V7防火牆mpls l2vpn 對接v5路由器

一局點出口設備替換為v7的防火牆，型號f1000-905-ai，原來是v5的路由器。

現網使用Martini方式建立mpls l2vpn

v7設備按照手冊配置好後，v7設備側的pw和v5設備側的l2vc死活起不來。但是兩側ldp可以正常建立

防火牆已經把所有接口都丟到trust域中，並配置域間全部放通

 

ldp已經建立：

<F1000-905>display mpls ldp peer 

Total number of peers: 1

Peer LDP ID             State         Role     GR   MD5  KA Sent/Rcvd

10.55.88.254:0          Operational   Active   Off  Off  317/317

 

<H3C>display mpls ldp session 

 

               LDP Session(s) in Public Network

 Total number of sessions: 1

 ------------------------------------------------------------------------------

 Peer-ID                Status         SsnRole  FT   MD5  KA-Sent/Rcv

 ------------------------------------------------------------------------------

 10.55.132.254:0        Operational    Passive  Off  Off  318/318

 ------------------------------------------------------------------------------

 FT  : Fault Tolerance

 

<H3C>   

 

 

但是PW無法up

<F1000-905>display l2vpn vsi name pw001 verbose 

VSI Name: pw001

  VSI Index               : 4

  VSI State               : Down

  MTU                     : 1200

  Bandwidth               : -

  Broadcast Restrain      : -

  Multicast Restrain      : -

  Unknown Unicast Restrain: -

  MAC Learning            : Enabled

  MAC Table Limit         : -

  MAC Learning rate       : -

  Drop Unknown            : -

  PW Redundancy           : Master

  Flooding                : Enabled

  VXLAN ID                : -

  ACs:

    AC                               Link ID    State   

    GE1/0/5                          0          Up      

<F1000-905>

 

<H3C>display mpls l2vc 

Total ldp vc : 1     0 up       1 down      0 blocked

 

Transport   Client               VC       Local      Remote

VC ID       Intf                 State    VC Label   VC Label

123123123   GE0/1                down     1027       --

 

 

 

 

 

 

現場組網方式：

 

配置如下（敏感信息隱去）：

v7防火牆：

<F1000-905>display cu

#

 version 7.1.064, Release 9560P48

#

 sysname F1000-905

#

 clock timezone Beijing add 08:00:00

 clock protocol ntp

#

 irf mac-address persistent timer

 irf auto-update enable

 undo irf link-delay

 irf member 1 priority 1

#

ospf 1

 area 0.0.0.0

  network xxxxxxx

#

ospf 2

 area 0.0.0.101

  network 10.55.132.254 0.0.0.0

  network 10.253.1.0 0.0.0.255

#

 mpls lsr-id 10.55.132.254

#              

 ip unreachables enable

 ip ttl-expires enable

#

 undo nat alg dns

 undo nat alg ftp

 undo nat alg icmp-error

 undo nat alg pptp

 undo nat alg rtsp

#

 dns server 223.5.5.5

#

 password-recovery enable

#

vlan 1

#

mpls ldp

#

 l2vpn enable

#

pw-class 001

 pw-type ethernet

#

pw-class 1     

 pw-type ethernet

#

pw-class 101

#

vsi evpn001

 vxlan 10

#

vsi gnsz01

 vxlan 1022

  tunnel 1022

#

vsi msr810_lm_g0/0

 vxlan 22

  tunnel 22

#

vsi pty2

 vxlan 26

  tunnel 1021

#

vsi pw001

 default-pw-id 123123123

 mtu 1200

 pwsignaling ldp

  pw-redundancy master

  peer 10.55.88.254 pw-id 123123123 pw-class 1

#

controller Cellular1/0/0

#

controller Cellular1/0/1

#

interface NULL0

#

interface LoopBack101

 ip address 10.60.132.254 255.255.255.255

#

interface LoopBack201

 ip address 10.55.132.254 255.255.255.255

#

interface LoopBack1001

 ip address 10.254.1.1 255.255.255.255

#

interface LoopBack1021

 ip address 10.60.131.254 255.255.255.255

#

interface LoopBack1022

 description msr810-lm

 ip address 10.60.131.222 255.255.255.255

#

interface GigabitEthernet1/0/0

 port link-mode route

 ip address xxxxx

 ipsec apply policy xxx

 ipsec no-nat-process enable

#

interface GigabitEthernet1/0/1

 port link-mode route

 ip address 10.253.1.1 255.255.255.0

 mpls enable

 mpls ldp enable

#

interface GigabitEthernet1/0/2

 port link-mode route

 ip address 192.168.1.1 255.255.255.0

#

interface GigabitEthernet1/0/3

 port link-mode route

#

interface GigabitEthernet1/0/4

 port link-mode route

 xconnect vsi msr810_lm_g0/0

#

interface GigabitEthernet1/0/5

 port link-mode route

 xconnect vsi pw001

#

interface GigabitEthernet1/0/6

 port link-mode route

 xconnect vsi gnsz01

#

interface GigabitEthernet1/0/7

 port link-mode route

 xconnect vsi pty2

#

interface Tunnel22 mode vxlan

 source 10.60.131.222

 destination 10.60.25.254

#

interface Tunnel101 mode gre

 mtu 1300

 ip address 10.50.132.254 255.255.255.0

 mpls enable

 mpls ldp enable

 source LoopBack101

 destination 10.60.77.254

#

interface Tunnel1021 mode vxlan

 source 10.60.131.254

 destination 10.60.131.26

#

interface Tunnel1022 mode vxlan

 source 10.60.131.254

 destination 10.60.28.254

#

security-zone name Local

#

security-zone name Trust

 import interface GigabitEthernet1/0/0

 import interface GigabitEthernet1/0/1

 import interface GigabitEthernet1/0/2

 import interface GigabitEthernet1/0/3

 import interface GigabitEthernet1/0/4

 import interface GigabitEthernet1/0/5

 import interface GigabitEthernet1/0/6

 import interface GigabitEthernet1/0/7

 import interface LoopBack101

 import interface LoopBack201

 import interface LoopBack1021

 import interface NULL0

 import interface Tunnel101

#

security-zone name DMZ

#

security-zone name Untrust

#

security-zone name Management

#

 scheduler logfile size 16

#

line class aux

 user-role network-operator

#

line class console

 authentication-mode scheme

 user-role network-admin

#

line class vty

 user-role network-operator

#              

line aux 0

 user-role network-admin

#

line con 0

 user-role network-admin

#

line vty 0 63

 authentication-mode scheme

 user-role network-admin

#

 ip route-static 0.0.0.0 0 192.168.130.254

 ip route-static 10.55.77.254 32 Tunnel101 preference 10

#

performance-management

#

 ssh server enable

#

 arp ip-conflict log prompt

#

 ntp-service enable

 ntp-service unicast-server ***.***

 ntp-service unicast-server 203.107.6.88

#              

 

domain system

#

 domain default enable system

#

role name level-0

 description Predefined level-0 role

#

role name level-1

 description Predefined level-1 role

#

role name level-2

 description Predefined level-2 role

#

role name level-3

 description Predefined level-3 role

#

role name level-4

 description Predefined level-4 role

#              

role name level-5

 description Predefined level-5 role

#

role name level-6

 description Predefined level-6 role

#

role name level-7

 description Predefined level-7 role

#

role name level-8

 description Predefined level-8 role

#

role name level-9

 description Predefined level-9 role

#

role name level-10

 description Predefined level-10 role

#

role name level-11

 description Predefined level-11 role

#

role name level-12

 description Predefined level-12 role

#

role name level-13

 description Predefined level-13 role

#

role name level-14

 description Predefined level-14 role

#

user-group system

#

 

#

 session statistics enable

#

 ipsec logging negotiation enable

#              

ipsec transform-set F1000-1_IPv4_1

 esp encryption-algorithm 3des-cbc 

 esp authentication-algorithm md5 

#

ipsec transform-set msr

 esp encryption-algorithm 3des-cbc 

 esp authentication-algorithm md5 

#

ipsec policy-template msr-lte01 1

 transform-set msr 

 security acl 3904 

 ike-profile msr

#

ipsec policy-template msr-lte02 1

 transform-set msr 

 security acl 3905 

 ike-profile msr

#

ipsec policy-template msr-lte03 1

 transform-set msr 

 security acl 3906 

 ike-profile msr

#              

ipsec policy-template msr-lte04 1

 transform-set msr 

 security acl 3801 

 ike-profile msr

#

ipsec policy-template msr810 2

 transform-set 001 

 security acl 3101 

 ike-profile msr810

#

ipsec policy-template msr810 3

 transform-set 001 

 security acl 3103 

 ike-profile msr810

#

ipsec policy MSR-LTE 1 isakmp template msr-lte01

#

ipsec policy MSR-LTE 2 isakmp template msr-lte02

#

ipsec policy MSR-LTE 3 isakmp template msr-lte03

#

ipsec policy MSR-LTE 4 isakmp template msr-lte04

#              

 ike dpd interval 5 retry 3 on-demand

 ike logging negotiation enable

#

 

ike proposal 1

 

#

 ip https enable

#

 loadbalance isp file flash:/lbispinfo_v1.5.tp

#

 undo loadbalance alg dns

 undo loadbalance alg ftp

 undo loadbalance alg icmp-error

 undo loadbalance alg pptp

 undo loadbalance alg rtsp

#

security-policy ip

 rule 0 name permit_any

  action pass

  logging enable

  counting enable

  source-zone Local

  source-zone Trust

  source-zone DMZ

  source-zone Untrust

  source-zone Management

  destination-zone Local

  destination-zone Trust

  destination-zone DMZ

  destination-zone Untrust

  destination-zone Management

#

dac log-collect service dpi traffic enable

#

 cloud-management server domain secops.h3c.com

#              

return

<F1000-905>            

 

 

v5路由器配置如下：

 

<H3C>display cu

#

 version 5.20, Release 2516P24

#

 sysname H3C

#

 password-control enable

 undo password-control aging enable

 undo password-control history enable

 password-control length 6

 password-control login-attempt 3 exceed lock-time 10

 password-control password update interval 0

 password-control login idle-time 0

 password-control complexity user-name check

#

 domain default enable system

#

 dns proxy enable

#

 dar p2p signature-file flash:/p2p_default.mtd

#

 ndp enable

#

 ntdp enable

#               

 cluster enable

#

 port-security enable

#

 mpls lsr-id 10.55.88.254

#

 password-recovery enable

#

vlan 1

#

mpls

 label advertise non-null

#

l2vpn

 mpls l2vpn

#

mpls ldp

#

mpls ldp remote-peer 10.55.132.254

 remote-ip 10.55.132.254

#

domain system

 access-limit disable

 state active

 idle-cut disable

 self-service-url disable

#

dhcp server ip-pool vlan1 extended

 network ip range 192.168.1.2 192.168.1.254

 network mask 255.255.255.0

 gateway-list 192.168.1.1

 dns-list 192.168.1.1

#

user-group system

 group-attribute allow-guest

#

local-user admin

 authorization-attribute level 3

 service-type telnet

 service-type web

#

cwmp

 undo cwmp enable

#

interface Aux0

 async mode flow

 link-protocol ppp

#

interface NULL0

#

interface LoopBack101

#

interface LoopBack201

 ip address 10.55.88.254 255.255.255.255

#

interface GigabitEthernet0/0

 port link-mode route

 ip address 10.253.1.2 255.255.255.0

 mpls

 mpls mtu 1200

 mpls ldp

#

interface GigabitEthernet0/1

 port link-mode route

 mpls l2vc 10.55.132.254 123123123

#

interface GigabitEthernet0/2

 port link-mode bridge

#               

interface GigabitEthernet0/3

 port link-mode bridge

#

interface GigabitEthernet0/4

 port link-mode bridge

#

interface Cellular-Ethernet0/0

#

ospf 2

 area 0.0.0.101

  network 10.55.88.254 0.0.0.0

  network 10.253.1.0 0.0.0.255

#

 dhcp enable

#

 load xml-configuration

#

 load tr069-configuration

#

user-interface aux 0

user-interface vty 0 4

 authentication-mode scheme

#               

return

<H3C>