Creating VNF Service Chains for Inter-LR Traffic
Contrail Networking Release 1912 extends the service chaining functionality to bare metal servers (BMS). In earlier releases, Contrail Networking supports traffic flow between a virtual machine in one virtual network and a virtual machine in another virtual network. However, traffic flow between a virtual machine and BMS through a service chain was not supported. With Release 1912, Contrail Networking supports the movement of inter-LR traffic by using virtual network functions (VNF). This EVPN-based VXLAN (Ethernet VPN-based Virtual Extensible LAN) service chain supports bidirectional traffic flow through a service virtual machine.
VNF service chaining uses EVPN with VXLAN to enable traffic flow between:
Two bare metal servers.
Figure 1: Traffic Flow Between Two Bare Metal ServersFigure 1 shows traffic flowing between two bare metal servers. Each bare metal server is connected to a logical router (virtual routing engine). These logical routers are configured to send traffic from the bare metal server in one virtual network to the bare metal server in the other virtual network, through the service virtual machine.
A bare metal server and a virtual machine.
Figure 2: Traffic Flow Between a Bare Metal Server and a Virtual MachineFigure 2 shows traffic flowing between a bare metal server and a virtual machine. The bare metal server and the virtual machine are connected to logical routers. These logical routers are configured to send traffic from the bare metal server in one virtual network to the virtual machine in the other virtual network, through the service virtual machine.
A virtual machine and a bare metal server.
Figure 3: Traffic Flow Between a Virtual Machine and a Bare Metal ServerFigure 3 shows traffic flowing between a virtual machine and a bare metal server. The virtual machine and the bare metal server are connected to logical routers. These logical routers are configured to send traffic from the virtual machine in one virtual network to the bare metal server in the other virtual network, through the service virtual machine.
Figure 4 shows how the service virtual machine, acting as a VNF, conceptually connects to the virtual networks.
The VNF does not connect to VN1 and VN2 directly. Instead, the VNF connects to virtual networks (labelled LR::LR1 and LR::LR2) that are internally generated by Contrail Networking. These internal virtual networks learn of routes in VN1 and VN2 through route leaking, as shown in Figure 5.
Contrail Networking creates LR::LR1 when you associate Logical Router LR1 with Virtual Network VN1, and LR::LR2 when you associate Logical Router LR2 with Virtual Network VN2. If you’re not working with VNFs, then you can safely ignore these internally-generated virtual networks. If you’re working with VNFs, as you are in this topic, then you must configure each of these internally-generated virtual networks with a subnet and associate these networks with the VNF. We’ll show you how to do this later.
Routes are learned through route leaking and re-origination. This works as follows:
Routes to endpoints in VN1 are leaked to LR::LR1, and routes to endpoints in VN2 are leaked to LR::LR2.
Contrail Networking then installs LR::LR1 routes into LR::LR2, and LR::LR2 routes into LR::LR1. Prior to installing these routes, Contrail Networking re-originates the routes so that the service virtual machine is the next hop. This means that traffic going from LR::LR1 to LR::LR2 and from LR::LR2 to LR::LR1 will be routed to the service virtual machine.
The re-originated routes are then leaked from LR::LR1 to VN1, and from LR::LR2 to VN2.
Additionally, Contrail Networking configures the routing tables in the vRouter (on the server where the service virtual machine resides) so that it too has routes to VN1 and VN2.
The end result is that packets in one virtual network destined for the other virtual network are sent to the service virtual machine for processing.
These topics provide instructions to create an EVPN-based VXLAN service chain.
Onboard Brownfield Devices
Follow these steps to onboard brownfield devices from the Contrail Command user interface (UI):
After the devices are onboarded, if you edit the fabric topology by adding new spine or leaf devices or by adding new links between devices, you must onboard the edited devices again. If you do not onboard the devices after edits to the initial configuration, underlay formation for the edited devices fails. You can choose to onboard individual devices by clicking the Onboard button for the selected device in the Fabric Devices tab of the Infrastructure > Fabrics > Fabric_Name page.
Create Virtual Network
A virtual network is a collection of endpoints, such as virtual machine instances, that can communicate with each other. You can also connect virtual networks to your on-premises network. A virtual network in a EVPN VXLAN data center corresponds to a bridge domain for one tenant in a multi-tenant data center fabric.
Follow these steps to create a virtual network from the Contrail Command user interface (UI).
Configuring Virtual Port Groups
This topic describes how to create virtual port groups (VPGs) from Contrail Command UI. Contrail Networking Release 2008 introduces a redesigned VPG-creation workflow. To create a VPG, perform the steps described in #id-configuring-virtual-port-groups__d18e47 if you are using release 2008 later and those described in #id-configuring-virtual-port-groups__d18e238 if you are using releases 2003 and 2005.
For release 2008:
In Contrail Networking Release 2008, you can create a VPG without attaching VLANs. You have the ability to add VLANs after the VPG is created. In scaled setups, there can be a large number of VLANs, making it very hard to manage inside the create or edit Virtual Port Group pages. Release 2008 simplifies the assignment of VLANs by introducing a dedicated page for management. The VPG creation workflow comprises two steps with the first step being configuration of the VPG. Only when the configuration step is completed successfully can you assign the VLANs which is the second step.
To create virtual port groups in Contrail Command in release 2008:
Navigate to Overlay > Virtual Port Group > Create Virtual Port Group.
The New Virtual Port Group wizard is displayed.
Enter a name for the virtual port group in the Virtual Port Group Name field.
Select the fabric from the Fabric Name list.
The available physical interfaces on the devices in the selected fabric are listed.
From the Available Physical Interface box, select the physical interfaces to be included in the virtual port group by clicking the arrow next to each physical interface. The available physical interfaces are the interfaces available on TORs that are already onboarded.
The selected interfaces are displayed in the Assigned Physical Interface box.
If you select more than one interface on the same TOR as shown in Figure 13, a link aggregation group (LAG) is automatically created on the device.
Select a security group from the Security Groups list.
For enterprise style fabric configuration, attach a security group to the virtual port group. The policies defined in the security group is assigned to all the ports in the virtual port group. For service provider style fabric configuration, you can attach a security group to every VLAN.
Assign a port profile to the virtual port group by selecting a port profile from the Port Profile list.
A port profile functions like a container that can support multiple port-related configurations, and allows you to apply those configurations by attaching them to the port profile.
Click Next to create the VPG. If VPG creation fails, an error message is displayed. If VPG creation is successful, you will be directed to the second step in the process, in which you can add the VLANs.
(Optional) You can assign VLANs in this step of the wizard. You can also add VLANs in the Overlay > Virtual Port Group page (see 10). To add VLANs here, enter the information as shown in Table 6.
Table 6: Enter VLAN Information Field
Action
Virtual Network
Select the virtual network to which the virtual port group belongs.
VLAN ID
Enter the VLAN ID and network to which the VLAN is associated. If you enable the VLAN-ID Fabric-Wide Significance option when creating a fabric, you can associate one VLAN ID to only one virtual network. This ensures that the same VLAN ID is not associated with more than one virtual network within the same enterprise style fabric.
Native/untagged
Select this check box to allow a native/untagged virtual network (optional). You can assign only one native/untagged VLAN in a virtual port group.
Security Group
This field is available only in service provider style fabric configuration. Select a security group from the Security Groups list.
You can attach a security group to each VLAN.
Figure 9: Assign VLANsClick Create.
The newly created virtual port group is displayed in the Virtual Port Group page with details of the interfaces as shown in Figure 10.
Figure 10: Virtual Port Groups(Optional) To assign VLANs if not previously configured or to edit configured VLANs, perform one of the following steps.
To edit or add only VLANs, click a VLAN or click Add next to the VPG name. The VLANs assignment page is displayed.
To edit VPG information and/or edit VLANs, select a VPG and click the edit (pencil) icon. The Edit VPG page is displayed.
Edit the VPG information as required. Click Save to save the changes and remain on this page. Alternatively, click Save and assign new VLANs to save the changes and assign VLANs. The VLANs assignment page is displayed.
Figure 11: Edit VPG
The VLANs assignment page has two panels. The left panel lists all currently configured VLANs, if any. The right panel enables you to assign additional VLANs. Enter VLAN information and click Assign to attach the VLANs. The VLANs appear in the left panel. You can attach up to 10 VLANs at a time. You can also edit existing VLANs from this page. Successful and failed attempts at assigning and editing are indicated through success or error message pop-ups.
Figure 12: Edit VLANsFor better visibility, you can hide the right panel by clicking the blue expansion icon. You can also use this page to delete individual VLANs and bulk delete multiple VLANs.
For releases 2003 and 2005:
To create virtual port groups in Contrail Command using releases 2003 and 2005:
Navigate to Overlay > Virtual Port Group > Create Virtual Port Group.
The Create Virtual Port Group page is displayed.
Enter a name for the virtual port group in the Virtual Port Group Name field.
Select virtual port group type.
With Contrail Networking Release 2003, you can create a routed virtual port group from the Contrail Command UI. Select the Routed option button to create a routed virtual port group. Select Layer 2 option button to create a virtual port group.
Select the fabric from the Fabric Name list.
The available physical interfaces on the devices in the selected fabric are listed.
From the Available Physical Interface box, select the physical interfaces to be included in the virtual port group by clicking the arrow next to each physical interface. The available physical interfaces are the interfaces available on TORs that are already onboarded.
The selected interfaces are displayed in the Assigned Physical Interface box.
If you select more than one interface on the same TOR as shown in Figure 13, a link aggregation group (LAG) is automatically created on the device.
Figure 13: Select Interfaces on the Same TORAssign a security group to the virtual port group by selecting a security group from the Security Groups list.
The policies defined in the security group is assigned to all the ports in the virtual port group.
Select and assign a port profile from the Port Profile list.
A port profile functions like a container that can support multiple port-related configurations, and allows you to apply those configurations by attaching them to the port profile.
Enter the following information as given in Table 7.
Table 7: Enter VLAN Information Field
Action
Network
Select the virtual network to which the virtual port group belongs.
VLAN ID
Enter the VLAN ID and network to which the VLAN is associated. If you enable the VLAN-ID Fabric-Wide Significance option when creating a fabric, you can associate one VLAN ID to only one virtual network. This ensures that the same VLAN ID is not associated with more than one virtual network within the same enterprise style fabric.
Display Name
Enter the VLAN name. If the Auto Display Name field is selected, this field is autogenerated from the virtual port group name.
Auto Display Name
Select Auto Display Name if you want the VLAN name to be autogenerated from the virtual port group name.
Native/untagged
Select this check box to allow a native/untagged virtual network (optional). You can assign only one native/untagged VLAN in a virtual port group.
Click Create.
The newly created virtual port group is displayed on the Virtual Port Group page with details of the interfaces and the TORs as shown in Figure 14.
Figure 14: Virtual Port Groups
You can delete a virtual port group by clicking the delete icon against the virtual port group. To delete a virtual port group, you must first remove the referenced VMI and the associated BMS instance from the virtual port group.
See Also
Create Logical Routers
A logical router replicates the functions of a physical router. It connects multiple virtual networks. A logical router performs a set of tasks that can be handled by a physical router, and contains multiple routing instances and routing tables.
Follow these steps to create a logical router (LR).
The router_interface object (Virtual Port) is created as part of the LR creation and VN extension to Spines workflow. While planning the IP address for spines, you must be aware that an extra one IP address is required for the router_interface object which gets created automatically.
Configure the Internal Virtual Networks
Use this procedure to configure the internal virtual networks.
When you connect a logical router to a virtual network, Contrail Networking automatically creates internal virtual networks. For logical routers named LR1 and LR2, the internal virtual networks are called LR::LR1 and LR::LR2 respectively. These networks attach to the service virtual machine.
Create the Service Virtual Machine
Use this procedure to create the service virtual machine, which is simply a compute workload.
Create VNF Service Template
Follow these steps to create a service template by using the Contrail Command UI:
Create VNF Service Instance
Follow these steps to add a service instance by using the Contrail Command UI:
Create the Network Policy
Use this procedure to create the network policy that governs traffic going through the VNF.
- Select Overlay>Network Policies to bring up the Network Policies page.
- Click Create.
- Provide a Policy Name.
- In the Policy Rule(s) section, select Network as the Source Type and use the drop-down lists to specify the Source (for example, LR::LR1) and Destination (for example, LR::LR2) networks.
Change History Table
Feature support is determined by the platform and release you are using. Use Feature Explorer to determine if a feature is supported on your platform.