ProHoster > Blog > Utongi > VxLAN fekitari. Chikamu 2

VxLAN fekitari. Chikamu 2

Hei Habr. Ini ndinoenderera mberi nenhevedzano yezvinyorwa paVxLAN EVPN tekinoroji, iyo zvakanyorwa zvakanangana kutangwa kwekosi "Network engineer" na OTUS. Uye nhasi tichatarisa chikamu chinonakidza chemabasa - routing. Hazvina mhosva kuti inganzwika sei, zvisinei, sechikamu chebasa refekitari yetiweki, zvese zvinogona kunge zvisiri nyore.

VxLAN fekitari. Chikamu 2

1 chikamu chekutenderera - L2 yekubatanidza pakati pemaseva

Muchikamu chekupedzisira, takawana imwe nhepfenyuro yakavakirwa pamusoro pemucheka wetiweki paNexus 9000v. Zvisinei, iyi haisi iyo yose yakawanda yemabasa inoda kugadziriswa mukati mehutano hwe data center network. Uye nhasi tichaona rinotevera basa - routing pakati network kana pakati VNIs.

Rega ndikuyeuchidze kuti Spine-Leaf topology inoshandiswa:

VxLAN fekitari. Chikamu 2

Kutanga, isu tichaongorora kuti routing inoitika sei uye kuti ine maitiro api.

Kuti tinzwisise, ngatirerutse dhiyagiramu yepfungwa uye tiwedzere imwe VNI 20000 yeHost-2. Mhedzisiro yacho ndeiyi:

VxLAN fekitari. Chikamu 2

Sei, mune iyi kesi, iwe unogona kuendesa traffic kubva kune imwe Host kuenda kune imwe?

Pane sarudzo mbiri:

  1. Chengetedza ruzivo nezve maVNI ese pane ese Leaf switch, ipapo zvese routing zvichaitika paLeaf rekutanga mune network;
  2. Shandisa yakatsaurirwa - L3 VNI

Nzira yekutanga iri nyore uye yakanakira. Sezvo iwe uchingoda kutanga maVNI ese pane ese Leaf switch. Nekudaro, kumhanya mazana mashoma kana zviuru zveVNIs paLeaf rose hazvichaite senge basa riri nyore. Nokudaro, mubasa rinoshandiswa kashoma.

Isu tichaongorora nzira 2, seyakanyanya kunakidza uye zvishoma yakaoma, asi ichipa kuchinjika kwakawanda mukumisa fekitori.

Ngatiwedzerei "PROD" kune iyo VRF topology. Ngatiwedzerei interface vlan 10 kwairi paLeaf-11/12 peya uye interface VLAN 20 paLeaf-21. VLAN 20 yakabatana neVNI 20000

vrf context PROD
  rd auto       ! Route Distinguisher Π½Π΅ ΠΏΡ€ΠΈΠ½Ρ†ΠΈΠΏΠΈΠ°Π»Π΅Π½ ΠΈ ΠΌΠΎΠΆΠ΅ΠΌ ΠΈΡΠΏΠΎΠ»ΡŒΠ·ΠΎΠ²Π°Ρ‚ΡŒ сформированный автоматичСски
  address-family ipv4 unicast
    route-target both auto      ! ΡƒΠΊΠ°Π·Ρ‹Π²Π°Π΅ΠΌ Route-target с ΠΊΠΎΡ‚ΠΎΡ€Ρ‹ΠΌ Π±ΡƒΠ΄ΡƒΡ‚ ΠΈΠΌΠΏΠΎΡ€Ρ‚ΠΈΡ€ΠΎΠ²Π°Ρ‚ΡŒΡΡ ΠΈ ΡΠΊΡΠΏΠΎΡ€Ρ‚ΠΈΡ€ΠΎΠ²Π°Ρ‚ΡŒΡΡ прСфиксы Π²/ΠΈΠ· VRF
vlan 20
  vn-segment 20000

interface nve 1
  member vni 20000
    ingress-replication protocol bgp

interface Vlan10
  no shutdown
  vrf member PROD
  ip address 192.168.20.1/24
  fabric forwarding mode anycast-gateway

Kuti ushandise L3VNI, unofanirwa kugadzira VLAN itsva, kuibatanidza neVNI itsva. Iyo VNI itsva inofanirwa kunge yakafanana paMashizha ese anofarira VLAN 10 uye 20 ruzivo.

vlan 99
  vn-segment 99000

interface nve1
  member vni 99000 associate-vrf        ! Π‘ΠΎΠ·Π΄Π°Π΅ΠΌ L3 VNI

vrf context PROD
  vni 99000                             ! ΠŸΡ€ΠΈΠ²ΡΠ·Ρ‹Π²Π°Π΅ΠΌ L3 VNI ΠΊ ΠΎΠΏΡ€Π΅Π΄Π΅Π»Π΅Π½Π½ΠΎΠΌΡƒ VRF

Nekuda kweizvozvo, iyo dhizaini ichaita seizvi:

VxLAN fekitari. Chikamu 2

Inoramba ichipedzisa zvishoma - wedzera imwezve interface - interface vlan 99 muVRF PROD

interface Vlan99
  no shutdown
  vrf member PROD
  ip forward  ! На интСрфСйсС Π½Π΅ Π΄ΠΎΠ»ΠΆΠ½ΠΎ Π±Ρ‹Ρ‚ΡŒ IP. Π˜ΡΠΏΠΎΠ»ΡŒΠ·ΡƒΠ΅Ρ‚ΡΡ Ρ‚ΠΎΠ»ΡŒΠΊΠΎ для пСрСсылки ΠΏΠ°ΠΊΠ΅Ρ‚ΠΎΠ² ΠΌΠ΅ΠΆΠ΄Ρƒ Leaf

Nekuda kweizvozvo, pfungwa yekupfuudza furemu kubva kuHost-1 kuenda kuHost-2 ndeiyi inotevera:

  1. Chimiro chakatumirwa neHost-1 chinosvika paLeaf muVLAN 10, iyo inosanganiswa neVNI 10000;
  2. Leaf inotarisa kuti kero yekuenda iri papi uye inoiwana kuburikidza neL3 VNI pane yechipiri Leaf switch;
  3. Pangosvika nzira yekuenda kukero yekuenda yawanikwa, Leaf inorongedza furemu mumusoro ine inodiwa L3VNI 99000 - uye inoitumira kune yechipiri Leshi;
  4. Yechipiri Leaf switch inogamuchira data kubva kuL3VNI 99000. Inotora furemu yepakutanga uye inoiendesa kune inodiwa L2VNI 20000 uyezve kuVLAN 20.

Nekuda kwebasa iri, L3VNI inobvisa kudiwa kwekuchengeta ruzivo nezve maVNI ese ari pane network pane ese Leaf switch.

Nekuda kweizvozvo, patinotumira traffic kubva kuHost-1 kuenda kuHost-2, iyo pakiti yakazara mukati meVxLAN neVNI itsva - 99000:

VxLAN fekitari. Chikamu 2

Zvinoramba zvichionekwa kuti Leaf-1 inodzidza sei nezvekero yeMAC kubva kune imwe VNI. Izvi zvinoitikawo nerubatsiro rweEVPN nzira-rudzi rwechipiri (MAC / IP).

Inotevera inoratidza maitiro ekuparadzira nzira nezve prefix iri mune imwe VNI:

VxLAN fekitari. Chikamu 2

Ndiko kuti, kero dzakagamuchirwa kubva kuVNI 20000 dzine maRT maviri.
Rega ndikuyeuchidze kuti nzira dzakagamuchirwa kubva kuKugadziridza dzinowira mutafura yeBGP ine Route-chinangwa chakatsanangurwa muVRF marongero (maitiro acho akanyanya kuoma, asi isu hatipinde muchinyorwa chino).
Iyo RT pachayo inoumbwa neformula: AS: VNI ​​(kana otomatiki modhi inoshandiswa).

Muenzaniso wekuumbwa kweRT mune otomatiki uye manyore modhi:

vrf context PROD
  address-family ipv4 unicast
    route-target import auto - автоматичСский Ρ€Π΅ΠΆΠΈΠΌ Ρ€Π°Π±ΠΎΡ‚Ρ‹
    route-target export 65001:20000 - Ρ€ΡƒΡ‡Π½ΠΎΠΉ Ρ€Π΅ΠΆΠΈΠΌ формирования RT

Nekuda kweizvozvo, iwe unogona kuona pamusoro kuti prefixes kubva kune imwe VNI ine maviri RT maitiro.
Imwe yacho 65001:99000 ndeyekuwedzera L3 VNI. Sezvo iyi VNI yakafanana paMashizha ese uye ichiwira pasi pemitemo yedu yekupinza muVRF marongero, prefix inopinda mutafura yeBGP, iyo inogona kuoneka kubva pane inobuda:

sh bgp l2vpn evpn
<.....>
   Network            Next Hop            Metric     LocPrf     Weight Path
Route Distinguisher: 10.255.1.11:32777    (L2VNI 10000)
*>l[2]:[0]:[0]:[48]:[5001.0007.0007]:[0]:[0.0.0.0]/216
                      10.255.1.10                       100      32768 i
*>l[2]:[0]:[0]:[48]:[5001.0007.0007]:[32]:[192.168.10.10]/272
                      10.255.1.10                       100      32768 i
*>l[3]:[0]:[32]:[10.255.1.10]/88
                      10.255.1.10                       100      32768 i

Route Distinguisher: 10.255.1.21:32787
* i[2]:[0]:[0]:[48]:[5001.0008.0007]:[32]:[192.168.20.20]/272    ! ΠŸΡ€Π΅Ρ„ΠΈΠΊΡ ΠΏΠΎΠ»ΡƒΡ‡Π΅Π½Π½Ρ‹ΠΉ ΠΈΠ· VNI 20000
                      10.255.1.20                       100          0 i
*>i                   10.255.1.20                       100          0 i

Kana tikanyatso tarisisa iyo yakagamuchirwa yekuvandudza, tinogona kuona kuti prefix iyi ine maviri maRTs:

Leaf11# sh bgp l2vpn evpn 5001.0008.0007
BGP routing table information for VRF default, address family L2VPN EVPN
Route Distinguisher: 10.255.1.21:32787
BGP routing table entry for [2]:[0]:[0]:[48]:[5001.0008.0007]:[32]:[192.168.20.2
0]/272, version 5164
Paths: (2 available, best #2)
Flags: (0x000202) (high32 00000000) on xmit-list, is not in l2rib/evpn, is not i
n HW

  Path type: internal, path is valid, not best reason: Neighbor Address, no labeled nexthop
  AS-Path: NONE, path sourced internal to AS
    10.255.1.20 (metric 81) from 10.255.1.102 (10.255.1.102)
      Origin IGP, MED not set, localpref 100, weight 0
      Received label 20000 99000                                 ! Π”Π²Π° label для Ρ€Π°Π±ΠΎΡ‚Ρ‹ VxLAN
      Extcommunity: RT:65001:20000 RT:65001:99000 SOO:10.255.1.20:0 ENCAP:8     ! Π”Π²Π° значСния Route-target, Π½Π° основС, ΠΊΠΎΡ‚ΠΎΡ€Ρ‹Ρ… Π΄ΠΎΠ±Π°Π²ΠΈΠ»ΠΈ Π΄Π°Π½Π½Ρ‹ΠΉ прСфикс
          Router MAC:5001.0005.0007
      Originator: 10.255.1.21 Cluster list: 10.255.1.102
<......>

Mutafura yekufambisa paLeaf-1, unogonawo kuona prefix 192.168.20.20/32:

Leaf11# sh ip route vrf PROD
192.168.10.0/24, ubest/mbest: 1/0, attached
    *via 192.168.10.1, Vlan10, [0/0], 01:29:28, direct
192.168.10.1/32, ubest/mbest: 1/0, attached
    *via 192.168.10.1, Vlan10, [0/0], 01:29:28, local
192.168.10.10/32, ubest/mbest: 1/0, attached
    *via 192.168.10.10, Vlan10, [190/0], 01:27:22, hmm
192.168.20.20/32, ubest/mbest: 1/0                                        ! АдрСс Host-2
    *via 10.255.1.20%default, [200/0], 01:20:20, bgp-65001, internal, tag 65001     ! Доступный Ρ‡Π΅Ρ€Π΅Π· Leaf-2
(evpn) segid: 99000 tunnelid: 0xaff0114 encap: VXLAN                                ! Π§Π΅Ρ€Π΅Π· VNI 99000

Waona chivakashure chepakutanga chisipo 192.168.20.0/24 patafura yekufambisa?
Ndizvozvo, haapo. Kureva kuti, Mashizha ari kure anogashira ruzivo chete nezvevatambi vari panetiweki yako. Uye iyi ndiyo maitiro echokwadi. Pamusoro, mune zvese zvigadziriso, iwe unogona kuona iyo ruzivo runouya nezviri mukati MAC / IP. Hapana prefixes yekutaura nezvayo.

Iyi ndiyo Host Mobility Manager (HMM) protocol, iyo inozadza tafura yeARP kubva iyo tafura yeBGP inozadzwazve (tichasiya maitiro aya mukati megadziriro yechinyorwa chino). Zvichienderana neruzivo rwakagamuchirwa kubva kuHMM, nzira-yemhando yechipiri EVPNs inogadzirwa (inofambiswa neMAC / IP).

Nekudaro, ko kana paine kudikanwa kwekupfuudza ruzivo nezve prefix?

Kune iyi mhando yeruzivo, pane EVPN nzira-rudzi 5 - inokutendera kuti utumire prefixes kuburikidza nekero-mhuri l2vpn evpn (rudzi urwu rwenzira panguva yekunyora uku inongori mushanduro yekunyora. RFC, nekuda kweizvi, vagadziri vakasiyana vanogona kuve nemaitiro akasiyana emhando iyi yenzira)

Kuendesa prefixes, zvinodikanwa kuwedzera prefixes muBGP maitiro eVRF, ayo achashambadzirwa:

router bgp 65001
  vrf PROD
    address-family ipv4 unicast
      redistribute direct route-map VNI20000        ! Π’ Π΄Π°Π½Π½ΠΎΠΌ случаС анонсируСм прСфиксы ΠΏΠΎΠ΄ΠΊΠ»ΡŽΡ‡Π΅Π½ΠΈΠ΅ нСпосрСдствСнно ΠΊ Leaf Π² VNI 20000
route-map VNI20000 permit 10
  match ip address prefix-list VNI20000_OUT    ! Π£ΠΊΠ°Π·Ρ‹Π²Π°Π΅ΠΌ ΠΊΠ°ΠΊΠΎΠΉ ΠΈΡΠΏΠΎΠ»ΡŒΠ·ΠΎΠ²Π°Ρ‚ΡŒ prefix-list

ip prefix-list VNI20000_OUT seq 5 permit 192.168.20.0/24   ! Π£ΠΊΠ°Π·Ρ‹Π²Π°Π΅ΠΌ ΠΊΠ°ΠΊΠΈΠ΅ сСти Π±ΡƒΠ΄ΡƒΡ‚ ΠΏΠΎΠΏΠ°Π΄Π°Ρ‚ΡŒ Π² EVPN route-type 5

Nekuda kweizvozvo, Update ichave:

VxLAN fekitari. Chikamu 2

Ngatitarisei patafura yeBGP. Pamusoro peEVPN nzira-rudzi 2,3, mhando 5 nzira dzakaonekwa dzine ruzivo nezve nhamba yetiweki:

<......>
   Network            Next Hop            Metric     LocPrf     Weight Path
Route Distinguisher: 10.255.1.11:3
* i[5]:[0]:[0]:[24]:[192.168.10.0]/224
                      10.255.1.10              0        100          0 ?
*>i                   10.255.1.10              0        100          0 ?

Route Distinguisher: 10.255.1.11:32777
* i[2]:[0]:[0]:[48]:[5001.0007.0007]:[0]:[0.0.0.0]/216
                      10.255.1.10                       100          0 i
*>i                   10.255.1.10                       100          0 i
* i[2]:[0]:[0]:[48]:[5001.0007.0007]:[32]:[192.168.10.10]/272
                      10.255.1.10                       100          0 i
*>i                   10.255.1.10                       100          0 i
* i[3]:[0]:[32]:[10.255.1.10]/88
                      10.255.1.10                       100          0 i
*>i                   10.255.1.10                       100          0 i

Route Distinguisher: 10.255.1.12:3
*>i[5]:[0]:[0]:[24]:[192.168.10.0]/224      ! EVPN route-type 5 с Π½ΠΎΠΌΠ΅Ρ€ΠΎΠΌ прСфикса
                      10.255.1.10              0        100          0 ?
* i
<.......>

Chivakashure chakaonekwawo patafura yenzira:

Leaf21# sh ip ro vrf PROD
192.168.10.0/24, ubest/mbest: 1/0
    *via 10.255.1.10%default, [200/0], 00:14:32, bgp-65001, internal, tag 65001  ! Π£Π΄Π°Π»Π΅Π½Π½Ρ‹ΠΉ прСфикс, доступный Ρ‡Π΅Ρ€Π΅Π· Leaf1/2(адрСс Next-hop = virtual IP ΠΌΠ΅ΠΆΠ΄Ρƒ ΠΏΠ°Ρ€ΠΎΠΉ VPC)
(evpn) segid: 99000 tunnelid: 0xaff010a encap: VXLAN      ! ΠŸΡ€Π΅Ρ„ΠΈΠΊΡ доступСн Ρ‡Π΅Ρ€Π΅Π· L3VNI 99000

192.168.10.10/32, ubest/mbest: 1/0
    *via 10.255.1.10%default, [200/0], 02:33:40, bgp-65001, internal, tag 65001
(evpn) segid: 99000 tunnelid: 0xaff010a encap: VXLAN

192.168.20.0/24, ubest/mbest: 1/0, attached
    *via 192.168.20.1, Vlan20, [0/0], 02:39:44, direct
192.168.20.1/32, ubest/mbest: 1/0, attached
    *via 192.168.20.1, Vlan20, [0/0], 02:39:44, local
192.168.20.20/32, ubest/mbest: 1/0, attached
    *via 192.168.20.20, Vlan20, [190/0], 02:35:46, hmm

Izvi zvinopedzisa chikamu chechipiri chezvinyorwa zveVxLAN EVPN. Muchikamu chinotevera, tichatarisa nzira dzakasiyana siyana dzekufambisa pakati peVRFs.

Zvinokosha zveIPv6 uye kuti yakasiyana sei neIPv4

Source: www.habr.com

Voeg