本產品的文件集力求使用無偏見用語。針對本文件集的目的,無偏見係定義為未根據年齡、身心障礙、性別、種族身分、民族身分、性別傾向、社會經濟地位及交織性表示歧視的用語。由於本產品軟體使用者介面中硬式編碼的語言、根據 RFP 文件使用的語言,或引用第三方產品的語言,因此本文件中可能會出現例外狀況。深入瞭解思科如何使用包容性用語。
思科已使用電腦和人工技術翻譯本文件,讓全世界的使用者能夠以自己的語言理解支援內容。請注意,即使是最佳機器翻譯,也不如專業譯者翻譯的內容準確。Cisco Systems, Inc. 對這些翻譯的準確度概不負責,並建議一律查看原始英文文件(提供連結)。
本檔案介紹如何僅在採用邊界閘道通訊協定(BGP)的Cisco Catalyst 9000系列交換器上實作和驗證虛擬可擴充區域網路(VXLAN)乙太網路VPN (EVPN)。
思科建議您瞭解以下主題:
本文中的資訊係根據以下軟體和硬體版本:
本文中的資訊是根據特定實驗室環境內的裝置所建立。文中使用到的所有裝置皆從已清除(預設)的組態來啟動。如果您的網路運作中,請確保您瞭解任何指令可能造成的影響。
設計下一代園區網路需要採用現代技術和架構,以滿足使用者、應用和裝置不斷發展的需求。具有BGP EVPN 的VXLAN(虛擬可擴展區域網)解決方案可以提供一個基於交換矩陣的架構,以實現簡便性、可擴充性和易管理性。 本檔案介紹適用於因任何原因而偏好對IPv4和EVPN路由使用BGP的使用者的BGP EVPN解決方案。
具有BGP EVPN的VXLAN使用主幹-枝葉架構,而不是傳統的3層網路模型。使用主幹-枝葉架構,主幹充當接入交換機之間的高速管道。主幹模型啟用橫向擴展模型,其中可透過增加更多主幹增加枝葉之間的頻寬,或透過增加更多枝葉增加端點容量。
對於希望將BGP用於IPv4和EVPN路由資訊的使用者,請考慮以下事項:
此拓撲顯示了常用的C9K EVPN單交換矩陣設計。
C9K EVPN單矩陣設計
對於僅BGP設計,要考慮的第一個問題是使用內部BGP(IBGP)還是外部BGP(EBGP)。使用IBGP的情況,這在傳統DC的VxLAN EVPN中很常見。與使用IBGP作為底層相比,使用EBGP時,無需再將主幹配置為路由反射器,而是用作交換路由的傳統路由器伺服器。因此,本文檔的前提是使用EBGP。
選項1.Two-AS:主幹使用一個AS,枝葉和邊界枝葉使用另一個AS。
Two-ASModelTwo-AS Model
選項 2.Multi-AS:主幹、枝葉和邊界枝葉各使用一個AS。
多AS模型
比較這兩種設計時,常見的問題是可擴充性,因為對於選項2,每次增加主幹或枝葉時,都需要增加新的AS編號,這將帶來未來更複雜的配置更改,不利於擴展和維護。因此,本文檔使用選項1.進行討論。
與使用IBGP作為底層相比,使用EBGP時,無需再將主幹配置為路由反射器,而是用作交換路由的傳統路由器伺服器。
這些是在襯底平面中需要考慮的關鍵點。
BGP IPv4 Allowed AS IN
AS環路檢測透過掃描完整的AS路徑(如AS_PATH屬性中所指定)並檢查本地系統的自治系統編號是否未出現在AS路徑中來完成。
根據上圖,形成BGP AS環路-在此場景中,與as-path中的AS編號相同:
要解決此問題,請在BGP IPv4地址系列中配置allow-as-in,其說明概述如下:
注意:當單一交換矩陣與DGW一起使用時,從一個主幹到另一個主幹的路由不太需要。但是,考慮到拓撲更改(例如超主幹),建議同時停用主幹裝置上的AS檢查。
BGP根據其標準選擇路由,預設情況下不會在BGP表中顯示2個ECMP路由。要實現ECMP以實現頻寬最佳化,則必須在所有BGP運行裝置中的BGP IPv4地址系列中配置「maximum-paths X」。同時,我們建議保持主幹和枝葉之間的相同鏈路頻寬作為最佳實踐。
注意:最大路徑數取決於拓撲設計。透過兩台主幹交換器,您可以設定「maximum-paths 2」。
在重疊平面中需要考慮這些要點。
重疊BGP IPv4 Allowed AS
AS環路檢測透過掃描完整的AS路徑(如AS_PATH屬性中所指定)並檢查本地系統的自治系統編號是否未出現在AS路徑中來完成。
根據映像,形成BGP AS環路-在此場景中,與as-path中的AS編號相同:
要解決此問題,必須在BGP IPv4地址系列中配置allow-as-in,其說明概述如下:
注意:當單一交換矩陣與DGW一起使用時,從一個主幹到另一個主幹的路由不太需要。但是,考慮到拓撲更改(例如超主幹),建議同時停用主幹裝置上的AS檢查。
預設情況下,BGP會更改從EBGP鄰居通告的網路層可達性資訊(NLRI)的下一跳屬性。枝葉/VXLAN通道端點(VTEP)使用其NVE來源位址作為EVPN路由的下一個躍點屬性,並且此位址用於判斷VXLAN通道(網路虛擬介面/NVE對等點)的目標。如果骨幹節點更改下一跳,則無法正確建立VXLAN隧道。
為了解決此問題,請應用以下說明。
來自枝葉裝置的EVPN路由會與路由目標(RT)社群一起通告。預設情況下,沒有相應RT配置的路由器會丟棄具有RT社群的路由。而所有主幹裝置均未配置虛擬路由和轉發(VRF)。這意味著預設情況下,主幹裝置會丟棄從枝葉裝置通告的所有EVPN路由。
要解決此問題,需要在所有主幹節點上停用預設路由目標過濾器。
網路圖表
本實驗環境的介面詳細資訊如下。
裝置名稱 |
軟體版本 |
介面編號 |
IP 位址 |
骨幹-1 |
IOS-XE 17.12.1 |
Hu 1/0/9 |
172.16.12.1/30 |
Hu 1/0/10 |
172.16.11.1/30 |
||
Lo 0 |
10.1.255.1/32 |
||
骨幹-2 |
IOS-XE 17.12.1 |
Hu 1/0/9 |
172.16.21.1/30 |
Hu 1/0/10 |
172.16.22.1/30 |
||
Lo 0 |
10.1.255.2/32 |
||
枝葉1 |
IOS-XE 17.12.1 |
Hu 1/0/1 |
172.16.21.2/30 |
Hu 1/0/2 |
172.16.11.2/30 |
||
第1步 |
10.2.254.1/32 |
||
枝葉2 |
IOS-XE 17.12.1 |
Hu 1/0/1 |
172.16.12.2/30 |
Hu 1/0/2 |
172.16.22.2/30 |
||
第1步 |
10.2.254.2/32 |
注意:本實驗中的IP地址分配僅用於測試。可以根據您的實際設計要求考慮點對點連線的子網掩碼(即/30、/31)。
在本示例中,物理介面用於建立BGP連線。
主幹上的配置:
router bgp 65001
bgp log-neighbor-changes
bgp listen range 172.16.0.0/16 peer-group Leaf-Peers
no bgp default ipv4-unicast
neighbor Leaf-Peers peer-group
neighbor Leaf-Peers remote-as 65002
!
address-family ipv4
redistribute connected
neighbor Leaf-Peers activate
neighbor Leaf-Peers allowas-in 1
maximum-paths 2
exit-address-family
枝葉-1上的配置:
router bgp 65002
bgp log-neighbor-changes
no bgp default ipv4-unicast
neighbor 172.16.11.1 remote-as 65001
neighbor 172.16.21.1 remote-as 65001
!
address-family ipv4
redistribute connected
neighbor 172.16.11.1 activate
neighbor 172.16.21.1 activate
exit-address-family
枝葉2上的配置:
router bgp 65002
bgp log-neighbor-changes
no bgp default ipv4-unicast
neighbor 172.16.12.1 remote-as 65001
neighbor 172.16.22.1 remote-as 65001
!
address-family ipv4
redistribute connected
neighbor 172.16.12.1 activate
neighbor 172.16.22.1 activate
exit-address-family
主幹上的配置:
router bgp 65001
address-family ipv4
neighbor Leaf-Peers allowas-in 1
枝葉-1上的配置:
router bgp 65002
address-family ipv4
neighbor 172.16.11.1 allowas-in 1
neighbor 172.16.21.1 allowas-in 1
枝葉2上的配置:
router bgp 65002
address-family ipv4
neighbor 172.16.12.1 allowas-in 1
neighbor 172.16.22.1 allowas-in 1
主幹上的配置:
router bgp 65001
address-family ipv4
maximum-paths 2
枝葉上的配置:
router bgp 65002
address-family ipv4
maximum-paths 2
要啟用組播複製(MR)來處理廣播、未知單播和本地鏈路組播(BUM)流量,所有主幹和枝葉裝置都需要組播路由。所有主幹和枝葉連線介面和相關環回都必須啟用PIM。
骨幹1上的底層組播示例:
ip multicast-routing
ip pim rp-address 10.1.255.1 //configure Spine loopback as RP
interface Loopback0
ip pim sparse-mode
interface HundredGigE1/0/9
ip pim sparse-mode
interface HundredGigE1/0/10
ip pim sparse-mode
主幹上的配置:
router bgp 65001
neighbor Leaf-Peers ebgp-multihop 255
address-family l2vpn evpn
neighbor Leaf-Peers activate
neighbor Leaf-Peers send-community both
枝葉-1上的配置:
router bgp 65002
neighbor 172.16.11.1 ebgp-multihop 255
neighbor 172.16.21.1 ebgp-multihop 255
address-family l2vpn evpn
neighbor 172.16.11.1 activate
neighbor 172.16.11.1 send-community both
neighbor 172.16.21.1 activate
neighbor 172.16.21.1 send-community both
枝葉2上的配置:
router bgp 65002
neighbor 172.16.12.1 ebgp-multihop 255
neighbor 172.16.22.1 ebgp-multihop 255
address-family l2vpn evpn
neighbor 172.16.12.1 activate
neighbor 172.16.12.1 send-community both
neighbor 172.16.22.1 activate
neighbor 172.16.22.1 send-community both
枝葉-1上的配置:
router bgp 65002
address-family l2vpn evpn
neighbor 172.16.11.1 allowas-in 1
neighbor 172.16.21.1 allowas-in 1
枝葉2上的配置:
router bgp 65002
address-family l2vpn evpn
neighbor 172.16.12.1 allowas-in 1
neighbor 172.16.22.1 allowas-in 1
注意:當單一交換矩陣與DGW一起使用時,從一個主幹到另一個主幹的路由不太需要。但是,考慮到拓撲更改(例如超主幹),建議同時停用主幹裝置上的AS檢查。
主幹上的配置:
route-map BGP-NHU permit 10
set ip next-hop unchanged
!
router bgp 65001
address-family l2vpn evpn
neighbor Leaf-Peers route-map BGP-NHU out
主幹上的配置:
router bgp 65001
no bgp default route-target filter
vrf definition S1-EVPN
rd 1:1
!
address-family ipv4
route-target export 1:1
route-target import 1:1
route-target export 1:1 stitching
route-target import 1:1 stitching
exit-address-family
router bgp 65002
address-family ipv4 vrf S1-EVPN
advertise l2vpn evpn
redistribute connected
maximum-paths 2
exit-address-family
在枝葉上啟用L2VPN EVPN和組播複製:
l2vpn evpn
replication-type static
在枝葉上建立EVPN例項(EVI):
l2vpn evpn instance 10 vlan-based
encapsulation vxlan
l2vpn evpn instance 20 vlan-based
encapsulation vxlan
為枝葉上的使用者流量建立VLAN和VNI:
vlan configuration 10
member evpn-instance 10 vni 10010
vlan configuration 20
member evpn-instance 20 vni 10020
建立NVE介面並將VNI縫合到枝葉上的組播組。
interface nve1
no ip address
source-interface Loopback1
host-reachability protocol bgp
member vni 10010 mcast-group 225.0.0.10
member vni 10020 mcast-group 225.0.0.20
在枝葉上為L3VNI建立VLAN。L3VNI不需要EVI。
vlan configuration 3000
member vni 33000
為枝葉上的L2VNI配置SVI。
interface Vlan10
mac-address 0010.0010.0010
vrf forwarding S1-EVPN
ip address 192.168.10.254 255.255.255.0
為枝葉上的L3VNI配置SVI。未將任何活動介面分配給該VLAN時,配置「no autostate」以啟動SVI。
interface Vlan3000
vrf forwarding S1-EVPN
ip unnumbered Loopback1
no autostate
在枝葉上,將L3VNI縫合到NVE配置下的VRF。
interface nve1
member vni 33000 vrf S1-EVPN
驗證BGP會話已建立
C9600X-SPINE-1#show ip bgp all summary For address family: IPv4 Unicast BGP router identifier 10.1.255.1, local AS number 65001 BGP table version is 23, main routing table version 23 12 network entries using 2976 bytes of memory 22 path entries using 2992 bytes of memory 2 multipath network entries and 4 multipath paths 4/3 BGP path/bestpath attribute entries using 1184 bytes of memory 3 BGP AS-PATH entries using 104 bytes of memory 8 BGP extended community entries using 400 bytes of memory 0 BGP route-map cache entries using 0 bytes of memory 0 BGP filter-list cache entries using 0 bytes of memory BGP using 7656 total bytes of memory BGP activity 7259/7235 prefixes, 13926/13892 paths, scan interval 60 secs 12 networks peaked at 07:06:41 Dec 5 2023 UTC (2w1d ago) Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd *172.16.11.2 4 65002 138 130 23 0 0 01:38:17 9 *172.16.12.2 4 65002 138 130 23 0 0 01:38:11 9 * Dynamically created based on a listen range command Dynamically created neighbors: 2, Subnet ranges: 1 BGP peergroup Leaf-Peers listen range group members: 172.16.0.0/16 For address family: L2VPN E-VPN BGP router identifier 10.1.255.1, local AS number 65001 BGP table version is 27, main routing table version 27 10 network entries using 3840 bytes of memory 12 path entries using 2784 bytes of memory 8/6 BGP path/bestpath attribute entries using 2368 bytes of memory 3 BGP AS-PATH entries using 104 bytes of memory 8 BGP extended community entries using 400 bytes of memory 0 BGP route-map cache entries using 0 bytes of memory 0 BGP filter-list cache entries using 0 bytes of memory BGP using 9496 total bytes of memory BGP activity 7259/7235 prefixes, 13926/13892 paths, scan interval 60 secs 12 networks peaked at 07:38:03 Dec 6 2023 UTC (2w0d ago) Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd *172.16.11.2 4 65002 138 130 27 0 0 01:38:17 6 *172.16.12.2 4 65002 138 130 27 0 0 01:38:11 6 * Dynamically created based on a listen range command Dynamically created neighbors: 2, Subnet ranges: 1 BGP peergroup Leaf-Peers listen range group members: 172.16.0.0/16 Total dynamically created neighbors: 2/(100 max), Subnet ranges: 1
C9500X-LEAF-1#show ip bgp all summary For address family: IPv4 Unicast BGP router identifier 10.2.255.1, local AS number 65002 BGP table version is 19, main routing table version 19 12 network entries using 2976 bytes of memory 22 path entries using 2992 bytes of memory 2 multipath network entries and 4 multipath paths 4/3 BGP path/bestpath attribute entries using 1184 bytes of memory 3 BGP AS-PATH entries using 104 bytes of memory 8 BGP extended community entries using 384 bytes of memory 0 BGP route-map cache entries using 0 bytes of memory 0 BGP filter-list cache entries using 0 bytes of memory BGP using 7640 total bytes of memory BGP activity 577/545 prefixes, 4021/3975 paths, scan interval 60 secs 12 networks peaked at 07:10:16 Dec 5 2023 UTC (1d18h ago) Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 172.16.11.1 4 65001 2427 3100 19 0 0 20:39:49 9 172.16.21.1 4 65001 2430 3094 19 0 0 20:39:49 9 For address family: L2VPN E-VPN BGP router identifier 10.2.255.1, local AS number 65002 BGP table version is 5371, main routing table version 5371 16 network entries using 6144 bytes of memory 20 path entries using 4640 bytes of memory 9/9 BGP path/bestpath attribute entries using 2664 bytes of memory 3 BGP AS-PATH entries using 104 bytes of memory 8 BGP extended community entries using 384 bytes of memory 0 BGP route-map cache entries using 0 bytes of memory 0 BGP filter-list cache entries using 0 bytes of memory BGP using 13936 total bytes of memory BGP activity 577/545 prefixes, 4021/3975 paths, scan interval 60 secs 16 networks peaked at 07:36:38 Dec 6 2023 UTC (18:16:58.620 ago) Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 172.16.11.1 4 65001 2427 3100 5371 0 0 20:39:49 4 172.16.21.1 4 65001 2430 3094 5371 0 0 20:39:49 4
Initiate traffic between hosts, verify IP Multicast and PIM configuration, and mroute table.
Please note that on IOS-XE platform, (*, G) entry should always present, and (S, G) entry presents only when BUM traffic present.
C9600X-SPINE-1#show ip mroute IP Multicast Routing Table <snip> Outgoing interface flags: H - Hardware switched, A - Assert winner, p - PIM Join t - LISP transit group Timers: Uptime/Expires Interface state: Interface, Next-Hop or VCD, State/Mode (*, 225.0.0.20), 16:51:00/stopped, RP 10.1.255.1, flags: SJCx Incoming interface: HundredGigE1/0/2, RPF nbr 172.16.11.1 Outgoing interface list: Tunnel0, Forward/Sparse-Dense, 16:51:00/00:02:58, flags: (*, 225.0.0.10), 16:51:14/stopped, RP 10.1.255.1, flags: SJCFx Incoming interface: HundredGigE1/0/2, RPF nbr 172.16.11.1 Outgoing interface list: Tunnel0, Forward/Sparse-Dense, 16:51:14/00:02:45, flags: (10.2.254.1, 225.0.0.10), 00:00:01/00:02:57, flags: FTx Incoming interface: Loopback1, RPF nbr 0.0.0.0, Registering Outgoing interface list: HundredGigE1/0/2, Forward/Sparse, 00:00:01/00:03:27, flags: (*, 224.0.1.40), 1d18h/00:02:42, RP 10.1.255.1, flags: SJCL Incoming interface: HundredGigE1/0/2, RPF nbr 172.16.11.1 Outgoing interface list: Loopback0, Forward/Sparse, 1d18h/00:02:42, flags
檢驗EVPN L2
C9500X-LEAF-1#show l2vpn evpn evi 10 detail EVPN instance: 10 (VLAN Based) RD: 10.2.254.1:10 (auto) Import-RTs: 65002:10 Export-RTs: 65002:10 <snip> C9500X-LEAF-1#show nve peers 'M' - MAC entry download flag 'A' - Adjacency download flag '4' - IPv4 flag '6' - IPv6 flag Interface VNI Type Peer-IP RMAC/Num_RTs eVNI state flags UP time nve1 33000 L3CP 10.2.254.2 242a.0412.0102 33000 UP A/M/4 18:11:35 nve1 10010 L2CP 10.2.254.2 2 10010 UP N/A 00:36:00 nve1 10020 L2CP 10.2.254.2 2 10020 UP N/A 00:01:17 C9500X-LEAF-1#show bgp l2vpn evpn BGP table version is 5475, local router ID is 10.2.254.1 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, t secondary path, L long-lived-stale, Origin codes: i - IGP, e - EGP, ? - incomplete RPKI validation codes: V valid, I invalid, N Not found Network Next Hop Metric LocPrf Weight Path Route Distinguisher: 10.2.254.1:10 *> [2][10.2.254.1:10][0][48][683B78FC8C9F][0][*]/20 10.2.254.2 0 65001 65002 ? *> [2][10.2.254.1:10][0][48][683B78FC8C9F][32][192.168.10.45]/24 10.2.254.2 0 65001 65002 ? <snip> C9500X-LEAF-1#show bgp l2vpn evpn detail [2][10.2.254.1:10][0][48][683B78FC8C9F][32][192.168.10.45]/24 BGP routing table entry for [2][10.2.254.1:10][0][48][683B78FC8C9F][32][192.168.10.45]/24, version 5371 Paths: (1 available, best #1, table evi_10) Not advertised to any peer Refresh Epoch 12 65001 65002, imported path from [2][10.2.254.2:10][0][48][683B78FC8C9F][32][192.168.10.45]/24 (global) 10.2.254.2 (via default) from 172.16.21.1 (10.1.255.2) Origin incomplete, localpref 100, valid, external, best EVPN ESI: 00000000000000000000, Label1 10010, Label2 33000 Extended Community: RT:1:1 RT:65002:10 ENCAP:8 Router MAC:242A.0412.0102 rx pathid: 0, tx pathid: 0x0 Updated on Dec 7 2023 01:52:33 UTC C9500X-LEAF-1#show device-tracking database <snip> Network Layer Address Link Layer Address Interface vlan prlvl age state Time left ARP 192.168.20.25 3c13.cc01.a7df Hu1/0/7 20 0005 3mn REACHABLE 103 s ARP 192.168.10.25 3c13.cc01.a7df Hu1/0/7 10 0005 20mn STALE try 0 943 s C9500X-LEAF-1#show l2vpn evpn mac ip IP Address EVI VLAN MAC Address Next Hop(s) --------------------------------------- ----- ----- -------------- ----------- 192.168.10.25 10 10 3c13.cc01.a7df Hu1/0/7:10 192.168.10.45 10 10 683b.78fc.8c9f 10.2.254.2
檢驗EVPN L3
C9500X-LEAF-1#show nve peers 'M' - MAC entry download flag 'A' - Adjacency download flag '4' - IPv4 flag '6' - IPv6 flag Interface VNI Type Peer-IP RMAC/Num_RTs eVNI state flags UP time nve1 33000 L3CP 10.2.254.2 242a.0412.0102 33000 UP A/M/4 18:50:51 nve1 10010 L2CP 10.2.254.2 2 10010 UP N/A 01:15:16 nve1 10020 L2CP 10.2.254.2 2 10020 UP N/A 00:31:39 9500X-LEAF-1#sh bgp l2vpn evpn BGP table version is 5523, local router ID is 10.2.255.1 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, t secondary path, L long-lived-stale, Origin codes: i - IGP, e - EGP, ? - incomplete RPKI validation codes: V valid, I invalid, N Not found Network Next Hop Metric LocPrf Weight Path <snip> Route Distinguisher: 1:1 (default for vrf S1-EVPN) *> [5][1:1][0][24][192.168.10.0]/17 0.0.0.0 0 32768 ? *> [5][1:1][0][24][192.168.20.0]/17 0.0.0.0 0 32768 ? C9500X-LEAF-1#sh ip ro vrf S1-EVPN Routing Table: S1-EVPN <snip> 192.168.10.0/24 is variably subnetted, 4 subnets, 2 masks C 192.168.10.0/24 is directly connected, Vlan10 S 192.168.10.25/32 is directly connected, Vlan10 B 192.168.10.45/32 [20/0] via 10.2.254.2, 00:00:56, Vlan3000 L 192.168.10.254/32 is directly connected, Vlan10 192.168.20.0/24 is variably subnetted, 4 subnets, 2 masks C 192.168.20.0/24 is directly connected, Vlan20 S 192.168.20.25/32 is directly connected, Vlan20 B 192.168.20.45/32 [20/0] via 10.2.254.2, 00:49:54, Vlan3000 L 192.168.20.254/32 is directly connected, Vlan20
修訂 | 發佈日期 | 意見 |
---|---|---|
1.0 |
12-Feb-2024 |
初始版本 |