{"id":73232,"date":"2020-03-08T08:42:18","date_gmt":"2020-03-08T05:42:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/vxlan-v-nsx-v-trablshutim-underlay"},"modified":"2020-03-08T08:42:18","modified_gmt":"2020-03-08T05:42:18","slug":"vxlan-v-nsx-v-trablshutim-underlay","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/vxlan-v-nsx-v-trablshutim-underlay","title":{"rendered":"VXLAN v NSX-V \u2013 \u0159e\u0161\u00edme probl\u00e9my s underlay","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u00edtejte, nejprve trochu lyriky. N\u011bkdy z\u00e1vid\u00edm koleg\u016fm, kte\u0159\u00ed pracuj\u00ed na d\u00e1lku \u2013 je to skv\u011bl\u00e9 m\u00edt mo\u017enost pracovat z jak\u00e9hokoli m\u00edsta p\u0159ipojen\u00e9ho k Internetu, dovolenou kdykoli, odpov\u011bdnost za projekty a term\u00edny, a ne b\u00fdt v kancel\u00e1\u0159i od 8 do 17. Moje pozice a pracovn\u00ed povinnosti prakticky vylu\u010duj\u00ed mo\u017enost dlouh\u00e9ho pobytu mimo datov\u00e9 centrum. Nicm\u00e9n\u011b \u2013 ob\u010das se vyskytuj\u00ed zaj\u00edmav\u00e9 p\u0159\u00edpady, jak je pops\u00e1no n\u00ed\u017ee \u2013 a ch\u00e1pu, \u017ee existuje m\u00e1lo pozic, kde je takov\u00fd prostor pro kreativn\u00ed vyj\u00e1d\u0159en\u00ed vnit\u0159n\u00edho troubleshooteru.
\n<\/a><\/noindex>
\nMal\u00fd disclaimer \u2014 v dob\u011b psan\u00ed \u010dl\u00e1nku nen\u00ed p\u0159\u00edpad zcela vy\u0159e\u0161en, ale vzhledem k rychlosti odpov\u011bdi dodavatel\u016f m\u016f\u017ee \u00fapln\u00e9 \u0159e\u0161en\u00ed trvat je\u0161t\u011b m\u011bs\u00edce, a r\u00e1d bych se nyn\u00ed pod\u011blil o sv\u00e9 poznatky. Douf\u00e1m, v\u00e1\u017een\u00ed \u010dten\u00e1\u0159i, \u017ee mi tuto usp\u011bchanost odpust\u00edte. Ale dost bylo \u0159e\u010d\u00ed \u2014 co se d\u011bje s p\u0159\u00edpadem? <\/p>\n

Nejprve \u00favod: je zde firma (kde pracuji jako s\u00ed\u0165ov\u00fd in\u017een\u00fdr), kter\u00e1 host\u00ed klientsk\u00e9 \u0159e\u0161en\u00ed v priv\u00e1tn\u00edm cloudu VMWare. V\u011bt\u0161ina nov\u00fdch \u0159e\u0161en\u00ed se p\u0159ipojuje k VXLAN segment\u016fm, kter\u00e9 jsou \u0159\u00edzeny NSX-V \u2014 nebudu hodnotit, kolik \u010dasu mi toto \u0159e\u0161en\u00ed u\u0161et\u0159ilo, stru\u010dn\u011b \u0159e\u010deno \u2014 hodn\u011b. Dokonce jsem se poda\u0159ilo nau\u010dit kolegy konfiguraci NSX ESG a mal\u00e1 klientsk\u00e1 \u0159e\u0161en\u00ed se nasazuj\u00ed bez m\u00e9ho z\u00e1sahu. D\u016fle\u017eit\u00e1 pozn\u00e1mka \u2014 n\u00e1\u0161 control plane pou\u017e\u00edv\u00e1 unicast replikaci. Hypervizory jsou redundantn\u011b p\u0159ipojen\u00e9 dv\u011bma rozhran\u00edmi k r\u016fzn\u00fdm fyzick\u00fdm switch\u016fm Juniper QFX5100 (sestaven\u00fdm ve Virtual Chassis) a politikou timingu route based on originating virtual port \u2014 to pro \u00faplnost obrazu.<\/p>\n

Klientsk\u00e1 \u0159e\u0161en\u00ed jsou velmi rozmanit\u00e1: od Windows IIS, kde jsou v\u0161echny komponenty webov\u00e9ho serveru nainstalov\u00e1ny na jednom stroji, a\u017e po celkem velk\u00e9 \u0159e\u0161en\u00ed \u2014 nap\u0159\u00edklad load-balanced Apache webov\u00e9 fronty + LB MariaDB v Galera + sd\u00edlen\u00e9 servery synchronizovan\u00e9 pomoc\u00ed GlusterFS. Prakticky ka\u017ed\u00fd server je t\u0159eba monitorovat samostatn\u011b a ve\u0159ejn\u00e9 adresy nemaj\u00ed v\u0161echny komponenty \u2014 pokud jste se s t\u00edmto \u00faskal\u00edm setkali a m\u00e1te elegantn\u011bj\u0161\u00ed \u0159e\u0161en\u00ed, budu vd\u011b\u010dn\u00fd za radu.
\nMoje \u0159e\u0161en\u00ed monitorov\u00e1n\u00ed spo\u010d\u00edv\u00e1 v \u201ep\u0159ipojen\u00ed\u201c firewallu (Fortigate) k ka\u017ed\u00e9 intern\u00ed klientsk\u00e9 s\u00edti (+SNAT a samoz\u0159ejm\u011b p\u0159\u00edsn\u00e9 omezen\u00ed typu povolen\u00e9ho provozu) a sledov\u00e1n\u00ed intern\u00edch adres \u2013 t\u00edmto zp\u016fsobem doch\u00e1z\u00ed k ur\u010dit\u00e9 unifikaci a zjednodu\u0161en\u00ed monitorov\u00e1n\u00ed. Samotn\u00e9 monitorov\u00e1n\u00ed prob\u00edh\u00e1 z clusteru server\u016f PRTG. Sch\u00e9ma monitorov\u00e1n\u00ed vypad\u00e1 zhruba takto:<\/p>\n

\"VXLAN
\n
\nPokud jsme operovali pouze s VLAN, v\u0161e bylo docela obvykl\u00e9 a p\u0159edv\u00eddateln\u00e9, fungovalo to jako hodinky. Po zaveden\u00ed NSX-V a VXLAN jsme \u010delili ot\u00e1zce \u2013 zda je mo\u017en\u00e9 nad\u00e1le monitorovat star\u00fdm zp\u016fsobem? V dob\u011b t\u00e9to ot\u00e1zky bylo nejrychlej\u0161\u00edm \u0159e\u0161en\u00edm nasadit NSX ESG a p\u0159ipojit VXLAN trunk-interface do VTEP s\u00edt\u011b. Rychl\u00fdm v uvozovk\u00e1ch \u2013 proto\u017ee pou\u017eit\u00ed GUI pro konfiguraci klientsk\u00fdch s\u00edt\u00ed, SNAT a pravidel firewallu m\u016f\u017ee unifikovat spr\u00e1vu v jednom rozhran\u00ed vSphere, ale podle m\u00e9ho n\u00e1zoru je to docela neohraban\u00e9 a krom\u011b toho omezuje sadu n\u00e1stroj\u016f pro odstra\u0148ov\u00e1n\u00ed probl\u00e9m\u016f. Ti, kte\u0159\u00ed pou\u017e\u00edvali NSX ESG jako n\u00e1hradu za \u201eskute\u010dn\u00fd\u201c firewall, si mysl\u00edm, \u017ee souhlas\u00ed. A\u010dkoli, pravd\u011bpodobn\u011b by takov\u00e9 \u0159e\u0161en\u00ed bylo stabiln\u011bj\u0161\u00ed \u2013 v\u017edy\u0165 se v\u0161e odehr\u00e1v\u00e1 v r\u00e1mci jednoho dodavatele.<\/p>\n

Dal\u0161\u00ed \u0159e\u0161en\u00ed je pou\u017e\u00edt NSX DLR v re\u017eimu mostu mezi VLAN a VXLAN. Tady je to mysl\u00edm jasn\u00e9 \u2014 prost\u011b se ztr\u00e1c\u00ed v\u00fdhoda pou\u017eit\u00ed VXLAN \u2014 proto\u017ee v tomto p\u0159\u00edpad\u011b je stejn\u011b nutn\u00e9 pokl\u00e1dat VLAN k monitorovac\u00ed instalaci. Mimochodem, p\u0159i pr\u00e1ci na tomto \u0159e\u0161en\u00ed jsem narazil na probl\u00e9m, kdy DLR-most nepos\u00edlal pakety virtu\u00e1lce, se kterou byl na jednom hostiteli. V\u00edm, v\u00edm \u2014 v knih\u00e1ch a pr\u016fvodc\u00edch o NSX-V se jasn\u011b \u0159\u00edk\u00e1, \u017ee pro NSX Edge mus\u00ed b\u00fdt vyhrazen\u00fd samostatn\u00fd cluster, ale to jsou jen knihy... Tak \u010di onak, po n\u011bkolika m\u011bs\u00edc\u00edch se z\u00e1kaznick\u00fdm supportem jsme probl\u00e9m nevy\u0159e\u0161ili. V z\u00e1sad\u011b jsem pochopil logiku fungov\u00e1n\u00ed \u2014 modul j\u00e1dra hypervizoru, odpov\u011bdn\u00fd za enkapsulaci VXLAN, se nezapojil, pokud DLR a sledovan\u00fd server byly na jednom hostiteli, proto\u017ee provoz neopou\u0161t\u00ed hostitele a logicky by m\u011bl b\u00fdt p\u0159ipojen k VXLAN segmentu \u2014 enkapsulace nen\u00ed pot\u0159eba. Se supportem jsme se zastavili u virtu\u00e1ln\u00edho rozhran\u00ed vdrPort, kter\u00e9 logicky spojuje uplinky a tak\u00e9 prov\u00e1d\u00ed mostov\u00e1n\u00ed\/enkapsulaci \u2014 tam byla zaznamen\u00e1na nesrovnalost ve vstupn\u00edm provozu, kterou jsem vzal na zpracov\u00e1n\u00ed v aktu\u00e1ln\u00edm p\u0159\u00edpad\u011b. Ale jak bylo \u0159e\u010deno, nedovedl jsem tento p\u0159\u00edpad do konce, proto\u017ee jsem byl p\u0159e\u0159azen na jin\u00fd projekt a tato cesta byla od za\u010d\u00e1tku slep\u00e1 a nem\u011bl jsem zvl\u00e1\u0161tn\u00ed chu\u0165 jej rozv\u00edjet. Pokud se nem\u00fdl\u00edm, probl\u00e9m se pozoroval ve verz\u00edch NSX 6.1.4 a 6.2. <\/p>\n

A tady \u2014 bingo! Fortinet oznamuje nativn\u00ed podporu VXLAN<\/a><\/noindex>. A ne jen point-to-point nebo VXLAN-over-IPSec, ne softwarov\u00e9 mostov\u00e1n\u00ed VLAN-VXLAN \u2014 to v\u0161e za\u010dali implementovat ji\u017e od verze 5.4 (a je to prezentov\u00e1no u jin\u00fdch dodavatel\u016f<\/a><\/noindex>), a skute\u010dnou podporu unicast control plane. P\u0159i zav\u00e1d\u011bn\u00ed \u0159e\u0161en\u00ed jsem narazil na dal\u0161\u00ed probl\u00e9m \u2013 kontrolovan\u00e9 servery ob\u010das \"mizely\" a pak se objevovaly v monitoringu, a\u010dkoliv samotn\u00e1 virtu\u00e1lka byla \u017eiv\u00e1. D\u016fvodem, jak se uk\u00e1zalo, bylo to, \u017ee jsem zapomn\u011bl povolit Ping na VXLAN rozhran\u00ed. V procesu rebalance klastr\u016f se virtu\u00e1lky p\u0159esouvaly a Ping kon\u010dil vMotionem, aby ozna\u010dil nov\u00fd ESXI host, na kter\u00fd byla ma\u0161ina p\u0159esunuta. Byla to moje chyba, ale tento probl\u00e9m op\u011bt podkopal d\u016fv\u011bru v podporu v\u00fdrobce \u2013 v tomto p\u0159\u00edpad\u011b Fortinet. Ani nemluv\u00edm o tom, \u017ee ka\u017ed\u00fd p\u0159\u00edpad t\u00fdkaj\u00edc\u00ed se VXLAN za\u010d\u00edn\u00e1 ot\u00e1zkou \u201ea kde m\u00e1te ve sv\u00fdch nastaven\u00edch softswitch VLAN-VXLAN?\u201c Tentokr\u00e1t mi doporu\u010dili zm\u011bnit MTU \u2013 to je pro Ping, kter\u00fd m\u00e1 32 bajt\u016f. Pak si \u201epohr\u00e1vej\u201c s tcp-send-mss a tcp-receive-mss v politice \u2013 pro VXLAN, kter\u00fd je encapsulov\u00e1n do UDP. Uf, promi\u0148te \u2013 to ve mn\u011b v\u0159elo. Ka\u017edop\u00e1dn\u011b jsem tento probl\u00e9m vy\u0159e\u0161il vlastn\u00edmi silami. <\/p>\n

\u00dasp\u011b\u0161n\u011b otestov\u00e1n\u00ed testovac\u00edho provozu, rozhodli jsme se implementovat toto \u0159e\u0161en\u00ed. A v produkci se uk\u00e1zalo, \u017ee po dni nebo dvou postupn\u011b odpad\u00e1 v\u0161echno, co se monitoruje p\u0159es VXLAN. Deaktivace\/aktivace rozhran\u00ed pomohla, ale jen na chv\u00edli. Vzhledem k pomalosti podpory v\u00fdrobce jsem se za\u010dal v\u011bnovat troubleshooting sv\u00e9 strany \u2013 koneckonc\u016f moje spole\u010dnost, moje s\u00ed\u0165 \u2013 moje zodpov\u011bdnost. <\/p>\n

Pod spoilerem b\u011bh troubleshootingu. Kdo m\u00e1 dost p\u00edsmen a chluben\u00ed \u2013 p\u0159esko\u010dte a p\u0159ejd\u011bte k postanalyzov\u00e1n\u00ed.<\/p>\n

B\u011bh troubleshootingu<\/b>D\u011bkuji, \u017ee jste pokra\u010dovali ve \u010dten\u00ed \u2013 pokra\u010dujeme!<\/p>\n

Tak\u017ee, monitorov\u00e1n\u00ed funguje n\u011bjakou dobu, pak se samo odpoj\u00ed. To znamen\u00e1, \u017ee v pravidlech firewallu pravd\u011bpodobn\u011b nejsou \u017e\u00e1dn\u00e9 probl\u00e9my. Nicm\u00e9n\u011b, proto\u017ee jsem se setkal s probl\u00e9mem vis\u00edc\u00edch syst\u00e9mov\u00fdch proces\u016f ve Fortigate verz\u00edch 5.6+, tak\u017ee nejprve se pod\u00edv\u00e1me na \u201ediagnose debug flow\u201c \u2013 o\u010dek\u00e1van\u011b se provoz povoluje a odch\u00e1z\u00ed z rozhran\u00ed a o\u010dek\u00e1van\u011b nic nep\u0159ich\u00e1z\u00ed zp\u011bt. To znamen\u00e1, \u017ee budeme kopat d\u00e1l po stacku. Budeme bohu\u017eel muset skr\u00fdt adresy, a\u0165 u\u017e jsou RFC1918 nebo ne, ale douf\u00e1m, \u017ee proces obohat\u00edm dostate\u010dn\u00fdm popisem pro pochopen\u00ed. Server uvnit\u0159 VXLAN m\u00e1 adresu x.x.x.15, rozhran\u00ed Fortigate x.x.x.254, v\u0161echny ostatn\u00ed adresy spadaj\u00ed do s\u00edt\u011b VTEP.<\/p>\n

Pro \u00fasp\u011b\u0161n\u00fd p\u0159enos VXLAN inkapsulovan\u00fdch paket\u016f je t\u0159eba m\u00edt spr\u00e1vn\u00e9 informace v n\u011bkolika tabulk\u00e1ch. Pro overlay to jsou ARP a OVSDB, pro underlay ARP a CAM. V p\u0159\u00edpad\u011b Fortigate je VXLAN FDB a OVSDB. Tam za\u010dneme:<\/p>\n

 fortigate (root) #diag sys vxlan fdb list vxlan-LS\nmac=00:50:56:8f:3f:5a state=0x0002 flags=0x00 remote_ip=u.u.u.47 port=4789 vni=5008 ifindex=7\n<\/code><\/pre>\n
\nTady je to docela jednoduch\u00e9 \u2014 MAC adresa virtu\u00e1ln\u00edho stroje by m\u011bla b\u00fdt na VTEP s adresou u.u.u.47. Po prozkoum\u00e1n\u00ed obsahu a nastaven\u00ed ESXI clusteru zji\u0161\u0165uji, \u017ee MAC virtu\u00e1ln\u00edho stroje je spr\u00e1vn\u00e1, adresa VTEP tak\u00e9. Kontroluji CAM\/ARP tabulku na Fortigate \u2014 znovu v\u0161e odpov\u00edd\u00e1 nastaven\u00ed ESXI hostitele:<\/p>\n
fortigate (root) #get sys arp | grep u.u.u.47\nu.u.u.47 0 00:50:56:65:f6:2c dmz\n<\/code><\/pre>\n
\nTabulky jsou spr\u00e1vn\u00e9 a traffic odch\u00e1z\u00ed \u2013 mo\u017en\u00e1 probl\u00e9m nen\u00ed na fortigate? Z\u00e1m\u011brn\u011b jsem vynechal anal\u00fdzu p\u0159ep\u00edn\u00e1n\u00ed trafficu na Juniperu \u2013 logicky by se to m\u011blo uskute\u010dnit na n\u011bm, ale s\u00ed\u0165 m\u00e1m jednoduchou \u2013 jen jeden VLAN pro VTEP a v\u0161echny komponenty jsou p\u0159ipojeny p\u0159\u00edmo. Nav\u00edc vzpom\u00edn\u00e1m na p\u0159\u00edpad s DLR-bridgem, VDR a miz\u00edc\u00edm traffickem \u2013 jdu sniffit na ESXI host, mezit\u00edm vytv\u00e1\u0159\u00edm p\u0159\u00edpad u\u017e k VMWare. N\u00ed\u017ee MAC \u201e97:6e\u201c pat\u0159\u00ed fortimu, vmnic1 \u2013 to je rozhran\u00ed, kter\u00e9 m\u00e1 VTEP s adresou u.u.u.47, sniff\u00edme v obou sm\u011brech \"\u2014dir 2\":<\/p>\n
pktcap-uw --uplink vmnic1 --vni 5008  --mac 90:6c:ac:a9:97:6e --dir 2 -o \/tmp\/monitor.pcap\n<\/code><\/pre>\n
\n\"VXLAN
\n
\nPokrok \u2014 ve sniffu vid\u00edm ARP po\u017eadavek a p\u0159ich\u00e1zej\u00edc\u00ed odpov\u011b\u010f. P\u0159in\u00e1\u0161\u00edm pouze ARP odpov\u011b\u010f a v\u0161e je spr\u00e1vn\u011b. Zm\u00ednil jsem, \u017ee server monitorov\u00e1n\u00ed po celou dobu pingoval adresu x.x.x.15 \u2014 kde je ICMP provoz? Vzpom\u00edn\u00e1m, \u017ee m\u00e1m dv\u011b uplinky. Tady bych mohl diskutovat a \u0159\u00edci, \u017ee virtu\u00e1ln\u00ed port zdroje je stejn\u00fd (m\u00e1 politika spojen\u00ed), tedy pro stejnou vNIC by m\u011bl b\u00fdt vybr\u00e1n stejn\u00fd uplink, ale kdy\u017e jsem na hostiteli, zkontrolovat jin\u00fd uplink nen\u00ed probl\u00e9m:<\/p>\n
pktcap-uw --uplink vmnic4 --vni 5008  --mac 90:6c:ac:a9:97:6e --dir 2 -o \/tmp\/monitor.pcap\n<\/code><\/pre>\n
\n\"VXLAN
\n
\nP\u0159ich\u00e1zej\u00ed po\u017eadavky z FortiGate, ale odpov\u011b\u010f nikde. To znamen\u00e1, \u017ee probl\u00e9m nen\u00ed ve FortiGate. No, mysl\u00edm si, \u017ee op\u011bt stejn\u00fd probl\u00e9m s miz\u00edc\u00edm provozem na VDR, znovu sm\u011brovat p\u0159\u00edpad na spr\u00e1vn\u00e9 m\u00edsto po dobu n\u011bkolika m\u011bs\u00edc\u016f. Po p\u00e1r dnech, kdy\u017e jsem zchladl a necht\u011bl se sm\u00ed\u0159it s visen\u00edm, jsem se rozhodl znovu posb\u00edrat sniffy pro support, abych urychlil proces. A tu \"n\u00e1hodou\" padl m\u016fj pohled na Ethernetovou enkapsulaci underlay. Kr\u00e1l nen\u00ed opravdov\u00fd a MAC adresa VTEP neodpov\u00edd\u00e1 jeho IP. Resetuji na nulu, sniffuji, kop\u00e1m - je to tak, jak to m\u011blo b\u00fdt. P\u0159ipoj\u00edm ARP tabulku vedle, aby bylo snaz\u0161\u00ed srovn\u00e1vat. V\u0161imn\u011bte si prvn\u00ed Ethernetov\u00e9 enkapsulace na obr\u00e1zku naho\u0159e:<\/p>\n
fortigate (root) #get sys arp | grep x.x.x.47\nx.x.x.47 0 00:50:56:65:f6:2c dmz\nfortigate (root) #get sys arp | grep x.x.x.42\nx.x.x.42 0 00:50:56:6a:78:86 dmz\n<\/code><\/pre>\n
\nTak\u017ee co m\u00e1me na z\u00e1v\u011br - po migraci virtu\u00e1ln\u00edho stroje, FortiGate se sna\u017e\u00ed poslat provoz na VTEP z (spr\u00e1vn\u00e9ho) VXLAN FDB, ale pou\u017e\u00edv\u00e1 \u0161patn\u00fd DST MAC a provoz je o\u010dek\u00e1van\u011b odm\u00edtnut p\u0159ij\u00edmaj\u00edc\u00edm rozhran\u00edm hypervizoru. A to v jednom p\u0159\u00edpad\u011b ze \u010dty\u0159 pat\u0159il tento MAC p\u016fvodn\u00edmu hypervizoru, ze kter\u00e9ho jsme za\u010dali migraci stroje.<\/p>\n
V\u010dera jsem dostal e-mail od technick\u00e9 podpory Fortinet - k m\u00e9mu p\u0159\u00edpadu otev\u0159eli chybu 615586. Opravu nev\u00edm, zda se m\u00e1m radovat nebo truchlit: na jedn\u00e9 stran\u011b - probl\u00e9m nen\u00ed v nastaven\u00ed, na druh\u00e9 - oprava p\u0159ijde pouze s aktualizac\u00ed firmwaru, nejl\u00e9pe v p\u0159\u00ed\u0161t\u00edm. M\u016fj egoismus zesiluje tak\u00e9 dal\u0161\u00ed chyba, kterou jsem odhalil minul\u00fd m\u011bs\u00edc, pravda v tenkr\u00e1t v HTML5 GUI vSphere. No, jako lok\u00e1ln\u00ed QA odd\u011blen\u00ed dodavatel\u016f\u2026<\/p>\n
Risknu s n\u00e1sleduj\u00edc\u00edm n\u00e1vrhem:<\/p>\n
1 - multicast kontroln\u00ed rovina pravd\u011bpodobn\u011b nebude vystavena popsan\u00e9mu probl\u00e9mu - MAC adresy VTEP se p\u0159ece z\u00edsk\u00e1vaj\u00ed z IP adresy skupiny, na kterou se rozhran\u00ed p\u0159ihl\u00e1silo. <\/p>\n
2 - probl\u00e9m FortiGate je pravd\u011bpodobn\u011b v offloadov\u00e1n\u00ed relac\u00ed na Network Processor (p\u0159ibli\u017en\u011b analogick\u00e9 CEF) - pokud se ka\u017ed\u00fd paket nech\u00e1 proj\u00edt CPU, budou se pou\u017e\u00edvat tabulky obsahuj\u00edc\u00ed spr\u00e1vn\u00e9 - alespo\u0148 na prvn\u00ed pohled - informace. Zp\u011btn\u00e1 vazba pro toto p\u0159edpokl\u00e1d\u00e1n\u00ed je, \u017ee pom\u016f\u017ee zav\u0159\u00edt\/otev\u0159\u00edt rozhran\u00ed nebo vy\u010dkat n\u011bjak\u00fd \u010das - v\u00edce ne\u017e 5 minut. <\/p>\n
3 - zm\u011bna teaming policy, nap\u0159\u00edklad na explicit failover, nebo zaveden\u00ed LAG nevy\u0159e\u0161\u00ed probl\u00e9m, proto\u017ee bylo pozorov\u00e1no \"zasek\u00e1v\u00e1n\u00ed\" MAC p\u016fvodn\u00edho hypervizoru v enkapsulovan\u00fdch paketech.<\/p>\n
V tomto ohledu mohu sd\u00edlet, \u017ee jsem ned\u00e1vno objevil blog<\/a><\/noindex>, kde v jednom z \u010dl\u00e1nk\u016f bylo uvedeno, \u017ee stateful firewally a cachovan\u00e9 zp\u016fsoby p\u0159enosu dat jsou pouze nouzov\u00e1 \u0159e\u0161en\u00ed. Nu\u017ee, nejsem tak zku\u0161en\u00fd v IT, abych takov\u00e9 tvrzen\u00ed mohl zaru\u010dit, nav\u00edc nesouhlas\u00edm se v\u0161emi tvrzen\u00edmi blogov\u00fdch \u010dl\u00e1nk\u016f hned na prvn\u00ed pohled. P\u0159esto mi n\u011bco \u0159\u00edk\u00e1, \u017ee v slovech Ivana je \u010d\u00e1st pravdy.<\/p>\n
D\u011bkuji za pozornost! Budu r\u00e1d odpov\u011bd\u011bt na ot\u00e1zky a sly\u0161et konstruktivn\u00ed kritiku.
\n
Zdroj: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u041f\u0440\u0438\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e, \u0438 \u0441\u043f\u0435\u0440\u0432\u0430 \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u043b\u0438\u0440\u0438\u043a\u0438. \u042f \u0438\u043d\u043e\u0433\u0434\u0430 \u0437\u0430\u0432\u0438\u0434\u0443\u044e \u043a\u043e\u043b\u043b\u0435\u0433\u0430\u043c, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u043c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u2014 \u0432\u0435\u0434\u044c \u044d\u0442\u043e \u043f\u0440\u0435\u043a\u0440\u0430\u0441\u043d\u043e \u0438\u043c\u0435\u0442\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0438\u0437 \u043b\u044e\u0431\u043e\u0433\u043e \u043a\u043e\u043d\u0446\u0430 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u043e\u0433\u043e \u043a Internet \u043c\u0438\u0440\u0430, \u043a\u0430\u043d\u0438\u043a\u0443\u043b\u044b \u0432 \u043b\u044e\u0431\u043e\u0435 \u0432\u0440\u0435\u043c\u044f, \u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u0437\u0430 \u043f\u0440\u043e\u0435\u043a\u0442\u044b \u0438 \u0434\u0435\u0434\u043b\u0430\u0439\u043d\u044b, \u0430 \u043d\u0435 \u043d\u0430\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u0435 \u0432 \u043e\u0444\u0438\u0441\u0435 \u0441 8 \u0434\u043e 17. \u041c\u043e\u044f \u043f\u043e\u0437\u0438\u0446\u0438\u044f \u0438 \u0440\u0430\u0431\u043e\u0447\u0438\u0435 \u043e\u0431\u044f\u0437\u0430\u043d\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0438\u0441\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0434\u043e\u043b\u0433\u043e\u0433\u043e \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u0432 \u0434\u0430\u0442\u0430\u0446\u0435\u043d\u0442\u0440\u0435. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":73233,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-73232","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47VXLAN v NSX-V \u2014 \u0159e\u0161\u00edme probl\u00e9my s underlay | ProHoster","description":"Zdrav\u00edm a nejprve trochu lyriky.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/vxlan-v-nsx-v-trablshutim-underlay","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47VXLAN \u0432 NSX-V \u2014 \u0442\u0440\u0430\u0431\u043b\u0448\u0443\u0442\u0438\u043c underlay | ProHoster","og:description":"\u041f\u0440\u0438\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e, \u0438 \u0441\u043f\u0435\u0440\u0432\u0430 \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u043b\u0438\u0440\u0438\u043a\u0438.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/vxlan-v-nsx-v-trablshutim-underlay","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-08T05:42:18+00:00","article:modified_time":"2020-03-08T05:42:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"73232","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:36:23","updated":"2022-09-27 15:26:08","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/73232","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=73232"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/73232\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/73233"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=73232"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=73232"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=73232"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}