ProHoster > Blog > Tsamaiso > Fektheri ea VxLAN. Karolo ea 2

Fektheri ea VxLAN. Karolo ea 2

Hello Habr. Ke tsoela pele letoto la lihlooho tse mabapi le theknoloji ea VxLAN EVPN, e leng li ngotsoe ka ho khetheha bakeng sa ho thakholoa ha thupelo "Moenjiniere oa Marang-rang" ka OTUS. 'Me kajeno re tla nahana ka karolo e khahlisang ea mesebetsi - ho tsamaisa. Leha ho le joalo, ho sa tsotellehe hore na e ka 'na ea utloahala eka ke ntho e nyenyane hakae, leha ho le joalo, e le karolo ea mosebetsi oa fektheri ea marang-rang, ntho e' ngoe le e 'ngoe e ka' na ea se ke ea e-ba bonolo hakaalo.

Fektheri ea VxLAN. Karolo ea 2

Karolo e le 'ngoe ea potoloho - Khokahano ea L1 lipakeng tsa li-server

Karolong ea ho qetela, re fihletse sebaka se le seng sa phatlalatso se hahiloeng holim'a lesela la marang-rang ho Nexus 9000v. Leha ho le joalo, ena hase mefuta eohle ea mesebetsi e lokelang ho rarolloa ka har'a moralo oa marang-rang a setsi sa data. 'Me kajeno re tla nahana ka mosebetsi o latelang - ho tsamaisa marang-rang kapa pakeng tsa VNIs.

E re ke u hopotse hore topology ea Spine-Leaf e sebelisoa:

Fektheri ea VxLAN. Karolo ea 2

Ho qala, re tla sekaseka hore na routing e etsahala joang le hore na e na le likarolo life.

Bakeng sa kutloisiso, a re nolofatseng setΕ‘oantΕ‘o sa logic mme re kenye VNI 20000 e 'ngoe bakeng sa Host-2. Sephetho ke:

Fektheri ea VxLAN. Karolo ea 2

Joang, tabeng ee, u ka fetisetsa sephethephethe ho tloha ho Moemeli e mong ho ea ho o mong?

Hona le likhetho tse peli:

  1. Boloka tlhahisoleseling mabapi le li-VNI tsohle ho li-switches tsohle tsa Leaf, joale litsela tsohle li tla etsahala Lekhasing la pele la marang-rang;
  2. Sebelisa e inehetseng - L3 VNI

Mokhoa oa pele o bonolo ebile o bonolo. Kaha o hloka feela ho qala li-VNI tsohle ho li-switches tsohle tsa Leaf. Leha ho le joalo, ho fumana makholo a seng makae kapa likete tsa VNIs ho pholletsa le Lekhasi kaofela ha e sa le mosebetsi o bonolo. Ka hona, mosebetsing ha e sebelisoe hangata.

Re tla sekaseka mokhoa oa 2, o thahasellisa haholoanyane ebile o rarahane haholoanyane, empa o fana ka maemo a bonolo ho theha feme.

Ha re kenyelle "PROD" ho topology ea VRF. Ha re kenyelle sebopeho sa vlan 10 ho eona ho Leaf-11/12 para le VLAN 20 ho Leaf-21. VLAN 20 e amahanngoa le VNI 20000

vrf context PROD
  rd auto       ! Route Distinguisher Π½Π΅ ΠΏΡ€ΠΈΠ½Ρ†ΠΈΠΏΠΈΠ°Π»Π΅Π½ ΠΈ ΠΌΠΎΠΆΠ΅ΠΌ ΠΈΡΠΏΠΎΠ»ΡŒΠ·ΠΎΠ²Π°Ρ‚ΡŒ сформированный автоматичСски
  address-family ipv4 unicast
    route-target both auto      ! ΡƒΠΊΠ°Π·Ρ‹Π²Π°Π΅ΠΌ Route-target с ΠΊΠΎΡ‚ΠΎΡ€Ρ‹ΠΌ Π±ΡƒΠ΄ΡƒΡ‚ ΠΈΠΌΠΏΠΎΡ€Ρ‚ΠΈΡ€ΠΎΠ²Π°Ρ‚ΡŒΡΡ ΠΈ ΡΠΊΡΠΏΠΎΡ€Ρ‚ΠΈΡ€ΠΎΠ²Π°Ρ‚ΡŒΡΡ прСфиксы Π²/ΠΈΠ· VRF
vlan 20
  vn-segment 20000

interface nve 1
  member vni 20000
    ingress-replication protocol bgp

interface Vlan10
  no shutdown
  vrf member PROD
  ip address 192.168.20.1/24
  fabric forwarding mode anycast-gateway

E le hore u sebelise L3VNI, u lokela ho theha VLAN e ncha, e kopanye le VNI e ncha. VNI e ncha e tlameha ho tΕ‘oana le Makhasi ohle a ratang tlhahisoleseling ea VLAN 10 le 20.

vlan 99
  vn-segment 99000

interface nve1
  member vni 99000 associate-vrf        ! Π‘ΠΎΠ·Π΄Π°Π΅ΠΌ L3 VNI

vrf context PROD
  vni 99000                             ! ΠŸΡ€ΠΈΠ²ΡΠ·Ρ‹Π²Π°Π΅ΠΌ L3 VNI ΠΊ ΠΎΠΏΡ€Π΅Π΄Π΅Π»Π΅Π½Π½ΠΎΠΌΡƒ VRF

Ka lebaka leo, setΕ‘oantΕ‘o se tla shebahala tjena:

Fektheri ea VxLAN. Karolo ea 2

E sala e le ho phethela hanyane - eketsa sebopeho se le seng - sehokelo vlan 99 ho VRF PROD

interface Vlan99
  no shutdown
  vrf member PROD
  ip forward  ! На интСрфСйсС Π½Π΅ Π΄ΠΎΠ»ΠΆΠ½ΠΎ Π±Ρ‹Ρ‚ΡŒ IP. Π˜ΡΠΏΠΎΠ»ΡŒΠ·ΡƒΠ΅Ρ‚ΡΡ Ρ‚ΠΎΠ»ΡŒΠΊΠΎ для пСрСсылки ΠΏΠ°ΠΊΠ΅Ρ‚ΠΎΠ² ΠΌΠ΅ΠΆΠ΄Ρƒ Leaf

Ka lebaka leo, mabaka a ho fetisa foreimi ho tloha ho Host-1 ho ea ho Host-2 ke ka tsela e latelang:

  1. Foreimi e rometsoeng ke Host-1 e fihla Lekhasi ho VLAN 10, e amanang le VNI 10000;
  2. Lekhasi le hlahloba hore na aterese ea sebaka se hokae 'me le e fumana ka L3 VNI ho Leaf switch ea bobeli;
  3. Hang ha tsela e eang atereseng eo e eang ho eona e fumanoa, Lekhasi le kenya foreimi hloohong e nang le L3VNI 99000 e hlokahalang - ebe e e romela ho Lekhasi la bobeli;
  4. Leaf switch ea bobeli e fumana data ho tsoa ho L3VNI 99000. E fumana foreimi ea pele ebe e e fetisetsa ho L2VNI 20000 e hlokahalang ebe e ea VLAN 20.

Ka lebaka la mosebetsi ona, L3VNI e tlosa tlhokahalo ea ho boloka tlhahisoleseding e mabapi le li-VNI tsohle tse teng marang-rang ho li-switches tsohle tsa Leaf.

Ka lebaka leo, ha re romella sephethephethe ho tloha Host-1 ho ea ho Host-2, pakete e tletse ka har'a VxLAN ka VNI e ncha - 99000:

Fektheri ea VxLAN. Karolo ea 2

Ho sa ntse ho tla bonahala hore na Leaf-1 e ithuta joang ka aterese ea MAC ho tsoa ho VNI e 'ngoe. Sena se boetse se etsahala ka thuso ea mofuta oa mofuta oa 2 oa EVPN (MAC / IP).

Se latelang se bonts'a mokhoa oa ho phatlalatsa tsela mabapi le sehlomathiso se fumanehang VNI e 'ngoe:

Fektheri ea VxLAN. Karolo ea 2

Ke hore, liaterese tse amohetsoeng ho tsoa VNI 20000 li na le li-RT tse peli.
E-re ke u hopotse hore litsela tse amohetsoeng ho tsoa ho Update li oela tafoleng ea BGP ka sepheo sa Route se boletsoeng ho litlhophiso tsa VRF (ts'ebetso e batla e rarahane, empa re ke ke ra kena sengoloa sena).
RT ka boeona e entsoe ka mokhoa o latelang: AS: VNI ​​(haeba ho sebelisoa mokhoa o itekanetseng).

Mohlala oa sebopeho sa RT ka mekhoa e ikemetseng le ea matsoho:

vrf context PROD
  address-family ipv4 unicast
    route-target import auto - автоматичСский Ρ€Π΅ΠΆΠΈΠΌ Ρ€Π°Π±ΠΎΡ‚Ρ‹
    route-target export 65001:20000 - Ρ€ΡƒΡ‡Π½ΠΎΠΉ Ρ€Π΅ΠΆΠΈΠΌ формирования RT

Ka lebaka leo, u ka bona ka holimo hore li-prefixes tse tsoang ho VNI e 'ngoe li na le litekanyetso tse peli tsa RT.
E 'ngoe ea tsona 65001:99000 ke L3 VNI e eketsehileng. Kaha VNI ena e tΕ‘oana le Makhasi ohle 'me e oela tlas'a melao ea rona ea ho reka ka ntle ho litlhophiso tsa VRF, prefix e kena tafoleng ea BGP, e ka bonoang ho tsoa:

sh bgp l2vpn evpn
<.....>
   Network            Next Hop            Metric     LocPrf     Weight Path
Route Distinguisher: 10.255.1.11:32777    (L2VNI 10000)
*>l[2]:[0]:[0]:[48]:[5001.0007.0007]:[0]:[0.0.0.0]/216
                      10.255.1.10                       100      32768 i
*>l[2]:[0]:[0]:[48]:[5001.0007.0007]:[32]:[192.168.10.10]/272
                      10.255.1.10                       100      32768 i
*>l[3]:[0]:[32]:[10.255.1.10]/88
                      10.255.1.10                       100      32768 i

Route Distinguisher: 10.255.1.21:32787
* i[2]:[0]:[0]:[48]:[5001.0008.0007]:[32]:[192.168.20.20]/272    ! ΠŸΡ€Π΅Ρ„ΠΈΠΊΡ ΠΏΠΎΠ»ΡƒΡ‡Π΅Π½Π½Ρ‹ΠΉ ΠΈΠ· VNI 20000
                      10.255.1.20                       100          0 i
*>i                   10.255.1.20                       100          0 i

Haeba re shebisisa ntlafatso e fumanoeng, re ka bona hore sehlomathiso sena se na le li-RT tse peli:

Leaf11# sh bgp l2vpn evpn 5001.0008.0007
BGP routing table information for VRF default, address family L2VPN EVPN
Route Distinguisher: 10.255.1.21:32787
BGP routing table entry for [2]:[0]:[0]:[48]:[5001.0008.0007]:[32]:[192.168.20.2
0]/272, version 5164
Paths: (2 available, best #2)
Flags: (0x000202) (high32 00000000) on xmit-list, is not in l2rib/evpn, is not i
n HW

  Path type: internal, path is valid, not best reason: Neighbor Address, no labeled nexthop
  AS-Path: NONE, path sourced internal to AS
    10.255.1.20 (metric 81) from 10.255.1.102 (10.255.1.102)
      Origin IGP, MED not set, localpref 100, weight 0
      Received label 20000 99000                                 ! Π”Π²Π° label для Ρ€Π°Π±ΠΎΡ‚Ρ‹ VxLAN
      Extcommunity: RT:65001:20000 RT:65001:99000 SOO:10.255.1.20:0 ENCAP:8     ! Π”Π²Π° значСния Route-target, Π½Π° основС, ΠΊΠΎΡ‚ΠΎΡ€Ρ‹Ρ… Π΄ΠΎΠ±Π°Π²ΠΈΠ»ΠΈ Π΄Π°Π½Π½Ρ‹ΠΉ прСфикс
          Router MAC:5001.0005.0007
      Originator: 10.255.1.21 Cluster list: 10.255.1.102
<......>

Tafoleng ea routing ho Leaf-1, o ka bona le sehlongwapele 192.168.20.20/32:

Leaf11# sh ip route vrf PROD
192.168.10.0/24, ubest/mbest: 1/0, attached
    *via 192.168.10.1, Vlan10, [0/0], 01:29:28, direct
192.168.10.1/32, ubest/mbest: 1/0, attached
    *via 192.168.10.1, Vlan10, [0/0], 01:29:28, local
192.168.10.10/32, ubest/mbest: 1/0, attached
    *via 192.168.10.10, Vlan10, [190/0], 01:27:22, hmm
192.168.20.20/32, ubest/mbest: 1/0                                        ! АдрСс Host-2
    *via 10.255.1.20%default, [200/0], 01:20:20, bgp-65001, internal, tag 65001     ! Доступный Ρ‡Π΅Ρ€Π΅Π· Leaf-2
(evpn) segid: 99000 tunnelid: 0xaff0114 encap: VXLAN                                ! Π§Π΅Ρ€Π΅Π· VNI 99000

Ela hloko sehlomathiso sa mantlha se sieo 192.168.20.0/24 tafoleng ea ho tsamaisa?
Ke hantle, ha a eo. Ke hore, Remoutu Leafs e fumana tlhahisoleseling feela mabapi le baamoheli ba marang-rang a hau. 'Me sena ke boitΕ‘oaro bo nepahetseng. Ka holimo, lintlafatsong tsohle, u ka bona hore tlhahisoleseling e tla le litaba tsa MAC / IP. Ha ho li-prefixes tseo ho buuoang ka tsona.

Ena ke protocol ea Host Mobility Manager (HMM), e tlatsang tafole ea ARP eo tafole ea BGP e tlatsitsoeng ho eona (re tla tlohela ts'ebetso ena ka har'a moralo oa sehlooho sena). Ho ipapisitsoe le tlhaiso-leseling e fumanoeng ho tsoa ho HMM, li-EVPN tsa mofuta oa 2 li thehoa (li fetisoa ke MAC / IP).

Leha ho le joalo, ho thoe’ng haeba ho hlokahala ho fetisa boitsebiso bo mabapi le sehlongwapele?

Bakeng sa tlhahisoleseling ea mofuta ona, ho na le mofuta oa mofuta oa EVPN oa mofuta oa 5 - e o lumella ho romella li-prefixes ka aterese-lelapa la l2vpn evpn (mofuta ona oa tsela nakong ea ho ngola sena o ka har'a mofuta o hlophisitsoeng feela. RFC, ka lebaka la sena, baetsi ba fapaneng ba ka ba le boitΕ‘oaro bo fapaneng ba mofuta ona oa tsela)

Ho fetisa li-prefixes, hoa hlokahala ho kenya lihlomapele ts'ebetsong ea BGP bakeng sa VRF, e tla phatlalatsoa:

router bgp 65001
  vrf PROD
    address-family ipv4 unicast
      redistribute direct route-map VNI20000        ! Π’ Π΄Π°Π½Π½ΠΎΠΌ случаС анонсируСм прСфиксы ΠΏΠΎΠ΄ΠΊΠ»ΡŽΡ‡Π΅Π½ΠΈΠ΅ нСпосрСдствСнно ΠΊ Leaf Π² VNI 20000
route-map VNI20000 permit 10
  match ip address prefix-list VNI20000_OUT    ! Π£ΠΊΠ°Π·Ρ‹Π²Π°Π΅ΠΌ ΠΊΠ°ΠΊΠΎΠΉ ΠΈΡΠΏΠΎΠ»ΡŒΠ·ΠΎΠ²Π°Ρ‚ΡŒ prefix-list

ip prefix-list VNI20000_OUT seq 5 permit 192.168.20.0/24   ! Π£ΠΊΠ°Π·Ρ‹Π²Π°Π΅ΠΌ ΠΊΠ°ΠΊΠΈΠ΅ сСти Π±ΡƒΠ΄ΡƒΡ‚ ΠΏΠΎΠΏΠ°Π΄Π°Ρ‚ΡŒ Π² EVPN route-type 5

Ka lebaka leo, Update e tla ba:

Fektheri ea VxLAN. Karolo ea 2

Ha re shebeng tafole ea BGP. Ntle le mofuta oa 2,3 oa tsela ea EVPN, ho hlahile litsela tsa mofuta oa 5 tse nang le tlhahisoleseling mabapi le nomoro ea marang-rang:

<......>
   Network            Next Hop            Metric     LocPrf     Weight Path
Route Distinguisher: 10.255.1.11:3
* i[5]:[0]:[0]:[24]:[192.168.10.0]/224
                      10.255.1.10              0        100          0 ?
*>i                   10.255.1.10              0        100          0 ?

Route Distinguisher: 10.255.1.11:32777
* i[2]:[0]:[0]:[48]:[5001.0007.0007]:[0]:[0.0.0.0]/216
                      10.255.1.10                       100          0 i
*>i                   10.255.1.10                       100          0 i
* i[2]:[0]:[0]:[48]:[5001.0007.0007]:[32]:[192.168.10.10]/272
                      10.255.1.10                       100          0 i
*>i                   10.255.1.10                       100          0 i
* i[3]:[0]:[32]:[10.255.1.10]/88
                      10.255.1.10                       100          0 i
*>i                   10.255.1.10                       100          0 i

Route Distinguisher: 10.255.1.12:3
*>i[5]:[0]:[0]:[24]:[192.168.10.0]/224      ! EVPN route-type 5 с Π½ΠΎΠΌΠ΅Ρ€ΠΎΠΌ прСфикса
                      10.255.1.10              0        100          0 ?
* i
<.......>

Sehlongoapele se boetse se hlahile tafoleng ea ho tsamaisa:

Leaf21# sh ip ro vrf PROD
192.168.10.0/24, ubest/mbest: 1/0
    *via 10.255.1.10%default, [200/0], 00:14:32, bgp-65001, internal, tag 65001  ! Π£Π΄Π°Π»Π΅Π½Π½Ρ‹ΠΉ прСфикс, доступный Ρ‡Π΅Ρ€Π΅Π· Leaf1/2(адрСс Next-hop = virtual IP ΠΌΠ΅ΠΆΠ΄Ρƒ ΠΏΠ°Ρ€ΠΎΠΉ VPC)
(evpn) segid: 99000 tunnelid: 0xaff010a encap: VXLAN      ! ΠŸΡ€Π΅Ρ„ΠΈΠΊΡ доступСн Ρ‡Π΅Ρ€Π΅Π· L3VNI 99000

192.168.10.10/32, ubest/mbest: 1/0
    *via 10.255.1.10%default, [200/0], 02:33:40, bgp-65001, internal, tag 65001
(evpn) segid: 99000 tunnelid: 0xaff010a encap: VXLAN

192.168.20.0/24, ubest/mbest: 1/0, attached
    *via 192.168.20.1, Vlan20, [0/0], 02:39:44, direct
192.168.20.1/32, ubest/mbest: 1/0, attached
    *via 192.168.20.1, Vlan20, [0/0], 02:39:44, local
192.168.20.20/32, ubest/mbest: 1/0, attached
    *via 192.168.20.20, Vlan20, [190/0], 02:35:46, hmm

Sena se phethela karolo ea bobeli ea letoto la lihlooho tse mabapi le VxLAN EVPN. Karolong e latelang, re tla nahana ka likhetho tse fapaneng tsa ho tsamaisa li-VRF.

Lintlha tsa motheo tsa IPv6 le hore na e fapana joang le IPv4

Source: www.habr.com

Eketsa ka tlhaloso