需求描述
| 具体措施
|
1．在ITAA_MAIN、ITAA_LEFT、ITAA_RIGHT和ISP1、ISP2之间分别按照拓扑图配置EBGP邻接关系。
| Neighbor X.X.X.X remote-as XXX
|
2．在ITAA_MAIN、ITAA_LEFT、ITAA_RIGHT之间配置IBGP邻接关系。
| Neighbor X.X.X.X remote-as XXX
|
3．对ISP1和ISP2只通告内部网络192.168.0.0。
| 使用distribute-list + access-list 控制路由发布
|
4．ITAA_LEFT可以通过ITAA_MAIN和ISP2通信，同样，ITAA_RIGHT也可以通过ITAA_MAIN和ISP1通信。
| 在ITAA_LEFT和ITAA_RIGHT上使用BGP的weight属性，并且使用next-hop-self选项
|
5．ITAA_LEFT以ISP1为主ISP,ITAA_RIGHT以ISP2为主ISP。
| 同样使用weight属性，使通往主ISP的端口weight属性值最高
|
6．若ITAA_LEFT或ITAA_RIGHT通往ISP的直连链路失效，则所有数据流可以通过ITAA_MAIN流入ISP1和ISP2。
| 在ITAA_LEFT和ITAA_RIGHT上分别配置默认路由到ITAA_MAIN
|
7．AS65000这个私有AS号码不应该被宣告到ISP的其他客户
| 在ISP上配置remove-private-AS
|
需求一：在ITAA_MAIN、ITAA_LEFT、ITAA_RIGHT和ISP1、ISP2之间分别按照拓扑图配置EBGP邻接关系
|
ISP1#show ip protocols
Routing Protocol is "bgp 200"
Outgoing update filter list for all interfaces is not set
Incoming update filter list for all interfaces is not set
IGP synchronization is disabled
Automatic route summarization is disabled
Neighbor(s):
Address
FiltIn FiltOut DistIn DistOut Weight RouteMap
10.0.0.2
10.0.0.6
Maximum path: 1
Routing Information Sources:
Gateway
Distance
Last Update
10.0.0.2
20
01:46:55
10.0.0.6
20
00:09:09
Distance: external 20 internal 200 local 200
|
ISP2#show ip protocols
Routing Protocol is "bgp 300"
Outgoing update filter list for all interfaces is not set
Incoming update filter list for all interfaces is not set
IGP synchronization is disabled
Automatic route summarization is disabled
Neighbor(s):
Address
FiltIn FiltOut DistIn DistOut Weight RouteMap
172.6.0.6
172.16.0.2
Maximum path: 1
Routing Information Sources:
Gateway
Distance
Last Update
172.6.0.6
20
02:10:23
172.16.0.2
20
02:06:03
Distance: external 20 internal 200 local 200
|
2．在ITAA_MAIN、ITAA_LEFT、ITAA_RIGHT之间配置IBGP邻接关系
|
ITAA_MAIN#show ip protocols
Routing Protocol is "bgp 65000"
Outgoing update filter list for all interfaces is not set
Incoming update filter list for all interfaces is not set
IGP synchronization is disabled
Automatic route summarization is disabled
Redistributing: ospf 100 (internal)
Neighbor(s):
Address
FiltIn FiltOut DistIn DistOut Weight RouteMap
10.0.0.1
10
172.16.0.1
10
192.168.0.1
192.168.1.2
Maximum path: 1
Routing Information Sources:
Gateway
Distance
Last Update
10.0.0.1
20
00:10:01
192.168.0.1
200
00:10:23
172.16.0.1
20
01:10:48
Distance: external 20 internal 200 local 200
|
3．对ISP1和ISP2只通告内部网络192.168.0.0
|
ISP1#show ip bgp
BGP table version is 10, local router ID is 1.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete
Network
Next Hop
Metric LocPrf Weight Path
*> 1.1.1.0/24
0.0.0.0
0
32768 i
*
192.168.0.0
10.0.0.2
0
0 65000 ?
*>
10.0.0.6
0
0 65000 ?
*
192.168.1.0
10.0.0.2
0
0 65000 ?
*>
10.0.0.6
0
0 65000 ?
|
ISP2#show ip bgp
BGP table version is 12, local router ID is 172.16.0.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete
Network
Next Hop
Metric LocPrf Weight Path
*> 2.2.2.0/24
0.0.0.0
0
32768 i
*
192.168.0.0
172.6.0.6
0
0 65000 ?
*>
172.16.0.2
0
0 65000 ?
*
192.168.1.0
172.6.0.6
0
0 65000 ?
*>
172.16.0.2
0
0 65000 ?
|
4．ITAA_LEFT可以通过ITAA_MAIN和ISP2通信，同样，ITAA_RIGHT也可以通过ITAA_MAIN和ISP1通信
|
可以看到，ITAA_LEFT到达ISP2可以双链路通过ITAA_MAIN:
|
ITAA_LEFT#show ip route 172.16.0.1
Routing entry for 172.16.0.0/30
Known via "ospf 100", distance 110, metric 20, type extern 2, forward metric 1
Redistributing via bgp 65000
Last update from 192.168.0.2 on FastEthernet0/0, 01:18:31 ago
Routing Descriptor Blocks:
* 192.168.1.3, from 192.168.192.1, 01:18:31 ago, via FastEthernet1/0
Route metric is 20, traffic share count is 1
192.168.0.2, from 192.168.192.1, 01:18:31 ago, via FastEthernet0/0
Route metric is 20, traffic share count is 1
|
同样，我们看一下ITAA_RIGHT:
|
ITAA_RIGHT#show ip route 10.0.0.1
Routing entry for 10.0.0.0/30
Known via "ospf 100", distance 110, metric 20, type extern 2, forward metric 1
Redistributing via bgp 65000
Last update from 192.168.1.3 on FastEthernet0/0, 01:20:17 ago
Routing Descriptor Blocks:
* 192.168.0.2, from 192.168.192.1, 01:20:17 ago, via FastEthernet1/0
Route metric is 20, traffic share count is 1
192.168.1.3, from 192.168.192.1, 01:20:17 ago, via FastEthernet0/0
Route metric is 20, traffic share count is 1
|
5．ITAA_LEFT以ISP1为主ISP,ITAA_RIGHT以ISP2为主ISP
|
我们分别从ITAA_LEFT和ITAA_RIGHT traceroute到各自ISP的内部还回口：
|
ITAA_LEFT#traceroute 1.1.1.1
Type escape sequence to abort.
Tracing the route to 1.1.1.1
1 10.0.0.5 504 msec *
844 msec
|
ITAA_RIGHT#traceroute 2.2.2.2
Type escape sequence to abort.
Tracing the route to 2.2.2.2
1 172.6.0.5 464 msec 308 msec *
|
6．若ITAA_LEFT或ITAA_RIGHT通往ISP的直连链路失效，则所有数据流可以通过ITAA_MAIN流入ISP1和ISP2
|
在采取动作验证前，我们知道，ITAA_LEFT通往ISP1是通过直连链路的，现在我们手动关掉这条链路：
|
ISP1(config)#int s 2/0
ISP1(config-if)#shutdown
*Apr 12 06:34:38.721: %BGP-5-ADJCHANGE: neighbor 10.0.0.6 Down Interface flap
*Apr 12 06:34:39.705: %LINK-5-CHANGED: Interface Serial2/0, changed state to administratively down
|
随后我们到ITAA_LEFT上traceroute到1.1.1.1(ISP1的内部还回口)
|
ITAA_LEFT#traceroute 1.1.1.1
Type escape sequence to abort.
Tracing the route to 1.1.1.1
1 192.168.1.3 28 msec
192.168.0.2 92 msec
192.168.1.3 704 msec
2 10.0.0.1 720 msec *
832 msec
|
结果显而易见，确实通过了ITAA_MAIN到达了ISP1
|
7．AS65000这个私有AS号码不应该被宣告到ISP的其他客户
|
这个需求由于拓扑图中应该在ISP内多加入一台路由器才可以验证，具体配置是：
ISP1(config)#router bgp 200
ISP1(config-router)#neighbor X.X.X.X remove-private-AS
ISP1(config-router)#exi
|
X.X.X.X代表ISP1内部、外部的所有其他BGP对等体
|
