在Catalyst 9000系列交换机上实施BGP EVPN路由策略

已更新: 2023 年 8 月 18 日
文档 ID:220803

非歧视性语言

此产品的文档集力求使用非歧视性语言。在本文档集中，非歧视性语言是指不隐含针对年龄、残障、性别、种族身份、族群身份、性取向、社会经济地位和交叉性的歧视的语言。由于产品软件的用户界面中使用的硬编码语言、基于 RFP 文档使用的语言或引用的第三方产品使用的语言，文档中可能无法确保完全使用非歧视性语言。 深入了解思科如何使用包容性语言。

关于此翻译

思科采用人工翻译与机器翻译相结合的方式将此文档翻译成不同语言，希望全球的用户都能通过各自的语言得到支持性的内容。 请注意：即使是最好的机器翻译，其准确度也不及专业翻译人员的水平。 Cisco Systems, Inc. 对于翻译的准确性不承担任何责任，并建议您总是参考英文原始文档（已提供链接）。

    简介

    本文档介绍如何在Catalyst 9000系列交换机上的BGP EVPN VXLAN中实施路由策略。

    先决条件

    要求

    Cisco 建议您了解以下主题：

    • BGP配置和验证 
    • 路由映射和基本BGP路由策略
    • EVPN VxLAN

    使用的组件

    本文档中的信息基于以下软件和硬件版本：

    • Catalyst 9300
    • Catalyst 9400
    • Catalyst 9500
    • Catalyst 9600
    • Cisco IOS® XE 17.11.1及更高版本 

    本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始（默认）配置。如果您的网络处于活动状态，请确保您了解所有命令的潜在影响。

    背景信息

    EVPN VxLAN路由策略使用路由映射来控制主机的流量传输，以及VTEP学习和处理哪些路由：

    • 这是EVPN保护网段类型设计的一个关键方面（在本文档范围之外），其中ARP流量仅发送到中央网关(CGW)，因此CGW可以使用自己的MAC地址代理应答，即使对于本地网段流量也是如此。 
    • 受保护网段能够控制流量，使所有流量均可通过防火墙的流量检查和流量策略。 

    思科还实施了Default Gateway(DEF GW)扩展社区属性，以指示CGW拥有哪个MAC/IP前缀。

    note-icon

    注意：对于本文档范围之外的EVPN受保护网段，这是必需的。

    tip-icon

    提示：要了解有关Auto RT和Auto RD CLI简化功能的详细信息，请参阅本文档在Catalyst 9000系列交换机上为EVPN配置BGP VRF自动RD自动RT

    文档详细信息

    本文档的主要详细信息：

    • BUM流量的复制模式为入口（单播BUM隧道）
    • 使用的VLAN为201和202
    • 使用的VNI是20101和20201
    • 所有路由流量均发送到CGW（VTEP没有自己的SVI）
    • IMET路由类型3 BGP前缀是中心辐射型（枝叶只接受来自CGW的IMET路由，而不接受来自彼此的IMET路由）
    • 路由类型2和5为全网状 
    note-icon

    注意：允许全网状MAC/IP前缀的设计决策是为了移动目的。如果枝叶无法看到彼此的RT2，并且主机从一个枝叶移动到另一个枝叶，则假定它是新前缀，而不是增加现有RT2的序列号。

    支持的路由类型

    • 路由类型3（包含组播以太网标记路由）
    • 路由类型7（IGMP加入同步路由）
    • 路由类型8（IGMP离开同步路由）
    note-icon

    注意:作为此路由策略增强的一部分，还支持路由类型7和路由类型8。本文档仅演示如何匹配和过滤路由类型3前缀，但验证和方法适用于所有3种类型

    术语

    VRF

    虚拟路由转发

    定义与其他VRF和全局IPv4/IPv6路由域分离的第3层路由域

    AF

    地址系列

    定义BGP处理哪些类型前缀和路由信息

    AS

    自治系统

    一组互联网可路由IP前缀，它们属于一个网络或一组网络，由单个实体或组织管理、控制和监督

    EVPN

    以太网虚拟专用网络

    允许BGP传输第2层MAC和第3层IP信息的扩展是EVPN和 使用多协议边界网关协议(MP-BGP)作为协议，以分发与VXLAN重叠网络相关的可达性信息。

    VXLAN

    虚拟可扩展LAN（局域网）

    VXLAN旨在克服VLAN和STP的固有局限性。推荐的IETF标准[RFC 7348]提供与VLAN相同的以太网第2层网络服务，但灵活性更高。功能上，它是MAC-in-UDP封装协议，在第3层底层网络上作为虚拟重叠运行。

    CGW

    集中网关

    以及网关SVI不在每个枝叶上的EVPN的实施。相反，所有路由都由使用非对称IRB（集成路由和桥接）的特定枝叶完成

    DEF网关

    默认网关

    通过“l2vpn evpn”配置部分下的命令“default-gateway advertise enable”添加到MAC/IP前缀的BGP扩展社区属性。 

    IMET

    包含组播以太网标记（路由）

    也称为BGP类型3路由。此路由类型在EVPN中用于在VTEP之间传输BUM（广播/未知单播/组播）流量。

    配置

    网络图

    Hub and spoke IMET topology

    Ful mesh EVPN topology

    Full EVPN topology with device details

    配置

    此部分显示来自枝叶–01和边界枝叶(CGW)交换机的配置示例。其他枝叶配置相同，因此此处不重复。

    • 本文档中的示例基于入口复制，并演示如何应用策略来控制哪些VTEP可以传输广播和其他泛洪流量 

    枝叶–01（基本EVPN配置）

    Leaf-01#show run | sec l2vpn
    l2vpn evpn
     replication-type static
     flooding-suppression address-resolution disable  <-- Disables ARP caching so ARP is always sent up to the CGW 
     router-id Loopback1
    l2vpn evpn instance 201 vlan-based
 encapsulation vxlan
 replication-type ingress
 multicast advertise enable
l2vpn evpn instance 202 vlan-based
 encapsulation vxlan
 replication-type ingress
 multicast advertise enable
    Leaf-01#show run | sec vlan config
    vlan configuration 201
 member evpn-instance 201 vni 20101
vlan configuration 202
 member evpn-instance 202 vni 20201

    Leaf-01#show run int nve 1
Building configuration...

Current configuration : 327 bytes
!
interface nve1
 no ip address
 source-interface Loopback1
 host-reachability protocol bgp
 member vni 20201 ingress-replication
 member vni 20101 ingress-replication
end
    ip bgp-community new-format     <-- Required to see community in aa:nn format

    Leaf-01（路由过滤）

    确定要匹配的路由目标。

    • 为简化CLI，本文档中的示例使用自动路由目标功能。
    • 由于这是自动的，请运行此命令以了解如何配置社区列表
    Leaf-01#show l2vpn evpn route-target
Route Target           EVPN Instances
65001:201              201            <-- Route-targets for the Vlan/VNI of interest
65001:202              202    
    ip extcommunity-list expanded ALLOW-RT2 permit 65001:20[0-9] <-- match Route-targets 65001:200 - 65001:209
    !
    ip community-list standard BLOCK-RT3 permit 999:999          <-- Arbitrary RT used to mark IMET prefixes as they are advertised
    route-map POLICY-IN deny 5
 match community BLOCK-RT3 exact-match  <-- Deny prefixes that match RT 999:999 in standard community list
!
route-map POLICY-IN permit 10           <-- Permit any other prefixes that do not contain 999:999
!
route-map POLICY-OUT permit 5
 match extcommunity ALLOW-RT2           <-- Match the auto-RT in the extended community list
 match evpn route-type 3                <-- AND match route-type 3 prefixes
 set community 999:999                  <-- Set additional standard community to advertised prefixes  
!
route-map POLICY-OUT permit 10          <-- Permit prefixes that are not RT3 to be sent out without additional attributes added 
    router bgp 65001
 bgp router-id 172.16.255.3
 bgp log-neighbor-changes
 no bgp default ipv4-unicast
 neighbor 172.16.255.1 remote-as 65001
 neighbor 172.16.255.1 update-source Loopback0
 neighbor 172.16.255.2 remote-as 65001
 neighbor 172.16.255.2 update-source Loopback0
 !
 address-family ipv4
 exit-address-family
 !
 address-family ipv4 mvpn
  neighbor 172.16.255.1 activate
  neighbor 172.16.255.1 send-community both
  neighbor 172.16.255.2 activate
  neighbor 172.16.255.2 send-community both
 exit-address-family
 !
 address-family l2vpn evpn
  neighbor 172.16.255.1 activate
  neighbor 172.16.255.1 send-community both       <-- Send both standard and extended community attributes 
  neighbor 172.16.255.1 route-map POLICY-IN in    <-- Apply inbound policy to deny prefixes with 999:999 community string
  neighbor 172.16.255.1 route-map POLICY-OUT out  <-- Apply outbound policy to match RT3 / apply standard community & permit other RT2 prefixes as normal 
  neighbor 172.16.255.2 activate
  neighbor 172.16.255.2 send-community both
  neighbor 172.16.255.2 route-map POLICY-IN in
  neighbor 172.16.255.2 route-map POLICY-OUT out
 exit-address-family

    CGW（基本配置）

    CGW#show running-config | beg l2vpn evpn instance 201
l2vpn evpn instance 201 vlan-based
 encapsulation vxlan
 replication-type ingress
 default-gateway advertise enable    <-- adds the BGP attribute EVPN DEF GW:0:0 to the MAC/IP prefix
 multicast advertise enable
!
l2vpn evpn instance 202 vlan-based
 encapsulation vxlan
 replication-type ingress
 default-gateway advertise enable   <-- adds the BGP attribute EVPN DEF GW:0:0 to the MAC/IP prefix
 multicast advertise enable
    CGW#show running-config | sec vlan config
vlan configuration 201
     member evpn-instance 201 vni 20101
vlan configuration 202
 member evpn-instance 202 vni 20201
    CGW#show run int nve 1
Building configuration...

Current configuration : 313 bytes
!
interface nve1
 no ip address
 source-interface Loopback1
 host-reachability protocol bgp
 member vni 10101 mcast-group 225.0.0.101
 member vni 10102 mcast-group 225.0.0.102
     member vni 20101 ingress-replication local-routing  <-- 'ingress-replication' (Unicast all BUM traffic) / 'local-routing' (Enables vxlan centralized gateway forwarding)
 member vni 20201 ingress-replication local-routing
 member vni 50901 vrf green
end
    CGW#show run interface vlan 201
Building configuration...

Current configuration : 231 bytes
!
interface Vlan201
 mac-address 0000.beef.cafe          <-- MAC is static in this example for viewing simplicity. This is not required 
 vrf forwarding red                  <-- SVI is in VRF red
 ip address 10.1.201.1 255.255.255.0
 no ip redirects
 ip local-proxy-arp                 <-- Sets CGW to Proxy reply even for local subnet ARP requests 
 ip pim sparse-mode
 ip route-cache same-interface      <-- This is auto added when local-proxy-arp is configured. However, this is a legacy 'fast switching' command that is not used by CEF & is not required for forwarding 
 ip igmp version 3
 no autostate
end

CGW#show run interface vlan 202
Building configuration...

Current configuration : 163 bytes
!
interface Vlan202
 mac-address 0000.beef.cafe
 vrf forwarding red
 ip address 10.1.202.1 255.255.255.0
     no ip redirects 
     ip local-proxy-arp 
 ip pim sparse-mode
     ip route-cache same-interface
 ip igmp version 3
 no autostate
end
    CGW#sh run vrf red
    Building configuration...

    Current configuration : 873 bytes 
    vrf definition red
     rd 2:2
 !
 address-family ipv4
  route-target export 2:2
  route-target import 2:2
  route-target export 2:2 stitching
  route-target import 2:2 stitching
 exit-address-family
    note-icon

    注：在CGW上未应用BGP策略。允许CGW接收和发送所有前缀类型(RT2、RT5 / RT3)。

    验证

    网络图

    EVPN local Proxy ARP reply from CGW topology

     

    此图有助于直观显示本节所述的ARP解析过程。 

    • ARP请求显示为紫色。
      • 此ARP请求用于解析Leaf-01上的主机10.1.202.10的MAC地址
      • 请注意，紫色线路在CGW终止，并且未到达枝叶01
    • ARP应答显示为绿色，包含Vlan 202的CGW SVI的MAC 
      • 请注意，绿线来自CGW，而不是来自实际主机
    • 红色X表示此通信不涉及向枝叶01发送流量

    路由类型3策略（枝叶–01）

    验证应用到枝叶的路由映射是否正确过滤。我们只能看到来自CGW的IMET前缀，不能看到其他枝叶。 

    • 此处只显示了一片枝叶，但此检查应在所有相关枝叶上完成 
    note-icon

    注：一旦应用了路由映射，必须清除BGP到邻居，策略设置才能生效。

    可通过两种方法查看安装了哪种route-type 3:

    • 检查BGP条目
    • 检查l2route

    检查BGP条目(Leaf-01)

    Leaf-01#show bgp l2vpn evpn route-type 3 | inc Tunnel End
      PMSI Attribute: Flags:0x0, Tunnel type:IR, length 4, vni:20101, tunnel identifier: < Tunnel Endpoint: 172.16.254.6 >  <-- No RT3 prefixes present other than the CGW 172.16.254.6 
      PMSI Attribute: Flags:0x0, Tunnel type:IR, length 4, vni:20201, tunnel identifier: < Tunnel Endpoint: 172.16.254.6 >
      PMSI Attribute: Flags:0x0, Tunnel type:IR, length 4, vni:20101, tunnel identifier: < Tunnel Endpoint: 172.16.254.6 >
      PMSI Attribute: Flags:0x0, Tunnel type:IR, length 4, vni:20201, tunnel identifier: < Tunnel Endpoint: 172.16.254.6 >

    检查l2route

    Leaf-01-F241.03.23-9300#show l2route evpn imet
  EVI       ETAG   Prod                          Router IP Addr  Type    Label                               Tunnel ID Multicast Proxy
----- ---------- ------ --------------------------------------- ----- -------- --------------------------------------- ---------------
  201          0    BGP                            172.16.254.6     6    20101                            172.16.254.6              No <-- Only remote IMET producer is the CGW
  201          0  L2VPN                            172.16.254.3     6    20101                            172.16.254.3            IGMP
  202          0    BGP                            172.16.254.6     6    20201                            172.16.254.6              No
  202          0  L2VPN                            172.16.254.3     6    20201                            172.16.254.3            IGMP <-- Only remote IMET producer is the CGW
    note-icon

    注意：路由映射过滤器的验证仅在访问VTEP上完成。CGW接受所有类型3前缀，因此不会实施任何路由映射。

    本地路由(CGW) 

    检验CGW在本地网段ARP解析发生时是否使用自己的MAC进行应答。 

    • 除了验证配置部分所示的配置外，没有任何show命令 
    • 我们可以通过确认当主机为另一枝叶上的主机解析ARP时主机上已编程的MAC来验证这一点。

    捕获从Leaf-02主机发送到Leaf-01主机的ARP解析请求（这是使用Leaf-02访问接口上面向主机的EPC捕获完成的）

    • Leaf-01主机实际MAC:0006.f601.cd45
    • 响应ARP请求的CGW MAC:0000.beef.cafe
    Leaf-02-F241.03.23-9400#show mon cap 1 buff br | i ARP
   32  10.356291 00:06:f6:17:ee:c4 -> ff:ff:ff:ff:ff:ff ARP 64 Who has 10.1.202.10? Tell 10.1.202.11 <-- ARP request from Leaf-02 host
   33  10.357140 00:00:be:ef:ca:fe -> 00:06:f6:17:ee:c4 ARP 68 10.1.202.10 is at 00:00:be:ef:ca:fe   <-- ARP reply is the CGW MAC

    
Leaf-02-F241.03.23-9400#show mon cap 1 buff det | b Frame 32
Frame 32: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface /tmp/epc_ws/wif_to_ts_pipe, id 0
<...snip...>
    [Protocols in frame: eth:ethertype:vlan:ethertype:arp]
Ethernet II, Src: 00:06:f6:17:ee:c4 (00:06:f6:17:ee:c4), Dst: ff:ff:ff:ff:ff:ff (ff:ff:ff:ff:ff:ff)
    Destination: ff:ff:ff:ff:ff:ff (ff:ff:ff:ff:ff:ff)
        Address: ff:ff:ff:ff:ff:ff (ff:ff:ff:ff:ff:ff)
        .... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
        .... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)
    Source: 00:06:f6:17:ee:c4 (00:06:f6:17:ee:c4)
        Address: 00:06:f6:17:ee:c4 (00:06:f6:17:ee:c4)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Type: 802.1Q Virtual LAN (0x8100)
802.1Q Virtual LAN, PRI: 0, DEI: 0, ID: 202                    <-- Vlan 202 
    000. .... .... .... = Priority: Best Effort (default) (0)
    ...0 .... .... .... = DEI: Ineligible
    .... 0000 1100 1010 = ID: 202
    Type: ARP (0x0806)
    Padding: 0000000000000000000000000000
    Trailer: 00000000
Address Resolution Protocol (request)                          <-- ARP Request 
    Hardware type: Ethernet (1)
    Protocol type: IPv4 (0x0800)
    Hardware size: 6
    Protocol size: 4
    Opcode: request (1)
    Sender MAC address: 00:06:f6:17:ee:c4 (00:06:f6:17:ee:c4)
    Sender IP address: 10.1.202.11
    Target MAC address: 00:00:00:00:00:00 (00:00:00:00:00:00)
    Target IP address: 10.1.202.10                              <-- Leaf-02 Host 

Frame 33: 68 bytes on wire (544 bits), 68 bytes captured (544 bits) on interface /tmp/epc_ws/wif_to_ts_pipe, id 0
<...snip...>
Ethernet II, Src: 00:00:be:ef:ca:fe (00:00:be:ef:ca:fe), Dst: 00:06:f6:17:ee:c4 (00:06:f6:17:ee:c4)
    Destination: 00:06:f6:17:ee:c4 (00:06:f6:17:ee:c4)
        Address: 00:06:f6:17:ee:c4 (00:06:f6:17:ee:c4)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Source: 00:00:be:ef:ca:fe (00:00:be:ef:ca:fe)
        Address: 00:00:be:ef:ca:fe (00:00:be:ef:ca:fe)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Type: CiscoMetaData (0x8909)
Cisco MetaData
    Version: 1
    Length: 1
    Options: 0x0001
    SGT: 0
    Type: ARP (0x0806)
    Padding: 00000000000000000000
    Trailer: 0000000000000000
Address Resolution Protocol (reply)
    Hardware type: Ethernet (1)
    Protocol type: IPv4 (0x0800)
    Hardware size: 6
    Protocol size: 4
    Opcode: reply (2)
    Sender MAC address: 00:00:be:ef:ca:fe (00:00:be:ef:ca:fe)   <-- ARP Reply is the CGW MAC 0000.beef.cafe
    Sender IP address: 10.1.202.10
    Target MAC address: 00:06:f6:17:ee:c4 (00:06:f6:17:ee:c4)   <-- MAC of host off Leaf-02 0006.f617.eec4
    Target IP address: 10.1.202.11

    故障排除

    Debug Route-Map Policy（入站）

    确认入站路由映射是否按预期工作

    启用L2VPN EVPN更新调试 

    Leaf-02#debug bgp l2vpn evpn updates
    BGP updates debugging is on for address family: L2VPN E-VPN

    Leaf-02#debug bgp l2vpn evpn updates events
    BGP update events debugging is on for address family: L2VPN E-VPN

    Clear bgp address-family以实例化路由策略

    Leaf-02#clear bgp l2vpn evpn *

    验证仅从CGW接受路由类型3并从所有其他枝叶拒绝 

    Leaf-02#show log | i rcvd \[3\]
*Jul  4 06:40:41.556: BGP(10): 172.16.255.2 rcvd [3][172.16.254.6:202][0][32][172.16.254.6]/17    <-- Only accepted Type-3 is from the CGW (172.16.254.6)
*Jul  4 06:40:41.557: BGP(10): 172.16.255.2 rcvd [3][172.16.254.6:201][0][32][172.16.254.6]/17
*Jul  4 06:40:41.557: BGP(10): 172.16.255.2 rcvd [3][172.16.254.3:202][0][32][172.16.254.3]/17 -- DENIED due to: route-map;
*Jul  4 06:40:41.557: BGP(10): 172.16.255.2 rcvd [3][172.16.254.5:202][0][32][172.16.254.5]/17 -- DENIED due to: route-map;
*Jul  4 06:40:41.557: BGP(10): 172.16.255.2 rcvd [3][172.16.254.3:201][0][32][172.16.254.3]/17 -- DENIED due to: route-map;
*Jul  4 06:40:41.557: BGP(10): 172.16.255.2 rcvd [3][172.16.254.5:201][0][32][172.16.254.5]/17 -- DENIED due to: route-map;

    检验路由映射策略（出站）

    通过在CGW上检查来自枝叶的第3类前缀，验证标准社区是否已应用到它们。 

    • 此示例输出显示来自Leaf-01和Leaf-02的BGP前缀，其中为Vlan 202网段注入了社区属性 
    tip-icon

    提示：请记住，CGW不会过滤任何前缀，因此我们可以从CGW角度验证完整的BGP表。

    CGW#show bgp l2vpn evpn route-type 3
    BGP routing table entry for [3][172.16.254.6:202][0][32][172.16.254.3]/17, version 461855
Paths: (1 available, best #1, table evi_202)                                      <-- The EVI context for the vlan 202 segment 
  Not advertised to any peer
  Refresh Epoch 4
  Local, imported path from [3][172.16.254.3:202][0][32][172.16.254.3]/17 (global)
    172.16.254.3 (metric 3) (via default) from 172.16.255.2 (172.16.255.2)
      Origin incomplete, metric 0, localpref 100, valid, internal, best
      Community: 999:999                                                          <-- Route-map logic is good. Standard community applied to the Type-3 
      Extended Community: RT:65001:202 ENCAP:8 EVPN Mcast Flags:1
      Originator: 172.16.255.3, Cluster list: 172.16.255.2
      PMSI Attribute: Flags:0x0, Tunnel type:IR, length 4, vni:20201, tunnel identifier: < Tunnel Endpoint: 172.16.254.3 > <-- Type-3 tunnel 
      rx pathid: 0, tx pathid: 0x0
      Updated on Jan 22 2025 19:02:18 UTC
BGP routing table entry for [3][172.16.254.6:202][0][32][172.16.254.4]/17, version 605955
Paths: (1 available, best #1, table evi_202)
  Not advertised to any peer
  Refresh Epoch 4
  Local, imported path from [3][172.16.254.4:202][0][32][172.16.254.4]/17 (global)
    172.16.254.4 (metric 3) (via default) from 172.16.255.2 (172.16.255.2)
      Origin incomplete, metric 0, localpref 100, valid, internal, best
      Community: 999:999
      Extended Community: RT:65001:202 ENCAP:8 EVPN Mcast Flags:1
      Originator: 172.16.255.4, Cluster list: 172.16.255.2
      PMSI Attribute: Flags:0x0, Tunnel type:IR, length 4, vni:20201, tunnel identifier: < Tunnel Endpoint: 172.16.254.4 >
      rx pathid: 0, tx pathid: 0x0
      Updated on Jan 30 2025 18:50:49 UTC

    相关信息

    修订历史记录

    版本 发布日期 备注
    1.0
    18-Aug-2023
    初始版本
    TAC Authored

    由思科工程师提供

    • Ambrose Taylor
    • Saurav Dasgupta

    此文档是否有帮助?

    Feedback反馈

    联系我们

    本文档适用于以下产品