Po pierwszym wpisie o VxLAN, gdzie oparłem się wyłącznie na Cisco CSRv oraz ASAv przyszła pora na testowanie w konfiguracji multivendor.
Do tego laba wykorzystałem:
- Cisco CSRv
- Cisco ASAv
- Juniper vMX
Wszystko zostało uruchomione na Vmware Workstation.
W dobie wirtualizacji serwerów i desktopów postanowiłem wziąć się ostro za poznanie świata wirtualizacji networku tym bardziej kiedy coraz częściej słyszy się hasło vxlan.
Postanowiłem sprawdzić jak wygląda konfiguracja na “sprzęcie”.
Następnym etapem będzie integracja tego co robię na urządzeniach sieciowych w połączeniu ze światem wirtualnym ale o tym później…
Konfiguracja oraz poznanie tej technologii było dla mnie najbardziej czasochłonnym zajęciem do tej pory ale dla tych co też chcą walczyć z poznaniem vxlan zostawiam swoją notatkę w postaci wpisu.
Oprócz samej technologi vxlan poruszę tu zaganiania takie jak: BGP, OSPF, MPLS, Multicast. Dzięki takim labom człowiek przypomina sobie ww technologie oraz nadrabia braki.
Zapraszam do lektury.
Lab
Poniżej schemat poglądowy Laba.
Jak widać na powyższym schemacie mamy trzy vtep’y i Cisco CSRv, które wykorzystuje jako Core spinające wszystko.
Teraz przechodzimy do fajniejszych rzeczy czyli do konfiguracji.
Konfiguracja interfejsów sieciowych na urządzeniach:
Cisco ASA – asav01
interface GigabitEthernet0/0 nameif out security-level 0 ip address 192.168.1.75 255.255.255.0 no sh
interface GigabitEthernet0/1 nameif lan security-level 0 ip address 10.10.20.1 255.255.255.0 no sh
Cisco CSR – csrv03
interface Loopback0 ip address 3.3.3.3 255.255.255.255
interface GigabitEthernet1 ip address 10.10.20.2 255.255.255.0 negotiation auto description "CSRv03 -- asav01 gi 0/1" no sh
interface GigabitEthernet2 ip address 10.10.30.2 255.255.255.0 negotiation auto no sh
interface GigabitEthernet3 ip address 10.10.40.2 255.255.255.0 negotiation auto no sh
Juniper vMX – vmx01
set interfaces ge-0/0/1 description "vmx01 -- csrv03 GI2" set interfaces ge-0/0/1 unit 0 family inet address 10.10.30.10/24
set interfaces ge-0/0/4 unit 0 family inet address 10.120.10.1/24 set interfaces ge-0/0/4 description "vmx01 --- vtep01 gi 2"
Juniper vMX – vmx02
set interfaces ge-0/0/1 unit 0 family inet address 10.10.40.10/24 set interfaces ge-0/0/1 description "vmx02 -- csrv03 GI3"
set interfaces ge-0/0/4 unit 0 family inet address 10.130.10.1/24 set interfaces ge-0/0/4 description "vmx02 -- vtep GI0/2"
Cisco ASAv – vtep01
Rysunek szczegółowy dla połączeń vtep01 do vmx01
interface GigabitEthernet0/0.100 vlan 100 nameif lan security-level 0 ip address 192.168.200.10 255.255.255.0 no sh
interface GigabitEthernet0/2 nameif lan120 security-level 0 ip address 10.120.10.10 255.255.255.0 no sh
Cisco ASAv – vtep02
Rysunek szczegółowy dla połączeń vtep02 do vmx02
interface GigabitEthernet0/0.100 vlan 100 nameif lan security-level 0 ip address 192.168.200.110 255.255.255.0 no sh
interface GigabitEthernet0/2 nve-only nameif vlan130 security-level 0 ip address 10.130.10.10 255.255.255.0 no sh
Konfiguracja OSPF
W tym kroku konfigurujemy routing dynamiczny z wykorzystaniem OSPF. Urządzenia vmx01 oraz vmx02 będą skonfigurowane w dwóch obszarach ospf.
Cisco ASA – asav01
router ospf 1 network 10.10.20.0 255.255.255.0 area 0
Cisco CSR – csrv03
router ospf 1 network 3.3.3.3 0.0.0.0 area 0 network 10.10.20.0 0.0.0.255 area 0 network 10.10.30.0 0.0.0.255 area 0 network 10.10.40.0 0.0.0.255 area 0
Juniper vMX – vmx01
set protocols ospf area 0.0.0.0 interface lo0.0 set protocols ospf area 0.0.0.0 interface ge-0/0/1.0 set protocols ospf area 0.0.0.1 nssa summaries set protocols ospf area 0.0.0.1 interface ge-0/0/4.0
Juniper vMX – vmx02
set protocols ospf area 0.0.0.0 interface lo0.0 set protocols ospf area 0.0.0.0 interface ge-0/0/1.0 set protocols ospf area 0.0.0.1 nssa summaries set protocols ospf area 0.0.0.1 interface ge-0/0/4.0
Cisco ASAv – vtep01
router ospf 1 network 10.120.10.0 255.255.255.0 area 1 area 1 nssa
Cisco ASAv – vtep02
router ospf 1 network 10.130.10.0 255.255.255.0 area 1 area 1 nssa
Weryfikacja OSPF
Juniper vMX – vmx01
root@vMX01> show ospf neighbor Address Interface State ID Pri Dead 10.10.30.2 ge-0/0/1.0 Full 3.3.3.3 1 34 10.120.10.10 ge-0/0/4.0 Full 192.168.200.10 1 36
root@vMX01> show ospf database
OSPF database, Area 0.0.0.0
Type ID Adv Rtr Seq Age Opt Cksum Len
Router *1.1.1.1 1.1.1.1 0x80000451 283 0x22 0x72dc 48
Router 2.2.2.2 2.2.2.2 0x80000722 1306 0x22 0xaab0 48
Router 3.3.3.3 3.3.3.3 0x80000a26 1855 0x22 0x19f 72
Network 10.10.30.2 3.3.3.3 0x80000148 1118 0x22 0xf1af 32
Network 10.10.40.2 3.3.3.3 0x800001df 1850 0x22 0x8675 32
Summary *10.120.10.0 1.1.1.1 0x800002ee 1810 0x22 0xfcbe 28
Summary 10.130.10.0 2.2.2.2 0x80000439 1850 0x22 0xcb95 28
OSPF database, Area 0.0.0.1
Type ID Adv Rtr Seq Age Opt Cksum Len
Router *1.1.1.1 1.1.1.1 0x800002a2 2096 0x20 0xea77 36
Router 192.168.200.10 192.168.200.10 0x800002e2 1109 0x28 0xd9c0 36
Network 10.120.10.10 192.168.200.10 0x8000025a 1109 0x28 0xfbc9 32
Summary *1.1.1.1 1.1.1.1 0x80000123 577 0x20 0x14ff 28
Summary *2.2.2.2 1.1.1.1 0x80000001 1848 0x20 0x41ef 28
Summary *3.3.3.3 1.1.1.1 0x8000000d 1460 0x20 0xfa26 28
Summary *10.10.20.0 1.1.1.1 0x8000000d 1166 0x20 0xad57 28
Summary *10.10.30.0 1.1.1.1 0x800002b2 871 0x20 0xe370 28
Summary *10.10.40.0 1.1.1.1 0x80000014 1848 0x20 0xc227 28
Summary *10.130.10.0 1.1.1.1 0x80000001 1848 0x20 0x9809 28
root@vMX01> show route protocol ospf
inet.0: 21 destinations, 22 routes (21 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
2.2.2.2/32 *[OSPF/10] 00:31:21, metric 2
> to 10.10.30.2 via ge-0/0/1.0
3.3.3.3/32 *[OSPF/10] 00:52:07, metric 2
> to 10.10.30.2 via ge-0/0/1.0
10.10.20.0/24 *[OSPF/10] 00:52:07, metric 2
> to 10.10.30.2 via ge-0/0/1.0
10.10.40.0/24 *[OSPF/10] 00:31:21, metric 2
> to 10.10.30.2 via ge-0/0/1.0
10.130.10.0/24 *[OSPF/10] 00:31:21, metric 3
> to 10.10.30.2 via ge-0/0/1.0
224.0.0.5/32 *[OSPF/10] 5d 20:04:48, metric 1
MultiRecv
Juniper vMX – vmx02
root@vMX02> show ospf neighbor Address Interface State ID Pri Dead 10.10.40.2 ge-0/0/1.0 Full 3.3.3.3 1 38 10.130.10.10 ge-0/0/4.0 Full 192.168.200.110 1 34
root@vMX02> show ospf database
OSPF database, Area 0.0.0.0
Type ID Adv Rtr Seq Age Opt Cksum Len
Router 1.1.1.1 1.1.1.1 0x80000451 430 0x22 0x72dc 48
Router *2.2.2.2 2.2.2.2 0x80000722 1460 0x22 0xaab0 48
Router 3.3.3.3 3.3.3.3 0x80000a26 2016 0x22 0x19f 72
Network 10.10.30.2 3.3.3.3 0x80000148 1272 0x22 0xf1af 32
Network 10.10.40.2 3.3.3.3 0x800001df 2012 0x22 0x8675 32
Summary 10.120.10.0 1.1.1.1 0x800002ee 1973 0x22 0xfcbe 28
Summary *10.130.10.0 2.2.2.2 0x80000439 2009 0x22 0xcb95 28
OSPF database, Area 0.0.0.1
Type ID Adv Rtr Seq Age Opt Cksum Len
Router *2.2.2.2 2.2.2.2 0x80000393 1188 0x22 0x64ed 36
Router 192.168.200.110 192.168.200.110 0x80000492 66 0x22 0x51c0 36
Network 10.130.10.10 192.168.200.110 0x8000032a 66 0x22 0xfe25 32
Summary *1.1.1.1 2.2.2.2 0x80000003 915 0x22 0x2ffd 28
Summary *2.2.2.2 2.2.2.2 0x80000194 1732 0x22 0xc6d1 28
Summary *3.3.3.3 2.2.2.2 0x8000000a 643 0x22 0xc459 28
Summary *10.10.20.0 2.2.2.2 0x80000009 371 0x22 0x7989 28
Summary *10.10.30.0 2.2.2.2 0x8000000c 98 0x22 0x5f0 28
Summary *10.10.40.0 2.2.2.2 0x80000399 2010 0x22 0x68f3 28
Summary *10.120.10.0 2.2.2.2 0x80000002 2010 0x22 0xd2d1 28
ASBRSum *1.1.1.1 2.2.2.2 0x80000002 2010 0x22 0x230a 28
root@vMX02> show route protocol ospf
inet.0: 21 destinations, 22 routes (21 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
1.1.1.1/32 *[OSPF/10] 00:36:55, metric 2
> to 10.10.40.2 via ge-0/0/1.0
3.3.3.3/32 *[OSPF/10] 00:36:55, metric 2
> to 10.10.40.2 via ge-0/0/1.0
10.10.20.0/24 *[OSPF/10] 00:36:55, metric 2
> to 10.10.40.2 via ge-0/0/1.0
10.10.30.0/24 *[OSPF/10] 00:36:55, metric 2
> to 10.10.40.2 via ge-0/0/1.0
10.120.10.0/24 *[OSPF/10] 00:36:55, metric 3
> to 10.10.40.2 via ge-0/0/1.0
224.0.0.5/32 *[OSPF/10] 1w0d 01:21:50, metric 1
MultiRecv
Cisco ASAv – vtep01
vtep01# show ospf neighbor Neighbor ID Pri State Dead Time Address Interface 1.1.1.1 128 FULL/BDR 0:00:35 10.120.10.1 lan120
vtep01# show ospf database
OSPF Router with ID (192.168.200.10) (Process ID 1)
Router Link States (Area 1)
Link ID ADV Router Age Seq# Checksum Link count
1.1.1.1 1.1.1.1 593 0x800002a3 0xe878 1
192.168.200.10 192.168.200.10 1723 0x800002e2 0xd9c0 1
Net Link States (Area 1)
Link ID ADV Router Age Seq# Checksum
10.120.10.10 192.168.200.10 1723 0x8000025a 0xfbc9
Summary Net Link States (Area 1)
Link ID ADV Router Age Seq# Checksum
1.1.1.1 1.1.1.1 1188 0x80000123 0x14ff
2.2.2.2 1.1.1.1 6 0x80000001 0x41ef
3.3.3.3 1.1.1.1 2080 0x8000000d 0xfa26
10.10.20.0 1.1.1.1 1783 0x8000000d 0xad57
10.10.30.0 1.1.1.1 1485 0x800002b2 0xe370
10.10.40.0 1.1.1.1 6 0x80000016 0xbe29
10.130.10.0 1.1.1.1 6 0x80000001 0x9809
vtep01# show route ospf
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, + - replicated route
Gateway of last resort is 192.168.200.1 to network 0.0.0.0
O IA 1.1.1.1 255.255.255.255 [110/10] via 10.120.10.1, 01:02:09, lan120
O IA 2.2.2.2 255.255.255.255 [110/12] via 10.120.10.1, 00:00:12, lan120
O IA 3.3.3.3 255.255.255.255 [110/12] via 10.120.10.1, 01:02:09, lan120
O IA 10.10.20.0 255.255.255.0 [110/12] via 10.120.10.1, 01:02:09, lan120
O IA 10.10.30.0 255.255.255.0 [110/11] via 10.120.10.1, 01:02:09, lan120
O IA 10.10.40.0 255.255.255.0 [110/12] via 10.120.10.1, 00:00:12, lan120
O IA 10.130.10.0 255.255.255.0 [110/13] via 10.120.10.1, 00:00:12, lan120
Cisco ASAv – vtep02
vtep02# show ospf neighbor Neighbor ID Pri State Dead Time Address Interface 2.2.2.2 128 FULL/BDR 0:00:33 10.130.10.1 vlan130
vtep02# show ospf database
OSPF Router with ID (192.168.200.110) (Process ID 1)
Router Link States (Area 1)
Link ID ADV Router Age Seq# Checksum Link count
2.2.2.2 2.2.2.2 1469 0x80000393 0x64ed 1
192.168.200.110 192.168.200.110 346 0x80000492 0x51c0 1
Net Link States (Area 1)
Link ID ADV Router Age Seq# Checksum
10.130.10.10 192.168.200.110 346 0x8000032a 0xfe25
Summary Net Link States (Area 1)
Link ID ADV Router Age Seq# Checksum
1.1.1.1 2.2.2.2 1197 0x80000003 0x2ffd
2.2.2.2 2.2.2.2 2014 0x80000194 0xc6d1
3.3.3.3 2.2.2.2 925 0x8000000a 0xc459
10.10.20.0 2.2.2.2 652 0x80000009 0x7989
10.10.30.0 2.2.2.2 380 0x8000000c 0x 5f0
10.10.40.0 2.2.2.2 2292 0x80000399 0x68f3
10.120.10.0 2.2.2.2 108 0x80000003 0xd0d2
Summary ASB Link States (Area 1)
Link ID ADV Router Age Seq# Checksum
1.1.1.1 2.2.2.2 2293 0x80000002 0x230a
vtep02# show route ospf
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, + - replicated route
Gateway of last resort is 192.168.200.1 to network 0.0.0.0
O IA 1.1.1.1 255.255.255.255 [110/12] via 10.130.10.1, 00:38:33, vlan130
O IA 2.2.2.2 255.255.255.255 [110/10] via 10.130.10.1, 00:38:33, vlan130
O IA 3.3.3.3 255.255.255.255 [110/12] via 10.130.10.1, 00:38:33, vlan130
O IA 10.10.20.0 255.255.255.0 [110/12] via 10.130.10.1, 00:38:33, vlan130
O IA 10.10.30.0 255.255.255.0 [110/12] via 10.130.10.1, 00:38:33, vlan130
O IA 10.10.40.0 255.255.255.0 [110/11] via 10.130.10.1, 00:38:33, vlan130
O IA 10.120.10.0 255.255.255.0 [110/13] via 10.130.10.1, 00:38:33, vlan130
Cisco ASA – asav01
vtep02# show route ospf
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, + - replicated route
Gateway of last resort is 192.168.200.1 to network 0.0.0.0
O IA 1.1.1.1 255.255.255.255 [110/12] via 10.130.10.1, 00:38:13, vlan130
O IA 2.2.2.2 255.255.255.255 [110/10] via 10.130.10.1, 00:38:13, vlan130
O IA 3.3.3.3 255.255.255.255 [110/12] via 10.130.10.1, 00:38:13, vlan130
O IA 10.10.20.0 255.255.255.0 [110/12] via 10.130.10.1, 00:38:13, vlan130
O IA 10.10.30.0 255.255.255.0 [110/12] via 10.130.10.1, 00:38:13, vlan130
O IA 10.10.40.0 255.255.255.0 [110/11] via 10.130.10.1, 00:38:13, vlan130
O IA 10.120.10.0 255.255.255.0 [110/13] via 10.130.10.1, 00:38:13, vlan130
Cisco CSR – csrv03
core-csrv03#show ip route ospf
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
a - application route
+ - replicated route, % - next hop override, p - overrides from PfR
Gateway of last resort is not set
1.0.0.0/32 is subnetted, 1 subnets
O 1.1.1.1 [110/1] via 10.10.30.10, 00:08:04, GigabitEthernet2
2.0.0.0/32 is subnetted, 1 subnets
O 2.2.2.2 [110/1] via 10.10.40.10, 00:06:56, GigabitEthernet3
10.0.0.0/8 is variably subnetted, 8 subnets, 2 masks
O IA 10.120.10.0/24 [110/2] via 10.10.30.10, 00:08:04, GigabitEthernet2
O IA 10.130.10.0/24 [110/2] via 10.10.40.10, 00:06:56, GigabitEthernet3
Konfiguracja BGP
Juniper vMX – vmx01
set routing-options router-id 1.1.1.1 set routing-options autonomous-system 65000
set protocols bgp group Internal type internal set protocols bgp group Internal local-address 1.1.1.1 set protocols bgp group Internal family inet-vpn unicast set protocols bgp group Internal family evpn signaling set protocols bgp group Internal neighbor 2.2.2.2
set routing-options forwarding-table chained-composite-next-hop ingress evpn
Juniper vMX – vmx02
set routing-options router-id 2.2.2.2 set routing-options autonomous-system 65000
set protocols bgp group Internal type internal set protocols bgp group Internal local-address 2.2.2.2 set protocols bgp group Internal family inet-vpn unicast set protocols bgp group Internal family evpn signaling set protocols bgp group Internal neighbor 1.1.1.1
set routing-options forwarding-table chained-composite-next-hop ingress evpn
Weryfikacja BGP
Juniper vMX – vmx01
root@vMX01> show bgp summary Groups: 1 Peers: 1 Down peers: 0 Peer AS InPkt OutPkt OutQ Flaps Last Up/Dwn State|#Active/Received/Accepted/Damped... 2.2.2.2 65000 17 17 0 473 4:36 Establ
Juniper vMX – vmx02
root@vMX02> show bgp summary Groups: 1 Peers: 1 Down peers: 0 Peer AS InPkt OutPkt OutQ Flaps Last Up/Dwn State|#Active/Received/Accepted/Damped... 1.1.1.1 65000 22 20 0 484 6:06 Establ
Konfiguracja MPLS z sygnalizacją LDP
Cisco CSR – csrv03
mpls label protocol ldp
interface GigabitEthernet2 mpls ip
interface GigabitEthernet3 mpls ip
Juniper vMX – vmx01
set protocols mpls interface all set protocols ldp interface ge-0/0/1.0 set protocols ldp interface lo0.0
set interfaces ge-0/0/1 unit 0 family mpls
Juniper vMX – vmx02
set protocols mpls interface all set protocols ldp interface ge-0/0/1.0 set protocols ldp interface lo0.0
set interfaces ge-0/0/1 unit 0 family mpls
Weryfikacja MPLS
Cisco CSR – csrv03
core-csrv03#show mpls interfaces Interface IP Tunnel BGP Static Operational GigabitEthernet2 Yes (ldp) No No No Yes GigabitEthernet3 Yes (ldp) No No No Yes
core-csrv03#show mpls ldp neighbor
Peer LDP Ident: 2.2.2.2:0; Local LDP Ident 3.3.3.3:0
TCP connection: 2.2.2.2.646 - 3.3.3.3.21614
State: Oper; Msgs sent/rcvd: 16/10; Downstream
Up time: 00:00:40
LDP discovery sources:
GigabitEthernet3, Src IP addr: 10.10.40.10
Addresses bound to peer LDP Ident:
2.2.2.2 10.10.40.10
Peer LDP Ident: 1.1.1.1:0; Local LDP Ident 3.3.3.3:0
TCP connection: 1.1.1.1.646 - 3.3.3.3.25210
State: Oper; Msgs sent/rcvd: 13/7; Downstream
Up time: 00:00:09
LDP discovery sources:
GigabitEthernet2, Src IP addr: 10.10.30.10
Addresses bound to peer LDP Ident:
1.1.1.1 10.10.30.10
core-csrv03#show mpls forwarding-table Local Outgoing Prefix Bytes Label Outgoing Next Hop Label Label or Tunnel Id Switched interface 16 Pop Label 2.2.2.2/32 0 Gi3 10.10.40.10 17 No Label 10.130.10.0/24 0 Gi3 10.10.40.10 18 Pop Label 1.1.1.1/32 0 Gi2 10.10.30.10 19 No Label 10.120.10.0/24 0 Gi2 10.10.30.10
core-csrv03#show mpls ldp bindings
lib entry: 1.1.1.1/32, rev 13
local binding: label: 16
remote binding: lsr: 1.1.1.1:0, label: imp-null
remote binding: lsr: 2.2.2.2:0, label: 420688
lib entry: 2.2.2.2/32, rev 18
local binding: label: 18
remote binding: lsr: 2.2.2.2:0, label: imp-null
remote binding: lsr: 1.1.1.1:0, label: 410304
lib entry: 3.3.3.3/32, rev 2
local binding: label: imp-null
remote binding: lsr: 1.1.1.1:0, label: 410272
remote binding: lsr: 2.2.2.2:0, label: 420656
lib entry: 10.10.20.0/24, rev 8
local binding: label: imp-null
remote binding: lsr: 1.1.1.1:0, label: 410272
remote binding: lsr: 2.2.2.2:0, label: 420656
lib entry: 10.10.30.0/24, rev 4
local binding: label: imp-null
remote binding: lsr: 2.2.2.2:0, label: 420656
lib entry: 10.10.40.0/24, rev 6
local binding: label: imp-null
remote binding: lsr: 1.1.1.1:0, label: 410272
lib entry: 10.120.10.0/24, rev 12
local binding: label: 17
remote binding: lsr: 2.2.2.2:0, label: 420672
lib entry: 10.130.10.0/24, rev 17
local binding: label: 19
remote binding: lsr: 1.1.1.1:0, label: 410288
Juniper vMX – vmx01
root@vMX01> show ldp database
Input label database, 1.1.1.1:0--3.3.3.3:0
Labels received: 5
Label Prefix
18 1.1.1.1/32
16 2.2.2.2/32
3 3.3.3.3/32
3 10.10.20.0/24
3 10.10.30.0/24
3 10.10.40.0/24
19 10.120.10.0/24
17 10.130.10.0/24
Output label database, 1.1.1.1:0--3.3.3.3:0
Labels advertised: 4
Label Prefix
3 1.1.1.1/32
410208 2.2.2.2/32
410176 3.3.3.3/32
410176 10.10.20.0/24
410176 10.10.40.0/24
410192 10.130.10.0/24
root@vMX01> show ldp neighbor Address Interface Label space ID Hold time 10.10.30.2 ge-0/0/1.0 3.3.3.3:0 14
root@vMX01> show route protocol mpls
mpls.0: 16 destinations, 16 routes (16 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
0 *[MPLS/0] 5d 23:58:55, metric 1
to table inet.0
0(S=0) *[MPLS/0] 5d 23:58:55, metric 1
to table mpls.0
1 *[MPLS/0] 5d 23:58:55, metric 1
Receive
2 *[MPLS/0] 5d 23:58:55, metric 1
to table inet6.0
2(S=0) *[MPLS/0] 5d 23:58:55, metric 1
to table mpls.0
13 *[MPLS/0] 5d 23:58:55, metric 1
Receive
Juniper vMX – vmx02
root@vMX02> show ldp database
Input label database, 2.2.2.2:0--3.3.3.3:0
Labels received: 5
Label Prefix
18 1.1.1.1/32
16 2.2.2.2/32
3 3.3.3.3/32
3 10.10.20.0/24
3 10.10.30.0/24
3 10.10.40.0/24
19 10.120.10.0/24
17 10.130.10.0/24
Output label database, 2.2.2.2:0--3.3.3.3:0
Labels advertised: 4
Label Prefix
420592 1.1.1.1/32
3 2.2.2.2/32
420560 3.3.3.3/32
420560 10.10.20.0/24
420560 10.10.30.0/24
420576 10.120.10.0/24
root@vMX02> show ldp neighbor Address Interface Label space ID Hold time 10.10.40.2 ge-0/0/1.0 3.3.3.3:0 13
root@vMX02> show route protocol mpls
mpls.0: 16 destinations, 16 routes (16 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
0 *[MPLS/0] 1w0d 05:11:56, metric 1
to table inet.0
0(S=0) *[MPLS/0] 1w0d 05:11:56, metric 1
to table mpls.0
1 *[MPLS/0] 1w0d 05:11:56, metric 1
Receive
2 *[MPLS/0] 1w0d 05:11:56, metric 1
to table inet6.0
2(S=0) *[MPLS/0] 1w0d 05:11:56, metric 1
to table mpls.0
13 *[MPLS/0] 1w0d 05:11:56, metric 1
Receive
Konfiguracja Multicast
Juniper vMX – vmx01
set protocols pim rp static address 3.3.3.3 set protocols pim interface lo0.0 mode bidirectional-sparse set protocols pim interface ge-0/0/1.0 mode bidirectional-sparse set protocols pim interface ge-0/0/4.0 mode bidirectional-sparse
Juniper vMX – vmx02
set protocols pim rp static address 3.3.3.3 set protocols pim interface lo0.0 mode bidirectional-sparse set protocols pim interface ge-0/0/1.0 mode bidirectional-sparse set protocols pim interface ge-0/0/4.0 mode bidirectional-sparse
Cisco ASAv – vtep01
multicast-routing pim rp-address 3.3.3.3
Cisco ASAv – vtep02
multicast-routing pim rp-address 3.3.3.3
Cisco ASA – asav01
multicast-routing
Weryfikacja Multicast
Juniper vMX – vmx01
root@vMX01> show pim neighbors B = Bidirectional Capable, G = Generation Identifier H = Hello Option Holdtime, L = Hello Option LAN Prune Delay, P = Hello Option DR Priority, T = Tracking Bit Instance: PIM.master Interface IP V Mode Option Uptime Neighbor addr ge-0/0/1.0 4 2 HPGB 00:05:19 10.10.30.2 ge-0/0/4.0 4 2 HPLGB 00:00:22 10.120.10.10
root@vMX01> show route protocol pim
inet.0: 19 destinations, 20 routes (19 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
224.0.0.2/32 *[PIM/0] 6d 00:53:00
MultiRecv
224.0.0.13/32 *[PIM/0] 6d 00:53:00
MultiRecv
inet.1: 6 destinations, 6 routes (6 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
239.100.100.100,1.1.1.1/64*[PIM/105] 6d 00:49:25
Multicast (IPv4) Composite
239.110.110.110,1.1.1.1/64*[PIM/105] 6d 00:49:31
Multicast (IPv4) Composite
239.110.110.110,10.120.10.10/64*[PIM/105] 00:08:25
Multicast (IPv4) Composite
Juniper vMX – vmx02
root@vMX02> show pim neighbors B = Bidirectional Capable, G = Generation Identifier H = Hello Option Holdtime, L = Hello Option LAN Prune Delay, P = Hello Option DR Priority, T = Tracking Bit Instance: PIM.master Interface IP V Mode Option Uptime Neighbor addr ge-0/0/1.0 4 2 HPGB 00:13:11 10.10.40.2 ge-0/0/4.0 4 2 HPLGB 00:13:10 10.130.10.10
Cisco ASAv – vtep01
vtep01# show pim neighbor Neighbor Address Interface Uptime Expires DR pri Bidir 10.120.10.1 lan120 00:03:04 00:01:31 1 B
Cisco ASAv – vtep02
vtep02# show pim nei Neighbor Address Interface Uptime Expires DR pri Bidir 10.130.10.1 vlan130 00:38:34 00:01:24 1 B
Cisco ASA – asav01
asav01# show pim nei Neighbor Address Interface Uptime Expires DR pri Bidir 10.10.20.2 lan 00:05:55 00:01:41 1 (DR) B
Konfiguracja VxLAN
ze względu na połączenie evpn z vxvlan oraz łączenie interfejsów będziemy wykorzystywać routing instancje dla vxvlan6666 oraz vxvlan1100 oraz będziemy łączyć ze sobą segmenty wykorzystując bridge domain.
Jedna uwaga:
po uruchomieniu vxlan na Cisco ASAv przestaje działać OSPF ze względu na zmianę MTU na interfejsie źródłowym dla vtep’a i dlatego na urządzeniach sąsiednich trzeba zmienić MTU:
Cisco CSR – csrv03
interface GigabitEthernet1 mtu 1554
Juniper vMX
set interfaces ge-0/0/4 mtu 1568
Przypadek 1
Rysunek poglądowy:
Na Cisco ASA asav01 jest uruchomiony interfejs vni 6666 a Juniper vMX ma dostęp do tego vxlanu i tworzy Bridge pomiędzy vxvlanem, evpnem a vlanem 100, do którego będzie podłączone kolejne Cisco ASA z fizycznym interfejsem.
Na urządzeniach vMX konfigurujemy routing instances typu evpn
Juniper vMX – vmx01
set routing-instances evpn100 vtep-source-interface lo0.0 set routing-instances evpn100 instance-type evpn set routing-instances evpn100 vlan-id 100 set routing-instances evpn100 interface ge-0/0/2.0 set routing-instances evpn100 vxlan vni 6666 set routing-instances evpn100 vxlan multicast-group 239.100.100.100 set routing-instances evpn100 vxlan encapsulate-inner-vlan set routing-instances evpn100 vxlan decapsulate-accept-inner-vlan set routing-instances evpn100 route-distinguisher 1.1.1.1:100 set routing-instances evpn100 vrf-target target:1:1
Konfigurujemy interfejs, do którego będzie podłączony vtep01. Port jest tagowany vlanem 100
set interfaces ge-0/0/2 flexible-vlan-tagging set interfaces ge-0/0/2 encapsulation flexible-ethernet-services set interfaces ge-0/0/2 unit 0 encapsulation vlan-bridge set interfaces ge-0/0/2 unit 0 vlan-id 100
Juniper vMX – vmx02
set routing-instances evpn100 vtep-source-interface lo0.0 set routing-instances evpn100 instance-type evpn set routing-instances evpn100 vlan-id 100 set routing-instances evpn100 interface ge-0/0/2.0 set routing-instances evpn100 vxlan vni 6666 set routing-instances evpn100 vxlan multicast-group 239.100.100.100 set routing-instances evpn100 vxlan encapsulate-inner-vlan set routing-instances evpn100 vxlan decapsulate-accept-inner-vlan set routing-instances evpn100 route-distinguisher 2.2.2.2:100 set routing-instances evpn100 vrf-target target:1:1
Konfigurujemy interfejs, do którego będzie podłączony vtep01. Port jest tagowany vlanem 100
set interfaces ge-0/0/2 flexible-vlan-tagging set interfaces ge-0/0/2 encapsulation flexible-ethernet-services set interfaces ge-0/0/2 unit 0 encapsulation vlan-bridge set interfaces ge-0/0/2 unit 0 vlan-id 100
Cisco ASAv – vtep01
interface GigabitEthernet0/0.100 vlan 100 nameif lan security-level 0 ip address 192.168.200.10 255.255.255.0 no sh
routing domyślny przez asav01
route lan 0.0.0.0 0.0.0.0 192.168.200.1 1
Cisco ASAv – vtep02
interface GigabitEthernet0/0.100 vlan 100 nameif lan security-level 0 ip address 192.168.200.110 255.255.255.0 no sh
routing domyślny przez asav01
route lan 0.0.0.0 0.0.0.0 192.168.200.1 1
Cisco ASA – asav01
nve 1 encapsulation vxlan source-interface lan
interface vni1 segment-id 6666 nameif vxvlan6666 security-level 0 ip address 192.168.200.1 255.255.255.0 vtep-nve 1 mcast-group 239.100.100.100
Konfiguracja nat’u oraz routingu tak aby był dostępny Internet
route out 0.0.0.0 0.0.0.0 192.168.1.1 1
nat (vxvlan6666,out) source dynamic any interface
Weryfikacja:
Cisco ASAv – asav01
Wykonujemy pingi interfejsów l3
asav01# ping 192.168.200.10 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.200.10, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 10/22/30 ms
asav01# ping 192.168.200.110 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.200.110, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 10/22/30 ms
asav01# ping 192.168.200.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.200.1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
Tablica arp:
asav01# show arp
out 192.168.1.10 c8f7.3391.c2ab 11
lan 10.10.20.2 000c.29b7.00b9 373
vxvlan6666 192.168.200.110 000c.2977.39f5 223
vxvlan6666 192.168.200.10 000c.2995.a7b0 226
vxvlan:
asav01# show nve 1
nve 1, source-interface "lan" is up
IP address 10.10.20.1, subnet mask 255.255.255.0
Encapsulation: vxlan
Encapsulated traffic statistics:
34 packets input, 3644 bytes
50 packets output, 6470 bytes
0 packets dropped
Number of configured static peer VTEPs: 0
Number of discovered peer VTEPs: 2
Discovered peer VTEPs:
IP address 1.1.1.1
IP address 2.2.2.2
Number of VNIs attached to nve 1: 1
VNIs attached:
vni 1: segment-id 6666, mcast-group 239.100.100.100
Cisco ASAv – vtep01
vtep01# ping 192.168.200.10 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.200.10, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
vtep01# ping 192.168.200.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.200.1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 10/40/120 ms
vtep01# ping 192.168.200.110 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.200.110, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 20/38/80 ms
vtep01# show arp
lan 192.168.200.110 000c.2977.39f5 50
lan 192.168.200.1 000c.2927.c9a1 223
lan120 10.120.10.1 000c.2960.d9e1 108
vxvlan1100 172.16.110.100 0005.8671.35f0 1178
vxvlan1100 172.16.110.101 0005.8671.6ff0 3231
vxvlan1100 172.16.110.50 0200.2000.2000 12589
vtep01# show nve 1
nve 1, source-interface "lan120" is up
IP address 10.120.10.10, subnet mask 255.255.255.0
Encapsulation: vxlan
Encapsulated traffic statistics:
2409 packets input, 173226 bytes
3203 packets output, 330536 bytes
0 packets dropped
Number of configured static peer VTEPs: 0
Number of discovered peer VTEPs: 1
Discovered peer VTEPs:
IP address 1.1.1.1
Number of VNIs attached to nve 1: 1
VNIs attached:
vni 1100: segment-id 1100, mcast-group 239.110.110.110
Po skonfigurowaniu routingu domyślnego możemy osiągnąć Internet
vtep01# show route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, + - replicated route
Gateway of last resort is 192.168.200.1 to network 0.0.0.0
S* 0.0.0.0 0.0.0.0 [1/0] via 192.168.200.1, lan
O IA 1.1.1.1 255.255.255.255 [110/10] via 10.120.10.1, 00:45:08, lan120
O IA 2.2.2.2 255.255.255.255 [110/12] via 10.120.10.1, 00:05:03, lan120
O IA 3.3.3.3 255.255.255.255 [110/12] via 10.120.10.1, 00:45:08, lan120
O IA 10.10.20.0 255.255.255.0 [110/12] via 10.120.10.1, 00:45:08, lan120
O IA 10.10.30.0 255.255.255.0 [110/11] via 10.120.10.1, 00:45:08, lan120
O IA 10.10.40.0 255.255.255.0 [110/12] via 10.120.10.1, 00:05:03, lan120
C 10.120.10.0 255.255.255.0 is directly connected, lan120
L 10.120.10.10 255.255.255.255 is directly connected, lan120
O IA 10.130.10.0 255.255.255.0 [110/13] via 10.120.10.1, 00:05:03, lan120
C 172.16.110.0 255.255.255.0 is directly connected, vxvlan1100
L 172.16.110.10 255.255.255.255 is directly connected, vxvlan1100
C 192.168.200.0 255.255.255.0 is directly connected, lan
L 192.168.200.10 255.255.255.255 is directly connected, lan
vtep01# ping 8.8.8.8 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 40/100/310 ms
Cisco ASAv – vtep02
vtep02# ping 192.168.200.10 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.200.10, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 50/250/830 ms
vtep02# ping 192.168.200.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.200.1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 10/36/90 ms
vtep02# ping 192.168.200.110 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.200.110, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
vtep02# show arp
lan 192.168.200.10 000c.2995.a7b0 50
lan 192.168.200.1 000c.2927.c9a1 223
vlan130 10.130.10.1 000c.29a6.9bf5 105
vxlan1100 172.16.110.100 0005.8671.35f0 1178
vxlan1100 172.16.110.101 0005.8671.6ff0 3231
vxlan1100 172.16.110.10 000a.0100.1000 12589
vtep02# show nve 1
nve 1, source-interface "vlan130" is up
IP address 10.130.10.10, subnet mask 255.255.255.0
Encapsulation: vxlan
Encapsulated traffic statistics:
2924 packets input, 195924 bytes
2522 packets output, 273016 bytes
0 packets dropped
Number of configured static peer VTEPs: 0
Number of discovered peer VTEPs: 1
Discovered peer VTEPs:
IP address 2.2.2.2
Number of VNIs attached to nve 1: 1
VNIs attached:
vni 1100: segment-id 1100, mcast-group 239.110.110.110
vtep02# show route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, + - replicated route
Gateway of last resort is 192.168.200.1 to network 0.0.0.0
S* 0.0.0.0 0.0.0.0 [1/0] via 192.168.200.1, lan
O IA 1.1.1.1 255.255.255.255 [110/12] via 10.130.10.1, 00:04:20, vlan130
O IA 2.2.2.2 255.255.255.255 [110/10] via 10.130.10.1, 00:04:20, vlan130
O IA 3.3.3.3 255.255.255.255 [110/12] via 10.130.10.1, 00:04:20, vlan130
O IA 10.10.20.0 255.255.255.0 [110/12] via 10.130.10.1, 00:04:20, vlan130
O IA 10.10.30.0 255.255.255.0 [110/12] via 10.130.10.1, 00:04:20, vlan130
O IA 10.10.40.0 255.255.255.0 [110/11] via 10.130.10.1, 00:04:20, vlan130
O IA 10.120.10.0 255.255.255.0 [110/13] via 10.130.10.1, 00:04:20, vlan130
C 10.130.10.0 255.255.255.0 is directly connected, vlan130
L 10.130.10.10 255.255.255.255 is directly connected, vlan130
C 172.16.110.0 255.255.255.0 is directly connected, vxlan1100
L 172.16.110.50 255.255.255.255 is directly connected, vxlan1100
C 192.168.200.0 255.255.255.0 is directly connected, lan
L 192.168.200.110 255.255.255.255 is directly connected, lan
vtep02# ping 8.8.8.8 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 30/32/40 ms
Juniper vMX – vmx01
root@vMX01> show l2-learning vxlan-tunnel-end-point source
Logical System Name Id SVTEP-IP IFL L3-Idx
<default> 0 1.1.1.1 lo0.0 0
L2-RTT Bridge Domain VNID MC-Group-IP
evpn100 __evpn100__ 6666 239.100.100.100
vMX01 fpc0 Frame 10: sp = 0xffe0d768, pc = 0xf748c9b3
show l2-learning vxlan-tunnel-end-point remote
Logical System Name Id SVTEP-IP IFL L3-Idx
<default> 0 1.1.1.1 lo0.0 0
RVTEP-IP IFL-Idx NH-Id
10.10.20.1 348 1195
VNID MC-Group-IP
6666 239.100.100.100
root@vMX01> show evpn instance evpn100 extensive
Instance: evpn100
Route Distinguisher: 1.1.1.1:100
VLAN ID: 100
Per-instance MAC route label: 299776
MAC database status Local Remote
Total MAC addresses: 1 0
Default gateway MAC addresses: 0 0
Number of local interfaces: 3 (3 up)
Interface name ESI Mode Status
ge-0/0/2.0 00:00:00:00:00:00:00:00:00:00 single-homed Up
vtep.32770 00:00:00:00:00:00:00:00:00:00 single-homed Up
vtep.32772 Up
Number of IRB interfaces: 0 (0 up)
Number of bridge domains: 1
VLAN ID Intfs / up Mode MAC sync IM route label
100 1 1 Extended Enabled 299888
Number of neighbors: 1
2.2.2.2
Received routes
MAC address advertisement: 1
MAC+IP address advertisement: 0
Inclusive multicast: 1
Ethernet auto-discovery: 0
Number of ethernet segments: 0
root@vMX01> show route table evpn100.evpn.0
evpn100.evpn.0: 3 destinations, 3 routes (3 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
2:1.1.1.1:100::100::00:0c:29:27:c9:a1/304
*[EVPN/170] 00:00:56
Indirect
3:1.1.1.1:100::100::1.1.1.1/304
*[EVPN/170] 6d 22:38:21
Indirect
3:1.1.1.1:100::100::2.2.2.2/304
*[BGP/170] 00:00:57, localpref 100, from 2.2.2.2
AS path: I, validation-state: unverified
> to 10.10.30.2 via ge-0/0/1.0, Push 16
Juniper vMX – vmx01
root@vMX02> show l2-learning vxlan-tunnel-end-point source
Logical System Name Id SVTEP-IP IFL L3-Idx
<default> 0 2.2.2.2 lo0.0 0
L2-RTT Bridge Domain VNID MC-Group-IP
evpn100 __evpn100__ 6666 239.100.100.100
root@vMX02> show l2-learning vxlan-tunnel-end-point remote
Logical System Name Id SVTEP-IP IFL L3-Idx
<default> 0 2.2.2.2 lo0.0 0
RVTEP-IP IFL-Idx NH-Id
10.10.20.1 347 1644
VNID MC-Group-IP
6666 239.100.100.100
root@vMX02> show evpn instance evpn100 extensive
Instance: evpn100
Route Distinguisher: 1.1.1.1:100
VLAN ID: 100
Per-instance MAC route label: 299776
MAC database status Local Remote
Total MAC addresses: 1 0
Default gateway MAC addresses: 0 0
Number of local interfaces: 3 (3 up)
Interface name ESI Mode Status
ge-0/0/2.0 00:00:00:00:00:00:00:00:00:00 single-homed Up
vtep.32769 00:00:00:00:00:00:00:00:00:00 single-homed Up
vtep.32772 Up
Number of IRB interfaces: 0 (0 up)
Number of bridge domains: 1
VLAN ID Intfs / up Mode MAC sync IM route label
100 1 1 Extended Enabled 299872
Number of neighbors: 1
1.1.1.1
Received routes
MAC address advertisement: 0
MAC+IP address advertisement: 0
Inclusive multicast: 1
Ethernet auto-discovery: 0
Number of ethernet segments: 0
root@vMX02> show route table evpn100.evpn.0
evpn100.evpn.0: 3 destinations, 4 routes (3 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
2:1.1.1.1:100::100::00:0c:29:27:c9:a1/304
*[BGP/170] 00:01:32, localpref 100, from 1.1.1.1
AS path: I, validation-state: unverified
> to 10.10.40.2 via ge-0/0/1.0, Push 17
[EVPN/170] 00:01:26
Indirect
3:1.1.1.1:100::100::1.1.1.1/304
*[BGP/170] 00:01:33, localpref 100, from 1.1.1.1
AS path: I, validation-state: unverified
> to 10.10.40.2 via ge-0/0/1.0, Push 17
3:1.1.1.1:100::100::2.2.2.2/304
*[EVPN/170] 1w1d 04:04:37
Indirect
Przypadek 2
Rysunek poglądowy:
Na urządzeniach Cisco ASAv uruchomione są interfejsy vni 1100. Vxlan ten zostanie rozciągnięty przez dwa urządzenia Juniper vMX (vmx01 i vmx02). Dla tego przypadku uruchomię Routing instancję typu virtual-switch. W celach testowych na każdym vMX zostanie uruchomiony w tej adresacji interfejs irb w celu sprawdzenia czy wszystko odpowiednio działa.
Poniżej konfiguracja:
Juniper vMX – vmx01
set routing-instances evpn210 vtep-source-interface lo0.0 set routing-instances evpn210 instance-type virtual-switch set routing-instances evpn210 route-distinguisher 1.1.1.1:210 set routing-instances evpn210 vrf-target target:210:210 set routing-instances evpn210 protocols evpn extended-vlan-list 210 set routing-instances evpn210 bridge-domains vxvlan_a domain-type bridge set routing-instances evpn210 bridge-domains vxvlan_a vlan-id 210 set routing-instances evpn210 bridge-domains vxvlan_a routing-interface irb.110 set routing-instances evpn210 bridge-domains vxvlan_a vxlan vni 1100 set routing-instances evpn210 bridge-domains vxvlan_a vxlan multicast-group 239.110.110.110 set routing-instances evpn210 bridge-domains vxvlan_a vxlan encapsulate-inner-vlan set routing-instances evpn210 bridge-domains vxvlan_a vxlan decapsulate-accept-inner-vlan set routing-instances evpn210 bridge-domains vxvlan_a vxlan unreachable-vtep-aging-timer 300
Interfejs irb.110
set interfaces irb unit 110 family inet address 172.16.110.100/24
Juniper vMX – vmx02
set routing-instances evpn210 vtep-source-interface lo0.0 set routing-instances evpn210 instance-type virtual-switch set routing-instances evpn210 route-distinguisher 2.2.2.2:210 set routing-instances evpn210 vrf-target target:210:210 set routing-instances evpn210 protocols evpn extended-vlan-list 210 set routing-instances evpn210 bridge-domains vxvlan_a domain-type bridge set routing-instances evpn210 bridge-domains vxvlan_a vlan-id 210 set routing-instances evpn210 bridge-domains vxvlan_a routing-interface irb.110 set routing-instances evpn210 bridge-domains vxvlan_a vxlan vni 1100 set routing-instances evpn210 bridge-domains vxvlan_a vxlan multicast-group 239.110.110.110 set routing-instances evpn210 bridge-domains vxvlan_a vxlan encapsulate-inner-vlan set routing-instances evpn210 bridge-domains vxvlan_a vxlan decapsulate-accept-inner-vlan set routing-instances evpn210 bridge-domains vxvlan_a vxlan unreachable-vtep-aging-timer 300
Interfejs irb.110
set interfaces irb unit 110 family inet address 172.16.110.101/24
Cisco ASAv – vtep01
nve 1 encapsulation vxlan source-interface lan120
interface vni1100 mac-address 000a.0100.1000 segment-id 1100 nameif vxvlan1100 security-level 0 ip address 172.16.110.10 255.255.255.0 vtep-nve 1 mcast-group 239.110.110.110
Zauważyłem, gdy mamy uruchomione oba przypadki na urządzeniach warto jest wyłączyć PIM na interfejsie który jest podłączony do sieci vxvlan6666
interface GigabitEthernet0/0.100 no pim
Cisco ASAv – vtep02
nve 1 encapsulation vxlan source-interface vlan130
interface vni1100 mac-address 0200.2000.2000 segment-id 1100 nameif vxlan1100 security-level 0 ip address 172.16.110.50 255.255.255.0 vtep-nve 1 mcast-group 239.110.110.110
interface GigabitEthernet0/0.100 no pim
Weryfikacja:
Juniper vMX – vmx01
root@vMX01> ping 172.16.110.100 interface irb.110 count 5 PING 172.16.110.100 (172.16.110.100): 56 data bytes 64 bytes from 172.16.110.100: icmp_seq=0 ttl=64 time=34.977 ms 64 bytes from 172.16.110.100: icmp_seq=1 ttl=64 time=7.735 ms 64 bytes from 172.16.110.100: icmp_seq=2 ttl=64 time=12.253 ms 64 bytes from 172.16.110.100: icmp_seq=3 ttl=64 time=4.926 ms 64 bytes from 172.16.110.100: icmp_seq=4 ttl=64 time=20.743 ms --- 172.16.110.100 ping statistics --- 5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max/stddev = 4.926/16.127/34.977/10.840 ms
root@vMX01> ping 172.16.110.101 interface irb.110 count 5 PING 172.16.110.101 (172.16.110.101): 56 data bytes 64 bytes from 172.16.110.101: icmp_seq=0 ttl=64 time=0.336 ms 64 bytes from 172.16.110.101: icmp_seq=1 ttl=64 time=0.098 ms 64 bytes from 172.16.110.101: icmp_seq=2 ttl=64 time=0.258 ms 64 bytes from 172.16.110.101: icmp_seq=3 ttl=64 time=0.061 ms 64 bytes from 172.16.110.101: icmp_seq=4 ttl=64 time=0.115 ms --- 172.16.110.101 ping statistics --- 5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max/stddev = 0.061/0.174/0.336/0.105 ms
root@vMX01> ping 172.16.110.10 interface irb.110 count 5 PING 172.16.110.10 (172.16.110.10): 56 data bytes 64 bytes from 172.16.110.10: icmp_seq=0 ttl=255 time=61.138 ms 64 bytes from 172.16.110.10: icmp_seq=1 ttl=255 time=135.056 ms 64 bytes from 172.16.110.10: icmp_seq=2 ttl=255 time=8.125 ms 64 bytes from 172.16.110.10: icmp_seq=3 ttl=255 time=3.897 ms 64 bytes from 172.16.110.10: icmp_seq=4 ttl=255 time=6.604 ms --- 172.16.110.10 ping statistics --- 5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max/stddev = 3.897/42.964/135.056/50.741 ms
root@vMX01> ping 172.16.110.50 interface irb.110 count 5 PING 172.16.110.50 (172.16.110.50): 56 data bytes 64 bytes from 172.16.110.50: icmp_seq=2 ttl=254 time=10.458 ms 64 bytes from 172.16.110.50: icmp_seq=3 ttl=254 time=4.962 ms 64 bytes from 172.16.110.50: icmp_seq=4 ttl=254 time=77.743 ms --- 172.16.110.50 ping statistics --- 5 packets transmitted, 3 packets received, 40% packet loss round-trip min/avg/max/stddev = 4.962/31.054/77.743/33.090 ms
root@vMX01> show route table evpn210.evpn.0
evpn210.evpn.0: 9 destinations, 9 routes (9 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
2:1.1.1.1:210::210::00:05:86:71:6f:f0/304
*[EVPN/170] 18:27:42
Indirect
2:1.1.1.1:210::210::00:0a:01:00:10:00/304
*[EVPN/170] 18:27:41
Indirect
2:2.2.2.2:210::210::00:05:86:71:35:f0/304
*[BGP/170] 00:15:07, localpref 100, from 2.2.2.2
AS path: I, validation-state: unverified
> to 10.10.30.2 via ge-0/0/1.0, Push 16
2:2.2.2.2:210::210::02:00:20:00:20:00/304
*[BGP/170] 00:15:07, localpref 100, from 2.2.2.2
AS path: I, validation-state: unverified
> to 10.10.30.2 via ge-0/0/1.0, Push 16
2:1.1.1.1:210::210::00:05:86:71:6f:f0::172.16.110.101/304
*[EVPN/170] 18:27:42
Indirect
2:1.1.1.1:210::210::00:0a:01:00:10:00::172.16.110.10/304
*[EVPN/170] 01:52:26
Indirect
2:2.2.2.2:210::210::00:05:86:71:35:f0::172.16.110.100/304
*[BGP/170] 00:15:07, localpref 100, from 2.2.2.2
AS path: I, validation-state: unverified
> to 10.10.30.2 via ge-0/0/1.0, Push 16
3:1.1.1.1:210::210::1.1.1.1/304
*[EVPN/170] 6d 19:12:17
Indirect
3:2.2.2.2:210::210::2.2.2.2/304
*[BGP/170] 00:15:07, localpref 100, from 2.2.2.2
AS path: I, validation-state: unverified
> to 10.10.30.2 via ge-0/0/1.0, Push 16
root@vMX01> show evpn database Instance: evpn210 VLAN MAC address Active source Timestamp IP address 210 00:05:86:71:35:f0 2.2.2.2 Apr 26 08:46:43 172.16.110.100 210 00:05:86:71:6f:f0 irb.110 Apr 25 13:47:36 172.16.110.101 210 00:0a:01:00:10:00 vtep.32771 Apr 26 08:38:43 172.16.110.10 210 02:00:20:00:20:00 2.2.2.2 Apr 26 08:46:43 172.16.110.50
root@vMX01> show evpn instance evpn210 extensive
Instance: evpn210
Route Distinguisher: 1.1.1.1:210
Per-instance MAC route label: 299808
MAC database status Local Remote
Total MAC addresses: 2 2
Default gateway MAC addresses: 1 1
Number of local interfaces: 2 (2 up)
Interface name ESI Mode Status
vtep.32769 00:00:00:00:00:00:00:00:00:00 single-homed Up
vtep.32771 Up
Number of IRB interfaces: 1 (1 up)
Interface name VLAN ID Status L3 context
irb.110 210 Up master
Number of bridge domains: 1
VLAN ID Intfs / up Mode MAC sync IM route label
210 0 0 Extended Enabled 299872
Number of neighbors: 1
2.2.2.2
Received routes
MAC address advertisement: 2
MAC+IP address advertisement: 2
Inclusive multicast: 1
Ethernet auto-discovery: 0
Number of ethernet segments: 0
root@vMX01> show bridge domain vxvlan_a extensive
Routing instance: evpn210
Bridge domain: vxvlan_a State: Active
Bridge VLAN ID: 210 EVPN extended: Yes
Interfaces:
pip-4.030010000000
vtep.32771
Total MAC count: 2
root@vMX01> show l2-learning vxlan-tunnel-end-point source
Logical System Name Id SVTEP-IP IFL L3-Idx
<default> 0 1.1.1.1 lo0.0 0
L2-RTT Bridge Domain VNID MC-Group-IP
evpn100 __evpn100__ 6666 239.100.100.100
evpn210 vxvlan_a+210 1100 239.110.110.110
vMX01 fpc0 Frame 10: sp = 0xffe0d768, pc = 0xf748c9b3
show l2-learning vxlan-tunnel-end-point remote
Logical System Name Id SVTEP-IP IFL L3-Idx
<default> 0 1.1.1.1 lo0.0 0
RVTEP-IP IFL-Idx NH-Id
10.120.10.10 347 1157
VNID MC-Group-IP
1100 239.110.110.110
RVTEP-IP IFL-Idx NH-Id
10.10.20.1 348 1195
VNID MC-Group-IP
6666 239.100.100.100
Juniper vMX – vmx02
root@vMX02> ping 172.16.110.100 interface irb.110 count 5 PING 172.16.110.100 (172.16.110.100): 56 data bytes 64 bytes from 172.16.110.100: icmp_seq=0 ttl=64 time=0.417 ms 64 bytes from 172.16.110.100: icmp_seq=1 ttl=64 time=0.102 ms 64 bytes from 172.16.110.100: icmp_seq=2 ttl=64 time=0.103 ms 64 bytes from 172.16.110.100: icmp_seq=3 ttl=64 time=0.104 ms 64 bytes from 172.16.110.100: icmp_seq=4 ttl=64 time=0.155 ms --- 172.16.110.100 ping statistics --- 5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max/stddev = 0.102/0.176/0.417/0.122 ms
root@vMX02> ping 172.16.110.101 interface irb.110 count 5 PING 172.16.110.101 (172.16.110.101): 56 data bytes 64 bytes from 172.16.110.101: icmp_seq=0 ttl=64 time=31.305 ms 64 bytes from 172.16.110.101: icmp_seq=1 ttl=64 time=7.865 ms 64 bytes from 172.16.110.101: icmp_seq=2 ttl=64 time=3.407 ms 64 bytes from 172.16.110.101: icmp_seq=3 ttl=64 time=3.573 ms 64 bytes from 172.16.110.101: icmp_seq=4 ttl=64 time=8.155 ms --- 172.16.110.101 ping statistics --- 5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max/stddev = 3.407/10.861/31.305/10.420 ms
root@vMX02> ping 172.16.110.10 interface irb.110 count 5 PING 172.16.110.10 (172.16.110.10): 56 data bytes 64 bytes from 172.16.110.10: icmp_seq=2 ttl=254 time=12.403 ms 64 bytes from 172.16.110.10: icmp_seq=3 ttl=254 time=5.703 ms 64 bytes from 172.16.110.10: icmp_seq=4 ttl=254 time=14.494 ms --- 172.16.110.10 ping statistics --- 5 packets transmitted, 3 packets received, 40% packet loss round-trip min/avg/max/stddev = 5.703/10.867/14.494/3.750 ms
root@vMX02> ping 172.16.110.50 interface irb.110 count 5 PING 172.16.110.50 (172.16.110.50): 56 data bytes 64 bytes from 172.16.110.50: icmp_seq=0 ttl=255 time=33.069 ms 64 bytes from 172.16.110.50: icmp_seq=1 ttl=255 time=3.957 ms 64 bytes from 172.16.110.50: icmp_seq=2 ttl=255 time=89.464 ms 64 bytes from 172.16.110.50: icmp_seq=3 ttl=255 time=3.773 ms 64 bytes from 172.16.110.50: icmp_seq=4 ttl=255 time=43.534 ms --- 172.16.110.50 ping statistics --- 5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max/stddev = 3.773/34.759/89.464/31.564 ms
root@vMX02> show route table evpn210.evpn.0
evpn210.evpn.0: 9 destinations, 9 routes (9 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
2:1.1.1.1:210::210::00:05:86:71:6f:f0/304
*[BGP/170] 00:14:56, localpref 100, from 1.1.1.1
AS path: I, validation-state: unverified
> to 10.10.40.2 via ge-0/0/1.0, Push 17
2:1.1.1.1:210::210::00:0a:01:00:10:00/304
*[BGP/170] 00:14:56, localpref 100, from 1.1.1.1
AS path: I, validation-state: unverified
> to 10.10.40.2 via ge-0/0/1.0, Push 17
2:2.2.2.2:210::210::00:05:86:71:35:f0/304
*[EVPN/170] 18:28:01
Indirect
2:2.2.2.2:210::210::02:00:20:00:20:00/304
*[EVPN/170] 18:28:01
Indirect
2:1.1.1.1:210::210::00:05:86:71:6f:f0::172.16.110.101/304
*[BGP/170] 00:14:56, localpref 100, from 1.1.1.1
AS path: I, validation-state: unverified
> to 10.10.40.2 via ge-0/0/1.0, Push 17
2:1.1.1.1:210::210::00:0a:01:00:10:00::172.16.110.10/304
*[BGP/170] 00:14:56, localpref 100, from 1.1.1.1
AS path: I, validation-state: unverified
> to 10.10.40.2 via ge-0/0/1.0, Push 17
2:2.2.2.2:210::210::00:05:86:71:35:f0::172.16.110.100/304
*[EVPN/170] 18:28:01
Indirect
3:1.1.1.1:210::210::1.1.1.1/304
*[BGP/170] 00:14:56, localpref 100, from 1.1.1.1
AS path: I, validation-state: unverified
> to 10.10.40.2 via ge-0/0/1.0, Push 17
3:2.2.2.2:210::210::2.2.2.2/304
*[EVPN/170] 1w0d 17:52:07
Indirect
root@vMX02> show evpn database Instance: evpn210 VLAN MAC address Active source Timestamp IP address 210 00:05:86:71:35:f0 irb.110 Apr 25 15:23:07 172.16.110.100 210 00:05:86:71:6f:f0 1.1.1.1 Apr 26 10:23:12 172.16.110.101 210 00:0a:01:00:10:00 1.1.1.1 Apr 26 10:23:12 172.16.110.10 210 02:00:20:00:20:00 vtep.32771 Apr 26 10:15:14 172.16.110.50
root@vMX02> show bridge domain vxvlan_a extensive
Routing instance: evpn210
Bridge domain: vxvlan_a State: Active
Bridge VLAN ID: 210 EVPN extended: Yes
Interfaces:
pip-10.010010000000
vtep.32771
Total MAC count: 2
root@vMX02> show evpn instance evpn210 extensive
Instance: evpn210
Route Distinguisher: 2.2.2.2:210
Per-instance MAC route label: 300336
MAC database status Local Remote
Total MAC addresses: 2 2
Default gateway MAC addresses: 1 1
Number of local interfaces: 2 (2 up)
Interface name ESI Mode Status
vtep.32770 00:00:00:00:00:00:00:00:00:00 single-homed Up
vtep.32771 Up
Number of IRB interfaces: 1 (1 up)
Interface name VLAN ID Status L3 context
irb.110 210 Up master
Number of bridge domains: 1
VLAN ID Intfs / up Mode MAC sync IM route label
210 0 0 Extended Enabled 300384
Number of neighbors: 1
1.1.1.1
Received routes
MAC address advertisement: 2
MAC+IP address advertisement: 2
Inclusive multicast: 1
Ethernet auto-discovery: 0
Number of ethernet segments: 0
root@vMX02> show l2-learning vxlan-tunnel-end-point source
Logical System Name Id SVTEP-IP IFL L3-Idx
<default> 0 2.2.2.2 lo0.0 0
L2-RTT Bridge Domain VNID MC-Group-IP
evpn100 __evpn100__ 6666 239.100.100.100
evpn210 vxvlan_a+210 1100 239.110.110.110
root@vMX02> show l2-learning vxlan-tunnel-end-point remote
Logical System Name Id SVTEP-IP IFL L3-Idx
<default> 0 2.2.2.2 lo0.0 0
RVTEP-IP IFL-Idx NH-Id
10.10.20.1 347 1644
VNID MC-Group-IP
6666 239.100.100.100
RVTEP-IP IFL-Idx NH-Id
10.130.10.10 346 1591
VNID MC-Group-IP
1100 239.110.110.110
Cisco ASAv – vtep01
vtep01# ping 172.16.110.50 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.16.110.50, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/44/100 ms
vtep01# ping 172.16.110.100 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.16.110.100, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 10/16/30 ms
vtep01# ping 172.16.110.101 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.16.110.101, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/6/10 ms
vtep01# ping 172.16.110.10 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.16.110.10, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
vtep01# show arp
lan120 10.120.10.1 000c.2960.d9e1 221
vxvlan1100 172.16.110.100 0005.8671.35f0 580
vxvlan1100 172.16.110.101 0005.8671.6ff0 2633
vxvlan1100 172.16.110.50 0200.2000.2000 11991
vtep01# show nve 1
nve 1, source-interface "lan120" is up
IP address 10.120.10.10, subnet mask 255.255.255.0
Encapsulation: vxlan
Encapsulated traffic statistics:
2395 packets input, 172218 bytes
3178 packets output, 327966 bytes
0 packets dropped
Number of configured static peer VTEPs: 0
Number of discovered peer VTEPs: 1
Discovered peer VTEPs:
IP address 1.1.1.1
Number of VNIs attached to nve 1: 1
VNIs attached:
vni 1100: segment-id 1100, mcast-group 239.110.110.110
Cisco ASAv – vtep02
vtep02# ping 172.16.110.50 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.16.110.50, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
vtep02# ping 172.16.110.100 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.16.110.100, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/8/10 ms
vtep02# ping 172.16.110.101 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.16.110.101, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 10/22/50 ms
vtep02# ping 172.16.110.10 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.16.110.10, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/16/50 ms
vtep02# ping 172.16.110.10 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.16.110.10, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/16/50 ms
vtep02# show arp
vlan130 10.130.10.1 000c.29a6.9bf5 168
vxlan1100 172.16.110.100 0005.8671.35f0 533
vxlan1100 172.16.110.101 0005.8671.6ff0 2586
vxlan1100 172.16.110.10 000a.0100.1000 11944
vtep02# show nve 1
nve 1, source-interface "vlan130" is up
IP address 10.130.10.10, subnet mask 255.255.255.0
Encapsulation: vxlan
Encapsulated traffic statistics:
2906 packets input, 194732 bytes
2504 packets output, 271072 bytes
0 packets dropped
Number of configured static peer VTEPs: 0
Number of discovered peer VTEPs: 1
Discovered peer VTEPs:
IP address 2.2.2.2
Number of VNIs attached to nve 1: 1
VNIs attached:
vni 1100: segment-id 1100, mcast-group 239.110.110.110
Mam nadzieję, że komuś się przyda i gratuluję temu, kto dotarł do końca tego wpisu 🙂
