bgp 65001
[S2-bgp] peer 10.0.25.5 advertise-community

[S5]bgp 65001
[S5-bgp] peer 10.0.35.3 advertise-community

Configure routing policies on S1, S2, and S5 to add the community attribute to routes of
Loopback0 interfaces.

# Configure S1.
[S1]ip ip-prefix Com index 10 permit 10.0.1.1 32
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 43


23

[S1]route-policy Attr permit node 10


[S1-route-policy] if-match ip-prefix Com
[S1-route-policy] apply community 65001:1
[S1-route-policy] quit
[S1]route-policy Attr permit node 100
[S1-route-policy] quit
[S1]bgp 65001
[S1-bgp] peer 10.0.11.2 route-policy Attr export

# Configure S2.
[S2]ip ip-prefix Com index 10 permit 10.0.2.1 32
[S2]route-policy Attr permit node 10
[S2-route-policy] if-match ip-prefix Com
[S2-route-policy] apply community 65002:2
[S2-route-policy] quit
[S2]route-policy Attr permit node 100
[S2-route-policy quit
[S2]bgp 65002
[S2-bgp] peer 10.0.25.5 route-policy Attr export

# Configure S5.
[S5]ip ip-prefix Com index 10 permit 10.0.3.1 32
[S5]route-policy Attr permit node 10
[S5-route-policy] if-match ip-prefix Com
[S5-route-policy] apply community 65003:1
[S5-route-policy] quit
[S5]route-policy Attr permit node 100
[S5-route-policy] quit
[S5]bgp 65003
[S5-bgp] peer 10.0.35.3 route-policy Attr export

Check the configuration.

# Check the configurations on S1, S2, and S5. S1 is used as an example. The
configurations of S2 and S5 are similar to that of S1.
[S1]display bgp routing-table 10.0.3.1

BGP local router ID : 10.0.11.1


Local AS number : 65001
Paths: 1 available, 1 best, 1 select
BGP routing table entry information of 10.0.3.1/32:
From: 10.0.11.2 (10.10.10.1)
Route Duration: 00h03m50s
Direct Out-interface: Vlanif1
Original nexthop: 10.0.11.2
Qos information : 0x0
Community:<65003:1>
AS-path 65100 65003, origin igp, pref-val 0, valid, external, best, select, active, pre 255
Not advertised to any peer yet
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 44


23

Traffic of confidential financial services can be forwarded only between S1 and S5 and
between S2 and S5. If no VPN is deployed, you can only control route sending and
receiving.

To simplify filtering configuration, you can use the AS_Path filter and routing policy to
filter routes on R1 and R2.

For route control, do not filter the routes of Loopback0 interfaces. You can use the
community attribute to allow routes of Loopback0 interfaces in advance and then filter
routes of Loopback1 interfaces.

# Configure R1.
[R1]ip community-filter basic OA permit 65002:1
[R1]ip as-path-filter Finance permit 65002$
[R1]route-policy Finance permit node 10
[R1-route-policy] if-match community-filter OA
[R1-route-policy] quit
[R1]route-policy Finance deny node 20
[R1-route-policy] if-match as-path-filter Finance
[R1-route-policy] quit
[R1]route-policy Finance permit node 100
[R1-route-policy] quit
[R1]bgp 65100
[R1-bgp] peer 10.0.11.1
[R1-bgp] route-policy Finance export

# Configure R5.
[R5]ip community-filter basic OA permit 65001:1
[R5]ip as-path-filter Finance permit 65001$
[R5]route-policy Finance permit node 10
[R5-route-policy] if-match community-filter OA
[R5-route-policy] quit
[R5]route-policy Finance deny node 20
[R5-route-policy] if-match as-path-filter Finance
[R5-route-policy] quit
[R5]route-policy Finance permit node 100
[R5-route-policy] quit
[R5]bgp 65100
[R5-bgp] peer 10.0.25.2
[R5-bgp] route-policy Finance export

Check the configuration.

# Check the configurations on S1, S2, and S5.


<S1>display bgp routing-table

BGP Local router ID is 10.0.11.1


Status codes: * - valid, > - best, d - damped,
h - history, i - internal, s - suppressed, S - Stale
Origin : i - IGP, e - EGP, ? - incomplete

Total Number of Routes: 7


Network NextHop MED LocPrf PrefVal Path/Ogn
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 45


23

*> 10.0.1.1/32 0.0.0.0 0 0 i


*> 10.0.2.1/32 10.0.11.2 0 65100 65002i
*> 10.0.3.1/32 10.0.11.2 0 65100 65003i
*> 10.1.1.1/32 0.0.0.0 0 0 i
*> 10.1.3.1/32 10.0.11.2 0 65100 65003i

<S2>display bgp routing-table

BGP Local router ID is 10.0.25.2


Status codes: * - valid, > - best, d - damped,
h - history, i - internal, s - suppressed, S - Stale
Origin : i - IGP, e - EGP, ? - incomplete

Total Number of Routes: 7


Network NextHop MED LocPrf PrefVal Path/Ogn

*> 10.0.1.1/32 10.0.25.5 0 65100 65001i


*> 10.0.2.1/32 0.0.0.0 0 0 i
*> 10.0.3.1/32 10.0.25.5 0 65100 65003i
*> 10.1.2.1/32 0.0.0.0 0 0 i
*> 10.1.3.1/32 10.0.25.5 0 65100 65003i

<S5>display bgp routing-table

BGP Local router ID is 10.0.35.5


Status codes: * - valid, > - best, d - damped,
h - history, i - internal, s - suppressed, S - Stale
Origin : i - IGP, e - EGP, ? - incomplete

Total Number of Routes: 9


Network NextHop MED LocPrf PrefVal Path/Ogn

*> 10.0.1.1/32 10.0.35.3 0 65100 65001i


*> 10.0.2.1/32 10.0.35.3 0 65100 65002i
*> 10.0.3.1/32 0.0.0.0 0 0 i
*> 10.1.1.1/32 10.0.35.3 0 65100 65001i
*> 10.1.2.1/32 10.0.35.3 0 65100 65002i
*> 10.1.3.1/32 0.0.0.0 0 0 i

The command output shows that the route 10.1.2.1/32 of Loopback1 on S2 has been
filtered out in the BGP routing table of S1, the route 10.1.1.1/32 of Loopback1 on S1 has
been filtered out in the BGP routing table of S2, and the BGP routing table of S5 remains
unchanged.

2.1.3 Quiz
How can I prevent a BGP peer from receiving a large number of unnecessary routes?

2.1.4 Configuration Reference


Configuration on R1
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 46


23

#
sysname R1
#
router id 10.10.10.1
#
interface GigabitEthernet0/0/2
ip address 10.0.12.1 255.255.255.0
#
interface GigabitEthernet0/0/3
ip address 10.0.11.2 255.255.255.0
#
interface LoopBack0
ip address 10.10.10.1 255.255.255.255
#
bgp 65100
peer 10.0.11.1 as-number 65001
peer 10.0.11.1 password cipher Huawei@123
peer 10.0.11.1 valid-ttl-hops 255
group IBGP internal
peer IBGP connect-interface LoopBack0
peer 10.10.10.2 as-number 65100
peer 10.10.10.2 group IBGP
peer 10.10.10.4 as-number 65100
peer 10.10.10.4 group IBGP
#
ipv4-family unicast
undo synchronization
peer 10.0.11.1 enable
peer 10.0.11.1 route-policy Finance export
peer 10.0.11.1 advertise-community
peer IBGP enable
peer IBGP next-hop-local
peer IBGP advertise-community
peer 10.10.10.2 enable
peer 10.10.10.2 group IBGP
peer 10.10.10.4 enable
peer 10.10.10.4 group IBGP
#
ospf 1
area 0.0.0.0
network 10.0.12.1 0.0.0.0
network 10.10.10.1 0.0.0.0
#
route-policy Finance permit node 10
if-match community-filter OA
#
route-policy Finance deny node 20
if-match as-path-filter Finance
#
route-policy Finance permit node 100
#
ip as-path-filter Finance permit 65002$
#
ip community-filter basic OA permit 65002:1
#
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 47


23

return

Configuration on R2
#
sysname R2
#
router id 10.10.10.2
#
interface GigabitEthernet0/0/2
ip address 10.0.23.2 255.255.255.0
#
interface GigabitEthernet0/0/3
ip address 10.0.12.2 255.255.255.0
#
interface LoopBack0
ip address 10.10.10.2 255.255.255.255
#
bgp 65100
group IBGP internal
peer IBGP connect-interface LoopBack0
peer 10.10.10.1 as-number 65100
peer 10.10.10.1 group IBGP
peer 10.10.10.3 as-number 65100
peer 10.10.10.3 group IBGP
peer 10.10.10.4 as-number 65100
peer 10.10.10.4 group IBGP
peer 10.10.10.5 as-number 65100
peer 10.10.10.5 group IBGP
#
ipv4-family unicast
undo synchronization
reflector cluster-id 24.24.24.24
peer IBGP enable
peer IBGP reflect-client
peer IBGP advertise-community
peer 10.10.10.1 enable
peer 10.10.10.1 group IBGP
peer 10.10.10.3 enable
peer 10.10.10.3 group IBGP
peer 10.10.10.4 enable
peer 10.10.10.4 group IBGP
peer 10.10.10.5 enable
peer 10.10.10.5 group IBGP
#
ospf 1
area 0.0.0.0
network 10.0.12.2 0.0.0.0
network 10.0.23.2 0.0.0.0
network 10.10.10.2 0.0.0.0
#
return

Configuration on R3
#
sysname R3
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 48


23

#
router id 10.10.10.3
#
interface GigabitEthernet0/0/1
ip address 10.0.35.3 255.255.255.0
#
interface GigabitEthernet0/0/2
ip address 10.0.34.3 255.255.255.0
#
interface GigabitEthernet0/0/3
ip address 10.0.23.3 255.255.255.0
#
interface LoopBack0
ip address 10.10.10.3 255.255.255.255
#
bgp 65100
peer 10.0.35.5 as-number 65003
peer 10.0.35.5 password cipher Huawei@123
peer 10.0.35.5 valid-ttl-hops 255
group IBGP internal
peer IBGP connect-interface LoopBack0
peer 10.10.10.2 as-number 65100
peer 10.10.10.2 group IBGP
peer 10.10.10.4 as-number 65100
peer 10.10.10.4 group IBGP
#
ipv4-family unicast
undo synchronization
peer 10.0.35.5 enable
peer 10.0.35.5 advertise-community
peer IBGP enable
peer IBGP reflect-client
peer IBGP next-hop-local
peer IBGP advertise-community
peer 10.10.10.2 enable
peer 10.10.10.2 group IBGP
peer 10.10.10.4 enable
peer 10.10.10.4 group IBGP
#
ospf 1
area 0.0.0.0
network 10.0.23.3 0.0.0.0
network 10.0.34.3 0.0.0.0
network 10.0.35.3 0.0.0.0
network 10.10.10.3 0.0.0.0
#
return

Configuration on R4
#
sysname R4
#
router id 10.10.10.4
#
interface GigabitEthernet0/0/2
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 49


23

ip address 10.0.45.4 255.255.255.0


#
interface GigabitEthernet0/0/3
ip address 10.0.34.4 255.255.255.0
#
interface LoopBack0
ip address 10.10.10.4 255.255.255.255
#
bgp 65100
group IBGP internal
peer IBGP connect-interface LoopBack0
peer 10.10.10.1 as-number 65100
peer 10.10.10.1 group IBGP
peer 10.10.10.2 as-number 65100
peer 10.10.10.2 group IBGP
peer 10.10.10.3 as-number 65100
peer 10.10.10.3 group IBGP
peer 10.10.10.5 as-number 65100
peer 10.10.10.5 group IBGP
#
ipv4-family unicast
undo synchronization
reflector cluster-id 24.24.24.24
peer IBGP enable
peer IBGP reflect-client
peer IBGP advertise-community
peer 10.10.10.1 enable
peer 10.10.10.1 group IBGP
peer 10.10.10.2 enable
peer 10.10.10.2 group IBGP
peer 10.10.10.3 enable
peer 10.10.10.3 group IBGP
peer 10.10.10.5 enable
peer 10.10.10.5 group IBGP
#
ospf 1
area 0.0.0.0
network 10.0.34.4 0.0.0.0
network 10.0.45.4 0.0.0.0
network 10.10.10.4 0.0.0.0
#
return

Configuration on R5
#
sysname R5
#
router id 10.10.10.5
#
firewall zone Local
priority 15
#
interface GigabitEthernet0/0/3
ip address 10.0.45.5 255.255.255.0
#
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 50


23

interface GigabitEthernet0/0/4
ip address 10.0.25.5 255.255.255.0
#
interface LoopBack0
ip address 10.10.10.5 255.255.255.255
#
bgp 65100
peer 10.0.25.2 as-number 65002
peer 10.0.25.2 password cipher Huawei@123
peer 10.0.25.2 valid-ttl-hops 255
group IBGP internal
peer IBGP connect-interface LoopBack0
peer 10.10.10.2 as-number 65100
peer 10.10.10.2 group IBGP
peer 10.10.10.4 as-number 65100
peer 10.10.10.4 group IBGP
#
ipv4-family unicast
undo synchronization
peer 10.0.25.2 enable
peer 10.0.25.2 route-policy Finance export
peer 10.0.25.2 advertise-community
peer IBGP enable
peer IBGP next-hop-local
peer IBGP advertise-community
peer 10.10.10.2 enable
peer 10.10.10.2 group IBGP
peer 10.10.10.4 enable
peer 10.10.10.4 group IBGP
#
ospf 1
area 0.0.0.0
network 10.0.45.5 0.0.0.0
network 10.10.10.5 0.0.0.0
#
route-policy Finance permit node 10
if-match community-filter OA
#
route-policy Finance deny node 20
if-match as-path-filter Finance
#
route-policy Finance permit node 100
#
ip as-path-filter Finance permit 65001$
#
ip community-filter basic OA permit 65001:1
#
return

Configuration on S1
#
sysname S1
#
interface Vlanif1
ip address 10.0.11.1 255.255.255.0
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 51


23

#
interface GigabitEthernet0/0/1
port link-type access
#
interface LoopBack0
ip address 10.0.1.1 255.255.255.255
#
interface LoopBack1
ip address 10.1.1.1 255.255.255.255
#
bgp 65001
peer 10.0.11.2 as-number 65100
peer 10.0.11.2 password cipher Huawei@123
#
ipv4-family unicast
undo synchronization
network 10.0.1.1 255.255.255.255
network 10.1.1.1 255.255.255.255
peer 10.0.11.2 enable
peer 10.0.11.2 route-policy Attr export
peer 10.0.11.2 advertise-community
#
route-policy Attr permit node 10
if-match ip-prefix Com
apply community 65001:1
#
route-policy Attr permit node 100
#
ip ip-prefix Com index 10 permit 10.0.1.1 32
#
return

Configuration on S2
#
sysname S2
#
interface Vlanif1
ip address 10.0.25.2 255.255.255.0
#
interface GigabitEthernet0/0/5
port link-type access
interface LoopBack0
ip address 10.0.2.1 255.255.255.255
#
interface LoopBack1
ip address 10.1.2.1 255.255.255.255
#
bgp 65002
peer 10.0.25.5 as-number 65100
peer 10.0.25.5 password cipher Huawei@123
#
ipv4-family unicast
undo synchronization
network 10.0.2.1 255.255.255.255
network 10.1.2.1 255.255.255.255
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 52


23

peer 10.0.25.5 enable


peer 10.0.25.5 route-policy Attr export
peer 10.0.25.5 advertise-community
#
route-policy Attr permit node 10
if-match ip-prefix Com
apply community 65002:1
#
route-policy Attr permit node 100
#
ip ip-prefix Com index 10 permit 10.0.2.1 32
#
return

Configuration on S5
#
sysname S5
#
interface Vlanif1
ip address 10.0.35.5 255.255.255.0
#
interface GigabitEthernet0/0/1
port link-type access
#
interface LoopBack0
ip address 10.0.3.1 255.255.255.255
#
interface LoopBack1
ip address 10.1.3.1 255.255.255.255
#
bgp 65003
peer 10.0.35.3 as-number 65100
peer 10.0.35.3 password cipher Huawei@123
#
ipv4-family unicast
undo synchronization
network 10.0.3.1 255.255.255.255
network 10.1.3.1 255.255.255.255
network 10.2.3.1 255.255.255.255
peer 10.0.35.3 enable
peer 10.0.35.3 route-policy Attr export
peer 10.0.35.3 advertise-community
#
route-policy Attr permit node 10
if-match ip-prefix Com
apply community 65003:1
#
route-policy Attr permit node 100
#
ip ip-prefix Com index 10 permit 10.0.3.1 32
#
return
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 53


23

3 IPv6 Routing

3.1 IPv4/IPv6 Dual Stack Experiment


3.1.1 Introduction
3.1.1.1 Objectives
Upon completion of this task, you will be able to:

● Configure MP-BGP.
● Configure IS-IS dual-stack.
● Configure OSPF dual-stack.

3.1.1.2 Networking Topology

Networking of IPv4/IPv6 dual-stack


1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 54


23

Figure 3-1 shows IP addresses of interconnection interfaces and BGP AS numbers. R3 is


an RR, and R1, R2, R4, and R5 are clients of R3. In BGP AS 65100, OSPF and IS-IS are used
to build the underlying network.

3.1.1.3 Lab Background


The IPv4+IPv6 service needs to be deployed on an enterprise network so that devices on
IPv4 and IPv6 network segments between branch 1 and branch 2 can communicate with
each other.

The enterprise has a large-scale backbone network. The access layer of the backbone
network uses OSPF or Open Shortest Path First Version 3 (OSPFv3), and the core layer
uses IPv4 or IPv6 IS-IS.

Some pure IPv4 networks exist at the core layer of the backbone network, and IPv6
cannot be deployed.

3.1.2 Lab Configuration


3.1.2.1 Configuration Roadmap
1. Configure IPv4 or IPv6 addresses for devices.

2. Deploy OSPF or OSPFv3 at the access layer of the backbone network.

3. Deploy IPv4 or IPv6 IS-IS at the core layer of the backbone network.

4. Configure IPv4 IS-IS and OSPF to import routes from each other, and IPv6 IS-IS and
OSPFv3 to import routes from each other.

5. Configure R1, R2, R4, and R5 to establish External BGP (EBGP) peer relationships
with the RR, and configure R3 as the RR.

6. Configure S1 and S2 to establish EBGP peer relationships with R1 and R5 and


advertise IPv4 and IPv6 routes.
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 55


23

3.1.2.2 Configuration Procedure

# Name the devices.

The configuration details are not provided.

# Disable the interfaces that are not used in this experiment.

The configuration details are not provided.

# Configure IPv4 addresses for GE0/0/2, GE0/0/3, and Loopback0 on R1.


[R1]interface LoopBack0
[R1-LoopBack0] ip address 10.10.10.1 255.255.255.255
[R1-LoopBack0] quit
[R1]interface GigabitEthernet0/0/2
[R1-GigabitEthernet0/0/2] ip address 10.0.12.1 255.255.255.0
[R1-GigabitEthernet0/0/2] quit
[R1]interface GigabitEthernet0/0/3
[R1-GigabitEthernet0/0/3] ip address 10.0.11.2 255.255.255.0
[R1-GigabitEthernet0/0/3] quit

# Configure IPv6 addresses for GE0/0/2, GE0/0/3, and Loopback0 on R1.


[R1]ipv6
[R1]interface LoopBack0
[R1-LoopBack0] ipv6 enable
[R1-LoopBack0] ipv6 address 1::1/128
[R1-LoopBack0] quit
[R1]interface GigabitEthernet0/0/2
[R1-GigabitEthernet0/0/2] ipv6 enable
[R1-GigabitEthernet0/0/2] ipv6 address 2001:DB8:12::1/64
[R1-GigabitEthernet0/0/2] quit
[R1]interface GigabitEthernet0/0/3
[R1-GigabitEthernet0/0/3] ipv6 enable
[R1-GigabitEthernet0/0/3] ipv6 address 2001:DB8:11::2/64
[R1-GigabitEthernet0/0/3] quit

# Configure IPv4 addresses for GE0/0/1, GE0/0/2, GE0/0/3, and Loopback0 on R2.
[R2]interface LoopBack0
[R2-LoopBack0] ip address 10.10.10.2 255.255.255.255
[R2-LoopBack0] quit
[R2]interface GigabitEthernet0/0/1
[R2-GigabitEthernet0/0/1] ip address 10.0.24.2 255.255.255.0
[R2-GigabitEthernet0/0/1] quit
[R2]interface GigabitEthernet0/0/2
[R2-GigabitEthernet0/0/2] ip address 10.0.23.2 255.255.255.0
[R2-GigabitEthernet0/0/2] quit
[R2]interface GigabitEthernet0/0/3
[R2-GigabitEthernet0/0/3] ip address 10.0.12.2 255.255.255.0
[R2-GigabitEthernet0/0/3] quit

# Configure IPv6 addresses for GE0/0/2, GE0/0/3, and Loopback0 on R2. GE0/0/1
supports only IPv4 and does not need to be configured with an IPv6 address.
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 56


23

[R2]ipv6
[R2]interface LoopBack0
[R2-LoopBack0] ipv6 enable
[R2-LoopBack0] ipv6 address 2::2/128
[R2-LoopBack0] quit
[R2]interface GigabitEthernet0/0/2
[R2-GigabitEthernet0/0/2] ipv6 enable
[R2-GigabitEthernet0/0/2] ipv6 address 2001:DB8:23::2/64
[R2-GigabitEthernet0/0/2] quit
[R2]interface GigabitEthernet0/0/3
[R2-GigabitEthernet0/0/3] ipv6 enable
[R2-GigabitEthernet0/0/3] ipv6 address 2001:DB8:12::2/64
[R2-GigabitEthernet0/0/3] quit

# Configure IPv4 addresses for GE0/0/2, GE0/0/3, and Loopback0 on R3.


[R3]interface LoopBack0
[R3-LoopBack0] ip address 10.10.10.3 255.255.255.255
[R3-LoopBack0] quit
[R3]interface GigabitEthernet0/0/2
[R3-GigabitEthernet0/0/2] ip address 10.0.34.3 255.255.255.0
[R3-GigabitEthernet0/0/2] quit
[R3]interface GigabitEthernet0/0/3
[R3-GigabitEthernet0/0/3] ip address 10.0.23.3 255.255.255.0
[R3-GigabitEthernet0/0/3] quit

# Configure IPv6 addresses for GE0/0/2, GE0/0/3, and Loopback0 on R3.


[R3]ipv6
[R3]interface LoopBack0
[R3-LoopBack0] ipv6 enable
[R3-LoopBack0] ipv6 address 3::3/128
[R3-LoopBack0] quit
[R3]interface GigabitEthernet0/0/2
[R3-GigabitEthernet0/0/2] ipv6 enable
[R3-GigabitEthernet0/0/2] ipv6 address 2001:DB8:23::3/64
[R3-GigabitEthernet0/0/2] quit
[R3]interface GigabitEthernet0/0/3
[R3-GigabitEthernet0/0/3] ipv6 enable
[R3-GigabitEthernet0/0/3] ipv6 address 2001:DB8:34::3/64
[R3-GigabitEthernet0/0/3] quit

# Configure IPv4 addresses for GE0/0/1, GE0/0/2, GE0/0/3, and Loopback0 on R4.
[R4]interface LoopBack0
[R4-LoopBack0] ip address 10.10.10.4 255.255.255.255
[R4-LoopBack0] quit
[R4]interface GigabitEthernet0/0/1
[R4-GigabitEthernet0/0/1] ip address 10.0.24.4 255.255.255.0
[R4-GigabitEthernet0/0/1] quit
[R4]interface GigabitEthernet0/0/2
[R4-GigabitEthernet0/0/2] ip address 10.0.45.4 255.255.255.0
[R4-GigabitEthernet0/0/2] quit
[R4]interface GigabitEthernet0/0/3
[R4-GigabitEthernet0/0/3] ip address 10.0.34.4 255.255.255.0
[R4-GigabitEthernet0/0/3] quit
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 57


23

# Configure IPv6 addresses for GE0/0/2, GE0/0/3, and Loopback0 on R4. GE0/0/1
supports only IPv4 and does not need to be configured with an IPv6 address.
[R4]ipv6
[R4]interface LoopBack0
[R4-LoopBack0] ipv6 enable
[R4-LoopBack0] ipv6 address 4::4/128
[R4-LoopBack0] quit
[R4]interface GigabitEthernet0/0/2
[R4-GigabitEthernet0/0/2] ipv6 enable
[R4-GigabitEthernet0/0/2] ipv6 address 2001:DB8:45::4/64
[R4-GigabitEthernet0/0/2] quit
[R4]interface GigabitEthernet0/0/3
[R4-GigabitEthernet0/0/3] ipv6 enable
[R4-GigabitEthernet0/0/3] ipv6 address 2001:DB8:34::4/64
[R4-GigabitEthernet0/0/3] quit

# Configure IPv4 addresses for GE0/0/3, GE0/0/4, and Loopback0 on R5.


[R5]interface LoopBack0
[R5-LoopBack0] ip address 10.10.10.5 255.255.255.255
[R5-LoopBack0] quit
[R5]interface GigabitEthernet0/0/3
[R5-GigabitEthernet0/0/3] ip address 10.0.45.5 255.255.255.0
[R5-GigabitEthernet0/0/3] quit
[R5]interface GigabitEthernet0/0/4
[R5-GigabitEthernet0/0/4] ip address 10.0.25.5 255.255.255.0
[R5-GigabitEthernet0/0/4] quit

# Configure IPv6 addresses for GE0/0/2, GE0/0/3, and Loopback0 on R5.


[R5]ipv6
[R5]interface LoopBack0
[R5-LoopBack0] ipv6 enable
[R5-LoopBack0] ipv6 address 5::5/128
[R5-LoopBack0] quit
[R5]interface GigabitEthernet0/0/3
[R5-GigabitEthernet0/0/2] ipv6 enable
[R5-GigabitEthernet0/0/2] ipv6 address 2001:DB8:45::5/64
[R5-GigabitEthernet0/0/2] quit
[R5]interface GigabitEthernet0/0/4
[R5-GigabitEthernet0/0/3] ipv6 enable
[R5-GigabitEthernet0/0/3] ipv6 address 2001:DB8:25::2/64
[R5-GigabitEthernet0/0/3] quit

# Configure the VLAN to which GE0/0/1 of S1 belongs and IPv4 addresses of VLANIF 1
and Loopback0.
[S1]interface LoopBack0
[S1-LoopBack0] ip address 10.0.1.1 255.255.255.255
[S1-LoopBack0] quit
[S1]interface GigabitEthernet0/0/1
[S1-GigabitEthernet0/0/1] port link-type access
[S1-GigabitEthernet0/0/1] port default vlan 1
[S1-GigabitEthernet0/0/1] quit
[S1]interface Vlanif 1
[S1-Vlanif1] ip address 10.1.11.1 24
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 58


23

[S1-Vlanif1] quit

# Configure the VLAN to which GE0/0/1 of S1 belongs and IPv6 addresses for VLANIF 1
and Loopback0.
[S1]ipv6
[S1]interface LoopBack0
[S1-LoopBack0] ipv6 enable
[S1-LoopBack0] ipv6 address 2001:DB8::1/128
[S1-LoopBack0] quit
[S1]interface GigabitEthernet0/0/1
[S1-GigabitEthernet0/0/1] ipv6 enable
[S1-GigabitEthernet0/0/1] ipv6 address 2001:DB8:11::1/64
[S1-GigabitEthernet0/0/1] quit

# Configure the VLAN to which GE0/0/5 of S2 belongs and IPv4 addresses of VLANIF 1
and Loopback0.
[S2]interface LoopBack0
[S2-LoopBack0] ip address 10.0.2.1 255.255.255.255
[S2-LoopBack0] quit
[S2]interface GigabitEthernet0/0/5
[S2-GigabitEthernet0/0/5] port link-type access
[S2-GigabitEthernet0/0/5] port default vlan 1
[S2-GigabitEthernet0/0/5] quit
[S2]interface Vlanif 1
[S2-Vlanif1] ip address 10.0.25.2 24
[S2-Vlanif1] quit

# Configure the VLAN to which GE0/0/5 of S2 belongs and IPv6 addresses for VLANIF 1
and Loopback0.
[S2]ipv6
[S2]interface LoopBack0
[S2-LoopBack0] ipv6 enable
[S2-LoopBack0] ipv6 address 2001:DB8::2/128
[S2-LoopBack0] quit
[S2]interface GigabitEthernet0/0/1
[S2-GigabitEthernet0/0/5] ipv6 enable
[S2-GigabitEthernet0/0/5] ipv6 address 2001:DB8:25::2/64
[S2-GigabitEthernet0/0/5] quit

# Check the connectivity of IP addresses of interconnection interfaces on R1, R3, and R5.
(IPv6 addresses are used as an example.)
<R1>ping ipv6 2001:0db8:11::1
PING 2001:0db8:11::1 : 56 data bytes, press CTRL_C to break
Reply from 2001:DB8:11::1
bytes=56 Sequence=1 hop limit=64 time = 20 ms

--- 2001:0db8:11::1 ping statistics ---


1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 20/30/40 ms

<R1>ping ipv6 2001:0db8:12::2


1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 59


23

PING 2001:0db8:12::2 : 56 data bytes, press CTRL_C to break


Reply from 2001:DB8:12::2
bytes=56 Sequence=1 hop limit=64 time = 20 ms

--- 2001:0db8:12::2 ping statistics ---


1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 20/30/40 ms

<R3>ping ipv6 2001:0db8:23::2


PING 2001:0db8:23::2 : 56 data bytes, press CTRL_C to break
Reply from 2001:DB8:23::2
bytes=56 Sequence=1 hop limit=64 time = 20 ms

--- 2001:0db8:23::2 ping statistics ---


1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 20/30/40 ms

<R3>ping ipv6 2001:0db8:34::4


PING 2001:0db8:34::4 : 56 data bytes, press CTRL_C to break
Reply from 2001:DB8:34::4
bytes=56 Sequence=1 hop limit=64 time = 20 ms

--- 2001:0db8:34::4 ping statistics ---


1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 20/30/40 ms

<R5>ping ipv6 2001:0db8:45::4


PING 2001:0db8:45::4 : 56 data bytes, press CTRL_C to break
Reply from 2001:DB8:45::4
bytes=56 Sequence=1 hop limit=64 time = 20 ms

--- 2001:0db8:45::4 ping statistics ---


1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 20/30/40 ms

<R5>ping ipv6 2001:0db8:25::5


PING 2001:0db8: 25::5 : 56 data bytes, press CTRL_C to break
Reply from 2001:DB8: 25::5
bytes=56 Sequence=1 hop limit=64 time = 20 ms

--- 2001:0db8: 25::5 ping statistics ---


1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 20/30/40 ms
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 60


23

Deploy OSPF processes on R1, R2, R4, and R5 according to the topology design. Set the
process ID to 1, area ID to 0, and router ID to the loopback interface's IP address of the
router. R1 with the router ID of 10.10.10.1 is used as an example.

Configure routes of OSPF interfaces in AS 65100 to be accurately advertised.

The configuration of OSPFv3 is similar to the configuration of OSPF. Set the process ID to
1, area ID to 0, instance ID to 1, and router ID to the loopback interface's address of the
router. R1 with the router ID of 10.10.10.1 is used as an example.

# Configure OSPF on R1.


[R1]router id 10.10.10.1
[R1]ospf 1
[R1-ospf-1] area 0
[R1-ospf-1-area-0.0.0.0] network 10.10.10.1 0.0.0.0
[R1-ospf-1-area-0.0.0.0] network 10. 0.12.1 0.0.0.0

# Configure OSPFv3 on R1.


[R1]ospfv3 1
[R1-ospfv3-1] router-id 10.10.10.1
[R1-ospfv3-1] quit
[R1]interface GigabitEthernet0/0/2
[R1-GigabitEthernet0/0/2] ospfv3 1 area 0 instance 1
[R1-GigabitEthernet0/0/2] quit
[R1]interface LoopBack0
[R1-LoopBack0] ospfv3 1 area 0 instance 1

# Configure OSPF on R2.


[R2]router id 10.10.10.2
[R2]ospf 1
[R2-ospf-1] area 0
[R2-ospf-1-area-0.0.0.0] network 10.0.12.2 0.0.0.0

# Configure OSPFv3 on R2.


[R2]ospfv3 1
[R2-ospfv3-1] router-id 10.10.10.2
[R2-ospfv3-1] quit
[R2]interface GigabitEthernet0/0/3
[R2-GigabitEthernet0/0/3] ospfv3 1 area 0 instance 1
[R2-GigabitEthernet0/0/3] quit

# Configure OSPF on R4.


[R4]router id 10.10.10.4
[R4]ospf 1
[R4-ospf-1] area 0
[R4-ospf-1-area-0.0.0.0] network 10.0.45.4 0.0.0.0

# Configure OSPFv3 on R4.


[R4]ospfv3 1
[R4-ospfv3-1] router-id 10.10.10.4
[R4-ospfv3-1] quit
[R4]interface GigabitEthernet0/0/2
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 61


23

[R4-GigabitEthernet0/0/2] ospfv3 1 area 0 instance 1


[R4-GigabitEthernet0/0/2] quit

# Configure OSPF on R5.


[R5]router id 10.10.10.5
[R5]ospf 1
[R5-ospf-1] area 0
[R5-ospf-1-area-0.0.0.0] network 10.10.10.5 0.0.0.0
[R5-ospf-1-area-0.0.0.0] network 10.0.45.5 0.0.0.0

# Configure OSPFv3 on R5.


[R5]ospfv3 1
[R5-ospfv3-1] router-id 10.10.10.5
[R5-ospfv3-1] quit
[R5]interface GigabitEthernet0/0/3
[R5-GigabitEthernet0/0/3] ospfv3 1 area 0 instance 1
[R5-GigabitEthernet0/0/3] quit
[R5]interface LoopBack0
[R5-LoopBack0] ospfv3 1 area 0 instance 1

Check the OSPF/OSPFv3 configuration.

# Check OSPF neighbor relationship information on R2 and R4.


[R2]display ospf peer brief

OSPF Process 1 with Router ID 10.10.10.2


Peer Statistic Information
-----------------------------------------------------------------------------------------------------
Area Id Interface Neighbor id State
0.0.0.0 GigabitEthernet0/0/3 10.10.10.1 Full
-----------------------------------------------------------------------------------------------------

[R4]display ospf peer brief

OSPF Process 1 with Router ID 10.10.10.4


Peer Statistic Information
-----------------------------------------------------------------------------------------------------
Area Id Interface Neighbor id State
0.0.0.0 GigabitEthernet0/0/2 10.10.10.5 Full
-----------------------------------------------------------------------------------------------------
# Check OSPFv3 neighbor relationship information on R1 and R5.
[R1]display ospfv3 peer
OSPFv3 Process (1)
OSPFv3 Area (0.0.0.0)
Neighbor ID Pri State Dead Time Interface Instance ID
10.10.10.2 1 Full/Backup 00:00:35 GE0/0/2 1

[R5]display ospfv3 peer


OSPFv3 Process (1)
OSPFv3 Area (0.0.0.0)
Neighbor ID Pri State Dead Time Interface Instance ID
10.10.10.4 1 Full/DR 00:00:36 GE0/0/3 1
# Check the OSPF and OSPFv3 routing tables on routers. R1 is used as an example.
[R1]display ospf routing
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 62


23

OSPF Process 1 with Router ID 10.10.10.1


Routing Tables

Routing for Network


Destination Cost Type NextHop AdvRouter Area
10.0.12.0/24 1 Transit 10.0.12.1 10.10.10.1 0.0.0.0
10.10.10.1/32 0 Stub 10.10.10.1 10.10.10.1 0.0.0.0

Total Nets: 2
Intra Area: 2 Inter Area: 0 ASE: 0 NSSA: 0

[R1]display ospfv3 routing

Codes : E2 - Type 2 External, E1 - Type 1 External, IA - Inter-Area,


N - NSSA, U - Uninstalled

OSPFv3 Process (1)


Destination Metric
Next-hop
1::1/128 0
directly connected, LoopBack0
2001:DB8:12::/64 1
directly connected, GigabitEthernet0/0/1

The command output shows that IPv4 and IPv6 routes have been learned by the router.

Deploy IS-IS processes on R2, R3, and R4 based on the topology design. Set the process
ID to 1, configure R2, R3, and R4 as Level-2 routers, set the cost type to wide, set the
area ID of the NET to 49.0001, set the system ID based on the loopback interface, and set
the IS-IS host name to be the same as the device name.

Because a pure IPv4 network exists between R2 and R4, the multi-topology function
needs to be deployed when dual-stack IS-IS is deployed.

# Deploy dual-stack IS-IS on R2. GE0/0/1 supports only IPv4, so the route of GE0/0/1
does not need to be advertised to IPv6 IS-IS.
[R2]isis 1
[R2-isis-1] is-level level-2
[R2-isis-1] cost-style wide
[R2-isis-1] network-entity 49.0001.0100.1001.0002.00
[R2-isis-1] is-name R2
[R2-isis-1] ipv6 enable topology ipv6
[R2-isis-1] quit
[R2]interface LoopBack0
[R2-LoopBack0] isis enable 1
[R2-LoopBack0] isis ipv6 enable 1
[R2-LoopBack0] quit
[R2]interface GigabitEthernet0/0/1
[R2-GigabitEthernet0/0/1] isis enable 1
[R2-GigabitEthernet0/0/1] quit
[R2]interface GigabitEthernet0/0/2
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 63


23

[R2-GigabitEthernet0/0/2] isis enable 1


[R2-GigabitEthernet0/0/2] isis ipv6 enable 1
[R2-GigabitEthernet0/0/2] quit

# Deploy dual-stack IS-IS on R3.


[R3]isis 1
[R3-isis-1] is-level level-2
[R3-isis-1] cost-style wide
[R3-isis-1] network-entity 49.0001.0100.1001.0003.00
[R3-isis-1] is-name R3
[R3-isis-1] ipv6 enable topology ipv6
[R3-isis-1] quit
[R3]interface LoopBack0
[R3-LoopBack0] isis enable 1
[R3-LoopBack0] isis ipv6 enable 1
[R3-LoopBack0] quit
[R3]interface GigabitEthernet0/0/2
[R3-GigabitEthernet0/0/2] isis enable 1
[R3-GigabitEthernet0/0/2] isis ipv6 enable 1
[R3-GigabitEthernet0/0/2] quit
[R3]interface GigabitEthernet0/0/3
[R3-GigabitEthernet0/0/3] isis enable 1
[R3-GigabitEthernet0/0/3] isis ipv6 enable 1
[R3-GigabitEthernet0/0/3] quit

# Deploy dual-stack IS-IS on R4. GE0/0/1 supports only IPv4, so the route of GE0/0/1
does not need to be advertised to IPv6 IS-IS.
[R4]isis 1
[R4-isis-1] is-level level-2
[R4-isis-1] cost-style wide
[R4-isis-1] network-entity 49.0001.0100.1001.0004.00
[R4-isis-1] is-name R4
[R4-isis-1] ipv6 enable topology ipv6
[R4-isis-1] quit
[R4]interface LoopBack0
[R4-LoopBack0] isis enable 1
[R4-LoopBack0] isis ipv6 enable 1
[R4-LoopBack0] quit
[R4]interface GigabitEthernet0/0/1
[R4-GigabitEthernet0/0/1] isis enable 1
[R4-GigabitEthernet0/0/1] quit
[R4]interface GigabitEthernet0/0/3
[R4-GigabitEthernet0/0/3] isis enable 1
[R4-GigabitEthernet0/0/3] isis ipv6 enable 1
[R4-GigabitEthernet0/0/3] quit

Check the dual-stack IS-IS configuration.

# Check the IS-IS neighbor relationship on R3.


[R3]display isis peer

Peer information for ISIS(1)

System Id Interface Circuit Id StateHoldTime Type PRI


1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 64


23

-------------------------------------------------------------------------------
R4* GE0/0/2 R4.02 Up 8s L2 64
R2* GE0/0/3 R2.02 Up 9s L2 64

Total Peer(s): 2

[R3]display isis interface

Interface information for ISIS(1)


---------------------------------
Interface Id IPV4.State IPV6.State MTU Type DIS
GE0/0/2 001 Up Up 1497 L1/L2 No/No
GE0/0/3 002 Up Up 1497 L1/L2 No/No
Loop0 001 Up Up 1500 L1/L2 --

# Check IPv4 and IPv6 IS-IS routing tables on each router. R3 is used as an example.
[R3]display isis route

Route information for ISIS(1)


-----------------------------

ISIS(1) Level-2 Forwarding Table


--------------------------------

IPV4 Destination IntCost ExtCost ExitInterface NextHop Flags


-------------------------------------------------------------------------------
10.0.24.0/24 20 NULL GE0/0/2 10.0.34.4 A/-/-/-
GE0/0/3 10.0.23.2
10.10.10.3/32 0 NULL Loop0 Direct D/-/L/-
10.10.10.2/32 10 NULL GE0/0/3 10.0.23.2 A/-/-/-
10.0.23.0/24 10 NULL GE0/0/3 Direct D/-/L/-
10.0.34.0/24 10 NULL GE0/0/2 Direct D/-/L/-
10.10.10.4/32 10 NULL GE0/0/2 10.0.34.4 A/-/-/-

IPV6 Dest. ExitInterface NextHop Cost Flags


-------------------------------------------------------------------------------
4::4/128 GE0/0/2 FE80::2E0:FCFF:FE92:2B1C 10 A/-/-
3::3/128 Loop0 Direct 0 D/L/-
2::2/128 GE0/0/3 FE80::2E0:FCFF:FE1C:24DE 10 A/-/-
2001:DB8:23::/64
GE0/0/3 Direct 10 D/L/-
2001:DB8:34::/64
GE0/0/2 Direct 10 D/L/-

Flags: D-Direct, A-Added to URT, L-Advertised in LSPs, S-IGP Shortcut,


U-Up/DownBit Set

The command output shows that IPv4 and IPv6 routes have been learned by the router.

Configure IS-IS and OSPF to import routes from each other on R2 and R4, implementing
connectivity of the underlying network of the backbone network and preparing for BGP
deployment.
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 65


23

R2 and R4 need to import routes from both IPv4 and IPv6 networks.

# Configure IS-IS and OSPF to import routes from each other on R2.
[R2]isis 1
[R2-isis-1] import-route ospf 1
[R2-isis-1] ipv6 import-route ospfv3 1
[R2-isis-1] quit
[R2]ospf 1
[R2-ospf-1] import-route isis 1
[R2-ospf-1] quit
[R2]ospfv3 1
[R2-ospfv3-1] import-route isis 1

# Configure IS-IS and OSPF to import routes from each other on R4.
[R4]isis 1
[R4-isis-1] import-route ospf 1
[R4-isis-1] ipv6 import-route ospfv3 1
[R4-isis-1] quit
[R4]ospf 1
[R4-ospf-1] import-route isis 1
[R4-ospf-1] quit
[R4]ospfv3 1
[R4-ospfv3-1] import-route isis 1

Check the bidirectional route import configuration.

# Check IPv4 and IPv6 routing tables on routers. R1 is used as an example.


[R1]display ip routing-table protocol ospf
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Public routing table : OSPF
Destinations : 8 Routes : 8

OSPF routing table status : <Active>


Destinations : 8 Routes : 8

Destination/Mask Proto Pre Cost Flags NextHop Interface

10.0.23.0/24 O_ASE 150 1 D 10.0.12.2 GigabitEthernet0/0/2


10.0.24.0/24 O_ASE 150 1 D 10.0.12.2 GigabitEthernet0/0/2
10.0.34.0/24 O_ASE 150 1 D 10.0.12.2 GigabitEthernet0/0/2
10.0.45.0/24 O_ASE 150 1 D 10.0.12.2 GigabitEthernet0/0/2
10.10.10.2/32 O_ASE 150 1 D 10.0.12.2 GigabitEthernet0/0/2
10.10.10.3/32 O_ASE 150 1 D 10.0.12.2 GigabitEthernet0/0/2
10.10.10.4/32 O_ASE 150 1 D 10.0.12.2 GigabitEthernet0/0/2
10.10.10.5/32 O_ASE 150 1 D 10.0.12.2 GigabitEthernet0/0/2

OSPF routing table status : <Inactive>


Destinations : 0 Routes : 0

[R1]display ipv6 routing-table protocol ospfv3


Public Routing Table : OSPFv3
Summary Count : 9
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 66


23

OSPFv3 Routing Table's Status : < Active >


Summary Count : 7

Destination : 2::2 PrefixLength : 128


NextHop : FE80::2E0:FCFF:FE1C:24DF Preference : 150
Cost :1 Protocol : OSPFv3ASE
RelayNextHop : :: TunnelID : 0x0
Interface : GigabitEthernet0/0/2 Flags :D

Destination : 3::3 PrefixLength : 128


NextHop : FE80::2E0:FCFF:FE1C:24DF Preference : 150
Cost :1 Protocol : OSPFv3ASE
RelayNextHop : :: TunnelID : 0x0
Interface : GigabitEthernet0/0/2 Flags :D

Destination : 4::4 PrefixLength : 128


NextHop : FE80::2E0:FCFF:FE1C:24DF Preference : 150
Cost :1 Protocol : OSPFv3ASE
RelayNextHop : :: TunnelID : 0x0
Interface : GigabitEthernet0/0/2 Flags :D

Destination : 5::5 PrefixLength : 128


NextHop : FE80::2E0:FCFF:FE1C:24DF Preference : 150
Cost :1 Protocol : OSPFv3ASE
RelayNextHop : :: TunnelID : 0x0
Interface : GigabitEthernet0/0/2 Flags :D

Destination : 2001:DB8:23:: PrefixLength : 64


NextHop : FE80::2E0:FCFF:FE1C:24DF Preference : 150
Cost :1 Protocol : OSPFv3ASE
RelayNextHop : :: TunnelID : 0x0
Interface : GigabitEthernet0/0/2 Flags :D

Destination : 2001:DB8:34:: PrefixLength : 64


NextHop : FE80::2E0:FCFF:FE1C:24DF Preference : 150
Cost :1 Protocol : OSPFv3ASE
RelayNextHop : :: TunnelID : 0x0
Interface : GigabitEthernet0/0/2 Flags :D

Destination : 2001:DB8:45:: PrefixLength : 64


NextHop : FE80::2E0:FCFF:FE1C:24DF Preference : 150
Cost :1 Protocol : OSPFv3ASE
RelayNextHop : :: TunnelID : 0x0
Interface : GigabitEthernet0/0/2 Flags :D

OSPFv3 Routing Table's Status : < Inactive >


Summary Count : 2

Destination : 1::1 PrefixLength : 128


NextHop : :: Preference : 10
Cost :0 Protocol : OSPFv3
RelayNextHop : :: TunnelID : 0x0
Interface : LoopBack0 Flags :

Destination : 2001:DB8:12:: PrefixLength : 64


1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 67


23

NextHop : :: Preference : 10
Cost :1 Protocol : OSPFv3
RelayNextHop : :: TunnelID : 0x0
Interface : GigabitEthernet0/0/2 Flags :

The routing table of R1 shows that the underlying network in AS 65100 has been
established.

Establish an IBGP peer relationship in AS 65100. Configure R3 as the RR, and R1, R2, R4,
and R5 as clients of R3.

You can configure a peer group to reduce the configuration workload.

# Configure R1 to establish IPv4 and IPv6 IBGP peer relationships.


[R1]bgp 65100
[R1-bgp] peer 10.10.10.3 as-number 65100
[R1-bgp] peer 10.10.10.3 connect-interface LoopBack0
[R1-bgp] peer 3::3 as-number 65100
[R1-bgp] peer 3::3 connect-interface LoopBack0
[R1-bgp] ipv4-family unicast
[R1-bgp-af-ipv4] peer 10.10.10.3 enable
[R1-bgp-af-ipv4] peer 10.10.10.3 next-hop-local
[R1-bgp-af-ipv4] quit
[R1-bgp] ipv6-family unicast
[R1-bgp-af-ipv6] peer 3::3 enable
[R1-bgp-af-ipv6] peer 3::3 next-hop-local
[R1-bgp-af-ipv6] quit

# Configure R2 to establish IPv4 and IPv6 IBGP peer relationships.


[R2]bgp 65100
[R2-bgp] peer 10.10.10.3 as-number 65100
[R2-bgp] peer 10.10.10.3 connect-interface LoopBack0
[R2-bgp] peer 3::3 as-number 65100
[R2-bgp] peer 3::3 connect-interface LoopBack0
[R2-bgp] ipv4-family unicast
[R2-bgp-af-ipv4] peer 10.10.10.3 enable
[R2-bgp-af-ipv4] quit
[R2-bgp] ipv6-family unicast
[R2-bgp-af-ipv6] peer 3::3 enable
[R2-bgp-af-ipv6] quit

# Configure R3 to establish IPv4 and IPv6 IBGP peer relationships. R3 functions as an RR


and needs to connect to many clients. The peer group is recommended.
[R3]bgp 65100
[R3-bgp] group IBGP internal
[R3-bgp] peer IBGP connect-interface LoopBack0
[R3-bgp] peer 10.10.10.1 group IBGP
[R3-bgp] peer 10.10.10.2 group IBGP
[R3-bgp] peer 10.10.10.4 group IBGP
[R3-bgp] peer 10.10.10.5 group IBGP
[R3-bgp] peer 1::1group IBGP
[R3-bgp] peer 2::2group IBGP
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 68


23

[R3-bgp] peer 4::4group IBGP


[R3-bgp] peer 5::5group IBGP
[R3-bgp] ipv4-family unicast
[R3-bgp-af-ipv4] peer IBGP enable
[R3-bgp-af-ipv4] peer IBGP reflect-client
[R3-bgp-af-ipv4] peer 10.10.10.1 enable
[R3-bgp-af-ipv4] peer 10.10.10.2 enable
[R3-bgp-af-ipv4] peer 10.10.10.4 enable
[R3-bgp-af-ipv4] peer 10.10.10.5 enable
[R3-bgp-af-ipv4] quit
[R3-bgp] ipv6-family unicast
[R3-bgp-af-ipv6] peer 3::3 enable
[R3-bgp-af-ipv6] peer IBGP enable
[R3-bgp-af-ipv6] peer IBGP reflect-client
[R3-bgp-af-ipv6] peer 1::1 enable
[R3-bgp-af-ipv6] peer 2::2 enable
[R3-bgp-af-ipv6] peer 4::4 enable
[R3-bgp-af-ipv6] peer 5::5 enable
[R3-bgp-af-ipv6] quit

# Configure R4 to establish IPv4 and IPv6 IBGP peer relationships.


[R4]bgp 65100
[R4-bgp] peer 10.10.10.3 as-number 65100
[R4-bgp] peer 10.10.10.3 connect-interface LoopBack0
[R4-bgp] peer 3::3 as-number 65100
[R4-bgp] peer 3::3 connect-interface LoopBack0
[R4-bgp] ipv4-family unicast
[R4-bgp-af-ipv4] peer 10.10.10.3 enable
[R4-bgp-af-ipv4] quit
[R4-bgp] ipv6-family unicast
[R4-bgp-af-ipv6] peer 3::3 enable
[R4-bgp-af-ipv6] quit

# Configure R5 to establish IPv4 and IPv6 IBGP peer relationships.


[R5]bgp 65100
[R5-bgp] peer 10.10.10.3 as-number 65100
[R5-bgp] peer 10.10.10.3 connect-interface LoopBack0
[R5-bgp] peer 3::3 as-number 65100
[R5-bgp] peer 3::3 connect-interface LoopBack0
[R5-bgp] ipv4-family unicast
[R5-bgp-af-ipv4] peer 10.10.10.3 enable
[R5-bgp-af-ipv4] peer 10.10.10.3 next-hop-local
[R5-bgp-af-ipv4] quit
[R5-bgp] ipv6-family unicast
[R5-bgp-af-ipv6] peer 3::3 enable
[R5-bgp-af-ipv6] peer 3::3 next-hop-local
[R5-bgp-af-ipv6] quit

Check the BGP configuration.

# Check IPv4 and IPv6 IBGP peer relationships on R3.


[R3]display bgp peer

BGP local router ID : 10.10.10.3


1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 69


23

Local AS number : 65100


Total number of peers : 4 Peers in established state : 4

Peer V AS MsgRcvd MsgSent OutQ Up/Down State PrefRcv

10.10.10.1 4 65100 200 201 0 03:17:18 Established 0


10.10.10.2 4 65100 344 352 0 05:42:08 Established 0
10.10.10.4 4 65100 343 352 0 05:41:49 Established 0
10.10.10.5 4 65100 199 200 0 03:16:45 Established 0

[R3]display BGP IPV6 peer

BGP local router ID : 10.10.10.3


Local AS number : 65100
Total number of peers : 4 Peers in established state : 4

Peer V AS MsgRcvd MsgSent OutQ Up/Down State PrefRcv

1::1 4 65100 201 202 0 03:18:39 Established 0


2::2 4 65100 345 355 0 05:43:56 Established 0
4::4 4 65100 345 356 0 05:43:37 Established 0
5::5 4 65100 201 202 0 03:18:26 Established 0

The command output shows that both IPv4 and IPv6 IBGP peer relationships have been
established.

IPv4 and IPv6 EBGP peer relationships have been established between the branch and
backbone network, and routes of loopback interfaces on S1 and S2 are imported to BGP.

# Establish IPv4 and IPv6 EBGP peer relationships between R1 and S1 and advertise
routes.
[R1]bgp 65100
[R1-bgp] peer 10.0.11.1 as-number 65001
[R1-bgp] peer 2001:DB8:11::1 as-number 65001
[R1-bgp] ipv4-family unicast
[R1-bgp-af-ipv4] peer 10.0.11.1 enable
[R1-bgp-af-ipv4] quit
[R1-bgp] ipv6-family unicast
[R1-bgp-af-ipv6] peer 2001:DB8:11::1 enable
[R1-bgp-af-ipv6] quit

[S1]bgp 65001
[S1-bgp] peer 10.0.11.2 as-number 65100
[S1-bgp] peer 2001:DB8:11::2 as-number 65100
[S1-bgp] ipv4-family unicast
[S1-bgp-af-ipv4] peer 10.0.11.2 enable
[S1-bgp-af-ipv4] network 10.0.1.1 255.255.255.255
[S1-bgp-af-ipv4] quit
[S1-bgp] ipv6-family unicast
[S1-bgp-af-ipv6] peer 2001:DB8:11::2 enable
[S1-bgp-af-ipv6] network 2001:DB8::1 128
[S1-bgp-af-ipv6] quit
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 70


23

# Establish IPv4 and IPv6 EBGP peer relationships between R5 and S2 and advertise
routes.
[R5]bgp 65100
[R5-bgp] peer 10.0.25.2 as-number 65002
[R5-bgp] peer 2001:DB8:25::2 as-number 65002
[R5-bgp] ipv4-family unicast
[R5-bgp-af-ipv4]p eer 10.0.25.2 enable
[R5-bgp-af-ipv4] quit
[R5-bgp] ipv6-family unicast
[R5-bgp-af-ipv6] peer 2001:DB8:25::2 enable
[R5-bgp-af-ipv6] quit

[S2]bgp 65002
[S2-bgp] peer 10.0.25.5 as-number 65100
[S2-bgp] peer 2001:DB8:25::5 as-number 65100
[S2-bgp] ipv4-family unicast
[S2-bgp-af-ipv4] peer 10.0.25.5 enable
[S2-bgp-af-ipv4] network 10.0.2.1 255.255.255.255
[S2-bgp-af-ipv4] quit
[S2-bgp] ipv6-family unicast
[S2-bgp-af-ipv6] peer 2001:DB8:25::5 enable
[S2-bgp-af-ipv6] network 2001:DB8::2 128
[S2-bgp-af-ipv6] quit

Check the configuration.

# Check the IPv4 and IPv6 EBGP peer relationships on S1 and S2. S1 is used as an
example.
[S1]display bgp peer

BGP local router ID : 10.0.11.1


Local AS number : 65001
Total number of peers : 1 Peers in established state : 1

Peer V AS MsgRcvd MsgSent OutQ Up/Down State PrefRcv

10.0.11.2 4 65100 377 371 0 06:08:10 Established 1

[S1]display bgp ipv6 peer

BGP local router ID : 10.0.11.1


Local AS number : 65001
Total number of peers : 1 Peers in established state : 1

Peer V AS MsgRcvd MsgSent OutQ Up/Down State PrefRcv

2001:DB8:11::2 4 65100 375 373 0 06:08:05 Established 1

The preceding command output shows that IPv4 and IPv6 BGP peer relationships have
been established.

# Check the route transmission result. Check IPv4 and IPv6 routing tables on S1 and S2.
S1 is used as an example.
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 71


23

[S1]display ip routing-table protocol bgp


Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Public routing table : BGP
Destinations : 1 Routes : 1

BGP routing table status : <Active>


Destinations : 1 Routes : 1

Destination/Mask Proto Pre Cost Flags NextHop Interface

10.0.2.1/32 EBGP 255 0 D 10.0.11.2 Vlanif1

BGP routing table status : <Inactive>


Destinations : 0 Routes : 0

[S1]display ipv6 routing-table protocol bgp


Public Routing Table : BGP
Summary Count : 1

BGP Routing Table's Status : < Active >


Summary Count : 1

Destination : 2001:DB8::2 PrefixLength : 128


NextHop : 2001:DB8:11::2 Preference : 255
Cost :0 Protocol : EBGP
RelayNextHop : :: TunnelID : 0x0
Interface : Vlanif1 Flags :D

BGP Routing Table's Status : < Inactive >


Summary Count : 0

The command output shows that S1 has received the route of Loopback0 on S2.

# Test the connectivity between Loopback0 interfaces of S1 and S2.


[S1]ping -a 10.0.1.1 10.0.2.1
PING 10.0.2.1: 56 data bytes, press CTRL_C to break
Reply from 10.0.2.1: bytes=56 Sequence=1 ttl=251 time=60 ms

--- 10.0.2.1 ping statistics ---


1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 40/66/100 ms

[S1]ping ipv6 -a 2001:0db8::1 2001:0db8::2


PING 2001:0db8::2 : 56 data bytes, press CTRL_C to break
Reply from 2001:DB8::2
bytes=56 Sequence=1 hop limit=59 time = 100 ms

--- 2001:0db8::2 ping statistics ---


1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 30/76/100 ms
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 72


23

The ping operation is successful, indicating that the lab configuration is successful.

3.1.3 Quiz
If IS-IS multi-topology is not deployed, can IPv4 and IPv6 networks communicate with
each other?

3.1.4 Configuration Reference


Configuration on R1
#
sysname R1
#
ipv6
#
router id 10.10.10.1
#
ospfv3 1
router-id 10.10.10.1
#
interface GigabitEthernet0/0/2
ipv6 enable
ip address 10.0.12.1 255.255.255.0
ipv6 address 2001:DB8:12::1/64
ospfv3 1 area 0.0.0.0
#
interface GigabitEthernet0/0/3
ipv6 enable
ip address 10.0.11.2 255.255.255.0
ipv6 address 2001:DB8:11::2/64
#
interface LoopBack0
ipv6 enable
ip address 10.10.10.1 255.255.255.255
ipv6 address 1::1/128
ospfv3 1 area 0.0.0.0
#
bgp 65100
peer 10.0.11.1 as-number 65001
peer 10.10.10.3 as-number 65100
peer 10.10.10.3 connect-interface LoopBack0
peer 3::3 as-number 65100
peer 3::3 connect-interface LoopBack0
peer 2001:DB8:11::1 as-number 65001
#
ipv4-family unicast
undo synchronization
peer 10.0.11.1 enable
peer 10.10.10.3 enable
peer 10.10.10.3 next-hop-local
#
ipv6-family unicast
undo synchronization
peer 3::3 enable
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 73


23

peer 3::3 next-hop-local


peer 2001:DB8:11::1 enable
#
ospf 1
area 0.0.0.0
network 10.0.12.1 0.0.0.0
network 10.10.10.1 0.0.0.0
#
return

Configuration on R2
#
sysname R2
#
ipv6
#
router id 10.10.10.2
#
isis 1
is-level level-2
cost-style wide
network-entity 49.0001.0100.1001.0002.00
is-name R2
import-route ospf 1
#
ipv6 enable topology ipv6
ipv6 import-route ospfv3 1
#
#
ospfv3 1
router-id 10.10.10.2
import-route isis 1
#
interface GigabitEthernet0/0/1
ip address 10.0.24.2 255.255.255.0
isis enable 1
#
interface GigabitEthernet0/0/2
ipv6 enable
ip address 10.0.23.2 255.255.255.0
ipv6 address 2001:DB8:23::2/64
isis enable 1
isis ipv6 enable 1
#
interface GigabitEthernet0/0/3
ipv6 enable
ip address 10.0.12.2 255.255.255.0
ipv6 address 2001:DB8:12::2/64
ospfv3 1 area 0.0.0.0
#
interface LoopBack0
ipv6 enable
ip address 10.10.10.2 255.255.255.255
ipv6 address 2::2/128
isis enable 1
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 74


23

isis ipv6 enable 1


#
bgp 65100
peer 10.10.10.3 as-number 65100
peer 10.10.10.3 connect-interface LoopBack0
peer 3::3 as-number 65100
peer 3::3 connect-interface LoopBack0
#
ipv4-family unicast
undo synchronization
peer 10.10.10.3 enable
#
ipv6-family unicast
undo synchronization
peer 3::3 enable
#
ospf 1
import-route isis 1
area 0.0.0.0
network 10.0.12.2 0.0.0.0
#
return

Configuration on R3
#
sysname R3
#
ipv6
#
router id 10.10.10.3
#
isis 1
is-level level-2
cost-style wide
network-entity 49.0001.0100.1001.0003.00
is-name R3
#
ipv6 enable topology ipv6
#
#
interface GigabitEthernet0/0/2
ipv6 enable
ip address 10.0.34.3 255.255.255.0
ipv6 address 2001:DB8:34::3/64
isis enable 1
isis ipv6 enable 1
#
interface GigabitEthernet0/0/3
ipv6 enable
ip address 10.0.23.3 255.255.255.0
ipv6 address 2001:DB8:23::3/64
isis enable 1
isis ipv6 enable 1
#
interface LoopBack0
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 75


23

ipv6 enable
ip address 10.10.10.3 255.255.255.255
ipv6 address 3::3/128
isis enable 1
isis ipv6 enable 1
#
bgp 65100
group IBGP internal
peer IBGP connect-interface LoopBack0
peer 10.10.10.1 as-number 65100
peer 10.10.10.1 group IBGP
peer 10.10.10.2 as-number 65100
peer 10.10.10.2 group IBGP
peer 10.10.10.4 as-number 65100
peer 10.10.10.4 group IBGP
peer 10.10.10.5 as-number 65100
peer 10.10.10.5 group IBGP
peer 1::1 as-number 65100
peer 1::1 group IBGP
peer 2::2 as-number 65100
peer 2::2 group IBGP
peer 4::4 as-number 65100
peer 4::4 group IBGP
peer 5::5 as-number 65100
peer 5::5 group IBGP
#
ipv4-family unicast
undo synchronization
peer IBGP enable
peer IBGP reflect-client
peer 10.10.10.1 enable
peer 10.10.10.1 group IBGP
peer 10.10.10.2 enable
peer 10.10.10.2 group IBGP
peer 10.10.10.4 enable
peer 10.10.10.4 group IBGP
peer 10.10.10.5 enable
peer 10.10.10.5 group IBGP
#
ipv6-family unicast
undo synchronization
peer IBGP enable
peer IBGP reflect-client
peer 1::1 enable
peer 1::1 group IBGP
peer 2::2 enable
peer 2::2 group IBGP
peer 4::4 enable
peer 4::4 group IBGP
peer 5::5 enable
peer 5::5 group IBGP
#
return

Configuration on R4
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 76


23

#
sysname R4
#
ipv6
#
router id 10.10.10.4
#
isis 1
is-level level-2
cost-style wide
network-entity 49.0001.0100.1001.0004.00
is-name R4
import-route ospf 1
#
ipv6 enable topology ipv6
ipv6 import-route ospfv3 1
#
#
ospfv3 1
router-id 10.10.10.4
import-route isis 1
#
interface GigabitEthernet0/0/1
ip address 10.0.24.4 255.255.255.0
isis enable 1
#
interface GigabitEthernet0/0/2
ipv6 enable
ip address 10.0.45.4 255.255.255.0
ipv6 address 2001:DB8:45::4/64
ospfv3 1 area 0.0.0.0 instance 1
#
interface GigabitEthernet0/0/3
ipv6 enable
ip address 10.0.34.4 255.255.255.0
ipv6 address 2001:DB8:34::4/64
isis enable 1
isis ipv6 enable 1
#
interface LoopBack0
ipv6 enable
ip address 10.10.10.4 255.255.255.255
ipv6 address 4::4/128
isis enable 1
isis ipv6 enable 1
#
bgp 65100
peer 10.10.10.3 as-number 65100
peer 10.10.10.3 connect-interface LoopBack0
peer 3::3 as-number 65100
peer 3::3 connect-interface LoopBack0
#
ipv4-family unicast
undo synchronization
peer 10.10.10.3 enable
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 77


23

#
ipv6-family unicast
undo synchronization
peer 3::3 enable
#
ospf 1
import-route isis 1
area 0.0.0.0
network 10.0.45.4 0.0.0.0
#
return

Configuration on R5
#
sysname R5
#
ipv6
#
router id 10.10.10.5
#
ospfv3 1
router-id 10.10.10.5
#
interface GigabitEthernet0/0/3
ipv6 enable
ip address 10.0.45.5 255.255.255.0
ipv6 address 2001:DB8:45::5/64
ospfv3 1 area 0.0.0.0 instance 1
#
interface GigabitEthernet0/0/4
ipv6 enable
ip address 10.0.25.5 255.255.255.0
ipv6 address 2001:DB8:25::5/64
#
interface LoopBack0
ipv6 enable
ip address 10.10.10.5 255.255.255.255
ipv6 address 5::5/128
ospfv3 1 area 0.0.0.0 instance 1
#
bgp 65100
peer 10.0.25.2 as-number 65002
peer 10.10.10.3 as-number 65100
peer 10.10.10.3 connect-interface LoopBack0
peer 3::3 as-number 65100
peer 3::3 connect-interface LoopBack0
peer 2001:DB8:25::2 as-number 65002
#
ipv4-family unicast
undo synchronization
peer 10.0.25.2 enable
peer 10.10.10.3 enable
peer 10.10.10.3 next-hop-local
#
ipv6-family unicast
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 78


23

undo synchronization
peer 3::3 enable
peer 3::3 next-hop-local
peer 2001:DB8:25::2 enable
#
ospf 1
area 0.0.0.0
network 10.0.45.5 0.0.0.0
network 10.10.10.5 0.0.0.0
#
return

Configuration on S1
#
sysname S1
#
ipv6
#
interface Vlanif1
ipv6 enable
ip address 10.0.11.1 255.255.255.0
ipv6 address 2001:DB8:11::1/64
#
interface GigabitEthernet0/0/1
port link-type access
#
interface LoopBack0
ipv6 enable
ip address 10.0.1.1 255.255.255.255
ipv6 address 2001:DB8::1/128
#
bgp 65001
peer 10.0.11.2 as-number 65100
peer 2001:DB8:11::2 as-number 65100
#
ipv4-family unicast
undo synchronization
network 10.0.1.1 255.255.255.255
peer 10.0.11.2 enable
#
ipv6-family unicast
undo synchronization
network 2001:DB8::1 128
peer 2001:DB8:11::2 enable
#
return

Configuration on S2
#
sysname SW2
#
ipv6
#
interface Vlanif1
ipv6 enable
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 79


23

ip address 10.0.25.2 255.255.255.0


ipv6 address 2001:DB8:25::2/64
#
interface GigabitEthernet0/0/1
port link-type access
#
interface LoopBack0
ipv6 enable
ip address 10.0.2.1 255.255.255.255
ipv6 address 2001:DB8::2/128
#
bgp 65002
peer 10.0.25.5 as-number 65100
peer 2001:DB8:25::5 as-number 65100
#
ipv4-family unicast
undo synchronization
network 10.0.2.1 255.255.255.255
peer 10.0.25.5 enable
#
ipv6-family unicast
undo synchronization
network 2001:DB8::2 128
peer 2001:DB8:25::5 enable
#
return
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 80


23

4 Advanced VLAN Technologies

4.1 Advanced VLAN Technologies


4.1.1 Introduction
4.1.1.1 Objectives
Upon completion of this task, you will be able to:

● Configure VLAN aggregation.


● Configure MUX VLAN.
● Configure proxy ARP to implement communication between sub-VLANs.

4.1.1.2 Networking Topology

Networking of advanced VLAN technologies


1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 81


23

VLAN aggregation is configured on S1 and S2, VLAN 100 is configured as the super-
VLAN, the VLANIF interface on S3 is used as the gateway of R1 and R2, and VLAN 10 and
VLAN 20 are configured as sub-VLANs.

MUX VLAN is configured on S2, and VLAN 200 is configured as the principal VLAN, VLAN
201 as the group VLAN, and VLAN 202 as the separate VLAN.

4.1.1.3 Lab Background


Assume that you are the network administrator of a company. To save the IP address
space of the intranet, you need to deploy VLAN aggregation on the intranet and deploy
MUX VLAN to restrict access between different services.

4.1.2 Lab Configuration


4.1.2.1 Configuration Roadmap
1. Complete basic VLAN aggregation configurations on S1 and S3, and configure IP
addresses for interfaces on R1 and R2 to simulate terminal users.

2. Enable proxy ARP on VLANIF 100 of the super-VLAN on S3 and observe the
communication between R1 and R2.

3. Configure VLAN 200 on S1, S2, and S3 to simulate the communication between the
external network and sub-VLANs.

4. Configure MUX VLAN on S2 and assign IP addresses to interfaces of R3 and R4 to


verify isolation through MUX VLAN.

4.1.2.2 Configuration Procedure

Create sub-VLANs 10 and 20 on S1, add the interfaces connected to R1 and R2 to sub-
VLAN 10 and sub-VLAN 20, create super-VLAN 100 on S3, and create VLANIF 100 as the
gateway. Configure the interconnection interfaces between S1 and S3 as trunk interfaces
and configure the interfaces to allow packets from VLAN 10 and VLAN 20 to pass
through. Configure IP addresses for interfaces on R1 and R2 to simulate terminal users.

# Name the devices.

The configuration details are not provided.

# Disable the interfaces that are not used in this experiment.

The configuration details are not provided.

# Create sub-VLANs on S1.


[S1]vlan batch 10 20

# Add S1's interfaces connected to R1 and R2 to sub-VLANs 10 and 20, respectively.


[S1]interface GigabitEthernet0/0/1
[S1-GigabitEthernet0/0/1] port link-type access
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 82


23

[S1-GigabitEthernet0/0/1] port default vlan 10


[S1-GigabitEthernet0/0/1] quit

[S1]interface GigabitEthernet0/0/2
[S1-GigabitEthernet0/0/2] port link-type access
[S1-GigabitEthernet0/0/2] port default vlan 20
[S1-GigabitEthernet0/0/2] quit

# Create super-VLAN 100 on S3 and associate it with sub-VLANs 10 and 20. (VLANs 10
and 20 must exist on S3.)
[S3]vlan batch 10 20 100

[S3]vlan 100
[S3-vlan100] aggregate-vlan
[S3-vlan100] access-vlan 10 20
[S3-vlan100] quit

# Create VLANIF 100 on S3 as the gateway.


[S3]interface Vlanif 100
[S3-Vlanif100] ip address 172.16.1.254 24
[S3-Vlanif100] quit

# Configure interconnection interfaces between S1 and S3 to allow packets from VLANs


10 and 20.
[S1]interface GigabitEthernet0/0/12
[S1-GigabitEthernet0/0/12] port link-type trunk
[S1-GigabitEthernet0/0/12] port trunk allow-pass vlan 10 20
[S1-GigabitEthernet0/0/12] quit

[S3]interface GigabitEthernet0/0/1
[S3-GigabitEthernet0/0/1] port link-type trunk
[S3-GigabitEthernet0/0/1] port trunk allow-pass vlan 10 20
[S3-GigabitEthernet0/0/1] quit

# Configure IP addresses for interfaces on R1 and R2.


[R1]interface GigabitEthernet0/0/3
[R1-GigabitEthernet0/0/3] ip address 172.16.1.10 255.255.255.0
[R1-GigabitEthernet0/0/3] quit

[R2]interface GigabitEthernet0/0/4
[R2-GigabitEthernet0/0/4] ip address 172.16.1.20 255.255.255.0
[R2-GigabitEthernet0/0/4] quit

# Check the connectivity between R1 and the gateway and between R2 and the gateway.
<S3>ping -c 1 172.16.1.10
PING 172.16.1.10: 56 data bytes, press CTRL_C to break
Reply from 172.16.1.10: bytes=56 Sequence=1 ttl=255 time=110 ms

--- 172.16.1.10 ping statistics ---


1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 110/110/110 ms
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 83


23

<S3>ping -c 1 172.16.1.20
PING 172.16.1.20: 56 data bytes, press CTRL_C to break
Reply from 172.16.1.20: bytes=56 Sequence=1 ttl=255 time=80 ms

--- 172.16.1.20 ping statistics ---


1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 80/80/80 ms

R1 and R2 can communicate with the gateway.

Enable proxy ARP on VLANIF 100 of S3 and observe the communication between sub-
VLANs.

# On R1, test the connectivity with R2.


<R1>ping -c 1 172.16.1.20
PING 172.16.1.20: 56 data bytes, press CTRL_C to break
Request time out

--- 172.16.1.20 ping statistics ---


1 packet(s) transmitted
0 packet(s) received
100.00% packet loss

R1 cannot communicate with R2.

# Check ARP entries on R1 and S3.


<R1>display arp all
IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-
INSTANCE
VLAN/CEVLAN PVC
------------------------------------------------------------------------------
172.16.1.10 5489-98bf-6225 I- GE0/0/3
172.16.1.254 4c1f-ccea-53ea 18 D-0 GE0/0/3
------------------------------------------------------------------------------
Total:2 Dynamic:1 Static:0 Interface:1

In this case, R1 can learn only the ARP entry of VLANIF 100.
<S3>display arp all
IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-
INSTANCE
VLAN/CEVLAN PVC
------------------------------------------------------------------------------
172.16.1.254 4c1f-ccea-53ea I- Vlanif100
172.16.1.10 5489-98bf-6225 15 D-0 GE0/0/1
10
172.16.1.20 5489-982a-0ad0 13 D-0 GE0/0/1
20
------------------------------------------------------------------------------
Total:3 Dynamic:2 Static:0 Interface:1
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 84


23

S3 has ARP entries of R1 and R2. The MAC address of VLANIF 100 is 4c1f-ccea-53ea.

# On S3, enable inter-VLAN proxy ARP on VLANIF 100.


[S3]interface Vlanif 100
[S3-Vlanif100] arp-proxy inter-sub-vlan-proxy enable

# Configure debugging arp process, debugging arp packet, and debugging arp-proxy on
S3 to check the ARP proxy process.
<S3>terminal debugging
<S3>terminal monitor

<S3>debugging arp process


<S3>debugging arp packet
<S3>debugging arp-proxy

# On R1, test the connectivity with R2 again.


<R1>ping -c 1 172.16.1.20
PING 172.16.1.20: 56 data bytes, press CTRL_C to break
Reply from 172.16.1.20: bytes=56 Sequence=1 ttl=254 time=190 ms

--- 172.16.1.20 ping statistics ---


1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 190/190/190 ms

R1 and R2 can communicate with each other.

# Display debugging information on S3.


<S3>
Jul 13 2020 14:44:04.730.1-08:00 S3 ARP/7/arp_rcv:Receive an ARP Packet, operation : 1, sender_eth_addr : 5489-
98bf-6225, sender_ip_addr : 172.16.1.10, target_eth_addr : 0000-0000-0000, target_ip_addr : 172.16.1.20
Jul 13 2020 14:44:04.730.2-08:00 S3 ARP/7/arp_info:ETHARP_ArpInput() Update an ARP entry, IP = 0xa0110ac.
Jul 13 2020 14:44:04.730.3-08:00 S3 ARP/7/eth_proxy_reply:The interface Vlanif100 outputs a proxy reply, origin
VLAN ID is 10, type of proxy is inter-sub-vlan-proxy
Jul 13 2020 14:44:04.730.4-08:00 S3 ARP/7/arp_proxy:Send an ARP Proxy Packet, operation : 2, sender_eth_addr :
4c1f-ccea-53ea,sender_ip_addr : 172.16.1.20, target_eth_addr : 5489-98bf-6225, target_ip_addr : 172.16.1.10

Jul 13 2020 14:44:04.840.1-08:00 S3 ARP/7/arp_rcv:Receive an ARP Packet, operation : 1, sender_eth_addr : 5489-


982a-0ad0, sender_ip_addr : 172.16.1.20, target_eth_addr : 0000-0000-0000, target_ip_addr : 172.16.1.10
Jul 13 2020 14:44:04.840.2-08:00 S3 ARP/7/arp_info:ETHARP_ArpInput() Update an ARP entry, IP = 0x140110ac.
Jul 13 2020 14:44:04.840.3-08:00 S3 ARP/7/eth_proxy_reply:The interface Vlanif100 outputs a proxy reply, origin
VLAN ID is 20, type of proxy is inter-sub-vlan-proxy
Jul 13 2020 14:44:04.840.4-08:00 S3 ARP/7/arp_proxy:Send an ARP Proxy Packet, operation : 2, sender_eth_addr :
4c1f-ccea-53ea,sender_ip_addr : 172.16.1.10, target_eth_addr : 5489-982a-0ad0, target_ip_addr : 172.16.1.20

# Analyze debugging information on S3 step by step.


Jul 13 2020 14:44:04.730.1-08:00 S3 ARP/7/arp_rcv:Receive an ARP Packet, operation : 1, sender_eth_addr : 5489-
98bf-6225, sender_ip_addr : 172.16.1.10, target_eth_addr : 0000-0000-0000, target_ip_addr : 172.16.1.20
Jul 13 2020 14:44:04.730.2-08:00 S3 ARP/7/arp_info:ETHARP_ArpInput() Update an ARP entry, IP = 0xa0110ac.
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 85


23

Jul 13 2020 14:44:04.730.3-08:00 S3 ARP/7/eth_proxy_reply:The interface Vlanif100 outputs a proxy reply, origin
VLAN ID is 10, type of proxy is inter-sub-vlan-proxy
Jul 13 2020 14:44:04.730.4-08:00 S3 ARP/7/arp_proxy:Send an ARP Proxy Packet, operation : 2, sender_eth_addr :
4c1f-ccea-53ea,sender_ip_addr : 172.16.1.20, target_eth_addr : 5489-98bf-6225, target_ip_addr : 172.16.1.10

S3 receives the ARP Request packet from R1 at 172.16.1.10 and requests to resolve the
MAC address of R2 at 172.16.1.20. Proxy ARP allows VLANIF 100 on S3 to respond to the
ARP Request packet from R1. The source MAC address in the ARP Reply packet is 4c1f-
ccea-53ea (MAC address of VLANIF 100), and the source IP address is 172.16.1.20.

After R1 receives the ARP Reply packet, it sends an ICMP packet with destination IP
address 172.16.1.20 and destination MAC address 4c1f-ccea-53ea (MAC address of
VLANIF 100). After receiving the ICMP packet, S3 forwards the packet.
Jul 13 2020 14:44:04.840.1-08:00 S3 ARP/7/arp_rcv:Receive an ARP Packet, operation : 1, sender_eth_addr : 5489-
982a-0ad0, sender_ip_addr : 172.16.1.20, target_eth_addr : 0000-0000-0000, target_ip_addr : 172.16.1.10
Jul 13 2020 14:44:04.840.2-08:00 S3 ARP/7/arp_info:ETHARP_ArpInput() Update an ARP entry, IP = 0x140110ac.
Jul 13 2020 14:44:04.840.3-08:00 S3 ARP/7/eth_proxy_reply:The interface Vlanif100 outputs a proxy reply, origin
VLAN ID is 20, type of proxy is inter-sub-vlan-proxy
Jul 13 2020 14:44:04.840.4-08:00 S3 ARP/7/arp_proxy:Send an ARP Proxy Packet, operation : 2, sender_eth_addr :
4c1f-ccea-53ea,sender_ip_addr : 172.16.1.10, target_eth_addr : 5489-982a-0ad0, target_ip_addr : 172.16.1.20

After receiving the ICMP packet from R1, R2 sends an ARP request to R1 at 172.16.1.20.
After S3 receives the ARP request, proxy ARP enables VLANIF 100 on S3 to respond to the
ARP Request packet from R2. In this case, the source MAC address of the ARP packet is
4c1f-ccea-53ea (MAC address of VLANIF 100), and the source IP address is 172.16.1.10.

R1 and R2 have learned MAC addresses of VLANIF 100 on S3.

# Check ARP entries on R1 and R2.


<R1>display arp all
IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-INSTANCE
VLAN/CEVLAN PVC
------------------------------------------------------------------------------
172.16.1.10 5489-98bf-6225 I- GE0/0/3
172.16.1.254 4c1f-ccea-53ea 3 D-0 GE0/0/3
172.16.1.20 4c1f-ccea-53ea 3 D-0 GE0/0/3
------------------------------------------------------------------------------
Total:3 Dynamic:2 Static:0 Interface:1

<R2>display arp all


IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-INSTANCE
VLAN/CEVLAN PVC
------------------------------------------------------------------------------
172.16.1.20 5489-982a-0ad0 I- GE0/0/4
172.16.1.254 4c1f-ccea-53ea 2 D-0 GE0/0/4
172.16.1.10 4c1f-ccea-53ea 2 D-0 GE0/0/4
------------------------------------------------------------------------------
Total:3 Dynamic:2 Static:0 Interface:1

The peer MAC addresses in the ARP entries learned by R1 and R2 are the MAC address of
VLANIF 100 on S3.
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 86


23

Create VLAN 200 on S1, S2, and S3 and create VLANIF 200 on S3 to simulate Layer 3
communication between sub-VLANs and the external network.

# Create VLAN 200.


[S1]vlan 200

[S2]vlan 200

[S3]vlan 200

# Configure interconnection interfaces between S1 and S3 to allow packets from VLAN


200 to pass through.
[S3]interface GigabitEthernet0/0/1
[S3-GigabitEthernet0/0/1] port link-type trunk
[S3-GigabitEthernet0/0/1] port trunk allow-pass vlan 200
[S3-GigabitEthernet0/0/1] quit

[S1]interface GigabitEthernet0/0/12
[S1-GigabitEthernet0/0/12] port link-type trunk
[S1-GigabitEthernet0/0/12] port trunk allow-pass vlan 200
[S1-GigabitEthernet0/0/12] quit
[S1]interface GigabitEthernet0/0/10
[S1-GigabitEthernet0/0/10] port link-type access
[S1-GigabitEthernet0/0/10] port default vlan 200
[S1-GigabitEthernet0/0/10] quit

Note that GE0/0/10 on S1 is configured as the access interface.

# Create VLANIF 200 on S3 and set its IP address to 172.16.200.xx/24 (x indicates the
device number).
[S3]interface Vlanif200
[S3-Vlanif200] ip address 172.16.200.33 255.255.255.0
[S3-Vlanif200] quit

# Configure static routes to the external network on R1 and R2.


[R1]ip route-static 172.16.200.0 24 172.16.1.254

[R2]ip route-static 172.16.200.0 24 172.16.1.254

Configure MUX VLAN on S2, configure VLAN 200 as the principal VLAN, configure VLAN
201 as the group VLAN, configure VLAN 202 as the separate VLAN, and configure IP
addresses for interfaces on R3 and R4 to verify isolation through MUX VLAN.

# Create VLANs 201 and 202.


[S2]vlan batch 201 202

# Configure VLAN 200 as the principal VLAN, VLAN 201 as the group VLAN, and VLAN
202 as the separate VLAN.
[S2]vlan 200
[S2-vlan200] mux-vlan
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 87


23

[S2-vlan200] subordinate separate 202


[S2-vlan200] subordinate group 201
[S2-vlan200] quit

# Add interfaces to the VLANs and enable the MUX VLAN function.
[S2]interface GigabitEthernet0/0/10
[S2-GigabitEthernet0/0/10] port link-type access
[S2-GigabitEthernet0/0/10] port default vlan 200
[S2-GigabitEthernet0/0/10] port mux-vlan enable
[S2-GigabitEthernet0/0/10] quit
[S2]interface GigabitEthernet0/0/3
[S2-GigabitEthernet0/0/3] port link-type access
[S2-GigabitEthernet0/0/3] port default vlan 201
[S2-GigabitEthernet0/0/3] port mux-vlan enable
[S2-GigabitEthernet0/0/3]quit
[S2]interface GigabitEthernet0/0/4
[S2-GigabitEthernet0/0/4] port link-type access
[S2-GigabitEthernet0/0/4] port default vlan 202
[S2-GigabitEthernet0/0/4] port mux-vlan enable
[S2-GigabitEthernet0/0/4]quit

# Check the MUX VLAN configuration.


[S2]display mux-vlan
Principal Subordinate Type Interface
-----------------------------------------------------------------------------
200 - principal GigabitEthernet0/0/10
200 202 separate GigabitEthernet0/0/4
200 201 group GigabitEthernet0/0/3
-----------------------------------------------------------------------------

# Configure IP addresses for interfaces on R3 and R4.


[R3]interface GigabitEthernet0/0/5
[R3-GigabitEthernet0/0/5] ip address 172.16.200.3 255.255.255.0
[R3-GigabitEthernet0/0/5] quit

[R4]interface GigabitEthernet0/0/5
[R4-GigabitEthernet0/0/5] ip address 172.16.200.4 255.255.255.0
[R4-GigabitEthernet0/0/5] quit

# Configure static routes on R3 and R4 to communicate with the network segment


172.16.1.0/24.
[R3]ip route-static 172.16.1.0 24 172.16.200.33

[R4]ip route-static 172.16.1.0 24 172.16.200.33

# Check the connectivity.


<R3>ping -c 1 172.16.1.10
PING 172.16.1.10: 56 data bytes, press CTRL_C to break
Reply from 172.16.1.10: bytes=56 Sequence=1 ttl=254 time=190 ms

--- 172.16.1.10 ping statistics ---


1 packet(s) transmitted
1 packet(s) received
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 88


23

0.00% packet loss


round-trip min/avg/max = 190/190/190 ms

<R3>ping -c 1 172.16.200.4
PING 172.16.200.4: 56 data bytes, press CTRL_C to break
Request time out

--- 172.16.200.4 ping statistics ---


1 packet(s) transmitted
0 packet(s) received
100.00% packet loss

R3 in the group VLAN can communicate with R1 through the principal VLAN, but cannot
communicate with R4 in the separate VLAN.
<R4>ping -c 1 172.16.1.10
PING 172.16.1.10: 56 data bytes, press CTRL_C to break
Reply from 172.16.1.10: bytes=56 Sequence=1 ttl=254 time=190 ms

--- 172.16.1.10 ping statistics ---


1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 190/190/190 ms

<R4>ping -c 1 172.16.200.3
PING 172.16.200.3: 56 data bytes, press CTRL_C to break
Request time out

--- 172.16.200.3 ping statistics ---


1 packet(s) transmitted
0 packet(s) received
100.00% packet loss

R4 in the separate VLAN can communicate with R1 through the principal VLAN, but
cannot communicate with R3 in the group VLAN.
<R1>ping -c 1 172.16.200.3
PING 172.16.200.3: 56 data bytes, press CTRL_C to break
Reply from 172.16.200.3: bytes=56 Sequence=1 ttl=254 time=110 ms

--- 172.16.200.3 ping statistics ---


1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 110/110/110 ms

<R1>ping -c 1 172.16.200.4
PING 172.16.200.4: 56 data bytes, press CTRL_C to break
Reply from 172.16.200.4: bytes=56 Sequence=1 ttl=254 time=120 ms

--- 172.16.200.4 ping statistics ---


1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 120/120/120 ms
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 89


23

R1 can communicate with R3 and R4 in the group VLAN and separate VLAN through the
principal VLAN.

4.1.3 Quiz
After inter-VLAN proxy ARP is enabled on a VLANIF interface in a super-VLAN, in which
situation will the VLANIF interface respond to ARP Request packets?

4.1.4 Configuration Reference


Configuration on R1
#
sysname R1
#
interface GigabitEthernet0/0/3
ip address 172.16.1.10 255.255.255.0
#
ip route-static 172.16.200.0 255.255.255.0 172.16.1.254

Configuration on R2
#
sysname R2
#
interface GigabitEthernet0/0/4
ip address 172.16.1.20 255.255.255.0
#
ip route-static 172.16.200.0 255.255.255.0 172.16.1.254
#
return

Configuration on R3
#
sysname R3
#
interface GigabitEthernet0/0/5
ip address 172.16.200.3 255.255.255.0
#
ip route-static 172.16.1.0 255.255.255.0 172.16.200.33
#
return

Configuration on R4
#
sysname R4
#
interface GigabitEthernet0/0/5
ip address 172.16.200.4 255.255.255.0
#
ip route-static 172.16.1.0 255.255.255.0 172.16.200.33
#
return
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 90


23

Configuration on S1
#
sysname S1
#
vlan batch 10 20 200
#
interface GigabitEthernet0/0/1
port link-type access
port default vlan 10
#
interface GigabitEthernet0/0/2
port link-type access
port default vlan 20
#
interface GigabitEthernet0/0/10
port link-type access
port default vlan 200
#
interface GigabitEthernet0/0/12
port link-type trunk
port trunk allow-pass vlan 10 20 200
#
return

Configuration on S2
#
sysname S2
#
vlan batch 200 to 202
#
vlan 200
mux-vlan
subordinate separate 202
subordinate group 201
#
interface GigabitEthernet0/0/3
port link-type access
port default vlan 201
port mux-vlan enable
#
interface GigabitEthernet0/0/4
port link-type access
port default vlan 202
port mux-vlan enable
#
interface GigabitEthernet0/0/10
port link-type access
port default vlan 200
port mux-vlan enable
#
ip route-static 172.16.1.0 255.255.255.0 172.16.200.3
#
return
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 91


23

Configuration on S3
#
sysname S3
#
vlan batch 10 20 100 200
#
vlan 100
aggregate-vlan
access-vlan 10 20
#
interface Vlanif100
ip address 172.16.1.254 255.255.255.0
arp-proxy inter-sub-vlan-proxy enable
#
interface Vlanif200
ip address 172.16.200.33 255.255.255.0
#
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 10 20 200
#
return
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 92


23

5 Ethernet Switching Security

5.1 Ethernet Switching Security


5.1.1 Introduction
5.1.1.1 Objectives
Upon completion of this task, you will be able to:

● Configure basic functions of DHCP snooping.


● Configure IP Source Guard (IPSG) to prevent users from changing terminal IP
addresses without permission.
● Configure port security to limit the number of access terminals.
● Configure port isolation to restrict Layer 2 communication between users on the
same network segment.
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 93


23

5.1.1.2 Networking Topology

Networking of Ethernet switching security

R1 and R2 are connected to GE0/0/1 and GE0/0/2 of S1 and are assigned to VLAN 10.
The interfaces connecting S1 and S3 are configured as trunk interfaces and configured to
allow packets from VLAN 10 to pass through.

The DHCP server is configured on S3 to statically assign fixed IP addresses to R1 and R2,
and DHCP snooping, IPSG, port security, and port isolation are configured on S1.

5.1.1.3 Lab Background


You are a network administrator of a company. To improve network security, you need to
deploy the following security technologies on access switches: DHCP snooping, IPSG, port
security, and port isolation.

5.1.2 Lab Configuration


5.1.2.1 Configuration Roadmap
1. Complete basic Layer 2 configurations on S1 and S2, and enable the DHCP service on
S3 to assign fixed IP addresses to R1 and R2.

2. Enable DHCP snooping on S1 and configure the interface connected to S3 as the


trusted interface.

3. Enable IPSG on S1 to check packets against dynamic binding entries generated by


DHCP snooping.
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 94


23

4. Configure port security on S1 to limit the number of MAC addresses learned by the
interface.

5. Configure a port isolation group on S1 to restrict Layer 2 communication between R1


and R2. Configure proxy ARP on VLANIF 10 of S3 to implement mutual access
between R1 and R2.

5.1.2.2 Configuration Procedure

Create VLAN 10 on S1 and add the interfaces connected to R1, R2, and S3 to VLAN 10.
Configure the interfaces connected to R1 and R2 as access interfaces and the interface
connected to S3 as the trunk interface.

Enable the DHCP service on S3 to allocate fixed IP addresses to R1 and R2.

# Name the devices.

The configuration details are not provided.

# Disable the interfaces that are not used in this experiment.

The configuration details are not provided.

# Create VLAN 10 on S1 and S3.


[S1]vlan 10

[S3]vlan 10

# On S1, configure GE0/0/1 and GE0/0/2 as access interfaces and set the PVID to VLAN
10.
[S1]interface GigabitEthernet0/0/1
[S1-GigabitEthernet0/0/1] port link-type access
[S1-GigabitEthernet0/0/1] port default vlan 10
[S1-GigabitEthernet0/0/1] quit

[S1]interface GigabitEthernet0/0/2
[S1-GigabitEthernet0/0/2] port link-type access
[S1-GigabitEthernet0/0/2] port default vlan 10
[S1-GigabitEthernet0/0/2] quit

# Configure GE0/0/12 of S1 as the trunk interface and configure it to allow packets from
VLAN 10 to pass through.
[S1]interface GigabitEthernet0/0/12
[S1-GigabitEthernet0/0/12] port link-type trunk
[S1-GigabitEthernet0/0/12] port trunk allow-pass vlan 10
[S1-GigabitEthernet0/0/12] quit

# Configure GE0/0/1 of S3 as the trunk interface and configure it to allow packets from
VLAN 10 to pass through.
[S3]interface GigabitEthernet0/0/1
[S3-GigabitEthernet0/0/1] port link-type trunk
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 95


23

[S3-GigabitEthernet0/0/1] port trunk allow-pass vlan 10


[S3-GigabitEthernet0/0/1] quit

# Create VLANIF 10 on S3 as the gateway of R1 and R2.


[S3]interface Vlanif10
[S3-Vlanif10] ip address 172.16.10.254 255.255.255.0
[S3-Vlanif10] quit

# Enable the DHCP service on S3 and configure a global address pool to assign fixed IP
addresses to R1 and R2.
[S3]dhcp enable

[S3]ip pool vlan10


[S3-ip-pool-vlan10] gateway-list 172.16.10.254
[S3-ip-pool-vlan10] network 172.16.10.0 mask 255.255.255.0
[S3-ip-pool-vlan10] dns-list 172.16.10.254
[S3-ip-pool-vlan10] quit

# Enable the DHCP server function on VLANIF 10 of S3.


[S3]interface Vlanif 10
[S3-Vlanif10] dhcp select global

# Check MAC addresses of interfaces on R1 and R2.


<R1>display interface GigabitEthernet 0/0/3 | in Hardware
IP Sending Frames' Format is PKTFMT_ETHNT_2, Hardware address is 5489-98bf-6225
Hardware address is 5489-98bf-6225

<R2>display interface GigabitEthernet 0/0/4 | in Hardware


IP Sending Frames' Format is PKTFMT_ETHNT_2, Hardware address is 5489-982a-0ad0

Hardware address is 5489-982a-0ad0

# Configure S3 to assign fixed IP addresses to R1 and R2.


[S3]ip pool vlan10
[S3-ip-pool-vlan10] static-bind ip-address 172.16.10.1 mac-address 5489-98bf-6225
[S3-ip-pool-vlan10] static-bind ip-address 172.16.10.2 mac-address 5489-982a-0ad0

# Configure R1 and R2 to obtain IP addresses through DHCP.


[R1]dhcp enable
[R1]interface GigabitEthernet0/0/3
[R1-GigabitEthernet0/0/3] ip address dhcp-alloc
[R1-GigabitEthernet0/0/3] quit

[R2]dhcp enable
[R2]interface GigabitEthernet0/0/4
[R2-GigabitEthernet0/0/4] ip address dhcp-alloc
[R2-GigabitEthernet0/0/4] quit

# Check the IP address allocation result on R1 and R2.


<R1>display ip interface brief | in GigabitEthernet0/0/3
*down: administratively down
!down: FIB overload down
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 96


23

^down: standby
(l): loopback
(s): spoofing
(d): Dampening Suppressed
The number of interface that is UP in Physical is 2
The number of interface that is DOWN in Physical is 9
The number of interface that is UP in Protocol is 2
The number of interface that is DOWN in Protocol is 9

Interface IP Address/Mask Physical Protocol


GigabitEthernet0/0/3 172.16.10.1/24 up up

<R2>display ip interface brief | in GigabitEthernet0/0/4


*down: administratively down
!down: FIB overload down
^down: standby
(l): loopback
(s): spoofing
(d): Dampening Suppressed
The number of interface that is UP in Physical is 2
The number of interface that is DOWN in Physical is 9
The number of interface that is UP in Protocol is 2
The number of interface that is DOWN in Protocol is 9

Interface IP Address/Mask Physical Protocol


GigabitEthernet0/0/4 172.16.10.2/24 up up

R1 and R2 have successfully obtained fixed IP addresses through DHCP.

To prevent unauthorized DHCP servers from assigning IP addresses, enable DHCP


snooping on S1, configure the interface connected to the DHCP server as the trusted
interface, and enable DHCP snooping on the interface connected to terminals.

# Enable DHCP snooping globally on S1 and configure the interface connected to S3 as


the trusted interface.
[S1]dhcp enable
[S1]dhcp snooping enable ipv4

[S1]interface GigabitEthernet 0/0/12


[S1-GigabitEthernet0/0/12] dhcp snooping trusted
[S1-GigabitEthernet0/0/12] quit

Note that the DHCP function must be enabled first.

# Enable DHCP snooping on S1's interfaces connected to R1 and R2.


[S1]interface GigabitEthernet 0/0/1
[S1-GigabitEthernet0/0/1] dhcp snooping enable
[S1-GigabitEthernet0/0/1] quit
[S1]interface GigabitEthernet 0/0/2
[S1-GigabitEthernet0/0/2] dhcp snooping enable
[S1-GigabitEthernet0/0/2] quit
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 97


23

# Shut down interfaces on R1 and R2, wait for a period of time, and enable the interfaces
again to obtain IP addresses through DHCP.
[R1]interface GigabitEthernet0/0/3
[R1-GigabitEthernet0/0/3] shutdown

[R2]interface GigabitEthernet0/0/4
[R2-GigabitEthernet0/0/4] shutdown

[R1]interface GigabitEthernet0/0/3
[R1-GigabitEthernet0/0/3] undo shutdown

[R2]interface GigabitEthernet0/0/4
[R2-GigabitEthernet0/0/4] undo shutdown

# Check dynamic DHCP snooping entries on S1.


[S1]display dhcp snooping user-bind all
DHCP Dynamic Bind-table:
Flags:O - outer vlan ,I - inner vlan ,P - map vlan
IP Address MAC Address VSI/VLAN(O/I/P) Interface Lease

--------------------------------------------------------------------------------
172.16.10.1 5489-98bf-6225 10 /-- /-- GE0/0/1 2020.07.14-22:42
172.16.10.2 5489-982a-0ad0 10 /-- /-- GE0/0/2 2020.07.14-22:46
--------------------------------------------------------------------------------
print count: 2 total count: 2

In this case, dynamic entries are generated.

Enable IPSG on S1 to prevent terminal users from configuring static IP addresses without
permission, allow hosts to use only the IP addresses allocated by the DHCP server, and
prevent access of unauthorized users.

# Enable IPSG on GE0/0/1 and GE0/0/2 of S1.


[S1]interface GigabitEthernet 0/0/1
[S1-GigabitEthernet0/0/1] ip source check user-bind enable
[S1-GigabitEthernet0/0/1] ip source check user-bind alarm enable
[S1-GigabitEthernet0/0/1] ip source check user-bind alarm threshold 3
[S1-GigabitEthernet0/0/1] quit
[S1]interface GigabitEthernet 0/0/2
[S1-GigabitEthernet0/0/2] ip source check user-bind enable
[S1-GigabitEthernet0/0/2] ip source check user-bind alarm enable
[S1-GigabitEthernet0/0/2] ip source check user-bind alarm threshold 3

Enable the alarm function for IP packet check and set the alarm threshold for the
number of discarded IP packets to 3.

# On R1, test the connectivity of the link between R1 and R5.


<R1>ping -c 1 172.16.10.254
PING 172.16.10.254: 56 data bytes, press CTRL_C to break
Reply from 172.16.10.254: bytes=56 Sequence=1 ttl=255 time=110 ms
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 98


23

--- 172.16.10.254 ping statistics ---


1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 110/110/110 ms

R1 can communicate with the gateway.

# Change the IP address of R1 to 172.16.10.11/24 so that the packets sent by R1 cannot


match dynamic DHCP snooping entries. That is, the packets cannot pass the IPSG check.
[R1]interface GigabitEthernet0/0/3
[R1-GigabitEthernet0/0/3] ip address 172.16.10.11 24

# On R1, test the connectivity with the gateway again.


[R1]ping -c 4 172.16.10.254
PING 172.16.10.254: 56 data bytes, press CTRL_C to break
Request time out
Request time out
Request time out
Request time out

--- 172.16.10.254 ping statistics ---


4 packet(s) transmitted
0 packet(s) received
100.00% packet loss

R1 cannot communicate with the gateway.

# Check the log buffer of S1.


[S1]display logbuffer
Logging buffer configuration and contents : enabled
Allowed max buffer size : 1024
Actual buffer size : 512
Channel number : 4 , Channel name : logbuffer
Dropped messages : 0
Overwritten messages : 0
Current messages : 5

Jul 14 2020 11:53:43 S1 %%01SECE/4/IPSG_DROP_PACKET(l)[0]:IP packets dropped by


IPSG.(SourceInterface=GigabitEthernet0/0/1,DropPacketNumber=4,DropTime=2020/07/14 11:53:43, The most
dropped packet is: VLAN=10, SourceMAC=5489-98bf-6225, SourceIP=172.16.10.11.)

The packets from R1 are discarded by IPSG, and the number of discarded packets is 4,
which exceeds the alarm threshold. An alarm log is generated and can be viewed in the
log buffer.

# Create a static binding entry.


[S1]user-bind static ip-address 172.16.10.11 mac-address 5489-98bf-6225 interface GigabitEthernet 0/0/1 vlan 10

# Check the static binding entry.


[S1]display dhcp static user-bind all
DHCP static Bind-table:
Flags:O - outer vlan ,I - inner vlan ,P - Vlan-mapping
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 99


23

IP Address MAC Address VSI/VLAN(O/I/P) Interface


--------------------------------------------------------------------------------
172.16.10.11 5489-98bf-6225 10 /-- /-- GE0/0/1
--------------------------------------------------------------------------------
Print count: 1 Total count:

# On R1, test the connectivity with the gateway again.


<R1>ping -c 4 172.16.10.254
PING 172.16.10.254: 56 data bytes, press CTRL_C to break
Reply from 172.16.10.254: bytes=56 Sequence=1 ttl=255 time=1 ms
Reply from 172.16.10.254: bytes=56 Sequence=2 ttl=255 time=1 ms
Reply from 172.16.10.254: bytes=56 Sequence=3 ttl=255 time=1 ms
Reply from 172.16.10.254: bytes=56 Sequence=4 ttl=255 time=1 ms

--- 172.16.10.254 ping statistics ---


4 packet(s) transmitted
4 packet(s) received
0.00% packet loss
round-trip min/avg/max = 1/1/1 ms

Because the static binding entry exists, R1 can communicate with the gateway.

To allow only one terminal to connect to an interface of an access switch, enable port
security on the interface of S1 connected to only one terminal. When the number of
terminals connected to the interface exceeds the limit, the packets whose source MAC
addresses are not in the secure MAC address list are discarded and an alarm is generated.

# Enable port security on S1's interface connected to R2.


[S1]interface GigabitEthernet 0/0/2
[S1-GigabitEthernet0/0/2] port-security enable
[S1-GigabitEthernet0/0/2] port-security max-mac-num 1
[S1-GigabitEthernet0/0/2] port-security mac-address sticky
[S1-GigabitEthernet0/0/2] port-security protect-action restrict
[S1-GigabitEthernet0/0/2] quit

# R2 communicates with the gateway to trigger the generation of a sticky MAC address
entry.
<R2>ping -c 1 172.16.10.254
PING 172.16.10.254: 56 data bytes, press CTRL_C to break
Reply from 172.16.10.254: bytes=56 Sequence=1 ttl=255 time=60 ms

--- 172.16.10.254 ping statistics ---


1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 60/60/60 ms

# Check the sticky MAC address entry generated on S1.


<S1>display mac-address sticky
MAC address table of slot 0:
-------------------------------------------------------------------------------
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 100


23

MAC Address VLAN/ PEVLAN CEVLAN Port Type LSP/LSR-ID


VSI/SI MAC-Tunnel
-------------------------------------------------------------------------------
5489-982a-0ad0 10 - - GE0/0/2 sticky -
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 1

# Change the MAC address of the interface on R2.


[R2]interface GigabitEthernet0/0/4
[R2-GigabitEthernet0/0/4] mac-address 0000-0000-0002
[R2-GigabitEthernet0/0/4] quit

# On R2, test the connectivity with the gateway.


<R2>ping -c 1 172.16.10.254
PING 172.16.10.254: 56 data bytes, press CTRL_C to break
Request time out

--- 172.16.10.254 ping statistics ---


1 packet(s) transmitted
0 packet(s) received
100.00% packet loss

S2 cannot communicate with the gateway.

# Check MAC address entries on GE0/0/2 of S1.


<S1>display mac-address sticky
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address VLAN/ PEVLAN CEVLAN Port Type LSP/LSR-ID
VSI/SI MAC-Tunnel
-------------------------------------------------------------------------------
5489-982a-0ad0 10 - - GE0/0/2 sticky -
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 1

There is still only one sticky MAC address entry, and the MAC address manually changed
on the interface of R2 is not learned.

# Change the maximum number of MAC addresses that can be learned by GE0/0/2 of S1
to 2.
[S1]interface GigabitEthernet 0/0/2
[S1-GigabitEthernet0/0/2] port-security max-mac-num 2
[S1-GigabitEthernet0/0/2] quit

# On R2, test the connectivity with the gateway.


<R2>ping -c 1 172.16.10.254
PING 172.16.10.254: 56 data bytes, press CTRL_C to break
Request time out

--- 172.16.10.254 ping statistics ---


1 packet(s) transmitted
0 packet(s) received
100.00% packet loss
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 101


23

In this case, R2 cannot communicate with the gateway due to IPSG configuration.

# Check MAC address entries on GE0/0/2 of S1.


<S1>display mac-address sticky
MAC address table of slot 0:
-------------------------------------------------------------------------------
MAC Address VLAN/ PEVLAN CEVLAN Port Type LSP/LSR-ID
VSI/SI MAC-Tunnel
-------------------------------------------------------------------------------
5489-982a-0ad0 10 - - GE0/0/2 sticky -
0000-0000-0002 10 - - GE0/0/2 sticky -
-------------------------------------------------------------------------------
Total matching items on slot 0 displayed = 2

After the MAC address entry is manually changed on the interface of R2, the interface
learns the sticky MAC address entry.

# Create a static binding entry.


[S1]user-bind static ip-address 172.16.10.2 mac-address 0000-0000-0002 interface GigabitEthernet 0/0/2 vlan 10

# On R2, test the connectivity with the gateway again.


<R2>ping -c 1 172.16.10.254
PING 172.16.10.254: 56 data bytes, press CTRL_C to break
Reply from 172.16.10.254: bytes=56 Sequence=1 ttl=255 time=80 ms

--- 172.16.10.254 ping statistics ---


1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 80/80/80 ms

R2 can communicate with the gateway.

Enable port isolation on S1 to restrict mutual access between R1 and R2.

# Test the connectivity between R1 and R2 before restricting mutual access between R1
and R2.
<R1>ping -c 1 172.16.10.2
PING 172.16.10.2: 56 data bytes, press CTRL_C to break
Reply from 172.16.10.2: bytes=56 Sequence=1 ttl=255 time=70 ms

--- 172.16.10.2 ping statistics ---


1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 70/70/70 ms

# Enable port isolation on S1 and set the isolation mode to Layer 2 isolation and Layer 3
interconnection.
[S1]port-isolate mode l2
[S1]interface GigabitEthernet 0/0/1
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 102


23

[S1-GigabitEthernet0/0/1] port-isolate enable group 1


[S1-GigabitEthernet0/0/1] quit
[S1]interface GigabitEthernet 0/0/2
[S1-GigabitEthernet0/0/2] port-isolate enable group 1
[S1-GigabitEthernet0/0/2] quit

# Test the connectivity between R1 and R2.


<R1>ping -c 1 172.16.10.2
PING 172.16.10.2: 56 data bytes, press CTRL_C to break
Request time out

--- 172.16.10.2 ping statistics ---


1 packet(s) transmitted
0 packet(s) received
100.00% packet loss

R1 and R2 cannot communicate with each other.

# Enable intra-VLAN proxy ARP on VLANIF 10 of S3.


[S3]interface Vlanif 10
[S3-Vlanif10] arp-proxy inner-sub-vlan-proxy enable
[S3-Vlanif10] quit

# Clear ARP entries on R1 and R2.


<R1>reset arp all
Warning: This operation will reset all static and dynamic ARP entries, and clear the configurations of all static ARP,
continue?[Y/N]:y

<R2>reset arp all


Warning: This operation will reset all static and dynamic ARP entries, and clear the configurations of all static ARP,
continue?[Y/N]:y

In this case, R1 and R2 learn ARP entries again. Because proxy ARP is enabled on the
gateway, R1 and R2 can communicate with each other through the gateway.

# Test the connectivity between R1 and R2.


<R1>ping -c 1 172.16.10.2
PING 172.16.10.2: 56 data bytes, press CTRL_C to break
Reply from 172.16.10.2: bytes=56 Sequence=1 ttl=254 time=190 ms

--- 172.16.10.2 ping statistics ---


1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 190/190/190 ms

R1 and R2 can communicate with each other.

# Check ARP entries on R1.


<R1>display arp all
IP ADDRESS MAC ADDRESS EXPIRE(M) TYPE INTERFACE VPN-
INSTANCE
VLAN/CEVLAN PVC
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 103


23

------------------------------------------------------------------------------
172.16.10.11 5489-98bf-6225 I- GE0/0/3
172.16.10.254 4c1f-ccea-53ea 14 D-0 GE0/0/3
172.16.10.2 4c1f-ccea-53ea 14 D-0 GE0/0/3
------------------------------------------------------------------------------
Total:3 Dynamic:2 Static:0 Interface:1

The command output shows that MAC addresses mapping 172.16.10.2 and 172.16.10.254
in the ARP entries are the same.

5.1.3 Quiz
After port isolation is configured, the gateway functions as a proxy to implement
communication on the same network segment. What are the advantages and
disadvantages of this mode?

5.1.4 Configuration Reference


Configuration on R1
#
sysname R1
#
interface GigabitEthernet0/0/3
ip address 172.16.10.11 255.255.255.0
#
return

Configuration on R2
#
sysname R2
#
interface GigabitEthernet0/0/4
mac-address 0000-0000-0002
ip address dhcp-alloc
#
return

Configuration on S1
#
sysname S1
#
vlan batch 10
#
port-isolate mode all
#
dhcp enable
#
dhcp snooping enable ipv4
user-bind static ip-address 172.16.10.11 mac-address 5489-98bf-6225 interface GigabitEthernet0/0/1 vlan 10
user-bind static ip-address 172.16.10.2 mac-address 0000-0000-0002 interface GigabitEthernet0/0/2 vlan 10
#
interface GigabitEthernet0/0/1
port link-type access
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 104


23

port default vlan 10


port-isolate enable group 1
ip source check user-bind enable
ip source check user-bind alarm enable
ip source check user-bind alarm threshold 3
dhcp snooping enable
#
interface GigabitEthernet0/0/2
port link-type access
port default vlan 10
port-security enable
port-security max-mac-num 2
port-security mac-address sticky
port-isolate enable group 1
ip source check user-bind enable
ip source check user-bind alarm enable
ip source check user-bind alarm threshold 3
dhcp snooping enable
#
interface GigabitEthernet0/0/12
port link-type trunk
port trunk allow-pass vlan 10
dhcp snooping trusted
#
return

Configuration on S3
#
sysname S3
#
vlan batch 10
#
dhcp enable
#
ip pool vlan10
gateway-list 172.16.10.254
network 172.16.10.0 mask 255.255.255.0
static-bind ip-address 172.16.10.1 mac-address 5489-98bf-6225
static-bind ip-address 172.16.10.2 mac-address 5489-982a-0ad0
dns-list 172.16.10.254
#
interface Vlanif10
ip address 172.16.10.254 255.255.255.0
arp-proxy inner-sub-vlan-proxy enable
dhcp select global
#
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 10
#
return
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 105


23

6 BGP/MPLS IP VPN

6.1 BGP/MPLS IP VPN


6.1.1 Introduction
6.1.1.1 Objectives
Upon completion of this task, you will be able to:

● Configure MPLS.
● Configure MPLS LDP.
● Configure MPLS VPN.

6.1.1.2 Networking Topology

Networking of BGP/MPLS IP VPN

Figure 6-1 shows IP addresses of interconnection interfaces and BGP AS numbers. R3 is a


VPN RR, and R2 and R4 are clients of R3. In BGP AS 65100, IS-IS is used to build the
underlying network.

R2 and R4 are PEs of the MPLS VPN network, R1 and R5 are CEs of the finance VPN, and
R1, S1, and S2 are CEs of the OA VPN.

6.1.1.3 Lab Background


An enterprise network has one headquarters and three branches. Branch1 mainly
provides financial services, and Branch2 and Branch3 mainly provide enterprise office
services.
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 106


23

The enterprise headquarters needs to receive routing entries of Branch1, Branch2, and
Branch3. Branch1 is not allowed to receive routing entries of Branch2 and Branch3.

The enterprise backbone network is large, so the VPN RR needs to be used to simplify the
configuration.

6.1.2 Lab Configuration


6.1.2.1 Configuration Roadmap
1. Configure IP addresses for devices.

2. Deploy IS-IS on the backbone network to build the underlying network.

3. Properly plan the RT and RD of the VPN instance and bind the VPN to the
corresponding interface on the PE.

4. Deploy MPLS and MPLS LDP on the backbone network.

5. Create VPNv4 IBGP peers on the backbone network.

6. Advertise routing entries in the finance VPN.

7. Advertise routing entries in the OA VPN.

6.1.2.2 Configuration Procedure

# Name the devices.

The configuration details are not provided.

# Disable the interfaces that are not used in this experiment.

The configuration details are not provided.

# Configure IP addresses for GE0/0/2 and Loopback0 on R1.


[R1]interface LoopBack0
[R1-LoopBack0] ip address 10.0.1.1 255.255.255.255
[R1-LoopBack0] quit
[R1]interface GigabitEthernet0/0/2
[R1-GigabitEthernet0/0/2] ip address 10.0.12.1 255.255.255.0
[R1-GigabitEthernet0/0/2] quit

# Configure IP addresses for GE0/0/1, GE0/0/2, and Loopback0 on R2. GE0/0/3 and
GE0/0/4 need to be bound to a VPN instance, so no IP address is assigned to them.
[R2]interface LoopBack0
[R2-LoopBack0] ip address 10.10.10.2 255.255.255.255
[R2-LoopBack0] quit
[R2]interface GigabitEthernet0/0/1
[R2-GigabitEthernet0/0/1] ip address 10.0.24.2 255.255.255.0
[R2-GigabitEthernet0/0/1] quit
[R2]interface GigabitEthernet0/0/2
[R2-GigabitEthernet0/0/2] ip address 10.0.23.2 255.255.255.0
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 107


23

[R2-GigabitEthernet0/0/2] quit

# Configure IP addresses for GE0/0/2, GE0/0/3, and Loopback0 on R3.


[R3]interface LoopBack0
[R3-LoopBack0] ip address 10.10.10.3 255.255.255.255
[R3-LoopBack0]quit
[R3]interface GigabitEthernet0/0/2
[R3-GigabitEthernet0/0/2] ip address 10.0.34.3 255.255.255.0
[R3-GigabitEthernet0/0/2] quit
[R3]interface GigabitEthernet0/0/3
[R3-GigabitEthernet0/0/3]ip address 10.0.23.3 255.255.255.0
[R3-GigabitEthernet0/0/3]quit

# Assign IP addresses to GE0/0/1, GE0/0/3, and Loopback0 on R4. GE0/0/2 and GE0/0/5
need to be bound to a VPN instance, so no IP address is assigned to them.
[R4]interface LoopBack0
[R4-LoopBack0] ip address 10.10.10.4 255.255.255.255
[R4-LoopBack0] quit
[R4]interface GigabitEthernet0/0/1
[R4-GigabitEthernet0/0/1] ip address 10.0.24.4 255.255.255.0
[R4-GigabitEthernet0/0/1] quit
[R4]interface GigabitEthernet0/0/3
[R4-GigabitEthernet0/0/3] ip address 10.0.34.4 255.255.255.0
[R4-GigabitEthernet0/0/3] quit

# Configure IP addresses for GE0/0/3 and Loopback0 on R5.


[R5]interface LoopBack0
[R5-LoopBack0] ip address 10.0.1.2 255.255.255.255
[R5-LoopBack0] quit
[R5]interface GigabitEthernet0/0/3
[R5-GigabitEthernet0/0/3] ip address 10.0.45.5 255.255.255.0
[R5-GigabitEthernet0/0/3] quit

# Configure the VLAN to which GE0/0/2 of S1 belongs and IP addresses for VLANIF 1 and
Loopback0.
[S1]interface LoopBack0
[S1-LoopBack0] ip address 10.0.2.1 255.255.255.255
[S1-LoopBack0] quit
[S1]interface GigabitEthernet0/0/2
[S1-GigabitEthernet0/0/2] port link-type access
[S1-GigabitEthernet0/0/2] port default vlan 1
[S1-GigabitEthernet0/0/2] quit
[S1]interface Vlanif 1
[S1-Vlanif1] ip address 10.1.21.1 24
[S1-Vlanif1] quit

# Configure the VLAN to which GE0/0/4 of S2 belongs and IP addresses for VLANIF 1 and
Loopback0.
[S2]interface LoopBack0
[S2-LoopBack0] ip address 10.0.2.2 255.255.255.255
[S2-LoopBack0] quit
[S2]interface GigabitEthernet0/0/4
[S2-GigabitEthernet0/0/4] port link-type access
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 108


23

[S2-GigabitEthernet0/0/4] port default vlan 1


[S2-GigabitEthernet0/0/4] quit
[S2]interface Vlanif 1
[S2-Vlanif1] ip address 10.0.42.2 24
[S2-Vlanif1] quit

Deploy IS-IS processes on R2, R3, and R4 based on the topology design. Set the process
ID to 1, configure R2, R3, and R4 as Level-2 routers, set the cost type to wide, set the
area ID of the NET to 49.0001, set the system ID based on the loopback interface, and set
the IS-IS host name to be the same as the device name.

# Configure IS-IS on R2.


[R2]isis 1
[R2-isis-1] is-level level-2
[R2-isis-1] cost-style wide
[R2-isis-1] network-entity 49.0001.0100.1001.0002.00
[R2-isis-1] is-name R2
[R2-isis-1] quit
[R2]interface LoopBack0
[R2-LoopBack0] isis enable 1
[R2-LoopBack0] quit
[R2]interface GigabitEthernet0/0/1
[R2-GigabitEthernet0/0/1] isis enable 1
[R2-GigabitEthernet0/0/1] quit
[R2]interface GigabitEthernet0/0/2
[R2-GigabitEthernet0/0/2] isis enable 1
[R2-GigabitEthernet0/0/2] quit

# Configure IS-IS on R3.


[R3]isis 1
[R3-isis-1] is-level level-2
[R3-isis-1] cost-style wide
[R3-isis-1] network-entity 49.0001.0100.1001.0003.00
[R3-isis-1] is-name R3
[R3-isis-1] quit
[R3]interface LoopBack0
[R3-LoopBack0] isis enable 1
[R3-LoopBack0] quit
[R3]interface GigabitEthernet0/0/2
[R3-GigabitEthernet0/0/2] isis enable 1
[R3-GigabitEthernet0/0/2] quit
[R3]interface GigabitEthernet0/0/3
[R3-GigabitEthernet0/0/3] isis enable 1
[R3-GigabitEthernet0/0/3] quit

# Configure IS-IS on R4.


[R4]isis 1
[R4-isis-1] is-level level-2
[R4-isis-1] cost-style wide
[R4-isis-1] network-entity 49.0001.0100.1001.0004.00
[R4-isis-1] is-name R4
[R4-isis-1] quit
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 109


23

[R4]interface LoopBack0
[R4-LoopBack0] isis enable 1
[R4-LoopBack0] quit
[R4]interface GigabitEthernet0/0/1
[R4-GigabitEthernet0/0/1] isis enable 1
[R4-GigabitEthernet0/0/1] quit
[R4]interface GigabitEthernet0/0/3
[R4-GigabitEthernet0/0/3] isis enable 1
[R4-GigabitEthernet0/0/3] quit

Check the IS-IS configuration.

# Check the IS-IS neighbor relationship on R3.


[R3]display isis peer

Peer information for ISIS(1)

System Id Interface Circuit Id State HoldTime Type PRI1


-------------------------------------------------------------------------------
R4* GE0/0/2 R4.02 Up 8s L2 64
R2* GE0/0/3 R2.02 Up 9s L2 64

Total Peer(s): 2

[R3]display isis interface

Interface information for ISIS(1)


---------------------------------
Interface Id IPV4.State IPV6.State MTU Type DIS
GE0/0/2 001 Up Up 1497 L1/L2 No/No
GE0/0/3 002 Up Up 1497 L1/L2 No/No
Loop0 001 Up Up 1500 L1/L2–

# Check the IPv4 IS-IS routing table on each router. R3 is used as the example.
[R3]display isis route

Route information for ISIS(1)


-----------------------------

ISIS(1) Level-2 Forwarding Table


--------------------------------

IPV4 Destination IntCost ExtCost ExitInterface NextHop Flags


-------------------------------------------------------------------------------
10.0.24.0/24 20 NULL GE0/0/2 10.0.34.4 A/-/-/-
GE0/0/3 10.0.23.2
10.10.10.3/32 0 NULL Loop0 Direct D/-/L/-
10.10.10.2/32 10 NULL GE0/0/3 10.0.23.2 A/-/-/-
10.0.23.0/24 10 NULL GE0/0/3 Direct D/-/L/-
10.0.34.0/24 10 NULL GE0/0/2 Direct D/-/L/-
10.10.10.4/32 10 NULL GE0/0/2 10.0.34.4 A/-/-/-

Flags: D-Direct, A-Added to URT, L-Advertised in LSPs, S-IGP Shortcut,


U-Up/DownBit Set
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 110


23

The command output shows that IPv4 and IPv6 routes have been learned by the router.

RDs and RTs need to be planned for VPN instances.

RDs can be used to identify duplicate routes and identify the areas from which routes are
originated.

The RD of the route from the headquarters is 65100:12.

The RD of the route from Branch1 is 65100:1.

The RD of the route from Branch2 is 65001:2.

The RD of the route from Branch3 is 65002:2.

RTs need to be planned based on service requirements. The headquarters needs to


communicate with Branch1, the headquarters, Branch2, and Branch3 need to
communicate with each other, and Branch1 cannot communicate with Branch2 or
Branch3.

The export RTs of the routes from the headquarters are 65100:12 and 65001:65002, and
import RTs are 65100:12 and 65001:65002.

The export RT and IRT of the routes from Branch1 are 65100:12 and 65100:12,
respectively.

The export RT and import RT of the routes from Branch2 are 65001:65002 and
65001:65002, respectively.

The export RT and import RT of the routes from Branch3 are 65001:65002 and
65001:65002, respectively.

# On R2, configure VPN instances, bind interfaces to VPN instances, and configure IP
addresses for the interfaces.
[R2]ip vpn-instance Finance&OA
[R2-vpn-instance-Finance&OA] route-distinguisher 65100:12
[R2-vpn-instance-Finance&OA-af-ipv4] vpn-target 65100:12 65001:65002
[R2-vpn-instance-Finance&OA-af-ipv4] quit
[R2]ip vpn-instance OA
[R2-vpn-instance-OA]
[R2-vpn-instance-OA] route-distinguisher 65001:2
[R2-vpn-instance-OA-af-ipv4] vpn-target 65001:65002
[R2-vpn-instance-OA-af-ipv4] quit
[R2]interface GigabitEthernet0/0/3
[R2-GigabitEthernet0/0/3] ip binding vpn-instance Finance&OA
[R2-GigabitEthernet0/0/3] ip address 10.0.12.2 255.255.255.0
[R2-GigabitEthernet0/0/3] quit
[R2]interface GigabitEthernet0/0/4
[R2-GigabitEthernet0/0/4] ip binding vpn-instance OA
[R2-GigabitEthernet0/0/4] ip address 10.0.21.2 255.255.255.0
[R2-GigabitEthernet0/0/4] quit

# On R4, configure VPN instances, bind interfaces to VPN instances, and configure IP
addresses for the interfaces.
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 111


23

[R4]ip vpn-instance Finance


[R4-vpn-instance-Finance] route-distinguisher 65100:1
[R4-vpn-instance-Finance -af-ipv4] vpn-target 65100:12
[R4-vpn-instance-Finance -af-ipv4] quit
[R4]ip vpn-instance OA
[R4-vpn-instance-OA] route-distinguisher 65002:2
[R4-vpn-instance-OA-af-ipv4] vpn-target 65001:65002
[R4-vpn-instance-OA-af-ipv4] quit
[R4]interface GigabitEthernet0/0/2
[R4-GigabitEthernet0/0/2] ip binding vpn-instance Finance
[R4-GigabitEthernet0/0/2] ip address 10.0.45.4 255.255.255.0
[R4-GigabitEthernet0/0/2] quit
[R4]interface GigabitEthernet0/0/5
[R4-GigabitEthernet0/0/5] ip binding vpn-instance OA
[R4-GigabitEthernet0/0/5] ip address 10.0.42.4 255.255.255.0
[R4-GigabitEthernet0/0/5] quit

Check the VPN instance configuration.

# Check the VPN instance configuration on each PE. R2 is used as an example.


[R2]display current-configuration section vpn-instance
#
ip vpn-instance Finance&OA
ipv4-family
route-distinguisher 65100:1
vpn-target 65100:12 65001:65002 export-extcommunity
vpn-target 65100:12 65001:65002 import-extcommunity
#
ip vpn-instance OA
ipv4-family
route-distinguisher 65001:2
vpn-target 65001:65002 export-extcommunity
vpn-target 65001:65002 import-extcommunity

# Check VPN instance binding information on the PE. R2 is used as an example.


[R2]display ip vpn-instance interface
Total VPN-Instances configured :2

VPN-Instance Name and ID : Finance&OA, 1


Interface Number : 1
Interface list : GigabitEthernet0/0/3

VPN-Instance Name and ID : OA, 2


Interface Number : 1
Interface list : GigabitEthernet0/0/4

The preceding command output helps you can check whether VPN instances are correctly
configured and whether interfaces are correctly bound to VPN instances.

MPLS and MPLS LDP need to be configured on the BGP/MPLS IP VPN data forwarding
path.
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 112


23

In this experiment, the path R2 -> R4 is the active path, and the path R2 -> R3 -> R4 is
the standby path. Therefore, MPLS and MPLS LDP must be enabled on R2, R3, R4, and
interfaces connecting R2, R3, and R4.

The IP address of the loopback interface is used as the MPLS LSR ID.

# Configure MPLS on R2.


[R2]mpls lsr-id 10.10.10.2
[R2]mpls
[R2-mpls] quit
[R2]mpls ldp
[R2-mpls-ldp] quit
[R2]interface GigabitEthernet0/0/1
[R2-GigabitEthernet0/0/1] mpls
[R2-GigabitEthernet0/0/1] mpls ldp
[R2-GigabitEthernet0/0/1] quit
[R2]interface GigabitEthernet0/0/2
[R2-GigabitEthernet0/0/2] mpls
[R2-GigabitEthernet0/0/2] mpls ldp
[R2-GigabitEthernet0/0/2] quit

# Configure MPLS on R3.


[R3]mpls lsr-id 10.10.10.3
[R3]mpls
[R3-mpls] quit
[R3]mpls ldp
[R3-mpls-ldp] quit
[R3]interface GigabitEthernet0/0/2
[R3-GigabitEthernet0/0/2] mpls
[R3-GigabitEthernet0/0/2] mpls ldp
[R3-GigabitEthernet0/0/2] quit
[R3]interface GigabitEthernet0/0/3
[R3-GigabitEthernet0/0/3] mpls
[R3-GigabitEthernet0/0/3] mpls ldp
[R3-GigabitEthernet0/0/3] quit

# Configure MPLS on R4.


[R4]mpls lsr-id 10.10.10.4
[R4]mpls
[R4-mpls] quit
[R4]mpls ldp
[R4-mpls-ldp] quit
[R4]interface GigabitEthernet0/0/1
[R4-GigabitEthernet0/0/1] mpls
[R4-GigabitEthernet0/0/1] mpls ldp
[R4-GigabitEthernet0/0/1] quit
[R4]interface GigabitEthernet0/0/3
[R4-GigabitEthernet0/0/3] mpls
[R4-GigabitEthernet0/0/3] mpls ldp
[R4-GigabitEthernet0/0/3] quit

Check the MPLS configuration.

# Check information about LDP peers on R3.


1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 113


23

[R3]display mpls ldp peer

LDP Peer Information in Public network


A '*' before a peer means the peer is being deleted.
------------------------------------------------------------------------------
PeerID TransportAddress DiscoverySource
------------------------------------------------------------------------------
10.10.10.2:0 10.10.10.2 GigabitEthernet0/0/3
10.10.10.4:0 10.10.10.4 GigabitEthernet0/0/2
------------------------------------------------------------------------------
TOTAL: 2 Peer(s) Found.

# Check information about LSPs on R3.


[R3]display mpls lsp
--------------------------------------------------------------------------------------------------------
LSP Information: LDP LSP
--------------------------------------------------------------------------------------------------------
FEC In/Out Label In/Out IF Vrf Name
10.10.10.2/32 NULL/3 -/GE0/0/3
10.10.10.2/32 1024/3 -/GE0/0/3
10.10.10.3/32 3/NULL -/-
10.10.10.4/32 NULL/3 -/GE0/0/2
10.10.10.4/32 1025/3 -/GE0/0/2

The command output shows that an LDP LSP has been established.

Establish IBGP VPNv4 peer relationships in AS 65100, configure R3 as the VPN RR, and
configure R2 and R4 as clients of R3.

As AS 65100 only needs to transmit VPNv4 routes, so IPv4 IBGP peer relationships can be
not established.

When R3 functions as a VPN RR, the RT filtering function needs to be disabled because
no VPN instance is configured.

# Configure a VPNv4 IBGP peer on R2.


[R2]bgp 65100
[R2-bgp] undo default ipv4-unicast
[R2-bgp] peer 10.10.10.3 as-number 65100
[R2-bgp] peer 10.10.10.3 connect-interface LoopBack0
[R2-bgp] ipv4-family vpnv4
[R2-bgp-af-vpnv4] peer 10.10.10.3 enable
[R2-bgp-af-vpnv4] quit

# Configure a VPNv4 IBGP peer on R3. The RT filtering function needs to be disabled on
R3 that functions as the VPN RR.
[R3]bgp 65100
[R3-bgp] undo default ipv4-unicast
[R3-bgp] peer 10.10.10.2 as-number 65100
[R3-bgp] peer 10.10.10.2 connect-interface LoopBack0
[R3-bgp] peer 10.10.10.4 as-number 65100
[R3-bgp] peer 10.10.10.4 connect-interface LoopBack0
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 114


23

[R3-bgp] ipv4-family vpnv4


[R3-bgp-af-vpnv4] undo policy vpn-target
[R3-bgp-af-vpnv4] peer 10.10.10.2 enable
[R3-bgp-af-vpnv4] peer 10.10.10.2 reflect-client
[R3-bgp-af-vpnv4] peer 10.10.10.4 enable
[R3-bgp-af-vpnv4] peer 10.10.10.4 reflect-client
[R3-bgp-af-vpnv4] quit

# Configure a VPNv4 IBGP peer on R4.


[R4]bgp 65100
[R4-bgp] undo default ipv4-unicast
[R4-bgp] peer 10.10.10.3 as-number 65100
[R4-bgp] peer 10.10.10.3 connect-interface LoopBack0
[R4-bgp] ipv4-family vpnv4
[R4-bgp-af-vpnv4] peer 10.10.10.3 enable
[R4-bgp-af-vpnv4] quit

Check the BGP configuration.

# Check the BGP VPNv4 peer on R3.


[R3-bgp]display bgp vpnv4 all peer

BGP local router ID : 10.10.10.3


Local AS number : 65100
Total number of peers : 2 Peers in established state : 2

Peer V AS MsgRcvd MsgSent OutQ Up/Down State PrefRcv

10.10.10.2 4 65100 312 320 0 05:04:45 Established 0


10.10.10.4 4 65100 311 316 0 05:04:40 Established 0

The command output shows that an IBGP VPNv4 peer relationship has been established.

R1 and R5 function as CEs and use OSPF to send routes of Loopback0 to PEs. Then PEs
exchange routes.

Set the process ID to 1, area ID to 0, and router ID to the loopback interface's IP address
of the router. R2 with the router ID of 10.10.10.2 is used as an example.

# Establish an OSPF neighbor relationship between R1 (CE) and R2 (PE).


[R1]router id 10.10.10.1
[R1]ospf 1
[R1-ospf-1] area 0
[R1-ospf-1-area-0.0.0.0] network 10.0.1.1 0.0.0.0
[R1-ospf-1-area-0.0.0.0] network 10.0.12.1 0.0.0.0

[R2]router id 10.10.10.2
[R2]ospf 1 vpn-instance Finance&OA
[R2-ospf-1] area 0
[R2-ospf-1-area-0.0.0.0] network 10.0.12.2 0.0.0.0
[R2-ospf-1-area-0.0.0.0] quit

# Establish an OSPF neighbor relationship between R4 (CE) and R5 (PE).


1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 115


23

[R5]router id 10.10.10.5
[R5]ospf 1
[R5-ospf-1] area 0
[R5-ospf-1-area-0.0.0.0] network 10.0.1.2 0.0.0.0
[R5-ospf-1-area-0.0.0.0] network 10.0.45.5 0.0.0.0

[R4]router id 10.10.10.4
[R4]ospf 1 vpn-instance Finance
[R4-ospf-1] area 0
[R4-ospf-1-area-0.0.0.0] network 10.0.45.4 0.0.0.0
[R4-ospf-1-area-0.0.0.0] quit

# Configure R2 and R4 to import routes from each other.


[R2]ospf 1 vpn-instance Finance&OA
[R2-ospf-1] import-route bgp
[R2-ospf-1] quit
[R2]bgp 65100
[R2-bgp] ipv4-family vpn-instance Finance&OA
[R2-bgp-Finance&OA] network 10.0.1.1 32

[R4]ospf 1 vpn-instance Finance


[R4-ospf-1] import-route bgp
[R4-ospf-1] quit
[R4]bgp 65100
[R4-bgp] ipv4-family vpn-instance Finance
[R4-bgp-Finance&OA] network 10.0.1.2 32

Check the configuration.

# Check routing tables on R1 and R5. R1 is used as an example.


[R1]display ip routing-table
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: Public
Destinations: 9 Routes : 9

Destination/Mask Proto Pre Cost Flags NextHop Interface

10.0.1.1/32 Direct 0 0 D 127.0.0.1 LoopBack0


10.0.1.2/32 OSPF 10 3 D 10.0.12.2 GigabitEthernet0/0/2
10.0.12.0/24 Direct 0 0 D 10.0.12.1 GigabitEthernet0/0/2
10.0.12.1/32 Direct 0 0 D 127.0.0.1 GigabitEthernet0/0/2
10.0.12.255/32 Direct 0 0 D 127.0.0.1 GigabitEthernet0/0/2
127.0.0.0/8 Direct 0 0 D 127.0.0.1 InLoopBack0
127.0.0.1/32 Direct 0 0 D 127.0.0.1 InLoopBack0
127.255.255.255/32 Direct 0 0 D 127.0.0.1 InLoopBack0
255.255.255.255/32 Direct 0 0 D 127.0.0.1 InLoopBack0

# Test the connectivity between Loopback0 interfaces of R1 and R5.


[R1]ping -a 10.0.1.1 10.0.1.2
PING 10.0.1.2: 56 data bytes, press CTRL_C to break
Reply from 10.0.1.2: bytes=56 Sequence=1 ttl=253 time=60 ms

--- 10.0.1.2 ping statistics ---


1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 116


23

1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 30/40/60 ms

The preceding information shows that connectivity on the network segment of the
finance VPN is achieved.

S1 and S2 function as CEs and use BGP to send routes of Loopback0 interfaces to PEs.
The PEs then advertise routes to each other.

# Establish a BGP peer relationship between S1 (CE) and R2 (PE) and advertise routes.
[S1]bgp 65001
[S1-bgp] peer 10.0.21.2 enable
[S1-bgp] network 10.0.2.1 32
[S1-bgp] quit

[R2]bgp 65100
[R2-bgp] ipv4 vpn-instance OA
[R2-bgp-OA] peer 10.0.21.1 as-number 65001
[R2-bgp-OA] quit

# Establish a BGP peer relationship between S2 (CE) and R4 (PE) and advertise routes.
[S2]bgp 65002
[S2-bgp] peer 10.0.42.4 enable
[S2-bgp] network 10.0.2.2 32
[S2-bgp] quit

[R4]bgp 65100
[R4-bgp] ipv4 vpn-instance OA
[R4-bgp-OA] peer 10.0.42.2 as-number 65002
[R4-bgp-OA] quit

Check the configuration.

# Check routing tables on R1, S1, and S2. R1 is used as an example.


[R1]display ip routing-table
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: Public
Destinations: 9 Routes : 9

Destination/Mask Proto Pre Cost Flags NextHop Interface

10.0.1.1/32 Direct 0 0 D 127.0.0.1 LoopBack0


10.0.1.2/32 OSPF 10 3 D 10.0.12.2 GigabitEthernet0/0/2
10.0.2.1/32 O_ASE 150 1 D 10.0.12.2 GigabitEthernet0/0/2
10.0.2.2/32 O_ASE 150 1 D 10.0.12.2 GigabitEthernet0/0/2
10.0.12.0/24 Direct 0 0 D 10.0.12.1 GigabitEthernet0/0/2
10.0.12.1/32 Direct 0 0 D 127.0.0.1 GigabitEthernet0/0/2
10.0.12.255/32 Direct 0 0 D 127.0.0.1 GigabitEthernet0/0/2
127.0.0.0/8 Direct 0 0 D 127.0.0.1 InLoopBack0
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 117


23

127.0.0.1/32 Direct 0 0 D 127.0.0.1 InLoopBack0


127.255.255.255/32 Direct 0 0 D 127.0.0.1 InLoopBack0
255.255.255.255/32 Direct 0 0 D 127.0.0.1 InLoopBack0

# Test the connectivity between Loopback0 interfaces of R1 and S2.


<R1>ping -a 10.0.1.1 10.0.2.2
PING 10.0.2.2: 56 data bytes, press CTRL_C to break
Reply from 10.0.2.2: bytes=56 Sequence=1 ttl=253 time=50 ms

--- 10.0.2.2 ping statistics ---


1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 30/42/50 ms

# Test the connectivity between Loopback0 interfaces of S1 and S2.


[S1]ping -a 10.0.2.1 10.0.2.2
PING 10.0.2.2: 56 data bytes, press CTRL_C to break
Reply from 10.0.2.2: bytes=56 Sequence=1 ttl=253 time=50 ms

--- 10.0.2.2 ping statistics ---


1 packet(s) transmitted
1 packet(s) received
0.00% packet loss
round-trip min/avg/max = 50/60/70 ms

# Test the connectivity between Loopback0 interfaces of S1 and R5.


[S1]ping -a 10.0.2.1 10.0.1.2
PING 10.0.1.2: 56 data bytes, press CTRL_C to break
Request time out
Request time out
Request time out
Request time out
Request time out

--- 10.0.1.2 ping statistics ---


5 packet(s) transmitted
0 packet(s) received
100.00% packet loss

According to the preceding information, S1 and S2 can communicate with R1 in the OA


VPN, but S1 and S2 cannot communicate with R5 in the finance VPN.

6.1.3 Quiz
If R5 needs to communicate with S1 and S2, how do we modify the VPN instance
configuration?

6.1.4 Configuration Reference


Configuration on R1
#
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 118


23

sysname R1
#
router id 10.10.10.1
#
interface GigabitEthernet0/0/2
ip address 10.0.12.1 255.255.255.0
#
interface LoopBack0
ip address 10.0.1.1 255.255.255.255
#
ospf 1
area 0.0.0.0
network 10.0.1.1 0.0.0.0
network 10.0.12.1 0.0.0.0
#
return

Configuration on R2
#
sysname R2
#
router id 10.10.10.2
#
ip vpn-instance Finance&OA
ipv4-family
route-distinguisher 65100:12
vpn-target 65100:12 65001:65002 export-extcommunity
vpn-target 65100:12 65001:65002 import-extcommunity
#
ip vpn-instance OA
ipv4-family
route-distinguisher 65001:2
vpn-target 65001:65002 export-extcommunity
vpn-target 65001:65002 import-extcommunity
#
mpls lsr-id 10.10.10.2
mpls
#
mpls ldp
#
isis 1
is-level level-2
cost-style wide
network-entity 49.0001.0100.1001.0002.00
is-name R2
#
interface GigabitEthernet0/0/1
ip address 10.0.24.2 255.255.255.0
isis enable 1
mpls
mpls ldp
#
interface GigabitEthernet0/0/2
ip address 10.0.23.2 255.255.255.0
isis enable 1
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 119


23

mpls
mpls ldp
#
interface GigabitEthernet0/0/3
ip binding vpn-instance Finance&OA
ip address 10.0.12.2 255.255.255.0
#
interface GigabitEthernet0/0/4
ip binding vpn-instance OA
ip address 10.0.21.2 255.255.255.0
#
interface LoopBack0
ip address 10.10.10.2 255.255.255.255
isis enable 1
#
bgp 65100
undo default ipv4-unicast
peer 10.10.10.3 as-number 65100
peer 10.10.10.3 connect-interface LoopBack0
#
ipv4-family unicast
undo synchronization
undo peer 10.10.10.3 enable
#
ipv4-family vpnv4
policy vpn-target
peer 10.10.10.3 enable
#
ipv4-family vpn-instance Finance&OA
network 10.0.1.1 255.255.255.255
#
ipv4-family vpn-instance OA
peer 10.0.21.1 as-number 65001
#
ospf 1 vpn-instance Finance&OA
import-route bgp
area 0.0.0.0
network 10.0.12.2 0.0.0.0
#
return

Configuration on R3
#
sysname R3
#
router id 10.10.10.3
#
mpls lsr-id 10.10.10.3
mpls
#
mpls ldp
#
isis 1
is-level level-2
cost-style wide
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 120


23

network-entity 49.0001.0100.1001.0003.00
is-name R3
#
interface GigabitEthernet0/0/2
ip address 10.0.34.3 255.255.255.0
isis enable 1
mpls
mpls ldp
#
interface GigabitEthernet0/0/3
ip address 10.0.23.3 255.255.255.0
isis enable 1
mpls
mpls ldp
#
interface LoopBack0
ip address 10.10.10.3 255.255.255.255
isis enable 1
#
bgp 65100
undo default ipv4-unicast
peer 10.10.10.2 as-number 65100
peer 10.10.10.2 connect-interface LoopBack0
peer 10.10.10.4 as-number 65100
peer 10.10.10.4 connect-interface LoopBack0
#
ipv4-family unicast
undo synchronization
undo peer 10.10.10.2 enable
undo peer 10.10.10.4 enable
#
ipv4-family vpnv4
undo policy vpn-target
peer 10.10.10.2 enable
peer 10.10.10.2 reflect-client
peer 10.10.10.4 enable
peer 10.10.10.4 reflect-client
#
return

Configuration on R4
#
sysname R4
#
router id 10.10.10.4
#
ip vpn-instance Finance
ipv4-family
route-distinguisher 65100:1
vpn-target 65100:12 export-extcommunity
vpn-target 65100:12 import-extcommunity
#
ip vpn-instance OA
ipv4-family
route-distinguisher 65002:2
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 121


23

vpn-target 65001:65002 export-extcommunity


vpn-target 65001:65002 import-extcommunity
#
mpls lsr-id 10.10.10.4
mpls
#
mpls ldp
#
isis 1
is-level level-2
cost-style wide
network-entity 49.0001.0100.1001.0004.00
is-name R4
#
interface GigabitEthernet0/0/1
ip address 10.0.24.4 255.255.255.0
isis enable 1
mpls
mpls ldp
#
interface GigabitEthernet0/0/2
ip binding vpn-instance Finance
ip address 10.0.45.4 255.255.255.0
#
interface GigabitEthernet0/0/3
ip address 10.0.34.4 255.255.255.0
isis enable 1
mpls
mpls ldp
#
interface GigabitEthernet0/0/5
ip binding vpn-instance OA
ip address 10.0.42.4 255.255.255.0
#
interface LoopBack0
ip address 10.10.10.4 255.255.255.255
isis enable 1
#
bgp 65100
undo default ipv4-unicast
peer 10.10.10.3 as-number 65100
peer 10.10.10.3 connect-interface LoopBack0
#
ipv4-family unicast
undo synchronization
undo peer 10.10.10.3 enable
#
ipv4-family vpnv4
policy vpn-target
peer 10.10.10.3 enable
#
ipv4-family vpn-instance Finance
network 10.0.1.2 255.255.255.255
#
ipv4-family vpn-instance OA
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 122


23

peer 10.0.42.2 as-number 65002


#
ospf 1 vpn-instance Finance
import-route bgp
area 0.0.0.0
network 10.0.45.4 0.0.0.0
#
return

Configuration on R5
#
sysname R5
#
router id 10.10.10.5
#
interface GigabitEthernet0/0/3
ip address 10.0.45.5 255.255.255.0
#
interface LoopBack0
ip address 10.0.1.2 255.255.255.255
#
ospf 1
area 0.0.0.0
network 10.0.1.2 0.0.0.0
network 10.0.45.5 0.0.0.0
#
return

Configuration on S1
#
sysname S1
#
interface Vlanif1
ip address 10.0.21.1 255.255.255.0
#
interface GigabitEthernet0/0/2
port link-type access
#
interface LoopBack0
ip address 10.0.2.1 255.255.255.255
#
bgp 65001
peer 10.0.21.2 as-number 65100
#
ipv4-family unicast
undo synchronization
network 10.0.2.1 255.255.255.255
peer 10.0.21.2 enable
#
return

Configuration on S2
#
sysname S2
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 123


23

#
interface Vlanif1
ip address 10.0.42.2 255.255.255.0
#
interface GigabitEthernet0/0/4
port link-type access
#
interface LoopBack0
ip address 10.0.2.2 255.255.255.255
#
bgp 65002
peer 10.0.42.4 as-number 65100
#
ipv4-family unicast
undo synchronization
network 10.0.2.2 255.255.255.255
peer 10.0.42.4 enable
#
Return
1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 124


23

Reference Answers
Answers to the advanced IGP

1. OSPF inter-area route advertisement depends on Type 3 LSAs. In OSPF, an ABR


imports inter-area routes to other areas into the local area through Type 3 LSAs. You
can run the filter command in the area view of the ABR to set filtering conditions for
incoming and outgoing Type 3 LSAs in the area. Only the filtered information can be
advertised and received.

Note that the filter command in the OSPF area view can be executed only on ABRs
and takes effect only for Type 3 LSAs. The internal route calculation in an OSPF area
depends on Type 1 and Type 2 LSAs, so this command cannot be used to filter these
LSAs.

Answers to the advanced BGP

1. When a BGP peer receives a route, it adds the route to the BGP Adj-IN routing table
and processes the route based on the inbound BGP routing policy.

If a BGP peer needs to receive only some routes, the peer does not need to send all
routes. To solve this problem, use either of the following methods:

a) Configure a routing policy on the peer to filter the routes to be sent to the BGP
peer. This method requires the cooperation of the peer and has poor flexibility.

b) With the outbound route filtering (ORF) function enabled, the BGP peer notifies
the peer that only some routes are sent. This method is flexible, but both ends
must support ORF.

Use either of the two methods as required.

Answers to the IPv6 Routing

1. IS-IS uses LSPs in the type-length-value (TLV) structure. Therefore, no new protocol
framework needs to be developed when IS-IS is used to deploy a dual-stack network.
However, by default, IS-IS uses only the shortest path tree (SPT) constructed on an
IPv4 network to calculate the topology.

If a dual-stack IS-IS network needs to be deployed but some devices do not support
IPv6, IS-IS still uses the SPT constructed based on the IPv4 network by default. As a
result, IPv6 packets may be sent to the devices that do not support IPv6, causing
packet loss. Therefore, the multi-topology feature is required.

OSPFv3 has developed for IPv6 networks. OSPFv3 can form SPTs based on IPv6
networks, and therefore multi-topology is not required.

Advanced VLAN Technologies


1

HCIP-Datacom-Advanced Routing & Switching Technology Lab Guide Page 125


23

If the ARP entry of the requested host can be found in local ARP entries (dynamic
learned or statically bound entries), the VLANIF interface of the super-VLAN
responds to the ARP Request packet.

Answers to the Ethernet Switching Security

1. All terminals on the same network segment communicate with each other through
the gateway. The gateway can restrict and monitor the communication between
terminals. However, the traffic that should be forwarded by the switch at Layer 2 is
forwarded by the gateway at Layer 3, which increases the load of the gateway.

Answers to the BGP/MPLS IP VPN

1. Multiple ERTs and IRTs can be configured in a VPN instance. After the peer receives a
route, it accepts the route as long as one ERT in the route matches the locally
configured IRT.

To enable R5 to receive routes from S1 and S2, add Import RT 65001:65002 to the
finance VPN on R4.

You might also like