目录
三、Segment Vxlan详细
适用于mulit-site
1、L3互通
2、L2互通
1.1在site1下的bd10，1.2在site2的bd20，1.1->1.2需要跨越两个site，不同bd
L2要求两侧数据中心的VNI必须保持一致，因此有两种互通方式1、映射VNI，2、
Ⅰ、映射VNI
100和300关联，200也和300关联，在bd10下配置和300的水平分割组
水平分割组：如果多个数据中心有环形的物理连接，由a发送给b和c的mac，要防止b发给c
bd 10
vxlan vni 300 split-group sg 1
bd 10
vxlan vni 100
evpn
rd
rt
interface nve 1
source xxxx
vni 300 head-end peer-list protocol bgpⅡ、局部VNI
去程和回程的vni不一致
3、L3互通实验
underlay已配置
Ⅰ、控制面
leaf1
evpn-overlay enable
bgp 100
router-id 1.1.1.1
peer 4.4.4.4 as-number 100
peer 4.4.4.4 connect-interface LoopBack0
#
l2vpn-family evpn
policy vpn-target
peer 4.4.4.4 enable
peer 4.4.4.4 advertise irb
#dci1
evpn-overlay enable
bgp 100
router-id 4.4.4.4
peer 1.1.1.1 as-number 100
peer 1.1.1.1 connect-interface LoopBack0
peer 5.5.5.5 as-number 200
peer 5.5.5.5 ebgp-max-hop 255
peer 5.5.5.5 connect-interface LoopBack0
#
ipv4-family unicast
peer 1.1.1.1 enable
peer 5.5.5.5 enable
#
l2vpn-family evpn
undo policy vpn-target
peer 1.1.1.1 enable
peer 1.1.1.1 advertise irb
peer 1.1.1.1 import reoriginate
peer 1.1.1.1 advertise route-reoriginated evpn mac-ip
peer 1.1.1.1 advertise route-reoriginated evpn ip
peer 5.5.5.5 enable
peer 5.5.5.5 advertise irb
peer 5.5.5.5 import reoriginate
peer 5.5.5.5 advertise route-reoriginated evpn mac-ip
peer 5.5.5.5 advertise route-reoriginated evpn ip
#
returnleaf2
evpn-overlay enable
bgp 200
router-id 2.2.2.2
peer 5.5.5.5 as-number 200
peer 5.5.5.5 connect-interface LoopBack0
#
ipv4-family unicast
peer 5.5.5.5 enable
#
l2vpn-family evpn
policy vpn-target
peer 5.5.5.5 enable
peer 5.5.5.5 advertise irb
#dci2
evpn-overlay enable
bgp 200
router-id 5.5.5.5
peer 2.2.2.2 as-number 200
peer 2.2.2.2 connect-interface LoopBack0
peer 4.4.4.4 as-number 100
peer 4.4.4.4 ebgp-max-hop 255
peer 4.4.4.4 connect-interface LoopBack0
#
ipv4-family unicast
peer 2.2.2.2 enable
peer 4.4.4.4 enable
#
l2vpn-family evpn
undo policy vpn-target
peer 2.2.2.2 enable
peer 2.2.2.2 advertise irb
peer 2.2.2.2 import reoriginate
peer 2.2.2.2 advertise route-reoriginated evpn mac-ip
peer 2.2.2.2 advertise route-reoriginated evpn ip
peer 4.4.4.4 enable
peer 4.4.4.4 advertise irb
peer 4.4.4.4 import reoriginate
peer 4.4.4.4 advertise route-reoriginated evpn mac-ip
peer 4.4.4.4 advertise route-reoriginated evpn ip
#验证：
Ⅱ、数据面
①、单独配置
leaf1：
evpn-overlay enable
#
ip vpn-instance abc
ipv4-family
route-distinguisher 1:1
vpn-target 11:1 export-extcommunity evpn
vpn-target 11:1 import-extcommunity evpn
vxlan vni 3000
#
bridge-domain 1000
vxlan vni 5010
evpn
route-distinguisher 5010:1
vpn-target 5010:1 export-extcommunity
vpn-target 11:1 export-extcommunity
vpn-target 5010:1 import-extcommunity
#
interface Vbdif1000
ip binding vpn-instance abc
ip address 192.168.1.254 255.255.255.0
mac-address 0000-5e00-0108
vxlan anycast-gateway enable
arp collect host enable
#
interface Nve1
source 1.1.1.1
vni 5010 head-end peer-list protocol bgp
#dci1
ip vpn-instance abc
ipv4-family
route-distinguisher 1:1
vpn-target 11:1 export-extcommunity evpn
vpn-target 11:1 import-extcommunity evpn
vxlan vni 3000
#
interface Nve1
source 4.4.4.4
#leaf2
evpn-overlay enable
#
ip vpn-instance abc
ipv4-family
route-distinguisher 2:2
vpn-target 22:1 export-extcommunity evpn
vpn-target 22:1 import-extcommunity evpn
vxlan vni 4000
#
bridge-domain 2000
vxlan vni 5021
evpn
route-distinguisher 5021:1
vpn-target 5021:1 export-extcommunity
vpn-target 22:1 export-extcommunity
vpn-target 5021:1 import-extcommunity
#
interface Vbdif2000
ip binding vpn-instance abc
ip address 192.168.2.254 255.255.255.0
mac-address 0000-5e00-0109
vxlan anycast-gateway enable
arp collect host enable
#
interface Nve1
source 2.2.2.2
vni 5021 head-end peer-list protocol bgp
#dci2
ip vpn-instance abc
ipv4-family
route-distinguisher 2:2
vpn-target 22:1 export-extcommunity evpn
vpn-target 22:1 import-extcommunity evpn
vxlan vni 4000
#
interface Nve1
source 5.5.5.5
#②、共性配置
dci1/dci2：
ip vpn-instance abc
vpn-target 1200:1 both evpn
③、业务接入配置
leaf1/leaf2
# Leaf1
interface GE1/0/0.100 mode l2
encapsulation dot1q vid 100
bridge-domain 1000
# Leaf2
interface GE1/0/0.200 mode l2
encapsulation dot1q vid 200
bridge-domain 2000Ⅲ、验证
ensp不支持数据面转发，记录跟随大伟老师学习的验证截图
可以验证下查询了几次路由表
# 1、ping -vpn-instance pc1 192.168.2.1
# 2、icmp port-unreachable send
# trace -vpn-instance pc11 192.168.2.1
# 3、dis bgp evpn all routing-table mac-route 
4、L2互通实验-映射方式
同子网互通，这里仅配置192.168.1.1->192.168.1.2，配置书接L3互通
Ⅰ、配置BD
DCI1
bridge-domain 1000
vxlan vni 5010
evpn
route-distinguisher 5010:1
vpn-target 5010:1 export-extcommunity
vpn-target 5010:1 import-extcommunity
#DCI2
bridge-domain 1000
vxlan vni 5011
evpn
route-distinguisher 5011:1
vpn-target 5011:1 export-extcommunity
vpn-target 5011:1 import-extcommunity
#Leaf2
bridge-domain 1000
vxlan vni 5011
evpn
route-distinguisher 5011:1
# 22:1是给三层用的，此处可以不写
vpn-target 22:1 export-extcommunity
vpn-target 5011:1 export-extcommunity
vpn-target 5011:1 import-extcommunity
#
int g1/0/0.100 mode l2
bridge-domain 1000
encapslation dot1q vid 100
Ⅱ、互通的RT配置
DCI1/DCI2
bridge-domain 1000
evpn
vpn-target 2000:1 both Ⅲ、互通VNI配置
直接配置映射vni无法配置，因为bridge-domain下已经配置过了，需要现在控制面配置水平分割组，split-gourp定义本地有意义，两个DCI可以不同
DCI1
bgp 100
l2vpn-family evpn
peer 5.5.5.5 split-group sg1
#
bridge-domain 1000
vxlan vni 5000 split-group sg1
DCI2
bgp 200
l2vpn-family evpn
peer 4.4.4.4 split-group sg1
#
bridge-domain 1000
vxlan vni 5000 split-group sg1
Ⅴ、配置evpn-type2-2元路由
DCI1
bgp 100
l2vpn-family evpn
peer 1.1.1.1 advertise route-reoriginated evpn mac
peer 5.5.5.5 advertise route-reoriginated evpn macDCI2
bgp 200
l2vpn-family evpn
peer 2.2.2.2 advertise route-reoriginated evpn mac
peer 4.4.4.4 advertise route-reoriginated evpn macⅥ、NVE通道发布
Leaf1
int nve 1
vni 5010 head-end peer-list protocol bgpDCI1
int nve 1
vni 5010 head-end peer-list protocol bgp
vni 5000 head-end peer-list protocol bgpLeaf2
int nve 1
vni 5011 head-end peer-list protocol bgp
vni 5000 head-end peer-list protocol bgpDCI2
int nve 1
vni 5011 head-end peer-list protocol bgpⅦ、如果不通，排障思路
①、虚机ping测试，发送arp到接入交换机
②、查看配置是否配置正确
③、查看bgp-evpn、vxlan tunnel是否建立
dis bgp evpn peer
dis vxlan tunnel④、leaf上面执行命令,查看是否学到了对端的主机ip
dis mac-address
362
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
