集中式网关
集中式网关意思是所有BD的网关集中放在一个设备上
MAC VRF(BD中的EVPN实例)是二层vni
IP VRF是三层vni
三层vni在转发平面上解决跨网段通讯问题
二层vni在转发平面上解决同网段通讯问题
集中式网关只涉及到二层vni
东西向靠直连路由,南北靠默认路由
集中式网关仅靠直连路由进行东西互访
拓扑
实验目的
全网互通,使用集中式网关实现同网段通信和跨网段通信
配置
业务接入点配置
SW1:
#
vlan batch 10 20
#
interface GE1/0/1
port link-type trunk
port trunk allow-pass vlan 10 20
#
interface GE1/0/2
port default vlan 10
#
interface GE1/0/3
port default vlan 20
SW2:
#
vlan batch 10 20
#
interface GE1/0/1
port link-type trunk
port trunk allow-pass vlan 10 20
#
interface GE1/0/2
port default vlan 10
#
interface GE1/0/3
port default vlan 20
CE1:
#
bridge-domain 1000
vxlan vni 1000
#
bridge-domain 2000
vxlan vni 2000
#
interface GE1/0/1.10 mode l2
encapsulation dot1q vid 10
bridge-domain 1000
#
interface GE1/0/1.20 mode l2
encapsulation dot1q vid 20
bridge-domain 2000
CE2:
#
bridge-domain 1000
vxlan vni 1000
#
bridge-domain 2000
vxlan vni 2000
#
interface GE1/0/2.10 mode l2
encapsulation dot1q vid 10
bridge-domain 1000
#
interface GE1/0/2.20 mode l2
encapsulation dot1q vid 20
bridge-domain 2000
spine-leaf之间的underlay不需要关注是多少,这里已经预配完
VTEP配置 EVPN
CE1:
#
evpn-overlay enable
#
bridge-domain 1000
evpn
route-distinguisher 1:1
vpn-target 10:10 export-extcommunity
vpn-target 10:10 import-extcommunity
#
bridge-domain 2000
evpn
route-distinguisher 2:1
vpn-target 20:20 export-extcommunity
vpn-target 20:20 import-extcommunity
#
interface Nve1
source 1.1.1.1
vni 1000 head-end peer-list protocol bgp
vni 2000 head-end peer-list protocol bgp
#
bgp 100
router-id 11.11.11.11
undo default ipv4-unicast
private-4-byte-as enable
peer 33.33.33.33 as-number 100
peer 33.33.33.33 connect-interface LoopBack1
#
ipv4-family unicast
undo peer 33.33.33.33 enable
#
l2vpn-family evpn
policy vpn-target
peer 33.33.33.33 enable
CE2:
#
evpn-overlay enable
#
bridge-domain 1000
evpn
route-distinguisher 1:2
vpn-target 10:10 export-extcommunity
vpn-target 10:10 import-extcommunity
#
bridge-domain 2000
evpn
route-distinguisher 2:2
vpn-target 20:20 export-extcommunity
vpn-target 20:20 import-extcommunity
#
interface Nve1
source 2.2.2.2
vni 1000 head-end peer-list protocol bgp
vni 2000 head-end peer-list protocol bgp
#
bgp 100
router-id 22.22.22.22
undo default ipv4-unicast
private-4-byte-as enable
peer 33.33.33.33 as-number 100
peer 33.33.33.33 connect-interface LoopBack1
#
ipv4-family unicast
undo peer 33.33.33.33 enable
#
l2vpn-family evpn
policy vpn-target
peer 33.33.33.33 enable
CE3:
#
evpn-overlay enable
#
bridge-domain 1000
vxlan vni 1000
evpn
route-distinguisher 1:3
vpn-target 10:10 export-extcommunity
vpn-target 10:10 import-extcommunity
#
bridge-domain 2000
vxlan vni 2000
evpn
route-distinguisher 2:3
vpn-target 20:20 export-extcommunity
vpn-target 20:20 import-extcommunity
#
interface Nve1
source 3.3.3.3
vni 1000 head-end peer-list protocol bgp
vni 2000 head-end peer-list protocol bgp
#
bgp 100
router-id 33.33.33.33
undo default ipv4-unicast
private-4-byte-as enable
peer 11.11.11.11 as-number 100
peer 11.11.11.11 connect-interface LoopBack1
peer 22.22.22.22 as-number 100
peer 22.22.22.22 connect-interface LoopBack1
#
ipv4-family unicast
undo peer 11.11.11.11 enable
undo peer 22.22.22.22 enable
#
l2vpn-family evpn
policy vpn-target
peer 11.11.11.11 enable
peer 11.11.11.11 reflect-client
peer 22.22.22.22 enable
peer 22.22.22.22 reflect-client
#
interface Vbdif1000
ip address 192.168.1.254 255.255.255.0
#
interface Vbdif2000
ip address 192.168.2.254 255.255.255.0
验证
隧道是建立好了的
CE2会使用EVPN通过NLRI传递Type 2 MAC类型的路由,来通告CE2租户侧的MAC地址给CE1,CE3。只要CE2的MAC表有就会通告
缺点
而集中式网关场景下,网关设备需要维护所有租户的MAC地址,而三层网关上的ARP表项规格有限,这不利于数据中心网络的扩展
转发路径不是最优:同一二层网关下跨子网的数据中心三层流量都需要经过集中三层网关转发