ProHoster > Π‘Π»ΠΎΠ³ > Ukuphatha > Imboni ye-VxLAN. Ingxenye 2

Imboni ye-VxLAN. Ingxenye 2

Sawubona, Habr. Ngiqhubeka nochungechunge lwami lwezihloko ze-VxLAN EVPN ubuchwepheshe, okuyinto zibhalelwe ukwethulwa kwezifundo "Unjiniyela wenethiwekhi" ngu-OTUSNamuhla, sizobheka isici esithakazelisayo somsebenzi: umzila. Njengoba kungase kuzwakale kuncane, ngaphakathi komongo wendwangu yenethiwekhi, izinto zingaba yinkimbinkimbi kakhulu.

Imboni ye-VxLAN. Ingxenye 2

Ingxenye engu-1 yomjikelezo - Ukuxhumana kwe-L2 phakathi kwamaseva

Esigabeni esidlule, sizuze isizinda esisodwa sokusakaza esakhelwe phezu kwendwangu yenethiwekhi ku-Nexus 9000v. Nokho, lokhu kukude nohlu oluphelele lwemisebenzi edinga ukubhekwana nayo ngaphakathi kwenethiwekhi yesikhungo sedatha. Namuhla, sizocubungula inselele elandelayo: umzila phakathi kwamanethiwekhi noma phakathi kwama-VNI.

Ake ngikukhumbuze ukuthi i-Spine-Leaf topology isetshenziswa:

Imboni ye-VxLAN. Ingxenye 2

Okokuqala, ake sibheke ukuthi umzila usebenza kanjani nokuthi ziyini izici zakhona.

Ukuze uthole ukucaca, masenze lula umdwebo we-logic futhi sengeze enye i-VNI 20000 ye-Host-2. Umphumela uthi:

Imboni ye-VxLAN. Ingxenye 2

Ungayidlulisela kanjani ithrafikhi isuka ku-Host eyodwa iye kwenye kuleli cala?

Kunezinketho ezimbili:

  1. Wonke ama-Leaf switches kufanele aqukathe ulwazi mayelana nawo wonke ama-VNI, khona-ke wonke umzila uzokwenzeka kuLeaf lokuqala kunethiwekhi;
  2. Sebenzisa i-L3 VNI ezinikele

Indlela yokuqala ilula futhi ifanelekile, njengoba idinga kuphela ukwabela wonke ama-VNI kuwo wonke amaswishi Amaqabunga. Kodwa-ke, ukwabela amakhulu ambalwa noma izinkulungwane zama-VNI kuwo wonke ama-Leaf switch akusewona umsebenzi olula. Ngakho-ke, akuvamile ukusetshenziswa ekukhiqizeni.

Ake sibheke indlela yesi-2, ethakazelisa kakhulu futhi eyinkimbinkimbi kakhudlwana, kodwa inikeza ukuguquguquka okukhulu ekumiseni ifektri.

Ake sengeze i-"PROD" VRF ku-topology. Sizongeza isixhumi esibonakalayo se-VLAN 10 kubhangqa leLeaf-11/12 kanye nesixhumi esibonakalayo se-VLAN 20 kuya kuLeaf-21. Sizohlobanisa i-VLAN 20 ne-VNI 20000.

vrf context PROD
  rd auto       ! Route Distinguisher Π½Π΅ ΠΏΡ€ΠΈΠ½Ρ†ΠΈΠΏΠΈΠ°Π»Π΅Π½ ΠΈ ΠΌΠΎΠΆΠ΅ΠΌ ΠΈΡΠΏΠΎΠ»ΡŒΠ·ΠΎΠ²Π°Ρ‚ΡŒ сформированный автоматичСски
  address-family ipv4 unicast
    route-target both auto      ! ΡƒΠΊΠ°Π·Ρ‹Π²Π°Π΅ΠΌ Route-target с ΠΊΠΎΡ‚ΠΎΡ€Ρ‹ΠΌ Π±ΡƒΠ΄ΡƒΡ‚ ΠΈΠΌΠΏΠΎΡ€Ρ‚ΠΈΡ€ΠΎΠ²Π°Ρ‚ΡŒΡΡ ΠΈ ΡΠΊΡΠΏΠΎΡ€Ρ‚ΠΈΡ€ΠΎΠ²Π°Ρ‚ΡŒΡΡ прСфиксы Π²/ΠΈΠ· VRF
vlan 20
  vn-segment 20000

interface nve 1
  member vni 20000
    ingress-replication protocol bgp

interface Vlan10
  no shutdown
  vrf member PROD
  ip address 192.168.20.1/24
  fabric forwarding mode anycast-gateway

Ukuze usebenzise i-L3VNI, udinga ukudala i-VLAN entsha bese uyihlobanisa ne-VNI entsha. I-VNI entsha kufanele ifane kuwo wonke Amaqabunga anentshisekelo olwazini lwe-VLAN 10 no-20.

vlan 99
  vn-segment 99000

interface nve1
  member vni 99000 associate-vrf        ! Π‘ΠΎΠ·Π΄Π°Π΅ΠΌ L3 VNI

vrf context PROD
  vni 99000                             ! ΠŸΡ€ΠΈΠ²ΡΠ·Ρ‹Π²Π°Π΅ΠΌ L3 VNI ΠΊ ΠΎΠΏΡ€Π΅Π΄Π΅Π»Π΅Π½Π½ΠΎΠΌΡƒ VRF

Ngenxa yalokho, umdwebo uzobukeka kanje:

Imboni ye-VxLAN. Ingxenye 2

Sekusele kancane ukwenze - engeza esinye isixhumi esibonakalayo - isikhombimsebenzisi se-vlan 99 ku-VRF PROD

interface Vlan99
  no shutdown
  vrf member PROD
  ip forward  ! На интСрфСйсС Π½Π΅ Π΄ΠΎΠ»ΠΆΠ½ΠΎ Π±Ρ‹Ρ‚ΡŒ IP. Π˜ΡΠΏΠΎΠ»ΡŒΠ·ΡƒΠ΅Ρ‚ΡΡ Ρ‚ΠΎΠ»ΡŒΠΊΠΎ для пСрСсылки ΠΏΠ°ΠΊΠ΅Ρ‚ΠΎΠ² ΠΌΠ΅ΠΆΠ΄Ρƒ Leaf

Njengomphumela, i-logic yokudluliswa kohlaka kusuka ku-Host-1 kuya ku-Host-2 imi kanje:

  1. Uhlaka oluthunyelwe ngu-Host-1 lufika eLeaf ku-VLAN 10, ehlotshaniswa ne-VNI 10000;
  2. Iqabunga lihlola ukuthi ikheli lendawo likuphi bese liyithola nge-L3 VNI kuswishi yeLeaf yesibili;
  3. Uma indlela eya endaweni okuyiwa kuyo isitholiwe, Iqabunga lipakisha ifreyimu ibe unhlokweni nge-L3VNI 99000 edingekayo bese ilithumela ngaseLeaf lesibili;
  4. Iswishi yesibili ye-Leaf ithola idatha esuka ku-L3VNI 99000. Ikhipha uhlaka lwangempela futhi iyidlulisele ku-L2VNI 20000 edingekayo bese iba ku-VLAN 20.

Njengomphumela walo msebenzi, i-L3VNI iqeda isidingo sokugcina ulwazi mayelana nawo wonke ama-VNI kunethiwekhi kuwo wonke ama-switch switch.

Njengomphumela, lapho sithumela ithrafikhi kusuka ku-Host-1 kuya ku-Host-2, iphakethe ligcwele ngaphakathi kwe-VxLAN nge-VNI entsha - 99000:

Imboni ye-VxLAN. Ingxenye 2

Kusazobonakala ukuthi iLeaf-1 ifunda kanjani ikheli le-MAC kwenye i-VNI. Lokhu futhi kwenzeka kusetshenziswa i-EVPN-route-type 2 (MAC/IP).

Inqubo yokusabalalisa umzila mayelana nesiqalo esitholakala ku-VNI ehlukile iboniswa ngezansi:

Imboni ye-VxLAN. Ingxenye 2

Okusho ukuthi, amakheli atholwe ku-VNI 20000 anama-RT amabili.
Ake ngikukhumbuze ukuthi imizila etholwe kusukela ku-Update yengezwe kuthebula le-BGP nge-Route-target ecaciswe kuzilungiselelo ze-VRF (inqubo iyinkimbinkimbi kakhulu, kodwa ngeke singene ngemininingwane kulesi sihloko).
I-RT ngokwayo yakheka ngokwefomula: AS:VNI (uma imodi ezenzakalelayo isetshenziswa).

Isibonelo sokwakheka kwe-RT kumodi ezenzakalelayo neyemanuwali:

vrf context PROD
  address-family ipv4 unicast
    route-target import auto - автоматичСский Ρ€Π΅ΠΆΠΈΠΌ Ρ€Π°Π±ΠΎΡ‚Ρ‹
    route-target export 65001:20000 - Ρ€ΡƒΡ‡Π½ΠΎΠΉ Ρ€Π΅ΠΆΠΈΠΌ формирования RT

Njengomphumela, ungabona ngenhla ukuthi iziqalo ezivela kwenye i-VNI zinamanani amabili e-RT.
Enye yazo, 65001:99000, iyi-L3 VNI eyengeziwe. Njengoba le VNI ifana kuwo wonke Amaqabunga futhi ifanisa nemithetho yethu yokungenisa kuzilungiselelo ze-VRF, isiqalo sifakwe kuthebula le-BGP, njengoba kungabonakala kokuphumayo:

sh bgp l2vpn evpn
<.....>
   Network            Next Hop            Metric     LocPrf     Weight Path
Route Distinguisher: 10.255.1.11:32777    (L2VNI 10000)
*>l[2]:[0]:[0]:[48]:[5001.0007.0007]:[0]:[0.0.0.0]/216
                      10.255.1.10                       100      32768 i
*>l[2]:[0]:[0]:[48]:[5001.0007.0007]:[32]:[192.168.10.10]/272
                      10.255.1.10                       100      32768 i
*>l[3]:[0]:[32]:[10.255.1.10]/88
                      10.255.1.10                       100      32768 i

Route Distinguisher: 10.255.1.21:32787
* i[2]:[0]:[0]:[48]:[5001.0008.0007]:[32]:[192.168.20.20]/272    ! ΠŸΡ€Π΅Ρ„ΠΈΠΊΡ ΠΏΠΎΠ»ΡƒΡ‡Π΅Π½Π½Ρ‹ΠΉ ΠΈΠ· VNI 20000
                      10.255.1.20                       100          0 i
*>i                   10.255.1.20                       100          0 i

Uma sibhekisisa kakhudlwana isibuyekezo esitholiwe, singabona ukuthi lesi siqalo sinama-RT amabili:

Leaf11# sh bgp l2vpn evpn 5001.0008.0007
BGP routing table information for VRF default, address family L2VPN EVPN
Route Distinguisher: 10.255.1.21:32787
BGP routing table entry for [2]:[0]:[0]:[48]:[5001.0008.0007]:[32]:[192.168.20.2
0]/272, version 5164
Paths: (2 available, best #2)
Flags: (0x000202) (high32 00000000) on xmit-list, is not in l2rib/evpn, is not i
n HW

  Path type: internal, path is valid, not best reason: Neighbor Address, no labeled nexthop
  AS-Path: NONE, path sourced internal to AS
    10.255.1.20 (metric 81) from 10.255.1.102 (10.255.1.102)
      Origin IGP, MED not set, localpref 100, weight 0
      Received label 20000 99000                                 ! Π”Π²Π° label для Ρ€Π°Π±ΠΎΡ‚Ρ‹ VxLAN
      Extcommunity: RT:65001:20000 RT:65001:99000 SOO:10.255.1.20:0 ENCAP:8     ! Π”Π²Π° значСния Route-target, Π½Π° основС, ΠΊΠΎΡ‚ΠΎΡ€Ρ‹Ρ… Π΄ΠΎΠ±Π°Π²ΠΈΠ»ΠΈ Π΄Π°Π½Π½Ρ‹ΠΉ прСфикс
          Router MAC:5001.0005.0007
      Originator: 10.255.1.21 Cluster list: 10.255.1.102
<......>

Kuthebula lomzila kuLeaf-1 ungakwazi futhi ukubona isiqalo 192.168.20.20/32:

Leaf11# sh ip route vrf PROD
192.168.10.0/24, ubest/mbest: 1/0, attached
    *via 192.168.10.1, Vlan10, [0/0], 01:29:28, direct
192.168.10.1/32, ubest/mbest: 1/0, attached
    *via 192.168.10.1, Vlan10, [0/0], 01:29:28, local
192.168.10.10/32, ubest/mbest: 1/0, attached
    *via 192.168.10.10, Vlan10, [190/0], 01:27:22, hmm
192.168.20.20/32, ubest/mbest: 1/0                                        ! АдрСс Host-2
    *via 10.255.1.20%default, [200/0], 01:20:20, bgp-65001, internal, tag 65001     ! Доступный Ρ‡Π΅Ρ€Π΅Π· Leaf-2
(evpn) segid: 99000 tunnelid: 0xaff0114 encap: VXLAN                                ! Π§Π΅Ρ€Π΅Π· VNI 99000

Uqaphele ukungabikho kwesiqalo esiyinhloko 192.168.20.0/24 kuthebula lomzila?
Impela, ayikho lapho. Okusho ukuthi, i-remote Leafs ithola kuphela ulwazi mayelana nabasingathi kunethiwekhi yakho. Futhi lokhu ukuziphatha okulungile. Kuzo zonke izibuyekezo ezingenhla, ungabona ukuthi ulwazi olutholiwe luqukethe ulwazi lwe-MAC/IP. Akukho okukhulunywa ngakho nganoma yiziphi iziqalo.

Lona umsebenzi wephrothokholi ye-Host Mobility Manager (HMM), egcwalisa ithebula le-ARP, elibese ligcwalisa ithebula le-BGP (sizokweqa le nqubo ngezinjongo zalesi sihloko). Ngokusekelwe kulwazi olutholwe ku-HMM, i-EVPN yohlobo lomzila 2 (i-MAC/IP iyadluliselwa) iyakhiqizwa.

Nokho, yini okufanele uyenze uma kunesidingo sokudlulisa ulwazi mayelana nesiqalo esithile?

Ngalolu hlobo lolwazi, kukhona i-EVPN yohlobo lomzila 5 - ikuvumela ukuthi udlulise iziqalo ngekheli-umndeni l2vpn evpn (ngesikhathi sokubhala lolu hlobo lomzila lusenguqulo yokusalungiswa kuphela) I-RFC, ngenxa yalokhu, abakhiqizi abahlukene bangase babe nokuziphatha okuhlukile lapho besebenza nalolu hlobo lomzila)

Ukuze udlulise iziqalo, kuyadingeka ukwengeza iziqalo ezizomenyezelwa kunqubo ye-BGP ye-VRF:

router bgp 65001
  vrf PROD
    address-family ipv4 unicast
      redistribute direct route-map VNI20000        ! Π’ Π΄Π°Π½Π½ΠΎΠΌ случаС анонсируСм прСфиксы ΠΏΠΎΠ΄ΠΊΠ»ΡŽΡ‡Π΅Π½ΠΈΠ΅ нСпосрСдствСнно ΠΊ Leaf Π² VNI 20000
route-map VNI20000 permit 10
  match ip address prefix-list VNI20000_OUT    ! Π£ΠΊΠ°Π·Ρ‹Π²Π°Π΅ΠΌ ΠΊΠ°ΠΊΠΎΠΉ ΠΈΡΠΏΠΎΠ»ΡŒΠ·ΠΎΠ²Π°Ρ‚ΡŒ prefix-list

ip prefix-list VNI20000_OUT seq 5 permit 192.168.20.0/24   ! Π£ΠΊΠ°Π·Ρ‹Π²Π°Π΅ΠΌ ΠΊΠ°ΠΊΠΈΠ΅ сСти Π±ΡƒΠ΄ΡƒΡ‚ ΠΏΠΎΠΏΠ°Π΄Π°Ρ‚ΡŒ Π² EVPN route-type 5

Ngenxa yalokho, Isibuyekezo sizoqukatha:

Imboni ye-VxLAN. Ingxenye 2

Ake sibheke ithebula le-BGP. Ngokungeziwe ezinhlotsheni zomzila we-EVPN 2 no-3, thayipha imizila emi-5, equkethe imininingwane yenombolo yenethiwekhi:

<......>
   Network            Next Hop            Metric     LocPrf     Weight Path
Route Distinguisher: 10.255.1.11:3
* i[5]:[0]:[0]:[24]:[192.168.10.0]/224
                      10.255.1.10              0        100          0 ?
*>i                   10.255.1.10              0        100          0 ?

Route Distinguisher: 10.255.1.11:32777
* i[2]:[0]:[0]:[48]:[5001.0007.0007]:[0]:[0.0.0.0]/216
                      10.255.1.10                       100          0 i
*>i                   10.255.1.10                       100          0 i
* i[2]:[0]:[0]:[48]:[5001.0007.0007]:[32]:[192.168.10.10]/272
                      10.255.1.10                       100          0 i
*>i                   10.255.1.10                       100          0 i
* i[3]:[0]:[32]:[10.255.1.10]/88
                      10.255.1.10                       100          0 i
*>i                   10.255.1.10                       100          0 i

Route Distinguisher: 10.255.1.12:3
*>i[5]:[0]:[0]:[24]:[192.168.10.0]/224      ! EVPN route-type 5 с Π½ΠΎΠΌΠ΅Ρ€ΠΎΠΌ прСфикса
                      10.255.1.10              0        100          0 ?
* i
<.......>

Isiqalo siphinde savela kuthebula lomzila:

Leaf21# sh ip ro vrf PROD
192.168.10.0/24, ubest/mbest: 1/0
    *via 10.255.1.10%default, [200/0], 00:14:32, bgp-65001, internal, tag 65001  ! Π£Π΄Π°Π»Π΅Π½Π½Ρ‹ΠΉ прСфикс, доступный Ρ‡Π΅Ρ€Π΅Π· Leaf1/2(адрСс Next-hop = virtual IP ΠΌΠ΅ΠΆΠ΄Ρƒ ΠΏΠ°Ρ€ΠΎΠΉ VPC)
(evpn) segid: 99000 tunnelid: 0xaff010a encap: VXLAN      ! ΠŸΡ€Π΅Ρ„ΠΈΠΊΡ доступСн Ρ‡Π΅Ρ€Π΅Π· L3VNI 99000

192.168.10.10/32, ubest/mbest: 1/0
    *via 10.255.1.10%default, [200/0], 02:33:40, bgp-65001, internal, tag 65001
(evpn) segid: 99000 tunnelid: 0xaff010a encap: VXLAN

192.168.20.0/24, ubest/mbest: 1/0, attached
    *via 192.168.20.1, Vlan20, [0/0], 02:39:44, direct
192.168.20.1/32, ubest/mbest: 1/0, attached
    *via 192.168.20.1, Vlan20, [0/0], 02:39:44, local
192.168.20.20/32, ubest/mbest: 1/0, attached
    *via 192.168.20.20, Vlan20, [190/0], 02:35:46, hmm

Lokhu kuphetha ingxenye yesibili yochungechunge lwethu ku-VxLAN EVPN. Engxenyeni elandelayo, sizobheka izinketho ezahlukene zomzila phakathi kwama-VRF.

I-IPv6 Basics nokuthi Ihluke Kanjani ku-IPv4

Source: www.habr.com

Thenga ukusingathwa okuthembekile kwamasayithi anokuvikelwa kwe-DDoS, amaseva e-VPS VDS πŸ”₯ Thenga ukusingathwa kwewebhusayithi okuthembekile ngokuvikelwa kwe-DDoS, amaseva e-VPS VDS | ProHoster