实验背景与拓扑解析在开始之前我们先看这张图。这是一个典型的运营商骨干网模型PE1 (左侧核心)连接客户 R1 和 R3。P (中间骨干)纯 IPv6 转发设备不需要感知VRF实例也不需要配置复杂的 SRv6 功能只要路由通就行。PE3 (右侧核心)连接客户 R2 和 R4。业务目标实现 R1 与 R2 互通VRF实例 AR3 与 R4 互通VRF实例 B。底层通过 SRv6 BE 隧道自动转发。IP 地址规划表设备接口IP 地址/掩码备注PE1Loopback01::1/128SRv6 源地址 BGP Router-IDGE0/0/1 (连P)2001:12::1/64GE0/0/2 (连R1/R3)10.1.11.1 / 10.1.13.1连接 CE 的网关PLoopback02::2/128GE0/0/0 (连PE1)2001:12::2/64GE0/0/1 (连PE3)2001:23::2/64PE3Loopback03::3/128SRv6 源地址 BGP Router-IDGE0/0/1 (连P)2001:23::3/64GE0/0/2 (连R2/R4)10.1.23.1 / 10.1.34.1连接 CE 的网关第一步打通底层地基IS-IS IPv6SRv6 的基础是 IPv6 路由可达。我们需要在 PE1、P、PE3 之间运行 IS-IS并且必须开启独立的 IPv6 拓扑这是 SRv6 的标准姿势。1. PE1 配置[PE1] isis 1 [PE1-isis-1] is-level level-2 [PE1-isis-1] cost-style wide [PE1-isis-1] network-entity 10.0000.0000.0000.0001.00 [PE1-isis-1] ipv6 enable topology ipv6 # 关键开启独立IPv6拓扑 [PE1-isis-1] quit [PE1] interface LoopBack0 [PE1-LoopBack0] ipv6 address 1::1 128 [PE1-LoopBack0] isis ipv6 enable [PE1] interface GigabitEthernet0/0/0 [PE1-GigabitEthernet0/0/1] ipv6 address 2001:12::1 [PE1-GigabitEthernet0/0/1] isis ipv6 enable2. P 设备配置P 设备只需要做纯粹的 IPv6 转发它甚至不需要知道 SRv6 是什么只要能把包送到 PE3 的 Loopback 即可。[P] isis 1 [P-isis-1] is-level level-2 [P-isis-1] cost-style wide [P-isis-1] network-entity 10.0000.0000.0000.0002.00 [P-isis-1] ipv6 enable topology ipv6 [P-isis-1] quit [P] interface LoopBack0 [P-LoopBack0] ipv6 address 2::2 128 [P-LoopBack0] isis ipv6 enable [P] interface GigabitEthernet0/0/0 [P-GigabitEthernet0/0/0] ipv6 address 2001:12::2 64 [P-GigabitEthernet0/0/0] isis ipv6 enable [P] interface GigabitEthernet0/0/1 [P-GigabitEthernet0/0/1] ipv6 address 2001:23::2 64 [P-GigabitEthernet0/0/1] isis ipv6 enable3. PE3 配置[PE3] isis 1 [PE3-isis-1] is-level level-2 [PE3-isis-1] cost-style wide [PE3-isis-1] network-entity 10.0000.0000.0000.0003.00 [PE3-isis-1] ipv6 enable topology ipv6 [PE3-isis-1] quit [PE3] interface LoopBack0 [PE3-LoopBack0] ipv6 address 3::3 128 [PE3-LoopBack0] isis ipv6 enable [PE3] interface GigabitEthernet0/0/0 [PE3-GigabitEthernet0/0/1] ipv6 address 2001:23::3 64 [PE3-GigabitEthernet0/0/1] isis ipv6 enable此时请在 PE1 上ping -a 1::1 3::3要先确保能通如果不通请排除配置否则后面的 SRv6 全都会挂掉。第二步配置 SRv6 Locator定义隧道端点这一步是给 PE 设备发“身份证”。我们要告诉网络“我是 SRv6 节点我的段路由前缀是 xxx”。PE1 配置[PE1] segment-routing ipv6 [PE1-srv6] encapsulation source-address 1::1 # 指定封装源地址 [PE1-srv6] locator jackey ipv6-prefix 2000:1:: 96 static 32 # 解释Locator名为jackey前缀2000:1::长度96位静态分配函数部分32位 [PE1-srv6] quit [PE1] isis 1 [PE1-isis-1] segment-routing ipv6 locator jackey # 将Locator通告进IS-ISPE3 配置[PE3] segment-routing ipv6 [PE3-srv6] encapsulation source-address 3::3 [PE3-srv6] locator jackey ipv6-prefix 2000:3:: 96 static 32 [PE3-srv6] quit [PE3] isis 1 [PE3-isis-1] segment-routing ipv6 locator jackey此时 P 设备虽然没有配置 SRv6但因为 IS-IS 传递了 2000:1::/96 的路由P 设备会把它当作普通 IPv6 路由进行转发。这就是 SRv6 兼容传统网络的奥秘第三步配置 实例与 End.DT4 行为这是最容易出错的地方。我们需要创建 VRF实例并在 SRv6 视图下绑定End.DT4行为。什么是 End.DT4简单来说就是告诉 PE“当你收到发给我的 SRv6 数据包且 SID 后缀是 ::11 时请把里面的 IPv4 报文解封装扔进 VRF实例 A 里去查表转发。”PE1 配置# 1. 创建实例 [PE1] ip vpn-instance A [PE1-vpn-a] route-distinguisher 1:1 [PE1-vpn-a] vpn-target 1:1 export-extcommunity [PE1-vpn-a] vpn-target 1:1 import-extcommunity [PE1-vpn-a] quit [PE1] ip vpn-instance B [PE1-vpn-b] route-distinguisher 2:2 [PE1-vpn-b] vpn-target 2:2 export-extcommunity [PE1-vpn-b] vpn-target 2:2 import-extcommunity [PE1-vpn-b] quit # 2. 接口绑定 实例 [PE1] interface GigabitEthernet0/0/1 [PE1-GigabitEthernet0/0/2] ip binding vpn-instance A [PE1-GigabitEthernet0/0/2] ip address 10.1.11.1 24 [PE1-GigabitEthernet0/0/2] quit [PE1] interface GigabitEthernet0/0/2 [PE1-GigabitEthernet0/0/2] ip binding vpn-instance B [PE1-GigabitEthernet0/0/2] ip address 10.1.13.1 24 [PE1-GigabitEthernet0/0/2] quit # 3. 配置 SRv6 End.DT4 (关键) [PE1] segment-routing ipv6 [PE1-srv6] locator jackey [PE1-srv6-locator] opcode ::11 end-dt4 vpn-instance A [PE1-srv6-locator] opcode ::22 end-dt4 vpn-instance B # 解释::11 是函数值组合起来 SID 就是 2000:1::11/128PE3 配置# 1. 创建实例 (RD/RT 必须与 PE1 对应一致才能互通) [PE3] ip vpn-instance A [PE3-vpn-a] route-distinguisher 1:1 [PE3-vpn-a] vpn-target 1:1 export-extcommunity [PE3-vpn-a] vpn-target 1:1 import-extcommunity [PE3-vpn-a] quit [PE3] ip vpn-instance B [PE3-vpn-b] route-distinguisher 2:2 [PE3-vpn-b] vpn-target 2:2 export-extcommunity [PE3-vpn-b] vpn-target 2:2 import-extcommunity [PE3-vpn-b] quit # 2. 接口绑定 实例 [PE3] interface GigabitEthernet0/0/1 [PE3-GigabitEthernet0/0/2] ip binding vpn-instance A [PE3-GigabitEthernet0/0/2] ip address 10.1.23.1 24 [PE3-GigabitEthernet0/0/2] quit [PE3] interface GigabitEthernet0/0/2 [PE3-GigabitEthernet0/0/2] ip binding vpn-instance A [PE3-GigabitEthernet0/0/2] ip address 10.1.34.1 24 [PE3-GigabitEthernet0/0/2] quit # 3. 配置 SRv6 End.DT4 [PE3] segment-routing ipv6 [PE3-srv6] locator jackey [PE3-srv6-locator] opcode ::11 end-dt4 vpn-instance A [PE3-srv6-locator] opcode ::22 end-dt4 vpn-instance B第四步配置 CE 设备R1 - R4CE 设备很简单只需要配置接口 IP 和普通 EBGP。1. R1 配置 (左上,)[R1] interface GigabitEthernet0/0/0 [R1-GigabitEthernet0/0/0] ip address 10.1.11.254 24 [R1-GigabitEthernet0/0/0] quit [R1] interface LoopBack0 [R1-LoopBack0] ip address 10.1.1.1 24 [R1-LoopBack0] quit [R1] bgp 65001 [R1-bgp] router-id 1.1.1.1 [R1-bgp] peer 10.1.11.1 as-number 100 [R1-bgp] ipv4-family unicast [R1-bgp-af-ipv4] peer 10.1.11.1 enable [R1-bgp-af-ipv4] network 10.1.1.0 24 [R1-bgp-af-ipv4] return2. R2 配置 (右上)[R2] interface GigabitEthernet0/0/0 [R2-GigabitEthernet0/0/0] ip address 10.1.23.254 24 [R2-GigabitEthernet0/0/0] quit [R2] interface LoopBack0 [R2-LoopBack0] ip address 10.1.2.1 24 [R2-LoopBack0] quit [R2] bgp 65002 [R2-bgp] router-id 2.2.2.2 [R2-bgp] peer 10.1.23.1 as-number 100 [R2-bgp] ipv4-family unicast [R2-bgp-af-ipv4] peer 10.1.23.1 enable [R2-bgp-af-ipv4] network 10.1.2.0 24 [R2-bgp-af-ipv4] return3. R3 配置 (左下)[R3] interface GigabitEthernet0/0/0 [R3-GigabitEthernet0/0/0] ip address 10.1.13.254 24 [R3-GigabitEthernet0/0/0] quit [R3] interface LoopBack0 [R3-LoopBack0] ip address 192.168.1.1 24 [R3-LoopBack0] quit [R3] bgp 65003 [R3-bgp] router-id 3.3.3.3 [R3-bgp] peer 10.1.13.1 as-number 100 [R3-bgp] ipv4-family unicast [R3-bgp-af-ipv4] peer 10.1.13.1 enable [R3-bgp-af-ipv4] network 192.168.1.0 24 [R3-bgp-af-ipv4] return4. R4 配置 (右下)[R4] interface GigabitEthernet0/0/0 [R4-GigabitEthernet0/0/0] ip address 10.1.34.254 24 [R4-GigabitEthernet0/0/0] quit [R4] interface LoopBack0 [R4-LoopBack0] ip address 192.168.2.1 24 [R4-LoopBack0] quit [R4] bgp 65004 [R4-bgp] router-id 4.4.4.4 [R4-bgp] peer 10.1.34.1 as-number 100 [R4-bgp] ipv4-family unicast [R4-bgp-af-ipv4] peer 10.1.34.1 enable [R4-bgp-af-ipv4] network 192.168.2.0 24 [R4-bgp-af-ipv4] return第五步建立 MP-BGP (VPNv4) 邻居并启用 SRv6 BE最后一步让 PE 之间交换 VPNv4 路由并告诉 BGP“请用 SRv6 BE 隧道来传输这些流量”。PE1 BGP 配置[PE1] bgp 100 [PE1-bgp] router-id 1.1.1.1 [PE1-bgp] peer 3::3 as-number 100 [PE1-bgp] peer 3::3 connect-interface LoopBack0 # 使能 VPNv4 家族 [PE1-bgp] ipv4-family vpnv4 [PE1-bgp-af-vpnv4] peer 3::3 enable [PE1-bgp-af-vpnv4] peer 3::3 prefix-sid # 解释prefix-sid 允许交换携带 Prefix SID 属性的路由 # 进入实例 A 的视图应用 SRv6 策略 [PE1-bgp] ipv4-family vpn-instance A [PE1-bgp-vpn-a] segment-routing ipv6 locator jackey [PE1-bgp-vpn-a] segment-routing ipv6 best-effort # 解释best-effort 表示使用 SRv6 BE 隧道自动计算路径 # 进入实例 B 的视图 [PE1-bgp] ipv4-family vpn-instance B [PE1-bgp-vpn-b] segment-routing ipv6 locator jackey [PE1-bgp-vpn-b] segment-routing ipv6 best-effortPE3 BGP 配置[PE3] bgp 100 [PE3-bgp] router-id 2.2.2.2 [PE3-bgp] peer 1::1 as-number 100 [PE3-bgp] peer 1::1 connect-interface LoopBack0 [PE3-bgp] ipv4-family vpnv4 [PE3-bgp-af-vpnv4] peer 1::1 enable [PE3-bgp-af-vpnv4] peer 1::1 prefix-sid [PE3-bgp] ipv4-family vpn-instance A [PE3-bgp-vpn-a] segment-routing ipv6 locator jackey [PE3-bgp-vpn-a] segment-routing ipv6 best-effort [PE3-bgp] ipv4-family vpn-instance B [PE3-bgp-vpn-b] segment-routing ipv6 locator jackey [PE3-bgp-vpn-b] segment-routing ipv6 best-effort第六步验证与排错配置完成后按以下顺序检查检查 BGP 邻居状PE1 display bgp vpnv4 all peer确保 State 是Established。如果不是检查 Loopback 是否互通AS号是否配错。检查 VPNv4 路PE1 display bgp vpnv4 all routing-table你应该能看到从 PE3 学过来的 10.1.2.0/24 等路由并且 NextHop 是 IPv6 地址即 PE3 的 Loopback。检查 SRv6 Local SIDPE1 display segment-routing ipv6 local sid重点查找2000:1::11和2000:1::22行为应该是End.DT4。如果没有说明第三步配置有误。最终 Ping 测试在 R1 上 Ping R2[R1] ping -a 10.1.1.1 10.1.2.1如果能通恭喜你你已经成功掌握了 SRv6 BE BGP VPNv4 的核心配置这个实验最难的地方在于理解“三层解耦”IS-IS负责修路IPv6 连通性。SRv6 Locator负责定坐标给 PE 贴标签。BGP负责指路告诉流量要去哪个坐标进哪个 实例。只要理清这三层关系配置起来就游刃有余了。