BGP 联邦和路由反射器作业
Topo
如图所示，R1和R2、R4和R5是ebgp邻居，R2和R3是ibgp邻居，R3和R4是ebgp 邻居，除了R1/2/4/5之间，都是用loopback0建立邻居。
注意：R1指向R2以及R5指向R4的AS号为234！
请问，R1-R2，R4-R5的bgp邻居能否起来？请解释原因，通过抓包和截图
如何解决？，实现如下拓扑
R3
Bgp 64523
Confederationid 234
Confederation peer-as 64544
R4
Bgp 64544
Confederation id 234
Confederation peer-as 64523
请总结confedrationid的作用，配置前和配置后的区别
配置前：抓包说明
配置后：抓包说明
Confederation peer-as的作用，为什么需要这条命令，请通过抓包和截图展示总结联邦的优缺点
路由反射器（RR）
角色：
RRrouter-reflector
RR-Cclient
RRcluster=RR+RR-C
Topo如下
配置R3是RR，R2是RR-c，请贴出命令
如果R3和R2调换位置，R3为RR-C，R2为RR，那么出现什么问题，请解释为什么？贴出相关路由的disbgprouting
RR在IBGP环境下取代了IBGP的水平分割，那么又是如何放环的，请贴出disbgprouting 10.1.1.1表象来说明
案例精解：BGP路由黑洞 2008-10-19 15:05:37 标签：路由反射器路由黑洞同步BGP联邦 什么是路由黑洞？简单的说，它会默默的将数据包丢弃，使所有数据包有去无回，下面来看一个案例： 如图所示： R1和R2建立EBGP邻居关系 R2和R5建立IBGP邻居关系 R5和R7建立EBGP邻居关系 R2、R3、R5之间运行RIPv2 首先看配置： hostname r1 interface Loopback0 ip address 1.1.1.1 255.255.255.0 interface Serial1/0 ip address 192.168.12.1 255.255.255.0
serial restart-delay 0 router bgp 100 no synchronization bgp router-id 1.1.1.1 bgp log-neighbor-changes network 1.1.1.0 mask 255.255.255.0 network 192.168.12.0 neighbor 2.2.2.2 remote-as 200 neighbor 2.2.2.2 ebgp-multihop 255 neighbor 2.2.2.2 update-source Loopback0 no auto-summary ! ip route 2.2.2.0 255.255.255.0 192.168.12.2 hostname r2 interface Loopback0 ip address 2.2.2.2 255.255.255.0 ! interface Serial1/0 ip address 192.168.23.2 255.255.255.0 serial restart-delay 0 ! interface Serial1/1 ip address 192.168.12.2 255.255.255.0 serial restart-delay 0 ! interface Serial1/2 ip address 192.168.24.2 255.255.255.0 serial restart-delay 0 !
华为模拟器命令 计算机命令 PCA login: root ；使用root用户password: linux ；口令是linux # shutdown -h now ；关机 # init 0 ；关机 # logout ；用户注销 # login ；用户登录 # ifconfig ；显示IP地址 # ifconfig eth0
组网说明： 本案例采用H3C HCL模拟器来模拟IPV6 IBGP一级RR路由反射器典型组网配置！R1与R2属于AS100，R3属于AS200。R1是R2的RR路由反射器的客户端。R2与R3为EBGP邻居关系。要求R1、R2、R3的loopback0能够互通。 配置思路： 1、按照网络拓扑图正确配置IP地址 2、R1与R2建立IBGP邻居关系，R2配置RR路由反射器客户端，指向R1 3、R2与R3建立EBGP邻居关系 配置过程： R1：
R1路由器： ######################### system-view sysname R1 user-interface vty 0 4 set authentication password cipher huawei user privilege level 3 quit router id LoopBack0 ip address GigabitEthernet 0/0/0 ip address GigabitEthernet 0/0/1 ip address 路由器： ################################## system-view sysname R2 user-interface vty 0 4 set authentication password cipher huawei user privilege level 3 quit router id LoopBack0 ip address GigabitEthernet 0/0/0 ip address GigabitEthernet 0/0/1 ip address 路由器： ################################## system-view
sysname R3 user-interface vty 0 4 set authentication password cipher huawei user privilege level 3 quit router id LoopBack0 ip address GigabitEthernet 0/0/0 ip address GigabitEthernet 0/0/1 ip address 交换机： ######################### system-view sysname SW1 user-interface vty 0 4 set authentication password cipher huawei user privilege level 3 quit vlan batch 10 20 30 port-group huawei group-member GigabitEthernet 0/0/1 to GigabitEthernet 0/0/5 port link-type acc port default vlan 10 quit interface Vlanif 10 ip address 24 quit
末梢区域实例实验： R1的配置： ospf 1 import-route rip 1 cost 100 area 0.0.0.0 network 12.0.0.0 0.0.0.255 network 11.11.11.11 0.0.0.0 rip 1 undo summary version 2 network 1.0.0.0 import-route ospf 1 cost 10 R2的配置： ospf 1 area 0.0.0.0 network 12.0.0.0 0.0.0.255 network 2.2.2.2 0.0.0.0 area 0.0.0.1 network 22.22.22.22 0.0.0.0 network 23.0.0.0 0.0.0.255 R3的配置： ospf 1 asbr-summary 192.168.0.0 255.255.252.0 import-route rip 1 cost 100 area 0.0.0.1 network 23.0.0.0 0.0.0.255 network 33.33.33.33 0.0.0.0 rip 1 network 192.168.1.0 network 192.168.2.0 network 192.168.3.0 import-route ospf 1 cost 10
将Area 1配置为Stub区域，查看现象： 配置Stub区域前R3的路由条目： [R3]dis ip routing-table Route Flags: R - relay, D - download to fib ------------------------------------------------------------------------------ Routing Tables: Public Destinations : 14 Routes : 14 Destination/Mask Proto Pre Cost Flags NextHop Interface 1.1.1.1/32 O_ASE 150 100 D 23.0.0.2 Ethernet0/0/0 2.2.2.2/32 OSPF 10 1 D 2 3.0.0.2 Ethernet0/0/0 3.3.3.3/32 Direct 0 0 D 127.0.0.1 LoopBack0 11.11.11.11/32 OSPF 10 2 D 23.0.0.2 Ethernet0/0/0 12.0.0.0/24 OSPF 10 2 D 23.0.0.2 Ethernet0/0/0 22.22.22.22/32 OSPF 10 1 D 23.0.0.2 Ethernet0/0/0 23.0.0.0/24 Direct 0 0 D 23.0.0.3 Ethernet0/0/0 23.0.0.3/32 Direct 0 0 D 127.0.0.1 Ethernet0/0/0 33.33.33.33/32 Direct 0 0 D 127.0.0.1 LoopBack1 127.0.0.0/8 Direct 0 0 D 127.0.0.1 InLoopBack0 127.0.0.1/32 Direct 0 0 D 127.0.0.1 InLoopBack0 192.168.1.1/32 Direct 0 0 D 127.0.0.1 LoopBack2 192.168.2.1/32 Direct 0 0 D 127.0.0.1 LoopBack3 192.168.3.1/32 Direct 0 0 D 127.0.0.1 LoopBack4 配置Stub区域： [R2]ospf 1 [R2-ospf-1]area 1 [R2-ospf-1-area-0.0.0.1]stub [R3]ospf 1 [R3-ospf-1]area 1 [R3-ospf-1-area-0.0.0.1]stub 再看R3的路由表： [R3]dis ip routing-table Route Flags: R - relay, D - download to fib ------------------------------------------------------------------------------ Routing Tables: Public Destinations : 14 Routes : 14 Destination/Mask Proto Pre Cost Flags NextHop Interface 0.0.0.0/0 OSPF 10 2 D 23.0.0.2 Ethernet0/0/0 2.2.2.2/32 OSPF 10 1 D 2 3.0.0.2 Ethernet0/0/0 3.3.3.3/32 Direct 0 0 D 127.0.0.1 LoopBack0 11.11.11.11/32 OSPF 10 2 D 23.0.0.2 Ethernet0/0/0 12.0.0.0/24 OSPF 10 2 D 23.0.0.2 Ethernet0/0/0 22.22.22.22/32 OSPF 10 1 D 23.0.0.2 Ethernet0/0/0 23.0.0.0/24 Direct 0 0 D 23.0.0.3 Ethernet0/0/0 23.0.0.3/32 Direct 0 0 D 127.0.0.1 Ethernet0/0/0 33.33.33.33/32 Direct 0 0 D 127.0.0.1 LoopBack1 127.0.0.0/8 Direct 0 0 D 127.0.0.1 InLoopBack0 127.0.0.1/32 Direct 0 0 D 127.0.0.1 InLoopBack0
实验一口令和主机名设置 1.交换机的初始化 当交换机没有进行配置时，接入超级终端会提示是否以对话方式进行配置，初始化内容主要有IP地址、网关、主机名和口令等。配置文件是flash:config.text。 2924交换机进入ROM方式是在上电时按住其mode键，本软件是按Ctrl+Break键，出现： switch> ;按Ctrl+Break键 switch:reset ;或用boot命令 如果有配置文件进入用户模式，否则提交对话： --- System Configuration Dialog --- At any point you may enter a question mark '?' for help. Use ctrl-c to abort configuration dialog at any prompt. Default settings are in square brackets '[]'. Continue with configuration dialog? [yes/no]:y Enter IP address:10.65.1.8 Enter IP netmask:255.255.0.0 Would you like to enter a default gateway address? [yes]: IP address of default gateway: Enter host name [Switch]:swa The enable secret is a one-way cryptographic secret used instead of the enable password when it exists. Enter enable secret:aaa Would you like to configure a Telnet password? [yes]: Enter Telnet password:a Would you like to enable as a cluster command switch? [no]: The following configuration command script was created: ...... Press RETURN to get started. swa>en password:aaa swa#copy run start (保存配置信息) swa#dir flash: (查看闪存中的文件) 再次进入对话方式：
华为模拟器 3.0绿色特别版-实验命令参考 计算机命令 ~~~~~~~~~~ PCA login root ；使用root用户 password linux ；口令是linux # shutdown -h now ；关机 # init 0 ；关机 # logout ；用户注销 # login ；用户登录 # ifconfig ；显示IP地址 # ifconfig eth0 ip address netmask netmask ；设置IP地址 # ifconfig eht0 ip address netmask netmask down ；禁用IP地址 # route add 0.0.0.0 gw ip ；设置网关 # route del 0.0.0.0 gw ip ；删除网关 # route add default gw ip ；设置网关 # route del default gw ip ；删除网关 # route ；显示网关 # ping ip ；发ECHO包 # telnet ip ；远程登录 －－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－ 交换机命令 ~~~~~~~~~~ [Quidway]dis cur ；显示当前配置 [Quidway]display current-configuration ；显示当前配置 [Quidway]display interfaces ；显示接口信息 [Quidway]display vlan all ；显示路由信息 [Quidway]display version ；显示版本信息 [Quidway]ip route-static 0.0.0.0 0.0.0.0 10.65.1.2 ；静态路由＝网关/设置缺省路由的下一跳为10.65.1.2 [Quidway]rip ；三层交换支持 [Quidway]local-user ftp ；指定FTP用户 [Quidway]user-interface vty 0 4 ；进入虚拟终端 [S3026-ui-vty0-4]authentication-mode password ；设置口令模式 [S3026-ui-vty0-4]set authentication-mode password simple 222 ；设置口令 [S3026-ui-vty0-4]user privilege level 3 ；用户级别 [Quidway]interface ethernet 01 ；进入端口模式 [Quidway]int e01 ；进入端口模式 [Quidway-Ethernet01]duplex {halffullauto} ；配置端口工作状态 [Quidway-Ethernet01]speed {10100auto} ；配置端口工作速率 [Quidway-Ethernet01]flow-control ；配置端口流控 [Quidway-Ethernet01]mdi {acrossautonormal} ；配置端口平接扭接
华为设备单臂路由配置实例： 拓扑图注：实验在华为模拟器eNSP内模拟进行。 1、交换机配置
[S1-Ethernet0/0/1]port default vlan 10 [S1-Ethernet0/0/1] int e0/0/2 [S1-Ethernet0/0/2]port link-type access [S1-Ethernet0/0/2]port default vlan 20 [S1-Ethernet0/0/2] int g0/0/1 [S1-GigabitEthernet0/0/1]port link-type trunk [S1-GigabitEthernet0/0/1]port trunk allow-pass vlan 10 20 [S1-GigabitEthernet0/0/1]undo port trunk allow-pass vlan 1 //可省了此处，根据实际需要配置。 2、路由器配置
案例精解：BGP路由黑洞 什么是路由黑洞？简单的说，它会默默的将数据包丢弃，使所有数据包有去无回，下面来看一个案 如图所示： R1和R2建立EBGP邻居关系 R2和R5建立IBGP邻居关系 R5和R7建立EBGP邻居关系 R2、R3、R5之间运行RIPv2 首先看配置： sysname route-1 # router id 1.1.1.1 # interface Ethernet0/0 ip address 192.168.12.1 255.255.255.252 # interface Ethernet0/1 ip address dhcp-alloc # interface LoopBack0 ip address 1.1.1.1 255.255.255.255 # bgp 100 undo synchronization group 1 external peer 192.168.12.2 group 1 as-number 200 # ip route-static 2.2.2.2 255.255.255.255 192.168.12.2 preference 60
# sysname route-2 # router id 2.2.2.2 # interface Ethernet0/0 ip address 192.168.12.2 255.255.255.252 # interface Ethernet0/1 ip address 192.168.23.1 255.255.255.252 # interface LoopBack0 ip address 2.2.2.2 255.255.255.255 # bgp 200 undo synchronization group 1 external peer 192.168.12.1 group 1 as-number 100 group 2 internal peer 192.168.35.2 group 2 # ospf 1 import-route direct import-route static area 0.0.0.0 network 2.2.2.2 0.0.0.0 network 192.168.23.0 0.0.0.3 # ip route-static 1.1.1.1 255.255.255.255 192.168.12.1 preference 60 # sysname route-3 # router id 3.3.3.3 # interface Ethernet0/0 ip address 192.168.35.1 255.255.255.252 # interface Ethernet0/1 ip address 192.168.23.2 255.255.255.252 # interface LoopBack0 ip address 3.3.3.3 255.255.255.255 # ospf 1 import-route direct import-route static area 0.0.0.0 network 3.3.3.3 0.0.0.0 network 192.168.23.0 0.0.0.3 network 192.168.35.0 0.0.0.3 # sysname route-5 # router id 5.5.5.5 # interface Ethernet0/0 ip address 192.168.35.2 255.255.255.252 #
计算机命令 ~~~~~~~~~~ PCA login: root ；使用root用户password: linux ；口令是linux # shutdown -h now ；关机 # init 0 ；关机 # logout ；用户注销 # login ；用户登录 # ifconfig ；显示IP地址 # ifconfig eth0
IBGP水平分割：从一个IBGP学到的BGP路由不会传到另一个IBGP 解决办法RR（路由反射器）可以指定他的客户 1、如果一条路由通过客户学习到，那么会反射到客户、非客户、EBGP邻居 2、如果一条路由通过EBGP邻居学习到，那么会反射给客户、非客户、EBGP邻居 3、如果一条路由通过非客户学习到，那么会反射给客户和EBGP邻居，不会反射给非客户R1(config)#int s2/1 R1(config-if)#ip add 12.0.0.1 255.255.255.0 R1(config-if)#no shu R1(config-if)#int lo0 R1(config-if)#ip add 1.1.1.1 255.255.255.0 R1(config-if)#do ping 12.0.0.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 12.0.0.2, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 24/58/96 ms R1(config-if)#router bgp 100 R1(config-router)#bgp router-id 1.1.1.1 R1(config-router)#nei 12.0.0.2 remote-as 234 R1(config-router)#net 1.1.1.0 mask 255.255.255.0 R1(config-router)# *Sep 12 19:39:51.659: %BGP-5-ADJCHANGE: neighbor 12.0.0.2 Up R1(config-router)#do sh ip bgp BGP table version is 3, local router ID is 1.1.1.1 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 1.1.1.0/24 0.0.0.0 0 32768 i *> 5.5.5.0/24 12.0.0.2 0 234 500 i R1(config-router)#do sh ip route Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
BGP路由黑洞及IBGP全连接 组网需求： 1.AS65000边界网段发布：RT1、RT2重发布直连路由至OSPF（metric 1000 type 1） 2.BGP配置要求： no synchronization no auto-summary IBGP使用LOOPBACK建立邻居，下一跳指向自己 3.RT1,RT2发布AS65000的汇总路由至BGP：10.0.0.0/16、10.3.0.0/16 4.RT5发布AS65001的汇总路由至BGP：10. 5.0.0/16 5.RT6发布AS65001的汇总路由至BGP：10. 6.0.0/16 6.分析路由黑洞的形成及解决方法 IGP路由的配置： R1: router ospf 1 router-id 10.0.0.1 redistribute connected metric 1000 metric-type 1 subnets //重发布直连网络到OSPF中passive-interface Serial0/1//与EBGP相连的接口必须配置为被动接口，以免形成邻居network 10.0.0.1 0.0.0.0 area 0 network 10.0.1.4 0.0.0.3 area 0
router ospf 1 router-id 10.0.0.3 passive-interface default no passive-interface Serial0/0 no passive-interface FastEthernet1/0 network 10.0.0.3 0.0.0.0 area 0 network 10.0.1.0 0.0.0.3 area 0 network 10.0.1.4 0.0.0.3 area 0 network 10.3.3.0 0.0.0.255 area 0 interface FastEthernet1/0 ip address 10.0.1.1 255.255.255.252 ip ospf network point-to-point //配置网络类型为点对点（不需选举DR或BDR） R4: router ospf 1 router-id 10.0.0.4 passive-interface default no passive-interface Serial0/0 no passive-interface FastEthernet1/0 network 10.0.0.4 0.0.0.0 area 0 network 10.0.1.0 0.0.0.3 area 0 network 10.0.1.8 0.0.0.3 area 0 network 10.3.4.0 0.0.0.255 area 0 interface FastEthernet1/0 ip address 10.0.1.1 255.255.255.252 ip ospf network point-to-point //配置网络类型为点对点（不需选举DR或BDR） R2: router ospf 1 router-id 10.0.0.2 redistribute connected metric 1000 metric-type 1 subnets//重发布直连网络到OSPF中passive-interface default//与EBGP相连的接口必须配置为被动接口，以免形成邻居no passive-interface Serial0/0 network 10.0.1.8 0.0.0.3 area 0 IBGP的配置： R1： router bgp 65000 no synchronization//关闭同步 neighbor 10.0.0.2 remote-as 65000//指定IBGP邻居和AS neighbor 10.0.0.2 update-source Loopback0//指定更新源为LOOPBACK0 neighbor 10.0.0.2 next-hop-self//把下跳改为自己（EBGP默认）neighbor 10.0.15.2 remote-as 65001 //指定EBGP邻居和AS network 10.0.0.0 mask 255.255.0.0 /静态发布路由到BGP no auto-summary//关闭自动汇总 ip route 10.0.0.0 255.255.0.0 null 0 //添加一条静态汇总路由，用来发布
华为无线控制器AC6005配置（直接转发） Switch的配置文件 # sysnameSwitch # vlanbatch100to101 # interfaceGigabitEthernet0/0/1 portlink-typetrunk porttrunkpvidvlan100 porttrunkallow-passvlan100to101 port-isolateenablegroup1 # interfaceGigabitEthernet0/0/2 portlink-typetrunk porttrunkallow-passvlan100to101 # return Router的配置文件 # sysnameRouter # vlanbatch101 # interfaceVlanif101 ipaddress # interfaceGigabitEthernet1/0/0 portlink-typetrunk porttrunkallow-passvlan101 # return AC的配置文件 # sysnameAC # vlanbatch100to101 # dhcpenable # interfaceVlanif100 ipaddress dhcpselectinterface #
interfaceVlanif101 ipaddress dhcpselectinterface # interfaceGigabitEthernet0/0/1 portlink-typetrunk porttrunkallow-passvlan100to101 # interfaceGigabitEthernet0/0/2 portlink-typetrunk porttrunkallow-passvlan101 # capwapsourceinterfacevlanif100 # wlan security-profilenamewlan-net securitywpa-wpa2pskpass-phrase%^%#m"tz0f>~7.[`^6RWdzwCy16hJj/Mc!,}s`X*B]}A%^%#aes ssid-profilenamewlan-net ssidwlan-net vap-profilenamewlan-net service-vlanvlan-id101 ssid-profilewlan-net security-profilewlan-net regulatory-domain-profilenamedefault rrm-profilenamedefault calibrateauto-channel-selectdisable calibrateauto-txpower-selectdisable ap-groupnameap-group1 radio0 vap-profilewlan-netwlan1 radio1 vap-profilewlan-netwlan1 ap-id0type-id35ap-mac60de-4476-e360ap-sn ap-namearea_1 ap-groupap-group1 radio0 channel20mhz6 eirp127 radio1 channel20mhz149 eirp127 # return 华为无线控制器AC6005配置（隧道转发） Switch的配置文件 # sysnameSwitch
1:优化配置,优化管理 路由反射器的作用： 减少IBGP 对等体关系的数目 解决IBGP 水平分割带来的路由不被学习的问题. 1.1.3 反射的原则 1)If the route was learned from a nonclient IBGP peer, it is reflected to clients only. 2)If the route was learned from a client, it is reflected to all nonclients and clients, except for the originating client. 如图所示：将1.1.1.0/24宣告进bgp ，但是R3与R5都学不到这个路由。解决方法： 把R2变成路由反射器。 配置： R2(config-router)#nei 12.12.12.1 route-reflector-client R2(config-router)#nei 23.23.23.3 route-reflector-client R2(config-router)#nei 25.25.25.5 route-reflector-client *Feb 16 18:34:32.279: %BGP-5-ADJCHANGE: neighbor 25.25.25.5 Down RR client config change //路由反射器的配置会引起邻居关系的down 路由反射器，进行路由反射时，其被反射的路由的下一跳是不会改变的。 路由反射器 Wednesday, February 16, 2011 6:07 PM
华为的路由器模拟器及实验内容 2009-12-21 20:27:53| 分类：默认分类| 标签：|字号大中小订阅 实验一：基本命令实验 实验二：配置端口聚合 实验三：基本VLAN设置 实验四：配置primary VLAN和secondary VLAN 实验五：其它功能 实验六：路由器BootROM升级 实验七：直联路由 实验八：单臂路由 实验九：静态路由实验 实验十：动态路由实验 实验十一：访问控制列表 实验十二：地址转换配置 华为的路由器模拟器下载地址（右键迅雷下载） 实验一基本命令实验 添加一个交换机，一个计算机，双击交换机，进入终端配置：
system password: [Quidway]sysname S3026 交换机命名 [S3026]super password 111 修改特权用户密码 [S3026]user-interface vty 0 4 [S3026-ui-vty0-4]authentication-mode password [S3026-ui-vty0-4]set authentication-mode password simple 222 [S3026-ui-vty0-4]user privilege level 3 [S3026-ui-vty0-4]quit [S3026]quit sys password:111 [S3026]display currect-config [S3026]dis curr [S3026]vlan 2 [S3026-vlan2]port ethernet0/2 [S3026-vlan2]port e0/4 to et0/6 [S3026-vlan2]quit [S3026]dis vlan [S3026]int e0/3 [S3026-Ethernet1]port access vlan 2 [S3026-Ethernet1]quit [S3026]dis vlan [S3026]dis curr