CCNP课程实验-08-BGP-Trouble-Shooting
目录
- 实验条件
- 网络拓朴
- 背景环境配置
- 1. 确保所有的邻居正常建立
- 错点1：R4-R7邻居建立报错，BGP认证不通过
- 错点2：4.4.4.4 没有宣告进OSPF
- 错点3：R5-R6邻居被关闭，重新启用
- 错点4：交换机接口没开
- 2. 路由选择
- 去往3.3.3.3路径调整
- 错点5：3.3.3.3没有正确宣告进BGP
- 去往2.2.2.2路径调整
- 去往1.1.1.1/1.1.1.2路径调整
- 错点6：R1重分布时，过滤路由时配置错误
- 错误7：12，13网段被过滤，R2，R3的IBGP邻居要配置下一跳的IP地址为自己
- 错点8：R8没有开启BGP多路负载均衡
- 错点9：route-map 应用方向错误
- 另外一种方法达到目的
实验条件
网络拓朴
背景环境配置
R1
interface Loopback0ip address 1.1.1.2 255.255.255.255 secondaryip address 1.1.1.1 255.255.255.255
interface Ethernet0/0ip address 12.1.1.1 255.255.255.0
interface Ethernet0/1ip address 13.1.1.1 255.255.255.0ip prefix-list CON seq 5 deny 12.1.1.0/24
ip prefix-list CON seq 10 deny 13.1.1.0/24route-map RED permit 10match ip address prefix-list CONrouter bgp 1111bgp router-id 1.1.1.1redistribute connected route-map REDneighbor 12.1.1.2 remote-as 12345neighbor 13.1.1.3 remote-as 12345
R2
interface Loopback0ip address 2.2.2.2 255.255.255.255ip ospf 12345 area 0
interface Ethernet0/0ip address 12.1.1.2 255.255.255.0
interface Ethernet0/2ip address 23.1.1.2 255.255.255.0ip ospf 12345 area 0ip ospf cost 1000
interface Ethernet0/3ip address 25.1.1.2 255.255.255.0ip ospf 12345 area 0router ospf 12345router-id 2.2.2.2
router bgp 12345bgp router-id 2.2.2.2bgp default local-preference 150network 2.2.2.2 mask 255.255.255.255neighbor 5.5.5.5 remote-as 12345neighbor 5.5.5.5 update-source Loopback0neighbor 5.5.5.5 route-map LP inneighbor 12.1.1.1 remote-as 1111access-list 1 permit 1.1.1.1
access-list 1 permit 1.1.1.0route-map LP permit 10match ip address 1set local-preference 99
route-map LP permit 20
R3
interface Loopback0ip address 3.3.3.3 255.255.255.255ip ospf 12345 area 0
interface Ethernet0/0ip address 34.1.1.3 255.255.255.0ip ospf 12345 area 0
interface Ethernet0/1ip address 13.1.1.3 255.255.255.0
interface Ethernet0/2ip address 23.1.1.3 255.255.255.0ip ospf 12345 area 0ip ospf cost 1000router ospf 12345router-id 3.3.3.3
router bgp 12345bgp router-id 3.3.3.3network 3.3.3.0 mask 255.255.255.0neighbor 4.4.4.4 remote-as 12345neighbor 4.4.4.4 update-source Loopback0neighbor 4.4.4.4 next-hop-selfneighbor 13.1.1.1 remote-as 1111
R4
interface Loopback0ip address 4.4.4.4 255.255.255.255
interface Ethernet0/0ip address 34.1.1.4 255.255.255.0ip ospf 12345 area 0
interface Ethernet0/2ip address 45.1.1.4 255.255.255.0ip ospf 12345 area 0
interface Ethernet0/3ip address 47.1.1.4 255.255.255.0ip ospf 12345 area 0router ospf 12345router-id 4.4.4.4
router bgp 12345bgp router-id 4.4.4.4bgp log-neighbor-changesneighbor 3.3.3.3 remote-as 12345neighbor 3.3.3.3 update-source Loopback0neighbor 3.3.3.3 route-reflector-clientneighbor 5.5.5.5 remote-as 12345neighbor 5.5.5.5 update-source Loopback0neighbor 5.5.5.5 next-hop-selfneighbor 7.7.7.7 remote-as 12345neighbor 7.7.7.7 update-source Loopback0neighbor 7.7.7.7 route-reflector-client
R5
interface Loopback0ip address 5.5.5.5 255.255.255.255ip ospf 12345 area 0
interface Ethernet0/1ip address 56.1.1.5 255.255.255.0ip ospf 12345 area 0
interface Ethernet0/2ip address 45.1.1.5 255.255.255.0ip ospf 12345 area 0
interface Ethernet0/3ip address 25.1.1.5 255.255.255.0ip ospf 12345 area 0router ospf 12345router-id 5.5.5.5
router bgp 12345bgp router-id 5.5.5.5bgp log-neighbor-changesneighbor 2.2.2.2 remote-as 12345neighbor 2.2.2.2 update-source Loopback0neighbor 2.2.2.2 route-reflector-clientneighbor 4.4.4.4 remote-as 12345neighbor 4.4.4.4 update-source Loopback0neighbor 4.4.4.4 route-reflector-clientneighbor 6.6.6.6 remote-as 12345neighbor 6.6.6.6 shutdownneighbor 6.6.6.6 update-source Loopback0neighbor 6.6.6.6 route-reflector-client
R6
interface Loopback0ip address 6.6.6.6 255.255.255.255ip ospf 12345 area 0
interface Ethernet0/0ip address 6.7.8.6 255.255.255.0
interface Ethernet0/1ip address 56.1.1.6 255.255.255.0ip ospf 12345 area 0
interface Ethernet0/2ip address 67.1.1.6 255.255.255.0ip ospf 12345 area 0router ospf 12345router-id 6.6.6.6
router bgp 12345bgp router-id 6.6.6.6bgp log-neighbor-changesneighbor 5.5.5.5 remote-as 12345neighbor 5.5.5.5 update-source Loopback0neighbor 5.5.5.5 next-hop-selfneighbor 6.7.8.8 remote-as 8888neighbor 6.7.8.8 route-map MED out
route-map MED permit 10match ip address 3set metric 100
route-map MED permit 20match ip address 2set metric 200
route-map MED permit 30access-list 2 permit 2.2.2.2
access-list 3 permit 3.3.3.3
R7
interface Loopback0ip address 7.7.7.7 255.255.255.255ip ospf 12345 area 0
interface Ethernet0/1ip address 6.7.8.7 255.255.255.0
interface Ethernet0/2ip address 67.1.1.7 255.255.255.0ip ospf 12345 area 0ip ospf cost 1000
interface Ethernet0/3ip address 47.1.1.7 255.255.255.0ip ospf 12345 area 0router ospf 12345router-id 7.7.7.7
router bgp 12345bgp router-id 7.7.7.7bgp log-neighbor-changesneighbor 4.4.4.4 remote-as 12345neighbor 4.4.4.4 password SPOTOneighbor 4.4.4.4 update-source Loopback0neighbor 4.4.4.4 next-hop-selfneighbor 6.7.8.8 remote-as 8888neighbor 6.7.8.8 route-map MED out
route-map MED permit 10match ip address 3set metric 200
route-map MED permit 20match ip address 2set metric 100
route-map MED permit 30access-list 2 permit 2.2.2.2
access-list 3 permit 3.3.3.3
R8
interface Loopback0ip address 8.8.8.8 255.255.255.255
interface Ethernet0/2ip address 6.7.8.8 255.255.255.0router bgp 8888bgp router-id 8.8.8.8bgp log-neighbor-changesnetwork 8.8.8.8 mask 255.255.255.255neighbor 6.7.8.6 remote-as 12345neighbor 6.7.8.7 remote-as 12345
Switch
空，没有配置
1. 确保所有的邻居正常建立
错点1：R4-R7邻居建立报错，BGP认证不通过
配置R4
R4：router bgp 12345neighbor 7.7.7.7 password SPOTO
配置完成之后，邻居还是有问题。没有建立。
R4(config-router)#do ping 7.7.7.7 so 4.4.4.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 7.7.7.7, timeout is 2 seconds:
Packet sent with a source address of 4.4.4.4
.....
Success rate is 0 percent (0/5)
发现网络有问题。4.4.4.4 没有宣告进OSPF
错点2：4.4.4.4 没有宣告进OSPF
R4：interface Loopback0ip ospf 12345 area 0
R4-R7之间邻居建立.
错点3：R5-R6邻居被关闭，重新启用
R5：router bgp 12345no neighbor 6.6.6.6 shutdown
错点4：交换机接口没开
R5：interface range ethernet 0/0-2no shutdown
检查所有邻居状态，都正常建立邻居
2. 路由选择
去往3.3.3.3路径调整
R8#traceroute 3.3.3.3 so lo0
Type escape sequence to abort.
Tracing the route to 3.3.3.3
VRF info: (vrf in name/id, vrf out name/id)1 * * * 2 * * *
网络不通，检查环回口是否配置，是否宣告进BGP等
经查，有配置环回口，宣告进BGP时，宣告路由不正确
错点5：3.3.3.3没有正确宣告进BGP
R3:router bgp 12345no network 3.3.3.0 mask 255.255.255.0network 3.3.3.3 mask 255.255.255.255
宣告进BGP的路由条目，必须和路由表保持一致。
再次测试成功
R8#traceroute 3.3.3.3 so lo0
Type escape sequence to abort.
Tracing the route to 3.3.3.3
VRF info: (vrf in name/id, vrf out name/id)1 6.7.8.6 1 msec 0 msec 0 msec2 56.1.1.5 0 msec 0 msec 1 msec3 45.1.1.4 0 msec 1 msec 0 msec4 34.1.1.3 1 msec * 1 msec
R8#
去往2.2.2.2路径调整
R8#traceroute 2.2.2.2 so lo0
Type escape sequence to abort.
Tracing the route to 2.2.2.2
VRF info: (vrf in name/id, vrf out name/id)1 6.7.8.7 0 msec 1 msec 0 msec2 47.1.1.4 0 msec 0 msec 0 msec3 45.1.1.5 0 msec 0 msec 0 msec4 25.1.1.2 1 msec * 1 msec
R8#
与目标一致无须调整。
去往1.1.1.1/1.1.1.2路径调整
两个环回口的ip地址没有被宣告进BGP，经过检查发现，是在直连路由重分布进BGP的时候，被过滤了
错点6：R1重分布时，过滤路由时配置错误
R1
R1#show ip prefix-list
ip prefix-list CON: 2 entriesseq 5 deny 12.1.1.0/24seq 10 deny 13.1.1.0/24
没有permit其它ip地址
R1:ip prefix-list CON permit 0.0.0.0/0 le 32
结果查询：
R1(config)#do show ip prefix-list
ip prefix-list CON: 3 entriesseq 5 deny 12.1.1.0/24seq 10 deny 13.1.1.0/24seq 15 permit 0.0.0.0/0 le 32
R1(config)#do show ip bgp
BGP table version is 6, local router ID is 1.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, t secondary path,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not foundNetwork Next Hop Metric LocPrf Weight Path*> 1.1.1.1/32 0.0.0.0 0 32768 ?*> 1.1.1.2/32 0.0.0.0 0 32768 ?* 2.2.2.2/32 13.1.1.3 0 12345 i*> 12.1.1.2 0 0 12345 i* 3.3.3.3/32 12.1.1.2 0 12345 i*> 13.1.1.3 0 0 12345 i* 8.8.8.8/32 12.1.1.2 0 12345 8888 i*> 13.1.1.3 0 12345 8888 i
R1(config)#
错误7：12，13网段被过滤，R2，R3的IBGP邻居要配置下一跳的IP地址为自己
IGP的路由很可能没有直达12，13网段的路由，所以如果指定下一跳的IP是12，13网段很可能会让网络不通，因为最好是转发路由通告的时候，把下一跳的IP指向自己。
查询BGP配置，发现R3已经配置好了，R2没有配置
R2：router bgp 12345neighbor 5.5.5.5 next-hop-self
错点8：R8没有开启BGP多路负载均衡
R8#traceroute 1.1.1.1 so lo 0 probe 2
Type escape sequence to abort.
Tracing the route to 1.1.1.1
VRF info: (vrf in name/id, vrf out name/id)1 6.7.8.7 1 msec 0 msec2 47.1.1.4 1 msec 0 msec3 34.1.1.3 1 msec 0 msec4 13.1.1.1 2 msec *
与目标不一致。因为没有开启多路负载均衡。
R8：router bgp 8888maximum-paths 2
检查路径：
R8#traceroute 1.1.1.1 so lo 0 probe 2
Type escape sequence to abort.
Tracing the route to 1.1.1.1
VRF info: (vrf in name/id, vrf out name/id)1 6.7.8.6 0 msec6.7.8.7 1 msec2 56.1.1.5 0 msec47.1.1.4 1 msec3 25.1.1.2 1 msec45.1.1.5 0 msec4 12.1.1.1 1 msec25.1.1.2 1 msec
R8#traceroute 1.1.1.2 so lo 0 probe 2
Type escape sequence to abort.
Tracing the route to 1.1.1.2
VRF info: (vrf in name/id, vrf out name/id)1 6.7.8.6 1 msec6.7.8.7 1 msec2 56.1.1.5 0 msec47.1.1.4 1 msec3 25.1.1.2 1 msec45.1.1.5 0 msec4 12.1.1.1 1 msec25.1.1.2 0 msec
R8#
查结果发现多路负载均衡时，两个目标网络都是走以下的路径(配合拓扑图分析得出):
R8->R6->R5->R2->R1
R8->R7->R4->R5->R2
从要求上看，去往1.1.1.2的路由符合要求，达到目标，而去往1.1.1.1的第3跳应该是R3或是R4，但在R4上进行路由时，下一跳变成R5，分析R4路由器上的BGP路由表
R4(config-if)#do show ip bgp
......Network Next Hop Metric LocPrf Weight Path*>i 1.1.1.1/32 2.2.2.2 0 150 0 1111 ?*>i 1.1.1.2/32 2.2.2.2 0 150 0 1111 ?r>i 2.2.2.2/32 2.2.2.2 0 150 0 ir>i 3.3.3.3/32 3.3.3.3 0 100 0 i* i 8.8.8.8/32 6.6.6.6 0 100 0 8888 i*>i 7.7.7.7 0 100 0 8888 i
R4(config-if)#do show ip route
......1.0.0.0/32 is subnetted, 2 subnets
B 1.1.1.1 [200/0] via 2.2.2.2, 00:08:11
B 1.1.1.2 [200/0] via 2.2.2.2, 00:08:112.0.0.0/32 is subnetted, 1 subnets
O 2.2.2.2 [110/21] via 45.1.1.5, 03:38:43, Ethernet0/23.0.0.0/32 is subnetted, 1 subnets
O 3.3.3.3 [110/11] via 34.1.1.3, 03:38:43, Ethernet0/0
R4(config-if)#
......
可以看出，R4上的并没有收到R3通告过来关于1.1.1.1的路由信息，查询R3的路由表信息
R3(config-router)#do show ip bgp
......Network Next Hop Metric LocPrf Weight Path*>i 1.1.1.1/32 2.2.2.2 0 150 0 1111 ?* 13.1.1.1 0 0 1111 ?*>i 1.1.1.2/32 2.2.2.2 0 150 0 1111 ?* 13.1.1.1 0 0 1111 ?r>i 2.2.2.2/32 2.2.2.2 0 150 0 i*> 3.3.3.3/32 0.0.0.0 0 32768 i*>i 8.8.8.8/32 7.7.7.7 0 100 0 8888 iR3(config-router)#do show ip bgp 1.1.1.1/32
BGP routing table entry for 1.1.1.1/32, version 11
Paths: (2 available, best #1, table default)Advertised to update-groups:1 Refresh Epoch 211112.2.2.2 (metric 31) from 4.4.4.4 (4.4.4.4)Origin incomplete, metric 0, localpref 150, valid, internal, bestOriginator: 2.2.2.2, Cluster list: 4.4.4.4, 5.5.5.5rx pathid: 0, tx pathid: 0x0Refresh Epoch 1111113.1.1.1 from 13.1.1.1 (1.1.1.1)Origin incomplete, metric 0, localpref 100, valid, externalrx pathid: 0, tx pathid: 0
R3(config-router)#
在R3上可以看到R2和R1通告过来的关于1.1.1.1路由信息。由于R2的local-preference被调整过。所以下一跳为2.2.2.2的路由变成了最优（该路由经过了4.4.4.4和5.5.5.5两个反射器反射到了R3且还是最优，则由R1通告过来的路由就被忽略了不传递给反射器），为了不影响其它的路由选路，最好用Prefix-list或是access-list来修改指定1.1.1.1路由的local-preference值。让从R3到R1的路径变成最优。可以在R2向IBGP的OUT方向，调小1.1.1.1的local-preference，让从R2走的路由优先级变小。从而达到从R3走的目的，也可以调大R3向IBGP的OUT方向，调大1.1.1.1的local-preference，让从R3走的路由优先级变大，从而达到从R3走的目的。
错点9：route-map 应用方向错误
查询R2的配置：
R2：access-list 1 permit 1.1.1.1access-list 1 permit 1.1.1.0route-map LP permit 10match ip address 1set local-preference 99route-map LP permit 20router bgp 12345neighbor 5.5.5.5 route-map LP in
从配置上看，目的是为了调小1.1.1.1的路由local-preference值，降低优先级。达到不从R2走的目的，但是由于1.1.1.1的路由通告方向是从R1->R2->R5(到R5反射器)，而以上的配置则表示是从R5方向接受1.1.1.1路由的时候设置local-preference值为150，显然与实际路由通告的方向不符导致配置失效，现进行以下修改：
R2：router bgp 12345no neighbor 5.5.5.5 route-map LP inneighbor 5.5.5.5 route-map LP out
查询R2，R5的BGP路由表（查询之前记得先清理 do clear ip bgp * soft）
R2(config-router)#do show ip bgp
......Network Next Hop Metric LocPrf Weight Path* i 1.1.1.1/32 3.3.3.3 0 100 0 1111 ?*> 12.1.1.1 0 0 1111 ?*> 1.1.1.2/32 12.1.1.1 0 0 1111 ?*> 2.2.2.2/32 0.0.0.0 0 32768 ir>i 3.3.3.3/32 3.3.3.3 0 100 0 i*>i 8.8.8.8/32 6.6.6.6 0 100 0 8888 iR2(config-router)#do show ip bgp 1.1.1.1/32
BGP routing table entry for 1.1.1.1/32, version 6
Paths: (2 available, best #2, table default)Advertised to update-groups:6 Refresh Epoch 1911113.3.3.3 (metric 31) from 5.5.5.5 (5.5.5.5)Origin incomplete, metric 0, localpref 100, valid, internalOriginator: 3.3.3.3, Cluster list: 5.5.5.5, 4.4.4.4rx pathid: 0, tx pathid: 0Refresh Epoch 2111112.1.1.1 from 12.1.1.1 (1.1.1.1)Origin incomplete, metric 0, localpref 150, valid, external, bestrx pathid: 0, tx pathid: 0x0
现在由于降低了R2的1.1.1.1的local-preference值，可以收到R3反射来的路由了。最优路径还是从直连12.1.1.1走，这是合理的
R5(config-router)#do show ip bgp
......Network Next Hop Metric LocPrf Weight Path*>i 1.1.1.1/32 3.3.3.3 0 100 0 1111 ?* i 2.2.2.2 0 99 0 1111 ?*>i 1.1.1.2/32 2.2.2.2 0 150 0 1111 ?r>i 2.2.2.2/32 2.2.2.2 0 150 0 ir>i 3.3.3.3/32 3.3.3.3 0 100 0 i*>i 8.8.8.8/32 6.6.6.6 0 100 0 8888 i* i 7.7.7.7 0 100 0 8888 i
R5(config-router)#do show ip route
......1.0.0.0/32 is subnetted, 2 subnets
B 1.1.1.1 [200/0] via 3.3.3.3, 00:01:19
B 1.1.1.2 [200/0] via 2.2.2.2, 00:48:332.0.0.0/32 is subnetted, 1 subnets
O 2.2.2.2 [110/11] via 25.1.1.2, 04:19:05, Ethernet0/33.0.0.0/32 is subnetted, 1 subnets
O 3.3.3.3 [110/21] via 45.1.1.4, 04:19:05, Ethernet0/2
......
现在R5去往1.1.1.1往3.3.3.3的机器走了，3.3.3.3则是走R4的路由，因此目的达成,且去往1.1.1.2的路由不受影响。测试路由如下：
R8#traceroute 1.1.1.1 so lo 0 probe 2
Type escape sequence to abort.
Tracing the route to 1.1.1.1
VRF info: (vrf in name/id, vrf out name/id)1 6.7.8.6 1 msec6.7.8.7 0 msec2 67.1.1.7 0 msec47.1.1.4 1 msec3 47.1.1.4 1 msec34.1.1.3 0 msec4 34.1.1.3 1 msec13.1.1.1 1 msec
R8#traceroute 1.1.1.2 so lo 0 probe 2
Type escape sequence to abort.
Tracing the route to 1.1.1.2
VRF info: (vrf in name/id, vrf out name/id)1 6.7.8.6 1 msec6.7.8.7 0 msec2 56.1.1.5 1 msec47.1.1.4 0 msec3 25.1.1.2 1 msec45.1.1.5 0 msec4 12.1.1.1 0 msec25.1.1.2 1 msec
R8#
另外一种方法达到目的
在R3上修改方法
R3:access-list 1 permit 1.1.1.1route-map R3-LP permit 10match ip address 1set local-preference 151route-map R3-LP permit 20router bgp 12345neighbor 13.1.1.1 route-map R3-LP in
查询R3，R5的BGP路由表（查询之前记得先清理 do clear ip bgp * soft）
R3:Network Next Hop Metric LocPrf Weight Path*> 1.1.1.1/32 13.1.1.1 0 151 0 1111 ?* 1.1.1.2/32 13.1.1.1 0 0 1111 ?*>i 2.2.2.2 0 150 0 1111 ?r>i 2.2.2.2/32 2.2.2.2 0 150 0 i*> 3.3.3.3/32 0.0.0.0 0 32768 i*>i 8.8.8.8/32 7.7.7.7 0 100 0 8888 iR5：Network Next Hop Metric LocPrf Weight Path*>i 1.1.1.1/32 3.3.3.3 0 151 0 1111 ?* i 2.2.2.2 0 150 0 1111 ?*>i 1.1.1.2/32 2.2.2.2 0 150 0 1111 ?r>i 2.2.2.2/32 2.2.2.2 0 150 0 ir>i 3.3.3.3/32 3.3.3.3 0 100 0 i*>i 8.8.8.8/32 6.6.6.6 0 100 0 8888 i* i 7.7.7.7 0 100 0 8888 i
测试路由
R8#traceroute 1.1.1.1 so lo 0 probe 2
Type escape sequence to abort.
Tracing the route to 1.1.1.1
VRF info: (vrf in name/id, vrf out name/id)1 6.7.8.6 1 msec6.7.8.7 0 msec2 67.1.1.7 0 msec47.1.1.4 1 msec3 47.1.1.4 1 msec34.1.1.3 0 msec4 34.1.1.3 1 msec13.1.1.1 1 msec
R8#traceroute 1.1.1.2 so lo 0 probe 2
Type escape sequence to abort.
Tracing the route to 1.1.1.2
VRF info: (vrf in name/id, vrf out name/id)1 6.7.8.6 1 msec6.7.8.7 0 msec2 56.1.1.5 1 msec47.1.1.4 0 msec3 25.1.1.2 1 msec45.1.1.5 0 msec4 12.1.1.1 0 msec25.1.1.2 1 msec
R8#
与要求一致目标达成了。