MPLS L3VPN + 路由反射器 + 双栈 6VPE + DMVPN
综合实验手册

!===========================================================
! P1 —— 核心 P 路由器：只跑 IGP + LDP，不接客户
!===========================================================
configure terminal
!
hostname P1
!
ip cef
ipv6 unicast-routing
ipv6 cef
!
!---------- Loopback（LDP router-id 与 BGP next-hop 的载体）----------
interface Loopback0
 ip address 10.0.0.11 255.255.255.255
 ip ospf 1 area 0
 ipv6 address fd00::11/128
 ipv6 ospf 1 area 0
!
!---------- 到 PE1（链路 L1）----------
interface GigabitEthernet0/0
 description ## CORE: P1 Gi0/0  <-->  PE1 Gi0/0 ##
 ip address 10.0.1.2 255.255.255.252
 ip ospf network point-to-point
 ip ospf 1 area 0
 ipv6 address fd00:1::2/64
 ipv6 ospf network point-to-point
 ipv6 ospf 1 area 0
 mpls ip
 no shutdown
!
!---------- 到 PE2（链路 L2）----------
interface GigabitEthernet0/1
 description ## CORE: P1 Gi0/1  <-->  PE2 Gi0/0 ##
 ip address 10.0.2.2 255.255.255.252
 ip ospf network point-to-point
 ip ospf 1 area 0
 ipv6 address fd00:2::2/64
 ipv6 ospf network point-to-point
 ipv6 ospf 1 area 0
 mpls ip
 no shutdown
!
!---------- 到 P2（链路 L5，核心横联）----------
interface GigabitEthernet0/2
 description ## CORE: P1 Gi0/2  <-->  P2 Gi0/2 ##
 ip address 10.0.5.1 255.255.255.252
 ip ospf network point-to-point
 ip ospf 1 area 0
 ipv6 address fd00:5::1/64
 ipv6 ospf network point-to-point
 ipv6 ospf 1 area 0
 mpls ip
 no shutdown
!
!---------- 到 RR1（链路 L6）----------
interface GigabitEthernet0/3
 description ## CORE: P1 Gi0/3  <-->  RR1 Gi0/0 ##
 ip address 10.0.6.2 255.255.255.252
 ip ospf network point-to-point
 ip ospf 1 area 0
 ipv6 address fd00:6::2/64
 ipv6 ospf network point-to-point
 ipv6 ospf 1 area 0
 no shutdown
!
!---------- IGP：OSPFv2 ----------
router ospf 1
 router-id 10.0.0.11
 passive-interface Loopback0
 log-adjacency-changes
 auto-cost reference-bandwidth 100000
 timers throttle spf 50 200 5000
 timers throttle lsa 50 200 5000
!
!---------- IGP：OSPFv3（IPv6）----------
router ospfv3 1
 router-id 10.0.0.11
 log-adjacency-changes
!
!---------- MPLS / LDP ----------
mpls label protocol ldp
mpls ldp
 router-id Loopback0 force
 !
 ! 链路抖动时保住 LDP 会话，避免标签重新收敛（现网必备）
 session protection for CORE-LDP duration 120
 !
 ! IGP 与 LDP 同步：接口起来但 LDP 还没就绪时，OSPF 先不通告该链路
 ! 防止"黑洞"：流量被 IGP 引到一条还没有标签的链路上
!
router ospf 1
 mpls ldp sync
!
!---------- 快速检测（可选但强烈推荐）----------
interface range GigabitEthernet0/0 - 3
 bfd interval 300 min_rx 300 multiplier 3
!
router ospf 1
 bfd all-interfaces
!
end
write memory

configure terminal
hostname P2
ip cef
ipv6 unicast-routing
ipv6 cef
!
interface Loopback0
 ip address 10.0.0.12 255.255.255.255
 ip ospf 1 area 0
 ipv6 address fd00::12/128
 ipv6 ospf 1 area 0
!
interface GigabitEthernet0/0
 description ## P2 Gi0/0  <-->  PE3 Gi0/0 ##
 ip address 10.0.3.2 255.255.255.252
 ip ospf network point-to-point
 ip ospf 1 area 0
 ipv6 address fd00:3::2/64
 ipv6 ospf network point-to-point
 ipv6 ospf 1 area 0
 mpls ip
 no shutdown
!
interface GigabitEthernet0/1
 description ## P2 Gi0/1  <-->  PE4 Gi0/0 ##
 ip address 10.0.4.2 255.255.255.252
 ip ospf network point-to-point
 ip ospf 1 area 0
 ipv6 address fd00:4::2/64
 ipv6 ospf network point-to-point
 ipv6 ospf 1 area 0
 mpls ip
 no shutdown
!
interface GigabitEthernet0/2
 description ## P2 Gi0/2  <-->  P1 Gi0/2 ##
 ip address 10.0.5.2 255.255.255.252
 ip ospf network point-to-point
 ip ospf 1 area 0
 ipv6 address fd00:5::2/64
 ipv6 ospf network point-to-point
 ipv6 ospf 1 area 0
 mpls ip
 no shutdown
!
interface GigabitEthernet0/3
 description ## P2 Gi0/3  <-->  RR2 Gi0/0 ##
 ip address 10.0.7.2 255.255.255.252
 ip ospf network point-to-point
 ip ospf 1 area 0
 ipv6 address fd00:7::2/64
 ipv6 ospf network point-to-point
 ipv6 ospf 1 area 0
 no shutdown
!
router ospf 1
 router-id 10.0.0.12
 passive-interface Loopback0
 log-adjacency-changes
 auto-cost reference-bandwidth 100000
!
router ospfv3 1
 router-id 10.0.0.12
!
mpls label protocol ldp
mpls ldp
 router-id Loopback0 force
 session protection
!
end
write memory

configure terminal
hostname RR1
ip cef
ipv6 unicast-routing
ipv6 cef
!
interface Loopback0
 ip address 10.0.0.1 255.255.255.255
 ip ospf 1 area 0
 ipv6 address fd00::1/128
 ipv6 ospf 1 area 0
!
interface GigabitEthernet0/0
 description ## RR1 Gi0/0  <-->  P1 Gi0/3 ##
 ip address 10.0.6.1 255.255.255.252
 ip ospf network point-to-point
 ip ospf 1 area 0
 ipv6 address fd00:6::1/64
 ipv6 ospf network point-to-point
 ipv6 ospf 1 area 0
 no shutdown
!
interface GigabitEthernet0/1
 description ## RR1 Gi0/1  <-->  RR2 Gi0/1 ##
 ip address 10.0.9.1 255.255.255.252
 ip ospf network point-to-point
 ip ospf 1 area 0
 ipv6 address fd00:9::1/64
 ipv6 ospf network point-to-point
 ipv6 ospf 1 area 0
 no shutdown
!
router ospf 1
 router-id 10.0.0.1
 passive-interface Loopback0
 log-adjacency-changes
 auto-cost reference-bandwidth 100000
!
router ospfv3 1
 router-id 10.0.0.1
!
! RR 不在转发路径上，【不需要】启用 MPLS / LDP
! 这也是 RR 可以低成本部署的原因
!
end
write memory

configure terminal
hostname RR2
ip cef
ipv6 unicast-routing
ipv6 cef
!
interface Loopback0
 ip address 10.0.0.2 255.255.255.255
 ip ospf 1 area 0
 ipv6 address fd00::2/128
 ipv6 ospf 1 area 0
!
interface GigabitEthernet0/0
 description ## RR2 Gi0/0  <-->  P2 Gi0/3 ##
 ip address 10.0.7.1 255.255.255.252
 ip ospf network point-to-point
 ip ospf 1 area 0
 ipv6 address fd00:7::1/64
 ipv6 ospf network point-to-point
 ipv6 ospf 1 area 0
 no shutdown
!
interface GigabitEthernet0/1
 description ## RR2 Gi0/1  <-->  RR1 Gi0/1 ##
 ip address 10.0.9.2 255.255.255.252
 ip ospf network point-to-point
 ip ospf 1 area 0
 ipv6 address fd00:9::2/64
 ipv6 ospf network point-to-point
 ipv6 ospf 1 area 0
 no shutdown
!
router ospf 1
 router-id 10.0.0.2
 passive-interface Loopback0
 log-adjacency-changes
 auto-cost reference-bandwidth 100000
!
router ospfv3 1
 router-id 10.0.0.2
!
end
write memory

configure terminal
hostname PE1
ip cef
ipv6 unicast-routing
ipv6 cef
!
mpls label protocol ldp
mpls ldp
 router-id Loopback0 force
 session protection
!
interface Loopback0
 ip address 10.0.0.21 255.255.255.255
 ip ospf 1 area 0
 ipv6 address fd00::21/128
 ipv6 ospf 1 area 0
!
!---------- 到 P1（L1）----------
interface GigabitEthernet0/0
 description ## PE1 Gi0/0  <-->  P1 Gi0/0 ##
 ip address 10.0.1.1 255.255.255.252
 ip ospf network point-to-point
 ip ospf 1 area 0
 ipv6 address fd00:1::1/64
 ipv6 ospf network point-to-point
 ipv6 ospf 1 area 0
 mpls ip
 no shutdown
!
!---------- 到 PE4（L8，冗余 / TE 备份路径）----------
! 注意：这条链路参与 IGP，会让 PE1-PE4 之间出现一条"不经 P"的直连路径
! 第 8 章做 MPLS TE 时会用它，前期先配好
interface GigabitEthernet0/1
 description ## PE1 Gi0/1  <-->  PE4 Gi0/1 ##
 ip address 10.0.8.1 255.255.255.252
 ip ospf network point-to-point
 ip ospf 1 area 0
 ipv6 address fd00:8::1/64
 ipv6 ospf network point-to-point
 ipv6 ospf 1 area 0
 mpls ip
 no shutdown
!
router ospf 1
 router-id 10.0.0.21
 passive-interface Loopback0
 log-adjacency-changes
 auto-cost reference-bandwidth 100000
!
router ospfv3 1
 router-id 10.0.0.21
!
end
write memory

configure terminal
!
! 模拟一个"IPv6 公网客户"，直接挂在 PE1 上
interface Loopback66
 description ## 6PE demo: 模拟 IPv6 公网前缀 ##
 ipv6 address 2001:db8:aaaa::1/64
!
router bgp 65000
 ! 关键：IPv6 单播地址族 + send-label，让 BGP 同时通告前缀和标签
 address-family ipv6 unicast
  network fd00::21/128
  network 2001:db8:aaaa::/64
  neighbor 10.0.0.1 activate
  neighbor 10.0.0.1 send-label
  neighbor 10.0.0.2 activate
  neighbor 10.0.0.2 send-label
 exit-address-family
!
end
write memory

P1# show mpls ldp neighbor
    Peer LDP Ident: 10.0.0.21:0; Local LDP Ident 10.0.0.11:0
        TCP connection: 10.0.0.21.646 - 10.0.0.11.23741
        State: Oper; Msgs sent/rcvd: 42/41; Downstream
        Up time: 00:12:33
        LDP discovery sources:
          GigabitEthernet0/0, Src IP addr: 10.0.1.1

P1# show mpls forwarding-table
Local      Outgoing   Prefix           Bytes Label   Outgoing   Next Hop
Label      Label      or Tunnel Id     Switched      interface
16         Pop Label  10.0.0.1/32      0             Gi0/3      10.0.6.1
17         Pop Label  10.0.0.21/32     0             Gi0/0      10.0.1.1
18         Pop Label  10.0.0.22/32     0             Gi0/1      10.0.2.1
19         19         10.0.0.12/32     0             Gi0/2      10.0.5.2
20         20         10.0.0.23/32     0             Gi0/2      10.0.5.2
21         21         10.0.0.24/32     0             Gi0/2      10.0.5.2
22         Pop Label  10.0.0.2/32      0             Gi0/2      10.0.5.2

configure terminal
!
ip bgp-community new-format
ip extcommunity-list standard EXT-ALL permit rt 65000:.*
!
router bgp 65000
 bgp router-id 10.0.0.1
 !
 ! ---- 集群 ID：RR1 / RR2 必须【完全相同】----
 bgp cluster-id 10.0.0.100
 !
 bgp log-neighbor-changes
 no bgp default ipv4-unicast
 !
 ! ---- NSF / Graceful Restart：RR 重启时 PE 不撤销路由 ----
 bgp graceful-restart
 bgp graceful-restart restart-time 120
 bgp graceful-restart stalepath-time 360
 !
 ! ---- Add-Path：允许向 PE 通告多条等价/备份路径 ----
 bgp additional-paths select all
 !
 !================ 邻居：peer-group 统一管理 ================!
 ! PE 客户端组
 neighbor IBGP-CLIENT peer-group
 neighbor IBGP-CLIENT remote-as 65000
 neighbor IBGP-CLIENT update-source Loopback0
 neighbor IBGP-CLIENT password 0 MplsLab@2026
 neighbor IBGP-CLIENT timers 5 15
 neighbor IBGP-CLIENT transport connection-mode active
 !
 ! 另一台 RR（非客户端，普通 iBGP）
 neighbor IBGP-RR peer-group
 neighbor IBGP-RR remote-as 65000
 neighbor IBGP-RR update-source Loopback0
 neighbor IBGP-RR password 0 MplsLab@2026
 neighbor IBGP-RR timers 5 15
 !
 ! ---- 成员绑定 ----
 neighbor 10.0.0.2  peer-group IBGP-RR        ! RR2
 neighbor 10.0.0.21 peer-group IBGP-CLIENT    ! PE1
 neighbor 10.0.0.22 peer-group IBGP-CLIENT    ! PE2
 neighbor 10.0.0.23 peer-group IBGP-CLIENT    ! PE3
 neighbor 10.0.0.24 peer-group IBGP-CLIENT    ! PE4
 !
 !================ 地址族 ================!
 !
 !--- 1) IPv4 公网单播（保持会话结构）---
 address-family ipv4 unicast
  neighbor IBGP-CLIENT activate
  neighbor IBGP-CLIENT send-community both
  neighbor IBGP-CLIENT route-reflector-client
  neighbor IBGP-RR activate
  neighbor IBGP-RR send-community both
 exit-address-family
 !
 !--- 2) VPNv4：客户 IPv4 路由（重点）---
 address-family vpnv4 unicast
  neighbor IBGP-CLIENT activate
  neighbor IBGP-CLIENT send-community extended
  neighbor IBGP-CLIENT route-reflector-client
  neighbor IBGP-RR activate
  neighbor IBGP-RR send-community extended
  ! Add-Path：把备份路径也发给 PE，供 PIC 快速切换
  neighbor IBGP-CLIENT advertise additional-paths all
  neighbor IBGP-CLIENT additional-paths send
  neighbor IBGP-CLIENT additional-paths receive
 exit-address-family
 !
 !--- 3) VPNv6：客户 IPv6 路由（6VPE）---
 address-family vpnv6 unicast
  neighbor IBGP-CLIENT activate
  neighbor IBGP-CLIENT send-community extended
  neighbor IBGP-CLIENT route-reflector-client
  neighbor IBGP-RR activate
  neighbor IBGP-RR send-community extended
  neighbor IBGP-CLIENT advertise additional-paths all
  neighbor IBGP-CLIENT additional-paths send
  neighbor IBGP-CLIENT additional-paths receive
 exit-address-family
 !
 !--- 4) 6PE：IPv6 公网 + 标签（关键：send-label 不能少）---
 address-family ipv6 unicast
  neighbor IBGP-CLIENT activate
  neighbor IBGP-CLIENT send-label
  neighbor IBGP-CLIENT route-reflector-client
  neighbor IBGP-RR activate
  neighbor IBGP-RR send-label
 exit-address-family
 !
 !--- 5) RTC：Route Target Constraint ---!
 ! PE 只向 RR 订阅"我感兴趣的 RT"，RR 不再给 PE 推无关路由
 ! 大规模网络（几百个 VRF）能显著降低 RR 和 PE 的负担
 address-family rtfilter unicast
  neighbor IBGP-CLIENT activate
  neighbor IBGP-CLIENT send-community extended
  neighbor IBGP-CLIENT route-reflector-client
  ! 向所有客户端通告"默认过滤"（接收全部），
  ! 这样即使 PE 没显式订阅也能正常工作；PE 侧再细化
  neighbor IBGP-CLIENT default-originate
  neighbor IBGP-RR activate
  neighbor IBGP-RR send-community extended
 exit-address-family
 !
end
write memory

configure terminal
ip bgp-community new-format
!
router bgp 65000
 bgp router-id 10.0.0.2
 bgp cluster-id 10.0.0.100          ! 与 RR1 一致！
 bgp log-neighbor-changes
 no bgp default ipv4-unicast
 bgp graceful-restart
 bgp graceful-restart restart-time 120
 bgp graceful-restart stalepath-time 360
 bgp additional-paths select all
 !
 neighbor IBGP-CLIENT peer-group
 neighbor IBGP-CLIENT remote-as 65000
 neighbor IBGP-CLIENT update-source Loopback0
 neighbor IBGP-CLIENT password 0 MplsLab@2026
 neighbor IBGP-CLIENT timers 5 15
 neighbor IBGP-CLIENT transport connection-mode active
 !
 neighbor IBGP-RR peer-group
 neighbor IBGP-RR remote-as 65000
 neighbor IBGP-RR update-source Loopback0
 neighbor IBGP-RR password 0 MplsLab@2026
 neighbor IBGP-RR timers 5 15
 !
 neighbor 10.0.0.1  peer-group IBGP-RR        ! RR1
 neighbor 10.0.0.21 peer-group IBGP-CLIENT
 neighbor 10.0.0.22 peer-group IBGP-CLIENT
 neighbor 10.0.0.23 peer-group IBGP-CLIENT
 neighbor 10.0.0.24 peer-group IBGP-CLIENT
 !
 address-family ipv4 unicast
  neighbor IBGP-CLIENT activate
  neighbor IBGP-CLIENT send-community both
  neighbor IBGP-CLIENT route-reflector-client
  neighbor IBGP-RR activate
  neighbor IBGP-RR send-community both
 exit-address-family
 !
 address-family vpnv4 unicast
  neighbor IBGP-CLIENT activate
  neighbor IBGP-CLIENT send-community extended
  neighbor IBGP-CLIENT route-reflector-client
  neighbor IBGP-RR activate
  neighbor IBGP-RR send-community extended
  neighbor IBGP-CLIENT advertise additional-paths all
  neighbor IBGP-CLIENT additional-paths send
  neighbor IBGP-CLIENT additional-paths receive
 exit-address-family
 !
 address-family vpnv6 unicast
  neighbor IBGP-CLIENT activate
  neighbor IBGP-CLIENT send-community extended
  neighbor IBGP-CLIENT route-reflector-client
  neighbor IBGP-RR activate
  neighbor IBGP-RR send-community extended
  neighbor IBGP-CLIENT advertise additional-paths all
  neighbor IBGP-CLIENT additional-paths send
  neighbor IBGP-CLIENT additional-paths receive
 exit-address-family
 !
 address-family ipv6 unicast
  neighbor IBGP-CLIENT activate
  neighbor IBGP-CLIENT send-label
  neighbor IBGP-CLIENT route-reflector-client
  neighbor IBGP-RR activate
  neighbor IBGP-RR send-label
 exit-address-family
 !
 address-family rtfilter unicast
  neighbor IBGP-CLIENT activate
  neighbor IBGP-CLIENT send-community extended
  neighbor IBGP-CLIENT route-reflector-client
  neighbor IBGP-CLIENT default-originate
  neighbor IBGP-RR activate
  neighbor IBGP-RR send-community extended
 exit-address-family
 !
end
write memory

configure terminal
ip bgp-community new-format
!
router bgp 65000
 bgp router-id 10.0.0.21
 bgp log-neighbor-changes
 no bgp default ipv4-unicast
 !
 ! ---- Graceful Restart：BGP 进程重启 / 主备倒换时保持转发 ----
 bgp graceful-restart
 bgp graceful-restart restart-time 120
 bgp graceful-restart stalepath-time 360
 !
 ! ---- Add-Path + PIC：备份路径直接写进 CEF，故障切换 < 50ms ----
 bgp additional-paths select all
 bgp recursion host
 !
 ! ---- 与两台 RR 建会话 ----
 neighbor 10.0.0.1 remote-as 65000
 neighbor 10.0.0.1 update-source Loopback0
 neighbor 10.0.0.1 password 0 MplsLab@2026
 neighbor 10.0.0.1 timers 5 15
 !
 neighbor 10.0.0.2 remote-as 65000
 neighbor 10.0.0.2 update-source Loopback0
 neighbor 10.0.0.2 password 0 MplsLab@2026
 neighbor 10.0.0.2 timers 5 15
 !
 !--- IPv4 公网单播 ---!
 address-family ipv4 unicast
  neighbor 10.0.0.1 activate
  neighbor 10.0.0.2 activate
  no auto-summary
  no synchronization
 exit-address-family
 !
 !--- VPNv4 ---!
 address-family vpnv4 unicast
  neighbor 10.0.0.1 activate
  neighbor 10.0.0.1 send-community extended
  neighbor 10.0.0.2 activate
  neighbor 10.0.0.2 send-community extended
  ! 接收 RR 发来的多条路径 + 把备份路径装进转发表（BGP PIC Edge）
  bgp additional-paths receive
  bgp additional-paths send
  bgp additional-paths install
 exit-address-family
 !
 !--- VPNv6（6VPE）---!
 address-family vpnv6 unicast
  neighbor 10.0.0.1 activate
  neighbor 10.0.0.1 send-community extended
  neighbor 10.0.0.2 activate
  neighbor 10.0.0.2 send-community extended
  bgp additional-paths receive
  bgp additional-paths send
  bgp additional-paths install
 exit-address-family
 !
 !--- 6PE：发布自己的 IPv6 loopback 与演示前缀 ---!
 address-family ipv6 unicast
  network fd00::21/128
  network 2001:db8:aaaa::/64
  neighbor 10.0.0.1 activate
  neighbor 10.0.0.1 send-label
  neighbor 10.0.0.2 activate
  neighbor 10.0.0.2 send-label
 exit-address-family
 !
 !--- RTC：订阅我关心的 RT ---!
 ! PE1 上只有 CORP-A 和 BRANCH，所以只订阅这两个 RT
 address-family rtfilter unicast
  neighbor 10.0.0.1 activate
  neighbor 10.0.0.2 activate
 exit-address-family
 !
end
write memory

! 在 PE1 上：只接收 CORP-A(65000:100) 与 BRANCH(65000:300) 的路由
configure terminal
router bgp 65000
 address-family rtfilter unicast
  neighbor 10.0.0.1 default-originate route-map RM-RTC-OUT
  neighbor 10.0.0.2 default-originate route-map RM-RTC-OUT
 exit-address-family
!
route-map RM-RTC-OUT permit 10
 match ip extcommunity RT-SUBSCRIBE
!
ip extcommunity-list standard RT-SUBSCRIBE permit rt 65000:100
ip extcommunity-list standard RT-SUBSCRIBE permit rt 65000:300

RR1# show bgp all summary
For address family: IPv4 Unicast
Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.0.0.2        4 65000      38      39        2    0    0 00:16:11        0
10.0.0.21       4 65000      37      38        2    0    0 00:16:05        0
10.0.0.22       4 65000      37      38        2    0    0 00:16:03        0
10.0.0.23       4 65000      36      37        2    0    0 00:15:58        0
10.0.0.24       4 65000      36      37        2    0    0 00:15:55        0

For address family: VPNv4 Unicast
Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.0.0.21       4 65000      37      38        6    0    0 00:16:05        4
10.0.0.22       4 65000      37      38        6    0    0 00:16:03        2
10.0.0.23       4 65000      36      37        6    0    0 00:15:58        4
10.0.0.24       4 65000      36      37        6    0    0 00:15:55        2

For address family: VPNv6 Unicast
Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.0.0.21       4 65000      37      38        4    0    0 00:16:05        2

For address family: IPv6 Unicast
Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.0.0.21       4 65000      37      38        3    0    0 00:16:05        1

For address family: RT Filter
Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.0.0.21       4 65000      37      38        2    0    0 00:16:05        1

configure terminal
!===========================================================
! 1) 定义 VRF（IPv4 / IPv6 双栈）
!===========================================================
vrf definition CORP-A
 rd 65000:100
 !
 address-family ipv4
  route-target export 65000:100
  route-target import 65000:100
 exit-address-family
 !
 address-family ipv6
  route-target export 65000:100
  route-target import 65000:100
 exit-address-family
!
!===========================================================
! 2) 把接口放进 VRF
!    注意：先配 vrf forwarding，再配 IP！
!    顺序反了 IOS 会把已配的 IP 清掉（经典大坑）
!===========================================================
interface GigabitEthernet0/2
 description ## PE1 Gi0/2  <-->  CE-A1 Gi0/0  (VRF CORP-A) ##
 vrf forwarding CORP-A
 ip address 10.1.1.1 255.255.255.252
 ipv6 address 2001:db8:1:1::1/64
 no shutdown
!
!===========================================================
! 3) PE-CE 路由：eBGP，同一条会话同时承载 v4 + v6
!===========================================================
ip community-list standard CL-CORPA permit 65001:1001
!
route-map RM-CORPA-A1-IN permit 10
 description ## 从 CE-A1 收到的路由打上本地优先级与团体属性 ##
 set local-preference 200
 set community 65000:1001 additive
!
route-map RM-CORPA-A1-OUT permit 10
 description ## 默认允许全部下发；需要过滤时在这里加 match ##
!
router bgp 65000
 !
 !---------- IPv4 ----------
 address-family ipv4 vrf CORP-A
  neighbor 10.1.1.2 remote-as 65001
  neighbor 10.1.1.2 activate
  neighbor 10.1.1.2 description ** CE-A1 **
  !
  ! 安全：TTL=1，防伪造的远距离 eBGP 会话
  neighbor 10.1.1.2 ttl-security hops 1
  !
  ! 客户的两个站点都用 AS 65001，BGP 会因"AS_PATH 里已有自己"而丢弃路由
  ! as-override 把客户 AS 号替换成运营商 AS，绕过这个限制
  neighbor 10.1.1.2 as-override
  !
  ! SoO：标记这是"站点 101"的路由，配合多宿主防环
  neighbor 10.1.1.2 soo 65000:101
  !
  ! 团体属性（标准 + 扩展都要发）
  neighbor 10.1.1.2 send-community both
  !
  ! 保护：最多收 100 条，到 80% 告警，超了断 10 分钟后自动恢复
  neighbor 10.1.1.2 maximum-prefix 100 80 restart 10
  !
  neighbor 10.1.1.2 route-map RM-CORPA-A1-IN in
  neighbor 10.1.1.2 route-map RM-CORPA-A1-OUT out
  !
  no auto-summary
  no synchronization
 exit-address-family
 !
 !---------- IPv6 ----------
 ! 关键设计：用【IPv4 会话】承载 IPv6 路由。
 ! 这样 VPNv6 的下一跳是 ::FFFF:10.0.0.21（IPv4-mapped），
 ! 可以直接沿 IPv4 LDP 隧道走，核心不需要 IPv6 标签分发。
 address-family ipv6 vrf CORP-A
  neighbor 10.1.1.2 remote-as 65001
  neighbor 10.1.1.2 activate
  neighbor 10.1.1.2 as-override
  neighbor 10.1.1.2 send-community both
 exit-address-family
 !
end
write memory

configure terminal
vrf definition CORP-A
 rd 65000:100
 address-family ipv4
  route-target export 65000:100
  route-target import 65000:100
 exit-address-family
 address-family ipv6
  route-target export 65000:100
  route-target import 65000:100
 exit-address-family
!
interface GigabitEthernet0/1
 description ## PE3 Gi0/1  <-->  CE-A2 Gi0/0 ##
 vrf forwarding CORP-A
 ip address 10.1.3.1 255.255.255.252
 ipv6 address 2001:db8:1:3::1/64
 no shutdown
!
route-map RM-CORPA-A2-IN permit 10
 set local-preference 200
 set community 65000:1002 additive
!
route-map RM-CORPA-A2-OUT permit 10
!
router bgp 65000
 address-family ipv4 vrf CORP-A
  neighbor 10.1.3.2 remote-as 65001
  neighbor 10.1.3.2 activate
  neighbor 10.1.3.2 ttl-security hops 1
  neighbor 10.1.3.2 as-override
  neighbor 10.1.3.2 soo 65000:102
  neighbor 10.1.3.2 send-community both
  neighbor 10.1.3.2 maximum-prefix 100 80 restart 10
  neighbor 10.1.3.2 route-map RM-CORPA-A2-IN in
  neighbor 10.1.3.2 route-map RM-CORPA-A2-OUT out
 exit-address-family
 !
 address-family ipv6 vrf CORP-A
  neighbor 10.1.3.2 remote-as 65001
  neighbor 10.1.3.2 activate
  neighbor 10.1.3.2 as-override
  neighbor 10.1.3.2 send-community both
 exit-address-family
!
end
write memory

configure terminal
hostname CE-A1
ip cef
ipv6 unicast-routing
ipv6 cef
!
interface GigabitEthernet0/0
 description ## CE-A1 Gi0/0  <-->  PE1 Gi0/2 ##
 ip address 10.1.1.2 255.255.255.252
 ipv6 address 2001:db8:1:1::2/64
 no shutdown
!
interface Loopback0
 ip address 192.168.255.1 255.255.255.255
 ipv6 address 2001:db8:a:ff::1/128
!
interface Loopback10
 description ## 站点 1 业务网段 ##
 ip address 192.168.11.1 255.255.255.0
 ipv6 address 2001:db8:a:11::1/64
!
router bgp 65001
 bgp router-id 192.168.255.1
 bgp log-neighbor-changes
 no bgp default ipv4-unicast
 neighbor 10.1.1.1 remote-as 65000
 neighbor 10.1.1.1 password 0 CeA1@2026
 neighbor 10.1.1.1 timers 10 30
 !
 address-family ipv4 unicast
  network 192.168.11.0 mask 255.255.255.0
  network 192.168.255.1 mask 255.255.255.255
  neighbor 10.1.1.1 activate
  neighbor 10.1.1.1 send-community both
  ! 若运营商未做 as-override，在这里用 allowas-in 自救：
  ! neighbor 10.1.1.1 allowas-in 1
  no auto-summary
  no synchronization
 exit-address-family
 !
 address-family ipv6 unicast
  network 2001:db8:a:11::/64
  network 2001:db8:a:ff::1/128
  neighbor 10.1.1.1 activate
  neighbor 10.1.1.1 send-community both
 exit-address-family
!
end
write memory

configure terminal
hostname CE-A2
ip cef
ipv6 unicast-routing
ipv6 cef
!
interface GigabitEthernet0/0
 description ## CE-A2 Gi0/0  <-->  PE3 Gi0/1 ##
 ip address 10.1.3.2 255.255.255.252
 ipv6 address 2001:db8:1:3::2/64
 no shutdown
!
interface Loopback0
 ip address 192.168.255.2 255.255.255.255
 ipv6 address 2001:db8:a:ff::2/128
!
interface Loopback10
 description ## 站点 2 业务网段 ##
 ip address 192.168.12.1 255.255.255.0
 ipv6 address 2001:db8:a:12::1/64
!
router bgp 65001
 bgp router-id 192.168.255.2
 bgp log-neighbor-changes
 no bgp default ipv4-unicast
 neighbor 10.1.3.1 remote-as 65000
 neighbor 10.1.3.1 password 0 CeA2@2026
 neighbor 10.1.3.1 timers 10 30
 !
 address-family ipv4 unicast
  network 192.168.12.0 mask 255.255.255.0
  network 192.168.255.2 mask 255.255.255.255
  neighbor 10.1.3.1 activate
  neighbor 10.1.3.1 send-community both
  no auto-summary
  no synchronization
 exit-address-family
 !
 address-family ipv6 unicast
  network 2001:db8:a:12::/64
  network 2001:db8:a:ff::2/128
  neighbor 10.1.3.1 activate
  neighbor 10.1.3.1 send-community both
 exit-address-family
!
end
write memory

PE1# show bgp vpnv4 unicast vrf CORP-A
BGP table version is 12, local router ID is 10.0.0.21
   Network          Next Hop            Metric LocPrf Weight Path
Route Distinguisher: 65000:100 (default for vrf CORP-A)
*> 192.168.11.0     10.1.1.2                 0           0 65001 i
*>i192.168.12.0     10.0.0.23                0    100      0 65000 65000 i
*> 192.168.255.1/32 10.1.1.2                 0           0 65001 i
*>i192.168.255.2/32 10.0.0.23                0    100      0 65000 65000 i

PE1# show bgp vpnv4 unicast vrf CORP-A 192.168.12.0
BGP routing table entry for 65000:100:192.168.12.0/24, version 9
Paths: (1 available, best #1)
  Advertised to update-groups: 2
  65000 65000, imported path from 65000:100:192.168.12.0/24 (global)
    10.0.0.23 (metric 30) from 10.0.0.1 (10.0.0.1)
      Origin IGP, metric 0, localpref 100, valid, internal, best
      Extended Community: RT:65000:100 SoO:65000:102:0
      Originator: 10.0.0.23, Cluster list: 10.0.0.100
      mpls labels in/out nolabel/23

PE1# show ip cef vrf CORP-A 192.168.12.0
192.168.12.0/24, epoch 0, flags rib only nolabel, rib defined all labels
  recursive via 10.0.0.23
    nexthop 10.0.1.2 GigabitEthernet0/0 label 21 23   <-- 外层21 / 内层23

PE1# show ipv6 cef vrf CORP-A 2001:db8:a:12::/64
2001:db8:a:12::/64
  recursive via ::FFFF:10.0.0.23        <-- IPv4-mapped 下一跳
    nexthop 10.0.1.2 GigabitEthernet0/0 label 21 24

! 分支(spoke)侧 VRF：导出 SPOKE-RT，只导入 HUB-RT
vrf definition CORP-SPOKE
 rd 65000:110
 address-family ipv4
  route-target export 65000:111          ! SPOKE 路由贴 111
  route-target import 65000:222          ! 只接收 HUB 发来的 222
 exit-address-family
!
! 总部(hub)侧 VRF：导出 HUB-RT，导入 SPOKE-RT
vrf definition CORP-HUB
 rd 65000:120
 address-family ipv4
  route-target export 65000:222          ! HUB 路由贴 222
  route-target import 65000:111          ! 接收所有 SPOKE
  route-target import 65000:222
 exit-address-family
!
! 效果：spoke→hub 通，hub→spoke 通，spoke→spoke 不通（因为 spoke 不 import 111）

configure terminal
!===========================================================
! 1) VRF
!===========================================================
vrf definition CORP-B
 rd 65000:200
 address-family ipv4
  route-target export 65000:200
  route-target import 65000:200
 exit-address-family
 address-family ipv6
  route-target export 65000:200
  route-target import 65000:200
 exit-address-family
!
!===========================================================
! 2) Sham-Link 端点：/32 环回，放进 VRF，【只由 BGP 通告】
!===========================================================
interface Loopback200
 description ## Sham-Link endpoint (VRF CORP-B) ##
 vrf forwarding CORP-B
 ip address 172.31.255.2 255.255.255.255
 ipv6 address 2001:db8:200::2/128
!
!===========================================================
! 3) 客户接口
!===========================================================
interface GigabitEthernet0/1
 description ## PE2 Gi0/1  <-->  CE-B1 Gi0/0 ##
 vrf forwarding CORP-B
 ip address 10.1.2.1 255.255.255.252
 ip ospf network point-to-point
 ip ospf 200 area 0
 ipv6 address 2001:db8:1:2::1/64
 ospfv3 200 ipv6 area 0
 no shutdown
!
!===========================================================
! 4) OSPFv2（VRF）
!===========================================================
router ospf 200 vrf CORP-B
 router-id 172.31.255.2
 !
 ! domain-id 与 PE4 保持一致 → 生成 Type-3 而不是 Type-5
 domain-id 0.0.0.200
 !
 ! 把 MP-BGP 学到的客户路由重分发进 OSPF，发给 CE
 redistribute bgp 65000 subnets
 !
 ! ---- Sham-Link（源 本端 / 目的 PE4 端点 / cost）----
 area 0 sham-link 172.31.255.2 172.31.255.4 cost 10
 !
 network 10.1.2.0 0.0.0.3 area 0
!
!===========================================================
! 5) OSPFv3（VRF）—— 注意语法与 OSPFv2 不同
!===========================================================
router ospfv3 200
 !
 address-family ipv6 unicast vrf CORP-B
  router-id 172.31.255.2
  redistribute bgp 65000 include-connected
  area 0 sham-link 2001:db8:200::2 2001:db8:200::4 cost 10
 exit-address-family
!
!===========================================================
! 6) MP-BGP：把 OSPF 学到的客户路由带上 RT 发布出去
!===========================================================
router bgp 65000
 !
 address-family ipv4 vrf CORP-B
  ! Sham-Link 端点必须【只用 network 通告】，不要 redistribute connected
  network 172.31.255.2 mask 255.255.255.255
  redistribute ospf 200 match internal external 1 external 2
  no auto-summary
  no synchronization
 exit-address-family
 !
 address-family ipv6 vrf CORP-B
  network 2001:db8:200::2/128
  redistribute ospf 200 include-connected
 exit-address-family
!
end
write memory

configure terminal
vrf definition CORP-B
 rd 65000:200
 address-family ipv4
  route-target export 65000:200
  route-target import 65000:200
 exit-address-family
 address-family ipv6
  route-target export 65000:200
  route-target import 65000:200
 exit-address-family
!
interface Loopback200
 description ## Sham-Link endpoint (VRF CORP-B) ##
 vrf forwarding CORP-B
 ip address 172.31.255.4 255.255.255.255
 ipv6 address 2001:db8:200::4/128
!
interface GigabitEthernet0/2
 description ## PE4 Gi0/2  <-->  CE-B2 Gi0/0 ##
 vrf forwarding CORP-B
 ip address 10.1.4.1 255.255.255.252
 ip ospf network point-to-point
 ip ospf 200 area 0
 ipv6 address 2001:db8:1:4::1/64
 ospfv3 200 ipv6 area 0
 no shutdown
!
router ospf 200 vrf CORP-B
 router-id 172.31.255.4
 domain-id 0.0.0.200
 redistribute bgp 65000 subnets
 area 0 sham-link 172.31.255.4 172.31.255.2 cost 10
 network 10.1.4.0 0.0.0.3 area 0
!
router ospfv3 200
 address-family ipv6 unicast vrf CORP-B
  router-id 172.31.255.4
  redistribute bgp 65000 include-connected
  area 0 sham-link 2001:db8:200::4 2001:db8:200::2 cost 10
 exit-address-family
!
router bgp 65000
 address-family ipv4 vrf CORP-B
  network 172.31.255.4 mask 255.255.255.255
  redistribute ospf 200 match internal external 1 external 2
 exit-address-family
 address-family ipv6 vrf CORP-B
  network 2001:db8:200::4/128
  redistribute ospf 200 include-connected
 exit-address-family
!
end
write memory

configure terminal
hostname CE-B1
ip cef
ipv6 unicast-routing
ipv6 cef
!
interface GigabitEthernet0/0
 description ## CE-B1 Gi0/0  <-->  PE2 Gi0/1  (MPLS 主用) ##
 ip address 10.1.2.2 255.255.255.252
 ip ospf network point-to-point
 ip ospf 200 area 0
 ipv6 address 2001:db8:1:2::2/64
 ospfv3 200 ipv6 area 0
 no shutdown
!
interface GigabitEthernet0/1
 description ## CE-B1 Gi0/1  <-->  CE-B2 Gi0/1  (后门链路) ##
 ip address 172.20.99.1 255.255.255.0
 ipv6 address 2001:db8:b:99::1/64
 ! 关键：把后门链路的 cost 调高，让它只在 MPLS 故障时接管
 ip ospf 200 area 0
 ip ospf cost 1000
 ospfv3 200 ipv6 area 0
 ipv6 ospf cost 1000
 no shutdown
!
interface Loopback0
 ip address 172.20.255.1 255.255.255.255
 ip ospf 200 area 0
 ipv6 address 2001:db8:b:ff::1/128
 ospfv3 200 ipv6 area 0
!
interface Loopback10
 description ## 站点 1 业务网段 ##
 ip address 172.20.11.1 255.255.255.0
 ip ospf 200 area 0
 ipv6 address 2001:db8:b:11::1/64
 ospfv3 200 ipv6 area 0
!
router ospf 200
 router-id 172.20.255.1
 passive-interface Loopback0
 log-adjacency-changes
!
router ospfv3 200
 router-id 172.20.255.1
!
end
write memory

configure terminal
hostname CE-B2
ip cef
ipv6 unicast-routing
ipv6 cef
!
interface GigabitEthernet0/0
 description ## CE-B2 Gi0/0  <-->  PE4 Gi0/2  (MPLS 主用) ##
 ip address 10.1.4.2 255.255.255.252
 ip ospf network point-to-point
 ip ospf 200 area 0
 ipv6 address 2001:db8:1:4::2/64
 ospfv3 200 ipv6 area 0
 no shutdown
!
interface GigabitEthernet0/1
 description ## CE-B2 Gi0/1  <-->  CE-B1 Gi0/1  (后门链路) ##
 ip address 172.20.99.2 255.255.255.0
 ipv6 address 2001:db8:b:99::2/64
 ip ospf 200 area 0
 ip ospf cost 1000
 ospfv3 200 ipv6 area 0
 ipv6 ospf cost 1000
 no shutdown
!
interface Loopback0
 ip address 172.20.255.2 255.255.255.255
 ip ospf 200 area 0
 ipv6 address 2001:db8:b:ff::2/128
 ospfv3 200 ipv6 area 0
!
interface Loopback10
 description ## 站点 2 业务网段 ##
 ip address 172.20.12.1 255.255.255.0
 ip ospf 200 area 0
 ipv6 address 2001:db8:b:12::1/64
 ospfv3 200 ipv6 area 0
!
router ospf 200
 router-id 172.20.255.2
 passive-interface Loopback0
 log-adjacency-changes
!
router ospfv3 200
 router-id 172.20.255.2
!
end
write memory

PE2# show ip ospf sham-links
Sham Link OSPF_SL0 to address 172.31.255.4 is up
Area 0 source address 172.31.255.2
  Run as demand circuit
  DoNotAge LSA allowed. Cost of using 10 State POINT_TO_POINT,
  Timer intervals configured, Hello 10, Dead 40, Wait 40,
    Hello due in 00:00:03
    Adjacency State FULL (Hello suppressed)
    Index 2/2, retransmission queue length 0, number of retransmission 0
    First 0x0(0)/0x0(0) Next 0x0(0)/0x0(0)

PE2# show ip route vrf CORP-B 172.20.12.0
Routing entry for 172.20.12.0/24
  Known via "ospf 200", distance 110, metric 11, type intra area   <-- 区域内！
  Last update from 10.1.2.2 on GigabitEthernet0/1, 00:00:21 ago
  Routing Descriptor Blocks:
  * 10.1.2.2, from 172.20.255.2, 00:00:21 ago, via GigabitEthernet0/1
      Route metric is 11, traffic share count is 1

configure terminal
vrf definition BRANCH
 rd 65000:300
 address-family ipv4
  route-target export 65000:300
  route-target import 65000:300
 exit-address-family
 address-family ipv6
  route-target export 65000:300
  route-target import 65000:300
 exit-address-family
!
interface GigabitEthernet0/3
 description ## PE1 Gi0/3  <-->  SPOKE1 Gi0/0 ##
 vrf forwarding BRANCH
 ip address 10.1.11.1 255.255.255.252
 ipv6 address 2001:db8:1:11::1/64
 no shutdown
!
router bgp 65000
 address-family ipv4 vrf BRANCH
  neighbor 10.1.11.2 remote-as 65003
  neighbor 10.1.11.2 activate
  neighbor 10.1.11.2 ttl-security hops 1
  ! 三个站点都是 AS 65003，本例让 CE 侧用 allowas-in 解决
  ! （对比：CORP-A 用的是运营商侧 as-override）
  neighbor 10.1.11.2 send-community both
  neighbor 10.1.11.2 maximum-prefix 50 80 restart 5
  neighbor 10.1.11.2 default-originate
 exit-address-family
 address-family ipv6 vrf BRANCH
  neighbor 10.1.11.2 remote-as 65003
  neighbor 10.1.11.2 activate
 exit-address-family
!
end
write memory

configure terminal
!===========================================================
! IKEv2 + IPsec：为 GRE 流量加密（transport 模式，省 20 字节）
!===========================================================
crypto ikev2 proposal DMVPN-PROP
 encryption aes-cbc-256
 integrity sha256
 group 14
!
crypto ikev2 policy DMVPN-POL
 proposal DMVPN-PROP
!
crypto ikev2 keyring DMVPN-KEYRING
 peer ANY
  address 0.0.0.0 0.0.0.0
  pre-shared-key local MplsLab@2026
  pre-shared-key remote MplsLab@2026
!
crypto ikev2 profile DMVPN-IKEV2
 match identity remote address 0.0.0.0
 authentication remote pre-share
 authentication local pre-share
 keyring local DMVPN-KEYRING
 dpd 40 5 on-demand
!
crypto ipsec transform-set DMVPN-TS esp-aes 256 esp-sha256-hmac
 mode transport
!
crypto ipsec profile DMVPN-PROF
 set transform-set DMVPN-TS
 set ikev2-profile DMVPN-IKEV2
!
end
write memory

configure terminal
hostname HUB
ip cef
ipv6 unicast-routing
ipv6 cef
!
!===========================================================
! Front-door VRF：underlay 专用（FVRF），隧道与 LAN 在全局表（IVRF）
! 这是 DMVPN 的标准做法：underlay 与 overlay 路由表彻底分离
!===========================================================
vrf definition UNDERLAY
 rd 65003:100
 address-family ipv4
 exit-address-family
 address-family ipv6
 exit-address-family
!
!---------- underlay 上行口 ----------
interface GigabitEthernet0/0
 description ## HUB Gi0/0  <-->  PE4 Gi0/3 ##
 vrf forwarding UNDERLAY
 ip address 10.1.14.2 255.255.255.252
 ipv6 address 2001:db8:1:14::2/64
 no shutdown
!
!---------- NHRP / GRE 的源地址 ----------
interface Loopback100
 description ## DMVPN NBMA source ##
 vrf forwarding UNDERLAY
 ip address 172.16.100.1 255.255.255.255
 ipv6 address 2001:db8:100:ffff::1/128
!
!---------- 总部业务网段 ----------
interface Loopback10
 description ## HQ LAN ##
 ip address 192.168.20.1 255.255.255.0
 ipv6 address 2001:db8:c:20::1/64
!
!===========================================================
! DMVPN 隧道：一个 Tunnel 同时跑 IPv4 + IPv6（双栈单隧道）
!===========================================================
interface Tunnel0
 description ## DMVPN Phase3 - Dual Stack ##
 bandwidth 10000
 !
 !---- IPv4 overlay ----
 ip address 10.100.0.1 255.255.255.0
 no ip redirects
 ip mtu 1400
 ip tcp adjust-mss 1360
 ip nhrp authentication DMVPNKEY
 ip nhrp network-id 100
 ip nhrp holdtime 300
 ip nhrp map multicast dynamic        ! Hub：接受所有 Spoke 的动态组播映射
 ip nhrp redirect                     ! Phase 3：告诉 Spoke "你可以直连"
 !
 !---- IPv6 overlay（走 IPv4 传输的 mGRE）----
 ipv6 address 2001:db8:100::1/64
 ipv6 mtu 1400
 ipv6 nhrp authentication DMVPNKEY
 ipv6 nhrp network-id 100
 ipv6 nhrp holdtime 300
 ipv6 nhrp map multicast dynamic
 ipv6 nhrp redirect
 !
 !---- 隧道参数 ----
 tunnel source Loopback100
 tunnel vrf UNDERLAY                  ! 关键：underlay 查表用 UNDERLAY VRF
 tunnel mode gre multipoint
 tunnel key 100
 tunnel protection ipsec profile DMVPN-PROF
!
!===========================================================
! Overlay 路由：EIGRP 命名模式（双栈）
!===========================================================
router eigrp DMVPN
 !
 address-family ipv4 unicast autonomous-system 100
  af-interface Tunnel0
   no split-horizon                   ! Hub 必须关水平分割，否则 Spoke 学不到彼此
   no next-hop-self                   ! Phase 3 必须，保留 Spoke 真实下一跳
   summary-address 192.168.20.0/24
  exit-af-interface
  network 10.100.0.0 0.0.0.255
  network 192.168.20.0 0.0.0.255
  ! 若邻居起不来，在地址族下补一句：no shutdown
 exit-address-family
 !
 address-family ipv6 unicast autonomous-system 100
  af-interface Tunnel0
   no split-horizon
   no next-hop-self
  exit-af-interface
  network 2001:db8:100::/64
  network 2001:db8:c:20::/64
 exit-address-family
!
!===========================================================
! Underlay 路由：把 Lo100 通告进 MPLS VPN
!===========================================================
router bgp 65003
 bgp router-id 172.16.100.1
 bgp log-neighbor-changes
 no bgp default ipv4-unicast
 !
 address-family ipv4 unicast vrf UNDERLAY
  network 172.16.100.1 mask 255.255.255.255
  neighbor 10.1.14.1 remote-as 65000
  neighbor 10.1.14.1 activate
  neighbor 10.1.14.1 ttl-security hops 1
  neighbor 10.1.14.1 allowas-in 1        ! 三个站点同 AS 65003
  neighbor 10.1.14.1 send-community both
 exit-address-family
 !
end
write memory

configure terminal
hostname SPOKE1
ip cef
ipv6 unicast-routing
ipv6 cef
!  ! （IPsec 配置见 7.2，三台相同）
!
vrf definition UNDERLAY
 rd 65003:100
 address-family ipv4
 exit-address-family
 address-family ipv6
 exit-address-family
!
interface GigabitEthernet0/0
 description ## SPOKE1 Gi0/0  <-->  PE1 Gi0/3 ##
 vrf forwarding UNDERLAY
 ip address 10.1.11.2 255.255.255.252
 ipv6 address 2001:db8:1:11::2/64
 no shutdown
!
interface Loopback100
 vrf forwarding UNDERLAY
 ip address 172.16.100.11 255.255.255.255
 ipv6 address 2001:db8:100:ffff::11/128
!
interface Loopback10
 description ## Branch-1 LAN ##
 ip address 192.168.21.1 255.255.255.0
 ipv6 address 2001:db8:c:21::1/64
!
interface Tunnel0
 description ## DMVPN Phase3 - Spoke ##
 bandwidth 10000
 !
 ip address 10.100.0.11 255.255.255.0
 no ip redirects
 ip mtu 1400
 ip tcp adjust-mss 1360
 ip nhrp authentication DMVPNKEY
 ip nhrp network-id 100
 ip nhrp holdtime 300
 ! NHS = 下一跳服务器（Hub），nbma = Hub 的 underlay 地址
 ip nhrp nhs 10.100.0.1 nbma 172.16.100.1 multicast
 ip nhrp shortcut                     ! Phase 3：接受 Hub 的直连建议
 ip nhrp registration timeout 60
 !
 ipv6 address 2001:db8:100::11/64
 ipv6 mtu 1400
 ipv6 nhrp authentication DMVPNKEY
 ipv6 nhrp network-id 100
 ipv6 nhrp holdtime 300
 ipv6 nhrp nhs 2001:db8:100::1
 ipv6 nhrp map 2001:db8:100::1/128 172.16.100.1
 ipv6 nhrp map multicast 172.16.100.1
 ipv6 nhrp shortcut
 !
 tunnel source Loopback100
 tunnel vrf UNDERLAY
 tunnel mode gre multipoint
 tunnel key 100
 tunnel protection ipsec profile DMVPN-PROF
!
router eigrp DMVPN
 address-family ipv4 unicast autonomous-system 100
  af-interface Tunnel0
   no split-horizon
   no next-hop-self
  exit-af-interface
  network 10.100.0.0 0.0.0.255
  network 192.168.21.0 0.0.0.255
 exit-address-family
 address-family ipv6 unicast autonomous-system 100
  af-interface Tunnel0
   no split-horizon
   no next-hop-self
  exit-af-interface
  network 2001:db8:100::/64
  network 2001:db8:c:21::/64
 exit-address-family
!
router bgp 65003
 bgp router-id 172.16.100.11
 no bgp default ipv4-unicast
 address-family ipv4 unicast vrf UNDERLAY
  network 172.16.100.11 mask 255.255.255.255
  neighbor 10.1.11.1 remote-as 65000
  neighbor 10.1.11.1 activate
  neighbor 10.1.11.1 ttl-security hops 1
  neighbor 10.1.11.1 allowas-in 1
  neighbor 10.1.11.1 send-community both
 exit-address-family
!
end
write memory

HUB# show dmvpn
Legend: Attrb --> S - Static, D - Dynamic, I - Incomplete
        N - NATed, L - Local, X - No Socket
        # Ent --> Number of NHRP entries with same NBMA peer
Tunnel0, Type:Hub, NHRP Peers:2,
 # Ent  Peer NBMA Addr Peer Tunnel Add State  UpDn Tm Attrb
 ----- --------------- --------------- ----- -------- -----
     1 172.16.100.11      10.100.0.11    UP 00:14:22     D
     1 172.16.100.12      10.100.0.12    UP 00:14:05     D

HUB# show ipv6 nhrp brief
Target             Via            NBMA            Mode   Intfc   Claimed
2001:db8:100::11/128 2001:db8:100::11 172.16.100.11  dynamic Tu0    <-->
2001:db8:100::12/128 2001:db8:100::12 172.16.100.12  dynamic Tu0    <-->

HUB# show crypto ikev2 sa
 IPv4 Crypto IKEv2  SA
Tunnel-id Local                 Remote                fvrf/ivrf            Status
1         172.16.100.1/500      172.16.100.11/500     UNDERLAY/none        READY
2         172.16.100.1/500      172.16.100.12/500     UNDERLAY/none        READY

SPOKE1# show ip nhrp shortcut
10.100.0.12/32 via 10.100.0.12
   Tunnel0 created 00:00:41, expire 00:04:19
   Type: dynamic, Flags: router nhop rib
   NBMA address: 172.16.100.12
   Preference: 255

! 在 PE1 上查看：同一前缀应有 2 个 path（best + backup）
PE1# show bgp vpnv4 unicast vrf CORP-A 192.168.12.0
Paths: (2 available, best #1, table CORP-A)
  Additional-path
  ...
  Path #2:  by 10.0.0.24 ...  (backup / repair path)

! 看 CEF 里有没有 repair 路径 —— 有就说明 PIC 生效
PE1# show ip cef vrf CORP-A 192.168.12.0 detail
192.168.12.0/24, epoch 0, flags rib only nolabel, rib defined all labels
  recursive via 10.0.0.23
    nexthop 10.0.1.2 GigabitEthernet0/0 label 21 23
  recursive via 10.0.0.24           <-- 备份下一跳（repair）
    nexthop 10.0.8.2 GigabitEthernet0/1 label 19 25

! 也可以看 BGP 的 PIC 统计
PE1# show bgp vpnv4 unicast all | include PIC

router bgp 65000
 !
 !---------- 会话模板：只管"怎么连" ----------
 template peer-session IBGP-SESSION
  remote-as 65000
  update-source Loopback0
  password 0 MplsLab@2026
  timers 5 15
  transport connection-mode active
 exit-peer-session
 !
 template peer-session IBGP-RR-SESSION
  inherit peer-session IBGP-SESSION
  version 4
 exit-peer-session
 !
 !---------- 策略模板：只管"发什么" ----------
 template peer-policy IBGP-POLICY
  send-community extended
  route-reflector-client
  advertise additional-paths all
 exit-peer-policy
 !
 template peer-policy IBGP-RR-POLICY
  send-community extended
 exit-peer-policy
 !
 !---------- 邻居引用模板 ----------
 neighbor 10.0.0.21 inherit peer-session IBGP-SESSION
 neighbor 10.0.0.22 inherit peer-session IBGP-SESSION
 neighbor 10.0.0.23 inherit peer-session IBGP-SESSION
 neighbor 10.0.0.24 inherit peer-session IBGP-SESSION
 neighbor 10.0.0.2  inherit peer-session IBGP-RR-SESSION
 !
 address-family vpnv4 unicast
  neighbor 10.0.0.21 inherit peer-policy IBGP-POLICY
  neighbor 10.0.0.22 inherit peer-policy IBGP-POLICY
  neighbor 10.0.0.23 inherit peer-policy IBGP-POLICY
  neighbor 10.0.0.24 inherit peer-policy IBGP-POLICY
  neighbor 10.0.0.2  inherit peer-policy IBGP-RR-POLICY
 exit-address-family
 !
 address-family vpnv6 unicast
  neighbor 10.0.0.21 inherit peer-policy IBGP-POLICY
  neighbor 10.0.0.22 inherit peer-policy IBGP-POLICY
  neighbor 10.0.0.23 inherit peer-policy IBGP-POLICY
  neighbor 10.0.0.24 inherit peer-policy IBGP-POLICY
  neighbor 10.0.0.2  inherit peer-policy IBGP-RR-POLICY
 exit-address-family
!
! 验证：
!   show bgp template peer-session
!   show bgp template peer-policy

configure terminal
!---------- 全局开启 TE ----------
mpls traffic-eng tunnels
!
!---------- 骨干接口启用 TE + RSVP 带宽 ----------
interface GigabitEthernet0/0
 mpls traffic-eng tunnels
 ip rsvp bandwidth 100000
!
interface GigabitEthernet0/1
 mpls traffic-eng tunnels
 ip rsvp bandwidth 100000
!
!---------- IGP 通告 TE 信息（OSPF 需要 Opaque LSA）----------
router ospf 1
 mpls traffic-eng router-id Loopback0
 mpls traffic-eng area 0
!
!---------- 显式路径：强制走 PE1 → PE4 直连 ----------
ip explicit-path name VIA-DIRECT enable
 next-address 10.0.8.2
!
!---------- 隧道接口 ----------
interface Tunnel100
 description ## MPLS TE: PE1 -> PE4 (via direct link) ##
 ip unnumbered Loopback0
 tunnel destination 10.0.0.24
 tunnel mode mpls traffic-eng
 tunnel mpls traffic-eng bandwidth 50000
 tunnel mpls traffic-eng priority 5 5
 tunnel mpls traffic-eng path-option 1 explicit name VIA-DIRECT
 tunnel mpls traffic-eng path-option 2 dynamic
 ! 把 TE 隧道放进 IGP 计算（注意：这只影响本端出流量）
 tunnel mpls traffic-eng autoroute announce
 no shutdown
!
end
write memory

PE1# show mpls traffic-eng tunnels brief
Signalling Summary:
    LSP Tunnels Process:  running
    Passive LSP Listener: running
    RSVP Process:         running
    Forwarding:           enabled
TUNNEL NAME         DESTINATION      UP IF     DOWN IF   STATE/PROT
PE1_t100            10.0.0.24        -         Gi0/1     up/up

PE1# show mpls traffic-eng tunnels tunnel100
    Name: PE1_t100                      (Tunnel100) Destination: 10.0.0.24
    Status: Admin: up   Oper: up   Path: valid   Signalling: connected
      path option 1, (Explicit Path) type explicit VIA-DIRECT (Basis for Setup)
    Config Parameters:
      Bandwidth: 50000    kbps (Global)  Priority: 5  5   Affinity: 0x0/0xFFFF
      AutoRoute announce: enabled  LockDown: disabled   Policy class: not set
    Shortest Unconstrained Path Info:
      Path Weight: 30 (TE)
      Explicit Route: 10.0.8.1 10.0.8.2 10.0.0.24
    History:
      Tunnel has been up for: 00:03:12

configure terminal
!---------- 1) 分类 ----------
class-map match-any CM-VOICE
 match dscp ef
class-map match-any CM-VIDEO
 match dscp af41 af42 af43
class-map match-any CM-CRITICAL
 match dscp af31 af32 af33
!
!---------- 2) 标记：把 DSCP 映射到 MPLS EXP ----------
policy-map PM-MPLS-MARK
 class CM-VOICE
  set mpls experimental imposition 5
  police 2000000 conform-action transmit exceed-action drop
 class CM-VIDEO
  set mpls experimental imposition 4
 class CM-CRITICAL
  set mpls experimental imposition 3
 class class-default
  set mpls experimental imposition 0
!
!---------- 3) 应用到客户接口（入方向）----------
interface GigabitEthernet0/2
 vrf forwarding CORP-A
 service-policy input PM-MPLS-MARK
!
!---------- 4) 出方向：按 EXP 调度（LLQ 给语音）----------
policy-map PM-CORE-OUT
 class CM-VOICE
  priority percent 20
 class CM-VIDEO
  bandwidth percent 25
 class CM-CRITICAL
  bandwidth percent 15
 class class-default
  fair-queue
!
interface GigabitEthernet0/0
 service-policy output PM-CORE-OUT
!
!---------- 5) 隧道 / 加密场景：先解封装再分类 ----------
! 对 DMVPN 的 Hub/Spoke（在 HUB 上配）
interface Tunnel0
 qos pre-classify
!
end
write memory

PE1# show policy-map interface GigabitEthernet0/2
 GigabitEthernet0/2
  Service-policy input: PM-MPLS-MARK
    Class-map: CM-VOICE (match-any)
      1243 packets, 132158 bytes
      5 minute offered rate 4000 bps, drop rate 0 bps
      Match: dscp ef (46)
      QoS Set:
        mpls experimental imposition 5

! 抓包验证：在 PE1-P1 链路上抓包，MPLS 头的 EXP 字段应为 5
! Wireshark 过滤：mpls && mpls.exp == 5

configure terminal
!
! ① LDP 会话保护：链路短暂抖动时不重建 LDP 会话（避免标签重收敛）
mpls ldp
 session protection
 ! 或限定范围 + 保护时长：
 ! session protection for CORE-LDP duration 120
!
! ② LDP 与 IGP 同步：IGP 通告某链路前，先确认 LDP 已就绪
router ospf 1
 mpls ldp sync
 ! 等待超时（秒），超时后不再等待，避免永久卡住
 mpls ldp sync holddown 30
!
! ③ 接受定向 Hello（Targeted LDP）：用于 LDP over TE、L2VPN、mLDP
mpls ldp
 discovery targeted-hello accept from CORE-LDP
 discovery targeted-hello interval 10
 discovery targeted-hello holdtime 90
!
! ④ 隐藏核心拓扑：转发时不把 IP TTL 复制到 MPLS TTL
!    这样 traceroute 从客户侧看不到骨干有几跳（安全 + 美观）
no mpls ip propagate-ttl forwarded
! 本地产生的包仍然复制 TTL（便于自己排错）
mpls ip propagate-ttl local
!
! ⑤ TTL 到期时在哪里弹标签：pop 1 表示在倒数第一跳（更贴近真实）
mpls ip ttl-expiration pop 1
!
! ⑥ 提高接口 MPLS MTU（标签栈会变长，双层标签 +8 字节）
interface GigabitEthernet0/0
 mtu 9216
 mpls mtu 9200
!
! ⑦ 加快 LDP 检测
mpls ldp
 discovery hello interval 5
 discovery hello holdtime 15
!
end
write memory

! ① LSP Ping：验证到某台 PE 的标签路径是否可达（数据平面）
PE1# ping mpls ipv4 10.0.0.24/32
Sending 5, 100-byte MPLS Echos to 10.0.0.24/32,
     timeout is 2 seconds, send interval is 0 msec:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms

! ② LSP Traceroute：逐跳显示标签交换路径（能看到每一跳用了什么标签）
PE1# traceroute mpls ipv4 10.0.0.24/32
Tracing MPLS Label Switched Path to 10.0.0.24/32, timeout is 2 seconds
  0 10.0.1.1 MRU 1500 [Labels: 21 Exp: 0]
L 1 10.0.1.2 MRU 1500 [Labels: 21 Exp: 0] 3 ms
L 2 10.0.5.2 MRU 1500 [Labels: 21 Exp: 0] 4 ms
! 3 10.0.4.1 5 ms            <-- 到达 PE4

! ③ 带源地址（VRF 场景常用）
PE1# ping mpls ipv4 10.0.0.24/32 source 10.0.0.21

! ④ 验证 VPN 标签（两层标签）
PE1# ping mpls ipv4 10.0.0.24/32 verbose

! ⑤ IPv6 LSP（6PE 场景）
PE1# ping mpls ipv6 fd00::24/128

! ⑥ 查看 LSP 树（拓扑视角）
PE1# show mpls ldp bindings 10.0.0.24 32
PE1# show mpls forwarding-table 10.0.0.24 32 detail

客户 CE 上 ping 对端 LAN 不通
   │
   ├─① CE 本地有路由吗？  show ip route <对端LAN>
   │     └─ 没有 → 查 PE-CE 协议（eBGP/OSPF 邻居、network 语句、重分发）
   │
   ├─② PE 的 VRF 表里有这条路由吗？  show ip route vrf <VRF> <对端LAN>
   │     ├─ 没有 → 查本端 PE 有没有从 CE 学到（show bgp vpnv4 unicast vrf X）
   │     │          └─ 学到了但没装表 → 下一跳不可达（回 ④）
   │     └─ 有 → 继续 ③
   │
   ├─③ 对端 PE 有这条 VPNv4 路由吗？  show bgp vpnv4 unicast all | i <前缀>
   │     ├─ 完全没有 → 查 RT（export/import 是否匹配）、查 RTC 订阅
   │     ├─ 有但本端收不到 → 查 RR：
   │     │     show bgp vpnv4 unicast all neighbors 10.0.0.1 received-routes
   │     │     如果 RR 上也没有 → 源 PE 没发出（回 RT / 重分发）
   │     └─ 都有 → 继续 ④
   │
   ├─④ 下一跳可达吗？  show ip cef vrf X <前缀>    ← 有无 "label A B"
   │     ├─ 没有标签 → LDP 问题！
   │     │     show mpls ldp neighbor      （邻居在不在）
   │     │     show mpls forwarding-table  （有没有出标签）
   │     │     ping mpls ipv4 <对端PE>/32  （LSP 通不通）
   │     └─ 有标签 → 继续 ⑤
   │
   ├─⑤ 数据平面真的通吗？
   │     ping mpls ipv4 <对端PE-lo0>/32          → 不通：LDP/LSP 故障
   │     traceroute mpls ipv4 <对端PE-lo0>/32    → 看在哪一跳断
   │     抓包看 PE-CE 与 P 链路上的标签栈
   │
   └─⑥ 单向通 / 双向不通？
         检查回程路由、ACL、VRF 接口绑定、CE 上是否有默认路由

【三句口诀】
   控制平面看 BGP（show bgp vpnv4 / show ip route vrf）
   转发平面看标签（show mpls forwarding-table / show ip cef vrf）
   两层都对还不通 → 一定是 ACL / MTU / NAT

!---------- ASBR1（AS 65000 侧）----------
router bgp 65000
 ! 向对端 ASBR 通告【本 AS 内 PE 的 loopback + 标签】
 address-family ipv4 unicast
  network 10.0.0.21 mask 255.255.255.255
  network 10.0.0.22 mask 255.255.255.255
  neighbor 192.0.2.2 remote-as 65100
  neighbor 192.0.2.2 activate
  neighbor 192.0.2.2 send-label           ! 关键：带标签发布
 exit-address-family
!
!---------- RR1 与对端 RR 建多跳 eBGP，直接交换 VPNv4 ----------
router bgp 65000
 neighbor 10.100.100.2 remote-as 65100
 neighbor 10.100.100.2 ebgp-multihop 255
 neighbor 10.100.100.2 update-source Loopback0
 !
 address-family vpnv4 unicast
  neighbor 10.100.100.2 activate
  neighbor 10.100.100.2 send-community extended
  ! 跨域时下一跳不能改，否则标签链断裂
  neighbor 10.100.100.2 next-hop-unchanged
 exit-address-family

router bgp 65000
 address-family l2vpn evpn
  neighbor 10.0.0.1 activate
  neighbor 10.0.0.1 send-community both
 exit-address-family
!
! 二层实例（EVI）
l2vpn evpn instance 100 vlan-based
 rd 65000:100
 route-target export 65000:100
 route-target import 65000:100

! 传统 MPLS 需要：IGP + LDP + （TE 时还要 RSVP）
! SR-MPLS 只需在 IGP 里加几行：
router isis CORE
 net 49.0001.0100.0000.0021.00
 is-type level-2-only
 metric-style wide
 segment-routing mpls
 !
 address-family ipv4 unicast
  segment-routing mpls
 exit-address-family
!
segment-routing mpls
 global-block 16000 23999          ! SRGB
 !
 connected-prefix-sid-map
  address-family ipv4
   10.0.0.21/32 index 21          ! Node-SID = 16000 + 21
  exit-address-family
!
! 结果：不再需要 mpls ldp / mpls ip / rsvp，标签由 IGP 分发

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
EVE-NG 批量下发 Cisco 配置
用法：python bulk_push.py cfg/PE1.txt 10.0.0.21
前提：EVE-NG 的 Management Cloud 已桥接到宿主机网段，设备可达且开启 telnet
"""
import sys, time, telnetlib

HOST_MAP = {
    "P1":       "10.0.0.11",
    "P2":       "10.0.0.12",
    "RR1":      "10.0.0.1",
    "RR2":      "10.0.0.2",
    "PE1":      "10.0.0.21",
    "PE2":      "10.0.0.22",
    "PE3":      "10.0.0.23",
    "PE4":      "10.0.0.24",
}
USER = ""          # EVE-NG 的 IOSv 默认无用户名密码
PASSWORD = ""
ENABLE = ""

def push(host, lines):
    tn = telnetlib.Telnet(host, 23, timeout=10)
    tn.read_until(b"Router>", timeout=10)
    tn.write(b"enable\n")
    tn.read_until(b"#", timeout=5)
    tn.write(b"configure terminal\n")
    tn.read_until(b"(config)#", timeout=5)
    for ln in lines:
        s = ln.rstrip("\n")
        if not s.strip() or s.strip().startswith("!"):
            continue                      # 跳过空行与注释
        tn.write(s.encode("ascii") + b"\n")
        time.sleep(0.05)
    tn.write(b"end\n")
    tn.write(b"write memory\n")
    time.sleep(1)
    tn.write(b"exit\n")
    print(f"[OK] {host} 推送完成")

if __name__ == "__main__":
    name = sys.argv[1]                    # 例如 PE1
    host = HOST_MAP[name]
    with open(f"cfg/{name}.txt", encoding="utf-8") as f:
        push(host, f.readlines())