在此页面上
配置可选加载项
本节介绍如何配置以下功能,这些功能是具有 EVPN 多宿主园区网络的折叠核心的可选加载项。
如何配置 DHCP
要求
在 如何使用 EVPN 多宿主 配置配置示例中配置的以下设备上配置 DHCP:
两台 EX4650 或 QFX5120 交换机作为折叠核心设备。软件版本:Junos OS 20.2R2 或更高版本。
外部 DHCP 服务器。
概述
使用此部分可以在网络上配置 DHCP。为避免 DHCP 发现数据包淹没网络,请在 VRF 路由实例中的接口上配置 DHCP。折叠的核心设备充当第 3 层可访问外部 DHCP 服务器的 DHCP 中继。
配置
程序
分步过程
将折叠的核心设备配置为仅充当 DHCP 中继。它不会维护绑定表。
set routing-instances JNPR_1_VRF forwarding-options dhcp-relay forward-only
创建服务器组并指定 DHCP 服务器的 IP 地址。
set routing-instances JNPR_1_VRF forwarding-options dhcp-relay server-group server_group_1 192.168.192.1
将新服务器组指定为活动服务器组。
set routing-instances JNPR_1_VRF forwarding-options dhcp-relay group dhcp_relay_1 active-server-group server_group_1
在 JDHCPD 进程的客户端绑定期间禁止安装访问、访问内部或目标路由。
set routing-instances JNPR_1_VRF forwarding-options dhcp-relay group dhcp_relay_1 route-suppression destination
对于所有类型的 DHCP 消息,始终将广播位设置为 1。如果不配置此选项,某些客户端会在发送消息之前将该位设置为零,这是不可取的。
set routing-instances JNPR_1_VRF forwarding-options dhcp-relay group dhcp_relay_1 overrides no-unicast-replies
配置 IRB 以连接到相关的 VLAN 和子网,并向这些客户端提供 DHCP 服务。
set routing-instances JNPR_1_VRF forwarding-options dhcp-relay group Relay_Group1 interface irb.201 set routing-instances JNPR_1_VRF forwarding-options dhcp-relay group Relay_Group1 interface irb.202
注意:在此步骤中,您可以包括属于路由实例的任何 IRB。
您需要在网络中的所有折叠核心设备上重复此配置。
如何配置 SRX 路由器
配置
CLI 快速配置
在此示例配置中,SRX 用于将用户流量从 Mist 接入点路由到互联网。 图 1 显示了折叠的核心网络以及 SRX 路由器。此示例使用以下配置设置:
-
VLAN 126 用于将流量从折叠核心转发到 SRX 和互联网。
-
VLAN 125 用于发送管理流量,用于 Mist 接入点的云注册和操作。
-
VLAN 125 在连接接入点的中继端口中也被标记为本机 VLAN
-
将 server_group_1 192.168.192.1 指定为 DHCP 服务器。
有关在 SRX 路由器上配置 VRF 间路由的详细信息,请参阅 SRX 配置

SRX 配置
在 SRX 路由器上配置以下设置。
set security zones security-zone trust interfaces irb.126 set interfaces irb unit 126 family inet address 192.168.3.1/24 set vlans mgmt1 l3-interface irb.126 set interfaces ae1 unit 0 family ethernet-switching interface-mode trunk set interfaces ae1 unit 0 family ethernet-switching vlan members mgmt1 set interfaces ge-0/0/4 unit 0 family inet address 10.204.37.175/20 set security nat source rule-set trust-to-untrust from zone trust set security nat source rule-set trust-to-untrust to zone untrust set security nat source rule-set trust-to-untrust rule source-nat-rule match source-address 0.0.0.0/0 set security nat source rule-set trust-to-untrust rule source-nat-rule then source-nat interface set security policies from-zone trust to-zone trust policy trust-to-trust match source-address any set security policies from-zone trust to-zone trust policy trust-to-trust match destination-address any set security policies from-zone trust to-zone trust policy trust-to-trust match application any set security policies from-zone trust to-zone trust policy trust-to-trust then permit set security policies from-zone trust to-zone untrust policy trust-to-untrust match source-address any set security policies from-zone trust to-zone untrust policy trust-to-untrust match destination-address any set security policies from-zone trust to-zone untrust policy trust-to-untrust match application any set security policies from-zone trust to-zone untrust policy trust-to-untrust then permit set security zones security-zone trust host-inbound-traffic system-services ping set security zones security-zone trust host-inbound-traffic system-services all set security zones security-zone trust host-inbound-traffic protocols all set security zones security-zone trust interfaces irb.126
折叠核心 1 配置
在折叠核心交换机上配置以下设置。
set interfaces irb unit 126 family inet address 192.168.3.2/24 set vlans mgmt1 vxlan vni 1000126 set vlans mgmt1 vlan-id 126 set vlans mgmt1 l3-interface irb.126 set interfaces irb unit 125 family inet address 192.168.2.2/24 set vlans mgmt vlan-id 125 set vlans mgmt l3-interface irb.125 set vlans mgmt vxlan vni 1000125 set interfaces ae31 unit 0 family ethernet-switching vlan members mgmt1 set interfaces ae22 unit 0 family ethernet-switching vlan members mgmt set groups dhcp-mist-relay forwarding-options dhcp-relay forward-only routing-instance default set groups dhcp-mist-relay forwarding-options dhcp-relay forward-only-replies set groups dhcp-mist-relay forwarding-options dhcp-relay server-group server_group_1 192.168.192.1 set groups dhcp-mist-relay forwarding-options dhcp-relay group dhcp_mist active-server-group server_group_1 set groups dhcp-mist-relay forwarding-options dhcp-relay group dhcp_mist route-suppression destination set groups dhcp-mist-relay forwarding-options dhcp-relay group dhcp_mist interface irb.125 set apply-groups dhcp-mist-relay
折叠核心 2 配置
在折叠核心交换机上配置以下设置。
set interfaces irb unit 126 family inet address 192.168.3.3/24 set vlans mgmt1 vxlan vni 1000126 set vlans mgmt1 vlan-id 126 set vlans mgmt1 l3-interface irb.126 set interfaces irb unit 125 family inet address 192.168.2.3/24 set vlans mgmt vlan-id 125 set vlans mgmt l3-interface irb.125 set vlans mgmt vxlan vni 1000125 set interfaces ae31 unit 0 family ethernet-switching vlan members mgmt1 set interfaces ae22 unit 0 family ethernet-switching vlan members mgmt set groups dhcp-mist-relay forwarding-options dhcp-relay forward-only routing-instance default set groups dhcp-mist-relay forwarding-options dhcp-relay forward-only-replies set groups dhcp-mist-relay forwarding-options dhcp-relay server-group server_group_1 192.168.192.1 set groups dhcp-mist-relay forwarding-options dhcp-relay group dhcp_mist active-server-group server_group_1 set groups dhcp-mist-relay forwarding-options dhcp-relay group dhcp_mist route-suppression destination set groups dhcp-mist-relay forwarding-options dhcp-relay group dhcp_mist interface irb.125 set apply-groups dhcp-mist-relay
Mist 接入点接入交换机配置
在接入交换机上配置以下设置。
set poe interface ge-0/0/4 set poe interface ge-0/0/5 set interfaces ae22 unit 0 family ethernet-switching vlan members mgmt set interfaces ge-0/0/4 native-vlan-id 125 set interfaces ge-0/0/4 unit 0 family ethernet-switching vlan members 125 set interfaces ge-0/0/5 native-vlan-id 125 set interfaces ge-0/0/5 unit 0 family ethernet-switching vlan members 125
802.1X 的接入交换机配置
我们建议您为交换机上的有线客户端启用 802.1x 基于端口的网络访问控制 (PNAC) 身份验证,以对连接到交换机端口的客户端进行身份验证。
有三种方法可以执行此操作:
-
对身份验证器端口上的第一个终端设备(请求方)进行身份验证,并允许所有其他连接终端设备也访问 LAN
-
一次对身份验证器端口上的单个终端设备进行身份验证
-
在身份验证器端口上对多个终端设备进行身份验证(这通常用于 VoIP 配置
在本例中,我们将交换机配置为接受多个请求方。
set groups dot1x access radius-server 192.168.10.1 secret "$9$8.s7b2ZGi.mTZUqf5QCA" set groups dot1x access radius-server 192.168.10.1 source-address 192.168.10.200 set groups dot1x protocols dot1x authenticator authentication-profile-name pdt_profile_1 set groups dot1x protocols dot1x authenticator no-mac-table-binding set groups dot1x protocols dot1x authenticator interface ge-1/0/12.0 supplicant multiple set groups dot1x protocols dot1x authenticator interface ge-1/0/12.0 mac-radius set groups dot1x access profile pdt_profile_1 authentication-order radius set groups dot1x access profile pdt_profile_1 radius authentication-server 192.168.10.1
下一步是什么
瞻博网络的园区解决方案基于 VXLAN 与 EVPN 控制平面的叠加,是一种跨核心网络构建和互连多个园区的高效且可扩展的方式。凭借强大的 BGP/EVPN 实施,瞻博网络完全有能力发挥 EVPN 技术的全部潜力。
有关可用 EVPN 功能及其配置方法的详细信息,请参阅 EVPN 用户指南。