网络工程 - BGP <-> OSPF 路由再分配循环 - 吾爱随笔录

BGP <-> OSPF 路由再分配循环

网络工程思科路由 bgp ospf 再分配

2021-08-01 23:16:01

在下面的拓扑中，我有一个来自 BGP <-> OSPF 的多点重新分配，我最近遇到了路由循环。进一步阅读后，我了解到有问题的路由器是 ISP-2 和 ISP-3，我需要标记路由并根据需要拒绝，这样循环就不会发生，但是，在尝试之后我知道 BGP 不支持标记( % "OSPF_TO_BGP" used as redistribute ospf into bgp route-map, set tag not supported). 在调查这个话题时，我被告知我可以通过 BGP 社区实现同样的目标，但我不知道应该如何实现这一点。我将不胜感激任何帮助。

注意：下面添加了图像、跟踪和配置

RB-5#trace 10.1.22.2  
Type escape sequence to abort.
Tracing the route to 10.1.22.2
VRF info: (vrf in name/id, vrf out name/id)
  1 172.16.52.2 11 msec 9 msec 6 msec
  2 172.16.65.1 [AS 65200] 9 msec 13 msec 7 msec
  3 10.1.11.2 [AS 65200] 9 msec 21 msec 20 msec
  4 10.1.31.1 [AS 65200] 29 msec 18 msec 15 msec
  5 10.0.32.2 [AS 65200] 17 msec 20 msec 10 msec
  6 10.0.42.1 [AS 65200] 18 msec 25 msec 13 msec
  7 172.16.34.2 [AS 65100] 21 msec 32 msec 18 msec
  8 172.16.32.2 [AS 65100] 13 msec 12 msec 14 msec
  9 172.16.65.1 [AS 65200] 15 msec 31 msec 16 msec
 10 10.1.11.2 [AS 65200] 15 msec 18 msec 16 msec
 11 10.1.31.1 [AS 65200] 18 msec 28 msec 24 msec
 12 10.0.32.2 [AS 65200] 22 msec 24 msec 13 msec
 13 10.0.42.1 [AS 65200] 22 msec 24 msec 22 msec
 14 172.16.34.2 [AS 65100] 34 msec 22 msec 16 msec
 15 172.16.32.2 [AS 65100] 20 msec 18 msec 17 msec
 16 172.16.65.1 [AS 65200] 41 msec 33 msec 26 msec
 17 10.1.11.2 [AS 65200] 20 msec 25 msec 28 msec
 18 10.1.31.1 [AS 65200] 31 msec 34 msec 28 msec
 19 10.0.32.2 [AS 65200] 21 msec 32 msec 24 msec
 20 10.0.42.1 [AS 65200] 26 msec 30 msec 31 msec
 21 172.16.34.2 [AS 65100] 37 msec 45 msec 44 msec
 22 172.16.32.2 [AS 65100] 12 msec 29 msec 36 msec
 23 172.16.65.1 [AS 65200] 24 msec 38 msec 33 msec
 24 10.1.11.2 [AS 65200] 31 msec 34 msec 32 msec
 25 10.1.31.1 [AS 65200] 68 msec 59 msec 63 msec
 26 10.0.32.2 [AS 65200] 42 msec 45 msec 35 msec
 27 10.0.42.1 [AS 65200] 28 msec 51 msec 30 msec
 28 172.16.34.2 [AS 65100] 45 msec 32 msec 48 msec
 29 172.16.32.2 [AS 65100] 41 msec 37 msec 41 msec
 30 172.16.65.1 [AS 65200] 39 msec 47 msec 39 msec

ISP-2 配置：

ISP-2(config)#do show run
Building configuration...

Current configuration : 2854 bytes
!
! Last configuration change at 08:07:38 UTC Thu Jul 29 2021
!
version 15.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service compress-config
!
hostname ISP-2
!
boot-start-marker
boot-end-marker
!
!
logging discriminator EXCESS severity drops 6 msg-body drops EXCESSCOLL 
logging buffered 50000
logging console discriminator EXCESS
!
no aaa new-model
!
!         
!         
!         
!         
no ip icmp rate-limit unreachable
!         
!         
!         
no ip domain-lookup
ip cef    
no ipv6 cef
!         
!         
!         
spanning-tree mode rapid-pvst
spanning-tree extend system-id
!         
vlan internal allocation policy ascending
!         
ip tcp synwait-time 5
!         
!         
!         
!         
!         
!         
!         
!         
!         
!         
!         
!         
!         
interface Ethernet0/0
 no switchport
 ip address 172.16.12.2 255.255.255.252
 duplex auto
!         
interface Ethernet0/1
 no switchport
 ip address 172.16.52.2 255.255.255.252
 duplex auto
!         
interface Ethernet0/2
 no switchport
 ip address 172.16.32.2 255.255.255.252
 duplex auto
!         
interface Ethernet0/3
 no switchport
 ip address 172.16.210.1 255.255.255.252
 duplex auto
!         
interface Ethernet1/0
 shutdown 
!         
interface Ethernet1/1
 shutdown 
!         
interface Ethernet1/2
 shutdown 
!         
interface Ethernet1/3
 shutdown 
!         
interface Ethernet2/0
 shutdown 
!         
interface Ethernet2/1
 shutdown 
!         
interface Ethernet2/2
 shutdown 
!         
interface Ethernet2/3
 shutdown 
!         
interface Ethernet3/0
 shutdown 
!         
interface Ethernet3/1
 shutdown 
!         
interface Ethernet3/2
 shutdown 
!         
interface Ethernet3/3
 no switchport
 ip address 172.16.65.2 255.255.255.252
 duplex auto
!         
interface Vlan1
 no ip address
 shutdown 
!         
router ospf 101
 redistribute bgp 65200 metric 1 metric-type 1 subnets route-map BGP_TO_OSPF
 network 172.16.65.0 0.0.0.3 area 1
!         
router bgp 65200
 bgp router-id 2.0.0.2
 bgp log-neighbor-changes
 neighbor 172.16.12.1 remote-as 15000
 neighbor 172.16.32.1 remote-as 65100
 neighbor 172.16.52.1 remote-as 25000
 neighbor 172.16.210.2 remote-as 65300
 !        
 address-family ipv4
  network 172.16.12.0 mask 255.255.255.252
  network 172.16.32.0 mask 255.255.255.252
  network 172.16.52.0 mask 255.255.255.252
  network 172.16.65.0 mask 255.255.255.252
  network 172.16.210.0 mask 255.255.255.252
  redistribute ospf 101 match internal external 1 external 2 route-map OSPF_TO_BGP
  neighbor 172.16.12.1 activate
  neighbor 172.16.32.1 activate
  neighbor 172.16.52.1 activate
  neighbor 172.16.210.2 activate
 exit-address-family
!         
ip forward-protocol nd
!         
ip bgp-community new-format
!         
no ip http server
no ip http secure-server
!         
!         
!         
route-map BGP_TO_OSPF deny 10
 match tag 111
!         
route-map BGP_TO_OSPF permit 20
 set tag 222
!         
route-map OSPF_TO_BGP deny 10
 match tag 222
!         
route-map OSPF_TO_BGP permit 20
 set tag 111
!         
!         
!         
control-plane
!         
!         
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line vty 0 4
 login    
!         
!         
end

4个回答

我在我的网络中做同样的事情，但它确实有效。我认为这里的区别在于您用于重新分发的标记，并且正如您提到的那样不受支持。您可以通过 ip 前缀而不是标签对路由映射进行过滤。请检查我的路由器中的示例，如果有帮助，请告诉我。

router ospf 1
 router-id 10.254.61.254
 redistribute bgp 65111 metric 10 route-map BGP-to-OSPF
 passive-interface default
 no passive-interface Loopback1
 no passive-interface Vlan4003
 network 10.211.61.72 0.0.0.3 area 11
 network 10.254.61.254 0.0.0.0 area 11
!
router bgp 65111
 bgp router-id 10.255.61.5
 bgp log-neighbor-changes
 neighbor 10.255.61.1 remote-as 65444
 neighbor 10.255.61.1 update-source GigabitEthernet0/0/0
 !
 address-family ipv4
  network 10.254.61.254 mask 255.255.255.255
  network 10.255.61.0 mask 255.255.255.248
  network 172.17.111.0 mask 255.255.255.0
  network 172.17.121.0 mask 255.255.255.0
  redistribute ospf 1 metric 10 route-map OSPF-to-BGP
  neighbor 10.255.61.1 activate
  neighbor 10.255.61.1 send-community
  neighbor 10.255.61.1 allowas-in 1
  neighbor 10.255.61.1 soft-reconfiguration inbound
 exit-address-family
!
ip prefix-list IPVPN seq 10 permit 10.30.0.0/16
ip prefix-list IPVPN seq 15 permit 172.19.221.0/24
ip prefix-list IPVPN seq 20 permit 172.19.21.0/24
ip prefix-list IPVPN seq 25 permit 10.7.0.0/16
!
ip prefix-list PF-LOCAL seq 10 permit 10.211.1.0/24
ip prefix-list PF-LOCAL seq 15 permit 172.17.101.0/24
ip prefix-list PF-LOCAL seq 20 permit 172.17.102.0/24
ip prefix-list PF-LOCAL seq 25 permit 172.17.103.0/24
ip prefix-list PF-LOCAL seq 30 permit 172.17.104.0/24
ip prefix-list PF-LOCAL seq 35 permit 172.17.105.0/24
ip prefix-list PF-LOCAL seq 40 permit 172.17.111.0/24
ip prefix-list PF-LOCAL seq 45 permit 172.17.121.0/24
!
ip prefix-list PL-DEFAULT-ROUTE seq 5 permit 0.0.0.0/0
!
!
route-map BGP-to-OSPF permit 10 
 match ip address prefix-list IPVPN
!
route-map OSPF-to-BGP permit 10 
 match ip address prefix-list PF-LOCAL
!
route-map RM-DENY-DEFAULT-IN deny 5 
 match ip address prefix-list PL-DEFAULT-ROUTE
!
route-map RM-DENY-DEFAULT-IN permit 10 
!

如果没有其他一些路由器 (RO-4/RO-1) 的配置，我们基本上是在猜测。但是，这听起来像是您自己的路线被宣布给您的经典问题。如果“ISP-2”应该是 ISP 的路由器，它就不会与您一起运行 OSPF。

在这个混乱的示例中，您在 OSPF 外部（通过 BGP）创建了 OSPF 区域 0 和 1 之间的循环。OSPF 显然看不到这一点。在常见的现实世界中，您永远不会将 OSPF 转储到 BGP 中。您将严格配置 BGP 以仅宣布您拥有的前缀——已知/预期在 AS 内的前缀——并从其他人向您宣布的内容中过滤掉这些前缀：

! (null routes covering owned prefixes, so they're always in the FIB)
ip route 246.152.0.0  255.255.224.0 Null0 200
ip route 246.152.32.0 255.255.240.0 Null0 200
ip route 246.152.48.0 255.255.240.0 Null0 200

router bgp ...
! (announce the networks I own)
network 246.152.0.0  mask 255.255.224.0
network 246.152.32.0 mask 255.255.240.0
network 246.152.48.0 mask 255.255.240.0

neighbor XXX distribute-list 111 in

! (for any global internet peer)
access-list 111 deny   ip 127.0.0.0 0.255.255.255 any log
access-list 111 deny   ip 10.0.0.0 0.255.255.255 any log
access-list 111 deny   ip 172.16.0.0 0.15.255.255 any log
access-list 111 deny   ip 192.168.0.0 0.0.255.255 any log
! ...
! (allow multi-homed customer's prefix)
access-list 111 permit ip 246.152.26.0 0.0.0.255 any
! ...
! (owned prefix)
access-list 111 deny   ip 246.152.0.0 0.0.63.255 any log
! ...
access-list 111 permit ip any any

如果您有多个独立的边界（用不同的 ASN 通告），则必须在其他边界过滤这些路由通告入口。

neighbor XXX filter-list 99 in

ip as-path access-list 99 deny (^|_)65100(_|$)
ip as-path access-list 99 deny (^|_)65200(_|$)
ip as-path access-list 99 deny (^|_)65300(_|$)

（类似的过滤可以使用路线图，包括使用标签和社区。）

昨天有这个对话。社区听起来很复杂，但实际上只是 BGP 的标签。有几种不同的方法可以解决这个问题。查看拓扑，我假设 RO-1 和 RO-4 是您的再分配集。考虑到这一点，您可以为 65100:10 和 65200:10 设置 BGP 社区（数字是任意的。标准做法是使用您的 ASN）。在重新分发点，您将添加一个路由映射以将重新分发的路由的社区设置为社区 65100:10 或 65200:10，然后在您的 eBGP 对等体上，您需要设置来自 ebgp 邻居的入站策略以匹配 65100： 10 或 65200:10 并拒绝这些路由。我正在打电话，所以输入示例配置有点困难，但希望这会有所帮助

要记住的关键事项：您需要接受和发送社区

建议打开软重置入站（有助于验证您是否看到了 NLRI 并可以相应地设置规则

入站策略：您可以匹配已知前缀或匹配社区。您可以设置一些条件，但这些条件有点复杂

您有几个几乎正确的路线图。就像您猜测的那样，您需要在 BGP 路由策略中使用社区。

ip community-list standard permit from-ospf <asn>:1

route-map BGP_TO_OSPF deny 10
 match community from-ospf
route-map BGP_TO_OSPF permit 20
 set tag 222

route-map OSPF_TO_BGP deny 10
 match tag 222
route-map OSPF_TO_BGP permit 20
 set community <asn>:1

其它你可能感兴趣的问题

上一篇哪一项正确，UDP 有 508 或 512 字节的有效负载限制？下一篇流量整形器和调度器有什么区别？