在此页面上
如何使用 EVPN 多宿主配置园区网络
要求
此配置示例使用以下设备：
两台 EX4650 交换机或两台 QFX5120 交换机作为折叠式核心设备。软件版本：Junos OS 20.2R2 或更高版本
注意：EX4650 和 QFX5120 交换机相似，可以互换使用。
一台 EX2300、EX3400、EX4300 或 EX4400 交换机作为接入层。在您的网络中，这可以是瞻博网络交换机，也可以是第三方交换机。
概述
使用此网络配置示例，通过基于 3 层 IP 的底层网络部署单个园区交换矩阵，该底层网络使用 EVPN 作为控制平面协议，VXLAN 作为叠加网络中的数据平面协议。
您可以使用 BGP 或 OSPF 作为底层路由协议来交换环路路由。在此示例中，您将首先将 BGP 配置为底层路由协议。然后，您将在叠加网络的核心和分布设备之间配置 IBGP，以共享有关交换矩阵中端点的可访问性信息。
园区网络拓扑的典型塌缩核心如图 1 所示。在此示例中，您将配置此拓扑的子集。
图 1：采用 EVPN 多宿主的
塌陷核心园区
塌陷核心园区
拓扑
此示例中演示的方案涉及将三个虚拟网络联网的需要：（员工、来宾和 IoT 的“单独”网络）。这些虚拟网络的 IRB 接口位于核心交换机上。所有 IRB 接口都放置在同一个路由实例中。如果部署中需要，请将 IRB 接口放置在不同的路由实例中，以便进行网络分段。 图 2 显示了此示例中使用的拓扑和 IP 寻址方案。
图 2：园区网络 EVPN 多宿主拓扑
示例
示例
示例拓扑中的所有链路都是 1 个千兆以太网接口。在生产部署中，核心链路通常以 10 Gbps 或更高的速度运行，以确保不存在阻塞的可能性。
细节
在此 NCE 中，我们为三种不同类型的用户和设备（员工、访客和物联网设备）设计网络，这些用户和设备将通过有线和无线访问连接到网络。员工、访客和 IoT 设备映射到不同的虚拟网络和 VNI。 表 1 显示了此 NHE 的配置信息。
虚拟网络 |
有线网络 |
无线网络 |
VRF |
路由区分符 |
|---|---|---|---|---|
员工 |
IRB： 101 子网：192.168.101.3/24 |
IRB： 102 子网：192.168.102.3/24 |
JNPR_2_VRF |
102 |
客人 |
IRB： 201 子网：192.168.201.3/24 |
IRB： 202 子网：192.168.202.3/24 |
JNPR_1_VRF |
101 |
物联网设备 |
IRB： 301 子网：192.168.210.3/24 |
IRB： 302 子网：192.168.212.3/24 |
JNPR_3_VRF |
103 |
配置底层 IP 交换矩阵
要求
概述
本节说明如何使用 BGP 在折叠核心交换机上配置 IP 交换矩阵底层。
接口和底层配置
使用此部分配置折叠核心交换机上的底层网络。
本节介绍每个设备的分步配置过程。
折叠核心 1 配置
分步过程
配置连接到折叠核心交换机的接口。为避免网络中出现脑裂状态，我们建议在折叠的核心交换机之间配置至少两个链路，并配置从接入交换机到折叠核心交换机的多宿主。
set interfaces ge-0/0/46 unit 0 description "Connected to campus-tme-ex4650-2" set interfaces ge-0/0/46 unit 0 family inet address 192.168.100.5/31 set interfaces ge-0/0/46 mtu 9100
配置环路接口和路由器 ID，并启用按数据包的负载平衡。
set interfaces lo0 unit 0 family inet address 192.168.255.11/32 set routing-options router-id 192.168.255.11 set routing-options forwarding-table export ecmp_policy set policy-options policy-statement ecmp_policy then load-balance per-packet set policy-options policy-statement ecmp_policy then accept
配置 BGP 底层网络。
set policy-options policy-statement UNDERLAY-EXPORT term LOOPBACK from route-filter 192.168.255.0/24 orlonger set policy-options policy-statement UNDERLAY-EXPORT term LOOPBACK then accept set policy-options policy-statement UNDERLAY-EXPORT term DEFAULT then reject set policy-options policy-statement UNDERLAY-IMPORT term LOOPBACK from route-filter 192.168.255.0/24 orlonger set policy-options policy-statement UNDERLAY-IMPORT term LOOPBACK then accept set policy-options policy-statement UNDERLAY-IMPORT term DEFAULT then reject set protocols bgp bfd-liveness-detection minimum-interval 1000 set protocols bgp group UNDERLAY type external set protocols bgp group UNDERLAY description "EBGP UNDERLAY" set protocols bgp group UNDERLAY import UNDERLAY-IMPORT set protocols bgp group UNDERLAY family inet unicast set protocols bgp group UNDERLAY authentication-key “SecretKeyPhrase” set protocols bgp group UNDERLAY export UNDERLAY-EXPORT set protocols bgp group UNDERLAY local-as 65013 set protocols bgp group UNDERLAY multipath multiple-as set protocols bgp group UNDERLAY bfd-liveness-detection minimum-interval 350 set protocols bgp group UNDERLAY bfd-liveness-detection multiplier 3 set protocols bgp group UNDERLAY neighbor 192.168.100.4 peer-as 65012
折叠核心 2 配置
分步过程
配置连接到折叠核心设备的接口。为避免网络中出现脑裂状态，我们建议在折叠的核心交换机之间配置至少两个链路，并配置从接入交换机到折叠核心交换机的多宿主。
set interfaces ge-0/0/46 unit 0 description "Connected to campus-tme-ex4650-01" set interfaces ge-0/0/46 unit 0 family inet address 192.168.100.4/31 set interfaces ge-0/0/46 mtu 9100
配置环路接口和路由器 ID，并启用按数据包的负载平衡。
set interfaces lo0 unit 0 family inet address 192.168.255.12/32 set routing-options router-id 192.168.255.12 set policy-options policy-statement ecmp_policy then load-balance per-packet set policy-options policy-statement ecmp_policy then accept set routing-options forwarding-table export ecmp_policy
配置 BGP 底层网络。
set policy-options policy-statement UNDERLAY-EXPORT term LOOPBACK from route-filter 192.168.255.0/24 orlonger set policy-options policy-statement UNDERLAY-EXPORT term LOOPBACK then accept set policy-options policy-statement UNDERLAY-EXPORT term DEFAULT then reject set policy-options policy-statement UNDERLAY-IMPORT term LOOPBACK from route-filter 192.168.255.0/24 orlonger set policy-options policy-statement UNDERLAY-IMPORT term LOOPBACK then accept set policy-options policy-statement UNDERLAY-IMPORT term DEFAULT then reject set protocols bgp group UNDERLAY type external set protocols bgp group UNDERLAY description "Connection to EBGP UNDERLAY" set protocols bgp group UNDERLAY import UNDERLAY-IMPORT set protocols bgp group UNDERLAY family inet unicast set protocols bgp group UNDERLAY authentication-key “SecretKeyPhrase” set protocols bgp group UNDERLAY export UNDERLAY-EXPORT set protocols bgp group UNDERLAY local-as 65012 set protocols bgp group UNDERLAY multipath multiple-as set protocols bgp group UNDERLAY bfd-liveness-detection minimum-interval 350 set protocols bgp group UNDERLAY bfd-liveness-detection multiplier 3 set protocols bgp group UNDERLAY neighbor 192.168.100.5 peer-as 65013
配置叠加
要求
概述
本节介绍如何配置叠加网络。它包括 IBGP 对等互连、VLAN 到 VXLAN 映射以及虚拟网络的 IRB 接口配置。
叠加和虚拟网络配置
使用此部分可以在折叠的核心层交换机上配置叠加网络和虚拟网络。
本节介绍每个设备的分步配置过程。
折叠核心 1 配置
分步过程
配置从折叠核心交换机到核心交换机的 IBGP 邻接方。
set routing-options autonomous-system 65100 set protocols bgp group EVPN_FABRIC type internal set protocols bgp group EVPN_FABRIC description "OVERLAY Config" set protocols bgp group EVPN_FABRIC local-address 192.168.255.11 set protocols bgp group EVPN_FABRIC family evpn signaling set protocols bgp group EVPN_FABRIC authentication-key “SecretKeyPhrase” set protocols bgp group EVPN_FABRIC local-as 65100 set protocols bgp group EVPN_FABRIC multipath set protocols bgp group EVPN_FABRIC neighbor 192.168.255.12 set protocols evpn no-core-isolation
在折叠核心交换机上配置交换机选项。
set switch-options vtep-source-interface lo0.0 set switch-options route-distinguisher 192.168.255.11:1 set switch-options vrf-target target:999:999 set switch-options vrf-target auto
启用 VXLAN 封装。
set protocols evpn encapsulation vxlan set protocols evpn default-gateway no-gateway-community set protocols evpn extended-vni-list 5101 set protocols evpn extended-vni-list 5102 set protocols evpn extended-vni-list 5201 set protocols evpn extended-vni-list 5202 set protocols evpn extended-vni-list 5301 set protocols evpn extended-vni-list 5302
配置 VLAN 和 VXLAN 映射。
set vlans VLAN-101 description Employee-Wired-VLAN set vlans VLAN-101 vlan-id 101 set vlans VLAN-101 l3-interface irb.101 set vlans VLAN-101 vxlan vni 5101 set vlans VLAN-102 description Employee-Wireless-VLAN set vlans VLAN-102 vlan-id 102 set vlans VLAN-102 l3-interface irb.102 set vlans VLAN-102 vxlan vni 5102 set vlans VLAN-201 description Guest-Wired-VLAN set vlans VLAN-201 vlan-id 201 set vlans VLAN-201 l3-interface irb.201 set vlans VLAN-201 vxlan vni 5201 set vlans VLAN-202 description Guest-Wireless-VLAN set vlans VLAN-202 vlan-id 202 set vlans VLAN-202 l3-interface irb.202 set vlans VLAN-202 vxlan vni 5202 set vlans VLAN-301 description IOT-Wired-VLAN set vlans VLAN-301 vlan-id 301 set vlans VLAN-301 l3-interface irb.301 set vlans VLAN-301 vxlan vni 5301 set vlans VLAN-302 description IOT-Wireless-VLAN set vlans VLAN-302 vlan-id 302 set vlans VLAN-302 l3-interface irb.302 set vlans VLAN-302 vxlan vni 5302
为员工、访客和物联网设备 VLAN 配置 IRB 接口。
set interfaces irb unit 101 virtual-gateway-accept-data set interfaces irb unit 101 description Wired-Employee set interfaces irb unit 101 family inet address 192.168.101.3/24 virtual-gateway-address 192.168.101.1 set interfaces irb unit 102 virtual-gateway-accept-data set interfaces irb unit 102 description Wireless-Employee set interfaces irb unit 102 family inet address 192.168.102.3/24 virtual-gateway-address 192.168.102.1 set interfaces irb unit 201 virtual-gateway-accept-data set interfaces irb unit 201 description Guest-Wired-Subnet set interfaces irb unit 201 family inet address 192.168.201.3/24 virtual-gateway-address 192.168.201.1 set interfaces irb unit 202 virtual-gateway-accept-data set interfaces irb unit 202 description Guest-Wireless-Subnet set interfaces irb unit 202 family inet address 192.168.202.3/24 virtual-gateway-address 192.168.202.1 set interfaces irb unit 301 virtual-gateway-accept-data set interfaces irb unit 301 description Wired-IOT set interfaces irb unit 301 family inet address 192.168.210.3/24 virtual-gateway-address 192.168.210.1 set interfaces irb unit 302 virtual-gateway-accept-data set interfaces irb unit 302 description Wireless-IOT set interfaces irb unit 302 family inet address 192.168.212.3/24 virtual-gateway-address 192.168.212.1
配置 VRF 实例。
set routing-instances JNPR_1_VRF description "VRF for Guest Access" set routing-instances JNPR_1_VRF instance-type vrf set routing-instances JNPR_1_VRF interface irb.201 set routing-instances JNPR_1_VRF interface irb.202 set routing-instances JNPR_1_VRF route-distinguisher 192.168.255.11:101 set routing-instances JNPR_1_VRF vrf-target target:1:65001 set routing-instances JNPR_1_VRF vrf-table-label set routing-instances JNPR_1_VRF routing-options auto-export set routing-instances JNPR_2_VRF description "VRF for Employee Access" set routing-instances JNPR_2_VRF instance-type vrf set routing-instances JNPR_2_VRF interface irb.101 set routing-instances JNPR_2_VRF interface irb.102 set routing-instances JNPR_2_VRF route-distinguisher 192.168.255.11:102 set routing-instances JNPR_2_VRF vrf-target target:2:65001 set routing-instances JNPR_2_VRF vrf-table-label set routing-instances JNPR_3_VRF description "VRF for IOT Access" set routing-instances JNPR_3_VRF instance-type vrf set routing-instances JNPR_3_VRF interface irb.301 set routing-instances JNPR_3_VRF interface irb.302 set routing-instances JNPR_3_VRF route-distinguisher 192.168.255.11:103 set routing-instances JNPR_3_VRF vrf-target target:3:65001 set routing-instances JNPR_3_VRF vrf-table-label set routing-instances JNPR_3_VRF routing-options auto-export set routing-instances JNPR_2_VRF routing-options auto-export
（可选）启用 IGMP 侦听以限制 VLAN 上的 IPv4 组播流量泛洪。
set protocols igmp-snooping vlan VLAN-201 interface ae11.0 multicast-router-interface set protocols igmp-snooping vlan VLAN-202 interface ae11.0 multicast-router-interface set protocols igmp-snooping vlan VLAN-101 interface ae11.0 multicast-router-interface set protocols igmp-snooping vlan VLAN-102 interface ae11.0 multicast-router-interface set protocols igmp-snooping vlan VLAN-301 interface ae11.0 multicast-router-interface set protocols igmp-snooping vlan VLAN-301 interface ae11.0 multicast-router-interface
折叠核心 2 配置
分步过程
配置从折叠核心交换机到核心交换机的 IBGP 邻接方。
set routing-options autonomous-system 65100 set protocols bgp group EVPN_FABRIC type internal set protocols bgp group EVPN_FABRIC description "OVERLAY Config" set protocols bgp group EVPN_FABRIC local-address 192.168.255.12 set protocols bgp group EVPN_FABRIC family evpn signaling set protocols bgp group EVPN_FABRIC authentication-key “SecretKeyPhrase” set protocols bgp group EVPN_FABRIC local-as 65100 set protocols bgp group EVPN_FABRIC multipath set protocols bgp group EVPN_FABRIC neighbor 192.168.255.11 set protocols evpn no-core-isolation
在折叠核心交换机上配置交换机选项。
set switch-options vtep-source-interface lo0.0 set switch-options route-distinguisher 192.168.255.12:1 set switch-options vrf-target target:999:999 set switch-options vrf-target auto
启用 VXLAN 封装。
set protocols evpn encapsulation vxlan set protocols evpn extended-vni-list 5101 set protocols evpn extended-vni-list 5102 set protocols evpn extended-vni-list 5201 set protocols evpn extended-vni-list 5202 set protocols evpn extended-vni-list 5301 set protocols evpn extended-vni-list 5302
配置 VLAN 和 VXLAN 映射。
set vlans VLAN-101 description Employee-Wired-VLAN set vlans VLAN-101 vlan-id 101 set vlans VLAN-101 l3-interface irb.101 set vlans VLAN-101 vxlan vni 5101 set vlans VLAN-102 description Employee-Wireless-VLAN set vlans VLAN-102 vlan-id 102 set vlans VLAN-102 l3-interface irb.102 set vlans VLAN-102 vxlan vni 5102 set vlans VLAN-201 description "Guest Wired Subnet" set vlans VLAN-201 vlan-id 201 set vlans VLAN-201 l3-interface irb.201 set vlans VLAN-201 vxlan vni 5201 set vlans VLAN-202 description "Guest Wireless Subnet" set vlans VLAN-202 vlan-id 202 set vlans VLAN-202 l3-interface irb.202 set vlans VLAN-202 vxlan vni 5202 set vlans VLAN-301 description IOT-Wired-VLAN set vlans VLAN-301 vlan-id 301 set vlans VLAN-301 l3-interface irb.301 set vlans VLAN-301 vxlan vni 5301 set vlans VLAN-302 description IOT-Wireless-VLAN set vlans VLAN-302 vlan-id 302 set vlans VLAN-302 l3-interface irb.302 set vlans VLAN-302 vxlan vni 5302
为员工、访客和物联网设备 VLAN 配置 IRB 接口。
set interfaces irb unit 101 description "** Employee-Wired-Subnet" set interfaces irb unit 101 virtual-gateway-accept-data set interfaces irb unit 101 family inet address 192.168.101.2/24 virtual-gateway-address 192.168.101.1 set interfaces irb unit 102 virtual-gateway-accept-data set interfaces irb unit 102 family inet address 192.168.102.2/24 virtual-gateway-address 192.168.102.1 set interfaces irb unit 201 virtual-gateway-accept-data set interfaces irb unit 201 description "** L3 interface for VLAN-201 in jnpr_1" set interfaces irb unit 201 family inet address 192.168.201.2/24 virtual-gateway-address 192.168.201.1 set interfaces irb unit 202 virtual-gateway-accept-data set interfaces irb unit 202 description "** L3 interface for VLAN-202 in jnpr_1" set interfaces irb unit 202 family inet address 192.168.202.2/24 virtual-gateway-address 192.168.202.1 set interfaces irb unit 301 virtual-gateway-accept-data set interfaces irb unit 301 description Wired-IOT-Subnet set interfaces irb unit 301 family inet address 192.168.210.2/24 virtual-gateway-address 192.168.210.1 set interfaces irb unit 302 virtual-gateway-accept-data set interfaces irb unit 302 description Wireless-IOT-subnet set interfaces irb unit 302 family inet address 192.168.212.2/24 virtual-gateway-address 192.168.212.1
配置 VRF 实例。
set routing-instances JNPR_1_VRF description "VRF for Guest Access" set routing-instances JNPR_1_VRF instance-type vrf set routing-instances JNPR_1_VRF interface irb.201 set routing-instances JNPR_1_VRF interface irb.202 set routing-instances JNPR_1_VRF route-distinguisher 192.168.255.12:101 set routing-instances JNPR_1_VRF vrf-target target:1:65001 set routing-instances JNPR_1_VRF vrf-table-label set routing-instances JNPR_1_VRF routing-options auto-export set routing-instances JNPR_2_VRF description "VRF for Employee Access" set routing-instances JNPR_2_VRF instance-type vrf set routing-instances JNPR_2_VRF interface irb.101 set routing-instances JNPR_2_VRF interface irb.102 set routing-instances JNPR_2_VRF route-distinguisher 192.168.255.12:102 set routing-instances JNPR_2_VRF vrf-target target:2:65001 set routing-instances JNPR_2_VRF vrf-table-label set routing-instances JNPR_2_VRF routing-options auto-export set routing-instances JNPR_3_VRF description "VRF for IOT Access" set routing-instances JNPR_3_VRF instance-type vrf set routing-instances JNPR_3_VRF interface irb.301 set routing-instances JNPR_3_VRF interface irb.302 set routing-instances JNPR_3_VRF route-distinguisher 192.168.255.12:103 set routing-instances JNPR_3_VRF vrf-target target:3:65001 set routing-instances JNPR_3_VRF vrf-table-label set routing-instances JNPR_3_VRF routing-options auto-export
（可选）启用 IGMP 侦听以限制 VLAN 上的 IPv4 组播流量泛洪。
set protocols igmp-snooping vlan VLAN-201 interface ae11.0 multicast-router-interface set protocols igmp-snooping vlan VLAN-202 interface ae11.0 multicast-router-interface set protocols igmp-snooping vlan VLAN-101 interface ae11.0 multicast-router-interface set protocols igmp-snooping vlan VLAN-102 interface ae11.0 multicast-router-interface set protocols igmp-snooping vlan VLAN-301 interface ae11.0 multicast-router-interface set protocols igmp-snooping vlan VLAN-301 interface ae11.0 multicast-router-interface
配置接入层交换机和折叠核心交换机之间的多宿主
要求
概述
本节说明了从接入层交换机到折叠核心层交换机的多宿主上行链路接口所需的配置。使用此示例将同一聚合以太网接口中的多宿主接入层上行链路接口配置为多个折叠核心交换机。
配置 EVPN 多宿主时，使用相同的 ESI 值在连接到同一接入交换机的不同折叠核心交换机接口上配置多宿主分段。ESI 值编码为 10 字节整数，用于标识多宿主段。我们建议使用的 ESI 值对前 8 个字节使用相同的值，并且仅更改每个 EVPN LAG 的第 9 个和第 10 个字节。
拓扑
接入层支持 VLAN 的第 2 层。接入层的上行链路是配置为中继端口的聚合以太网链路束或 LAG，用于将 VLAN 从接入层交换机传送到折叠核心层交换机。
有关一个接入层交换机与折叠核心 1 交换机之间连接的物理拓扑的详细信息，请参阅 图 2 。
配置
使用此示例为 EVPN 多宿主和接入层交换机配置折叠核心层。
本节介绍每个设备的分步配置过程。
折叠核心 1 配置
分步过程
指定要包含在聚合以太网捆绑包中的成员。
set interfaces ge-0/0/3 description "Connected to campus-tme-ex4300-01" set interfaces ge-0/0/3 ether-options 802.3ad ae11
配置聚合以太网接口，包括以太网分段标识符 （ESI），用于将此交换机上的多宿主接口分配给以太网分段。不同多宿主接口上的 ESI 值必须相同。
set chassis aggregated-devices ethernet device-count 1 set interfaces ae11 description To-Access-1 set interfaces ae11 mtu 9200 set interfaces ae11 esi 00:11:11:11:11:11:11:11:11:01 set interfaces ae11 esi all-active set interfaces ae11 aggregated-ether-options lacp active set interfaces ae11 aggregated-ether-options lacp periodic fast set interfaces ae11 aggregated-ether-options lacp system-id 00:40:00:00:00:01 set interfaces ae11 unit 0 family ethernet-switching interface-mode trunk set interfaces ae11 unit 0 family ethernet-switching vlan members VLAN-201 set interfaces ae11 unit 0 family ethernet-switching vlan members VLAN-202 set interfaces ae11 unit 0 family ethernet-switching vlan members VLAN-101 set interfaces ae11 unit 0 family ethernet-switching vlan members VLAN-102 set interfaces ae11 unit 0 family ethernet-switching vlan members VLAN-301 set interfaces ae11 unit 0 family ethernet-switching vlan members VLAN-302
折叠核心 2 配置
分步过程
指定要包含在聚合以太网捆绑包中的成员。
set interfaces ge-0/0/6 description "Connected to campus-tme-ex2300-01" set interfaces ge-0/0/6 ether-options 802.3ad ae11
配置聚合以太网接口，包括以太网分段标识符 （ESI），用于将此交换机上的多宿主接口分配给以太网分段。不同多宿主接口上的 ESI 值必须相同。
set chassis aggregated-devices ethernet device-count 1 set interfaces ae11 description To-Access-1 set interfaces ae11 mtu 9200 set interfaces ae11 esi 00:11:11:11:11:11:11:11:11:01 set interfaces ae11 esi all-active set interfaces ae11 aggregated-ether-options lacp active set interfaces ae11 aggregated-ether-options lacp periodic fast set interfaces ae11 aggregated-ether-options lacp system-id 00:40:00:00:00:01 set interfaces ae11 unit 0 family ethernet-switching interface-mode trunk set interfaces ae11 unit 0 family ethernet-switching vlan members VLAN-201 set interfaces ae11 unit 0 family ethernet-switching vlan members VLAN-202 set interfaces ae11 unit 0 family ethernet-switching vlan members VLAN-101 set interfaces ae11 unit 0 family ethernet-switching vlan members VLAN-102 set interfaces ae11 unit 0 family ethernet-switching vlan members VLAN-301 set interfaces ae11 unit 0 family ethernet-switching vlan members VLAN-302
接入交换机配置
分步过程
指定要包含在聚合以太网捆绑包中的成员。
set interfaces ge-0/0/1 description "to Campus-tme--ex4650-01" set interfaces ge-0/0/1 ether-options 802.3ad ae11 set interfaces ge-0/0/2 description "To Campus-tme-ex4650-02" set interfaces ge-0/0/2 ether-options 802.3ad ae11
配置聚合以太网接口。
set chassis aggregated-devices ethernet device-count 1 set interfaces ae11 aggregated-ether-options lacp active set interfaces ae11 aggregated-ether-options lacp periodic fast set interfaces ae11 unit 0 family ethernet-switching interface-mode trunk set interfaces ae11 unit 0 family ethernet-switching vlan members 101-102 set interfaces ae11 unit 0 family ethernet-switching vlan members 201-202 set interfaces ae11 unit 0 family ethernet-switching vlan members 301-302
配置 VLAN。
set vlans VLAN-201 vlan-id 201 set vlans VLAN-101 vlan-id 101 set vlans VLAN-102 vlan-id 102 set vlans VLAN-201 vlan-id 201 set vlans VLAN-202 vlan-id 202 set vlans VLAN-301 vlan-id 301 set vlans VLAN-302 vlan-id 302
您现在已经将上行链路接口从接入层交换机多宿主到折叠的核心设备。
如果网络中有多个接入层交换机，请对每台交换机重复此配置过程。
注意：
有关为 PoE 配置端口、为接入点配置中继端口以及配置 802.1X 的详细信息，请参阅 如何配置 SRX 路由器。
验证
要求
概述
在本节中，您将验证 EVPN MC LAG 示例的正确操作。登录到每台设备并验证是否已配置 EVPN-VXLAN 交换矩阵。
验证
- 折叠核心 1：验证 BGP 会话
- 折叠核心 2：验证 BGP 会话
- 折叠核心 1：验证 EVPN 数据库信息
- 折叠核心 2：验证 EVPN 数据库信息
- 折叠核心 1：验证本地交换表信息
- 折叠核心 2：验证本地交换表信息
- 折叠核心1：验证多宿主以太网段
- 折叠核心 2：验证多宿主以太网段
折叠核心 1：验证 BGP 会话
目的
验证与核心设备的 BGP 会话的状态。
行动
验证折叠核心 1 IBGP 会话是否使用核心设备的环路建立，这些设备具有 IP 地址 192.168.0.4 和 192.168.0.5。
user@campus-tme-ex4650-01> show bgp summary
Threading mode: BGP I/O
Default eBGP mode: advertise - accept, receive - accept
Groups: 2 Peers: 2 Down peers: 0
Table Tot Paths Act Paths Suppressed History Damp State Pending
inet.0
1 1 0 0 0 0
bgp.evpn.0
39 39 0 0 0 0
Peer AS InPkt OutPkt OutQ Flaps Last Up/Dwn State|#Active/Received/Accepted/Damped...
192.168.100.4 65012 54 53 0 0 22:51 Establ
inet.0: 1/1/1/0
192.168.255.12 65100 177 167 0 0 22:49 Establ
bgp.evpn.0: 39/39/39/0
default-switch.evpn.0: 38/38/38/0
__default_evpn__.evpn.0: 1/1/1/0
意义
IBGP 会话是使用 MP-IBGP 与核心设备的环路建立的，叠加层中有 EVPN 信令，以实现 EVPN 路由的交换。
折叠核心 2：验证 BGP 会话
目的
验证与折叠核心 2 的 BGP 会话的状态。
行动
验证是否已与核心设备建立 BGP 会话。核心设备的IP地址为192.168.0.4和192.168.0.5。
user@campus-tme-ex4650-02> show bgp summary
Threading mode: BGP I/O
Default eBGP mode: advertise - accept, receive - accept
Groups: 2 Peers: 2 Down peers: 0
Table Tot Paths Act Paths Suppressed History Damp State Pending
inet.0
1 1 0 0 0 0
bgp.evpn.0
39 39 0 0 0 0
Peer AS InPkt OutPkt OutQ Flaps Last Up/Dwn State|#Active/Received/Accepted/Damped...
192.168.100.5 65013 62 61 0 0 26:45 Establ
inet.0: 1/1/1/0
192.168.255.11 65100 176 185 0 0 26:43 Establ
bgp.evpn.0: 39/39/39/0
default-switch.evpn.0: 38/38/38/0
__default_evpn__.evpn.0: 1/1/1/0
意义
IBGP 会话是使用 MP-IBGP 与核心设备的环路建立的，叠加层中有 EVPN 信令，以实现 EVPN 路由的交换。
折叠核心 1：验证 EVPN 数据库信息
目的
验证是否已正确填充 EVPN 数据库。
行动
验证 EVPN 数据库是否正在为本地连接的主机安装 MAC 地址信息，以及是否正在从其他叶设备接收包含远程主机相关信息的播发。
user@campus-tme-ex4650-01> show evpn database
Instance: default-switch
VLAN DomainId MAC address Active source Timestamp IP address
5101 00:00:5e:00:01:01 05:00:00:fe:4c:00:00:13:ed:00 Aug 19 10:21:46 192.168.101.1
5101 02:05:86:71:5d:00 irb.101 Aug 19 10:21:46 192.168.101.3
5101 02:05:86:71:8d:00 192.168.255.12 Aug 19 10:21:46 192.168.101.2
5102 00:00:5e:00:01:01 05:00:00:fe:4c:00:00:13:ee:00 Aug 19 10:21:46 192.168.102.1
5102 02:05:86:71:5d:00 irb.102 Aug 19 10:21:46 192.168.102.3
5102 02:05:86:71:8d:00 192.168.255.12 Aug 19 10:21:46 192.168.102.2
5201 00:00:5e:00:01:01 05:00:00:fe:4c:00:00:14:51:00 Aug 19 10:21:46 192.168.201.1
5201 02:05:86:71:5d:00 irb.201 Aug 19 10:21:46 192.168.201.3
5201 02:05:86:71:8d:00 192.168.255.12 Aug 19 10:21:46 192.168.201.2
5202 00:00:5e:00:01:01 05:00:00:fe:4c:00:00:14:52:00 Aug 19 10:21:46 192.168.202.1
5202 02:05:86:71:5d:00 irb.202 Aug 19 10:21:46 192.168.202.3
5202 02:05:86:71:8d:00 192.168.255.12 Aug 19 10:21:46 192.168.202.2
5301 00:00:5e:00:01:01 05:00:00:fe:4c:00:00:14:b5:00 Aug 19 10:22:35 192.168.210.1
5301 02:05:86:71:5d:00 irb.301 Aug 19 10:21:46 192.168.210.3
5301 02:05:86:71:8d:00 192.168.255.12 Aug 19 10:22:35 192.168.210.2
5302 00:00:5e:00:01:01 05:00:00:fe:4c:00:00:14:b6:00 Aug 19 10:21:46 192.168.212.1
5302 02:05:86:71:5d:00 irb.302 Aug 19 10:21:46 192.168.212.3
5302 02:05:86:71:8d:00 192.168.255.12 Aug 19 10:22:35 192.168.212.2
意义
上述输出确认 EVPN 数据库正在正确学习并为所有端点安装 MAC 路由。它还显示了 MAC 地址与其关联的 VNI 之间的关系：5101、5102、5201、5202、5301 和 5302。
折叠核心 2：验证 EVPN 数据库信息
目的
验证是否已正确填充 EVPN 数据库。
行动
验证 EVPN 数据库是否正在为本地连接的主机安装 MAC 地址信息，并从其他叶设备接收包含有关远程主机信息的播发。
user@campus-tme-ex4650-02> show evpn database
Instance: default-switch
VLAN DomainId MAC address Active source Timestamp IP address
5101 00:00:5e:00:01:01 05:00:00:fe:4c:00:00:13:ed:00 Aug 19 10:21:46 192.168.101.1
5101 02:05:86:71:5d:00 irb.101 Aug 19 10:21:46 192.168.101.3
5101 02:05:86:71:8d:00 192.168.255.12 Aug 19 10:21:46 192.168.101.2
5102 00:00:5e:00:01:01 05:00:00:fe:4c:00:00:13:ee:00 Aug 19 10:21:46 192.168.102.1
5102 02:05:86:71:5d:00 irb.102 Aug 19 10:21:46 192.168.102.3
5102 02:05:86:71:8d:00 192.168.255.12 Aug 19 10:21:46 192.168.102.2
5201 00:00:5e:00:01:01 05:00:00:fe:4c:00:00:14:51:00 Aug 19 10:21:46 192.168.201.1
5201 02:05:86:71:5d:00 irb.201 Aug 19 10:21:46 192.168.201.3
5201 02:05:86:71:8d:00 192.168.255.12 Aug 19 10:21:46 192.168.201.2
5202 00:00:5e:00:01:01 05:00:00:fe:4c:00:00:14:52:00 Aug 19 10:21:46 192.168.202.1
5202 02:05:86:71:5d:00 irb.202 Aug 19 10:21:46 192.168.202.3
5202 02:05:86:71:8d:00 192.168.255.12 Aug 19 10:21:46 192.168.202.2
5301 00:00:5e:00:01:01 05:00:00:fe:4c:00:00:14:b5:00 Aug 19 10:22:35 192.168.210.1
5301 02:05:86:71:5d:00 irb.301 Aug 19 10:21:46 192.168.210.3
5301 02:05:86:71:8d:00 192.168.255.12 Aug 19 10:22:35 192.168.210.2
5302 00:00:5e:00:01:01 05:00:00:fe:4c:00:00:14:b6:00 Aug 19 10:21:46 192.168.212.1
5302 02:05:86:71:5d:00 irb.302 Aug 19 10:21:46 192.168.212.3
5302 02:05:86:71:8d:00 192.168.255.12 Aug 19 10:22:35 192.168.212.2
意义
上述输出确认 EVPN 数据库正在正确学习并为所有端点安装 MAC 路由。它还显示了 MAC 地址与其关联的 VNI 之间的关系：5101、5102、5201、5202、5301 和 5302。
折叠核心 1：验证本地交换表信息
目的
验证是否已正确填充本地交换表。
行动
验证本地交换表是否正在为本地连接的主机安装 MAC 地址信息，以及是否正在从其他叶设备接收包含远程主机相关信息的播发。
user@campus-tme-ex4650-01> show ethernet-switching table
MAC flags (S - static MAC, D - dynamic MAC, L - locally learned, P - Persistent static
SE - statistics enabled, NM - non configured MAC, R - remote PE MAC, O - ovsdb MAC)
Ethernet switching table : 12 entries, 12 learned
Routing instance : default-switch
Vlan MAC MAC Logical SVLBNH/ Active
name address flags interface VENH Index source
VLAN-101 00:00:5e:00:01:01 DR esi.1734 05:00:00:fe:4c:00:00:13:ed:00
VLAN-101 02:05:86:71:8d:00 D vtep.32769 192.168.255.12
VLAN-102 00:00:5e:00:01:01 DR esi.1739 05:00:00:fe:4c:00:00:13:ee:00
VLAN-102 02:05:86:71:8d:00 D vtep.32769 192.168.255.12
VLAN-201 00:00:5e:00:01:01 DR esi.1735 05:00:00:fe:4c:00:00:14:51:00
VLAN-201 02:05:86:71:8d:00 D vtep.32769 192.168.255.12
VLAN-202 00:00:5e:00:01:01 DR esi.1736 05:00:00:fe:4c:00:00:14:52:00
VLAN-202 02:05:86:71:8d:00 D vtep.32769 192.168.255.12
VLAN-301 00:00:5e:00:01:01 DR esi.1737 05:00:00:fe:4c:00:00:14:b5:00
VLAN-301 02:05:86:71:8d:00 D vtep.32769 192.168.255.12
VLAN-302 00:00:5e:00:01:01 DR esi.1738 05:00:00:fe:4c:00:00:14:b6:00
VLAN-302 02:05:86:71:8d:00 D vtep.32769 192.168.255.12
意义
上述输出确认本地交换表正在正确学习并安装所有端点的 MAC 地址。它还显示了 MAC 地址、它们关联的 VLAN（在本例中为 VLAN 101、102、201、202、301 和 302）及其下一跃点接口之间的关系。
折叠核心 2：验证本地交换表信息
目的
验证是否已正确填充本地交换表。
行动
验证本地交换表是否正在为本地连接的主机安装 MAC 地址信息，以及是否正在从其他叶设备接收包含远程主机相关信息的播发。
user@campus-tme-ex4650-02> show ethernet-switching table
MAC flags (S - static MAC, D - dynamic MAC, L - locally learned, P - Persistent static
SE - statistics enabled, NM - non configured MAC, R - remote PE MAC, O - ovsdb MAC)
Ethernet switching table : 12 entries, 12 learned
Routing instance : default-switch
Vlan MAC MAC Logical SVLBNH/ Active
name address flags interface VENH Index source
VLAN-101 00:00:5e:00:01:01 DR esi.1878 05:00:00:fe:4c:00:00:13:ed:00
VLAN-101 02:05:86:71:5d:00 D vtep.32769 192.168.255.11
VLAN-102 00:00:5e:00:01:01 DR esi.1958 05:00:00:fe:4c:00:00:13:ee:00
VLAN-102 02:05:86:71:5d:00 D vtep.32769 192.168.255.11
VLAN-201 00:00:5e:00:01:01 DR esi.1960 05:00:00:fe:4c:00:00:14:51:00
VLAN-201 02:05:86:71:5d:00 D vtep.32769 192.168.255.11
VLAN-202 00:00:5e:00:01:01 DR esi.1959 05:00:00:fe:4c:00:00:14:52:00
VLAN-202 02:05:86:71:5d:00 D vtep.32769 192.168.255.11
VLAN-301 00:00:5e:00:01:01 DR esi.1860 05:00:00:fe:4c:00:00:14:b5:00
VLAN-301 02:05:86:71:5d:00 D vtep.32769 192.168.255.11
VLAN-302 00:00:5e:00:01:01 DR esi.1957 05:00:00:fe:4c:00:00:14:b6:00
VLAN-302 02:05:86:71:5d:00 D vtep.32769 192.168.255.11
意义
上述输出确认本地交换表正在正确学习并安装所有端点的 MAC 地址。它还显示了 MAC 地址、它们关联的 VLAN（在本例中为 VLAN 101、102、201、202、301 和 302）及其下一跃点接口之间的关系。
折叠核心1：验证多宿主以太网段
目的
检查从接入交换机 1 到折叠核心设备的多宿主连接。
行动
验证属于以太网段的本地接口、属于同一以太网段的其他折叠核心设备、属于以太网段的桥接域以及以太网段的指定转发器。
user@campus-tme-ex4650-01> show evpn instance esi 00:11:11:11:11:11:11:11:11:01 extensive
Instance: default-switch
Route Distinguisher: 192.168.255.11:1
Encapsulation type: VXLAN
Duplicate MAC detection threshold: 5
Duplicate MAC detection window: 180
MAC database status Local Remote
MAC advertisements: 6 12
MAC+IP advertisements: 12 12
Default gateway MAC advertisements: 12 6
Number of local interfaces: 2 (2 up)
Interface name ESI Mode Status AC-Role
.local..3 00:00:00:00:00:00:00:00:00:00 single-homed Up Root
ae11.0 00:11:11:11:11:11:11:11:11:01 all-active Up Root
Number of IRB interfaces: 6 (6 up)
Interface name VLAN VNI Status L3 context
irb.101 5101 Up JNPR_2_VRF
irb.102 5102 Up JNPR_2_VRF
irb.201 5201 Up JNPR_1_VRF
irb.202 5202 Up JNPR_1_VRF
irb.301 5301 Up JNPR_3_VRF
irb.302 5302 Up JNPR_3_VRF
Number of protect interfaces: 0
Number of bridge domains: 6
VLAN Domain-ID Intfs/up IRB-intf Mode MAC-sync IM-label v4-SG-sync IM-core-NH v6-SG-sync IM-core-NH Trans-ID
101 5101 1 1 irb.101 Extended Enabled 5101 Enabled 131134 Disabled 5101
102 5102 1 1 irb.102 Extended Enabled 5102 Enabled 131130 Disabled 5102
201 5201 1 1 irb.201 Extended Enabled 5201 Enabled 131142 Disabled 5201
202 5202 1 1 irb.202 Extended Enabled 5202 Enabled 131138 Disabled 5202
301 5301 1 1 irb.301 Extended Enabled 5301 Enabled 131126 Disabled 5301
302 5302 1 1 irb.302 Extended Enabled 5302 Enabled 131122 Disabled 5302
Number of neighbors: 1
Address MAC MAC+IP AD IM ES Leaf-label Remote-DCI-Peer
192.168.255.12 12 12 8 6 0
Number of ethernet segments: 7
ESI: 00:11:11:11:11:11:11:11:11:01
Status: Resolved by IFL ae11.0
Local interface: ae11.0, Status: Up/Forwarding
Number of remote PEs connected: 1
Remote-PE MAC-label Aliasing-label Mode
192.168.255.12 0 0 all-active
DF Election Algorithm: MOD based
Designated forwarder: 192.168.255.12
Backup forwarder: 192.168.255.11
Last designated forwarder update: Aug 19 10:21:50
Router-ID: 192.168.255.11
SMET Forwarding: Enabled: Nexthop Limit: 10000 Nexthop Usage: 1
意义
接口 ae11.0 是此以太网段的一部分。虚拟网络（员工、访客和 IoT）是此以太网段的一部分。参与此以太网段的远程 PE 或折叠式核心设备为 192.168.255.12。
折叠核心 2：验证多宿主以太网段
目的
检查从接入交换机 1 到折叠核心的多宿主连接。
行动
验证属于以太网段的本地接口、属于同一以太网段的其他折叠核心设备、属于以太网段的桥接域以及以太网段的指定转发器。
user@campus-tme-ex4650-02> show evpn instance esi 00:11:11:11:11:11:11:11:11:01 extensive
Instance: default-switch
Route Distinguisher: 192.168.255.12:1
Encapsulation type: VXLAN
Duplicate MAC detection threshold: 5
Duplicate MAC detection window: 180
MAC database status Local Remote
MAC advertisements: 6 12
MAC+IP advertisements: 12 12
Default gateway MAC advertisements: 12 0
Number of local interfaces: 2 (2 up)
Interface name ESI Mode Status AC-Role
.local..3 00:00:00:00:00:00:00:00:00:00 single-homed Up Root
ae11.0 00:11:11:11:11:11:11:11:11:01 all-active Up Root
Number of IRB interfaces: 6 (6 up)
Interface name VLAN VNI Status L3 context
irb.101 5101 Up JNPR_2_VRF
irb.102 5102 Up JNPR_2_VRF
irb.201 5201 Up JNPR_1_VRF
irb.202 5202 Up JNPR_1_VRF
irb.301 5301 Up JNPR_3_VRF
irb.302 5302 Up JNPR_3_VRF
Number of protect interfaces: 0
Number of bridge domains: 6
VLAN Domain-ID Intfs/up IRB-intf Mode MAC-sync IM-label v4-SG-sync IM-core-NH v6-SG-sync IM-core-NH Trans-ID
101 5101 1 1 irb.101 Extended Enabled 5101 Enabled 131088 Disabled 5101
102 5102 1 1 irb.102 Extended Enabled 5102 Enabled 131084 Disabled 5102
201 5201 1 1 irb.201 Extended Enabled 5201 Enabled 131076 Disabled 5201
202 5202 1 1 irb.202 Extended Enabled 5202 Enabled 131072 Disabled 5202
301 5301 1 1 irb.301 Extended Enabled 5301 Enabled 131080 Disabled 5301
302 5302 1 1 irb.302 Extended Enabled 5302 Enabled 131093 Disabled 5302
Number of neighbors: 1
Address MAC MAC+IP AD IM ES Leaf-label Remote-DCI-Peer
192.168.255.11 12 12 8 6 0
Number of ethernet segments: 7
ESI: 00:11:11:11:11:11:11:11:11:01
Status: Resolved by IFL ae11.0
Local interface: ae11.0, Status: Up/Forwarding
Number of remote PEs connected: 1
Remote-PE MAC-label Aliasing-label Mode
192.168.255.11 0 0 all-active
DF Election Algorithm: MOD based
Designated forwarder: 192.168.255.12
Backup forwarder: 192.168.255.11
Last designated forwarder update: Aug 19 10:21:50
Router-ID: 192.168.255.12
SMET Forwarding: Enabled: Nexthop Limit: 10000 Nexthop Usage: 1
意义
接口 ae11.0 是此以太网段的一部分。虚拟网络 1、2 和 3 是此以太网段的一部分。参与此以太网段的远程 PE 或折叠核心设备为 192.168.255.11。