vpp的网卡直通配置和SRIOV配置方法

本文总结了Centos-KVM作为宿主机,centos-vpp作为客户机时的网卡passthrough和SRIOV的配置方法

 

配置网卡直通

一、宿主机上修改GRUB,增加intel_iommu=on。刷新GRUB。然后重启宿主机。

[root@kvm-02 ~]# vi /etc/default/grub

 [root@kvm-02 ~]# grub2-mkconfig -o /boot/efi/EFI/centos/grub.cfg

Generating grub configuration file ...

Found linux image: /boot/vmlinuz-3.10.0-693.el7.x86_64

Found initrd image: /boot/initramfs-3.10.0-693.el7.x86_64.img

Found linux image: /boot/vmlinuz-0-rescue-20fe28cd4f4b4fa1b140c6a72d10ae05

Found initrd image: /boot/initramfs-0-rescue-20fe28cd4f4b4fa1b140c6a72d10ae05.im

g

done

(注:刷新grub的方法与系统引导方式有关,如果是legacy模式,就是/boot/grub2/grub.cfg,如果是uefi模式,则为/boot/efi/EFI/centos/grub.cfg)

 [root@kvm-02 ~]# reboot

等启动完了之后

[root@kvm-02 ~]# cat /proc/cmdline

BOOT_IMAGE=/vmlinuz-3.10.0-693.el7.x86_64 root=/dev/mapper/centos-root ro crashkernel=auto rd.lvm.lv=centos/root rd.lvm.lv=centos/swap intel_iommu=on isolcpus=20-23 nohz_full=20-23 rcu_nocbs=20-23 nmi_watchdog=0 selinux=0 intel_pstate=disable nosoftlockup rhgb quiet

[root@kvm-02 ~]#

 

二、通过virsh命令将PCI从宿主机分离

[root@kvm-02 ~]# lspci -nn | grep net

09:00.0 Ethernet controller [0200]: Intel Corporation Ethernet Connection X722 for 10GbE SFP+ [8086:37d3] (rev 09)

09:00.1 Ethernet controller [0200]: Intel Corporation Ethernet Connection X722 for 10GbE SFP+ [8086:37d3] (rev 09)

09:00.2 Ethernet controller [0200]: Intel Corporation Ethernet Connection X722 for 10GbE SFP+ [8086:37d3] (rev 09)

09:00.3 Ethernet controller [0200]: Intel Corporation Ethernet Connection X722 for 10GbE SFP+ [8086:37d3] (rev 09)

2f:00.0 Ethernet controller [0200]: Intel Corporation Ethernet Controller X710 for 10GbE SFP+ [8086:1572] (rev 01)

2f:00.1 Ethernet controller [0200]: Intel Corporation Ethernet Controller X710 for 10GbE SFP+ [8086:1572] (rev 01)

31:00.0 Ethernet controller [0200]: Intel Corporation Ethernet Controller XXV710 for 25GbE SFP28 [8086:158b] (rev 02)

31:00.1 Ethernet controller [0200]: Intel Corporation Ethernet Controller XXV710 for 25GbE SFP28 [8086:158b] (rev 02)

58:00.0 Ethernet controller [0200]: Intel Corporation Ethernet Controller X710 for 10GbE SFP+ [8086:1572] (rev 01)

58:00.1 Ethernet controller [0200]: Intel Corporation Ethernet Controller X710 for 10GbE SFP+ [8086:1572] (rev 01)

86:00.0 Ethernet controller [0200]: Broadcom Limited NetXtreme BCM5720 Gigabit Ethernet PCIe [14e4:165f]

86:00.1 Ethernet controller [0200]: Broadcom Limited NetXtreme BCM5720 Gigabit Ethernet PCIe [14e4:165f]

af:00.0 Ethernet controller [0200]: Intel Corporation Ethernet Controller X710 for 10GbE SFP+ [8086:1572] (rev 01)

af:00.1 Ethernet controller [0200]: Intel Corporation Ethernet Controller X710 for 10GbE SFP+ [8086:1572] (rev 01)

virsh nodedev认的PCI格式稍微有点区别,用virsh再显示一遍

[root@kvm-02 ~]# virsh nodedev-list --tree | grep 09

  |           +- pci_0000_09_00_0

  |           +- pci_0000_09_00_1

  |           +- pci_0000_09_00_2

  |           +- pci_0000_09_00_3

  +- pci_0000_05_09_0

  +- pci_0000_05_09_1

  +- pci_0000_05_09_2

  +- pci_0000_05_09_3

  +- pci_0000_05_09_4

  +- pci_0000_05_09_5

  +- pci_0000_05_09_6

  +- pci_0000_05_09_7

  +- pci_0000_2e_09_0

  |           |       +- block_sdc_MTFDDAK480TBY_1AR1ZA_01PE061D7A09450LEN_1CC00A37

  |           |       +- block_sdd_MTFDDAK480TBY_1AR1ZA_01PE061D7A09450LEN_1CFD6

  • 0
    点赞
  • 6
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
VPP(Vector Packet Processing)是一种高性能数据平面框架,支持多种协议,包括 IKEv2(Internet Key Exchange version 2)协议。在VPP配置IKEv2,需要进行以下步骤: 1. 安装VPP 首先,需要安装VPP和相关的插件。可以从官方网站上下载最新版本的VPP,并按照官方文档进行安装。 2. 配置IKEv2插件 在VPP中,可以使用IKEv2插件来实现IKEv2协议的支持。需要启用IKEv2插件,可以使用以下命令: ``` set plugins plugin_path /usr/lib64/vpp_plugins/ set plugins plugin default-plugin-enable set plugins plugin ikev2-plugin-enable ``` 3. 配置IKEv2连接 在VPP中,可以使用IKEv2插件来创建IKEv2连接。可以使用以下命令创建IKEv2连接: ``` ikev2 profile name IKEV2-PROFILE ikev2 profile auth shared-secret KEY ikev2 profile local-auth method pre-shared-key ikev2 profile remote-auth method pre-shared-key ikev2 profile local-id name FQDN ikev2 profile remote-id name FQDN ikev2 profile tunnel-ip local IP_ADDRESS ikev2 profile tunnel-ip remote IP_ADDRESS ikev2 profile ike-crypto-profile IKE-CRYPTO-PROFILE ikev2 profile esp-crypto-profile ESP-CRYPTO-PROFILE ``` 4. 配置IKEv2策略 在VPP中,可以使用IKEv2插件来配置IKEv2策略。可以使用以下命令配置IKEv2策略: ``` ikev2 policy name IKEV2-POLICY ikev2 policy proposal 1 encryption aes-256-gcm ikev2 policy proposal 1 integrity sha-256 ikev2 policy proposal 1 dh-group 19 ikev2 policy proposal 1 lifetime seconds 3600 ``` 5. 配置IKEv2安全协议 在VPP中,可以使用IKEv2插件来配置IKEv2安全协议。可以使用以下命令配置IKEv2安全协议: ``` ikev2 crypto name IKE-CRYPTO ikev2 crypto proposal 1 encryption aes-256-gcm ikev2 crypto proposal 1 integrity sha-256 ikev2 crypto proposal 1 dh-group 19 ikev2 crypto proposal 1 lifetime seconds 3600 ``` 6. 配置ESP安全协议 在VPP中,可以使用IKEv2插件来配置ESP安全协议。可以使用以下命令配置ESP安全协议: ``` ikev2 crypto name ESP-CRYPTO ikev2 crypto proposal 1 encryption aes-256-gcm ikev2 crypto proposal 1 integrity sha-256 ikev2 crypto proposal 1 lifetime seconds 3600 ``` 7. 配置IKEv2转发 在VPP中,可以使用IKEv2插件来配置IKEv2转发。可以使用以下命令配置IKEv2转发: ``` ikev2 route name IKEV2-ROUTE ikev2 route local-networks 10.0.0.0/24 ikev2 route remote-networks 10.1.0.0/24 ikev2 route profile IKEV2-PROFILE ``` 以上就是在VPP配置IKEv2的步骤。需要根据实际情况进行调整和修改
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值