1 环境搭建
本环境为真实交换机环境配置，如果您采用华为ensp模拟器参照配置，会有一些配置无法实现或者有微小差异。
3 underlay配置
3.1 gz-sprine1
interface 40GE7/0/1
undo portswitch
ip address 10.210.244.37 255.255.255.252
ospf network-type p2p
device transceiver 40GBASE-FIBER
#
interface 40GE7/0/2
undo portswitch
ip address 10.210.244.41 255.255.255.252
ospf network-type p2p
device transceiver 40GBASE-FIBER
#
interface 40GE7/0/3
undo portswitch
ip address 10.210.244.53 255.255.255.252
ospf network-type p2p
device transceiver 40GBASE-FIBER
#
interface 40GE7/0/4
undo portswitch
ip address 10.210.244.57 255.255.255.252
ospf network-type p2p
device transceiver 40GBASE-FIBER
#
interface LoopBack0
description VTEP-IP/route-id
ip address 10.210.245.1 255.255.255.255
ospf 1 router-id 10.210.245.1
area 0.0.0.0
network 10.210.244.36 0.0.0.3
network 10.210.244.40 0.0.0.3
network 10.210.244.52 0.0.0.3
network 10.210.244.56 0.0.0.3
network 10.210.245.1 0.0.0.0
bgp 65535
router-id 10.210.245.1
undo default ipv4-unicast
peer 10.210.245.3 as-number 65535
peer 10.210.245.3 connect-interface LoopBack0
peer 10.210.245.4 as-number 65535
peer 10.210.245.4 connect-interface LoopBack0
#
ipv4-family unicast
undo peer 10.210.245.3 enable
undo peer 10.210.245.4 enable
#
l2vpn-family evpn
undo policy vpn-target
peer 10.210.245.3 enable
peer 10.210.245.3 advertise irb
peer 10.210.245.3 reflect-client
peer 10.210.245.4 enable
peer 10.210.245.4 advertise irb
peer 10.210.245.4 reflect-client
3.2 gz-leaf1
# gz-leaf1
evpn-overlay enable
interface 100GE1/0/1
undo portswitch
ip address 10.210.244.38 255.255.255.252
ospf network-type p2p
ospf peer hold-max-cost timer 800000
device transceiver 40GBASE-FIBER
interface 100GE1/0/2
undo portswitch
ip address 10.210.244.54 255.255.255.252
ospf network-type p2p
ospf peer hold-max-cost timer 800000
device transceiver 40GBASE-FIBER
interface LoopBack0
description VTEP-IP/route-id
ip address 10.210.245.4 255.255.255.255
ospf 1 router-id 10.210.245.138
area 0.0.0.0
network 10.210.244.36 0.0.0.3
network 10.210.244.52 0.0.0.3
network 10.210.245.3 0.0.0.0
bgp 65535
router-id 10.210.245.3
undo default ipv4-unicast
peer 10.210.245.1 as-number 65535
peer 10.210.245.1 connect-interface LoopBack0
#
ipv4-family unicast
undo peer 10.210.245.1 enable
#
l2vpn-family evpn
policy vpn-target
peer 10.210.245.1 enable
peer 10.210.245.1 advertise irb
3.3 gz-leaf2
# gz-leaf2
evpn-overlay enable
interface 100GE1/0/1
undo portswitch
ip address 10.210.244.42 255.255.255.252
ospf network-type p2p
ospf peer hold-max-cost timer 800000
device transceiver 40GBASE-FIBER
interface 100GE1/0/2
undo portswitch
ip address 10.210.244.58 255.255.255.252
ospf network-type p2p
ospf peer hold-max-cost timer 800000
device transceiver 40GBASE-FIBER
interface LoopBack0
description VTEP-IP/route-id
ip address 10.210.245.4 255.255.255.255
ospf 1 router-id 10.210.245.138
area 0.0.0.0
network 10.210.244.40 0.0.0.3
network 10.210.244.56 0.0.0.3
network 10.210.245.4 0.0.0.0
bgp 65535
router-id 10.210.245.4
undo default ipv4-unicast
peer 10.210.245.132 as-number 65535
peer 10.210.245.132 connect-interface LoopBack0
#
ipv4-family unicast
undo peer 10.210.245.132 enable
#
l2vpn-family evpn
policy vpn-target
peer 10.210.245.132 enable
peer 10.210.245.132 advertise irb
#
4 分布式网关l2-gateway方式
4.1 Nve配置
# gz-leaf1:
interface Nve1
source 10.210.245.3
vni 10 head-end peer-list protocol bgp
# gz-leaf2
interface Nve1
source 10.210.245.4
vni 10 head-end peer-list protocol bgp
#
4.2 BD配置
# gz-leaf1:
bridge-domain 10
vxlan vni 10
#
evpn
route-distinguisher 10:1
vpn-target 10:1 export-extcommunity
vpn-target 10:1 import-extcommunity
arp broadcast-suppress enable
# gz-leaf2:
bridge-domain 10
vxlan vni 10
#
evpn
route-distinguisher 10:1
vpn-target 10:1 export-extcommunity
vpn-target 10:1 import-extcommunity
arp broadcast-suppress enable
4.3 vlan to vxlan配置
# gz-leaf1:
interface 10GE1/0/47.100 mode l2
encapsulation dot1q vid 10
bridge-domain 10
# gz-leaf2:
interface 10GE1/0/47.100 mode l2
encapsulation dot1q vid 10
bridge-domain 10
4.4 查询相关的信息
4.4.1 leaf交换机
gz-leaf1:
display mac-address bridge-domain 10
Flags: * - Backup
# - forwarding logical interface, operations cannot be performed based
on the interface.
BD : bridge-domain Age : dynamic MAC learned time in seconds
-------------------------------------------------------------------------------
MAC Address VLAN/BD Learned-From Type Age
-------------------------------------------------------------------------------
c08c-6066-54d4 -/10 10.210.245.4 evn 265561
-------------------------------------------------------------------------------
Total items: 1
display mac-address | i 1/0/47
Flags: * - Backup
# - forwarding logical interface, operations cannot be performed based
on the interface.
BD : bridge-domain Age : dynamic MAC learned time in seconds
-------------------------------------------------------------------------------
MAC Address VLAN/BD Learned-From Type Age
-------------------------------------------------------------------------------
c08c-6074-d084 1/- 10GE1/0/47 dynamic 287863
c08c-6074-d084 -/10 10GE1/0/47.100 dynamic 9
-------------------------------------------------------------------------------
Total items: 17
display bgp evpn all routing-table
Route Distinguisher: 10:1
Network(EthTagId/MacAddrLen/MacAddr/IpAddrLen/IpAddr) NextHop
*>i 0:48:c08c-6066-54d4:0:0.0.0.0 10.210.245.4
*> 0:48:c08c-6074-d084:0:0.0.0.0 0.0.0.0
2类路由：
EVPN-Instance 10:
Number of Mac Routes: 1
Network(EthTagId/MacAddrLen/MacAddr/IpAddrLen/IpAddr) NextHop
*> 0:48:c08c-6066-54d4:0:0.0.0.0 0.0.0.0
4类路由：
EVPN-Instance 10:
Number of Inclusive Multicast Routes: 2
Network(EthTagId/IpAddrLen/OriginalIp) NextHop
*> 0:32:10.210.245.3 0.0.0.0
*>i 0:32:10.210.245.4 10.210.245.4
gz-leaf2:
display mac-address bridge-domain 10
Flags: * - Backup
# - forwarding logical interface, operations cannot be performed based
on the interface.
BD : bridge-domain Age : dynamic MAC learned time in seconds
-------------------------------------------------------------------------------
MAC Address VLAN/BD Learned-From Type Age
-------------------------------------------------------------------------------
c08c-6066-54d4 -/10 10GE1/0/47.100 dynamic 265608
-------------------------------------------------------------------------------
Total items: 1
display mac-address | i 1/0/47
Flags: * - Backup
# - forwarding logical interface, operations cannot be performed based
on the interface.
BD : bridge-domain Age : dynamic MAC learned time in seconds
-------------------------------------------------------------------------------
MAC Address VLAN/BD Learned-From Type Age
-------------------------------------------------------------------------------
c08c-6066-54d4 1/- 10GE1/0/47 dynamic 339739
c08c-6066-54d4 -/10 10GE1/0/47.100 dynamic 339739
-------------------------------------------------------------------------------
Total items: 6
display bgp evpn all routing-table:
2类路由：
Route Distinguisher: 10:1
Network(EthTagId/MacAddrLen/MacAddr/IpAddrLen/IpAddr) NextHop
*> 0:48:c08c-6066-54d4:0:0.0.0.0 0.0.0.0
4类路由：
EVPN-Instance 10:
Number of Inclusive Multicast Routes: 2
Network(EthTagId/IpAddrLen/OriginalIp) NextHop
*>i 0:32:10.210.245.3 10.210.245.3
*> 0:32:10.210.245.4 0.0.0.0
4.4.2 虚拟机
二层vni数据层面，traceroute只有一跳
R1#ping 192.168.2.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.2.2, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 1/1/1 ms
R1#traceroute 192.168.2.2
Type escape sequence to abort.
Tracing the route to 192.168.2.2
VRF info: (vrf in name/id, vrf out name/id)
1 192.168.2.2 0 msec 0 msec *
R2#ping 192.168.2.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.2.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
R2#traceroute 192.168.2.2
Type escape sequence to abort.
Tracing the route to 192.168.2.2
VRF info: (vrf in name/id, vrf out name/id)
1 192.168.2.2 0 msec 0 msec *
5 分布式网关l3-gateway方式
5.1 Nve配置
# gz-leaf1:
interface Nve1
source 10.210.245.3
# 三层不需要头端复制这条 vni 10 head-end peer-list protocol bgp
# gz-leaf2
interface Nve1
source 10.210.245.4
# 三层不需要头端复制这条 vni 10 head-end peer-list protocol bgp
5.2 BD配置
# gz-leaf1:
bridge-domain 10
vxlan vni 10
evpn
route-distinguisher 10:1
vpn-target 10:1 export-extcommunity
vpn-target 10:10 export-extcommunity #必须配置，否则路由不通
vpn-target 10:1 import-extcommunity
arp broadcast-suppress enable
arp l2-proxy gateway-mac #配置l2-proxy网关代答才会走三层vni
# gz-leaf2:
bridge-domain 10
vxlan vni 10
evpn
route-distinguisher 10:1
vpn-target 10:1 export-extcommunity
vpn-target 10:10 export-extcommunity #必须配置，否则路由不通
vpn-target 10:1 import-extcommunity
arp broadcast-suppress enable
arp l2-proxy gateway-mac #配置l2-proxy网关代答才会走三层vni
5.3 vrf配置
走三层一定要配置vrf，因为2个leaf直接走的是三层vni
# gz-leaf1:
ip vpn-instance vpn10
ipv4-family
route-distinguisher 10:10
vpn-target 10:10 export-extcommunity evpn
vpn-target 10:10 import-extcommunity evpn
vxlan vni 100
# gz-leaf2:
ip vpn-instance vpn10
ipv4-family
route-distinguisher 10:10
vpn-target 10:10 export-extcommunity evpn
vpn-target 10:10 import-extcommunity evpn
vxlan vni 100
#
5.4 vbdif接口配置
# gz-leaf1:
interface Vbdif10
ip binding vpn-instance vpn10
ip address 192.168.2.254 255.255.255.0
arp distribute-gateway enable
mac-address 0000-8888-0010
vxlan anycast-gateway enable
arp collect host enable
# gz-leaf2:
interface Vbdif10
ip binding vpn-instance vpn10
ip address 192.168.2.254 255.255.255.0
arp distribute-gateway enable
mac-address 0000-8888-0010
vxlan anycast-gateway enable
arp collect host enable
没有启用三层接口无类似0:48:c08c-6066-54d4:32:192.168.2.2这样的路由。
5.5 启用irb的宣告
# gz-leaf1:
bgp 65535
l2vpn-family evpn
peer 10.210.245.133 advertise irb
# gz-leaf2:
bgp 65535
l2vpn-family evpn
peer 10.210.245.133 advertise irb
5.6 查询相关的信息
5.6.1 leaf交换机
# gz-leaf1:
display mac-address bridge-domain 10 ：
Flags: * - Backup
# - forwarding logical interface, operations cannot be performed based
on the interface.
BD : bridge-domain Age : dynamic MAC learned time in seconds
-------------------------------------------------------------------------------
MAC Address VLAN/BD Learned-From Type Age
-------------------------------------------------------------------------------
c08c-6066-54d4 -/10 10.210.245.4 evn 254571
c08c-6074-d084 -/10 10GE1/0/47.100 dynamic 10
-------------------------------------------------------------------------------
Total items: 2
display arp | i vpn10 ：
ARP Entry Types: D - Dynamic, S - Static, I - Interface, O - OpenFlow, RD - Redirect
EXP: Expire-time VLAN: VLAN or Bridge Domain
IP ADDRESS MAC ADDRESS EXP(M) TYPE/VLAN INTERFACE VPN-INSTANCE
----------------------------------------------------------------------------------------
192.168.2.254 0000-8888-0010 I Vbdif10 vpn10
192.168.2.1 c08c-6074-d084 11 D/BD10 10GE1/0/47.100 vpn10
----------------------------------------------------------------------------------------
Total:24 Dynamic:15 Static:0 Interface:9 OpenFlow:0
Redirect:0
display bgp evpn all routing-table ：
Route Distinguisher: 10:1
Network(EthTagId/MacAddrLen/MacAddr/IpAddrLen/IpAddr) NextHop
*> 0:48:0000-8888-0010:0:0.0.0.0 0.0.0.0
*>i 0:48:c08c-6066-54d4:0:0.0.0.0 10.210.245.4
*>i 0:48:c08c-6066-54d4:32:192.168.2.2 10.210.245.4
*> 0:48:c08c-6074-d084:0:0.0.0.0 0.0.0.0
*> 0:48:c08c-6074-d084:32:192.168.2.1 0.0.0.0
display ip routing-table vpn-instance vpn10 ：
Proto: Protocol Pre: Preference
Route Flags: R - relay, D - download to fib, T - to vpn-instance, B - black hole route
------------------------------------------------------------------------------
Routing Table : vpn10
Destinations : 6 Routes : 6
Destination/Mask Proto Pre Cost Flags NextHop Interface
192.168.2.0/24 Direct 0 0 D 192.168.2.254 Vbdif10
192.168.2.2/32 IBGP 255 0 RD 10.210.245.4 VXLAN
192.168.2.254/32 Direct 0 0 D 127.0.0.1 Vbdif10
192.168.2.255/32 Direct 0 0 D 127.0.0.1 Vbdif10
255.255.255.255/32 Direct 0 0 D 127.0.0.1 InLoopBack0
# gz-leaf2:
display mac-address bridge-domain 10 ：
Flags: * - Backup
# - forwarding logical interface, operations cannot be performed based
on the interface.
BD : bridge-domain Age : dynamic MAC learned time in seconds
-------------------------------------------------------------------------------
MAC Address VLAN/BD Learned-From Type Age
-------------------------------------------------------------------------------
c08c-6066-54d4 -/10 10GE1/0/47.100 dynamic 254640
c08c-6074-d084 -/10 10.210.245.3 evn 77
-------------------------------------------------------------------------------
Total items: 2
display arp | i vpn10 ：
ARP Entry Types: D - Dynamic, S - Static, I - Interface, O - OpenFlow, RD - Redirect
EXP: Expire-time VLAN: VLAN or Bridge Domain
IP ADDRESS MAC ADDRESS EXP(M) TYPE/VLAN INTERFACE VPN-INSTANCE
----------------------------------------------------------------------------------------
192.168.2.254 0000-8888-0010 I Vbdif10 vpn10
192.168.2.2 c08c-6066-54d4 3 D/BD10 10GE1/0/47.100 vpn10
----------------------------------------------------------------------------------------
Total:16 Dynamic:9 Static:0 Interface:7 OpenFlow:0
Redirect:0
display bgp evpn all routing-table ：
Route Distinguisher: 10:1
Network(EthTagId/MacAddrLen/MacAddr/IpAddrLen/IpAddr) NextHop
*> 0:48:0000-8888-0010:0:0.0.0.0 0.0.0.0
* i 10.210.245.3
*> 0:48:c08c-6066-54d4:0:0.0.0.0 0.0.0.0
*> 0:48:c08c-6066-54d4:32:192.168.2.2 0.0.0.0
*>i 0:48:c08c-6074-d084:0:0.0.0.0 10.210.245.3
*>i 0:48:c08c-6074-d084:32:192.168.2.1 10.210.245.3
display ip routing-table vpn-instance vpn10 ：
Proto: Protocol Pre: Preference
Route Flags: R - relay, D - download to fib, T - to vpn-instance, B - black hole route
------------------------------------------------------------------------------
Routing Table : vpn10
Destinations : 5 Routes : 5
Destination/Mask Proto Pre Cost Flags NextHop Interface
192.168.2.0/24 Direct 0 0 D 192.168.2.254 Vbdif10
192.168.2.1/32 IBGP 255 0 RD 10.210.245.3 VXLAN
192.168.2.254/32 Direct 0 0 D 127.0.0.1 Vbdif10
192.168.2.255/32 Direct 0 0 D 127.0.0.1 Vbdif10
255.255.255.255/32 Direct 0 0 D 127.0.0.1 InLoopBack0
5.6.2 虚拟机
R1#show ip arp
Protocol Address Age (min) Hardware Addr Type Interface
Internet 192.168.2.1 - c08c.6074.d084 ARPA Vlan100
Internet 192.168.2.2 162 0000.8888.0010 ARPA Vlan100
Internet 192.168.2.254 3 0000.8888.0010 ARPA Vlan100
Internet 192.168.10.5 19 c4e2.8728.e2a2 ARPA FastEthernet4
Internet 192.168.10.6 - c08c.6074.d088 ARPA FastEthernet4
R2#show ip arp
Protocol Address Age (min) Hardware Addr Type Interface
Internet 192.168.2.1 175 0000.8888.0010 ARPA Vlan100
Internet 192.168.2.2 - c08c.6066.54d4 ARPA Vlan100
Internet 192.168.2.254 8 0000.8888.0010 ARPA Vlan100
Internet 192.168.10.1 3 c4e2.8728.e0e2 ARPA FastEthernet4
Internet 192.168.10.2 - c08c.6066.54d8 ARPA FastEthernet4
测试：
R1#ping 192.168.2.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.2.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
R1#traceroute 192.168.2.2
Type escape sequence to abort.
Tracing the route to 192.168.2.2
VRF info: (vrf in name/id, vrf out name/id)
1 192.168.2.254 8 msec 0 msec 4 msec
2 192.168.2.254 696 msec 4 msec 0 msec
3 192.168.2.2 4 msec 0 msec *
R2#ping 192.168.2.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.2.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
R2#traceroute 192.168.2.1
Type escape sequence to abort.
Tracing the route to 192.168.2.1
VRF info: (vrf in name/id, vrf out name/id)
1 192.168.2.254 4 msec 0 msec 0 msec
2 192.168.2.254 76 msec 0 msec 4 msec
3 192.168.2.1 8 msec 0 msec *
走三层网络，一定要有/32的路由，此时下面虚拟机发给l3-gateway的数据包不会再发arp请求。
6 微分段测试
微分段注意要在BD启用arp l2-proxy gateway-mac，数据包不经过网关解包封包，EPG这个功能无法实现。
6.1 启用微分段
gz-leaf1
traffic-segment enable
traffic-segment segment-id 32760 segment-name EPG1 intra-epg-behavior none
segment-member ip 192.168.2.1 255.255.255.255 vpn-instance vpn10
#
gz-leaf2
traffic-segment enable
traffic-segment segment-id 32767 segment-name EPG2 intra-epg-behavior none
segment-member ip 192.168.2.2 255.255.255.255 vpn-instance vpn10
#
启用微分段后，发现不同EPG之间是无法通讯的：
gz-leaf1下面的虚拟机R1
R1#ping 192.168.2.2 source 192.168.2.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.2.2, timeout is 2 seconds:
Packet sent with a source address of 192.168.2.1
.....
Success rate is 0 percent (0/5)
gz-leaf2下面的虚拟机R2
R2#ping 192.168.2.1 source 192.168.2.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.2.1, timeout is 2 seconds:
Packet sent with a source address of 192.168.2.2
.....
Success rate is 0 percent (0/5)
6.2 启用微分段策略
启用微分段策略，打通不同EPG策略:
gz-leaf1
segment classifier EPG1-EPG2
rule permit source-segment 32760 destination-segment 32767
rule permit source-segment 32767 destination-segment 32760
#
segment behavior EPG1-EPG2
#
segment policy GBP
classifier EPG1-EPG2 behavior EPG1-EPG2
#
gz-leaf2
segment classifier EPG1-EPG2
rule permit source-segment 32760 destination-segment 32767
rule permit source-segment 32767 destination-segment 32760
#
segment behavior EPG1-EPG2
#
segment policy GBP
classifier EPG1-EPG2 behavior EPG1-EPG2
#
接gz-leaf1的R1
R1#ping 192.168.2.2 source 192.168.2.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.2.2, timeout is 2 seconds:
Packet sent with a source address of 192.168.2.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
接gz-leaf2的R2
R2#ping 192.168.2.1 source 192.168.2.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.2.1, timeout is 2 seconds:
Packet sent with a source address of 192.168.2.2
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
1863
扫一扫
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
