ENSP Pro VXLAN EVPN分布式网关部署配置

datacom_chen2023-12-11 11:00

分布式网关

在BGP EVPN方式部署分布式网关的场景中，控制平面的流程包括VXLAN隧道建立、MAC地址动态学习；转发平面的流程包括同子网已知单播报文转发、同子网BUM报文转发、跨子网报文转发。该方式实现的功能全面，支持主机IP路由通告、主机MAC地址通告、主机ARP通告，可以直接使能ARP广播抑制功能。如果在VXLAN网络中采用分布式网关，推荐使用此方式。

对比集中式网关，分布式网关的arp条目比集中式网关的arp条目少，分布式网关只学习租户侧的arp条目，不学习网络侧的arp条目

拓扑

实验目的

全互联互通，underlay使用OSPF来使底层可达，后使用BGP EVPN传递Type 2（学习MAC和32位的主机路由），Type 3路由（动态发现VTEP，自动建立VXLAN隧道）

创建两个BD，1.0/24在BD1000，2.0/24在BD2000 网关分别为：192.168.1.254/24 192.168.2.254/24

业务接入点

c 复制代码 
TOR_S-1：
    vlan batch  10 20
    #
    interface GE1/0/1
 		port link-type trunk
 		port trunk allow-pass vlan 10 20
	#
    interface GE1/0/2
    	port link-type access 
 		port default vlan 10
	#
	interface GE1/0/3
    	port link-type access 
 		port default vlan 20
c 复制代码 
TOR_S-2：
    vlan batch  10 20
    #
    interface GE1/0/1
 		port link-type trunk
 		port trunk allow-pass vlan 10 20
	#
    interface GE1/0/3
    	port link-type access 
 		port default vlan 10
	#
	interface GE1/0/2
    	port link-type access 
 		port default vlan 20
c 复制代码 
leaf1_CE-3:
	bridge-domain 1000
 		vxlan vni 5010
	#
	bridge-domain 2000
 		vxlan vni 5020
    #
	interface GE1/0/3.10 mode l2
 		encapsulation dot1q vid 10
 		bridge-domain 1000
	#
	interface GE1/0/3.20 mode l2
 		encapsulation dot1q vid 20
 		bridge-domain 2000
c 复制代码 
leaf1_CE-4:
	bridge-domain 1000
 		vxlan vni 5010
	#
	bridge-domain 2000
 		vxlan vni 5020
    #
	interface GE1/0/3.10 mode l2
 		encapsulation dot1q vid 10
 		bridge-domain 1000
	#
	interface GE1/0/3.20 mode l2
 		encapsulation dot1q vid 20
 		bridge-domain 2000

underlay

c 复制代码 
leaf1_CE-3:
	interface LoopBack0
 		ip address 1.1.1.1 255.255.255.255
	#
	interface LoopBack1
		 ip address 11.11.11.11 255.255.255.255
    #
	interface GE1/0/1
 		undo portswitch
 		ip address 10.1.1.1 255.255.255.252
 		ospf network-type p2p
	#
	interface GE1/0/2
 		undo portswitch
 		ip address 10.1.1.5 255.255.255.252
 		ospf network-type p2p
    #
	ospf 1 router-id 11.11.11.11
 		area 0.0.0.0
  			network 1.1.1.1 0.0.0.0
  			network 10.1.1.0 0.0.0.255
  			network 11.11.11.11 0.0.0.0
c 复制代码 
leaf1_CE-4:
	interface LoopBack0
 		ip address 2.2.2.2 255.255.255.255
	#
	interface LoopBack1
		 ip address 22.22.22.22 255.255.255.255
    #
	interface GE1/0/1
 		undo portswitch
 		ip address 10.1.1.9 255.255.255.252
 		ospf network-type p2p
	#
	interface GE1/0/2
 		undo portswitch
 		ip address 10.1.1.13 255.255.255.252
 		ospf network-type p2p
    #
	ospf 1 router-id 22.22.22.22
 		area 0.0.0.0
  			network 2.2.2.2 0.0.0.0
  			network 10.1.1.0 0.0.0.255
  			network 22.22.22.22 0.0.0.0
c 复制代码 
spine_CE-1：
	interface LoopBack1
		 ip address 33.33.33.33 255.255.255.255
    #
	interface GE1/0/1
 		undo portswitch
 		ip address 10.1.1.2 255.255.255.252
 		ospf network-type p2p
	#
	interface GE1/0/2
 		undo portswitch
 		ip address 10.1.1.10 255.255.255.252
 		ospf network-type p2p
    #
	ospf 1 router-id 33.33.33.33
 		area 0.0.0.0
  			network 10.1.1.0 0.0.0.255
  			network 33.33.33.33 0.0.0.0
c 复制代码 
spine_CE-2：
	interface LoopBack1
		 ip address 44.44.44.44 255.255.255.255
    #
	interface GE1/0/1
 		undo portswitch
 		ip address 10.1.1.6 255.255.255.252
 		ospf network-type p2p
	#
	interface GE1/0/2
 		undo portswitch
 		ip address 10.1.1.14 255.255.255.252
 		ospf network-type p2p
    #
	ospf 1 router-id 44.44.44.44
 		area 0.0.0.0
  			network 10.1.1.0 0.0.0.255
  			network 44.44.44.44 0.0.0.0

underlay已经完成，ospf邻居已经建立成功

Overlay

c 复制代码 
leaf1_CE-3:
	evpn-overlay enable 
    #
	ip vpn-instance abc
 		ipv4-family
  			route-distinguisher 1:1
  			vpn-target 11:1 export-extcommunity evpn
  			vpn-target 11:1 import-extcommunity evpn
 		vxlan vni 3000
	#
    bridge-domain 1000
 		vxlan vni 5010
 		evpn
  			route-distinguisher 1000:1
  			vpn-target 5010:1 export-extcommunity
 			vpn-target 11:1 export-extcommunity
  			vpn-target 5010:1 import-extcommunity
	#
    bridge-domain 2000
 		vxlan vni 5020
 		evpn
  			route-distinguisher 2000:1
  			vpn-target 5020:1 export-extcommunity
 			vpn-target 11:1 export-extcommunity
  			vpn-target 5020:1 import-extcommunity
	#
	interface Vbdif1000
    	ip binding vpn-instance abc
 		ip address 192.168.1.254 255.255.255.0
 		mac-address 0000-5e00-0001
 		vxlan anycast-gateway enable
 		arp collect host enable
	#
	interface Vbdif2000
    	ip binding vpn-instance abc
 		ip address 192.168.2.254 255.255.255.0
 		mac-address 0000-5e00-0002
 		vxlan anycast-gateway enable
 		arp collect host enable
	#
	interface Nve1
 		source 1.1.1.1
 		vni 5010 head-end peer-list protocol bgp
 		vni 5020 head-end peer-list protocol bgp
	#
	bgp 65000
 		router-id 11.11.11.11
 		undo default ipv4-unicast
 		peer 33.33.33.33 as-number 65000
 		peer 33.33.33.33 connect-interface LoopBack1
 		peer 44.44.44.44 as-number 65000
 		peer 44.44.44.44 connect-interface LoopBack1
 		l2vpn-family evpn
  			policy vpn-target
  			peer 33.33.33.33 enable
  			peer 33.33.33.33 advertise irb
  			peer 44.44.44.44 enable
  			peer 44.44.44.44 advertise irb
c 复制代码 
leaf1_CE-4:
	evpn-overlay enable 
    #
	ip vpn-instance abc
 		ipv4-family
  			route-distinguisher 1:2
  			vpn-target 11:1 export-extcommunity evpn
  			vpn-target 11:1 import-extcommunity evpn
 		vxlan vni 3000
	#
    bridge-domain 1000
 		vxlan vni 5010
 		evpn
  			route-distinguisher 1000:2
  			vpn-target 5010:1 export-extcommunity
 			vpn-target 11:1 export-extcommunity
  			vpn-target 5010:1 import-extcommunity
	#
    bridge-domain 2000
 		vxlan vni 5020
 		evpn
  			route-distinguisher 2000:2
  			vpn-target 5020:1 export-extcommunity
 			vpn-target 11:1 export-extcommunity
  			vpn-target 5020:1 import-extcommunity
	#
	interface Vbdif1000
    	ip binding vpn-instance abc
 		ip address 192.168.1.254 255.255.255.0
 		mac-address 0000-5e00-0001
 		vxlan anycast-gateway enable
 		arp collect host enable
	#
	interface Vbdif2000
    	ip binding vpn-instance abc
 		ip address 192.168.2.254 255.255.255.0
 		mac-address 0000-5e00-0002
 		vxlan anycast-gateway enable
 		arp collect host enable
	#
	interface Nve1
 		source 2.2.2.2
 		vni 5010 head-end peer-list protocol bgp
 		vni 5020 head-end peer-list protocol bgp
	#
	bgp 65000
 		router-id 22.22.22.22
 		undo default ipv4-unicast
 		peer 33.33.33.33 as-number 65000
 		peer 33.33.33.33 connect-interface LoopBack1
 		peer 44.44.44.44 as-number 65000
 		peer 44.44.44.44 connect-interface LoopBack1
 		l2vpn-family evpn
  			policy vpn-target
  			peer 33.33.33.33 enable
  			peer 33.33.33.33 advertise irb
  			peer 44.44.44.44 enable
  			peer 44.44.44.44 advertise irb
c 复制代码 
spine_CE-1：
	bgp 65000
 		router-id 33.33.33.33
 		undo default ipv4-unicast
 		peer 11.11.11.11 as-number 65000
 		peer 11.11.11.11 connect-interface LoopBack1
        peer 22.22.22.22 as-number 65000
 		peer 22.22.22.22 connect-interface LoopBack1
 		l2vpn-family evpn
  			undo policy vpn-target
  			peer 11.11.11.11 enable
  			peer 11.11.11.11 advertise irb
  			peer 11.11.11.11 reflect-client
  			peer 22.22.22.22 enable
  			peer 22.22.22.22 advertise irb
  			peer 22.22.22.22 reflect-client
c 复制代码 
spine_CE-2：
	bgp 65000
 		router-id 44.44.44.44
 		undo default ipv4-unicast
 		peer 11.11.11.11 as-number 65000
 		peer 11.11.11.11 connect-interface LoopBack1
        peer 22.22.22.22 as-number 65000
 		peer 22.22.22.22 connect-interface LoopBack1
 		l2vpn-family evpn
  			undo policy vpn-target
  			peer 11.11.11.11 enable
  			peer 11.11.11.11 advertise irb
  			peer 11.11.11.11 reflect-client
  			peer 22.22.22.22 enable
  			peer 22.22.22.22 advertise irb
  			peer 22.22.22.22 reflect-client

验证

当leaf1_CE-3的VBDIF接口有了租户的ARP表项后，会通过BGP EVPN的Type 2传递32位的主机路由给对等体

下一跳为leaf1_CE-3的VTEP IP（NVE IP)，但是如果leaf1_CE-3租户的arp表项超时了，该路由也会撤销。MAC表也是类似的，当leaf1_CE-3租户的MAC超时，leaf2_CE-4上对应从EVPN Type2学到的MAC表也是撤销

Spine有两个并且都作为RR为什么只有一条呢？

相关推荐
szxinmai主板定制专家20 分钟前
RK3588+AI算力卡替代英伟达jetson方案，大算力，支持FPGA自定义扩展
arm开发·人工智能·分布式·fpga开发
帅帅梓23 分钟前
docker网络
网络·docker·php
white-persist1 小时前
SQL 注入详解：从原理到实战
前端·网络·数据库·sql·安全·web安全·原型模式
wanhengidc1 小时前
云手机的挂机功能涉及到哪些内容
运维·服务器·网络·游戏·智能手机
AORO20251 小时前
防爆手机与普通手机的区别！
网络·5g·安全·智能手机·电脑·信息与通信
非凡ghost2 小时前
猫眼浏览器(Chrome内核增强版浏览器)官方便携版
前端·网络·chrome·windows·软件需求
阿拉斯加大闸蟹2 小时前
[SIGCOMM‘25] Revisiting RDMA Reliability for Lossy Fabrics
网络·架构
嗨丶王哪跑2 小时前
网络安全审计技术原理与应用
运维·网络·安全·web安全
RTC老炮2 小时前
webrtc弱网-RobustThroughputEstimator源码分析与算法原理
网络·算法·webrtc
Pota-to成长日记3 小时前
Redisson 看门狗机制深度解析：分布式锁的守护者
分布式·wpf
热门推荐
01BongoCat - 跨平台键盘猫动画工具02两千字总结：Codex 国内如何安装和使用的教程，以及如何设置中文回答03智能库存管理的需求预测模型：从业务痛点到落地代码的完整实践04UV安装并设置国内源05GitHub 镜像站点0646个Nano-banana 精选提示词，持续更新中07Cursor Plan Mode：AI 终于知道先想后做了08Linux下V2Ray安装配置指南09GitLab 零基础入门指南：从安装到项目管理全流程10一文了解国产算子编程语言 TileLang，TileLang 对国产开源生态的影响与启示