ProHoster > Π‘Π»ΠΎΠ³ > Maamulka > warshad VxLAN. Qaybta 2

warshad VxLAN. Qaybta 2

Haye Habr. Waxaan sii wadaa maqaallada taxanaha ah ee VxLAN EVPN technology, kaas oo waxaa si gaar ah loogu qoray daah-furka koorsada "Injineer shabakadeed" by OTUS. Oo maanta waxaan tixgelin doonaa qayb xiiso leh oo ka mid ah hawlaha - wadista. Si kastaba ha ahaatee sida ay u dhawaaqi karto, si kastaba ha ahaatee, iyada oo qayb ka ah shaqada warshad shabakad, wax walba ma noqon karaan kuwo fudud.

warshad VxLAN. Qaybta 2

1 qayb ka mid ah wareegga - L2 isku xirka u dhexeeya server-yada

Qaybtii u dambaysay, waxa aanu ku gaadhnay hal goob baahinta oo laga dul dhisay maro shabakadeed Nexus 9000v. Si kastaba ha ahaatee, tani maaha dhammaan hawlaha kala duwan ee u baahan in lagu xalliyo qaabka shabakadda xarunta xogta. Oo maanta waxaan tixgelin doonaa hawsha soo socota - isku xirka shabakadaha ama inta u dhaxaysa VNIs.

Aan ku xasuusiyo in topology-ga laf dhabarta la isticmaalo:

warshad VxLAN. Qaybta 2

Bilawga, waxaanu falanqeyn doonaa sida uu u dhaco dariiqa iyo sifooyinka uu leeyahay.

Si loo fahmo, aan fududeyno jaantuska macquulka ah oo aan ku darno VNI 20000 kale oo loogu talagalay Host-2. Natiijadu waa:

warshad VxLAN. Qaybta 2

Sidee, kiiskan, aad uga wareejin kartaa taraafikada hal Marti-geliyaha mid kale?

Waxaa jira laba ikhtiyaar:

  1. Ku hay macluumaadka ku saabsan dhammaan VNI-yada dhammaan furayaasha caleenta, ka dib dhammaan dariiqyada waxay ku dhici doonaan caleenta ugu horreysa ee shabakada;
  2. Isticmaal go'an - L3 VNI

Habka ugu horreeya waa mid fudud oo ku habboon. Maadaama aad u baahan tahay oo kaliya inaad ku bilowdo dhammaan VNI-yada dhammaan furayaasha caleenta. Si kastaba ha noqotee, ku socodsiinta dhowr boqol ama kun oo VNIs ah oo ku yaal caleenta oo dhan hadda uma muuqato hawl fudud. Sidaa darteed, shaqada waxaa loo isticmaalaa si dhif ah.

Waxaan falanqayn doonaa habka 2, sida aad u xiiso badan oo waxoogaa ka sii adag, laakiin siinta dabacsanaan dheeraad ah samaynta warshadda.

Aan kudarno "PROD" VRF topology. Aynu ku darno interface vlan 10 iyada oo ku taal Leaf-11/12 lammaane iyo interface VLAN 20 on Leaf-21. VLAN 20 waxay la xiriirtaa VNI 20000

vrf context PROD
  rd auto       ! Route Distinguisher Π½Π΅ ΠΏΡ€ΠΈΠ½Ρ†ΠΈΠΏΠΈΠ°Π»Π΅Π½ ΠΈ ΠΌΠΎΠΆΠ΅ΠΌ ΠΈΡΠΏΠΎΠ»ΡŒΠ·ΠΎΠ²Π°Ρ‚ΡŒ сформированный автоматичСски
  address-family ipv4 unicast
    route-target both auto      ! ΡƒΠΊΠ°Π·Ρ‹Π²Π°Π΅ΠΌ Route-target с ΠΊΠΎΡ‚ΠΎΡ€Ρ‹ΠΌ Π±ΡƒΠ΄ΡƒΡ‚ ΠΈΠΌΠΏΠΎΡ€Ρ‚ΠΈΡ€ΠΎΠ²Π°Ρ‚ΡŒΡΡ ΠΈ ΡΠΊΡΠΏΠΎΡ€Ρ‚ΠΈΡ€ΠΎΠ²Π°Ρ‚ΡŒΡΡ прСфиксы Π²/ΠΈΠ· VRF
vlan 20
  vn-segment 20000

interface nve 1
  member vni 20000
    ingress-replication protocol bgp

interface Vlan10
  no shutdown
  vrf member PROD
  ip address 192.168.20.1/24
  fabric forwarding mode anycast-gateway

Si aad u isticmaasho L3VNI, waxaad u baahan tahay inaad abuurto VLAN cusub, ku xidho VNI-ga cusub. VNI-da cusub waa in ay la mid noqotaa dhammaan Caleemaha xiisaynaya VLAN 10 iyo 20 macluumaadka.

vlan 99
  vn-segment 99000

interface nve1
  member vni 99000 associate-vrf        ! Π‘ΠΎΠ·Π΄Π°Π΅ΠΌ L3 VNI

vrf context PROD
  vni 99000                             ! ΠŸΡ€ΠΈΠ²ΡΠ·Ρ‹Π²Π°Π΅ΠΌ L3 VNI ΠΊ ΠΎΠΏΡ€Π΅Π΄Π΅Π»Π΅Π½Π½ΠΎΠΌΡƒ VRF

Natiijo ahaan, jaantusku wuxuu u ekaan doonaa sidan:

warshad VxLAN. Qaybta 2

Way hadhsan tahay in la dhammeeyo wax yar - ku dar hal interface kale - interface vlan 99 gudaha VRF PROD

interface Vlan99
  no shutdown
  vrf member PROD
  ip forward  ! На интСрфСйсС Π½Π΅ Π΄ΠΎΠ»ΠΆΠ½ΠΎ Π±Ρ‹Ρ‚ΡŒ IP. Π˜ΡΠΏΠΎΠ»ΡŒΠ·ΡƒΠ΅Ρ‚ΡΡ Ρ‚ΠΎΠ»ΡŒΠΊΠΎ для пСрСсылки ΠΏΠ°ΠΊΠ΅Ρ‚ΠΎΠ² ΠΌΠ΅ΠΆΠ΄Ρƒ Leaf

Natiijo ahaan, macquulka ah ee ka gudbinta jir ka Host-1 ilaa Host-2 waa sida soo socota:

  1. Fareem ay soo dirtay Host-1 ayaa ku dul yimid caleen ku taal VLAN 10, kaas oo la xidhiidha VNI 10000;
  2. Caleentu waxay hubisaa meesha ciwaanka loo socdo oo waxay ka helaysaa L3 VNI ee beddelka caleenta labaad;
  3. Isla marka dariiqa loo maro ciwaanka loo socdo la helo, caleentu waxay ku xidhaa jirkeeda madax leh L3VNI 99000 ee lagama maarmaanka ah - waxayna u dirtaa dhinaca caleenta labaad;
  4. Beddelka caleenta labaad wuxuu helayaa xogta L3VNI 99000. Wuxuu helayaa qaabkii asalka ahaa wuxuuna u gudbiyaa L2VNI 20000 ee loo baahan yahay ka dibna VLAN 20.

Shaqadan awgeed, L3VNI waxay meesha ka saaraysaa baahida lagu hayo macluumaadka ku saabsan dhammaan VNI-yada ku jira shabakadda dhammaan furayaasha caleenta.

Natiijo ahaan, marka aan taraafikada ka dirno Host-1 una dirno Host-2, baakadda waxaa lagu soo buuxiyay VxLAN-ka cusub ee VNI - 99000:

warshad VxLAN. Qaybta 2

Waa la arki doonaa sida saxda ah ee Leaf-1 ay uga ogaato ciwaanka MAC ee VNI kale. Tani waxay sidoo kale ku dhacdaa iyadoo la kaashanayo EVPN-dariiqa 2 (MAC / IP).

Kuwa soo socdaa waxay tusiyaan habka faafinta dariiqa ku saabsan horgalayaasha ku yaal VNI kale:

warshad VxLAN. Qaybta 2

Taasi waa, ciwaanada laga helay VNI 20000 waxay leeyihiin laba RTs.
Aan ku xasuusiyo in dariiqyada laga helay Cusbooneysii ay ku dhacaan miiska BGP-ga oo leh marin-bartilmaameedka ku qeexan goobaha VRF (habku waa yara adag yahay, laakiin ma geli doono maqaalkan).
RT lafteeda waxaa lagu sameeyay qaacidada: AS:VNI (haddii habka tooska ah loo isticmaalo).

Tusaale ahaan samaynta RT ee qaababka tooska ah iyo kuwa gacanta:

vrf context PROD
  address-family ipv4 unicast
    route-target import auto - автоматичСский Ρ€Π΅ΠΆΠΈΠΌ Ρ€Π°Π±ΠΎΡ‚Ρ‹
    route-target export 65001:20000 - Ρ€ΡƒΡ‡Π½ΠΎΠΉ Ρ€Π΅ΠΆΠΈΠΌ формирования RT

Natiijo ahaan, waxaad kor ku arki kartaa horgalayaasha VNI kale waxay leeyihiin laba qiime oo RT ah.
Mid ka mid ah 65001: 99000 waa L3 VNI dheeraad ah. Maaddaama VNI-dani ay la mid tahay dhammaan caleemaha oo ay hoos timaado xeerarka soo dejinta ee goobaha VRF, horgalaha wuxuu galaa miiska BGP, kaas oo laga arki karo wax soo saarka:

sh bgp l2vpn evpn
<.....>
   Network            Next Hop            Metric     LocPrf     Weight Path
Route Distinguisher: 10.255.1.11:32777    (L2VNI 10000)
*>l[2]:[0]:[0]:[48]:[5001.0007.0007]:[0]:[0.0.0.0]/216
                      10.255.1.10                       100      32768 i
*>l[2]:[0]:[0]:[48]:[5001.0007.0007]:[32]:[192.168.10.10]/272
                      10.255.1.10                       100      32768 i
*>l[3]:[0]:[32]:[10.255.1.10]/88
                      10.255.1.10                       100      32768 i

Route Distinguisher: 10.255.1.21:32787
* i[2]:[0]:[0]:[48]:[5001.0008.0007]:[32]:[192.168.20.20]/272    ! ΠŸΡ€Π΅Ρ„ΠΈΠΊΡ ΠΏΠΎΠ»ΡƒΡ‡Π΅Π½Π½Ρ‹ΠΉ ΠΈΠ· VNI 20000
                      10.255.1.20                       100          0 i
*>i                   10.255.1.20                       100          0 i

Haddii aan si dhow u eegno cusboonaysiinta la helay, waxaan arki karnaa in horgalahani uu leeyahay laba RTs:

Leaf11# sh bgp l2vpn evpn 5001.0008.0007
BGP routing table information for VRF default, address family L2VPN EVPN
Route Distinguisher: 10.255.1.21:32787
BGP routing table entry for [2]:[0]:[0]:[48]:[5001.0008.0007]:[32]:[192.168.20.2
0]/272, version 5164
Paths: (2 available, best #2)
Flags: (0x000202) (high32 00000000) on xmit-list, is not in l2rib/evpn, is not i
n HW

  Path type: internal, path is valid, not best reason: Neighbor Address, no labeled nexthop
  AS-Path: NONE, path sourced internal to AS
    10.255.1.20 (metric 81) from 10.255.1.102 (10.255.1.102)
      Origin IGP, MED not set, localpref 100, weight 0
      Received label 20000 99000                                 ! Π”Π²Π° label для Ρ€Π°Π±ΠΎΡ‚Ρ‹ VxLAN
      Extcommunity: RT:65001:20000 RT:65001:99000 SOO:10.255.1.20:0 ENCAP:8     ! Π”Π²Π° значСния Route-target, Π½Π° основС, ΠΊΠΎΡ‚ΠΎΡ€Ρ‹Ρ… Π΄ΠΎΠ±Π°Π²ΠΈΠ»ΠΈ Π΄Π°Π½Π½Ρ‹ΠΉ прСфикс
          Router MAC:5001.0005.0007
      Originator: 10.255.1.21 Cluster list: 10.255.1.102
<......>

Jadwalka dariiqa ee Leaf-1, waxa kale oo aad arki kartaa horgalaha 192.168.20.20/32:

Leaf11# sh ip route vrf PROD
192.168.10.0/24, ubest/mbest: 1/0, attached
    *via 192.168.10.1, Vlan10, [0/0], 01:29:28, direct
192.168.10.1/32, ubest/mbest: 1/0, attached
    *via 192.168.10.1, Vlan10, [0/0], 01:29:28, local
192.168.10.10/32, ubest/mbest: 1/0, attached
    *via 192.168.10.10, Vlan10, [190/0], 01:27:22, hmm
192.168.20.20/32, ubest/mbest: 1/0                                        ! АдрСс Host-2
    *via 10.255.1.20%default, [200/0], 01:20:20, bgp-65001, internal, tag 65001     ! Доступный Ρ‡Π΅Ρ€Π΅Π· Leaf-2
(evpn) segid: 99000 tunnelid: 0xaff0114 encap: VXLAN                                ! Π§Π΅Ρ€Π΅Π· VNI 99000

U fiirso horgalayaasha aasaasiga ah ee maqan 192.168.20.0/24 ee ku dhex jira miiska dajinta?
Waa sax, ma joogo. Taasi waa, Caleemaha fog waxay helayaan macluumaadka ku saabsan martigeliyayaasha ku jira shabakadaada kaliya. Tanina waa hab-dhaqanka saxda ah. Kor, dhammaan cusbooneysiinta, waxaad arki kartaa in macluumaadka uu la socdo waxa ku jira MAC / IP. Ma jiraan horgalayaal laga hadlo.

Kani waa borotokoolka Maamulaha Dhaqdhaqaaqa Martigelinta (HMM), kaas oo buuxinaya miiska ARP kaas oo miiska BGP ka sii buuxsamay (waxa aanu kaga tagi doonaa habkan qaab dhismeedka qodobkan). Iyada oo ku saleysan macluumaadka laga helay HMM, nooca 2 EVPNs ayaa la sameeyay (waxaa gudbiya MAC / IP).

Si kastaba ha ahaatee, maxaa dhacaya haddii ay jirto baahi loo qabo gudbinta macluumaadka ku saabsan horgale?

Macluumaadka noocaan ah, waxaa jira EVPN-dariiqa 5 - waxay kuu ogolaaneysaa inaad ku soo dirto horgalayaasha cinwaanka qoyska l2vpn evpn RFC, Sababtan awgeed, soosaarayaasha kala duwan ayaa laga yaabaa inay yeeshaan dabeecado kala duwan oo noocaan ah)

Si loo wareejiyo horgalayaasha, waa lagama maarmaan in lagu daro horgalayaasha nidaamka BGP ee VRF, kaas oo la xayeysiin doono:

router bgp 65001
  vrf PROD
    address-family ipv4 unicast
      redistribute direct route-map VNI20000        ! Π’ Π΄Π°Π½Π½ΠΎΠΌ случаС анонсируСм прСфиксы ΠΏΠΎΠ΄ΠΊΠ»ΡŽΡ‡Π΅Π½ΠΈΠ΅ нСпосрСдствСнно ΠΊ Leaf Π² VNI 20000
route-map VNI20000 permit 10
  match ip address prefix-list VNI20000_OUT    ! Π£ΠΊΠ°Π·Ρ‹Π²Π°Π΅ΠΌ ΠΊΠ°ΠΊΠΎΠΉ ΠΈΡΠΏΠΎΠ»ΡŒΠ·ΠΎΠ²Π°Ρ‚ΡŒ prefix-list

ip prefix-list VNI20000_OUT seq 5 permit 192.168.20.0/24   ! Π£ΠΊΠ°Π·Ρ‹Π²Π°Π΅ΠΌ ΠΊΠ°ΠΊΠΈΠ΅ сСти Π±ΡƒΠ΄ΡƒΡ‚ ΠΏΠΎΠΏΠ°Π΄Π°Ρ‚ΡŒ Π² EVPN route-type 5

Natiijo ahaan, Cusbooneysii wuxuu noqon doonaa:

warshad VxLAN. Qaybta 2

Aan eegno miiska BGP. Marka lagu daro EVPN-dariiqa 2,3, nooca 5 ayaa soo muuqday kuwaas oo ka kooban macluumaadka ku saabsan lambarka shabakada:

<......>
   Network            Next Hop            Metric     LocPrf     Weight Path
Route Distinguisher: 10.255.1.11:3
* i[5]:[0]:[0]:[24]:[192.168.10.0]/224
                      10.255.1.10              0        100          0 ?
*>i                   10.255.1.10              0        100          0 ?

Route Distinguisher: 10.255.1.11:32777
* i[2]:[0]:[0]:[48]:[5001.0007.0007]:[0]:[0.0.0.0]/216
                      10.255.1.10                       100          0 i
*>i                   10.255.1.10                       100          0 i
* i[2]:[0]:[0]:[48]:[5001.0007.0007]:[32]:[192.168.10.10]/272
                      10.255.1.10                       100          0 i
*>i                   10.255.1.10                       100          0 i
* i[3]:[0]:[32]:[10.255.1.10]/88
                      10.255.1.10                       100          0 i
*>i                   10.255.1.10                       100          0 i

Route Distinguisher: 10.255.1.12:3
*>i[5]:[0]:[0]:[24]:[192.168.10.0]/224      ! EVPN route-type 5 с Π½ΠΎΠΌΠ΅Ρ€ΠΎΠΌ прСфикса
                      10.255.1.10              0        100          0 ?
* i
<.......>

Horgalayaasha ayaa sidoo kale ka soo muuqday miiska dajinta:

Leaf21# sh ip ro vrf PROD
192.168.10.0/24, ubest/mbest: 1/0
    *via 10.255.1.10%default, [200/0], 00:14:32, bgp-65001, internal, tag 65001  ! Π£Π΄Π°Π»Π΅Π½Π½Ρ‹ΠΉ прСфикс, доступный Ρ‡Π΅Ρ€Π΅Π· Leaf1/2(адрСс Next-hop = virtual IP ΠΌΠ΅ΠΆΠ΄Ρƒ ΠΏΠ°Ρ€ΠΎΠΉ VPC)
(evpn) segid: 99000 tunnelid: 0xaff010a encap: VXLAN      ! ΠŸΡ€Π΅Ρ„ΠΈΠΊΡ доступСн Ρ‡Π΅Ρ€Π΅Π· L3VNI 99000

192.168.10.10/32, ubest/mbest: 1/0
    *via 10.255.1.10%default, [200/0], 02:33:40, bgp-65001, internal, tag 65001
(evpn) segid: 99000 tunnelid: 0xaff010a encap: VXLAN

192.168.20.0/24, ubest/mbest: 1/0, attached
    *via 192.168.20.1, Vlan20, [0/0], 02:39:44, direct
192.168.20.1/32, ubest/mbest: 1/0, attached
    *via 192.168.20.1, Vlan20, [0/0], 02:39:44, local
192.168.20.20/32, ubest/mbest: 1/0, attached
    *via 192.168.20.20, Vlan20, [190/0], 02:35:46, hmm

Tani waxay soo gabagabaynaysaa qaybta labaad ee maqaallada taxanaha ah ee VxLAN EVPN. Qaybta soo socota, waxaan ku eegi doonaa doorashooyin kala duwan oo loogu talagalay isku xirka VRF-yada.

Aasaaska IPv6 iyo sida ay uga duwan tahay IPv4

Source: www.habr.com

Add a comment