用于设置和管理路由的路由器配置示例Router configuration samples to set up and manage routing

本页提供处理 Azure ExpressRoute 时适用于 Cisco IOS-XE 和 Juniper MX 系列路由器的接口与路由配置示例。This page provides interface and routing configuration samples for Cisco IOS-XE and Juniper MX series routers when you're working with Azure ExpressRoute.

重要

本页中的示例仅供指导。Samples on this page are purely for guidance. 必须与供应商的销售/技术团队和网络团队合作,以便找到符合需要的适当配置。You must work with your vendor's sales/technical team and your networking team to find appropriate configurations to meet your needs. 对于本页中所列配置的相关问题,Microsoft 将不提供支持。Microsoft won't support issues related to configurations listed in this page. 有关支持问题,请与设备供应商联系。Contact your device vendor for support issues.

路由器接口上的 MTU 和 TCP MSS 设置MTU and TCP MSS settings on router interfaces

ExpressRoute 接口的最大传输单元 (MTU) 为 1500,即路由器上以太网接口的典型默认 MTU。The maximum transmission unit (MTU) for the ExpressRoute interface is 1500, which is the typical default MTU for an Ethernet interface on a router. 默认情况下,除非路由器具有不同 MTU,否则无需在路由器接口上指定值。Unless your router has a different MTU by default, there is no need to specify a value on the router interface.

与 Azure VPN 网关不同,不需要为 ExpressRoute 线路指定 TCP 最大段大小 (MSS)。Unlike an Azure VPN gateway, the TCP maximum segment size (MSS) for an ExpressRoute circuit does not need to be specified.

本文中的路由器配置示例适用于所有对等互连。The router configuration samples in this article apply to all peerings. 有关路由的更多详细信息,请查看 ExpressRoute 对等互连ExpressRoute 路由要求Review ExpressRoute peerings and ExpressRoute routing requirements for more details on routing.

基于 Cisco IOS-XE 的路由器Cisco IOS-XE based routers

本部分中的示例适用于任何运行 IOS-XE OS 系列的路由器。The samples in this section apply to any router running the IOS-XE OS family.

配置接口和子接口Configure interfaces and subinterfaces

在连接到 Microsoft 的每个路由器中,每个对等互连都需要一个子接口。You'll need one subinterface per peering in every router that you connect to Microsoft. 子接口可使用 VLAN ID 或一对堆叠的 VLAN ID 和 IP 地址来标识。A subinterface can be identified with a VLAN ID or a stacked pair of VLAN IDs and an IP address.

Dot1Q 接口定义Dot1Q interface definition

本示例针对包含单个 VLAN ID 的子接口提供子接口定义。This sample provides the subinterface definition for a subinterface with a single VLAN ID. 在每个对等互连中,VLAN ID 是唯一的。The VLAN ID is unique per peering. IPv4 地址的最后一个八位字节将始终是奇数。The last octet of your IPv4 address will always be an odd number.

interface GigabitEthernet<Interface_Number>.<Number>
 encapsulation dot1Q <VLAN_ID>
 ip address <IPv4_Address><Subnet_Mask>

QinQ 接口定义QinQ interface definition

本示例针对包含两个 VLAN ID 的子接口提供子接口定义。This sample provides the subinterface definition for a subinterface with two VLAN IDs. 外部 VLAN ID (s-tag)(如果使用)在所有对等互连中保持不变。The outer VLAN ID (s-tag), if used, remains the same across all peerings. 在每个对等互连中,内部 VLAN ID (c-tag) 是唯一的。The inner VLAN ID (c-tag) is unique per peering. IPv4 地址的最后一个八位字节将始终是奇数。The last octet of your IPv4 address will always be an odd number.

interface GigabitEthernet<Interface_Number>.<Number>
 encapsulation dot1Q <s-tag> seconddot1Q <c-tag>
 ip address <IPv4_Address><Subnet_Mask>

设置 eBGP 会话Set up eBGP sessions

必须针对每个对等互连设置与 Microsoft 的 BGP 会话。You must set up a BGP session with Microsoft for every peering. 使用以下示例设置 BGP 会话。Set up a BGP session by using the following sample. 如果对子接口使用的 IPv4 地址是 a.b.c.d,则 BGP 邻居 (Microsoft) 的 IP 地址将是 a.b.c.d+1。If the IPv4 address that you used for your subinterface was a.b.c.d, then the IP address of the BGP neighbor (Microsoft) will be a.b.c.d+1. BGP 邻居的 IPv4 地址的最后一个八位字节将始终是偶数。The last octet of the BGP neighbor's IPv4 address will always be an even number.

router bgp <Customer_ASN>
 bgp log-neighbor-changes
 neighbor <IP#2_used_by_Azure> remote-as 12076
 !
 address-family ipv4
 neighbor <IP#2_used_by_Azure> activate
 exit-address-family
!

设置要通过 BGP 会话播发的前缀Set up prefixes to be advertised over the BGP session

使用以下示例,将路由器配置为将所选前缀播发给 Microsoft。Configure your router to advertise select prefixes to Microsoft by using the following sample.

router bgp <Customer_ASN>
 bgp log-neighbor-changes
 neighbor <IP#2_used_by_Azure> remote-as 12076
 !
 address-family ipv4
  network <Prefix_to_be_advertised> mask <Subnet_mask>
  neighbor <IP#2_used_by_Azure> activate
 exit-address-family
!

路由映射Route maps

使用路由映射和前缀列表来筛选已传播到网络中的前缀。Use route maps and prefix lists to filter prefixes propagated into your network. 请参阅下面的示例,并确保已设置适当的前缀列表。See the following sample, and ensure that you have the appropriate prefix lists set up.

router bgp <Customer_ASN>
 bgp log-neighbor-changes
 neighbor <IP#2_used_by_Azure> remote-as 12076
 !
 address-family ipv4
  network <Prefix_to_be_advertised> mask <Subnet_mask>
  neighbor <IP#2_used_by_Azure> activate
  neighbor <IP#2_used_by_Azure> route-map <MS_Prefixes_Inbound> in
 exit-address-family
!
route-map <MS_Prefixes_Inbound> permit 10
 match ip address prefix-list <MS_Prefixes>
!

配置 BFDConfigure BFD

将在两个位置配置 BFD:一个在接口级别配置,另一个在 BGP 级别配置。You'll configure BFD in two places: one at the interface level and another at BGP level. 此处的示例适用于 QinQ 接口。The example here is for the QinQ interface.

interface GigabitEthernet<Interface_Number>.<Number>
 bfd interval 300 min_rx 300 multiplier 3
 encapsulation dot1Q <s-tag> seconddot1Q <c-tag>
 ip address <IPv4_Address><Subnet_Mask>

router bgp <Customer_ASN>
 bgp log-neighbor-changes
 neighbor <IP#2_used_by_Azure> remote-as 12076
 !
 address-family ipv4
  neighbor <IP#2_used_by_Azure> activate
  neighbor <IP#2_used_by_Azure> fall-over bfd
 exit-address-family
!

Juniper MX 系列路由器Juniper MX series routers

本部分中的示例适用于所有 Juniper MX 系列路由器。The samples in this section apply to any Juniper MX series router.

配置接口和子接口Configure interfaces and subinterfaces

Dot1Q 接口定义Dot1Q interface definition

本示例针对包含单个 VLAN ID 的子接口提供子接口定义。This sample provides the subinterface definition for a subinterface with a single VLAN ID. 在每个对等互连中,VLAN ID 是唯一的。The VLAN ID is unique per peering. IPv4 地址的最后一个八位字节将始终是奇数。The last octet of your IPv4 address will always be an odd number.

    interfaces {
        vlan-tagging;
        <Interface_Number> {
            unit <Number> {
                vlan-id <VLAN_ID>;
                family inet {
                    address <IPv4_Address/Subnet_Mask>;
                }
            }
        }
    }

QinQ 接口定义QinQ interface definition

本示例针对包含两个 VLAN ID 的子接口提供子接口定义。This sample provides the subinterface definition for a subinterface with two VLAN IDs. 外部 VLAN ID (s-tag)(如果使用)在所有对等互连中保持不变。The outer VLAN ID (s-tag), if used, remains the same across all peerings. 在每个对等互连中,内部 VLAN ID (c-tag) 是唯一的。The inner VLAN ID (c-tag) is unique per peering. IPv4 地址的最后一个八位字节将始终是奇数。The last octet of your IPv4 address will always be an odd number.

    interfaces {
        <Interface_Number> {
            flexible-vlan-tagging;
            unit <Number> {
                vlan-tags outer <S-tag> inner <C-tag>;
                family inet {
                    address <IPv4_Address/Subnet_Mask>;
                }                           
            }                               
        }                                   
    }                           

设置 eBGP 会话Set up eBGP sessions

必须针对每个对等互连设置与 Microsoft 的 BGP 会话。You must set up a BGP session with Microsoft for every peering. 使用以下示例设置 BGP 会话。Set up a BGP session by using the following sample. 如果对子接口使用的 IPv4 地址是 a.b.c.d,则 BGP 邻居 (Microsoft) 的 IP 地址将是 a.b.c.d+1。If the IPv4 address that you used for your subinterface was a.b.c.d, then the IP address of the BGP neighbor (Microsoft) will be a.b.c.d+1. BGP 邻居的 IPv4 地址的最后一个八位字节将始终是偶数。The last octet of the BGP neighbor's IPv4 address will always be an even number.

    routing-options {
        autonomous-system <Customer_ASN>;
    }
    }
    protocols {
        bgp { 
            group <Group_Name> { 
                peer-as 12076;              
                neighbor <IP#2_used_by_Azure>;
            }                               
        }                                   
    }

设置要通过 BGP 会话播发的前缀Set up prefixes to be advertised over the BGP session

使用以下示例,将路由器配置为将所选前缀播发给 Microsoft。Configure your router to advertise select prefixes to Microsoft by using the following sample.

    policy-options {
        policy-statement <Policy_Name> {
            term 1 {
                from protocol OSPF;
                route-filter; 
                <Prefix_to_be_advertised/Subnet_Mask> exact;
                then {
                    accept;
                }
            }
        }
    }
    protocols {
        bgp { 
            group <Group_Name> { 
                export <Policy_Name>;
                peer-as 12076;              
                neighbor <IP#2_used_by_Azure>;
            }                               
        }                                   
    }

路由策略Route policies

可以使用路由映射和前缀列表来筛选已传播到网络中的前缀。You can use route maps and prefix lists to filter prefixes propagated into your network. 请参阅下面的示例,并确保已设置适当的前缀列表。See the following sample, and ensure you have the appropriate prefix lists set up.

    policy-options {
        prefix-list MS_Prefixes {
            <IP_Prefix_1/Subnet_Mask>;
            <IP_Prefix_2/Subnet_Mask>;
        }
        policy-statement <MS_Prefixes_Inbound> {
            term 1 {
                from {
        prefix-list MS_Prefixes;
                }
                then {
                    accept;
                }
            }
        }
    }
    protocols {
        bgp { 
            group <Group_Name> { 
                export <Policy_Name>;
                import <MS_Prefixes_Inbound>;
                peer-as 12076;              
                neighbor <IP#2_used_by_Azure>;
            }                               
        }                                   
    }

配置 BFDConfigure BFD

仅在协议 BGP 部分下配置 BFD。Configure BFD under the protocol BGP section only.

    protocols {
        bgp { 
            group <Group_Name> { 
                peer-as 12076;              
                neighbor <IP#2_used_by_Azure>;
                bfd-liveness-detection {
                       minimum-interval 3000;
                       multiplier 3;
                }
            }                               
        }                                   
    }

配置 MACSecConfigure MACSec

对于 MACSec 配置,连接关联密钥 (CAK) 和连接关联密钥名称 (CKN) 必须通过 PowerShell 命令与已配置的值进行匹配。For MACSec configuration, Connectivity Association Key (CAK) and Connectivity Association Key Name (CKN) must match with configured values via PowerShell commands.

    security {
        macsec {
            connectivity-association <Connectivity_Association_Name> {
                cipher-suite gcm-aes-xpn-128;
                security-mode static-cak;
                pre-shared-key {
                    ckn <Connectivity_Association_Key_Name>;
                    cak <Connectivity_Association_Key>; ## SECRET-DATA
                }
            }
            interfaces {
                <Interface_Number> {
                    connectivity-association <Connectivity_Association_Name>;
                }
            }
        }
    }

后续步骤Next steps

有关详细信息,请参阅 ExpressRoute 常见问题See the ExpressRoute FAQ for more details.