ProHoster > Блог > Gudanarwa > VxLAN factory. Kashi na 2

VxLAN factory. Kashi na 2

Hello Habr. Na ci gaba da jerin labaran kan fasahar VxLAN EVPN, wanda an rubuta musamman don ƙaddamar da kwas "Injiniya Network" ta OTUS. Kuma a yau za mu kalli wani bangare mai ban sha'awa na aikin - kwatance. Ko ta yaya ƙananan sauti na iya yin sauti, duk da haka, a cikin tsarin aikin masana'antar cibiyar sadarwa, komai na iya zama mai sauƙi.

VxLAN factory. Kashi na 2

Sashe 1 na zagayowar - Haɗin L2 tsakanin sabobin

A cikin ɓangaren ƙarshe, mun sami yankin watsa shirye-shirye guda ɗaya da aka gina a saman masana'anta na cibiyar sadarwa akan Nexus 9000v. Koyaya, wannan ba duka kewayon ayyuka bane da ake buƙatar warwarewa a cikin cibiyar sadarwar bayanai. Kuma a yau za mu dubi aiki na gaba - kewayawa tsakanin cibiyoyin sadarwa ko tsakanin VNIs.

Bari in tunatar da ku cewa ana amfani da Topology na Spine-Leaf:

VxLAN factory. Kashi na 2

Da farko, bari mu kalli yadda tsarin ke faruwa da waɗanne fasali yake da shi.

Don fahimta, bari mu sauƙaƙe zanen dabaru kuma mu ƙara wani VNI 20000 don Mai watsa shiri-2. Sakamakon shine:

VxLAN factory. Kashi na 2

Ta yaya, a wannan yanayin, za ku iya canja wurin zirga-zirga daga wannan Mai watsa shiri zuwa wani?

Akwai zaɓuɓɓuka biyu:

  1. Ajiye bayanai game da duk VNIs a kan duk Leaf switches, sa'an nan duk routing zai faru a farkon Leaf a cikin cibiyar sadarwa;
  2. Yi amfani da keɓewar L3 VNI

Hanyar farko tana da sauƙi kuma mai dacewa. Tunda kawai kuna buƙatar shigar da duk VNI akan duk maɓallan leaf. Koyaya, kafa ɗaruruwan ko dubunnan VNI don duk Ganye ba ya zama aiki mai sauƙi. Saboda haka, ana amfani da shi sosai da wuya a cikin aiki.

Bari mu dubi hanyar 2, wanda ya fi ban sha'awa kuma ya fi rikitarwa, amma yana ba da ƙarin sassauci wajen kafa masana'anta.

Bari mu ƙara "PROD" zuwa VRF topology. A gare shi za mu ƙara dubawa vlan 10 akan Leaf-11/12 biyu da VLAN 20 akan Leaf-21. VLAN 20 yana da alaƙa da VNI 20000

vrf context PROD
  rd auto       ! Route Distinguisher не принципиален и можем использовать сформированный автоматически
  address-family ipv4 unicast
    route-target both auto      ! указываем Route-target с которым будут импортироваться и экспортироваться префиксы в/из VRF
vlan 20
  vn-segment 20000

interface nve 1
  member vni 20000
    ingress-replication protocol bgp

interface Vlan10
  no shutdown
  vrf member PROD
  ip address 192.168.20.1/24
  fabric forwarding mode anycast-gateway

Domin amfani da L3VNI, kuna buƙatar ƙirƙirar sabon VLAN kuma ku haɗa shi da sabuwar VNI. Sabuwar VNI dole ne ta kasance iri ɗaya akan duk Leafs masu sha'awar bayanin VLAN 10 da 20

vlan 99
  vn-segment 99000

interface nve1
  member vni 99000 associate-vrf        ! Создаем L3 VNI

vrf context PROD
  vni 99000                             ! Привязываем L3 VNI к определенному VRF

A sakamakon haka, zane zai kasance kamar haka:

VxLAN factory. Kashi na 2

Ya rage a yi kadan - ƙara ƙarin dubawa guda ɗaya - interface vlan 99 a cikin VRF PROD

interface Vlan99
  no shutdown
  vrf member PROD
  ip forward  ! На интерфейсе не должно быть IP. Используется только для пересылки пакетов между Leaf

Sakamakon haka, dabaru don ƙaddamar da firam daga Mai watsa shiri-1 zuwa Mai watsa shiri-2 shine kamar haka:

  1. Firam ɗin da Mai watsa shiri-1 ya aiko ya isa Leaf a cikin VLAN 10, wanda ke da alaƙa da VNI 10000;
  2. Leaf yana duba inda adireshin da aka nufa yake kuma ya same shi ta hanyar L3 VNI akan sauya Leaf na biyu;
  3. Da zaran an sami hanyar zuwa adireshin da aka nufa, Leaf ya tattara firam ɗin a cikin rubutun da ake buƙata L3VNI 99000 - kuma ya aika zuwa ga Leaf na biyu;
  4. Canjin Leaf na biyu yana karɓar bayanai daga L3VNI 99000. Yana ɗaukar firam ɗin asali kuma a tura shi zuwa L2VNI 20000 da ake buƙata sannan zuwa VLAN 20.

A sakamakon wannan aikin, L3VNI yana kawar da buƙatar adana bayanai game da duk VNIs da ke kan hanyar sadarwa a kan dukkan Leaf switches.

Sakamakon haka, lokacin da muka aika zirga-zirga daga Mai watsa shiri-1 zuwa Mai watsa shiri-2, fakitin yana cike cikin VxLAN tare da sabon VNI - 99000:

VxLAN factory. Kashi na 2

Ya rage don ganin yadda daidai Leaf-1 ke koya game da adireshin MAC daga wani VNI. Hakanan yana faruwa ta amfani da nau'in hanyar EVPN 2 (MAC/IP).

Mai zuwa yana nuna tsarin yada hanya game da prefix dake cikin wani VNI:

VxLAN factory. Kashi na 2

Wato, adiresoshin da aka karɓa daga VNI 20000 suna da RT guda biyu.
Bari in tunatar da ku cewa hanyoyin da aka karɓa daga Sabuntawa suna ƙarewa a cikin tebur na BGP tare da Hanyar Hanyar da aka ƙayyade a cikin saitunan VRF (tsarin yana da ɗan rikitarwa, amma ba za mu shiga cikin wannan labarin ba).
RT da kansa an ƙirƙira shi bisa ga dabara: AS: VNI ​​(idan an yi amfani da yanayin atomatik).

Misalin samuwar RT a yanayin atomatik da na hannu:

vrf context PROD
  address-family ipv4 unicast
    route-target import auto - автоматический режим работы
    route-target export 65001:20000 - ручной режим формирования RT

Sakamakon da ke sama ya nuna cewa prefixes daga wani VNI suna da ƙimar RT guda biyu.
Ɗayan su shine 65001:99000 - ƙarin L3 VNI. Tun da wannan VNI iri ɗaya ce akan duk Leafs kuma ta faɗi ƙarƙashin ƙa'idodin shigo da mu a cikin saitunan VRF, prefix ɗin yana ƙarewa a teburin BGP, wanda za'a iya gani daga fitarwa:

sh bgp l2vpn evpn
<.....>
   Network            Next Hop            Metric     LocPrf     Weight Path
Route Distinguisher: 10.255.1.11:32777    (L2VNI 10000)
*>l[2]:[0]:[0]:[48]:[5001.0007.0007]:[0]:[0.0.0.0]/216
                      10.255.1.10                       100      32768 i
*>l[2]:[0]:[0]:[48]:[5001.0007.0007]:[32]:[192.168.10.10]/272
                      10.255.1.10                       100      32768 i
*>l[3]:[0]:[32]:[10.255.1.10]/88
                      10.255.1.10                       100      32768 i

Route Distinguisher: 10.255.1.21:32787
* i[2]:[0]:[0]:[48]:[5001.0008.0007]:[32]:[192.168.20.20]/272    ! Префикс полученный из VNI 20000
                      10.255.1.20                       100          0 i
*>i                   10.255.1.20                       100          0 i

Idan muka kalli sabuntawar da aka karɓa sosai, zamu iya ganin cewa wannan prefix ɗin yana da RTs guda biyu:

Leaf11# sh bgp l2vpn evpn 5001.0008.0007
BGP routing table information for VRF default, address family L2VPN EVPN
Route Distinguisher: 10.255.1.21:32787
BGP routing table entry for [2]:[0]:[0]:[48]:[5001.0008.0007]:[32]:[192.168.20.2
0]/272, version 5164
Paths: (2 available, best #2)
Flags: (0x000202) (high32 00000000) on xmit-list, is not in l2rib/evpn, is not i
n HW

  Path type: internal, path is valid, not best reason: Neighbor Address, no labeled nexthop
  AS-Path: NONE, path sourced internal to AS
    10.255.1.20 (metric 81) from 10.255.1.102 (10.255.1.102)
      Origin IGP, MED not set, localpref 100, weight 0
      Received label 20000 99000                                 ! Два label для работы VxLAN
      Extcommunity: RT:65001:20000 RT:65001:99000 SOO:10.255.1.20:0 ENCAP:8     ! Два значения Route-target, на основе, которых добавили данный префикс
          Router MAC:5001.0005.0007
      Originator: 10.255.1.21 Cluster list: 10.255.1.102
<......>

A cikin tebur na kewayawa akan Leaf-1 kuma kuna iya ganin prefix 192.168.20.20/32:

Leaf11# sh ip route vrf PROD
192.168.10.0/24, ubest/mbest: 1/0, attached
    *via 192.168.10.1, Vlan10, [0/0], 01:29:28, direct
192.168.10.1/32, ubest/mbest: 1/0, attached
    *via 192.168.10.1, Vlan10, [0/0], 01:29:28, local
192.168.10.10/32, ubest/mbest: 1/0, attached
    *via 192.168.10.10, Vlan10, [190/0], 01:27:22, hmm
192.168.20.20/32, ubest/mbest: 1/0                                        ! Адрес Host-2
    *via 10.255.1.20%default, [200/0], 01:20:20, bgp-65001, internal, tag 65001     ! Доступный через Leaf-2
(evpn) segid: 99000 tunnelid: 0xaff0114 encap: VXLAN                                ! Через VNI 99000

An lura da rashin babban prefix 192.168.20.0/24 a cikin tebur mai tuƙi?
Haka ne, ba ya nan. Wato, Leafs masu nisa suna karɓar bayanai kawai game da rundunonin da ke kan hanyar sadarwar ku. Kuma wannan shine halin da ya dace. Sama a cikin duk sabuntawa za ku iya ganin cewa bayanin ya zo tare da abun ciki na MAC/IP. Babu maganar kowane prefixes.

Wannan shine yadda ka'idar Host Mobility Manager (HMM) ke aiki, wanda ke cika tebur na ARP wanda daga nan aka cika tebur BGP (za mu bar wannan tsari don dalilan wannan labarin). Dangane da bayanin da aka karɓa daga HMM, an kafa nau'in hanyar EVPN-nau'in 2 (MAC/IP ke watsawa).

Koyaya, menene idan akwai buƙatar watsa bayanai game da prefix?

Don irin wannan bayanin, akwai nau'in EVPN-nau'in 5 - yana ba ku damar aika prefixes ta hanyar adireshi-iyali l2vpn evpn (irin wannan nau'in hanyoyin a lokacin rubuce-rubuce yana cikin daftarin sigar RFC, saboda wannan, halayyar irin wannan hanya na iya bambanta tsakanin masana'antun daban-daban)

Don aika prefixes, ya zama dole a ƙara prefixes waɗanda za a yi talla a cikin tsarin BGP na VRF:

router bgp 65001
  vrf PROD
    address-family ipv4 unicast
      redistribute direct route-map VNI20000        ! В данном случае анонсируем префиксы подключение непосредственно к Leaf в VNI 20000
route-map VNI20000 permit 10
  match ip address prefix-list VNI20000_OUT    ! Указываем какой использовать prefix-list

ip prefix-list VNI20000_OUT seq 5 permit 192.168.20.0/24   ! Указываем какие сети будут попадать в EVPN route-type 5

A sakamakon haka, Sabuntawa zai sami:

VxLAN factory. Kashi na 2

Bari mu kalli teburin BGP. Baya ga hanyar EVPN-nau'in 2,3, nau'in hanyoyin 5 sun bayyana, waɗanda ke ɗauke da bayanai game da lambar cibiyar sadarwa:

<......>
   Network            Next Hop            Metric     LocPrf     Weight Path
Route Distinguisher: 10.255.1.11:3
* i[5]:[0]:[0]:[24]:[192.168.10.0]/224
                      10.255.1.10              0        100          0 ?
*>i                   10.255.1.10              0        100          0 ?

Route Distinguisher: 10.255.1.11:32777
* i[2]:[0]:[0]:[48]:[5001.0007.0007]:[0]:[0.0.0.0]/216
                      10.255.1.10                       100          0 i
*>i                   10.255.1.10                       100          0 i
* i[2]:[0]:[0]:[48]:[5001.0007.0007]:[32]:[192.168.10.10]/272
                      10.255.1.10                       100          0 i
*>i                   10.255.1.10                       100          0 i
* i[3]:[0]:[32]:[10.255.1.10]/88
                      10.255.1.10                       100          0 i
*>i                   10.255.1.10                       100          0 i

Route Distinguisher: 10.255.1.12:3
*>i[5]:[0]:[0]:[24]:[192.168.10.0]/224      ! EVPN route-type 5 с номером префикса
                      10.255.1.10              0        100          0 ?
* i
<.......>

Har ila yau, prefix ɗin ya bayyana a cikin tebirin tuƙi:

Leaf21# sh ip ro vrf PROD
192.168.10.0/24, ubest/mbest: 1/0
    *via 10.255.1.10%default, [200/0], 00:14:32, bgp-65001, internal, tag 65001  ! Удаленный префикс, доступный через Leaf1/2(адрес Next-hop = virtual IP между парой VPC)
(evpn) segid: 99000 tunnelid: 0xaff010a encap: VXLAN      ! Префикс доступен через L3VNI 99000

192.168.10.10/32, ubest/mbest: 1/0
    *via 10.255.1.10%default, [200/0], 02:33:40, bgp-65001, internal, tag 65001
(evpn) segid: 99000 tunnelid: 0xaff010a encap: VXLAN

192.168.20.0/24, ubest/mbest: 1/0, attached
    *via 192.168.20.1, Vlan20, [0/0], 02:39:44, direct
192.168.20.1/32, ubest/mbest: 1/0, attached
    *via 192.168.20.1, Vlan20, [0/0], 02:39:44, local
192.168.20.20/32, ubest/mbest: 1/0, attached
    *via 192.168.20.20, Vlan20, [190/0], 02:35:46, hmm

Wannan ya ƙare kashi na biyu na jerin labarai akan VxLAN EVPN. A kashi na gaba za mu duba zaɓuɓɓuka daban-daban don yin kwatance tsakanin VRFs.

Tushen ƙa'idar IPv6 da bambance-bambancenta daga IPv4

source: www.habr.com

Add a comment