Virtual Routing and Forwarding (VRF)

Virtual Routing and Forwarding (VRF)

The VRF device combined with ip rules provides the ability to create virtual
routing and forwarding domains (aka VRFs, VRF-lite to be specific) in the
Linux network stack. One use case is the multi-tenancy problem where each
tenant has their own unique routing tables and in the very least need
different default gateways.

Processes can be “VRF aware” by binding a socket to the VRF device. Packets
through the socket then use the routing table associated with the VRF
device. An important feature of the VRF device implementation is that it
impacts only Layer 3 and above so L2 tools (e.g., LLDP) are not affected
(ie., they do not need to be run in each VRF). The design also allows
the use of higher priority ip rules (Policy Based Routing, PBR) to take
precedence over the VRF device rules directing specific traffic as desired.

In addition, VRF devices allow VRFs to be nested within namespaces. For
example network namespaces provide separation of network interfaces at the
device layer, VLANs on the interfaces within a namespace provide L2 separation
and then VRF devices provide L3 separation.

Design

A VRF device is created with an associated route table. Network interfaces
are then enslaved to a VRF device:

     +-----------------------------+
     |           vrf-blue          |  ===> route table 10
     +-----------------------------+
        |        |            |
     +------+ +------+     +-------------+
     | eth1 | | eth2 | ... |    bond1    |
     +------+ +------+     +-------------+
                              |       |
                          +------+ +------+
                          | eth8 | | eth9 |
                          +------+ +------+

Packets received on an enslaved device and are switched to the VRF device
in the IPv4 and IPv6 processing stacks giving the impression that packets
flow through the VRF device. Similarly on egress routing rules are used to
send packets to the VRF device driver before getting sent out the actual
interface. This allows tcpdump on a VRF device to capture all packets into
and out of the VRF as a whole.[1] Similarly, netfilter[2] and tc rules can be
applied using the VRF device to specify rules that apply to the VRF domain
as a whole.

[1] Packets in the forwarded state do not flow through the device, so those
packets are not seen by tcpdump. Will revisit this limitation in a
future release.

[2] Iptables on ingress supports PREROUTING with skb->dev set to the real
ingress device and both INPUT and PREROUTING rules with skb->dev set to
the VRF device. For egress POSTROUTING and OUTPUT rules can be written
using either the VRF device or real egress device.

Setup

  1. VRF device is created with an association to a FIB table.
    ip link add vrf-blue type vrf table 10
    ip link set dev vrf-blue up

  2. An l3mdev FIB rule directs lookups to the table associated with the device.
    A single l3mdev rule is sufficient for all VRFs. The VRF device adds the
    l3mdev rule for IPv4 and IPv6 when the first device is created with a
    default preference of 1000. Users may delete the rule if desired and add
    with a different priority or install per-VRF rules.

    Prior to the v4.8 kernel iif and oif rules are needed for each VRF device:
    ip ru add oif vrf-blue table 10
    ip ru add iif vrf-blue table 10

  3. Set the default route for the table (and hence default route for the VRF).
    ip route add table 10 unreachable default metric 4278198272

    This high metric value ensures that the default unreachable route can
    be overridden by a routing protocol suite. FRRouting interprets
    kernel metrics as a combined admin distance (upper byte) and priority
    (lower 3 bytes). Thus the above metric translates to [255/8192].

  4. Enslave L3 interfaces to a VRF device.
    ip link set dev eth1 master vrf-blue

    Local and connected routes for enslaved devices are automatically moved to
    the table associated with VRF device. Any additional routes depending on
    the enslaved device are dropped and will need to be reinserted to the VRF
    FIB table following the enslavement.

    The IPv6 sysctl option keep_addr_on_down can be enabled to keep IPv6 global
    addresses as VRF enslavement changes.
    sysctl -w net.ipv6.conf.all.keep_addr_on_down=1

  5. Additional VRF routes are added to associated table.
    ip route add table 10 …

Applications

Applications that are to work within a VRF need to bind their socket to the
VRF device:

setsockopt(sd, SOL_SOCKET, SO_BINDTODEVICE, dev, strlen(dev)+1);

or to specify the output device using cmsg and IP_PKTINFO.

By default the scope of the port bindings for unbound sockets is
limited to the default VRF. That is, it will not be matched by packets
arriving on interfaces enslaved to an l3mdev and processes may bind to
the same port if they bind to an l3mdev.

TCP & UDP services running in the default VRF context (ie., not bound
to any VRF device) can work across all VRF domains by enabling the
tcp_l3mdev_accept and udp_l3mdev_accept sysctl options:

sysctl -w net.ipv4.tcp_l3mdev_accept=1
sysctl -w net.ipv4.udp_l3mdev_accept=1

These options are disabled by default so that a socket in a VRF is only
selected for packets in that VRF. There is a similar option for RAW
sockets, which is enabled by default for reasons of backwards compatibility.
This is so as to specify the output device with cmsg and IP_PKTINFO, but
using a socket not bound to the corresponding VRF. This allows e.g. older ping
implementations to be run with specifying the device but without executing it
in the VRF. This option can be disabled so that packets received in a VRF
context are only handled by a raw socket bound to the VRF, and packets in the
default VRF are only handled by a socket not bound to any VRF:

sysctl -w net.ipv4.raw_l3mdev_accept=0

netfilter rules on the VRF device can be used to limit access to services
running in the default VRF context as well.

################################################################################

Using iproute2 for VRFs

iproute2 supports the vrf keyword as of v4.7. For backwards compatibility this
section lists both commands where appropriate – with the vrf keyword and the
older form without it.

  1. Create a VRF

    To instantiate a VRF device and associate it with a table:
    $ ip link add dev NAME type vrf table ID

    As of v4.8 the kernel supports the l3mdev FIB rule where a single rule
    covers all VRFs. The l3mdev rule is created for IPv4 and IPv6 on first
    device create.

  2. List VRFs

    To list VRFs that have been created:
    $ ip [-d] link show type vrf
    NOTE: The -d option is needed to show the table id

    For example:
    $ ip -d link show type vrf
    11: mgmt: <NOARP,MASTER,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
    link/ether 72:b3:ba:91:e2:24 brd ff:ff:ff:ff:ff:ff promiscuity 0
    vrf table 1 addrgenmode eui64
    12: red: <NOARP,MASTER,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
    link/ether b6:6f:6e:f6:da:73 brd ff:ff:ff:ff:ff:ff promiscuity 0
    vrf table 10 addrgenmode eui64
    13: blue: <NOARP,MASTER,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
    link/ether 36:62:e8:7d:bb:8c brd ff:ff:ff:ff:ff:ff promiscuity 0
    vrf table 66 addrgenmode eui64
    14: green: <NOARP,MASTER,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
    link/ether e6:28:b8:63:70:bb brd ff:ff:ff:ff:ff:ff promiscuity 0
    vrf table 81 addrgenmode eui64

    Or in brief output:

    $ ip -br link show type vrf
    mgmt UP 72:b3:ba:91:e2:24 <NOARP,MASTER,UP,LOWER_UP>
    red UP b6:6f:6e:f6:da:73 <NOARP,MASTER,UP,LOWER_UP>
    blue UP 36:62:e8:7d:bb:8c <NOARP,MASTER,UP,LOWER_UP>
    green UP e6:28:b8:63:70:bb <NOARP,MASTER,UP,LOWER_UP>

  3. Assign a Network Interface to a VRF

    Network interfaces are assigned to a VRF by enslaving the netdevice to a
    VRF device:
    $ ip link set dev NAME master NAME

    On enslavement connected and local routes are automatically moved to the
    table associated with the VRF device.

    For example:
    $ ip link set dev eth0 master mgmt

  4. Show Devices Assigned to a VRF

    To show devices that have been assigned to a specific VRF add the master
    option to the ip command:
    $ ip link show vrf NAME
    $ ip link show master NAME

    For example:
    $ ip link show vrf red
    3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP mode DEFAULT group default qlen 1000
    link/ether 02:00:00:00:02:02 brd ff:ff:ff:ff:ff:ff
    4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP mode DEFAULT group default qlen 1000
    link/ether 02:00:00:00:02:03 brd ff:ff:ff:ff:ff:ff
    7: eth5: <BROADCAST,MULTICAST> mtu 1500 qdisc noop master red state DOWN mode DEFAULT group default qlen 1000
    link/ether 02:00:00:00:02:06 brd ff:ff:ff:ff:ff:ff

    Or using the brief output:
    $ ip -br link show vrf red
    eth1 UP 02:00:00:00:02:02 <BROADCAST,MULTICAST,UP,LOWER_UP>
    eth2 UP 02:00:00:00:02:03 <BROADCAST,MULTICAST,UP,LOWER_UP>
    eth5 DOWN 02:00:00:00:02:06 <BROADCAST,MULTICAST>

  5. Show Neighbor Entries for a VRF

    To list neighbor entries associated with devices enslaved to a VRF device
    add the master option to the ip command:
    $ ip [-6] neigh show vrf NAME
    $ ip [-6] neigh show master NAME

    For example:
    $ ip neigh show vrf red
    10.2.1.254 dev eth1 lladdr a6:d9:c7:4f:06:23 REACHABLE
    10.2.2.254 dev eth2 lladdr 5e:54:01:6a:ee:80 REACHABLE

    $ ip -6 neigh show vrf red
    2002:1::64 dev eth1 lladdr a6:d9:c7:4f:06:23 REACHABLE

  6. Show Addresses for a VRF

    To show addresses for interfaces associated with a VRF add the master
    option to the ip command:
    $ ip addr show vrf NAME
    $ ip addr show master NAME

    For example:
    $ ip addr show vrf red
    3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP group default qlen 1000
    link/ether 02:00:00:00:02:02 brd ff:ff:ff:ff:ff:ff
    inet 10.2.1.2/24 brd 10.2.1.255 scope global eth1
    valid_lft forever preferred_lft forever
    inet6 2002:1::2/120 scope global
    valid_lft forever preferred_lft forever
    inet6 fe80::ff:fe00:202/64 scope link
    valid_lft forever preferred_lft forever
    4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master red state UP group default qlen 1000
    link/ether 02:00:00:00:02:03 brd ff:ff:ff:ff:ff:ff
    inet 10.2.2.2/24 brd 10.2.2.255 scope global eth2
    valid_lft forever preferred_lft forever
    inet6 2002:2::2/120 scope global
    valid_lft forever preferred_lft forever
    inet6 fe80::ff:fe00:203/64 scope link
    valid_lft forever preferred_lft forever
    7: eth5: <BROADCAST,MULTICAST> mtu 1500 qdisc noop master red state DOWN group default qlen 1000
    link/ether 02:00:00:00:02:06 brd ff:ff:ff:ff:ff:ff

    Or in brief format:
    $ ip -br addr show vrf red
    eth1 UP 10.2.1.2/24 2002:1::2/120 fe80::ff:fe00:202/64
    eth2 UP 10.2.2.2/24 2002:2::2/120 fe80::ff:fe00:203/64
    eth5 DOWN

  7. Show Routes for a VRF

    To show routes for a VRF use the ip command to display the table associated
    with the VRF device:
    $ ip [-6] route show vrf NAME
    $ ip [-6] route show table ID

    For example:
    $ ip route show vrf red
    unreachable default metric 4278198272
    broadcast 10.2.1.0 dev eth1 proto kernel scope link src 10.2.1.2
    10.2.1.0/24 dev eth1 proto kernel scope link src 10.2.1.2
    local 10.2.1.2 dev eth1 proto kernel scope host src 10.2.1.2
    broadcast 10.2.1.255 dev eth1 proto kernel scope link src 10.2.1.2
    broadcast 10.2.2.0 dev eth2 proto kernel scope link src 10.2.2.2
    10.2.2.0/24 dev eth2 proto kernel scope link src 10.2.2.2
    local 10.2.2.2 dev eth2 proto kernel scope host src 10.2.2.2
    broadcast 10.2.2.255 dev eth2 proto kernel scope link src 10.2.2.2

    $ ip -6 route show vrf red
    local 2002:1:: dev lo proto none metric 0 pref medium
    local 2002:1::2 dev lo proto none metric 0 pref medium
    2002:1::/120 dev eth1 proto kernel metric 256 pref medium
    local 2002:2:: dev lo proto none metric 0 pref medium
    local 2002:2::2 dev lo proto none metric 0 pref medium
    2002:2::/120 dev eth2 proto kernel metric 256 pref medium
    local fe80:: dev lo proto none metric 0 pref medium
    local fe80:: dev lo proto none metric 0 pref medium
    local fe80::ff:fe00:202 dev lo proto none metric 0 pref medium
    local fe80::ff:fe00:203 dev lo proto none metric 0 pref medium
    fe80::/64 dev eth1 proto kernel metric 256 pref medium
    fe80::/64 dev eth2 proto kernel metric 256 pref medium
    ff00::/8 dev red metric 256 pref medium
    ff00::/8 dev eth1 metric 256 pref medium
    ff00::/8 dev eth2 metric 256 pref medium
    unreachable default dev lo metric 4278198272 error -101 pref medium

  8. Route Lookup for a VRF

    A test route lookup can be done for a VRF:
    $ ip [-6] route get vrf NAME ADDRESS
    $ ip [-6] route get oif NAME ADDRESS

    For example:
    $ ip route get 10.2.1.40 vrf red
    10.2.1.40 dev eth1 table red src 10.2.1.2
    cache

    $ ip -6 route get 2002:1::32 vrf red
    2002:1::32 from :: dev eth1 table red proto kernel src 2002:1::2 metric 256 pref medium

  9. Removing Network Interface from a VRF

    Network interfaces are removed from a VRF by breaking the enslavement to
    the VRF device:
    $ ip link set dev NAME nomaster

    Connected routes are moved back to the default table and local entries are
    moved to the local table.

    For example:
    $ ip link set dev eth0 nomaster


Commands used in this example:

cat >> /etc/iproute2/rt_tables.d/vrf.conf <<EOF
1  mgmt
10 red
66 blue
81 green
EOF

function vrf_create
{
    VRF=$1
    TBID=$2

    # create VRF device
    ip link add ${VRF} type vrf table ${TBID}

    if [ "${VRF}" != "mgmt" ]; then
        ip route add table ${TBID} unreachable default metric 4278198272
    fi
    ip link set dev ${VRF} up
}

vrf_create mgmt 1
ip link set dev eth0 master mgmt

vrf_create red 10
ip link set dev eth1 master red
ip link set dev eth2 master red
ip link set dev eth5 master red

vrf_create blue 66
ip link set dev eth3 master blue

vrf_create green 81
ip link set dev eth4 master green


Interface addresses from /etc/network/interfaces:
auto eth0
iface eth0 inet static
      address 10.0.0.2
      netmask 255.255.255.0
      gateway 10.0.0.254

iface eth0 inet6 static
      address 2000:1::2
      netmask 120

auto eth1
iface eth1 inet static
      address 10.2.1.2
      netmask 255.255.255.0

iface eth1 inet6 static
      address 2002:1::2
      netmask 120

auto eth2
iface eth2 inet static
      address 10.2.2.2
      netmask 255.255.255.0

iface eth2 inet6 static
      address 2002:2::2
      netmask 120

auto eth3
iface eth3 inet static
      address 10.2.3.2
      netmask 255.255.255.0

iface eth3 inet6 static
      address 2002:3::2
      netmask 120

auto eth4
iface eth4 inet static
      address 10.2.4.2
      netmask 255.255.255.0

iface eth4 inet6 static
      address 2002:4::2
      netmask 120

源于: https://www.kernel.org/doc/Documentation/networking/vrf.txt
另外:https://github.com/Mellanox/mlxsw/wiki/Virtual-Routing-and-Forwarding-(VRF)

<think>我们正在解决一个具体问题:在使用TFTP VRF传输时出现'Network is unreachable'错误。根据之前的对话,我们知道用户已经配置了VRF,并且尝试在VRF上下文中执行TFTP传输,但遇到了网络不可达的问题。 首先,回顾一下VRF的基本概念:VRF允许在同一台设备上创建多个独立的路由表,从而实现网络隔离。当我们使用`ip vrf exec`命令在特定VRF中执行命令时,该命令将使用该VRF的路由表进行网络通信。 现在,问题发生在使用TFTP在VRF中传输文件时。错误信息是“sendto: Network is unreachable”,这通常表示系统无法找到到达目标IP的路由。 根据引用[1]:TCP和UDP服务运行在默认VRF上下文中(即未绑定到任何VRF设备)可以通过启用sysctl选项`tcp_l3mdev_accept`和`udp_l3mdev_accept`来跨所有VRF域工作。但是,TFTP是基于UDP的(默认端口69),所以我们需要检查这个设置。 因此,我们按照以下步骤进行故障排除: 步骤1:检查目标地址是否可达 - 在目标VRF中ping目标IP地址,确认路由是否正常。 命令:`ip vrf exec <VRF_NAME> ping <目标IP>` 步骤2:检查VRF路由表 - 确认VRF路由表中存在到达目标网络的路由。 命令:`ip route show vrf <VRF_NAME>` 步骤3:检查TFTP客户端是否在正确的VRF中运行 - 确保使用`ip vrf exec`命令在正确的VRF中启动TFTP传输。 命令:`ip vrf exec <VRF_NAME> tftp <选项> <目标IP>` 步骤4:检查系统参数设置 - 根据引用[1],如果TFTP客户端运行在默认VRF中,但需要访问绑定到特定VRF的服务,则需要启用以下两个内核参数: `net.ipv4.tcp_l3mdev_accept` `net.ipv4.udp_l3mdev_accept` 注意:TFTP使用UDP,所以主要关注`udp_l3mdev_accept`。 查看当前设置: `sysctl net.ipv4.udp_l3mdev_accept` 如果返回0,则需要设置为1: `sysctl -w net.ipv4.udp_l3mdev_accept=1` 要使设置永久生效,可以将其添加到`/etc/sysctl.conf`文件中。 步骤5:检查TFTP服务端是否在正确的VRF中监听 - 如果TFTP服务端运行在同一台设备上,那么需要确保它绑定到了正确的VRF。否则,即使客户端在VRF中运行,服务端也可能在默认路由表中监听,导致无法通信。 可以使用以下命令查看服务端监听的接口: `netstat -unlp | grep tftp` 注意:如果服务端绑定到了特定的VRF,那么它只会接收来自该VRF的流量。 如果服务端没有绑定到VRF,那么它默认在默认路由表中监听。此时,如果客户端在VRF中运行,那么客户端发出的请求将使用VRF的路由表,而服务端在默认路由表中响应,这可能导致问题。 解决方案有两种: a) 将TFTP服务端绑定到与客户端相同的VRF中(推荐)。 b) 启用上面提到的sysctl选项,允许服务端接受来自任何VRF的请求(但要注意安全风险)。 步骤6:检查防火墙设置 - 确保防火墙(iptables/nftables)没有阻止TFTP流量(UDP端口69以及后续的数据端口)。 步骤7:检查网络接口绑定到正确的VRF - 确保客户端和服务端所使用的网络接口已经绑定到正确的VRF。 命令:`ip link show` 或 `ip vrf show` 总结故障排除步骤: 1. 在VRF中测试基本连通性(ping)。 2. 检查VRF路由表。 3. 确保使用`ip vrf exec`启动TFTP客户端。 4. 设置sysctl参数`udp_l3mdev_accept=1`(如果服务端在默认VRF中)。 5. 检查TFTP服务端绑定情况。 6. 检查防火墙。 7. 检查接口绑定。 下面是一个示例场景,假设我们有一个VRF名为“blue”,TFTP服务器IP为192.168.1.100: 示例步骤: 1. 在VRF blue中ping服务器: `ip vrf exec blue ping 192.168.1.100` 如果ping不通,则检查路由和接口绑定。 2. 查看VRF blue的路由: `ip route show vrf blue` 3. 使用TFTP客户端(在VRF blue中): `ip vrf exec blue tftp 192.168.1.100 -c get file.txt` 4. 如果出现“Network is unreachable”,检查sysctl参数: `sysctl net.ipv4.udp_l3mdev_accept` 如果为0,则设置: `sysctl -w net.ipv4.udp_l3mdev_accept=1` 5. 如果服务端在本机,检查服务端是否在blue VRF中运行。如果没有,则重新配置服务端绑定到blue VRF,或者启用上述sysctl参数。 注意:TFTP传输过程中会使用随机的高端口,所以防火墙需要允许这些端口。 根据引用[2]和[3],我们了解到VRF是Linux内核支持的功能,因此上述步骤适用于Linux系统。 最后,生成相关问题: §§相关问题§§ 1. 如何将TFTP服务绑定到特定的VRF? 2. 除了TFTP,还有哪些服务在VRF中运行时需要注意类似配置? 3. 如何永久设置sysctl参数? 4. VRF中防火墙规则如何单独配置?</think>以下针对 TFTP 在 VRF 环境中出现 `sendto: Network is unreachable` 错误的排查方案,结合系统配置和网络隔离特性逐步分析: --- ### **故障排查步骤** #### 1. **验证 VRF 路由表** ```bash ip route show vrf <VRF_NAME> # 检查目标网络是否存在有效路由 ``` - 若路由缺失,添加静态路由: ```bash ip route add <目标网络> via <网关> dev <接口> vrf <VRF_NAME> ``` #### 2. **检查 VRF 绑定状态** ```bash ip vrf show # 确认 VRF 存在 ip link show dev <接口> # 验证接口绑定到正确 VRF ``` - 绑定接口到 VRF: ```bash ip link set dev <接口> vrf <VRF_NAME> ``` #### 3. **启用跨 VRF 通信内核参数** 根据引用[1],**必须启用以下参数**: ```bash # 允许 TCP/UDP 服务跨 VRF 通信 sysctl -w net.ipv4.tcp_l3mdev_accept=1 sysctl -w net.ipv4.udp_l3mdev_accept=1 # 永久生效(写入 /etc/sysctl.conf) echo "net.ipv4.tcp_l3mdev_accept=1" >> /etc/sysctl.conf echo "net.ipv4.udp_l3mdev_accept=1" >> /etc/sysctl.conf sysctl -p ``` #### 4. **验证 VRF 内基础连通性** ```bash ip vrf exec <VRF_NAME> ping <目标IP> # 测试基础连通性 ip vrf exec <VRF_NAME> traceroute <目标IP> # 检查路径 ``` #### 5. **TFTP 服务绑定配置** - **服务端需监听 VRF 接口**: ```bash # 示例:在 systemd 服务中指定 VRF [Service] BindToDevice=<VRF_INTERFACE> ``` - **客户端执行时指定 VRF**: ```bash ip vrf exec <VRF_NAME> tftp <目标IP> -c get <文件名> ``` #### 6. **防火墙策略检查** ```bash iptables -L -v -n --line-numbers -t filter # 检查默认规则 ip vrf exec <VRF_NAME> iptables -L # 检查 VRF 专属规则 ``` - 开放 TFTP 端口(UDP 69): ```bash ip vrf exec <VRF_NAME> iptables -A INPUT -p udp --dport 69 -j ACCEPT ``` #### 7. **抓包分析 VRF 流量** ```bash ip vrf exec <VRF_NAME> tcpdump -i <接口> udp port 69 -v ``` - 观察是否生成 ARP 请求 - 检查 UDP 包是否被丢弃 --- ### **根本原因分析** | **故障点** | **症状** | **解决方案** | |----------------------|-----------------------------|---------------------------| | VRF 路由缺失 | 目标网络无有效路由 | 添加 VRF 专属路由 | | 内核未启用跨 VRF 通信 | 默认 VRF 无法响应其他 VRF 请求 | 启用 `udp_l3mdev_accept=1` [^1] | | TFTP 服务未绑定 VRF | 服务监听全局上下文 | 绑定服务到 VRF 接口 | | 防火墙拦截 | UDP/69 流量被丢弃 | 添加 VRF 专属防火墙规则 | --- ### **配置示例(完整流程)** ```bash # 创建 VRF ip link add vrf-blue type vrf table 10 ip link set dev eth1 vrf vrf-blue # 添加路由 ip route add 192.168.2.0/24 via 192.168.1.1 dev eth1 vrf vrf-blue # 启用内核参数 sysctl -w net.ipv4.udp_l3mdev_accept=1 # 启动 TFTP 客户端(VRF 环境) ip vrf exec vrf-blue tftp 192.168.2.100 -c get config.txt ``` --- ###
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值