{"id":73232,"date":"2020-03-08T08:42:18","date_gmt":"2020-03-08T05:42:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/vxlan-v-nsx-v-trablshutim-underlay"},"modified":"2020-03-08T08:42:18","modified_gmt":"2020-03-08T05:42:18","slug":"vxlan-v-nsx-v-trablshutim-underlay","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/vxlan-v-nsx-v-trablshutim-underlay","title":{"rendered":"VXLAN u NSX-V \u2014 re\u0161avanje problema sa underlay-om","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Pozdravljam, in najprej malo lirike. V\u010dasih zavidam kolegom, ki delajo na daljavo \u2013 saj je \u010dudovito imeti mo\u017enost delati s katerikoli to\u010dke sveta, povezane z Internetom, imeti po\u010ditnice kadarkoli, odgovornost za projekte in roke, namesto da bi bili v pisarni od 8. do 17. ure. Moja pozicija in delovne naloge prakti\u010dno izklju\u010dujejo mo\u017enost dalj\u0161e odsotnosti iz podatkovnega centra. Vendar se ob\u010dasno zgodijo zanimivi primeri, kot je opisano spodaj \u2013 in razumem, da obstaja malo pozicij, kjer je toliko prostora za kreativno izra\u017eanje notranjega re\u0161itelja te\u017eav.
\n<\/a><\/noindex>
\nMajhna opomba \u2014 ob pisanju \u010dlanka primer ni bil popolnoma re\u0161en, vendar upo\u0161tevajo\u010d hitrost odziva dobaviteljev, lahko popolna re\u0161itev traja \u0161e mesece, in deliti svoje ugotovitve \u017eelim \u017ee zdaj. Upam, da me boste, cenjeni bralci, oprostili te naglice. Ampak dovolj vode \u2014 kaj se dogaja s primerom? <\/p>\n

Najprej uvod: obstaja podjetje (kjer delam kot omre\u017eni in\u017eenir), ki gosti re\u0161itve strank v zasebnem oblaku VMWare. Ve\u010dina novih re\u0161itev se povezuje na VXLAN segmente, ki jih upravlja NSX-V \u2014 ne bom ocenjeval, koliko \u010dasa mi je ta re\u0161itev prihranila, na kratko povedano \u2014 veliko. Uspe\u0161no sem celo usposobil kolege za nastavitev NSX ESG in majhne re\u0161itve strank se postavijo brez mojega sodelovanja. Pomembna opomba \u2014 kontrollna raven pri nas ima unicast replikacijo. Hipervizorji so povezani redundantno z dvema vmesnikoma na razli\u010dne fizi\u010dne stikala Juniper QFX5100 (zbirana v Virtual Chassis) in politiko usklajevanja temelji na izvorni virtualni vratni oznaki \u2014 to je za popolno sliko.<\/p>\n

Re\u0161itve strank so zelo raznolike: od Windows IIS, kjer so vsi sestavni deli spletnega stre\u017enika name\u0161\u010deni na eni napravi, do precej ve\u010djih \u2014 na primer uravnote\u017eeni Apache spletni obrazi + LB MariaDB v Galera + datote\u010dni stre\u017eniki, sinhronizirani s pomo\u010djo GlusterFS. Skoraj vsak stre\u017enik je treba spremljati posebej, javni naslovi pa niso pri vseh sestavnih delih \u2014 \u010de ste se soo\u010dili s to nalogo in imate bolj elegantno re\u0161itev, bom vesel nasveta.
\nMoja re\u0161itev za spremljanje se sestavlja iz \"povezave\" po\u017earnega zidu (Fortigate) v vsak notranji klientski omre\u017eji (+SNAT in seveda stroge omejitve glede dovoljenega prometa) in spremljanja notranjih naslovov \u2014 na ta na\u010din dose\u017eemo dolo\u010deno unifikacijo in poenostavitev spremljanja. Samo spremljanje poteka iz gru\u010de stre\u017enikov PRTG. Na\u010drt spremljanja je pribli\u017eno tak:<\/p>\n

\"VXLAN
\n
\nDokler smo delali le z VLAN-om, je vse delovalo povsem obi\u010dajno in predvidljivo, kot ura. Po uvedbi NSX-V in VXLAN-a smo naleteli na vpra\u0161anje \u2014 ali lahko \u0161e naprej spremljamo na star na\u010din? Ob \u010dasu tega vpra\u0161anja je bila najelegantnej\u0161a re\u0161itev postavitev NSX ESG in povezava VXLAN trunk v VTEP omre\u017eje. Hitro v navednicah \u2014 saj uporaba GUI za nastavitev klientskih omre\u017eij, SNAT in pravil po\u017earnega zidu sicer poenoti upravljanje v enotnem vmesniku vSphere, vendar po mojem mnenju precej ote\u017euje in poleg vsega omejuje nabor orodij za re\u0161evanje te\u017eav. Tisti, ki so uporabljali NSX ESG kot zamenjavo za \"pravi\" po\u017earni zid, se mislim, da se bodo strinjali. \u010ceprav bi bila taka re\u0161itev verjetno bolj stabilna \u2014 saj se vse dogaja v okviru enega prodajalca.<\/p>\n

\u0160e ena re\u0161itev je uporaba NSX DLR v na\u010dinu mostu med VLAN in VXLAN. Tukaj mislim, da je vse jasno \u2014 preprosto izginja korist uporabe VXLAN \u2014 saj je v tem primeru \u0161e vedno potrebno pripeljati VLAN do monitoring-instalacije. Mimogrede, med obdelavo te re\u0161itve sem se sre\u010dal s te\u017eavo, ko DLR-most ni po\u0161iljal paketov virtualki, s katero je bil na istem gostitelju. Vem, vem \u2014 v knjigah in vodi\u010dih po NSX-V je jasno navedeno, da mora biti za NSX Edge dodeljen lo\u010den grozd, ampak to je v knjigah\u2026 Tako ali tako, po nekaj mesecih s podporo te\u017eave nismo re\u0161ili. V bistvu sem razumel logiko delovanja \u2014 modul jedra hipervizorja, odgovoren za enkapsulacijo VXLAN, ni bil uporabljen, \u010de sta bila DLR in opazovani stre\u017enik na istem gostitelju, saj promet ne zapusti gostitelja in po logiki bi moral biti priklju\u010den na VXLAN segment \u2014 enkapsulacija ni potrebna. S podporo smo se osredoto\u010dili na virtualni vmesnik vdrPort, ki logi\u010dno zdru\u017euje uplinke in hkrati izvaja mostovanje\/enkapsulacijo \u2014 tam je bila opa\u017eena neskladnost v vhodnem prometu, ki sem ga vzel za obdelavo v trenutnem primeru. Ampak kot je bilo re\u010deno, tega primera nisem dokon\u010dal, saj sem bil prenesen na drug projekt in tudi ta veja je bila od za\u010detka brezizhodna, zato nisem imel posebne \u017eelje, da bi jo razvijal. \u010ce se ne motim, je bila te\u017eava opa\u017eena v razli\u010dicah NSX 6.1.4 in 6.2. <\/p>\n

In tukaj \u2014 bingo! Fortinet napoveduje nativno podporo VXLAN<\/a><\/noindex>. In ne samo point-to-point ali VXLAN-over-IPSec, ne programsko mostovanje VLAN-VXLAN \u2014 vse to so za\u010deli uvajati \u017ee z razli\u010dico 5.4 (in predstavljeno pri drugih dobaviteljih<\/a><\/noindex>), in resni\u010dno podporo unicast control plane. Pri uvedbi re\u0161itve sem naletel \u0161e na en problem \u2013 preverjani stre\u017eniki so ob\u010dasno \"izginjali\" in se pojavljali v monitoringu, \u010deprav je sama virtualka \u0161e vedno delovala. Kot se je izkazalo, je razlog bil, da sem pozabil omogo\u010diti Ping na VXLAN vmesniku. Med postopkom rebalanceanja grozdov so se virtualke premikale, Ping pa je kon\u010dal vMotion, da ozna\u010di nov ESXI gostitelj, na katerega je bila naprava premaknjena. Moja neumnost, a ta te\u017eava je \u0161e enkrat spodkopala zaupanje v podporo proizvajalca \u2013 v tem primeru Fortinet. O tem, da se vsak primer, povezan z VXLAN, za\u010dne z vpra\u0161anjem \"kje imate v nastavitvah softverskega stikala VLAN-VXLAN?\" se niti ne poglabljam. Tokrat so mi svetovali, naj spremenim MTU \u2013 to je za Ping, ki je 32 bajtov. Potem \"igraj se\" s tcp-send-mss in tcp-receive-mss v politiki \u2013 za VXLAN, ki je incapsuliran v UDP. Uf, oprostite \u2013 nabralo se je. Na splo\u0161no sem to te\u017eavo re\u0161il sam. <\/p>\n

After successfully testing the traffic, it was decided to implement this solution. And in production, it turned out that after a day or two, everything monitored through VXLAN gradually disconnects entirely. Deactivating\/activating the interface helped, but only temporarily. Knowing the sluggishness of the manufacturer's support, I took on troubleshooting myself \u2014 after all, my company, my network \u2014 my responsibility. <\/p>\n

Troubleshooting progress under the spoiler. Those tired of letters and boasting \u2014 skip ahead to the post-analysis.<\/p>\n

Troubleshooting progress<\/b>Thank you for continuing to read \u2014 let's continue!<\/p>\n

So, monitoring works for some time, then disconnects on its own. This means there are probably no issues in the firewall policies. However, since I've encountered problems with hanging system processes in Fortigate versions 5.6+, the first thing we check is 'diagnose debug flow' \u2014 as expected, traffic is allowed and leaves the interface, and as expected, nothing comes back in response. This means we dig further down the stack. Unfortunately, I will have to hide addresses even if they are RFC1918, but I hope to provide enough description for understanding. The server inside the VXLAN has the address x.x.x.15, the Fortigate interface x.x.x.254, and all other addresses belong to the VTEP network.<\/p>\n

Za uspe\u0161no prenos VXLAN encapsulated paketov je potrebno, da so informacije pravilne v ve\u010d tabelah. Za overlay to sta ARP in OVSDB, za underlay pa ARP in CAM. V primeru Fortigate je VXLAN FDB pravzaprav OVSDB. Tam bomo za\u010deli:<\/p>\n

 fortigate (root) #diag sys vxlan fdb list vxlan-LS\nmac=00:50:56:8f:3f:5a state=0x0002 flags=0x00 remote_ip=\u0443.\u0443.\u0443.47 port=4789 vni=5008 ifindex=7\n<\/code><\/pre>\n
\nTukaj je vse zelo preprosto \u2014 MAC naslov virtualnega stroja mora biti na VTEP z naslovom \u0443.\u0443.\u0443.47. Ko pogledam vsebino in nastavitve ESXI grozda, ugotovim, da je MAC virtualnega stroja pravilen, naslov VTEP prav tako. Preverim CAM\/ARP tabelo na Fortigate \u2014 spet vse ustreza nastavitvam ESXI gostitelja:<\/p>\n
fortigate (root) #get sys arp | grep \u0443.\u0443.\u0443.47\n\u0443.\u0443.\u0443.47 0 00:50:56:65:f6:2c dmz\n<\/code><\/pre>\n
\nTabele so pravilne in promet gre \u2013 morda te\u017eava ni na Fortigate-u? Namenoma sem presko\u010dil analizo preklopa prometa na Juniperju \u2013 logi\u010dno je, da mora tukaj potekati naslednji korak odpravljanja te\u017eav, toda moja omre\u017eja so preprosta \u2013 samo en VLAN za VTEP in vsi komponenti so neposredno povezani. Poleg tega se spominjam primera z DLR mostom, VDR in izgubljenim prometom \u2013 grem sniffati na ESXI gostitelju, hkrati pa ustvarjam primer \u017ee za VMware. Spodaj MAC \"97:6e\" pripada fortiku, vmnic1 \u2013 to je vmesnik, ki ima VTEP s naslovom u.u.u.47 sniffamo v obeh smereh \"\u2014dir 2\".<\/p>\n
pktcap-uw --uplink vmnic1 --vni 5008  --mac 90:6c:ac:a9:97:6e --dir 2 -o \/tmp\/monitor.pcap\n<\/code><\/pre>\n
\n\"VXLAN
\n
\nNapredek \u2014 v snifanju vidim ARP zahtevo in prejet odgovor. Prikazujem samo ARP odgovor in tam je vse pravilno. Nisem omenil, toda ves ta \u010das stre\u017enik za spremljanje ping-a naslov \u0445.\u0445.\u0445.15 \u2014 kje je torej ICMP promet? Spomnim se, da imam dva uplinka. Tukaj bi se dalo trditi, da je virtualni izvorni port enak (moja politika skupinskega povezovanja), torej bi moral za isto vNIC vybrati en in isti uplink, vendar ko sem \u017ee na gostitelju, ni problema preveriti drugega uplinka:<\/p>\n
pktcap-uw --uplink vmnic4 --vni 5008  --mac 90:6c:ac:a9:97:6e --dir 2 -o \/tmp\/monitor.pcap\n<\/code><\/pre>\n
\n\"VXLAN
\n
\n\u041f\u0440\u0438\u0445\u043e\u0434\u0438\u0442 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043e\u0442 Fortigate, \u043d\u043e \u043e\u0442\u0432\u0435\u0442\u043e\u0432 \u043d\u0435 \u043f\u043e\u0441\u0442\u0443\u043f\u0430\u0435\u0442. \u042d\u0442\u043e \u044f\u0432\u043d\u043e \u0441\u0432\u0438\u0434\u0435\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0443\u0435\u0442 \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043d\u0435 \u0432 Fortigate. \u042f \u0441\u043d\u043e\u0432\u0430 \u0437\u0430\u0434\u0443\u043c\u044b\u0432\u0430\u044e\u0441\u044c: \u0432\u043d\u043e\u0432\u044c \u0442\u0430 \u0436\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441 \u043f\u0440\u043e\u043f\u0430\u0434\u0430\u043d\u0438\u0435\u043c \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043d\u0430 VDR, \u0441\u043d\u043e\u0432\u0430 \u043f\u0440\u0438\u0434\u0435\u0442\u0441\u044f \u043f\u043e\u0442\u0440\u0430\u0442\u0438\u0442\u044c \u043f\u0430\u0440\u0443 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u043d\u0430 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u044d\u0442\u043e\u0433\u043e \u0432\u043e\u043f\u0440\u043e\u0441\u0430. \u0427\u0435\u0440\u0435\u0437 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0434\u043d\u0435\u0439, \u043e\u0441\u0442\u0430\u0432\u0438\u0432 \u044d\u043c\u043e\u0446\u0438\u0438 \u043f\u043e\u0437\u0430\u0434\u0438 \u0438 \u043d\u0435 \u0436\u0435\u043b\u0430\u044f \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u044e \u043a\u0430\u043a \u0434\u0430\u043d\u043d\u043e\u0441\u0442\u044c, \u0440\u0435\u0448\u0438\u043b \u0441\u043e\u0431\u0440\u0430\u0442\u044c \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0441\u043d\u0438\u0444\u0444\u044b \u0434\u043b\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438, \u0447\u0442\u043e\u0431\u044b \u0443\u0441\u043a\u043e\u0440\u0438\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u0441\u0441. \u0418 \u0442\u0443\u0442 \u043c\u043e\u0439 \u0432\u0437\u0433\u043b\u044f\u0434 \"\u0441\u043b\u0443\u0447\u0430\u0439\u043d\u043e\" \u043f\u0430\u0434\u0430\u0435\u0442 \u043d\u0430 Ethernet \u0438\u043d\u043a\u0430\u043f\u0441\u0443\u043b\u044f\u0446\u0438\u044e underlay. \u0426\u0430\u0440\u044c-\u0442\u043e \u043d\u0435 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0438\u0439, \u0438 MAC-\u0430\u0434\u0440\u0435\u0441 VTEP \u043d\u0435 \u0441\u043e\u0432\u043f\u0430\u0434\u0430\u0435\u0442 \u0441 \u0435\u0433\u043e IP. \u0421\u0431\u0440\u0430\u0441\u044b\u0432\u0430\u044e \u0432 \u043d\u043e\u043b\u044c, \u0441\u043d\u0438\u0444\u043b\u044e, \u0432\u044b\u044f\u0441\u043d\u044f\u044e \u2014 \u0432\u0435\u0440\u043d\u043e \u0438\u043b\u0438 \u043d\u0435 \u0432\u0435\u0440\u043d\u043e. \u041f\u0440\u0438\u0432\u0435\u0434\u0443 ARP \u0442\u0430\u0431\u043b\u0438\u0446\u0443 \u0440\u044f\u0434\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u0431\u044b\u043b\u043e \u0443\u0434\u043e\u0431\u043d\u0435\u0435 \u0441\u0440\u0430\u0432\u043d\u0438\u0432\u0430\u0442\u044c. \u041e\u0431\u0440\u0430\u0442\u0438\u0442\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u043f\u0435\u0440\u0432\u0443\u044e Ethernet \u0438\u043d\u043a\u0430\u043f\u0441\u0443\u043b\u044f\u0446\u0438\u044e \u043d\u0430 \u043a\u0430\u0440\u0442\u0438\u043d\u043a\u0435 \u0441\u0432\u0435\u0440\u0445\u0443:<\/p>\n
fortigate (root) #get sys arp | grep \u0443.\u0443.\u0443.47\n\u0443.\u0443.\u0443.47 0 00:50:56:65:f6:2c dmz\nfortigate (root) #get sys arp | grep \u0443.\u0443.\u0443.42\n\u0443.\u0443.\u0443.42 0 00:50:56:6a:78:86 dmz\n<\/code><\/pre>\n
\n\u0418\u0442\u0430\u043a, \u0447\u0442\u043e \u043c\u044b \u0438\u043c\u0435\u0435\u043c \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u2014 \u043f\u043e\u0441\u043b\u0435 \u043c\u0438\u0433\u0440\u0430\u0446\u0438\u0438 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u044b, Fortigate \u043f\u044b\u0442\u0430\u0435\u0442\u0441\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a \u043d\u0430 VTEP \u0438\u0437 (\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439) VXLAN FDB, \u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u044b\u0439 DST MAC, \u0438 \u0442\u0440\u0430\u0444\u0438\u043a \u043e\u0436\u0438\u0434\u0430\u0435\u043c\u043e \u043e\u0442\u0431\u0440\u0430\u0441\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u043e\u043c \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0430. \u0412 \u043e\u0434\u043d\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u0438\u0437 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u044d\u0442\u043e\u0442 MAC \u043f\u0440\u0438\u043d\u0430\u0434\u043b\u0435\u0436\u0430\u043b \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u043c\u0443 \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0443, \u0441 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043d\u0430\u0447\u0438\u043d\u0430\u043b\u0438 \u043c\u0438\u0433\u0440\u0430\u0446\u0438\u044e \u043c\u0430\u0448\u0438\u043d\u044b.<\/p>\n
\u0412\u0447\u0435\u0440\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u043f\u0438\u0441\u044c\u043c\u043e \u043e\u0442 \u0442\u0435\u0445\u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 Fortinet \u2014 \u043f\u043e \u043c\u043e\u0435\u043c\u0443 \u0437\u0430\u043f\u0440\u043e\u0441\u0443 \u043e\u0442\u043a\u0440\u044b\u043b\u0438 \u0431\u0430\u0433 615586. \u041f\u0440\u044f\u043c \u043d\u0435 \u0437\u043d\u0430\u044e, \u0440\u0430\u0434\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0438\u043b\u0438 \u043e\u0433\u043e\u0440\u0447\u0430\u0442\u044c\u0441\u044f: \u0441 \u043e\u0434\u043d\u043e\u0439 \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u2014 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043d\u0435 \u0432 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u0445, \u0441 \u0434\u0440\u0443\u0433\u043e\u0439 \u2014 \u0444\u0438\u043a\u0441 \u043f\u0440\u0438\u0434\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0441 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438, \u0432 \u043b\u0443\u0447\u0448\u0435\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u0432 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u043c. \u0417\u0430 \u0441\u0447\u0451\u0442 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u043e\u0433\u043e \u0427\u0421\u0412 \u0442\u0430\u043a\u0436\u0435 \u0441\u0442\u0430\u043b\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e \u043f\u0440\u043e \u0435\u0449\u0435 \u043e\u0434\u0438\u043d \u0431\u0430\u0433, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u044f \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u043c\u0435\u0441\u044f\u0446\u0435, \u043f\u0440\u0430\u0432\u0434\u0430, \u0432 \u0442\u043e\u0442 \u0440\u0430\u0437 \u0432 HTML5 GUI vSphere. \u041f\u0440\u044f\u043c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0439 QA \u043e\u0442\u0434\u0435\u043b \u0432\u0435\u043d\u0434\u043e\u0440\u043e\u0432...<\/p>\n
\u0420\u0438\u0441\u043a\u043d\u0443 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u044c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0435:<\/p>\n
1 \u2014 multicast control plane, \u0441\u043a\u043e\u0440\u0435\u0435 \u0432\u0441\u0435\u0433\u043e, \u043d\u0435 \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u0430 \u043e\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u2014 \u0432\u0435\u0434\u044c MAC-\u0430\u0434\u0440\u0435\u0441\u0430 VTEP \u043f\u043e\u043b\u0443\u0447\u0430\u044e\u0442 \u0438\u0437 IP-\u0430\u0434\u0440\u0435\u0441\u0430 \u0433\u0440\u0443\u043f\u043f\u044b, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441. <\/p>\n
2 \u2014 \u0441\u043a\u043e\u0440\u0435\u0435 \u0432\u0441\u0435\u0433\u043e, \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 Fortigate \u0432 \u043e\u0444\u0444\u043b\u043e\u0430\u0434\u0435 \u0441\u0435\u0441\u0441\u0438\u0439 \u043d\u0430 Network Processor (\u043f\u0440\u0438\u0431\u043b\u0438\u0437\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0430\u043d\u0430\u043b\u043e\u0433 CEF) \u2014 \u0435\u0441\u043b\u0438 \u043a\u0430\u0436\u0434\u044b\u0439 \u043f\u0430\u043a\u0435\u0442 \u043f\u0440\u043e\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0447\u0435\u0440\u0435\u0437 CPU, \u0431\u0443\u0434\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0442\u0430\u0431\u043b\u0438\u0446\u044b, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u2014 \u0432\u043e \u0432\u0441\u044f\u043a\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u0432\u0438\u0437\u0443\u0430\u043b\u044c\u043d\u043e. \u0412 \u043f\u043e\u043b\u044c\u0437\u0443 \u044d\u0442\u043e\u0433\u043e \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0433\u043e\u0432\u043e\u0440\u0438\u0442 \u0442\u043e, \u0447\u0442\u043e \u043f\u043e\u043c\u043e\u0433\u0430\u0435\u0442 \u0437\u0430\u043a\u0440\u044b\u0442\u044c\/\u043e\u0442\u043a\u0440\u044b\u0442\u044c \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u0438\u043b\u0438 \u043f\u043e\u0434\u043e\u0436\u0434\u0430\u0442\u044c \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0432\u0440\u0435\u043c\u044f \u2014 \u0431\u043e\u043b\u0435\u0435 5 \u043c\u0438\u043d\u0443\u0442. <\/p>\n
3 \u2014 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043d\u0430 explicit failover, \u0438\u043b\u0438 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 LAG, \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u043d\u0435 \u0440\u0435\u0448\u0438\u0442, \u0442\u0430\u043a \u043a\u0430\u043a \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u043e\u0441\u044c \u00ab\u0437\u0430\u0441\u0442\u0440\u0435\u0432\u0430\u043d\u0438\u0435\u00bb MAC \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u0433\u043e \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0430 \u0432 \u0438\u043d\u043a\u0430\u043f\u0441\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u0430\u0445.<\/p>\n
\u0412 \u0441\u0432\u0435\u0442\u0435 \u044d\u0442\u043e\u0433\u043e \u043c\u043e\u0433\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f, \u0447\u0442\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0442\u043a\u0440\u044b\u043b \u0434\u043b\u044f \u0441\u0435\u0431\u044f blog<\/a><\/noindex>, kjer je bilo v enem izmed \u010dlankov trditev, da so stetfull po\u017earni zidovi in predpomnilni\u0161ki na\u010dini prenosa podatkov le re\u0161itev na hitro. No, nisem tako izku\u0161en v IT, da bi lahko trdil kaj takega, prav tako se ne strinjam s \u0161tevilnimi trditvami blogov. Vendar mi nekako govori, da je v Ivanovih besedah nekaj resnice.<\/p>\n
Hvala za pozornost! Z veseljem bom odgovoril na vpra\u0161anja in prisluhnil konstruktivni kritiki.
\n
Izvor: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u041f\u0440\u0438\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e, \u0438 \u0441\u043f\u0435\u0440\u0432\u0430 \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u043b\u0438\u0440\u0438\u043a\u0438. \u042f \u0438\u043d\u043e\u0433\u0434\u0430 \u0437\u0430\u0432\u0438\u0434\u0443\u044e \u043a\u043e\u043b\u043b\u0435\u0433\u0430\u043c, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u043c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u2014 \u0432\u0435\u0434\u044c \u044d\u0442\u043e \u043f\u0440\u0435\u043a\u0440\u0430\u0441\u043d\u043e \u0438\u043c\u0435\u0442\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0438\u0437 \u043b\u044e\u0431\u043e\u0433\u043e \u043a\u043e\u043d\u0446\u0430 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u043e\u0433\u043e \u043a Internet \u043c\u0438\u0440\u0430, \u043a\u0430\u043d\u0438\u043a\u0443\u043b\u044b \u0432 \u043b\u044e\u0431\u043e\u0435 \u0432\u0440\u0435\u043c\u044f, \u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u0437\u0430 \u043f\u0440\u043e\u0435\u043a\u0442\u044b \u0438 \u0434\u0435\u0434\u043b\u0430\u0439\u043d\u044b, \u0430 \u043d\u0435 \u043d\u0430\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u0435 \u0432 \u043e\u0444\u0438\u0441\u0435 \u0441 8 \u0434\u043e 17. \u041c\u043e\u044f \u043f\u043e\u0437\u0438\u0446\u0438\u044f \u0438 \u0440\u0430\u0431\u043e\u0447\u0438\u0435 \u043e\u0431\u044f\u0437\u0430\u043d\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0438\u0441\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0434\u043e\u043b\u0433\u043e\u0433\u043e \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u0432 \u0434\u0430\u0442\u0430\u0446\u0435\u043d\u0442\u0440\u0435. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":73233,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-73232","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47VXLAN v NSX-V \u2014 re\u0161ujemo te\u017eave underlay | ProHoster","description":"Pozdravljeni, najprej pa malo lirike.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/vxlan-v-nsx-v-trablshutim-underlay","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47VXLAN \u0432 NSX-V \u2014 \u0442\u0440\u0430\u0431\u043b\u0448\u0443\u0442\u0438\u043c underlay | ProHoster","og:description":"\u041f\u0440\u0438\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e, \u0438 \u0441\u043f\u0435\u0440\u0432\u0430 \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u043b\u0438\u0440\u0438\u043a\u0438.","og:url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/vxlan-v-nsx-v-trablshutim-underlay","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-08T05:42:18+00:00","article:modified_time":"2020-03-08T05:42:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"73232","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:36:23","updated":"2022-09-27 15:26:08","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/73232","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=73232"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/73232\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media\/73233"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=73232"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=73232"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=73232"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}