付録:ファブリックへのWANルーターの統合
一般に、キャンパスファブリックにWANルーターを接続するには、いくつかの方法があります。
- L2転送方法の使用:
- ファブリックアップリンクはESI-LAGとして設定され、WANルーターと通信するためのタグ付きVLAN(VRFごとに1つずつ)を1つ以上含みます。
- また、すでに上に示したように、各ファブリックVRFでのデフォルトフォワーディングのネクストホップIPアドレスとして、WANルーターインターフェイスのIPアドレスを手動で設定する必要があります。
- WANルーター自体が、アクティブLACPを備えた標準IEEE 802.3ad LAGを理解する必要があります。
- 冗長性のために複数のWANルーターが接続されている場合は、ファブリックへのインターフェイスIPアドレスに対して、それらの間にフェイルオーバーメカニズムを提供することをお勧めします。VRRP を推奨します。
- ファブリックとWANルーター間のルートは、静的に設定されているだけです。
- L3転送方法を使用する場合:
- ファブリックアップリンクは、L3ピアツーピアIPリンクとして設定されます。
- ファブリックVRFごとに、WANルーターとのピアツーピアリンクを確立する必要があります。
- 通常、1つの物理アップリンク上に複数のピアツーピアリンクがあります。これらは、タグ付きVLANを使用してさらにセグメント化され、アップリンク上で分離されます。
- デフォルトゲートウェイの伝播はルーティングプロトコルを介してWANルーターから取得されることを想定しているため、ファブリック内の各VRFにネクストホップを手動で設定する必要はありません。
- ファブリックとWANルーター間で、ルートを交換するためのルーティングプロトコルを確立する必要があります。
- キャンパスファブリックは、WANルーターへのルーティングプロトコルとして外部BGPとOSPFをサポートしています。
注:
このような統合の詳細については、すべてのファブリックタイプ向けの以下の JVD拡張機能 で説明します。この章の説明は、参照された拡張の背景とともによりよく文書化されているため、簡潔にまとめました。
このラボでは、SRX WANルーターとのL3 eBGPフォワーディング統合を採用することにしました。その前に、以下に示すように、access1スイッチ上の corp-it VRFのルーティングテーブルを確認しました。
root@access1> show route table corp-it.inet.0
corp-it.inet.0: 7 destinations, 8 routes (7 active, 0 holddown, 0 hidden)
@ = Routing Use Only, # = Forwarding Use Only
+ = Active Route, - = Last Active, * = Both
10.99.99.0/24 *[Direct/0] 03:54:18
> via irb.1099
[EVPN/170] 03:47:12
to 10.255.240.24 via mge-0/0/36.0
> to 10.255.240.20 via mge-0/0/37.0
10.99.99.1/32 *[Local/0] 03:54:18
Local via irb.1099
10.99.99.23/32 *[EVPN/7] 03:41:35
> via irb.1099
10.99.99.42/32 *[EVPN/170] 03:42:49
> to 10.255.240.24 via mge-0/0/36.0
to 10.255.240.20 via mge-0/0/37.0
10.99.99.99/32 *[EVPN/7] 03:39:08
> via irb.1099
172.16.192.4/32 *[Direct/0] 03:54:19
> via lo0.1
172.16.192.7/32 *[EVPN/170] 03:47:12
to 10.255.240.24 via mge-0/0/36.0
> to 10.255.240.20 via mge-0/0/37.0
1台のWANルーターと3台のVRFを使用するラボでは、構成は以下の図から確認できます。
図1:eBGP 
によるファブリック WANルーターの統合
によるファブリック WANルーターの統合
以下に、構成する各ピアリングのテーブルとして統合情報を示します。
| スイッチ | スイッチAS | VRF | サービスP2P IP | サービスIF | WANルーター | WANルーターP2P IP | WANルーターAS | WANルーターのIF | VLAN ID |
|---|---|---|---|---|---|---|---|---|---|
| サービス1 | 64911 | コーポレーションIT | 10.255.224.1/31 | xe-0/0/36.1099 | WANルーター | 10.255.224.0/31 | 64901 | xe-0/0/16.1099 | 1099 |
| サービス1 | 64911 | 開発者 | 10.255.224.3/31 | xe-0/0/36.1088 | WANルーター | 10.255.224.2/31 | 64901 | xe-0/0/16.1088 | 1088 |
| サービス1 | 64911 | ゲストWi-Fi | 10.255.224.5/31 | xe-0/0/36.1033 | WANルーター | 10.255.224.4/31 | 64901 | xe-0/0/16.1033 | 1033 |
| サービス2 | 64911 | コーポレーションIT | 10.255.226.1/31 | xe-0/0/36.1099 | WANルーター | 10.255.226.0/31 | 64901 | xe-0/0/17.1099 | 1099 |
| サービス2 | 64911 | 開発者 | 10.255.226.3/31 | xe-0/0/36.1088 | WANルーター | 10.255.226.2/31 | 64901 | xe-0/0/17.1088 | 1088 |
| サービス2 | 64911 | ゲストWi-Fi | 10.255.226.5/31 | xe-0/0/36.1033 | WANルーター | 10.255.226.4/31 | 64901 | xe-0/0/17.1033 | 1033 |
サービス1 WANルーター統合用ブロックスイッチの設定
このシステムで何を設定する必要があるかについて、ここに口頭での説明があります。
# configure the Additional IP-Subnet 10.255.224.1 255.255.255.254 to Network/VLAN:VLAN1099 # configure the Additional IP-Subnet 10.255.224.3 255.255.255.254 to Network/VLAN:VLAN1088 # configure the Additional IP-Subnet 10.255.224.5 255.255.255.254 to Network/VLAN:VLAN1033 # Then bind these 3 Network/VLANs to Port Interface xe-0/0/36 as L3-Sub-Interfaces with MTU=9018 . # Enable BGP and create an Export policy called 'export-vrfs' # Add to this export Policy the following Networks as: # - Add Term w. Name=VLAN1099 Prefix=10.99.99.0/24 Protocol=None Then=Accept # - Add Term w. Name=VLAN1088 Prefix=10.88.88.0/24 Protocol=None Then=Accept # - Add Term w. Name=VLAN1033 Prefix=10.33.33.0/24 Protocol=None Then=Accept # - Add Term w. Name=overlaylo0 Prefix=172.16.192.0/24-32 Protocol=None Then=Accept . # Create an Export policy called 'import-default' # - Name=default Prefix=0.0.0.0/0 Protocol=BGP Action=Accept . # Create a BGP Group with: # - Name=corp-it0 # - Type=External # - Network (VLAN)=VLAN1099 # - BFD interval=1000 # - Local AS=64911 # - Hold Time=90 # - Set Export=export-vrfs and Import=import-default # Add also the following Neighbor # - IP_Address=10.255.224.0 Neighbor_AS=64901 Hold-Time=90 . # Create a BGP Group with: # - Name=developers0 # - Type=External # - Network (VLAN)=VLAN1088 # - BFD interval=1000 # - Local AS=64911 # - Hold Time=90 # - Set Export=export-vrfs and Import=import-default # Add also the following Neighbor # - IP_Address=10.255.224.2 Neighbor_AS=64901 Hold-Time=90 . # Create a BGP Group with: # - Name=guest-wifi0 # - Type=External # - Network (VLAN)=VLAN1033 # - BFD interval=1000 # - Local AS=64911 # - Hold Time=90 # - Set Export=export-vrfs and Import=import-default # Add also the following Neighbor # - IP_Address=10.255.224.4 Neighbor_AS=64901 Hold-Time=90
設定完了後のスクリーンショットを次に示します。
図2:service1の追加IP設定
.
図3:service1のアップリンクインターフェイス
.
図4:service1 BGPの概要
.
図5:service1の最初のBGPピアリンググループ
.
図6:service1 Second BGP Peering Group
.
図7:service1の第3 BGPピアリンググループ
.
図8:service1ルーティングポリシーの概要
WANルーター統合のためのservice2ブロックスイッチの設定
このシステムで何を設定する必要があるかについて、ここに口頭での説明があります。
# configure the Additional IP-Subnet 10.255.226.1 255.255.255.254 to Network/VLAN:VLAN1099 # configure the Additional IP-Subnet 10.255.226.3 255.255.255.254 to Network/VLAN:VLAN1088 # configure the Additional IP-Subnet 10.255.226.5 255.255.255.254 to Network/VLAN:VLAN1033 # Then bind these 3 Network/VLANs to Port Interface xe-0/0/36 as L3-Sub-Interfaces with MTU=9018 . # Enable BGP and create an Export policy called 'export-vrfs' # Add to this export Policy the following Networks as: # - Add Term w. Name=VLAN1099 Prefix=10.99.99.0/24 Protocol=None Then=Accept # - Add Term w. Name=VLAN1088 Prefix=10.88.88.0/24 Protocol=None Then=Accept # - Add Term w. Name=VLAN1033 Prefix=10.33.33.0/24 Protocol=None Then=Accept # - Add Term w. Name=overlaylo0 Prefix=172.16.192.0/24-32 Protocol=None Then=Accept . # Create an Export policy called 'import-default' # - Name=default Prefix=0.0.0.0/0 Protocol=BGP Action=Accept . # Create a BGP Group with: # - Name=corp-it0 # - Type=External # - Network (VLAN)=VLAN1099 # - BFD interval=1000 # - Local AS=64911 # - Hold Time=90 # - Set Export=export-vrfs and Import=import-default # Add also the following Neighbor # - IP_Address=10.255.226.0 Neighbor_AS=64901 Hold-Time=90 . # Create a BGP Group with: # - Name=developers0 # - Type=External # - Network (VLAN)=VLAN1088 # - BFD interval=1000 # - Local AS=64911 # - Hold Time=90 # - Set Export=export-vrfs and Import=import-default # Add also the following Neighbor # - IP_Address=10.255.226.2 Neighbor_AS=64901 Hold-Time=90 . # Create a BGP Group with: # - Name=guest-wifi0 # - Type=External # - Network (VLAN)=VLAN1033 # - BFD interval=1000 # - Local AS=64911 # - Hold Time=90 # - Set Export=export-vrfs and Import=import-default # Add also the following Neighbor # - IP_Address=10.255.226.4 Neighbor_AS=64901 Hold-Time=90
設定完了後のスクリーンショットを次に示します。
図9:service2の追加IP設定
.
図10:service2アップリンクインターフェイス.png)
.
図11:service2 BGP概要
.png)
図12:service2のファーストBGPピアリンググループ
.
図13:service2のセカンドBGPピアリンググループ
.
図14:service2の第3 BGPピアリンググループ
.
図15:service2の第3 BGPピアリンググループ
.png)
統合後のサービスブロックスイッチとWANルーター間の検証
注:
このステップは、BGPルート交換を立ち上げるようにWANルーターも設定していることを前提としています。
Service1スイッチ:
サービス1スイッチは、3つのピアすべてとのBGPピアリングを確立し、3つのVRFのそれぞれのデフォルトルートをWANルーターから取得している必要があります。
root@service1> show bgp summary
Threading mode: BGP I/O
Default eBGP mode: advertise - accept, receive - accept
Groups: 5 Peers: 7 Down peers: 0
Table Tot Paths Act Paths Suppressed History Damp State Pending
inet.0
13 11 0 0 0 0
bgp.evpn.0
102 56 0 0 0 0
Peer AS InPkt OutPkt OutQ Flaps Last Up/Dwn State|#Active/Received/Accepted/Damped...
10.255.224.0 64901 141 143 0 1 1:02:40 Establ
corp-it.inet.0: 1/1/1/0
10.255.224.2 64901 140 141 0 1 1:02:36 Establ
developers.inet.0: 1/1/1/0
10.255.224.4 64901 140 141 0 1 1:02:32 Establ
guest-wifi.inet.0: 1/1/1/0
10.255.240.3 65003 3110 3139 0 0 23:45:45 Establ
inet.0: 6/7/7/0
10.255.240.5 65004 3127 3148 0 0 23:45:44 Establ
inet.0: 5/6/6/0
172.16.254.3 65003 5337 5143 0 0 23:45:44 Establ
bgp.evpn.0: 30/56/56/0
default-switch.evpn.0: 10/21/21/0
__default_evpn__.evpn.0: 0/0/0/0
guest-wifi.evpn.0: 10/10/10/0
developers.evpn.0: 12/12/12/0
corp-it.evpn.0: 13/13/13/0
172.16.254.4 65004 6069 4393 0 0 23:45:43 Establ
bgp.evpn.0: 26/46/46/0
default-switch.evpn.0: 11/21/21/0
__default_evpn__.evpn.0: 0/0/0/0
guest-wifi.evpn.0: 0/7/7/0
developers.evpn.0: 0/9/9/0
corp-it.evpn.0: 0/9/9/0
.
root@service1> show bfd session
Detect Transmit
Address State Interface Time Interval Multiplier
10.255.224.0 Up xe-0/0/36.1099 3.000 1.000 3
10.255.224.2 Up xe-0/0/36.1088 3.000 1.000 3
10.255.224.4 Up xe-0/0/36.1033 3.000 1.000 3
10.255.240.3 Up et-0/0/52.0 3.000 1.000 3
10.255.240.5 Up et-0/0/53.0 3.000 1.000 3
172.16.254.3 Up 3.000 1.000 3
172.16.254.4 Up 3.000 1.000 3
.
7 sessions, 7 clients
Cumulative transmit rate 7.0 pps, cumulative receive rate 7.0 pps
.
root@service1> show route table corp-it.inet.0
corp-it.inet.0: 12 destinations, 15 routes (12 active, 0 holddown, 0 hidden)
@ = Routing Use Only, # = Forwarding Use Only
+ = Active Route, - = Last Active, * = Both
.
0.0.0.0/0 *[BGP/170] 01:00:16, localpref 100
AS path: 64901 I, validation-state: unverified
> to 10.255.224.0 via xe-0/0/36.1099
[EVPN/170] 01:00:15
> to 10.255.240.3 via et-0/0/52.0
10.99.99.0/24 @[EVPN/170] 02:22:25
to 10.255.240.3 via et-0/0/52.0
> to 10.255.240.5 via et-0/0/53.0
[EVPN/170] 02:22:25
to 10.255.240.3 via et-0/0/52.0
> to 10.255.240.5 via et-0/0/53.0
#[Multipath/255] 02:22:25, metric2 0
to 10.255.240.3 via et-0/0/52.0
> to 10.255.240.5 via et-0/0/53.0
to 10.255.240.3 via et-0/0/52.0
> to 10.255.240.5 via et-0/0/53.0
10.99.99.23/32 *[EVPN/170] 02:22:25
to 10.255.240.3 via et-0/0/52.0
> to 10.255.240.5 via et-0/0/53.0
10.99.99.42/32 *[EVPN/170] 02:22:25
> to 10.255.240.3 via et-0/0/52.0
to 10.255.240.5 via et-0/0/53.0
10.99.99.99/32 *[EVPN/170] 02:22:25
to 10.255.240.3 via et-0/0/52.0
> to 10.255.240.5 via et-0/0/53.0
10.255.224.0/31 *[Direct/0] 02:22:25
> via xe-0/0/36.1099
10.255.224.1/32 *[Local/0] 02:22:25
Local via xe-0/0/36.1099
10.255.226.0/31 *[EVPN/170] 02:22:21
> to 10.255.240.3 via et-0/0/52.0
172.16.192.1/32 *[Direct/0] 02:22:25
> via lo0.1
172.16.192.4/32 *[EVPN/170] 02:22:25
to 10.255.240.3 via et-0/0/52.0
> to 10.255.240.5 via et-0/0/53.0
172.16.192.7/32 *[EVPN/170] 02:22:25
to 10.255.240.3 via et-0/0/52.0
> to 10.255.240.5 via et-0/0/53.0
172.16.192.10/32 *[EVPN/170] 02:22:21
> to 10.255.240.3 via et-0/0/52.0
.
root@service1> show route table developers.inet.0
developers.inet.0: 11 destinations, 14 routes (11 active, 0 holddown, 0 hidden)
@ = Routing Use Only, # = Forwarding Use Only
+ = Active Route, - = Last Active, * = Both
.
0.0.0.0/0 *[BGP/170] 01:00:32, localpref 100
AS path: 64901 I, validation-state: unverified
> to 10.255.224.2 via xe-0/0/36.1088
[EVPN/170] 01:00:31
> to 10.255.240.3 via et-0/0/52.0
10.88.88.0/24 @[EVPN/170] 02:22:45
to 10.255.240.3 via et-0/0/52.0
> to 10.255.240.5 via et-0/0/53.0
[EVPN/170] 02:22:45
to 10.255.240.3 via et-0/0/52.0
> to 10.255.240.5 via et-0/0/53.0
#[Multipath/255] 02:22:45, metric2 0
to 10.255.240.3 via et-0/0/52.0
> to 10.255.240.5 via et-0/0/53.0
to 10.255.240.3 via et-0/0/52.0
> to 10.255.240.5 via et-0/0/53.0
10.88.88.23/32 *[EVPN/170] 02:22:45
to 10.255.240.3 via et-0/0/52.0
> to 10.255.240.5 via et-0/0/53.0
10.88.88.88/32 *[EVPN/170] 02:22:45
> to 10.255.240.3 via et-0/0/52.0
to 10.255.240.5 via et-0/0/53.0
10.255.224.2/31 *[Direct/0] 02:22:45
> via xe-0/0/36.1088
10.255.224.3/32 *[Local/0] 02:22:45
Local via xe-0/0/36.1088
10.255.226.2/31 *[EVPN/170] 02:22:41
> to 10.255.240.3 via et-0/0/52.0
172.16.192.2/32 *[Direct/0] 02:22:45
> via lo0.2
172.16.192.5/32 *[EVPN/170] 02:22:45
to 10.255.240.3 via et-0/0/52.0
> to 10.255.240.5 via et-0/0/53.0
172.16.192.8/32 *[EVPN/170] 02:22:45
> to 10.255.240.3 via et-0/0/52.0
to 10.255.240.5 via et-0/0/53.0
172.16.192.11/32 *[EVPN/170] 02:22:41
> to 10.255.240.3 via et-0/0/52.0
.
root@service1> show route table guest-wifi.inet.0
guest-wifi.inet.0: 9 destinations, 12 routes (9 active, 0 holddown, 0 hidden)
@ = Routing Use Only, # = Forwarding Use Only
+ = Active Route, - = Last Active, * = Both
.
0.0.0.0/0 *[BGP/170] 01:00:45, localpref 100
AS path: 64901 I, validation-state: unverified
> to 10.255.224.4 via xe-0/0/36.1033
[EVPN/170] 01:00:44
> to 10.255.240.3 via et-0/0/52.0
10.33.33.0/24 @[EVPN/170] 02:23:02
to 10.255.240.3 via et-0/0/52.0
> to 10.255.240.5 via et-0/0/53.0
[EVPN/170] 02:23:02
to 10.255.240.3 via et-0/0/52.0
> to 10.255.240.5 via et-0/0/53.0
#[Multipath/255] 02:23:02, metric2 0
to 10.255.240.3 via et-0/0/52.0
> to 10.255.240.5 via et-0/0/53.0
to 10.255.240.3 via et-0/0/52.0
> to 10.255.240.5 via et-0/0/53.0
10.255.224.4/31 *[Direct/0] 02:23:02
> via xe-0/0/36.1033
10.255.224.5/32 *[Local/0] 02:23:02
Local via xe-0/0/36.1033
10.255.226.4/31 *[EVPN/170] 02:22:58
> to 10.255.240.3 via et-0/0/52.0
172.16.192.3/32 *[Direct/0] 02:23:02
> via lo0.3
172.16.192.6/32 *[EVPN/170] 02:23:02
to 10.255.240.3 via et-0/0/52.0
> to 10.255.240.5 via et-0/0/53.0
172.16.192.9/32 *[EVPN/170] 02:23:02
> to 10.255.240.3 via et-0/0/52.0
to 10.255.240.5 via et-0/0/53.0
172.16.192.12/32 *[EVPN/170] 02:22:58
> to 10.255.240.3 via et-0/0/52.0
Service2スイッチ:
サービス2スイッチは、3つのピアすべてとのBGPピアリングを確立し、3つのVRFそれぞれのデフォルトルートをWANルーターから取得している必要があります。
注:
service2とcore2の間には、まだシミュレートされた壊れたリンクがあることを忘れないでください。それが、ルートや bfd セッションを減らすものです。
root@service2> show bgp summary
Threading mode: BGP I/O
Default eBGP mode: advertise - accept, receive - accept
Groups: 5 Peers: 7 Down peers: 2
Table Tot Paths Act Paths Suppressed History Damp State Pending
inet.0
7 7 0 0 0 0
bgp.evpn.0
57 57 0 0 0 0
Peer AS InPkt OutPkt OutQ Flaps Last Up/Dwn State|#Active/Received/Accepted/Damped...
10.255.226.0 64901 160 163 0 1 1:11:18 Establ
corp-it.inet.0: 1/1/1/0
10.255.226.2 64901 159 161 0 1 1:11:14 Establ
developers.inet.0: 1/1/1/0
10.255.226.4 64901 159 162 0 1 1:11:10 Establ
guest-wifi.inet.0: 1/1/1/0
10.255.240.7 65003 3129 3179 0 0 23:54:22 Establ
inet.0: 7/7/7/0
10.255.240.9 65004 0 0 0 0 23:55:54 Idle
172.16.254.3 65003 6035 3203 0 0 23:54:20 Establ
bgp.evpn.0: 57/57/57/0
default-switch.evpn.0: 22/22/22/0
__default_evpn__.evpn.0: 0/0/0/0
guest-wifi.evpn.0: 10/10/10/0
developers.evpn.0: 12/12/12/0
corp-it.evpn.0: 13/13/13/0
172.16.254.4 65004 0 0 0 0 23:55:54 Active
.
root@service2> show bfd session
Detect Transmit
Address State Interface Time Interval Multiplier
10.255.226.0 Up xe-0/0/36.1099 3.000 1.000 3
10.255.226.2 Up xe-0/0/36.1088 3.000 1.000 3
10.255.226.4 Up xe-0/0/36.1033 3.000 1.000 3
10.255.240.7 Up et-0/0/53.0 3.000 1.000 3
172.16.254.3 Up 3.000 1.000 3
.
5 sessions, 5 clients
Cumulative transmit rate 5.0 pps, cumulative receive rate 5.0 pps
.
root@service2> show route table corp-it.inet.0
corp-it.inet.0: 12 destinations, 15 routes (12 active, 0 holddown, 0 hidden)
@ = Routing Use Only, # = Forwarding Use Only
+ = Active Route, - = Last Active, * = Both
.
0.0.0.0/0 *[BGP/170] 01:12:36, localpref 100
AS path: 64901 I, validation-state: unverified
> to 10.255.226.0 via xe-0/0/36.1099
[EVPN/170] 01:12:36
> to 10.255.240.7 via et-0/0/53.0
10.99.99.0/24 @[EVPN/170] 02:34:43
> to 10.255.240.7 via et-0/0/53.0
[EVPN/170] 02:34:43
> to 10.255.240.7 via et-0/0/53.0
#[Multipath/255] 02:34:43, metric2 0
> to 10.255.240.7 via et-0/0/53.0
> to 10.255.240.7 via et-0/0/53.0
10.99.99.23/32 *[EVPN/170] 02:34:43
> to 10.255.240.7 via et-0/0/53.0
10.99.99.42/32 *[EVPN/170] 02:34:43
> to 10.255.240.7 via et-0/0/53.0
10.99.99.99/32 *[EVPN/170] 02:34:43
> to 10.255.240.7 via et-0/0/53.0
10.255.224.0/31 *[EVPN/170] 02:34:43
> to 10.255.240.7 via et-0/0/53.0
10.255.226.0/31 *[Direct/0] 02:34:42
> via xe-0/0/36.1099
10.255.226.1/32 *[Local/0] 02:34:42
Local via xe-0/0/36.1099
172.16.192.1/32 *[EVPN/170] 02:34:43
> to 10.255.240.7 via et-0/0/53.0
172.16.192.4/32 *[EVPN/170] 02:34:43
> to 10.255.240.7 via et-0/0/53.0
172.16.192.7/32 *[EVPN/170] 02:34:43
> to 10.255.240.7 via et-0/0/53.0
172.16.192.10/32 *[Direct/0] 02:34:42
> via lo0.1
.
root@service2> show route table developers.inet.0
developers.inet.0: 11 destinations, 14 routes (11 active, 0 holddown, 0 hidden)
@ = Routing Use Only, # = Forwarding Use Only
+ = Active Route, - = Last Active, * = Both
.
0.0.0.0/0 *[BGP/170] 01:12:45, localpref 100
AS path: 64901 I, validation-state: unverified
> to 10.255.226.2 via xe-0/0/36.1088
[EVPN/170] 01:12:45
> to 10.255.240.7 via et-0/0/53.0
10.88.88.0/24 @[EVPN/170] 02:34:56
> to 10.255.240.7 via et-0/0/53.0
[EVPN/170] 02:34:56
> to 10.255.240.7 via et-0/0/53.0
#[Multipath/255] 02:34:56, metric2 0
> to 10.255.240.7 via et-0/0/53.0
> to 10.255.240.7 via et-0/0/53.0
10.88.88.23/32 *[EVPN/170] 02:34:56
> to 10.255.240.7 via et-0/0/53.0
10.88.88.88/32 *[EVPN/170] 02:34:56
> to 10.255.240.7 via et-0/0/53.0
10.255.224.2/31 *[EVPN/170] 02:34:56
> to 10.255.240.7 via et-0/0/53.0
10.255.226.2/31 *[Direct/0] 02:34:55
> via xe-0/0/36.1088
10.255.226.3/32 *[Local/0] 02:34:55
Local via xe-0/0/36.1088
172.16.192.2/32 *[EVPN/170] 02:34:56
> to 10.255.240.7 via et-0/0/53.0
172.16.192.5/32 *[EVPN/170] 02:34:56
> to 10.255.240.7 via et-0/0/53.0
172.16.192.8/32 *[EVPN/170] 02:34:56
> to 10.255.240.7 via et-0/0/53.0
172.16.192.11/32 *[Direct/0] 02:34:55
> via lo0.2
.
root@service2> show route table guest-wifi.inet.0
guest-wifi.inet.0: 9 destinations, 12 routes (9 active, 0 holddown, 0 hidden)
@ = Routing Use Only, # = Forwarding Use Only
+ = Active Route, - = Last Active, * = Both
.
0.0.0.0/0 *[BGP/170] 01:12:57, localpref 100
AS path: 64901 I, validation-state: unverified
> to 10.255.226.4 via xe-0/0/36.1033
[EVPN/170] 01:12:57
> to 10.255.240.7 via et-0/0/53.0
10.33.33.0/24 @[EVPN/170] 02:35:12
> to 10.255.240.7 via et-0/0/53.0
[EVPN/170] 02:35:12
> to 10.255.240.7 via et-0/0/53.0
#[Multipath/255] 02:35:12, metric2 0
> to 10.255.240.7 via et-0/0/53.0
> to 10.255.240.7 via et-0/0/53.0
10.255.224.4/31 *[EVPN/170] 02:35:12
> to 10.255.240.7 via et-0/0/53.0
10.255.226.4/31 *[Direct/0] 02:35:11
> via xe-0/0/36.1033
10.255.226.5/32 *[Local/0] 02:35:11
Local via xe-0/0/36.1033
172.16.192.3/32 *[EVPN/170] 02:35:12
> to 10.255.240.7 via et-0/0/53.0
172.16.192.6/32 *[EVPN/170] 02:35:12
> to 10.255.240.7 via et-0/0/53.0
172.16.192.9/32 *[EVPN/170] 02:35:12
> to 10.255.240.7 via et-0/0/53.0
172.16.192.12/32 *[Direct/0] 02:35:11
> via lo0.3
WANルーター:
以下に、BGPとBFDの概要、およびデバイスに既知のルートをキャプチャします。ここで重要な点は次のとおりです。
- オーバーレイからのルート
10.99.99.0/24VLAN1099VRF=corp-itに割り当て - overlay=
VLAN1088からのルート10.88.88.0/24はVRF=developersに割り当てられています - オーバーレイからのルート
10.33.33.0/24VLAN1033VRF=guest-wifiに割り当て - DHCP-Relay使用用のオーバーレイからのルート
172.16.192.4to9/32。
図16:DHCPリレー
のaccess1オーバーレイループバック
のaccess1オーバーレイループバック
.
図17:DHCPリレー
用のaccess2オーバーレイループバック
用のaccess2オーバーレイループバック
以下の情報を確認してください。
root@wanrouter> show bgp summary
Threading mode: BGP I/O
Default eBGP mode: advertise - accept, receive - accept
Groups: 3 Peers: 6 Down peers: 0
Peer AS InPkt OutPkt OutQ Flaps Last Up/Dwn State|#Active/Received/Accepted/Damped...
10.255.224.1 64911 145 140 0 2 1:02:47 Establ
public-int.inet.0: 4/5/5/0
10.255.224.3 64911 144 140 0 2 1:02:51 Establ
public-int.inet.0: 4/5/5/0
10.255.224.5 64911 143 140 0 6 1:02:46 Establ
public-int.inet.0: 4/5/5/0
10.255.226.1 64911 145 140 0 2 1:02:44 Establ
public-int.inet.0: 4/5/5/0
10.255.226.3 64911 145 140 0 2 1:02:48 Establ
public-int.inet.0: 4/5/5/0
10.255.226.5 64911 144 141 0 6 1:02:51 Establ
public-int.inet.0: 4/5/5/0
.
root@wanrouter> show bfd session
Detect Transmit
Address State Interface Time Interval Multiplier
10.255.224.1 Up xe-0/0/16.1099 3.000 1.000 3
10.255.224.3 Up xe-0/0/16.1088 3.000 1.000 3
10.255.224.5 Up xe-0/0/16.1033 3.000 1.000 3
10.255.226.1 Up xe-0/0/17.1099 3.000 1.000 3
10.255.226.3 Up xe-0/0/17.1088 3.000 1.000 3
10.255.226.5 Up xe-0/0/17.1033 3.000 1.000 3
.
6 sessions, 6 clients
Cumulative transmit rate 6.0 pps, cumulative receive rate 6.0 pps
.
root@wanrouter> show route
public-int.inet.0: 30 destinations, 45 routes (30 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
.
0.0.0.0/0 *[Static/5] 5d 23:56:46
> to 192.168.10.1 via ge-0/0/0.0
10.33.33.0/24 *[BGP/170] 01:03:06, localpref 100, from 10.255.226.5
AS path: 64911 65002 65003 65006 65007 I, validation-state: unverified
to 10.255.226.5 via xe-0/0/17.1033
> to 10.255.224.5 via xe-0/0/16.1033
[BGP/170] 01:03:16, localpref 100
AS path: 64911 65001 65003 65006 65007 I, validation-state: unverified
> to 10.255.224.5 via xe-0/0/16.1033
10.88.88.0/24 *[BGP/170] 01:03:06, localpref 100, from 10.255.224.3
AS path: 64911 65001 65003 65006 65007 I, validation-state: unverified
to 10.255.224.3 via xe-0/0/16.1088
> to 10.255.226.3 via xe-0/0/17.1088
[BGP/170] 01:03:18, localpref 100
AS path: 64911 65002 65003 65006 65007 I, validation-state: unverified
> to 10.255.226.3 via xe-0/0/17.1088
10.99.99.0/24 *[BGP/170] 01:03:06, localpref 100, from 10.255.224.1
AS path: 64911 65001 65003 65006 65007 I, validation-state: unverified
to 10.255.224.1 via xe-0/0/16.1099
> to 10.255.226.1 via xe-0/0/17.1099
[BGP/170] 01:03:14, localpref 100
AS path: 64911 65002 65003 65006 65007 I, validation-state: unverified
> to 10.255.226.1 via xe-0/0/17.1099
10.255.224.0/31 *[Direct/0] 22:24:32
> via xe-0/0/16.1099
10.255.224.0/32 *[Local/0] 22:24:32
Local via xe-0/0/16.1099
10.255.224.2/31 *[Direct/0] 22:24:32
> via xe-0/0/16.1088
10.255.224.2/32 *[Local/0] 22:24:32
Local via xe-0/0/16.1088
10.255.224.4/31 *[Direct/0] 22:24:32
> via xe-0/0/16.1033
10.255.224.4/32 *[Local/0] 22:24:32
Local via xe-0/0/16.1033
10.255.226.0/31 *[Direct/0] 22:24:32
> via xe-0/0/17.1099
10.255.226.0/32 *[Local/0] 22:24:32
Local via xe-0/0/17.1099
10.255.226.2/31 *[Direct/0] 22:24:32
> via xe-0/0/17.1088
10.255.226.2/32 *[Local/0] 22:24:32
Local via xe-0/0/17.1088
10.255.226.4/31 *[Direct/0] 22:24:32
> via xe-0/0/17.1033
10.255.226.4/32 *[Local/0] 22:24:32
Local via xe-0/0/17.1033
172.16.192.1/32 *[BGP/170] 01:03:17, localpref 100
AS path: 64911 I, validation-state: unverified
> to 10.255.224.1 via xe-0/0/16.1099
[BGP/170] 01:03:14, localpref 100
AS path: 64911 65002 65003 65001 I, validation-state: unverified
> to 10.255.226.1 via xe-0/0/17.1099
172.16.192.2/32 *[BGP/170] 01:03:21, localpref 100
AS path: 64911 I, validation-state: unverified
> to 10.255.224.3 via xe-0/0/16.1088
[BGP/170] 01:03:18, localpref 100
AS path: 64911 65002 65003 65001 I, validation-state: unverified
> to 10.255.226.3 via xe-0/0/17.1088
172.16.192.3/32 *[BGP/170] 01:03:16, localpref 100
AS path: 64911 I, validation-state: unverified
> to 10.255.224.5 via xe-0/0/16.1033
[BGP/170] 01:03:22, localpref 100
AS path: 64911 65002 65003 65001 I, validation-state: unverified
> to 10.255.226.5 via xe-0/0/17.1033
172.16.192.4/32 *[BGP/170] 01:03:06, localpref 100, from 10.255.224.1
AS path: 64911 65001 65003 65005 65008 I, validation-state: unverified
to 10.255.224.1 via xe-0/0/16.1099
> to 10.255.226.1 via xe-0/0/17.1099
[BGP/170] 01:03:14, localpref 100
AS path: 64911 65002 65003 65005 65008 I, validation-state: unverified
> to 10.255.226.1 via xe-0/0/17.1099
172.16.192.5/32 *[BGP/170] 01:03:06, localpref 100, from 10.255.224.3
AS path: 64911 65001 65003 65005 65008 I, validation-state: unverified
to 10.255.224.3 via xe-0/0/16.1088
> to 10.255.226.3 via xe-0/0/17.1088
[BGP/170] 01:03:18, localpref 100
AS path: 64911 65002 65003 65005 65008 I, validation-state: unverified
> to 10.255.226.3 via xe-0/0/17.1088
172.16.192.6/32 *[BGP/170] 01:03:06, localpref 100, from 10.255.226.5
AS path: 64911 65002 65003 65006 65008 I, validation-state: unverified
to 10.255.226.5 via xe-0/0/17.1033
> to 10.255.224.5 via xe-0/0/16.1033
[BGP/170] 01:03:16, localpref 100
AS path: 64911 65001 65003 65006 65008 I, validation-state: unverified
> to 10.255.224.5 via xe-0/0/16.1033
172.16.192.7/32 *[BGP/170] 01:03:06, localpref 100, from 10.255.224.1
AS path: 64911 65001 65003 65005 65007 I, validation-state: unverified
to 10.255.224.1 via xe-0/0/16.1099
> to 10.255.226.1 via xe-0/0/17.1099
[BGP/170] 01:03:14, localpref 100
AS path: 64911 65002 65003 65005 65007 I, validation-state: unverified
> to 10.255.226.1 via xe-0/0/17.1099
172.16.192.8/32 *[BGP/170] 01:03:06, localpref 100
AS path: 64911 65001 65003 65006 65007 I, validation-state: unverified
> to 10.255.224.3 via xe-0/0/16.1088
to 10.255.226.3 via xe-0/0/17.1088
[BGP/170] 01:03:18, localpref 100
AS path: 64911 65002 65003 65006 65007 I, validation-state: unverified
> to 10.255.226.3 via xe-0/0/17.1088
172.16.192.9/32 *[BGP/170] 01:03:06, localpref 100
AS path: 64911 65002 65003 65006 65007 I, validation-state: unverified
> to 10.255.226.5 via xe-0/0/17.1033
to 10.255.224.5 via xe-0/0/16.1033
[BGP/170] 01:03:16, localpref 100
AS path: 64911 65001 65003 65006 65007 I, validation-state: unverified
> to 10.255.224.5 via xe-0/0/16.1033
172.16.192.10/32 *[BGP/170] 01:03:14, localpref 100
AS path: 64911 I, validation-state: unverified
> to 10.255.226.1 via xe-0/0/17.1099
[BGP/170] 01:03:17, localpref 100
AS path: 64911 65001 65003 65002 I, validation-state: unverified
> to 10.255.224.1 via xe-0/0/16.1099
172.16.192.11/32 *[BGP/170] 01:03:18, localpref 100
AS path: 64911 I, validation-state: unverified
> to 10.255.226.3 via xe-0/0/17.1088
[BGP/170] 01:03:21, localpref 100
AS path: 64911 65001 65003 65002 I, validation-state: unverified
> to 10.255.224.3 via xe-0/0/16.1088
172.16.192.12/32 *[BGP/170] 01:03:22, localpref 100
AS path: 64911 I, validation-state: unverified
> to 10.255.226.5 via xe-0/0/17.1033
[BGP/170] 01:03:16, localpref 100
AS path: 64911 65001 65003 65002 I, validation-state: unverified
> to 10.255.224.5 via xe-0/0/16.1033
192.168.10.0/24 *[Direct/0] 6d 00:00:22
> via ge-0/0/0.0
192.168.10.99/32 *[Local/0] 6d 00:00:22
Local via ge-0/0/0.0
ファブリックVRFルートの更新
WANルーターとルートを交換したので、すべてのアクセススイッチには、サービスブロックスイッチを介して取得されたデフォルトルートがあるはずです。この例では、access1スイッチのVRF corp-it を確認し、WANルーター統合前と後の違いを確認します。
root@access1> show route table corp-it.inet.0
corp-it.inet.0: 12 destinations, 15 routes (12 active, 0 holddown, 0 hidden)
@ = Routing Use Only, # = Forwarding Use Only
+ = Active Route, - = Last Active, * = Both
0.0.0.0/0 @[EVPN/170] 00:02:34
> to 10.255.240.24 via mge-0/0/36.0
to 10.255.240.20 via mge-0/0/37.0
[EVPN/170] 00:02:30
> to 10.255.240.24 via mge-0/0/36.0
to 10.255.240.20 via mge-0/0/37.0
#[Multipath/255] 00:02:30, metric2 0
> to 10.255.240.24 via mge-0/0/36.0
to 10.255.240.20 via mge-0/0/37.0
> to 10.255.240.24 via mge-0/0/36.0
to 10.255.240.20 via mge-0/0/37.0
10.99.99.0/24 *[Direct/0] 04:00:31
> via irb.1099
[EVPN/170] 03:53:25
to 10.255.240.24 via mge-0/0/36.0
> to 10.255.240.20 via mge-0/0/37.0
10.99.99.1/32 *[Local/0] 04:00:31
Local via irb.1099
10.99.99.23/32 *[EVPN/7] 03:47:48
> via irb.1099
10.99.99.42/32 *[EVPN/170] 03:49:02
> to 10.255.240.24 via mge-0/0/36.0
to 10.255.240.20 via mge-0/0/37.0
10.99.99.99/32 *[EVPN/7] 03:45:21
> via irb.1099
10.255.224.0/31 *[EVPN/170] 00:02:44
> to 10.255.240.24 via mge-0/0/36.0
to 10.255.240.20 via mge-0/0/37.0
10.255.226.0/31 *[EVPN/170] 00:02:41
> to 10.255.240.24 via mge-0/0/36.0
to 10.255.240.20 via mge-0/0/37.0
172.16.192.1/32 *[EVPN/170] 00:02:44
to 10.255.240.24 via mge-0/0/36.0
> to 10.255.240.20 via mge-0/0/37.0
172.16.192.4/32 *[Direct/0] 04:00:32
> via lo0.1
172.16.192.7/32 *[EVPN/170] 03:53:25
to 10.255.240.24 via mge-0/0/36.0
> to 10.255.240.20 via mge-0/0/37.0
172.16.192.10/32 *[EVPN/170] 00:02:41
> to 10.255.240.24 via mge-0/0/36.0
to 10.255.240.20 via mge-0/0/37.0
クライアント通信検証の繰り返し
ここで最後のテストは、ここで実行したクライアント通信の検証を繰り返すことです: 有線クライアント検証。これに対して、WAN ルーターがこのトラフィックをヘアピンで固定するため、他の VRF のクライアントに ping を実行できるようになり、インターネットへの通信が可能になり、DHCP リースも取得できるようになりました。
root@desktop1:~# ifconfig ens5
ens5: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.99.99.99 netmask 255.255.255.0 broadcast 10.99.99.255
inet6 fe80::5054:ff:fe7e:f9b1 prefixlen 64 scopeid 0x20<link>
ether 52:54:00:7e:f9:b1 txqueuelen 1000 (Ethernet)
RX packets 170291 bytes 424870428 (424.8 MB)
RX errors 0 dropped 99974 overruns 0 frame 0
TX packets 29012 bytes 1942778 (1.9 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
.
root@desktop1:~# ip r
default via 10.99.99.1 dev ens5 proto static
10.99.99.0/24 dev ens5 proto kernel scope link src 10.99.99.99
192.168.10.0/24 dev ens3 proto kernel scope link src 192.168.10.61
.
root@desktop1:~# ping -c3 10.99.99.1
PING 10.99.99.1 (10.99.99.1) 56(84) bytes of data.
64 bytes from 10.99.99.1: icmp_seq=1 ttl=64 time=8.70 ms
64 bytes from 10.99.99.1: icmp_seq=2 ttl=64 time=7.06 ms
64 bytes from 10.99.99.1: icmp_seq=3 ttl=64 time=3.43 ms
.
root@desktop1:~# ping -c3 10.99.99.23
PING 10.99.99.23 (10.99.99.23) 56(84) bytes of data.
64 bytes from 10.99.99.23: icmp_seq=1 ttl=64 time=0.566 ms
64 bytes from 10.99.99.23: icmp_seq=2 ttl=64 time=0.531 ms
64 bytes from 10.99.99.23: icmp_seq=3 ttl=64 time=0.737 ms
.
root@desktop1:~# ping -c3 10.99.99.42
PING 10.99.99.42 (10.99.99.42) 56(84) bytes of data.
64 bytes from 10.99.99.42: icmp_seq=1 ttl=64 time=0.799 ms
64 bytes from 10.99.99.42: icmp_seq=2 ttl=64 time=0.532 ms
64 bytes from 10.99.99.42: icmp_seq=3 ttl=64 time=0.538 ms
.
root@desktop1:~# ping -c3 10.88.88.88
PING 10.88.88.88 (10.88.88.88) 56(84) bytes of data.
64 bytes from 10.88.88.88: icmp_seq=1 ttl=59 time=0.671 ms
64 bytes from 10.88.88.88: icmp_seq=2 ttl=59 time=0.576 ms
64 bytes from 10.88.88.88: icmp_seq=3 ttl=59 time=0.611 ms
.
root@desktop1:~# ping -c3 10.88.88.23
PING 10.88.88.23 (10.88.88.23) 56(84) bytes of data.
64 bytes from 10.88.88.23: icmp_seq=1 ttl=59 time=1.09 ms
64 bytes from 10.88.88.23: icmp_seq=2 ttl=59 time=0.645 ms
64 bytes from 10.88.88.23: icmp_seq=3 ttl=59 time=0.650 ms
.
root@desktop1:~# ping -c3 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=51 time=3.12 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=51 time=3.03 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=51 time=3.07 ms
.
root@desktop1:~# arp -an
? (10.99.99.1) at 00:00:5e:e4:31:57 [ether] on ens5
? (10.99.99.23) at 52:54:00:4a:e5:d0 [ether] on ens5
? (10.99.99.42) at 52:54:00:77:3c:03 [ether] on ens5
.
root@desktop1:~# dhclient -v ens5
Listening on LPF/ens5/52:54:00:7e:f9:b1
Sending on LPF/ens5/52:54:00:7e:f9:b1
Sending on Socket/fallback
DHCPDISCOVER on ens5 to 255.255.255.255 port 67 interval 3 (xid=0xefa2357a)
DHCPOFFER of 10.99.99.10 from 172.16.192.4
DHCPREQUEST for 10.99.99.10 on ens5 to 255.255.255.255 port 67 (xid=0x7a35a2ef)
DHCPACK of 10.99.99.10 from 172.16.192.4 (xid=0xefa2357a)
bound to 10.99.99.10 -- renewal in 765 seconds.