Рассмотрим пример: соединения установлены между свитчами А и В и между В и С.
Необходимо чтобы АС20 не могла аннонсировать маршруты полученные от АС 10 и 30
Настройка
Настраиваем VLAN
<HUAWEI> system-view [HUAWEI] sysname SwitchA [SwitchA] vlan batch 10 20 [SwitchA] interface gigabitethernet 1/0/0 [SwitchA-GigabitEthernet1/0/0] port link-type trunk [SwitchA-GigabitEthernet1/0/0] port trunk allow-pass vlan 10 [SwitchA-GigabitEthernet1/0/0] quit [SwitchA] interface gigabitethernet 2/0/0 [SwitchA-GigabitEthernet2/0/0] port link-type trunk [SwitchA-GigabitEthernet2/0/0] port trunk allow-pass vlan 20 [SwitchA-GigabitEthernet2/0/0] quit
Настройки коммутаторов В и С аналогичны.
Назначаем IP адреса на VLANIF интерфейсах
[SwitchA] interface vlanif 10 [SwitchA-Vlanif10] ip address 10.1.1.1 24 [SwitchA-Vlanif10] quit [SwitchA] interface vlanif 20 [SwitchA-Vlanif20] ip address 192.168.2.1 24 [SwitchA-Vlanif20] quit
Настройки коммутаторов В и С аналогичны.
Настраиваем EBGP.
# SwitchA. [SwitchA] bgp 10 [SwitchA-bgp] router-id 172.16.1.1 [SwitchA-bgp] peer 192.168.2.2 as-number 20 [SwitchA-bgp] ipv4-family unicast [SwitchA-bgp-af-ipv4] network 10.1.1.0 255.255.255.0 [SwitchA-bgp-af-ipv4] quit [SwitchA-bgp] quit #
SwitchB. [SwitchB] bgp 20 [SwitchB-bgp] router-id 172.16.2.2 [SwitchB-bgp] peer 192.168.2.1 as-number 10 [SwitchB-bgp] peer 192.168.3.2 as-number 30 [SwitchB-bgp] quit #
SwitchC. [SwitchC] bgp 30 [SwitchC-bgp] router-id 172.16.3.3 [SwitchC-bgp] peer 192.168.3.1 as-number 20 [SwitchC-bgp] quit #
routing table на SwitchB.
[SwitchB] display bgp routing-table 10.1.1.0 BGP local router ID : 172.16.2.2 Local AS number : 20 Paths: 1 available, 1 best, 1 select BGP routing table entry information of 10.1.1.0/24: From: 192.168.2.1 (172.16.1.1) Route Duration: 00h00m15s Direct Out-interface: Vlanif20 Original nexthop: 192.168.2.1 Qos information : 0x0 AS-path 10, origin igp, MED 0, pref-val 0, valid, external, best, select, active, pre 255 Advertised to such 2 peers: 192.168.2.1 192.168.3.2
Видим что свитч В аннонсит полученные маршруты от свитча С в АС30
routing table на SwitchC.
[SwitchC] display bgp routing-table BGP Local router ID is 172.16.3.3 Status codes: * - valid, > - best, d - damped, h - history, i - internal, s - suppressed, S - Stale Origin : i - IGP, e - EGP, ? - incomplete Total Number of Routes: 1 Network NextHop MED LocPrf PrefVal Path/Ogn *> 10.11.1.0/24 192.168.3.1 0 20 10i
Видим что свитч С изучил маршрут до 10.1.1.0/24 от Свитча В
Настроим BGP community attributes.
# Настроим routing policy на SwitchA чтобы SwitchB не аннонсировал маршруты от свитчей А в другие АС
[SwitchA] route-policy comm_policy permit node 10 [SwitchA-route-policy] apply community no-export [SwitchA-route-policy] quit #
Применяем routing policies.
[SwitchA] bgp 10 [SwitchA-bgp] ipv4-family unicast [SwitchA-bgp-af-ipv4] peer 192.168.2.2 route-policy comm_policy export [SwitchA-bgp-af-ipv4] peer 192.168.2.2 advertise-community
# Проверим routing table на SwitchB.
[SwitchB] display bgp routing-table 10.1.1.0 BGP local router ID : 172.16.2.2 Local AS number : 20 Paths: 1 available, 1 best, 1 select BGP routing table entry information of 10.1.1.0/24: From: 192.168.2.1 (172.16.1.1) Route Duration: 00h00m33s Direct Out-interface: Vlanif20 Original nexthop: 192.168.2.1 Qos information : 0x0 Community:no-export AS-path 10, origin igp, MED 0, pref-val 0, valid, external, best, select, active, pre 255 Not advertised to any peer yet
Видим community attribute в BGP routing table на SwitchB. Также видим что нет маршрутов до сети 10.1.1.0/24 в BGP routing table на SwitchC
Примеры файлов конфигурации
SwitchA
# sysname SwitchA # vlan batch 10 20 # interface Vlanif10 ip address 10.1.1.1 255.255.255.0 # interface Vlanif20 ip address 192.168.2.1 255.255.255.0 # interface GigabitEthernet1/0/0 port link-type trunk port trunk allow-pass vlan 10 # interface GigabitEthernet2/0/0 port link-type trunk port trunk allow-pass vlan 20 # bgp 10 router-id 172.16.1.1 peer 192.168.2.2 as-number 20 # ipv4-family unicast undo synchronization network 10.1.1.0 255.255.255.0 peer 192.168.2.2 enable peer 192.168.2.2 route-policy comm_policy export peer 192.168.2.2 advertise-community # route-policy comm_policy permit node 10 apply community no-export #
SwitchB
# sysname SwitchB # vlan batch 20 30 # interface Vlanif20 ip address 192.168.2.2 255.255.255.0 # interface Vlanif30 ip address 192.168.3.1 255.255.255.0 # interface GigabitEthernet2/0/0 port link-type trunk port trunk allow-pass vlan 20 # interface GigabitEthernet3/0/0 port link-type trunk port trunk allow-pass vlan 30 # bgp 20 router-id 172.16.2.2 peer 192.168.2.1 as-number 10 peer 192.168.3.2 as-number 30 # ipv4-family unicast undo synchronization peer 192.168.2.1 enable peer 192.168.3.2 enable # return
SwitchC
# sysname SwitchC # vlan 30 # interface Vlanif30 ip address 192.168.3.2 255.255.255.0 # interface GigabitEthernet3/0/0 port link-type trunk port trunk allow-pass vlan 30 # bgp 30 router-id 172.16.3.3 peer 192.168.3.1 as-number 20 # ipv4-family unicast undo synchronization peer 192.168.3.1 enable # return