ASR1K中通过VRF感知L2TPv3的Xconnect
简介
本文档介绍在配置第2层隧道协议(L2TP)v3 Xconnect over IP和多协议标签交换(MPLS)网络时如何使用虚拟路由和转发(VRF)。
背景信息
L2TP是Internet服务提供商(ISP)使用的隧道协议，用于在Internet上的拨号接入空间中提供虚拟专用网络(VPN)。
它结合了思科第2层转发(L2F)协议和Microsoft的点对点隧道协议(PPTP)的优势。 L2TP的主要组件是L2TP访问控制器(LAC)和L2TP网络服务器(LNS)。
L2TP访问控制器：LAC是连接到公共交换电话网(PSTN)的接入服务器。LAC是传入呼叫的发起方和传出呼叫的接收方。它通过LAN或WAN连接到LNS。
L2TP网络服务器：LNS是L2TP协议的网络服务器，PPP会话在此协议中终止并经过身份验证。LNS是呼出呼叫的发起者和呼入呼叫的接收者。
L2TPv2旨在通过IP网络传输PPP流量。网络接入设备（DSL、电缆调制解调器或拨号接入接口）接受用户的PPP连接，并通过L2TP将PPP会话通过隧道传输到ISP。新版本L2TPv3设计为除PPP外还承载任何第2层负载，PPP是第2版支持的唯一负载。具体而言，L2TPv3定义了L2TP协议，用于使用第2层VPN在IP核心网络上隧道化第2层负载。此功能的优点包括：
- L2TPv3简化了VPN的部署
- L2TPv3不需要MPLS
- L2TPv3支持任何负载的IP第2层隧道
以下是L2TPv3伪线的示例配置：
1.
enable
2.configure终端
3.interface type slot/port
4.xconnectpeer-ip-address vcidencapsulation l2tpv3pw-classpw-class-name
现在我们来了解一下L2TPv3 Xconnect在使用VRF时的行为方式。以下是用于演示的拓扑，在该拓扑中，我们在CPE与ASR1002(IP)和ASR1004(MPLS)之间配置Xconnect，在VRF中终端位于ASR1000（ASR1000平台不支持VRF感知L2TPv3）。
测试案例I:通过IP网络的L2TPv3 Xconnect，在VRF中具有终端
PE-1和PE-2使ISP成为MPLS网络。CPE通过VRF连接到PE-1,ASR1002通过VRF连接到PE-2。ASR1002在连接到PE-2的接口上也具有VRF。从ASR1002的CPE环回的可达性通过IP接口上的VRF实现。
在CPE上配置用于ASR1002的Xconnect:
interface FastEthernet4.2381
encapsulation dot1Q 2381
xconnect 3.3.3.3 2381 encapsulation l2tpv3 pw-class PSEUDO_CLASS >>>>>>>>>>> Xconnect with ASR1002
pseudowire-class PSEUDO_CLASS
encapsulation l2tpv3
interworking vlan
protocol l2tpv3 L2TP_CLASS
ip local interface Loopback0
ip tos reflect
l2tp-class L2TP_CLASS
authentication
password cisco
interface Gigabit0/1
ip address 192.168.8.190 255.255.255.0
end
Interface Loopback0
ip address 1.1.1.1 255.255.255.255
end
ip route 0.0.0.0 0.0.0.0 192.168.8.1 >>>>>>>>>>>>>> Default route towards PE-1
ASR1002上的工作配置：
interface GigabitEthernet0/0/0.906 —————————————————> Interface connected to PE-2 is in VRF
encapsulation dot1Q 906
ip vrf forwarding L2TP_VRF
ip address 10.1.1.1 255.255.255.252
interface GigabitEthernet0/0/1.2381
encapsulation dot1Q 2381
xconnect 1.1.1.1 2381 encapsulation l2tpv3 pw-class PSEUDO_CLASS
pseudowire-class PSEUDO_CLASS
encapsulation l2tpv3
interworking vlan
protocol l2tpv3 L2TP_CLASS
ip local interface Loopback11
l2tp-class L2TP_CLASS
authentication
password cisco
interface Loopback11
ip vrf forwarding L2TP_VRF ————————————————————————————> Source is in VRF
ip address 3.3.3.3 255.255.255.255
router bgp 1
address-family ipv4 vrf L2TP_VRF
redistribute connected
neighbor 10.1.1.2 remote-as 2 ———————————————> eBGP with PE-2 in VRF
neighbor 10.1.1.2 activate
neighbor 10.1.1.2 soft-reconfiguration inbound
exit-address-family
VRF L2TP_VRF:
B 1.1.1.1/32 [20/0] via 10.1.1.2, 1d ——————————> Xconnect end point learned via eBGP in VRF
现在让我们检查CPE上Xconnect的状态：
CPE #sh xconnect all de
Legend: XC ST=Xconnect State S1=Segment1 State S2=Segment2 State
UP=Up DN=Down AD=Admin Down IA=Inactive
SB=Standby HS=Hot Standby RV=Recovering NH=No Hardware
XC ST Segment 1 S1 Segment 2 S2
------+---------------------------------+--+---------------------------------+--
UP pri ac Fa4.2381:2381(Eth VLAN) UP l2tp 3.3.3.3:2381 DOWN
Interworking: vlan Session ID: 1906980494
Tunnel ID: 2886222725
Protocol State: DOWN
Remote Circuit State: DOWN
pw-class: PSEUDO_CLASS_VLAN
它表示数据段2已关闭，这意味着从CPE到ASR1002的路径有问题。但是，我们可以对终端执行ping操作。CPE上的调试显示到终端的隧道发生故障或没有到终端的路由。
*Feb 15 08:12:47.225: L2TP _____:18136:8DF92CB9/uid:0[1.1.1.1/2381]: I CDN, flg TLS, ver 3, len 80
*Feb 15 08:12:47.225: L2TP _____:18136:8DF92CB9/uid:0[1.1.1.1/2381]:IETF v2:
*Feb 15 08:12:47.225: L2TP _____:18136:8DF92CB9/uid:0[1.1.1.1/2381]:Result Code
*Feb 15 08:12:47.225: L2TP _____:18136:8DF92CB9/uid:0[1.1.1.1/2381]: Call disconnected for administrative reasons(3)
*Feb 15 08:12:47.225: L2TP _____:18136:8DF92CB9/uid:0[1.1.1.1/2381]: Error code
*Feb 15 08:12:47.225: L2TP _____:18136:8DF92CB9/uid:0[1.1.1.1/2381]: No error(0)
*Feb 15 08:12:47.225: L2TP _____:18136:8DF92CB9/uid:0[1.1.1.1/2381]: Optional msg
*Feb 15 08:12:47.225: L2TP _____:18136:8DF92CB9/uid:0[1.1.1.1/2381]: "Tunnel failed to 3.3.3.3" >>>>>>>>>>>>>>>>>
*Feb 15 08:12:47.225: L2TP _____:18136:8DF92CB9/uid:0[1.1.1.1/2381]:Cisco v3:
此处的主要问题是通过ASR1002上的VRF可访问终端。Xconnect终端需要位于全局路由表中才能启动。现在，让我们配置一条全局指向接口GigabitEthernet0/0/0.906（自身位于VRF中）的CPE Loopback 1.1.1.1/32路由。
ip route 1.1.1.1 255.255.255.255 GigabitEthernet0/0/0.906 10.1.1.2
S 1.1.1.1/32 [1/0] via 10.1.1.2, GigabitEthernet0/0/0.906
配置完虚拟静态路由后，Xconnect便会启动。您也可以将其指向Null0。这是一种解决方法，让路由器相信可通过全局而不是VRF访问终端，并且仅用于控制平面。实际数据平面流量将仅通过VRF。
以下是使用VRF和不使用VRF时的ping结果：
ASR1002 #ping 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
Ping vrf L2TP_VRF 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 33/50/72 ms
CPE上的Xconnect状态：
CPE #sh xconnect all de
Legend: XC ST=Xconnect State S1=Segment1 State S2=Segment2 State
UP=Up DN=Down AD=Admin Down IA=Inactive
SB=Standby HS=Hot Standby RV=Recovering NH=No Hardware
XC ST Segment 1 S1 Segment 2 S2
------+---------------------------------+--+---------------------------------+--
UP pri ac Fa4.2381:2381(Eth VLAN) UP l2tp3.3.3.3:2381 UP
Interworking: vlan Session ID: 1906980494
Tunnel ID: 2886222725
Protocol State: UP
Remote Circuit State: UP
pw-class: PSEUDO_CLASS_VLAN
测试案例II:通过MPLS网络的L2TPv3 Xconnect与VRF中的终端
PE-1、PE-2和PE-3使ISP的MPLS网络充当PE-2充当路由反射器(RR)。CPE通过VRF连接到PE-1,ASR1004通过接口上启用MPLS连接到PE-2。ASR1004还具有VRF，其中应通过RR从PE-1接收VPNv4路由。从ASR1004的CPE looback的可达性通过MPLS接口上的VRF实现。
在CPE上配置用于ASR1004的Xconnect:
interface FastEthernet4.2380
encapsulation dot1Q 2380
xconnect 2.2.2.2 2380 encapsulation l2tpv3 pw-class PSEUDO_CLASS >>>>>>>>>>Xconnect with ASR1004
interface FastEthernet4.2381
encapsulation dot1Q 2381
xconnect 3.3.3.3 2381 encapsulation l2tpv3 pw-class PSEUDO_CLASS >>>>>>>>>>> Xconnect with ASR1002
pseudowire-class PSEUDO_CLASS
encapsulation l2tpv3
interworking vlan
protocol l2tpv3 L2TP_CLASS
ip local interface Loopback0
ip tos reflect
l2tp-class L2TP_CLASS
authentication
password cisco
interface Gigabit0/1
ip address 192.168.8.190 255.255.255.0
end
Interface Loopback0
ip address 1.1.1.1 255.255.255.255
end
ip route 0.0.0.0 0.0.0.0 192.168.8.1 >>>>>>>>>>>>>> Default route towards PE-1
ASR1004上的配置：
interface GigabitEthernet0/0/1
no ip address
negotiation auto
service instance 2 ethernet
encapsulation dot1q 2380
xconnect 1.1.1.1 2380 encapsulation l2tpv3 pw-class PSEUDO_CLASS_VLAN
!
end
interface Loopback11
ip vrf forwarding L2TP_VRF —————————————————> Source Loopback in in VRF
ip address 2.2.2.2 255.255.255.255
end
pseudowire-class PSEUDO_CLASS_VLAN
encapsulation l2tpv3
interworking vlan
protocol l2tpv3 L2TP_CLASS
ip local interface Loopback11
l2tp-class L2TP_CLASS
authentication
password cisco
router bgp 2
address-family ipv4 vrf L2TP_VRF
redistribute connected
redistribute static
default-information originate
exit-address-family
Xconnect终端的路由条目：
ASR1004#sh ip rou vrf L2TP_VRF 1.1.1.1 . ——————————————————> Xconnect End Point also learned via VRF
Routing Table: L2TP_VRF
Routing entry for 1.1.1.1/32
Known via "bgp 2", distance 200, metric 0, type internal
Last update from 11.11.11.11 6d17h ago
Routing Descriptor Blocks:
* 11.11.11.11 (default), from 22.22.22.22, 6d17h ago
Route metric is 0, traffic share count is 1
AS Hops 0
MPLS label: 18
MPLS Flags: MPLS Required
We observed that Segment 2 was continuously flapping on both ends.
ASR1004#sh xc all de
Legend: XC ST=Xconnect State S1=Segment1 State S2=Segment2 State
UP=Up DN=Down AD=Admin Down IA=Inactive
SB=Standby HS=Hot Standby RV=Recovering NH=No Hardware
XC ST Segment 1 S1 Segment 2 S2
------+---------------------------------+--+---------------------------------+--
DN pri ac Gi0/0/1:2380(Eth VLAN) UP l2tp 1.1.1.1:2380 DN >>>>>>>>>>>>>>
Interworking: vlan Session ID: 2543426569
Tunnel ID: 3352120314
Protocol State: DOWN
Remote Circuit State: DOWN
pw-class: PSEUDO_CLASS_VLAN
ASR1004#sh xc all de
Legend: XC ST=Xconnect State S1=Segment1 State S2=Segment2 State
UP=Up DN=Down AD=Admin Down IA=Inactive
SB=Standby HS=Hot Standby RV=Recovering NH=No Hardware
XC ST Segment 1 S1 Segment 2 S2
------+---------------------------------+--+---------------------------------+--
UP pri ac Gi0/0/1:2380(Eth VLAN) UP l2tp 1.1.1,1:2380 UP >>>>>>>>>>>>>>>>
Interworking: vlan Session ID: 2543426569
Tunnel ID: 3352120314
Protocol State: UP
Remote Circuit State: UP
pw-class: PSEUDO_CLASS_VLAN
CPE中的日志：
CPE#sh xconnect all de
Legend: XC ST=Xconnect State S1=Segment1 State S2=Segment2 State
UP=Up DN=Down AD=Admin Down IA=Inactive
SB=Standby HS=Hot Standby RV=Recovering NH=No Hardware
XC ST Segment 1 S1 Segment 2 S2
------+---------------------------------+--+---------------------------------+--
DN pri ac Fa4.2380:2380(Eth VLAN) UP l2tp 2.2.2.2:2380 DN ---------------à Flapping with ASR1004
Interworking: vlan Session ID: 3434660693
Tunnel ID: 1760690853
Protocol State: DOWN
Remote Circuit State: DOWN
pw-class: PSEUDO_CLASS
UP pri ac Fa4.2381:2381(Eth VLAN) UP l2tp 3.3.3.3:2381 UP ---------------------à Stable with ASR1002
Interworking: vlan Session ID: 1906980494
Tunnel ID: 2886222725
Protocol State: UP
Remote Circuit State: UP
pw-class: PSEUDO_CLASS
CPE#sh l2tp session
L2TP Session Information Total tunnels 2 sessions 2
LocID RemID TunID Username, Intf/ State Last Chg Uniq ID
Vcid, Circuit
2714490989 3697021268 1760690853 2380, Fa4.2380:2380 est 00:00:03 0 ————————> Flapping with ASR1004
1906980494 2361475239 2886222725 2381, Fa4.2381:2381 est 15:37:06 0 ————————> Stable with ASR1002
在这种情况下，无法配置静态路由，因为送出接口是启用MPLS的接口。作为解决方法，有两个接口相互环回，并且在VRF中配置了一个接口，而在全局中配置另一个接口。然后在全局中配置一个指向VRF接口的静态路由，这样Xconnect变得稳定。
ASR1004#sh run int gi0/0/2
Building configuration...
Current configuration : 95 bytes
!
interface GigabitEthernet0/0/2 ——————————> Looped to Gi0/0/3
ip address 20.20.20.2 255.255.255.252
negotiation auto
end
#sh run int gi0/0/3
Building configuration...
Current configuration : 126 bytes
!
interface GigabitEthernet0/0/3
ip vrf forwarding L2TP_VRF
ip address 20.20.20.1 255.255.255.252
negotiation auto
end
ip route 10.246.131.62 255.255.255.255 20.20.20.1 ———————> Static route pointing towards an IP interface in Global
CPE#sh xconnect all de
Legend: XC ST=Xconnect State S1=Segment1 State S2=Segment2 State
UP=Up DN=Down AD=Admin Down IA=Inactive
SB=Standby HS=Hot Standby RV=Recovering NH=No Hardware
XC ST Segment 1 S1 Segment 2 S2
------+---------------------------------+--+---------------------------------+--
DN pri ac Fa4.2380:2380(Eth VLAN) UP l2tp 2.2.2.2:2380 UP
Interworking: vlan Session ID: 3434660693
Tunnel ID: 1760690853
Protocol State: DOWN
Remote Circuit State: DOWN
pw-class: PSEUDO_CLASS
UP pri ac Fa4.2381:2381(Eth VLAN) UP l2tp 3.3.3.3:2381 UP
Interworking: vlan Session ID: 1906980494
Tunnel ID: 2886222725
Protocol State: UP
Remote Circuit State: UP
pw-class: PSEUDO_CLASS
CPE#sh l2tp session
L2TP会话信息总计隧道2会话2:
LocID RemID TunID Username, Intf/ State Last Chg Uniq ID
Vcid, Circuit
2714490989 3697021268 1760690853 2380, Fa4.2380:2380 est 00:20:03 0
1906980494 2361475239 2886222725 2381, Fa4.2381:2381 est 15:37:06 0
ASR1004的流量被视为这种情况：
- 当流量来自ASR1004上的CPE时，它进入MPLS接口Gi0/0/1，并直接交换到Gi0/0/0接入端口。
- 当流量来自接入端口Gi0/0/0时，它采用Gi0/0/0 -> Gi0/0/2 -> Gi0/0/3 -> Gi0/0/1的循环路径。
此解决方法的主要问题是数据包处理两次时在ASR1000平台上的QFP使用率：
ASR1004# show platform packet-trace summary
Pkt Input Output State Reason
0 Gi0/0/3 Gi0/0/1 FWD
1 Gi0/0/3 Gi0/0/1 FWD
2 Gi0/0/3 Gi0/0/1 FWD
3 Gi0/0/0 Gi0/0/2 FWD
4 Gi0/0/0 Gi0/0/2 FWD
5 Gi0/0/0 Gi0/0/2 FWD
6 Gi0/0/0 Gi0/0/2 FWD
7 Gi0/0/0 Gi0/0/2 FWD
此行为记录在Doc Bug:CSCvi42964
反馈