配置BGP IPv6 Flowspec
簡介
本文描述如何在ASR1K上配置邊界網關協定(BGP)IPv6 Flowspec。
必要條件
需求
思科建議您瞭解以下主題：
- 獨立於平台
採用元件
本文中的資訊係根據以下軟體和硬體版本：
- IOS-XE
- ASR1000
- ASR9K
- ASR1K
- BGP
- Flowspec
- IPv6
本文中的資訊是根據特定實驗室環境內的裝置所建立。文中使用到的所有裝置皆從已清除（預設）的組態來啟動。如果您的網路運作中，請確保您瞭解任何指令可能造成的影響。
背景資訊
Flowspec指定通過BGP分發流規範規則的過程，並定義將流規範規則編碼為邊界網關協定網路層可達性資訊(BGP NLRI)的程式，該資訊可在任何應用中使用。它還定義了用於資料包過濾的應用程式，以緩解（分散式）拒絕服務攻擊。
限制
以下是組態的限制：
- flowspec規則中不允許混合使用地址系列。
- 在多匹配方案中，僅應用第一個匹配的flowspec規則。
- 每個系統最多支援3000 flowspec規則。
設定
在本示例中，我們將ASR9K配置為控制器，將ASR1K配置為PE、RR和Flowspec客戶端。
這是IPv6 Flowspec工作所需的最低配置。
On controller to push the policy to PE/client: class-map type traffic match-all FLOWSPEC match destination-address ipv6 2001:db8::/32 <<<<< Match destination address/subnet. end-class-map ! policy-map type pbr FS_P class type traffic FLOWSPEC <<<<< Apply class-map under policy-map. drop ! flowspec address-family ipv4 service-policy type pbr FSP_V4 ! address-family ipv6 service-policy type pbr FS_P <<<<< Apply policy-map inside Flowspec under AF. ! On PE/client is to enable IPv6 flowspec AF under BGP. address-family ipv6 flowspec <<<<< Under ipv6 flowspec AF, activate the neighbor. neighbor 10.192.202.5 activate neighbor 10.192.202.5 validation off To apply the flowspec policy on interface, "local-install interface-all" command is must under flowspec. flowspec local-install interface-all <<<<< Push the policy on interface.
- 根據控制器配置，任何目的地為2001:db8::/32的流量都會根據策略被丟棄。
- 在ipv6 address-family下關閉鄰居的驗證，以便ASR1K不會檢查下一跳。
- 理想情況下，如果策略處於活動狀態，則會在控制器中看到計數器，但如果您希望在任何其他裝置上看到該計數器，請在所有使用者介面上安裝flowspec策略，在flowspec下需要local-install interface-all命令。
故障排除期間面臨的挑戰
- 如果底層網路是IPv4，並且為IPv6運行BGP flowspec，則每個躍點的驗證檢查存在問題，並且會導致IPv6 Flowspec策略的問題。因此，請關閉驗證，以便鄰居不執行驗證檢查。
- 除了控制器之外，您無法看到flowspec策略匹配/操作計數器。為了檢查計數器，local-install interface-all必須位於Flowspec下（在AF下）。 此命令將流量規範策略配置推送到裝置的所有介面上的IPv4和IPv6地址系列，以及VRF例項內的介面。
網路圖表
+----------------+ +-----------------+ +------------------+ +-----------------+ | | | | | | | | | Controller +--------------+ PE/RR1 +------------+ PE/RR2 +-------------+ End-PE | | ASR9K | | CRR01 | | CRR02 | | DCPR01 | +----------------+ +-----------------+ +------------------+ +-----------------+
組態
此配置基於網路圖，與您的設定相同。
Controller: RP/0/RSP0/CPU0:Controller# show running-config Mon Apr 8 16:33:36.578 UTC Building configuration... !! IOS XR Configuration 5.3.4 !! Last configuration change at Wed Apr 3 17:34:59 2019 by admin ! hostname Controller cdp cdp advertise v1 ! class-map type traffic match-all FLOWSPEC match destination-address ipv6 2001:db8::/32 end-class-map ! class-map type traffic match-all V4_FLOWSPEC match source-address ipv4 102.102.102.102 255.255.255.255 end-class-map ! policy-map type pbr FS_P class type traffic FLOWSPEC drop ! class type traffic class-default ! end-policy-map ! policy-map type pbr FSP_V4 class type traffic V4_FLOWSPEC set dscp ef ! class type traffic class-default ! end-policy-map ! interface Loopback0 ipv4 address 10.192.202.5 255.255.255.255 ! interface Loopback100 ipv4 address 102.102.102.102 255.255.255.255 ipv6 address 2001:db8::1/32 ! interface TenGigE0/0/0/0 ipv4 address 10.10.12.1 255.255.255.0 ipv6 address 2001:10:10:12::1/64 ! route-policy ALL pass end-policy ! router static address-family ipv4 unicast 203.202.143.33/32 TenGigE0/0/0/0 ! address-family ipv6 unicast 2003::/64 2001:10:10:12::2 ! ! router ospfv3 1 area 0 interface TenGigE0/0/0/0 network point-to-point ! ! ! router bgp 64696 bgp router-id 10.192.202.5 address-family ipv4 unicast network 102.102.102.102/32 ! address-family vpnv4 unicast ! address-family ipv4 flowspec ! address-family ipv6 flowspec ! neighbor 203.202.143.33 remote-as 7474 ebgp-multihop 10 update-source Loopback0 address-family ipv4 unicast route-policy ALL in route-policy ALL out ! address-family vpnv4 unicast ! address-family ipv4 flowspec route-policy ALL in route-policy ALL out ! address-family ipv6 flowspec route-policy ALL in route-policy ALL out ! ! ! flowspec local-install interface-all address-family ipv4 service-policy type pbr FSP_V4 ! address-family ipv6 service-policy type pbr FS_P ! ! end
PE/RR1: CRR01#show running-config Building configuration... ! ipv6 unicast-routing mpls label protocol ldp ! spanning-tree extend system-id flowspec local-install interface-all diagnostic bootup level minimal ! interface Loopback0 ip address 203.202.143.33 255.255.255.255 ip ospf 1 area 0 ! interface Loopback1010 no ip address ipv6 address 2001:DB8::10/32 ! interface TenGigabitEthernet0/0/0 ip address 10.10.12.2 255.255.255.0 ip ospf network point-to-point cdp enable ipv6 address 2001:10:10:12::2/64 ! interface TenGigabitEthernet0/0/3 ip address 10.10.23.2 255.255.255.0 ip ospf network point-to-point ip ospf 1 area 0 cdp enable ipv6 address 2003::1/64 mpls ip ! router ospf 1 mpls ldp autoconfig ! router bgp 7474 bgp router-id 203.202.143.33 bgp log-neighbor-changes neighbor 10.192.202.5 remote-as 64696 neighbor 10.192.202.5 ebgp-multihop 10 neighbor 10.192.202.5 update-source Loopback0 neighbor 2001:10:10:12::1 remote-as 64696 neighbor 203.202.143.44 remote-as 7474 neighbor 203.202.143.44 update-source Loopback0 ! address-family ipv4 neighbor 10.192.202.5 activate no neighbor 2001:10:10:12::1 activate neighbor 203.202.143.44 activate neighbor 203.202.143.44 route-reflector-client exit-address-family ! address-family ipv4 flowspec neighbor 10.192.202.5 activate neighbor 203.202.143.44 activate neighbor 203.202.143.44 send-community both neighbor 203.202.143.44 route-reflector-client exit-address-family ! address-family ipv6 neighbor 10.192.202.5 activate neighbor 203.202.143.44 activate neighbor 203.202.143.44 route-reflector-client neighbor 203.202.143.44 send-label exit-address-family ! address-family ipv6 flowspec neighbor 10.192.202.5 activate neighbor 10.192.202.5 validation off neighbor 203.202.143.44 activate neighbor 203.202.143.44 send-community both neighbor 203.202.143.44 route-reflector-client neighbor 203.202.143.44 next-hop-self exit-address-family ! ip route 10.192.202.5 255.255.255.255 10.10.12.1 ! ! ipv6 route 2001:DB8::1/128 2001:10:10:12::1 ! end
PE/RR2: CRR02#show running-config Building configuration... Current configuration : 7227 bytes ! ! Last configuration change at 18:21:29 UTC Mon Apr 8 2019 ! hostname CRR02 ! boot-start-marker boot system flash bootflash:asr1000rpx86-universalk9.16.10.01a.SPA.bin boot-end-marker ! ipv6 unicast-routing multilink bundle-name authenticated ! spanning-tree extend system-id flowspec diagnostic bootup level minimal ! interface Loopback0 ip address 203.202.143.44 255.255.255.255 ip ospf 1 area 0 ! interface TenGigabitEthernet1/0/0 ip address 10.10.23.3 255.255.255.0 ip ospf network point-to-point ip ospf 1 area 0 cdp enable ipv6 address 2003::2/64 mpls ip ! interface TenGigabitEthernet1/0/1 ip address 10.10.34.3 255.255.255.0 ip ospf network point-to-point ip ospf 1 area 0 cdp enable ! router ospf 1 mpls ldp autoconfig ! router bgp 7474 bgp router-id 203.202.143.44 bgp log-neighbor-changes neighbor 203.202.143.33 remote-as 7474 neighbor 203.202.143.33 update-source Loopback0 neighbor 203.202.143.45 remote-as 7474 neighbor 203.202.143.45 update-source Loopback0 ! address-family ipv4 neighbor 203.202.143.33 activate neighbor 203.202.143.45 activate exit-address-family ! address-family ipv4 flowspec neighbor 203.202.143.33 activate neighbor 203.202.143.45 activate neighbor 203.202.143.45 send-community both neighbor 203.202.143.45 route-reflector-client exit-address-family ! address-family ipv6 neighbor 203.202.143.33 activate neighbor 203.202.143.33 send-label exit-address-family ! address-family ipv6 flowspec neighbor 203.202.143.33 activate neighbor 203.202.143.33 validation off neighbor 203.202.143.45 activate neighbor 203.202.143.45 send-community both neighbor 203.202.143.45 route-reflector-client exit-address-family ! ipv6 route 2001:10:10:12::/64 2003::1 ipv6 route 2001:DB8::1/128 2003::1 ! end
End-PE: DCPR01#show running-config Building configuration... ! hostname DCPR01 ! subscriber templating ! ipv6 unicast-routing ! flowspec diagnostic bootup level minimal ! interface Loopback0 ip address 203.202.143.45 255.255.255.255 ip ospf 1 area 0 ! interface TenGigabitEthernet1/3/0 ip address 10.10.34.4 255.255.255.0 ip ospf network point-to-point ip ospf 1 area 0 cdp enable ipv6 address 2001::1/64 ! router ospf 1 mpls ldp autoconfig ! router bgp 7474 bgp router-id 203.202.143.45 bgp log-neighbor-changes neighbor 203.202.143.44 remote-as 7474 neighbor 203.202.143.44 update-source Loopback0 ! address-family ipv4 flowspec neighbor 203.202.143.44 activate exit-address-family ! address-family ipv6 flowspec neighbor 203.202.143.44 activate neighbor 203.202.143.44 validation off exit-address-family ! ipv6 route ::/0 TenGigabitEthernet1/3/0 ! end
驗證
PE/RR2: CRR02#ping 2001:db8::1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2001:DB8::1, timeout is 2 seconds: ..... Success rate is 0 percent (0/5) CRR02#
Controller:
RP/0/RSP0/CPU0:Controller#show bgp ipv6 flowspec
Mon Apr 8 17:55:17.041 UTC
BGP router identifier 10.192.202.5, local AS number 64696
BGP generic scan interval 60 secs
Non-stop routing is enabled
BGP table state: Active
Table ID: 0x0 RD version: 20
BGP main routing table version 20
BGP NSR Initial initsync version 0 (Reached)
BGP NSR/ISSU Sync-Group versions 0/0
BGP scan interval 60 secs
Status codes: s suppressed, d damped, h history, * valid, > best
i - internal, r RIB-failure, S stale, N Nexthop-discard
Origin codes: i - IGP, e - EGP, ? - incomplete
Network Next Hop Metric LocPrf Weight Path
*> Dest:2001:db8::/0-32/56
:: 0 i
Processed 1 prefixes, 1 paths
RP/0/RSP0/CPU0:Controller#show flowspec ipv6 detail
Mon Apr 8 17:55:36.786 UTC
AFI: IPv6
Flow :Dest:2001:db8::/0-32
Actions :Traffic-rate: 0 bps (policy.1.FS_P.FLOWSPEC)
Statistics (packets/bytes)
Matched : 14/1652
Dropped : 14/1652
RP/0/RSP0/CPU0:BGL14.1.J.05-ASR-9000-1#
PE/RR1:
CRR01#show bgp ipv6 flowspec
BGP table version is 2, local router ID is 203.202.143.33
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
t secondary path,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
Network Next Hop Metric LocPrf Weight Path
*> Dest:2001:DB8::/0-32
:: 0 64696 i
CRR01#
CRR01#show flowspec ipv6 detail
AFI: IPv6
Flow :Dest:2001:DB8::/0-32
Actions :Traffic-rate: 0 bps (bgp.1)
Statistics (packets/bytes)
Matched : 4/456
Dropped : 4/456
CRR01#
疑難排解
目前尚無適用於此組態的具體疑難排解資訊。
意見