目次
概要
MPLS-VPNバックボーンのMP-BGPの設定について、設定ミスの切り分けと修正を行います。
ネットワーク構成
下記のネットワーク構成で、MPLS-VPNを通じてR4とR5間の通信ができるようにしたいと考えています。
ルータの役割は、次の通りです。
PEルータ:R1、R3
Pルータ :R2
CEルータ:R4、R5
PEルータであるR1、R3ではともにVRFとして次のように定義します。
VRF名:VPN
RD:100:100
Import RT:100:100
Export RT:100:100
設定概要
各ルータで行われているMPLS-VPNでの通信に関連する設定は次の通りです。
R1
ip vrf VPN rd 100:100 route-target export 100:100 route-target import 100:100 ! interface Loopback0 ip address 192.168.0.1 255.255.255.255 ! interface FastEthernet0/0 ip vrf forwarding VPN ip address 10.14.14.1 255.255.255.0 ! interface Serial1/0 ip address 192.168.12.1 255.255.255.0 encapsulation ppp mpls ip no peer neighbor-route ! router ospf 14 vrf VPN log-adjacency-changes redistribute bgp 100 subnets network 10.14.14.1 0.0.0.0 area 0 ! router ospf 1 log-adjacency-changes network 192.168.0.0 0.0.255.255 area 0 ! router bgp 100 no synchronization bgp log-neighbor-changes neighbor 192.168.0.3 remote-as 100 neighbor 192.168.0.3 update-source Loopback0 no auto-summary ! address-family ipv4 vrf VPN redistribute ospf 14 vrf VPN no synchronization exit-address-family
R2
interface Loopback0 ip address 192.168.0.2 255.255.255.255 ! interface Serial1/0 ip address 192.168.12.2 255.255.255.0 encapsulation ppp mpls ip no peer neighbor-route ! interface Serial1/1 ip address 192.168.23.2 255.255.255.0 encapsulation ppp mpls ip no peer neighbor-route ! router ospf 1 log-adjacency-changes network 192.168.0.0 0.0.255.255 area 0
R3
ip vrf VPN rd 100:100 route-target export 100:100 route-target import 100:100 ! interface Loopback0 ip address 192.168.0.3 255.255.255.255 ! interface FastEthernet0/0 ip vrf forwarding VPN ip address 10.35.35.3 255.255.255.0 duplex auto speed auto ! interface Serial1/0 ip address 192.168.23.3 255.255.255.0 encapsulation ppp mpls ip no peer neighbor-route ! router ospf 35 vrf VPN log-adjacency-changes redistribute bgp 100 subnets network 10.35.35.3 0.0.0.0 area 0 ! router ospf 1 log-adjacency-changes network 192.168.0.0 0.0.255.255 area 0 ! router bgp 100 no synchronization bgp log-neighbor-changes neighbor 192.168.0.1 remote-as 100 neighbor 192.168.0.1 update-source Loopback0 no auto-summary ! address-family vpnv4 neighbor 192.168.0.1 activate neighbor 192.168.0.1 send-community extended exit-address-family ! address-family ipv4 vrf VPN redistribute ospf 35 vrf VPN no synchronization exit-address-family
R4
interface Loopback0 ip address 172.16.4.4 255.255.255.0 ip ospf network point-to-point ! interface FastEthernet0/0 ip address 10.14.14.4 255.255.255.0 ! router ospf 1 log-adjacency-changes network 10.14.14.4 0.0.0.0 area 0 network 172.16.4.4 0.0.0.0 area 0
R5
interface Loopback0 ip address 172.16.5.5 255.255.255.0 ip ospf network point-to-point ! interface FastEthernet0/0 ip address 10.35.35.5 255.255.255.0 ! router ospf 1 log-adjacency-changes network 10.35.35.5 0.0.0.0 area 0 network 172.16.5.5 0.0.0.0 area 0
トラブルの症状
R4、R5でルーティングテーブルを見るとお互いのルートを確認できません。そのため、当然、通信が不可能な状態になってしまっています。
R4 show ip route
R4#show ip route ~省略~ Gateway of last resort is not set 172.16.0.0/24 is subnetted, 1 subnets C 172.16.4.0 is directly connected, Loopback0 10.0.0.0/24 is subnetted, 1 subnets C 10.14.14.0 is directly connected, FastEthernet0/0
R5 show ip route
R5#show ip route ~省略~ Gateway of last resort is not set 172.16.0.0/24 is subnetted, 1 subnets C 172.16.5.0 is directly connected, Loopback0 10.0.0.0/24 is subnetted, 1 subnets C 10.35.35.0 is directly connected, FastEthernet0/0
PEルータであるR1、R3とCEルータであるR4、R5はOSPFでルーティングを行っています。ネイバーを確認すると、次のように正常にOSPFネイバーを確認できています。
R4 show ip ospf neighbor
R4#sh ip ospf neighbor Neighbor ID Pri State Dead Time Address Interface 10.14.14.1 1 FULL/BDR 00:00:34 10.14.14.1 FastEthernet0/0
R5 show ip ospf neighbor
R5#show ip ospf neighbor Neighbor ID Pri State Dead Time Address Interface 10.35.35.3 1 FULL/BDR 00:00:38 10.35.35.3 FastEthernet0/0
そのため、PE-CE間のルーティングには特に問題がないと考えられます。問題はMPLSバックボーンにある可能性が高いです。そこでMPLSバックボーンを構成するR1、R2、R3で次のshowコマンドで原因の切り分けを行いました。
R1
show mpls interface
show mpls ldp neighbor
show ip bgp summary
show ip bgp neighbor
show ip bgp vpnv4 all
show ip route vrf VPN
R2
show mpls interface
show mpls ldp neighbor
R3
show mpls interface
show mpls ldp neighbor
show ip bgp summary
show ip bgp neighbor
show ip bgp vpnv4 all
show ip route vrf VPN
R1 showコマンドの結果
R1#show mpls interface Interface IP Tunnel Operational Serial1/0 Yes (ldp) No Yes R1#show mpls ldp neighbor Peer LDP Ident: 192.168.0.2:0; Local LDP Ident 192.168.0.1:0 TCP connection: 192.168.0.2.61071 - 192.168.0.1.646 State: Oper; Msgs sent/rcvd: 27/27; Downstream Up time: 00:16:50 LDP discovery sources: Serial1/0, Src IP addr: 192.168.12.2 Addresses bound to peer LDP Ident: 192.168.12.2 192.168.23.2 192.168.0.2 R1#show ip bgp summary BGP router identifier 192.168.0.1, local AS number 100 BGP table version is 1, main routing table version 1 Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 192.168.0.3 4 100 34 34 1 0 0 00:12:16 0 R1#show ip bgp neighbor BGP neighbor is 192.168.0.3, remote AS 100, internal link BGP version 4, remote router ID 192.168.0.3 BGP state = Established, up for 00:12:16 Last read 00:00:16, last write 00:00:16, hold time is 180, keepalive interval is 60 seconds Neighbor capabilities: Route refresh: advertised and received(old & new) Address family IPv4 Unicast: advertised and received Address family VPNv4 Unicast: received Message statistics: InQ depth is 0 OutQ depth is 0 Sent Rcvd Opens: 4 4 Notifications: 0 0 Updates: 6 6 Keepalives: 24 24 Route Refresh: 0 0 Total: 34 34 Default minimum time between advertisement runs is 0 seconds For address family: IPv4 Unicast BGP table version 1, neighbor version 1/0 Output queue size : 0 Index 1, Offset 0, Mask 0x2 1 update-group member Sent Rcvd Prefix activity: ---- ---- Prefixes Current: 0 0 Prefixes Total: 0 0 Implicit Withdraw: 0 0 Explicit Withdraw: 0 0 Used as bestpath: n/a 0 Used as multipath: n/a 0 Outbound Inbound Local Policy Denied Prefixes: -------- ------- Total: 0 0 Number of NLRIs in the update sent: max 0, min 0 Connections established 4; dropped 3 Last reset 00:12:47, due to Neighbor deleted Connection state is ESTAB, I/O status: 1, unread input bytes: 0 Connection is ECN Disabled, Mininum incoming TTL 0, Outgoing TTL 255 Local host: 192.168.0.1, Local port: 179 Foreign host: 192.168.0.3, Foreign port: 30997 Enqueued packets for retransmit: 0, input: 0 mis-ordered: 0 (0 bytes) Event Timers (current time is 0x101144): Timer Starts Wakeups Next Retrans 15 0 0x0 TimeWait 0 0 0x0 AckHold 14 0 0x0 SendWnd 0 0 0x0 KeepAlive 0 0 0x0 GiveUp 0 0 0x0 PmtuAger 0 0 0x0 DeadWait 0 0 0x0 iss: 3940898747 snduna: 3940899078 sndnxt: 3940899078 sndwnd: 16054 irs: 165713483 rcvnxt: 165713822 rcvwnd: 16046 delrcvwnd: 338 SRTT: 259 ms, RTTO: 579 ms, RTV: 320 ms, KRTT: 0 ms minRTT: 16 ms, maxRTT: 300 ms, ACK hold: 200 ms Flags: passive open, nagle, gen tcbs IP Precedence value : 6 Datagrams (max data segment is 536 bytes): Rcvd: 30 (out of order: 0), with data: 15, total data bytes: 338 Sent: 15 (retransmit: 0, fastretransmit: 0, partialack: 0, Second Congestion: 0), with data: 14, total data bytes: 330 R1#show ip bgp vpnv4 all BGP table version is 19, local router ID is 192.168.0.1 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path Route Distinguisher: 100:100 (default for vrf VPN) *> 10.14.14.0/24 0.0.0.0 0 32768 ? *> 172.16.4.0/24 10.14.14.4 2 32768 ? R1#show ip route vrf VPN Routing Table: VPN Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route Gateway of last resort is not set 172.16.0.0/24 is subnetted, 1 subnets O 172.16.4.0 [110/2] via 10.14.14.4, 00:16:29, FastEthernet0/0 10.0.0.0/24 is subnetted, 1 subnets C 10.14.14.0 is directly connected, FastEthernet0/0
R2 showコマンドの結果
R2#show mpls interface Interface IP Tunnel Operational Serial1/0 Yes (ldp) No Yes Serial1/1 Yes (ldp) No Yes R2#show mpls ldp neighbor Peer LDP Ident: 192.168.0.3:0; Local LDP Ident 192.168.0.2:0 TCP connection: 192.168.0.3.51579 - 192.168.0.2.646 State: Oper; Msgs sent/rcvd: 28/28; Downstream Up time: 00:17:46 LDP discovery sources: Serial1/1, Src IP addr: 192.168.23.3 Addresses bound to peer LDP Ident: 192.168.0.3 192.168.23.3 Peer LDP Ident: 192.168.0.1:0; Local LDP Ident 192.168.0.2:0 TCP connection: 192.168.0.1.646 - 192.168.0.2.61071 State: Oper; Msgs sent/rcvd: 28/27; Downstream Up time: 00:17:33 LDP discovery sources: Serial1/0, Src IP addr: 192.168.12.1 Addresses bound to peer LDP Ident: 192.168.0.1 192.168.12.1
R3 showコマンドの結果
R3#show mpls interface Interface IP Tunnel Operational Serial1/0 Yes (ldp) No Yes R3#show mpls ldp neighbor Peer LDP Ident: 192.168.0.2:0; Local LDP Ident 192.168.0.3:0 TCP connection: 192.168.0.2.646 - 192.168.0.3.51579 State: Oper; Msgs sent/rcvd: 29/28; Downstream Up time: 00:18:19 LDP discovery sources: Serial1/0, Src IP addr: 192.168.23.2 Addresses bound to peer LDP Ident: 192.168.12.2 192.168.23.2 192.168.0.2 R3#show ip bgp summary BGP router identifier 192.168.0.3, local AS number 100 BGP table version is 1, main routing table version 1 Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 192.168.0.1 4 100 35 35 1 0 0 00:13:33 0 R3#show ip bgp neighbor BGP neighbor is 192.168.0.1, remote AS 100, internal link BGP version 4, remote router ID 192.168.0.1 BGP state = Established, up for 00:13:33 Last read 00:00:33, last write 00:00:33, hold time is 180, keepalive interval is 60 seconds Neighbor capabilities: Route refresh: advertised and received(old & new) Address family IPv4 Unicast: advertised and received Address family VPNv4 Unicast: advertised Message statistics: InQ depth is 0 OutQ depth is 0 Sent Rcvd Opens: 4 4 Notifications: 0 0 Updates: 6 6 Keepalives: 25 25 Route Refresh: 0 0 Total: 35 35 Default minimum time between advertisement runs is 0 seconds For address family: IPv4 Unicast BGP table version 1, neighbor version 1/0 Output queue size : 0 Index 1, Offset 0, Mask 0x2 1 update-group member Sent Rcvd Prefix activity: ---- ---- Prefixes Current: 0 0 Prefixes Total: 0 0 Implicit Withdraw: 0 0 Explicit Withdraw: 0 0 Used as bestpath: n/a 0 Used as multipath: n/a 0 Outbound Inbound Local Policy Denied Prefixes: -------- ------- Total: 0 0 Number of NLRIs in the update sent: max 0, min 0 For address family: VPNv4 Unicast BGP table version 17, neighbor version 0/0 Output queue size : 0 Index 1, Offset 0, Mask 0x2 1 update-group member Sent Rcvd Prefix activity: ---- ---- Prefixes Current: 0 0 Prefixes Total: 0 0 Implicit Withdraw: 0 0 Explicit Withdraw: 0 0 Used as bestpath: n/a 0 Used as multipath: n/a 0 Outbound Inbound Local Policy Denied Prefixes: -------- ------- Total: 0 0 Number of NLRIs in the update sent: max 1, min 1 Connections established 4; dropped 3 Last reset 00:14:02, due to Peer closed the session Connection state is ESTAB, I/O status: 1, unread input bytes: 0 Connection is ECN Disabled, Mininum incoming TTL 0, Outgoing TTL 255 Local host: 192.168.0.3, Local port: 30997 Foreign host: 192.168.0.1, Foreign port: 179 Enqueued packets for retransmit: 0, input: 0 mis-ordered: 0 (0 bytes) Event Timers (current time is 0x1149C4): Timer Starts Wakeups Next Retrans 16 0 0x0 TimeWait 0 0 0x0 AckHold 15 14 0x0 SendWnd 0 0 0x0 KeepAlive 0 0 0x0 GiveUp 0 0 0x0 PmtuAger 0 0 0x0 DeadWait 0 0 0x0 iss: 165713483 snduna: 165713841 sndnxt: 165713841 sndwnd: 16027 irs: 3940898747 rcvnxt: 3940899097 rcvwnd: 16035 delrcvwnd: 349 SRTT: 264 ms, RTTO: 545 ms, RTV: 281 ms, KRTT: 0 ms minRTT: 16 ms, maxRTT: 300 ms, ACK hold: 200 ms Flags: active open, nagle IP Precedence value : 6 Datagrams (max data segment is 536 bytes): Rcvd: 16 (out of order: 0), with data: 15, total data bytes: 349 Sent: 32 (retransmit: 0, fastretransmit: 0, partialack: 0, Second Congestion: 0), with data: 16, total data bytes: 357 R3#show ip bgp vpnv4 all BGP table version is 17, local router ID is 192.168.0.3 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path Route Distinguisher: 100:100 (default for vrf VPN) *> 10.35.35.0/24 0.0.0.0 0 32768 ? *> 172.16.5.0/24 10.35.35.5 2 32768 ? R3#show ip route vrf VPN Routing Table: VPN Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route Gateway of last resort is not set 172.16.0.0/24 is subnetted, 1 subnets O 172.16.5.0 [110/2] via 10.35.35.5, 00:17:46, FastEthernet0/0 10.0.0.0/24 is subnetted, 1 subnets C 10.35.35.0 is directly connected, FastEthernet0/0
R1~R3のshowコマンドによって設定ミスがわかったので修正すると、正常にMPLS-VPNを通じてR4-R5間の通信ができるようになりました。
問題
- PE-CE間のルーティングには問題がないのに、R4-R5間で通信できない理由はなんですか?
- MPLS-VPN経由でR4-R5間の通信ができるようにするためには、どのように設定を修正すればよいですか?
解答
PE-CE間のルーティングには問題がないのに、R4-R5間で通信できない理由はなんですか?
R1でR3に対するMP-BGPネイバーをactivateしていなので、R1-R3間のMP-BGPネイバーが正しく確立されていない。そのため、R1-R3間でVPNv4ルートを交換できていない。
MPLS-VPN経由でR4-R5間の通信ができるようにするためには、どのように設定を修正すればよいですか?
R1
router bgp 100 address-family vpnv4 neighbor 192.168.0.3 activate
ワンポイント
- MP-BGPネイバーは、address-family vpnv4でのactivateを忘れずに
解説
PE-CE間でOSPFネイバーが確立されているので、CEルータには特に問題がないことがわかります。PEルータでの設定に問題があるために、R4-R5間の通信ができていません。
PEルータ間はMP-BGPによって、ユーザサイトのルートを32ビットのIPv4ルートから96ビットのVPNv4ルートに変換して交換します。PEルータ間でMP-BGPの設定が正しくないと、MP-BGPでユーザサイトのルートを交換できず、通信もできなくなります。MP-BGPネイバーが正常に確立されているかどうかは、show ip bgp neighborコマンドで確認します。R1でのshow ip bgp neighborコマンドを見てみます。
R1 show ip bgp neighbor 192.168.0.3 (activate前)
R1#show ip bgp neighbor BGP neighbor is 192.168.0.3, remote AS 100, internal link BGP version 4, remote router ID 192.168.0.3 BGP state = Established, up for 00:12:16 Last read 00:00:16, last write 00:00:16, hold time is 180, keepalive interval is 60 seconds Neighbor capabilities: Route refresh: advertised and received(old & new) Address family IPv4 Unicast: advertised and received Address family VPNv4 Unicast: received Message statistics: ~省略~
対象のネイバーとMP-BGPでのVPNv4ルートの交換が行われているかどうかは、「Address family VPNv4 Unicast: received」の部分でわかります。MP-BGPでVPNv4ルートを交換できているときは、この部分は、「advertised and received」になるはずです。R1でVPNv4ルートを受信しかできていないので、R1でMP-BGPネイバーをactivateしていないことが予想できます。そして、show running-configを見ると、やはりMP-BGPネイバーのactivateが抜けています。
R1 BGP設定抜粋
router bgp 100 no synchronization bgp log-neighbor-changes neighbor 192.168.0.3 remote-as 100 neighbor 192.168.0.3 update-source Loopback0 no auto-summary ! address-family ipv4 vrf VPN redistribute ospf 14 vrf VPN no synchronization exit-address-family
R1で、次のようにR3に対するMP-BGPネイバーをactivateします。
R1 R3に対するMP-BGPネイバーのactivate
router bgp 100 address-family vpnv4 neighbor 192.168.0.3 activate
activateしたあと、R1でshow ip bgp neighbor 192.168.0.3を見ると、VPNv4ルートの送受信ができていることがわかります。
R1 show ip bgp neighbor 192.168.0.3 (activate後)
R1#sh ip bgp neighbors 192.168.0.3 BGP neighbor is 192.168.0.3, remote AS 100, internal link BGP version 4, remote router ID 192.168.0.3 BGP state = Established, up for 00:01:02 Last read 00:00:01, last write 00:00:01, hold time is 180, keepalive interval is 60 seconds Neighbor capabilities: Route refresh: advertised and received(old & new) Address family IPv4 Unicast: advertised and received Address family VPNv4 Unicast: advertised and received Message statistics: ~省略~
VPNv4ルートの交換が行われるようになったので、R1ではR3から受信したVPNv4ルートを確認することができます。
R1 show ip bgp vpnv4 all
R1#show ip bgp vpnv4 all BGP table version is 11, local router ID is 192.168.0.1 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path Route Distinguisher: 100:100 (default for vrf VPN) *> 10.14.14.0/24 0.0.0.0 0 32768 ? *>i10.35.35.0/24 192.168.0.3 0 100 0 ? *> 172.16.4.0/24 10.14.14.4 2 32768 ? *>i172.16.5.0/24 192.168.0.3 2 100 0 ?
そして、R3から受信したVPNv4ルートは通常のIPv4ルートとしてOSPFでR4へアドバタイズされます。R4でのルーティングテーブルは次のようになります。
R4 show ip route
R4#show ip route Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route Gateway of last resort is not set 172.16.0.0/24 is subnetted, 2 subnets C 172.16.4.0 is directly connected, Loopback0 O E2 172.16.5.0 [110/2] via 10.14.14.1, 00:04:29, FastEthernet0/0 10.0.0.0/24 is subnetted, 2 subnets O E2 10.35.35.0 [110/1] via 10.14.14.1, 00:04:29, FastEthernet0/0 C 10.14.14.0 is directly connected, FastEthernet0/0
R1からR3へのVPNv4ルートも同様です。R3で通常のIPv4ルートとしてR5へOSPFでアドバタイズされます。その結果、R4-R5間の通信を正常に行うことができるようになります。R4からR5へPingすると、次のように成功します。
R4からR5へPing
R4#ping 172.16.5.5 source 172.16.4.4 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.16.5.5, timeout is 2 seconds: Packet sent with a source address of 172.16.4.4 !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 16/37/60 ms
MPLS/MPLS-VPN
- MPLSラベルスイッチングの設定と確認コマンド[Cisco]
- MPLSによるラベルスイッチングの設定例 [Cisco]
- MPLSによるトランジットASの構成
- MPLS 設定ミスの切り分けと修正 Part1
- MPLS 設定ミスの切り分けと修正 Part2
- MPLS-VPNの設定例 フルメッシュ(Any-to-Any)
- MPLS-VPNの設定例 エクストラネットVPN
- MPLS-VPNの設定例 セントラルサービスVPN
- MPLS-VPNの設定例 ハブ&スポークVPN
- OSPF Sham-linkの概要
- OSPF Sham-linkの設定
- MPLS-VPN 設定ミスの切り分けと修正 Part1
- MPLS-VPN 設定ミスの切り分けと修正 Part2
- MPLS-VPN 設定ミスの切り分けと修正 Part3
- MPLS-VPN 設定ミスの切り分けと修正 Part4
- MPLS-VPN 設定ミスの切り分けと修正 Part5
- MPLS-VPN 設定ミスの切り分けと修正 Part6