ProHoster > Π‘Π»ΠΎΠ³ > Kev tswj hwm > VxLAN Hoobkas. Ntu 2

VxLAN Hoobkas. Ntu 2

Hlo Habr. Kuv txuas ntxiv cov kab lus ntawm VxLAN EVPN thev naus laus zis, uas tau sau tshwj xeeb rau kev pib kawm "Network engineer" los ntawm OTUS. Thiab niaj hnub no peb yuav xav txog ib feem nthuav ntawm cov dej num - routing. Txawm hais tias nws yuav zoo li cas, txawm li cas los xij, ua ib feem ntawm kev ua haujlwm ntawm lub Hoobkas network, txhua yam tuaj yeem tsis yooj yim.

VxLAN Hoobkas. Ntu 2

1 feem ntawm lub voj voog - L2 kev sib txuas ntawm cov servers

Hauv ntu kawg, peb tau ua tiav ib qho kev tshaj tawm xov xwm ua rau saum lub network ntaub ntawm Nexus 9000v. Txawm li cas los xij, qhov no tsis yog tag nrho cov haujlwm uas yuav tsum tau daws nyob rau hauv lub moj khaum ntawm cov ntaub ntawv chaw network. Thiab niaj hnub no peb yuav xav txog cov haujlwm hauv qab no - kev sib txuas ntawm tes hauj lwm lossis ntawm VNIs.

Cia kuv ceeb toom koj tias Spine-Leaf topology yog siv:

VxLAN Hoobkas. Ntu 2

Yuav pib nrog, peb yuav txheeb xyuas seb qhov kev ua haujlwm tshwm sim li cas thiab nws muaj dab tsi.

Rau kev nkag siab, cia peb ua kom yooj yim cov duab kos duab thiab ntxiv lwm VNI 20000 rau Host-2. Qhov tshwm sim yog:

VxLAN Hoobkas. Ntu 2

Yuav ua li cas, nyob rau hauv cov ntaub ntawv no, koj yuav hloov tsheb los ntawm ib tug tswv mus rau lwm tus?

Muaj ob txoj hauv kev:

  1. Khaws cov ntaub ntawv hais txog tag nrho VNIs ntawm txhua nplooj ntawv hloov, tom qab ntawd txhua txoj kev yuav tshwm sim ntawm thawj nplooj hauv lub network;
  2. Siv nplooj siab - L3 VNI

Thawj txoj kev yog yooj yim thiab yooj yim. Txij li thaum koj tsuas yog yuav tsum pib tag nrho VNIs ntawm txhua nplooj ntawv hloov. Txawm li cas los xij, khiav ob peb puas lossis ntau txhiab VNIs ntawm tag nrho Nplooj tsis zoo li ib txoj haujlwm yooj yim. Yog li ntawd, hauv kev ua haujlwm nws yog siv tsis tshua muaj.

Peb yuav tshuaj xyuas txoj kev 2, raws li kev nthuav dav thiab me ntsis nyuaj, tab sis muab kev yooj yim dua rau kev teeb tsa lub Hoobkas.

Cia peb ntxiv "PROD" rau VRF topology. Wb ntxiv interface vlan 10 rau nws ntawm Leaf-11/12 khub thiab interface VLAN 20 ntawm Nplooj-21. VLAN 20 yog txuam nrog VNI 20000

vrf context PROD
  rd auto       ! Route Distinguisher Π½Π΅ ΠΏΡ€ΠΈΠ½Ρ†ΠΈΠΏΠΈΠ°Π»Π΅Π½ ΠΈ ΠΌΠΎΠΆΠ΅ΠΌ ΠΈΡΠΏΠΎΠ»ΡŒΠ·ΠΎΠ²Π°Ρ‚ΡŒ сформированный автоматичСски
  address-family ipv4 unicast
    route-target both auto      ! ΡƒΠΊΠ°Π·Ρ‹Π²Π°Π΅ΠΌ Route-target с ΠΊΠΎΡ‚ΠΎΡ€Ρ‹ΠΌ Π±ΡƒΠ΄ΡƒΡ‚ ΠΈΠΌΠΏΠΎΡ€Ρ‚ΠΈΡ€ΠΎΠ²Π°Ρ‚ΡŒΡΡ ΠΈ ΡΠΊΡΠΏΠΎΡ€Ρ‚ΠΈΡ€ΠΎΠ²Π°Ρ‚ΡŒΡΡ прСфиксы Π²/ΠΈΠ· VRF
vlan 20
  vn-segment 20000

interface nve 1
  member vni 20000
    ingress-replication protocol bgp

interface Vlan10
  no shutdown
  vrf member PROD
  ip address 192.168.20.1/24
  fabric forwarding mode anycast-gateway

Txhawm rau siv L3VNI, koj yuav tsum tsim VLAN tshiab, koom nrog VNI tshiab. VNI tshiab yuav tsum yog tib yam ntawm txhua nplooj ntawv xav paub VLAN 10 thiab 20 cov ntaub ntawv.

vlan 99
  vn-segment 99000

interface nve1
  member vni 99000 associate-vrf        ! Π‘ΠΎΠ·Π΄Π°Π΅ΠΌ L3 VNI

vrf context PROD
  vni 99000                             ! ΠŸΡ€ΠΈΠ²ΡΠ·Ρ‹Π²Π°Π΅ΠΌ L3 VNI ΠΊ ΠΎΠΏΡ€Π΅Π΄Π΅Π»Π΅Π½Π½ΠΎΠΌΡƒ VRF

Yog li ntawd, daim duab yuav zoo li no:

VxLAN Hoobkas. Ntu 2

Nws tseem tshuav me ntsis - ntxiv ib qho ntxiv interface - interface vlan 99 hauv VRF PROD

interface Vlan99
  no shutdown
  vrf member PROD
  ip forward  ! На интСрфСйсС Π½Π΅ Π΄ΠΎΠ»ΠΆΠ½ΠΎ Π±Ρ‹Ρ‚ΡŒ IP. Π˜ΡΠΏΠΎΠ»ΡŒΠ·ΡƒΠ΅Ρ‚ΡΡ Ρ‚ΠΎΠ»ΡŒΠΊΠΎ для пСрСсылки ΠΏΠ°ΠΊΠ΅Ρ‚ΠΎΠ² ΠΌΠ΅ΠΆΠ΄Ρƒ Leaf

Yog li ntawd, lub logic ntawm kev hla tus ncej ntawm Host-1 rau Host-2 yog raws li nram no:

  1. Ib tug ncej xa los ntawm Host-1 tuaj txog ntawm Nplooj hauv VLAN 10, uas cuam tshuam nrog VNI 10000;
  2. Nplooj tshuaj xyuas qhov chaw nyob qhov twg thiab pom nws ntawm L3 VNI ntawm nplooj thib ob hloov;
  3. Sai li sai tau txoj kev mus rau qhov chaw nyob tau pom, Nplooj packs lub thav duab rau hauv ib lub header nrog rau qhov tsim nyog L3VNI 99000 - thiab xa mus rau nplooj thib ob;
  4. Qhov thib ob Leaf hloov tau txais cov ntaub ntawv los ntawm L3VNI 99000. Tau txais cov qauv qub thiab hloov mus rau L2VNI 20000 thiab tom qab ntawd mus rau VLAN 20.

Raws li kev ua haujlwm no, L3VNI tshem tawm qhov yuav tsum tau khaws cov ntaub ntawv hais txog txhua VNIs uas nyob hauv lub network ntawm txhua qhov hloov pauv nplooj.

Yog li ntawd, thaum peb xa tsheb khiav los ntawm Host-1 mus rau Host-2, lub pob ntawv tau ntim rau hauv VxLAN nrog VNI tshiab - 99000:

VxLAN Hoobkas. Ntu 2

Nws tseem yuav pom tias Leaf-1 kawm tau li cas txog MAC chaw nyob los ntawm lwm tus VNI. Qhov no kuj tshwm sim nrog kev pab ntawm EVPN txoj kev-hom 2 (MAC / IP).

Cov hauv qab no qhia txog cov txheej txheem ntawm kev tshaj tawm txoj hauv kev hais txog lub npe ua ntej nyob hauv lwm VNI:

VxLAN Hoobkas. Ntu 2

Ntawd yog, qhov chaw nyob tau txais los ntawm VNI 20000 muaj ob RTs.
Cia kuv ceeb toom rau koj tias cov kev tau txais los ntawm Kev Hloov Kho tau poob rau hauv BGP lub rooj nrog Txoj Kev-lub hom phiaj tau teev tseg hauv VRF nqis (cov txheej txheem yuav nyuaj me ntsis, tab sis peb yuav tsis mus rau hauv kab lus no).
Tus RT nws tus kheej yog tsim los ntawm cov mis: AS:VNI (yog siv hom tsis siv neeg).

Ib qho piv txwv ntawm kev tsim RT nyob rau hauv hom tsis siv neeg thiab phau ntawv:

vrf context PROD
  address-family ipv4 unicast
    route-target import auto - автоматичСский Ρ€Π΅ΠΆΠΈΠΌ Ρ€Π°Π±ΠΎΡ‚Ρ‹
    route-target export 65001:20000 - Ρ€ΡƒΡ‡Π½ΠΎΠΉ Ρ€Π΅ΠΆΠΈΠΌ формирования RT

Raws li qhov tshwm sim, koj tuaj yeem pom saum toj no cov lus hais ua ntej los ntawm lwm tus VNI muaj ob qhov txiaj ntsig RT.
Ib ntawm lawv 65001: 99000 yog L3 VNI ntxiv. Txij li thaum VNI no zoo ib yam ntawm tag nrho cov nplooj thiab poob rau hauv peb cov kev cai ntshuam hauv VRF chaw, cov lus ua ntej nkag mus rau hauv BGP rooj, uas tuaj yeem pom los ntawm cov zis:

sh bgp l2vpn evpn
<.....>
   Network            Next Hop            Metric     LocPrf     Weight Path
Route Distinguisher: 10.255.1.11:32777    (L2VNI 10000)
*>l[2]:[0]:[0]:[48]:[5001.0007.0007]:[0]:[0.0.0.0]/216
                      10.255.1.10                       100      32768 i
*>l[2]:[0]:[0]:[48]:[5001.0007.0007]:[32]:[192.168.10.10]/272
                      10.255.1.10                       100      32768 i
*>l[3]:[0]:[32]:[10.255.1.10]/88
                      10.255.1.10                       100      32768 i

Route Distinguisher: 10.255.1.21:32787
* i[2]:[0]:[0]:[48]:[5001.0008.0007]:[32]:[192.168.20.20]/272    ! ΠŸΡ€Π΅Ρ„ΠΈΠΊΡ ΠΏΠΎΠ»ΡƒΡ‡Π΅Π½Π½Ρ‹ΠΉ ΠΈΠ· VNI 20000
                      10.255.1.20                       100          0 i
*>i                   10.255.1.20                       100          0 i

Yog tias peb saib ze ze ntawm qhov kev hloov tshiab tau txais, peb tuaj yeem pom tias qhov ua ntej no muaj ob RTs:

Leaf11# sh bgp l2vpn evpn 5001.0008.0007
BGP routing table information for VRF default, address family L2VPN EVPN
Route Distinguisher: 10.255.1.21:32787
BGP routing table entry for [2]:[0]:[0]:[48]:[5001.0008.0007]:[32]:[192.168.20.2
0]/272, version 5164
Paths: (2 available, best #2)
Flags: (0x000202) (high32 00000000) on xmit-list, is not in l2rib/evpn, is not i
n HW

  Path type: internal, path is valid, not best reason: Neighbor Address, no labeled nexthop
  AS-Path: NONE, path sourced internal to AS
    10.255.1.20 (metric 81) from 10.255.1.102 (10.255.1.102)
      Origin IGP, MED not set, localpref 100, weight 0
      Received label 20000 99000                                 ! Π”Π²Π° label для Ρ€Π°Π±ΠΎΡ‚Ρ‹ VxLAN
      Extcommunity: RT:65001:20000 RT:65001:99000 SOO:10.255.1.20:0 ENCAP:8     ! Π”Π²Π° значСния Route-target, Π½Π° основС, ΠΊΠΎΡ‚ΠΎΡ€Ρ‹Ρ… Π΄ΠΎΠ±Π°Π²ΠΈΠ»ΠΈ Π΄Π°Π½Π½Ρ‹ΠΉ прСфикс
          Router MAC:5001.0005.0007
      Originator: 10.255.1.21 Cluster list: 10.255.1.102
<......>

Nyob rau hauv lub rooj routing ntawm Nplooj-1, koj tuaj yeem pom ua ntej 192.168.20.20/32:

Leaf11# sh ip route vrf PROD
192.168.10.0/24, ubest/mbest: 1/0, attached
    *via 192.168.10.1, Vlan10, [0/0], 01:29:28, direct
192.168.10.1/32, ubest/mbest: 1/0, attached
    *via 192.168.10.1, Vlan10, [0/0], 01:29:28, local
192.168.10.10/32, ubest/mbest: 1/0, attached
    *via 192.168.10.10, Vlan10, [190/0], 01:27:22, hmm
192.168.20.20/32, ubest/mbest: 1/0                                        ! АдрСс Host-2
    *via 10.255.1.20%default, [200/0], 01:20:20, bgp-65001, internal, tag 65001     ! Доступный Ρ‡Π΅Ρ€Π΅Π· Leaf-2
(evpn) segid: 99000 tunnelid: 0xaff0114 encap: VXLAN                                ! Π§Π΅Ρ€Π΅Π· VNI 99000

Daim ntawv ceeb toom qhov uas ploj lawm thawj prefix 192.168.20.0/24 nyob rau hauv lub routing table?
Yog lawm, nws tsis nyob ntawd. Ntawd yog, Nplooj Ntoos Tej thaj chaw deb tau txais cov ntaub ntawv tsuas yog hais txog cov tswv uas nyob hauv koj lub network. Thiab qhov no yog tus cwj pwm raug. Saum toj no, hauv txhua qhov hloov tshiab, koj tuaj yeem pom tias cov ntaub ntawv tuaj nrog cov ntsiab lus ntawm MAC / IP. Tsis muaj prefixes los hais txog.

Qhov no yog Tus Thawj Saib Xyuas Kev Lag Luam (HMM) raws tu qauv, uas ua rau lub rooj ARP los ntawm cov lus BGP ntxiv (peb yuav tshem tawm cov txheej txheem no nyob rau hauv lub moj khaum ntawm tsab xov xwm no). Raws li cov ntaub ntawv tau txais los ntawm HMM, txoj kev-hom 2 EVPNs yog tsim (hloov los ntawm MAC / IP).

Txawm li cas los xij, yuav ua li cas yog tias xav tau kom dhau cov ntaub ntawv hais txog kev ua ntej?

Rau hom ntaub ntawv no, muaj EVPN txoj kev-hom 5 - nws tso cai rau koj xa prefixes ntawm chaw nyob-tsev neeg l2vpn evpn (txoj kev no thaum lub sij hawm sau ntawv no tsuas yog nyob rau hauv cov ntawv sau version. RFC, vim li no, cov tuam txhab sib txawv yuav muaj tus cwj pwm sib txawv ntawm txoj kev no)

Txhawm rau hloov cov ntawv ua ntej, nws yuav tsum tau ntxiv cov npe ua ntej hauv BGP txheej txheem rau VRF, uas yuav raug tshaj tawm:

router bgp 65001
  vrf PROD
    address-family ipv4 unicast
      redistribute direct route-map VNI20000        ! Π’ Π΄Π°Π½Π½ΠΎΠΌ случаС анонсируСм прСфиксы ΠΏΠΎΠ΄ΠΊΠ»ΡŽΡ‡Π΅Π½ΠΈΠ΅ нСпосрСдствСнно ΠΊ Leaf Π² VNI 20000
route-map VNI20000 permit 10
  match ip address prefix-list VNI20000_OUT    ! Π£ΠΊΠ°Π·Ρ‹Π²Π°Π΅ΠΌ ΠΊΠ°ΠΊΠΎΠΉ ΠΈΡΠΏΠΎΠ»ΡŒΠ·ΠΎΠ²Π°Ρ‚ΡŒ prefix-list

ip prefix-list VNI20000_OUT seq 5 permit 192.168.20.0/24   ! Π£ΠΊΠ°Π·Ρ‹Π²Π°Π΅ΠΌ ΠΊΠ°ΠΊΠΈΠ΅ сСти Π±ΡƒΠ΄ΡƒΡ‚ ΠΏΠΎΠΏΠ°Π΄Π°Ρ‚ΡŒ Π² EVPN route-type 5

Raws li qhov tshwm sim, Hloov tshiab yuav yog:

VxLAN Hoobkas. Ntu 2

Wb saib BGP rooj. Ntxiv rau EVPN txoj kev-hom 2,3, hom 5 txoj kev tau tshwm sim uas muaj cov ntaub ntawv hais txog tus lej xov tooj:

<......>
   Network            Next Hop            Metric     LocPrf     Weight Path
Route Distinguisher: 10.255.1.11:3
* i[5]:[0]:[0]:[24]:[192.168.10.0]/224
                      10.255.1.10              0        100          0 ?
*>i                   10.255.1.10              0        100          0 ?

Route Distinguisher: 10.255.1.11:32777
* i[2]:[0]:[0]:[48]:[5001.0007.0007]:[0]:[0.0.0.0]/216
                      10.255.1.10                       100          0 i
*>i                   10.255.1.10                       100          0 i
* i[2]:[0]:[0]:[48]:[5001.0007.0007]:[32]:[192.168.10.10]/272
                      10.255.1.10                       100          0 i
*>i                   10.255.1.10                       100          0 i
* i[3]:[0]:[32]:[10.255.1.10]/88
                      10.255.1.10                       100          0 i
*>i                   10.255.1.10                       100          0 i

Route Distinguisher: 10.255.1.12:3
*>i[5]:[0]:[0]:[24]:[192.168.10.0]/224      ! EVPN route-type 5 с Π½ΠΎΠΌΠ΅Ρ€ΠΎΠΌ прСфикса
                      10.255.1.10              0        100          0 ?
* i
<.......>

Lub prefix kuj tshwm sim nyob rau hauv lub rooj routing:

Leaf21# sh ip ro vrf PROD
192.168.10.0/24, ubest/mbest: 1/0
    *via 10.255.1.10%default, [200/0], 00:14:32, bgp-65001, internal, tag 65001  ! Π£Π΄Π°Π»Π΅Π½Π½Ρ‹ΠΉ прСфикс, доступный Ρ‡Π΅Ρ€Π΅Π· Leaf1/2(адрСс Next-hop = virtual IP ΠΌΠ΅ΠΆΠ΄Ρƒ ΠΏΠ°Ρ€ΠΎΠΉ VPC)
(evpn) segid: 99000 tunnelid: 0xaff010a encap: VXLAN      ! ΠŸΡ€Π΅Ρ„ΠΈΠΊΡ доступСн Ρ‡Π΅Ρ€Π΅Π· L3VNI 99000

192.168.10.10/32, ubest/mbest: 1/0
    *via 10.255.1.10%default, [200/0], 02:33:40, bgp-65001, internal, tag 65001
(evpn) segid: 99000 tunnelid: 0xaff010a encap: VXLAN

192.168.20.0/24, ubest/mbest: 1/0, attached
    *via 192.168.20.1, Vlan20, [0/0], 02:39:44, direct
192.168.20.1/32, ubest/mbest: 1/0, attached
    *via 192.168.20.1, Vlan20, [0/0], 02:39:44, local
192.168.20.20/32, ubest/mbest: 1/0, attached
    *via 192.168.20.20, Vlan20, [190/0], 02:35:46, hmm

Qhov no xaus qhov thib ob ntawm cov kab lus ntawm VxLAN EVPN. Hauv ntu tom ntej, peb yuav xav txog ntau yam kev xaiv rau kev sib txuas ntawm VRFs.

Lub hauv paus ntawm IPv6 thiab nws txawv li cas ntawm IPv4

Tau qhov twg los: www.hab.com

Ntxiv ib saib