Salam, Habr. Kuring neruskeun runtuyan artikel dina téhnologi VxLAN EVPN, nu ditulis husus pikeun peluncuran kursus ku OTUS. Sareng ayeuna urang bakal ningali bagian anu pikaresepeun tina tugas - routing. Perkara teu kumaha trivial eta bisa disada, kumaha oge, dina kerangka karya pabrik jaringan, sagalana bisa jadi teu jadi basajan.
Dina bagian pamungkas, urang ngahontal hiji domain siaran diwangun dina luhureun lawon jaringan dina Nexus 9000v. Nanging, ieu sanés sajumlah tugas anu kedah direngsekeun dina jaringan pusat data. Sareng ayeuna urang bakal ningali tugas salajengna - routing antara jaringan atanapi antara VNI.
Hayu atuh ngingetan yén topologi Spine-Leaf dianggo:
Kahiji, hayu urang nempo kumaha routing lumangsung sarta fitur naon eta boga.
Для понимания упростим логическую схему и добавим еще один VNI 20000 для Host-2. В итоге получается:
Kumaha, dina hal ieu, anjeun tiasa nransfer lalu lintas ti hiji Host ka anu sanés?
Aya dua pilihan:
- На всех Leaf коммутаторах держать информацию обо всех VNI, тогда вся маршрутизация будет происходить на первом же Leaf в сети;
- Paké dedicated L3 VNI
Metodeu kahiji basajan tur merenah. Kusabab anjeun ngan kedah masang sadayana VNI dina sadaya saklar Daun. Sanajan kitu, nyetel sababaraha ratus atawa sarébu VNIs pikeun sakabéh Leafs euweuh sigana tugas basajan. Ku alatan éta, dipaké rada jarang dina karya.
Hayu urang nempo metoda 2, nu leuwih metot jeung saeutik leuwih kompleks, tapi méré leuwih kalenturan dina nyetel pabrik.
Hayu urang tambahkeun "PROD" kana topologi VRF. Ka dinya urang bakal nambahan panganteur vlan 10 dina pasangan Daun-11/12 sarta panganteur VLAN 20 on Daun-21. VLAN 20 pakait sareng VNI 20000
vrf context PROD
rd auto ! Route Distinguisher не принципиален и можем использовать сформированный автоматически
address-family ipv4 unicast
route-target both auto ! указываем Route-target с которым будут импортироваться и экспортироваться префиксы в/из VRF
vlan 20
vn-segment 20000
interface nve 1
member vni 20000
ingress-replication protocol bgp
interface Vlan10
no shutdown
vrf member PROD
ip address 192.168.20.1/24
fabric forwarding mode anycast-gatewayDina raraga ngagunakeun L3VNI, anjeun kudu nyieun hiji VLAN anyar jeung pakait jeung VNI anyar. VNI anyar kudu sarua dina sagala Daun museurkeun VLAN 10 jeung 20 informasi
vlan 99
vn-segment 99000
interface nve1
member vni 99000 associate-vrf ! Создаем L3 VNI
vrf context PROD
vni 99000 ! Привязываем L3 VNI к определенному VRFHasilna, diagram bakal kasampak kawas kieu:
Tetep kudu dipigawé saeutik - tambahkeun hiji deui panganteur - panganteur vlan 99 di VRF PROD
interface Vlan99
no shutdown
vrf member PROD
ip forward ! На интерфейсе не должно быть IP. Используется только для пересылки пакетов между LeafHasilna, logika pikeun ngalirkeun pigura ti Host-1 ka Host-2 nyaéta kieu:
- Pigura dikirim ku Host-1 anjog di Daun di VLAN 10, nu pakait sareng VNI 10000;
- Daun mariksa dimana alamat tujuan sareng mendakanana ngalangkungan L3 VNI dina saklar Daun kadua;
- Pas rute ka alamat tujuan kapanggih, Daun ngarangkep pigura kana lulugu jeung perlu L3VNI 99000 - sarta ngirimkeun ka arah Daun kadua;
- Второй Leaf коммутатор получает данные из L3VNI 99000. Достает изначальный кадр и переносит его в необходимый L2VNI 20000 и далее в VLAN 20.
Salaku hasil tina karya ieu ngaleungitkeun L3VNI kudu tetep informasi ngeunaan sagala VNIs anu aya dina jaringan dina sagala switch Daun.
Hasilna, nalika kami ngirim lalu lintas ti Host-1 ka Host-2, pakét dibungkus dina VxLAN nganggo VNI anyar - 99000:
Tetep katingal kumaha persisna Daun-1 diajar ngeunaan alamat MAC tina VNI anu sanés. Ieu ogé lumangsung ngagunakeun EVPN route-type 2 (MAC/IP).
Di handap ieu nunjukkeun prosés nyebarkeun rute ngeunaan awalan anu aya di VNI anu sanés:
Nyaéta, alamat anu ditampi ti VNI 20000 gaduh dua RT.
Hayu atuh ngingetkeun yén ruteu narima ti Update mungkas nepi dina tabel BGP kalawan Rute-target dieusian dina setélan VRF (prosésna rada leuwih pajeulit, tapi urang moal delve kana artikel ieu).
RT sorangan kabentuk nurutkeun rumus: AS: VNI (lamun mode otomatis dipaké).
Conto formasi RT dina modeu otomatis sareng manual:
vrf context PROD
address-family ipv4 unicast
route-target import auto - автоматический режим работы
route-target export 65001:20000 - ручной режим формирования RTHasil di luhur nunjukeun yen awalan ti VNI sejen boga dua nilai RT.
Salah sahijina nyaéta 65001:99000 - tambahan L3 VNI. Kusabab VNI ieu sami dina sadaya Daun sareng aya dina aturan impor urang dina setélan VRF, awalan ditungtungan dina tabel BGP, anu tiasa ditingali tina kaluaran:
sh bgp l2vpn evpn
<.....>
Network Next Hop Metric LocPrf Weight Path
Route Distinguisher: 10.255.1.11:32777 (L2VNI 10000)
*>l[2]:[0]:[0]:[48]:[5001.0007.0007]:[0]:[0.0.0.0]/216
10.255.1.10 100 32768 i
*>l[2]:[0]:[0]:[48]:[5001.0007.0007]:[32]:[192.168.10.10]/272
10.255.1.10 100 32768 i
*>l[3]:[0]:[32]:[10.255.1.10]/88
10.255.1.10 100 32768 i
Route Distinguisher: 10.255.1.21:32787
* i[2]:[0]:[0]:[48]:[5001.0008.0007]:[32]:[192.168.20.20]/272 ! Префикс полученный из VNI 20000
10.255.1.20 100 0 i
*>i 10.255.1.20 100 0 iUpami urang ningali langkung caket kana pembaruan anu ditampi, urang tiasa ningali yén awalan ieu ngagaduhan dua RT:
Leaf11# sh bgp l2vpn evpn 5001.0008.0007
BGP routing table information for VRF default, address family L2VPN EVPN
Route Distinguisher: 10.255.1.21:32787
BGP routing table entry for [2]:[0]:[0]:[48]:[5001.0008.0007]:[32]:[192.168.20.2
0]/272, version 5164
Paths: (2 available, best #2)
Flags: (0x000202) (high32 00000000) on xmit-list, is not in l2rib/evpn, is not i
n HW
Path type: internal, path is valid, not best reason: Neighbor Address, no labeled nexthop
AS-Path: NONE, path sourced internal to AS
10.255.1.20 (metric 81) from 10.255.1.102 (10.255.1.102)
Origin IGP, MED not set, localpref 100, weight 0
Received label 20000 99000 ! Два label для работы VxLAN
Extcommunity: RT:65001:20000 RT:65001:99000 SOO:10.255.1.20:0 ENCAP:8 ! Два значения Route-target, на основе, которых добавили данный префикс
Router MAC:5001.0005.0007
Originator: 10.255.1.21 Cluster list: 10.255.1.102
<......>Dina tabel routing on Daun-1 anjeun ogé tiasa ningali awalan 192.168.20.20/32:
Leaf11# sh ip route vrf PROD
192.168.10.0/24, ubest/mbest: 1/0, attached
*via 192.168.10.1, Vlan10, [0/0], 01:29:28, direct
192.168.10.1/32, ubest/mbest: 1/0, attached
*via 192.168.10.1, Vlan10, [0/0], 01:29:28, local
192.168.10.10/32, ubest/mbest: 1/0, attached
*via 192.168.10.10, Vlan10, [190/0], 01:27:22, hmm
192.168.20.20/32, ubest/mbest: 1/0 ! Адрес Host-2
*via 10.255.1.20%default, [200/0], 01:20:20, bgp-65001, internal, tag 65001 ! Доступный через Leaf-2
(evpn) segid: 99000 tunnelid: 0xaff0114 encap: VXLAN ! Через VNI 99000Perhatikeun henteuna awalan utama 192.168.20.0/24 dina tabel routing?
Leres, anjeunna henteu aya. Nyaéta, jauh Leafs nampi inpormasi ngan ngeunaan host anu aya dina jaringan anjeun. Sareng ieu mangrupikeun kabiasaan anu leres. Di luhur dina sadaya apdet anjeun tiasa ningali yén inpormasi hadir sareng eusi MAC/IP. Euweuh omongan prefiks.
Это работает протокол Host Mobility Manager(HMM), который заполняет ARP таблицу из которой дальше заполняется BGP таблица(в рамках данной статьи опустим этот процесс). На основе информации полученной из HMM формируются EVPN route-type 2 (передается MAC/IP).
Nanging, kumaha upami aya kabutuhan pikeun ngirimkeun inpormasi ngeunaan awalan?
Для такого вида информации существует EVPN route-type 5 — позволяет передавать префиксы через address-family l2vpn evpn (данный тип маршрутов на момент написания статьи находится только в draft версии , kusabab ieu, paripolah jinis jalur ieu tiasa bénten-béda diantara pabrik anu béda)
Pikeun ngirimkeun awalan, anjeun kedah nambihan awalan anu bakal diémbarkeun dina prosés BGP pikeun VRF:
router bgp 65001
vrf PROD
address-family ipv4 unicast
redistribute direct route-map VNI20000 ! В данном случае анонсируем префиксы подключение непосредственно к Leaf в VNI 20000
route-map VNI20000 permit 10
match ip address prefix-list VNI20000_OUT ! Указываем какой использовать prefix-list
ip prefix-list VNI20000_OUT seq 5 permit 192.168.20.0/24 ! Указываем какие сети будут попадать в EVPN route-type 5Hasilna, Pembaruan bakal gaduh:
Hayu urang nempo tabel BGP. Salian EVPN rute-tipe 2,3, tipe 5 ruteu geus mucunghul, nu ngandung émbaran ngeunaan nomer jaringan:
<......>
Network Next Hop Metric LocPrf Weight Path
Route Distinguisher: 10.255.1.11:3
* i[5]:[0]:[0]:[24]:[192.168.10.0]/224
10.255.1.10 0 100 0 ?
*>i 10.255.1.10 0 100 0 ?
Route Distinguisher: 10.255.1.11:32777
* i[2]:[0]:[0]:[48]:[5001.0007.0007]:[0]:[0.0.0.0]/216
10.255.1.10 100 0 i
*>i 10.255.1.10 100 0 i
* i[2]:[0]:[0]:[48]:[5001.0007.0007]:[32]:[192.168.10.10]/272
10.255.1.10 100 0 i
*>i 10.255.1.10 100 0 i
* i[3]:[0]:[32]:[10.255.1.10]/88
10.255.1.10 100 0 i
*>i 10.255.1.10 100 0 i
Route Distinguisher: 10.255.1.12:3
*>i[5]:[0]:[0]:[24]:[192.168.10.0]/224 ! EVPN route-type 5 с номером префикса
10.255.1.10 0 100 0 ?
* i
<.......> Awalan ogé muncul dina tabel routing:
Leaf21# sh ip ro vrf PROD
192.168.10.0/24, ubest/mbest: 1/0
*via 10.255.1.10%default, [200/0], 00:14:32, bgp-65001, internal, tag 65001 ! Удаленный префикс, доступный через Leaf1/2(адрес Next-hop = virtual IP между парой VPC)
(evpn) segid: 99000 tunnelid: 0xaff010a encap: VXLAN ! Префикс доступен через L3VNI 99000
192.168.10.10/32, ubest/mbest: 1/0
*via 10.255.1.10%default, [200/0], 02:33:40, bgp-65001, internal, tag 65001
(evpn) segid: 99000 tunnelid: 0xaff010a encap: VXLAN
192.168.20.0/24, ubest/mbest: 1/0, attached
*via 192.168.20.1, Vlan20, [0/0], 02:39:44, direct
192.168.20.1/32, ubest/mbest: 1/0, attached
*via 192.168.20.1, Vlan20, [0/0], 02:39:44, local
192.168.20.20/32, ubest/mbest: 1/0, attached
*via 192.168.20.20, Vlan20, [190/0], 02:35:46, hmmНа этом закончим вторую часть цикла статей по VxLAN EVPN. В следующей части рассмотрим различные варианты маршрутизации между VRF.
sumber: www.habr.com