华为设备配置RSVP认证（手工TEFRR）

1. 配置IP地址
   [LSR1-GigabitEthernet0/0/0]ip add 20.1.1.1 24
   [LSR1-LoopBack0]ip add 1.1.1.1 32
   [LSR2-GigabitEthernet0/0/0]ip add 20.1.1.2 24
   [LSR2-GigabitEthernet0/0/1]ip add 20.1.2.2 24
   [LSR2-GigabitEthernet0/0/2]ip add 20.1.4.2 24
   [LSR2-LoopBack0]ip add 2.2.2.2 32
   [LSR3-GigabitEthernet0/0/0]ip add 20.1.2.3 24
   [LSR3-GigabitEthernet0/0/1]ip add 20.1.3.3 24
   [LSR3-GigabitEthernet0/0/2]ip add 20.1.5.3 24
   [LSR3-LoopBack0]ip add 3.3.3.3 32
   [LSR4-GigabitEthernet0/0/0]ip add 20.1.3.4 24
   [LSR4-LoopBack0]ip add 4.4.4.4 32
   [LSR5-GigabitEthernet0/0/0]ip add 20.1.4.5 24
   [LSR5-GigabitEthernet0/0/1]ip add 20.1.5.5 24
   [LSR5-LoopBack0]ip add 5.5.5.5 32

2. 配置IS-IS协议发布路由
   [LSR1]isis 1
   [LSR1-isis-1]network-entity 00.0001.0000.0000.0001.00
   [LSR1-isis-1]is-level level-2
   [LSR1-GigabitEthernet0/0/0]isis enable 1
   [LSR1-LoopBack0]isis enable 1
   [LSR2]isis 1
   [LSR2-isis-1]network-entity 00.0001.0000.0000.0002.00
   [LSR2-isis-1]is-level level-2
   [LSR2-GigabitEthernet0/0/0]isis enable 1
   [LSR2-GigabitEthernet0/0/1]isis enable 1
   [LSR2-GigabitEthernet0/0/2]isis enable 1
   [LSR2-LoopBack0]isis enable 1
   [LSR3]isis 1
   [LSR3-isis-1]network-entity 00.0001.0000.0000.0003.00
   [LSR3-isis-1]is-level level-2
   [LSR3-GigabitEthernet0/0/0]isis enable 1
   [LSR3-GigabitEthernet0/0/1]isis enable 1
   [LSR3-GigabitEthernet0/0/2]isis enable 1
   [LSR3-LoopBack0]isis enable 1
   [LSR4]isis 1
   [LSR4-isis-1]network-entity 00.0001.0000.0000.0004.00
   [LSR4-isis-1]is-level level-2
   [LSR4-GigabitEthernet0/0/0]isis enable 1
   [LSR4-LoopBack0]isis enable 1
   [LSR5]isis 1
   [LSR5-isis-1]network-entity 00.0001.0000.0000.0005.00
   [LSR5-isis-1]is-level level-2
   [LSR5-GigabitEthernet0/0/0]isis enable 1
   [LSR5-GigabitEthernet0/0/1]isis enable 1
   [LSR5-LoopBack0]isis enable 1

3. 配置MPLS基本能力&＃xff0c;使能MPLS TE、RSVP-TE和CSPF&＃xff0c;需在主隧道的入节点和旁路隧道入节点上使能CSPF
   [LSR1]mpls lsr-id 1.1.1.1
   [LSR1]mpls
   [LSR1-mpls]mpls te
   [LSR1-mpls]mpls te cspf
   [LSR1-mpls]mpls rsvp-te
   [LSR1-GigabitEthernet0/0/0]mpls
   [LSR1-GigabitEthernet0/0/0]mpls te
   [LSR1-GigabitEthernet0/0/0]mpls rsvp-te
   [LSR1]isis
   [LSR1-isis-1]cost-style wide
   [LSR1-isis-1]traffic-eng level-2
   [LSR2]mpls lsr-id 2.2.2.2
   [LSR2]mpls
   [LSR2-mpls]mpls te
   [LSR2-mpls]mpls rsvp-te
   [LSR2-mpls]mpls te cspf
   [LSR2-GigabitEthernet0/0/0]mpls
   [LSR2-GigabitEthernet0/0/0]mpls te
   [LSR2-GigabitEthernet0/0/0]mpls rsvp-te
   [LSR2-GigabitEthernet0/0/1]mpls
   [LSR2-GigabitEthernet0/0/1]mpls te
   [LSR2-GigabitEthernet0/0/1]mpls rsvp-te
   [LSR2-GigabitEthernet0/0/2]mpls
   [LSR2-GigabitEthernet0/0/2]mpls te
   [LSR2-GigabitEthernet0/0/2]mpls rsvp-te
   [LSR2]isis
   [LSR2-isis-1]cost-style wide
   [LSR2-isis-1]traffic-eng level-2
   [LSR3]mpls lsr-id 3.3.3.3
   [LSR3]mpls
   [LSR3-mpls]mpls te
   [LSR3-mpls]mpls rsvp-te
   [LSR3-GigabitEthernet0/0/0]mpls
   [LSR3-GigabitEthernet0/0/0]mpls te
   [LSR3-GigabitEthernet0/0/0]mpls rsvp-te
   [LSR3-GigabitEthernet0/0/1]mpls
   [LSR3-GigabitEthernet0/0/1]mpls te
   [LSR3-GigabitEthernet0/0/1]mpls rsvp-te
   [LSR3-GigabitEthernet0/0/2]mpls
   [LSR3-GigabitEthernet0/0/2]mpls te
   [LSR3-GigabitEthernet0/0/2]mpls rsvp-te
   [LSR3]isis
   [LSR3-isis-1]cost-style wide
   [LSR3-isis-1]traffic-eng level-2
   [LSR4]mpls lsr-id 4.4.4.4
   [LSR4]mpls
   [LSR4-mpls]mpls te
   [LSR4-mpls]mpls rsvp-te
   [LSR4-GigabitEthernet0/0/0]mpls
   [LSR4-GigabitEthernet0/0/0]mpls te
   [LSR4-GigabitEthernet0/0/0]mpls rsvp-te
   [LSR4]isis
   [LSR4-isis-1]cost-style wide
   [LSR4-isis-1]traffic-eng level-2
   [LSR5]mpls lsr-id 5.5.5.5
   [LSR5]mpls
   [LSR5-mpls]mpls te
   [LSR5-mpls]mpls rsvp-te
   [LSR5-GigabitEthernet0/0/0]mpls
   [LSR5-GigabitEthernet0/0/0]mpls te
   [LSR5-GigabitEthernet0/0/0]mpls rsvp-te
   [LSR5-GigabitEthernet0/0/1]mpls
   [LSR5-GigabitEthernet0/0/1]mpls te
   [LSR5-GigabitEthernet0/0/1]mpls rsvp-te
   [LSR5]isis
   [LSR5-isis-1]cost-style wide
   [LSR5-isis-1]traffic-eng level-2

4. 在入节点LSRA上创建主CR-LSP的MPLS TE Tunnel
   [LSR1]explicit-path pp1 //配置主CR-LSP的显式路径
   [LSR1-explicit-path-pp1]next hop 20.1.1.2
   [LSR1-explicit-path-pp1]next hop 20.1.2.3
   [LSR1-explicit-path-pp1]next hop 20.1.3.4
   [LSR1-explicit-path-pp1]next hop 4.4.4.4
   [LSR1]int Tunnel 0/0/1 //配置主CR-LSP的MPLS TE隧道接口
   [LSR1-Tunnel0/0/1]ip add unnumbered interface LoopBack 0
   [LSR1-Tunnel0/0/1]tunnel-protocol mpls te
   [LSR1-Tunnel0/0/1]destination 4.4.4.4
   [LSR1-Tunnel0/0/1]mpls te tunnel-id 100
   [LSR1-Tunnel0/0/1]mpls te path explicit-path pp1
   [LSR1-Tunnel0/0/1]mpls te fast-reroute //使能TE FRR
   [LSR1-Tunnel0/0/1]mpls te commit
   

5. 在作为PLR的LSR2上配置Bypass CR-LSP
   [LSR2]explicit-path bp1 //配置Bypass CR-LSP的显式路径
   [LSR2-explicit-path-bp1]next hop 20.1.4.5
   [LSR2-explicit-path-bp1]next hop 20.1.5.3
   [LSR2-explicit-path-bp1]next hop 3.3.3.3
   [LSR2]int Tunnel 0/0/2 //配置Bypass CR-LSP的隧道接口
   [LSR2-Tunnel0/0/2]ip address unnumbered interface LoopBack 0
   [LSR2-Tunnel0/0/2]tunnel-protocol mpls te
   [LSR2-Tunnel0/0/2]destination 3.3.3.3
   [LSR2-Tunnel0/0/2]mpls te tunnel-id 101
   [LSR2-Tunnel0/0/2]mpls te path explicit-path bp1
   [LSR2-Tunnel0/0/2]mpls te record-route
   [LSR2-Tunnel0/0/2]mpls te bypass-tunnel
   [LSR2-Tunnel0/0/2]mpls te protected-interface g0/0/1 //将Bypass CR-LSP绑定到被保护的接口
   [LSR2-Tunnel0/0/2]mpls te commit

6. 在LSR2与LSR3上配置RSVP认证功能
   [LSR2]mpls rsvp-te peer 3.3.3.3
   [LSR2-mpls-rsvp-te-peer-3.3.3.3]mpls rsvp-te authentication cipher abc&＃64;1234
   [LSR2-mpls-rsvp-te-peer-3.3.3.3]mpls rsvp-te authentication handshake abc&＃64;1234
   [LSR3]mpls
   [LSR3-mpls]mpls te cspf
   [LSR3]mpls rsvp-te peer 2.2.2.2
   [LSR3-mpls-rsvp-te-peer-2.2.2.2]mpls rsvp-te authentication cipher abc&＃64;1234
   [LSR3-mpls-rsvp-te-peer-2.2.2.2]mpls rsvp-te authentication handshake abc&＃64;1234

7. 检查配置
   

通过字段SendChallengeMsgCounter、RecChallengeMsgCounter、SendResponseMsgCounter和RecResponseMsgCounter的值不为零&＃xff0c;可以证明PLR与MP之间实现了成功握手

[LSR2-GigabitEthernet0/0/1]shutdown //使LSR2上被保护的出接口失效

由此可以确认链路已切换到Bypass CR-LSP

可以看到旁路隧道被使用

LSR2的邻居3.3.3.3上的RSB数量不为零&＃xff0c;说明LSRB和邻居LSR3之间RSVP密钥认证通过&＃xff0c;资源预留成功