华为实验 | ENSP模拟VXLAN EVPN分布式网关
2023-06-13 09:17:25 时间
一、Ping网关不通
- 首先确认网关有没有ARP，有不通的话，将pc重启，或者将物理接口重新
undo shutdown。 - PC写了网关，如果配置没问题的情况下，能到网关地址，就算不通，正常应该是TIMEOUT超时。如果Ping回应是
destination host unreachable不可达，有可能是BUG，说明网关都找不到，重启PC，或者接入SW。
二、VXLAN隧道建立问题
- EVPN建立不起来，通常Underlay网关能起来，EVPN基本没问题，有问题检查Underlay
- EVPN建立起来学习不到IRB路由条目，查看Vbdif下是否开启arp collect host enable，这个命令作用是收集主机路由信息，EVPN会将这些信息以TYPE 2路由传递给对端。
三、CE L3GW学习到路由，跨子网能通，同子网不能通
这个问题我研究了很久，最终是在bd域下加了arp broadcast-suppress enable（ARP广播抑制）与arp l2-proxy gateway-mac （L2网关代答）功能才能通，因为配置手册是不用加的，然后我针对加与不加抓包进行对比发现：
- 不加：
192.168.1.1Ping192.168.1.2同网段，默认CE1收到BUM报文会找到对应L2 VNI的头端复制隧道列表，将广播报文发送到CE2，CE2收到后发现VNI是发给自己的，解封装把BUM报文发个192.168.1.2，回报同理，后续发包就为单播了，但抓包一直发送是ARP广播包，DMAC：全FFFF，对面没回复，不明白是不是BUG。 - 加ARP抑制，L2网关代答，这2条命令缺一不可，少一条都不通。
因为启用L2网关代答，DMAC是CE1网关的MAC地址，这样才通的，但我认为不需要也能通。
原因有两种情况：
- 第一：ARP抑制，代答都不启用，正常第一个包全FFFF，对端回应单播包，后续有MAC地址表就能正常转发。
- 第二：仅开启ARP抑制，第一个包为全FFFF，发送至网关，网关上有type2路由主机信息（MAC/IP/VTEP IP/VNI ID），所以会将广播转单播，直接发送到对端VTEP节点上，对端VTEP解封装找到自己MAC地址打上VLAN ID送到主机上了。
配置信息：
sysname CE1
#
device board 17 board-type CE-MPUB
device board 1 board-type CE-LPUE
#
evpn-overlay enable
#
ip vpn-instance a
ipv4-family
route-distinguisher 1:1
vpn-target 11:1 export-extcommunity evpn
vpn-target 11:1 import-extcommunity evpn
vxlan vni 10
#
bridge-domain 2
vxlan vni 2
evpn
route-distinguisher 1:1
vpn-target 10:1 export-extcommunity
vpn-target 11:1 export-extcommunity
vpn-target 10:1 import-extcommunity
arp broadcast-suppress enable
#
aaa
#
authentication-scheme default
#
authorization-scheme default
#
accounting-scheme default
#
domain default
#
domain default_admin
#
interface Vbdif2
ip binding vpn-instance a
ip address 192.168.1.254 255.255.255.0
arp distribute-gateway enable
arp collect host enable
#
interface MEth0/0/0
undo shutdown
#
interface GE1/0/0
undo shutdown
#
interface GE1/0/0.2 mode l2
encapsulation dot1q vid 2
bridge-domain 2
#
interface GE1/0/1
undo portswitch
undo shutdown
ip address 12.1.1.1 255.255.255.0
#
interface GE1/0/2
shutdown
#
interface GE1/0/3
shutdown
#
interface GE1/0/4
shutdown
#
interface GE1/0/5
shutdown
#
interface GE1/0/6
shutdown
#
interface GE1/0/7
shutdown
#
interface GE1/0/8
shutdown
#
interface GE1/0/9
shutdown
#
interface LoopBack0
ip address 1.1.1.1 255.255.255.255
#
interface Nve1
source 1.1.1.1
vni 2 head-end peer-list protocol bgp
#
interface NULL0
#
bgp 100
peer 2.2.2.2 as-number 100
peer 2.2.2.2 connect-interface LoopBack0
peer 12.1.1.2 as-number 100
#
ipv4-family unicast
network 1.1.1.1 255.255.255.255
peer 2.2.2.2 enable
peer 12.1.1.2 enable
#
l2vpn-family evpn
policy vpn-target
peer 2.2.2.2 enable
peer 2.2.2.2 advertise irb
sysname CE2
#
device board 17 board-type CE-MPUB
device board 1 board-type CE-LPUE
#
evpn-overlay enable
#
evpn
#
ip vpn-instance b
ipv4-family
route-distinguisher 2:2
vpn-target 11:1 export-extcommunity evpn
vpn-target 11:1 import-extcommunity evpn
vxlan vni 10
#
bridge-domain 2
vxlan vni 2
evpn
route-distinguisher 2:3
vpn-target 10:1 export-extcommunity
vpn-target 11:1 export-extcommunity
vpn-target 10:1 import-extcommunity
#
bridge-domain 3
vxlan vni 3
evpn
route-distinguisher 2:2
vpn-target 20:1 export-extcommunity
vpn-target 11:1 export-extcommunity
vpn-target 20:1 import-extcommunity
#
aaa
#
authentication-scheme default
#
authorization-scheme default
#
accounting-scheme default
#
domain default
#
domain default_admin
#
interface Vbdif2
ip binding vpn-instance b
ip address 192.168.1.254 255.255.255.0
arp distribute-gateway enable
arp collect host enable
#
interface Vbdif3
ip binding vpn-instance b
ip address 192.168.2.254 255.255.255.0
arp distribute-gateway enable
arp collect host enable
#
interface MEth0/0/0
undo shutdown
#
interface GE1/0/0
undo shutdown
#
interface GE1/0/0.2 mode l2
encapsulation dot1q vid 2
bridge-domain 2
#
interface GE1/0/0.3 mode l2
encapsulation dot1q vid 3
bridge-domain 3
#
interface GE1/0/1
undo portswitch
undo shutdown
ip address 12.1.1.2 255.255.255.0
#
interface GE1/0/2
shutdown
#
interface GE1/0/3
shutdown
#
interface GE1/0/4
shutdown
#
interface GE1/0/5
shutdown
#
interface GE1/0/6
shutdown
#
interface GE1/0/7
shutdown
#
interface GE1/0/8
shutdown
#
interface GE1/0/9
shutdown
#
interface LoopBack0
ip address 2.2.2.2 255.255.255.255
#
interface Nve1
source 2.2.2.2
vni 2 head-end peer-list protocol bgp
vni 3 head-end peer-list protocol bgp
#
interface NULL0
#
bgp 100
peer 1.1.1.1 as-number 100
peer 1.1.1.1 connect-interface LoopBack0
peer 12.1.1.1 as-number 100
#
ipv4-family unicast
network 2.2.2.2 255.255.255.255
peer 1.1.1.1 enable
peer 12.1.1.1 enable
#
l2vpn-family evpn
policy vpn-target
peer 1.1.1.1 enable
peer 1.1.1.1 advertise irb
#
ssh authorization-type default aaa
#
ssh server cipher aes256_gcm aes128_gcm aes256_ctr aes192_ctr aes128_ctr aes256_cbc aes128_cbc 3des_cbc
#
ssh server dh-exchange min-len 1024
#
ssh client cipher aes256_gcm aes128_gcm aes256_ctr aes192_ctr aes128_ctr aes256_cbc aes128_cbc 3des_cbc
#
user-interface con 0
查看信息：
[~CE1-bd2]dis ip rou vpn a
Proto: Protocol Pre: Preference
Route Flags: R - relay, D - download to fib, T - to vpn-instance, B - black hole route
------------------------------------------------------------------------------
Routing Table : a
Destinations : 6 Routes : 6
Destination/Mask Proto Pre Cost Flags NextHop Interface
192.168.1.0/24 Direct 0 0 D 192.168.1.254 Vbdif2
192.168.1.2/32 IBGP 255 0 RD 2.2.2.2 VXLAN
192.168.1.254/32 Direct 0 0 D 127.0.0.1 Vbdif2
192.168.1.255/32 Direct 0 0 D 127.0.0.1 Vbdif2
192.168.2.1/32 IBGP 255 0 RD 2.2.2.2 VXLAN
255.255.255.255/32 Direct 0 0 D 127.0.0.1 InLoopBack0
[~CE1-bd2]dis bgp evpn al rou ma
Local AS number : 100
BGP Local router ID is 12.1.1.1
Status codes: * - valid, > - best, d - damped, x - best external, a - add path,
h - history, i - internal, s - suppressed, S - Stale
Origin : i - IGP, e - EGP, ? - incomplete
EVPN address family:
Number of Mac Routes: 6
Route Distinguisher: 1:1
Network(EthTagId/MacAddrLen/MacAddr/IpAddrLen/IpAddr) NextHop
*> 0:48:5489-98fd-0378:32:192.168.1.1 0.0.0.0
*> 0:48:707b-e8ad-235d:0:0.0.0.0 0.0.0.0
Route Distinguisher: 2:2
Network(EthTagId/MacAddrLen/MacAddr/IpAddrLen/IpAddr) NextHop
*>i 0:48:5489-98bc-1b5e:32:192.168.2.1 2.2.2.2
*>i 0:48:707b-e837-2581:0:0.0.0.0 2.2.2.2
Route Distinguisher: 2:3
Network(EthTagId/MacAddrLen/MacAddr/IpAddrLen/IpAddr) NextHop
*>i 0:48:5489-98c4-6f7b:32:192.168.1.2 2.2.2.2
*>i 0:48:707b-e837-2581:0:0.0.0.0 2.2.2.2
EVPN-Instance 2:
Number of Mac Routes: 4
Network(EthTagId/MacAddrLen/MacAddr/IpAddrLen/IpAddr) NextHop
*>i 0:48:5489-98c4-6f7b:32:192.168.1.2 2.2.2.2
*> 0:48:5489-98fd-0378:32:192.168.1.1 0.0.0.0
*>i 0:48:707b-e837-2581:0:0.0.0.0 2.2.2.2
*> 0:48:707b-e8ad-235d:0:0.0.0.0 0.0.0.0
EVPN-Instance __RD_1_1_1__:
Number of Mac Routes: 2
Network(EthTagId/MacAddrLen/MacAddr/IpAddrLen/IpAddr) NextHop
*>i 0:48:5489-98bc-1b5e:32:192.168.2.1 2.2.2.2
*>i 0:48:5489-98c4-6f7b:32:192.168.1.2 2.2.2.2
[~CE1-bd2] dis vx pe
Number of peers : 1
Vni ID Source Destination Type Out Vni ID
-------------------------------------------------------------------------------
2 1.1.1.1 2.2.2.2 dynamic 2
[~CE1-bd2]dis vx tun
Number of vxlan tunnel : 1
Tunnel ID Source Destination State Type Uptime
-----------------------------------------------------------------------------------
4026531841 1.1.1.1 2.2.2.2 up dynamic 00:34:16
[~CE1-bd2]dis vx vn
Number of vxlan vni : 1
VNI BD-ID State
---------------------------------------
2 2 up
[~CE1-bd2]
[~CE2]dis bgp evpn al routing-table mac-route
Local AS number : 100
BGP Local router ID is 12.1.1.2
Status codes: * - valid, > - best, d - damped, x - best external, a - add path,
h - history, i - internal, s - suppressed, S - Stale
Origin : i - IGP, e - EGP, ? - incomplete
EVPN address family:
Number of Mac Routes: 6
Route Distinguisher: 1:1
Network(EthTagId/MacAddrLen/MacAddr/IpAddrLen/IpAddr) NextHop
*>i 0:48:5489-98fd-0378:32:192.168.1.1 1.1.1.1
*>i 0:48:707b-e8ad-235d:0:0.0.0.0 1.1.1.1
Route Distinguisher: 2:2
Network(EthTagId/MacAddrLen/MacAddr/IpAddrLen/IpAddr) NextHop
*> 0:48:5489-98bc-1b5e:32:192.168.2.1 0.0.0.0
*> 0:48:707b-e837-2581:0:0.0.0.0 0.0.0.0
Route Distinguisher: 2:3
Network(EthTagId/MacAddrLen/MacAddr/IpAddrLen/IpAddr) NextHop
*> 0:48:5489-98c4-6f7b:32:192.168.1.2 0.0.0.0
*> 0:48:707b-e837-2581:0:0.0.0.0 0.0.0.0
EVPN-Instance 2:
Number of Mac Routes: 4
Network(EthTagId/MacAddrLen/MacAddr/IpAddrLen/IpAddr) NextHop
*> 0:48:5489-98c4-6f7b:32:192.168.1.2 0.0.0.0
*>i 0:48:5489-98fd-0378:32:192.168.1.1 1.1.1.1
*> 0:48:707b-e837-2581:0:0.0.0.0 0.0.0.0
*>i 0:48:707b-e8ad-235d:0:0.0.0.0 1.1.1.1
EVPN-Instance 3:
Number of Mac Routes: 2
Network(EthTagId/MacAddrLen/MacAddr/IpAddrLen/IpAddr) NextHop
*> 0:48:5489-98bc-1b5e:32:192.168.2.1 0.0.0.0
*> 0:48:707b-e837-2581:0:0.0.0.0 0.0.0.0
EVPN-Instance __RD_1_2_2__:
Number of Mac Routes: 1
Network(EthTagId/MacAddrLen/MacAddr/IpAddrLen/IpAddr) NextHop
*>i 0:48:5489-98fd-0378:32:192.168.1.1 1.1.1.1
[~CE2]dis vx pe
Number of peers : 1
Vni ID Source Destination Type Out Vni ID
-------------------------------------------------------------------------------
2 2.2.2.2 1.1.1.1 dynamic 2
[~CE2]dis vx tu
Number of vxlan tunnel : 1
Tunnel ID Source Destination State Type Uptime
-----------------------------------------------------------------------------------
4026531841 2.2.2.2 1.1.1.1 up dynamic 00:34:52
[~CE2]
相关文章
- web前端面试题汇总_web前端面试题模拟
- VTN4系列多通道振弦模拟信号采集仪模拟通道值和振弦传感器温度通道值修正
- 手机手环nfc模拟加密门禁卡
- NOIP2022模拟赛二 By JTZ 10.18
- curl 模拟 GETPOST 请求，以及 curl post 上传文件「建议收藏」
- python模拟点击手机上的图片按钮详解编程语言
- Go语言RPC（模拟远程过程调用）
- 使用MySQL和PSASP进行模拟仿真分析（mysql_psasp）
- JS多个矩形块选择效果代码(模拟CS结构)
- PHPCURL模拟GET及POST函数代码
- js模拟权限选择实现代码(select操作)
- js模拟滚动条(横向竖向)
- jquery模拟LCD时钟的html文件源代码