华为运营商级路由器配置示例 | SRv6 SFC承载IPv4业务功能（SFF到SF使用二层转发）

Posted 2022-02-19 一个热爱编程的通信人

组网需求

如图1所示，SF1连接到SFF1，SF2连接到SFF2，SF1和SF2提供不同的业务链功能。IPv4业务流向是从SC到Tail End，要求在网络里配置SFC功能，确保IPv4业务报文经过SF1和SF2的顺序处理。

图1 配置SRv6 SFC承载IPv4业务功能组网图（SFF到SF使用二层转发）

 

配置思路

1. 使能各节点的接口IPv6转发能力，配置各接口的IPv6地址。
2. 在各节点上使能IS-IS，配置Level级别，指定网络实体。
3. 在各节点上配置SRv6基本功能。
4. 在SFF设备上配置接入SF。
5. 在SFF上配置SFC功能。
6. 在SC上配置SRv6 TE Policy。
7. 在SC上配置流策略，将业务流量重定向到SRv6 TE Policy。

操作步骤

1.使能各接口的IPv6转发能力，配置各接口的IP地址

# 配置SFF1。其他设备的配置过程相同，不再赘述，详情可参考配置文件。

<HUAWEI> system-view
[~HUAWEI] sysname SFF1
[*HUAWEI] commit
[~SFF1] interface gigabitethernet 1/0/0
[~SFF1-GigabitEthernet1/0/0] ipv6 enable
[*SFF1-GigabitEthernet1/0/0] ipv6 address 2001:db8:1::2 96
[*SFF1-GigabitEthernet1/0/0] quit
[*SFF1] interface gigabitethernet 2/0/0
[*SFF1-GigabitEthernet2/0/0] ipv6 enable
[*SFF1-GigabitEthernet2/0/0] ipv6 address 2001:db8:2::1 96
[*SFF1-GigabitEthernet2/0/0] quit
[*SFF1] interface loopback1
[*SFF1-LoopBack1] ipv6 enable
[*SFF1-LoopBack1] ipv6 address 2::2 128
[*SFF1-LoopBack1] commit
[~SFF1-LoopBack1] quit

2.配置IS-IS

# 配置SFF1。其他设备的配置过程相同，不再赘述。

[~SFF1] isis 1
[*SFF1-isis-1] is-level level-1
[*SFF1-isis-1] cost-style wide
[*SFF1-isis-1] network-entity 10.0000.0000.0002.00
[*SFF1-isis-1] ipv6 enable topology ipv6
[*SFF1-isis-1] quit
[*SFF1] interface gigabitethernet 1/0/0
[*SFF1-GigabitEthernet1/0/0] isis ipv6 enable 1
[*SFF1-GigabitEthernet1/0/0] quit
[*SFF1] interface gigabitethernet 2/0/0
[*SFF1-GigabitEthernet2/0/0] isis ipv6 enable 1
[*SFF1-GigabitEthernet2/0/0] quit
[*SFF1] interface loopback1
[*SFF1-LoopBack1] isis ipv6 enable 1
[*SFF1-LoopBack1] commit
[~SFF1-LoopBack1] quit

3.配置SRv6 SID，同时使能IS-IS SRv6

# 配置SC。

[~SC] segment-routing ipv6
[*SC-segment-routing-ipv6] encapsulation source-address 1::1
[*SC-segment-routing-ipv6] locator as1 ipv6-prefix 2001:db8:11:: 64 static 32
[*SC-segment-routing-ipv6-locator] opcode ::1 end psp
[*SC-segment-routing-ipv6-locator] quit
[*SC-segment-routing-ipv6] quit
[*SC] isis 1
[*SC-isis-1] segment-routing ipv6 locator as1 auto-sid-disable
[*SC-isis-1] commit
[~SC-isis-1] quit

# 配置SFF1。

[~SFF1] segment-routing ipv6
[*SFF1-segment-routing-ipv6] encapsulation source-address 2::2
[*SFF1-segment-routing-ipv6] locator as1 ipv6-prefix 2001:db8:12:: 64 static 32
[*SFF1-segment-routing-ipv6-locator] opcode ::1 end psp
[*SFF1-segment-routing-ipv6-locator] quit
[*SFF1-segment-routing-ipv6] quit
[*SFF1] isis 1
[*SFF1-isis-1] segment-routing ipv6 locator as1 auto-sid-disable
[*SFF1-isis-1] commit
[~SFF1-isis-1] quit

# 配置SFF2。

[~SFF2] segment-routing ipv6
[*SFF2-segment-routing-ipv6] encapsulation source-address 3::3
[*SFF2-segment-routing-ipv6] locator as1 ipv6-prefix 2001:db8:13:: 64 static 32
[*SFF2-segment-routing-ipv6-locator] opcode ::1 end psp
[*SFF2-segment-routing-ipv6-locator] quit
[*SFF2-segment-routing-ipv6] quit
[*SFF2] isis 1
[*SFF2-isis-1] segment-routing ipv6 locator as1 auto-sid-disable
[*SFF2-isis-1] commit
[~SFF2-isis-1] quit

# 配置Tail End。

[~Tail] ip vpn-instance vpna
[*Tail-vpn-instance-vpna] ipv4-family
[*Tail-vpn-instance-vpna-af-ipv4] route-distinguisher 500:1
[*Tail-vpn-instance-vpna-af-ipv4] vpn-target 111:1 both
[*Tail-vpn-instance-vpna-af-ipv4] quit
[*Tail-vpn-instance-vpna] quit
[*Tail] segment-routing ipv6
[*Tail-segment-routing-ipv6] encapsulation source-address 5::5
[*Tail-segment-routing-ipv6] locator as1 ipv6-prefix 2001:db8:15:: 64 static 32
[*Tail-segment-routing-ipv6-locator] opcode ::1 end psp
[*Tail-segment-routing-ipv6-locator] opcode ::100 end-dt4 vpn-instance vpna
[*Tail-segment-routing-ipv6-locator] quit
[*Tail-segment-routing-ipv6] quit
[*Tail] isis 1
[*Tail-isis-1] segment-routing ipv6 locator as1 auto-sid-disable
[*Tail-isis-1] commit
[~Tail-isis-1] quit

配置完成后，执行命令display segment-routing ipv6 locator [ locator-name ] verbose查看SRv6的Locator信息。

4.在SFF设备上配置接入SF

# 配置SFF1。

[~SFF1] interface gigabitethernet 3/0/0.1 mode l2
[*SFF1-GigabitEthernet3/0/0.1] encapsulation dot1q vid 1
[*SFF1-GigabitEthernet3/0/0.1] quit
[*SFF1] commit

# 配置SFF2。

5.在SFF设备上配置SFC基本功能

# 配置SFF1。

[~SFF1] segment-routing ipv6
[*SFF1-segment-routing-ipv6] locator as1
[*SFF1-segment-routing-ipv6-locator] opcode ::100 end-as
[*SFF1-segment-routing-ipv6-locator-endas-::100] inner-type ipv4
[*SFF1-segment-routing-ipv6-locator-endas-::100] encapsulation eth out-interface gigabitethernet 3/0/0.1 out-vlan 1 in-interface gigabitethernet 3/0/0.1 in-vlan 1
[*SFF1-segment-routing-ipv6-locator-endas-::100] cache source-address 1::1
[*SFF1-segment-routing-ipv6-locator-endas-::100] cache list 2001:db8:15::100 2001:db8:15::1 2001:db8:13::100 2001:db8:12::100
[*SFF1-segment-routing-ipv6-locator-endas-::100] quit
[*SFF1-segment-routing-ipv6-locator] quit
[*SFF1-segment-routing-ipv6] quit
[*SFF1] commit

# 配置SFF2。

[~SFF2] segment-routing ipv6
[*SFF2-segment-routing-ipv6] locator as1
[*SFF2-segment-routing-ipv6-locator] opcode ::100 end-as
[*SFF2-segment-routing-ipv6-locator-endas-::100] inner-type ipv4
[*SFF2-segment-routing-ipv6-locator-endas-::100] encapsulation eth out-interface gigabitethernet 3/0/0.1 out-vlan 1 in-interface gigabitethernet 3/0/0.1 in-vlan 1
[*SFF2-segment-routing-ipv6-locator-endas-::100] cache source-address 1::1
[*SFF2-segment-routing-ipv6-locator-endas-::100] cache list 2001:db8:15::100 2001:db8:15::1 2001:db8:13::100 2001:db8:12::100
[*SFF2-segment-routing-ipv6-locator-endas-::100] quit
[*SFF2-segment-routing-ipv6-locator] quit
[*SFF2-segment-routing-ipv6] quit
[*SFF2] commit

6.在SC上配置SRv6 TE Policy

# 配置SC。

配置完成后，执行命令display srv6-te policy查看SRv6 TE Policy信息。

7.在SC配置流策略功能，将业务重定向到SRv6 TE Policy

# 配置SC。

[~SC] traffic classifier c1
[*SC-classifier-c1] if-match any
[*SC-classifier-c1] commit
[~SC-classifier-c1] quit
[~SC] traffic behavior b1
[*SC-behavior-b1] redirect srv6-te policy 5::5 101 vpnsid 2001:db8:15::100
[*SC-behavior-b1] commit
[~SC-behavior-b1] quit
[~SC] traffic policy p1
[*SC-trafficpolicy-p1] classifier c1 behavior b1
[*SC-trafficpolicy-p1] statistic enable
[*SC-trafficpolicy-p1] commit
[~SC-trafficpolicy-p1] quit
[~SC] bridge-domain 1
[*SC-bd1] quit
[*SC] interface gigabitethernet 1/0/0.1 mode l2
[*SC-GigabitEthernet1/0/0.1] encapsulation dot1q vid 1
[*SC-GigabitEthernet1/0/0.1] rewrite pop single
[*SC-GigabitEthernet1/0/0.1] bridge-domain 1
[*SC-GigabitEthernet1/0/0.1] quit
[*SC] interface Vbdif1
[*SC-Vbdif1] ip binding vpn-instance vpna
[*SC-Vbdif1] ip address 10.0.0.1 30
[*SC-Vbdif1] traffic-policy p1 inbound
[*SC-Vbdif1] commit
[~SC-Vbdif1] quit