华为AR2220 BGP路由聚合的必要性

缺乏、安全感 2023-07-22 10:26 11阅读 0赞

## 一、网络拓扑 ##

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70][]

需求：AS65007内有四个用户网段，AS65008内有四个用户网段。AS65009内的AR4路由器比较低端，处理能力较低。现在希望AS65009的AR4既能访问AS65007和AS65008的内网段，又不想接收过多的明细路由。

## 二、基本配置 ##

1、AR1

1、接口配置
    <Huawei>system-view
    [Huawei]sysname AR1	
    [AR1]interface  GigabitEthernet  0/0/0
    [AR1-GigabitEthernet0/0/0]ip address  10.1.13.1 24	
    [AR1-GigabitEthernet0/0/0]quit
    [AR1]interface LoopBack 1
    [AR1-LoopBack1]ip address  10.1.0.1 24
    [AR1-LoopBack1]quit
    [AR1]interface  LoopBack 2
    [AR1-LoopBack2]ip address  10.1.1.1 24
    [AR1-LoopBack2]quit
    [AR1]interface  LoopBack 3
    [AR1-LoopBack3]ip address  10.1.2.1 24
    [AR1-LoopBack3]quit
    [AR1]interface  LoopBack 4
    [AR1-LoopBack4]ip address  10.1.3.1 24
    [AR1-LoopBack4]quit
    
    2、BGP配置
    [AR1]bgp 65007
    [AR1-bgp]peer 10.1.13.3 as-number 65009
    [AR1-bgp]import-route direct    #导入直连路由
    [AR1-bgp]quit

2、AR2

1、接口配置
    <Huawei>system-view
    [Huawei]sysname AR2
    [AR2]interface GigabitEthernet  0/0/1
    [AR2-GigabitEthernet0/0/1]ip address  10.1.23.2 24
    [AR2-GigabitEthernet0/0/1]quit
    [AR2]interface  LoopBack 1
    [AR2-LoopBack1]ip address  10.1.4.1 24
    [AR2-LoopBack1]quit
    [AR2]interface  LoopBack 2
    [AR2-LoopBack2]ip address  10.1.5.1 24
    [AR2-LoopBack2]quit
    [AR2]interface  LoopBack 3
    [AR2-LoopBack3]ip address  10.1.6.1 24
    [AR2-LoopBack3]quit
    [AR2]interface  LoopBack 4
    [AR2-LoopBack4]ip address 10.1.7.1 24
    [AR2-LoopBack4]quit
    
    2、BGP配置
    [AR2]bgp 65008	
    [AR2-bgp]peer 10.1.23.3 as-number 65009
    [AR2-bgp]import-route direct
    [AR2-bgp]quit

3、AR3

1、接口配置
    <Huawei>system-view 
    [Huawei]sysname AR3
    [AR3]interface  GigabitEthernet  0/0/0
    [AR3-GigabitEthernet0/0/0]ip address  10.1.13.3 24	
    [AR3-GigabitEthernet0/0/0]quit	
    [AR3]interface  GigabitEthernet  0/0/1
    [AR3-GigabitEthernet0/0/1]ip address  10.1.23.3 24	
    [AR3-GigabitEthernet0/0/1]quit	
    [AR3]interface  GigabitEthernet  0/0/2
    [AR3-GigabitEthernet0/0/2]ip address  10.1.34.3 24
    [AR3-GigabitEthernet0/0/2]quit
    [AR3]interface  LoopBack 0
    [AR3-LoopBack0]ip address  3.3.3.3 32
    [AR3-LoopBack0]quit
    
    2、OSPF配置
    [AR3]ospf router-id 3.3.3.3
    [AR3-ospf-1]area 0	
    [AR3-ospf-1-area-0.0.0.0]network 10.1.34.0 0.0.0.255
    [AR3-ospf-1-area-0.0.0.0]network 10.1.13.0 0.0.0.255	
    [AR3-ospf-1-area-0.0.0.0]network 10.1.23.0 0.0.0.255
    [AR3-ospf-1-area-0.0.0.0]network 3.3.3.3 0.0.0.0	
    [AR3-ospf-1-area-0.0.0.0]return 
    
    3、BGP配置
    [AR3]bgp 65009
    [AR3-bgp]peer 10.1.13.1 as-number 65007
    [AR3-bgp]peer 10.1.23.2 as-number 65008
    [AR3-bgp]import-route ospf 1
    [AR3-bgp]quit

4、AR4

1、接口配置
    <Huawei>system-view
    [Huawei]sysname AR4	
    [AR4]interface  GigabitEthernet  0/0/2
    [AR4-GigabitEthernet0/0/2]ip address  10.1.34.4 24
    [AR4-GigabitEthernet0/0/2]quit
    [AR4]interface  LoopBack 0
    [AR4-LoopBack0]ip address  4.4.4.4 32
    [AR4-LoopBack0]quit
    
    2、OSPF配置
    [AR4]ospf router-id 4.4.4.4	
    [AR4-ospf-1]area 0 
    [AR4-ospf-1-area-0.0.0.0]network 10.1.34.0 0.0.0.255
    [AR4-ospf-1-area-0.0.0.0]network  4.4.4.4 0.0.0.0
    [AR4-ospf-1-area-0.0.0.0]return

5、查看路由表，这时候AR1、AR2、AR3都能互通，AR1和AR2通过AR3的ospf能通AR4，但是AR4不知道AR1和AR2的路由

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 1][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 2][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 3][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 4][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 5][]

6、全部互通，OSPFf导入BGP（当BGP条目多的时候会存在隐患，所以需要进行聚合）

[AR3]ospf router-id 3.3.3.3
    [AR3-ospf-1]import-route bgp 
    [AR3-ospf-1]quit

## ![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 6][] ##

## 三、AS65007和AS65008通告的时候做聚合（方法一） ##

需要在对方的BGP做配置，如果对方不配合就不能实现，另外配置不当会潜在环路

1、静态路由聚合

[AR1]ip route-static 10.1.0.0 255.255.252.0 NULL 0
    [AR1]bgp 65007
    [AR1-bgp]network 10.1.0.0 255.255.252.0
    [AR1-bgp]undo  import-route direct        #如果没有，可以不删
    [AR1-bgp]quit

查看：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 7][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 8][]

2、自动聚合

[AR2]bgp 65008
    [AR2-bgp]summary automatic
    [AR2-bgp]quit

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 9][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 10][]

3、手动聚合

[AR2]bgp 65008	
    [AR2-bgp]undo summary automatic        #取消自动聚合
    [AR2-bgp]aggregate 10.1.4.0 255.255.252.0 detail-suppressed
    [AR2-bgp]quit

## ![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 11][] ##

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 12][]

## 四、AS65009内部AR3做路由策略选择（方法二） ##

根据自己需要的路由条目选择学习，不需要在对方BGP做配置

1、恢复AR1和AR2的操作，在AR3上配置OSPF导入BGP路由策略

[AR3]ospf router-id 3.3.3.3
    [AR3-ospf-1]undo  import-route bgp                    #如有没有配置，不用删除
    [AR3-ospf-1]import-route bgp route-policy import      #引用名为import的路由策略
    [AR3-ospf-1]quit

2、定义路由策略

[AR3]route-policy import permit node 10
    [AR3-route-policy]if-match ip-prefix import    #创建一个基于IP地址前缀列表的匹配规则，如果满足条件，则执行路由策略的import；这里import有两个含义
    [AR3-route-policy]quit

3、创建IPv4地址前缀列表

[AR3]ip ip-prefix import index 5 permit 10.1.0.0 24
    [AR3]ip ip-prefix import index 10 permit 10.1.4.0 24

4、查看，只有允许的路由条目，AR4才会学习到。解决了路由条目的路由表将占用大量的内存资源，传输路由信息需要占用大量的带宽资源； 明细路由频繁震荡造成网络不稳定等问题。

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 13][]

5、网络通讯正常

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 14][]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70]: /images/20230528/2ce759e4b650416497c391d44e75a670.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 1]: /images/20230528/293663db242744bc94b7264e9af3afce.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 2]: /images/20230528/b43a6fbfbf3648ffba2aee2240577090.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 3]: /images/20230528/8fb07a127fd44965a01333326e562411.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 4]: /images/20230528/0100807bdedb4eadabf305458d97c127.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 5]: /images/20230528/4e3de181775e4c09bd543b7e4add50b4.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 6]: /images/20230528/bd9dc6a1303b4f258b5d0a7e58d56cb5.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 7]: /images/20230528/6c84532ffb7b4833b1948078302a64ae.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 8]: /images/20230528/78e3a41165054b1e9bbabb4ee4e9f56b.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 9]: /images/20230528/1f26f47346a1407d8c772ca8c33e56de.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 10]: /images/20230528/732d4872b9184acfb6403cd5fe740b73.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 11]: /images/20230528/8b5d3a90142e481885e4d715064997dc.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 12]: /images/20230528/1bfbf6cfbdaf4f35acb433bfba684b8c.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 13]: /images/20230528/aca39a16a1df4224b2e2bfc84114ed96.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 14]: /images/20230528/0f440c5f0e3046b6a91c372bce50716a.png