配置VXLAN分布式网关作为DHCPv4 Relay示例(跨VPN)
配置VXLAN分布式网关作为DHCPv4 Relay示例(跨VPN)
以跨VPN分布式VXLAN网关的典型应用场景为例,描述如何配置VXLAN分布式网关作为DHCPv4 Relay。
组网需求
如图1所示,某企业部署了分布式网关的VXLAN网络。现需要部署DHCP业务,以实现DHCP Server为不同网段的VM分配IP地址。其中Leaf1、Leaf2作为VXLAN网关并部署DHCP Relay,Leaf3与DHCP Server相连。DHCP Server和客户端VM属于不同的VPN。
配置思路
- 在Leaf1、Leaf2、Spine上以BGP EVPN方式部署分布式网关VXLAN。Leaf1、Leaf2作为VXLAN网关,Spine作为路由反射器。
- 在Leaf1、Leaf2、Leaf3上各配置一个用于DHCP业务的VPN实例。实现Leaf1、Leaf2上的DHCP VPN有至DHCP Server的路由。
- 在Leaf1、Leaf2上配置DHCP Relay。
- 配置DHCP Server。
数据准备
为完成此配置示例,需准备如下的数据:
- 网络中设备互连的接口IP地址。
- VM1所属的VLAN ID是VLAN 10,VM2所属的VLAN ID是VLAN 20。
- 广播域BD ID分别是BD 10和BD 20。
- VXLAN网络标识VNI ID分别是VNI 10和VNI 20。
操作步骤
- 配置路由协议。
# 配置Leaf1。Leaf2、Leaf3、Spine的配置与Leaf1配置类似,这里不再赘述。配置OSPF时,注意需要发布32位Loopback接口地址。
<HUAWEI> system-view [~HUAWEI] sysname Leaf1 [*HUAWEI] commit [~Leaf1] interface loopback 1 [*Leaf1-LoopBack1] ip address 1.1.1.1 32 [*Leaf1-LoopBack1] quit [*Leaf1] interface 10ge 1/0/1 [*Leaf1-10GE1/0/1] undo portswitch [*Leaf1-10GE1/0/1] ip address 192.168.1.1 24 [*Leaf1-10GE1/0/1] quit [*Leaf1] ospf [*Leaf1-ospf-1] area 0 [*Leaf1-ospf-1-area-0.0.0.0] network 1.1.1.1 0.0.0.0 [*Leaf1-ospf-1-area-0.0.0.0] network 192.168.1.0 0.0.0.255 [*Leaf1-ospf-1-area-0.0.0.0] quit [*Leaf1-ospf-1] quit [*Leaf1] commit
OSPF成功配置后,设备之间可通过OSPF协议发现对方的Loopback接口的IP地址,并能互相ping通。
- 配置VXLAN隧道模式并使能VXLAN的ACL扩展功能。 (仅CE12800需要配置此步骤)
# 配置Leaf1。Leaf2、Leaf3、Spine的配置与Leaf1配置类似,这里不再赘述。
[~Leaf1] ip tunnel mode vxlan [*Leaf1] assign forward nvo3 acl extend enable [*Leaf1] commit
配置VXLAN隧道模式、使能VXLAN的ACL扩展功能后,需要保存配置并重启设备才能生效,您可以选择立即重启或完成所有配置后再重启。
- 分别在Leaf1、Leaf2上配置业务接入点。
# 配置Leaf1。
[~Leaf1] bridge-domain 10 [*Leaf1-bd10] quit [*Leaf1] interface 10ge 1/0/2.1 mode l2 [*Leaf1-10GE1/0/2.1] encapsulation dot1q vid 10 [*Leaf1-10GE1/0/2.1] bridge-domain 10 [*Leaf1-10GE1/0/2.1] quit [*Leaf1] commit
Leaf2的配置与Leaf1配置类似,这里不再赘述。具体配置过程略,请参考配置文件。
- 使能EVPN作VXLAN控制平面功能。
# 配置Leaf1。
[~Leaf1] evpn-overlay enable [*Leaf1] commit
Leaf2、Leaf3、Spine的配置与Leaf1配置类似,这里不再赘述。具体配置过程略,请参考配置文件。
- 在Leaf1、Leaf2、Leaf3上建立与Spine之间的BGP EVPN对等体关系。
# 在Leaf1上配置BGP EVPN对等体关系。
[~Leaf1] bgp 100 [*Leaf1-bgp] peer 4.4.4.4 as-number 100 [*Leaf1-bgp] peer 4.4.4.4 connect-interface LoopBack1 [*Leaf1-bgp] l2vpn-family evpn [*Leaf1-bgp-af-evpn] peer 4.4.4.4 enable Warning: This operation will reset the peer session. Continue? [Y/N]: y [*Leaf1-bgp-af-evpn] quit [*Leaf1-bgp] quit [*Leaf1] commit
Leaf2、Leaf3的配置与Leaf1配置类似,这里不再赘述。具体配置过程略,请参考配置文件。
- 在Spine上建立与Leaf1、Leaf2、Leaf3之间的BGP EVPN对等体关系,并配置反射器功能,指定Leaf1、Leaf2、Leaf3作为反射器的客户机。
# 在Spine上配置BGP EVPN对等体关系。
[~Spine] bgp 100 [*Spine-bgp] peer 1.1.1.1 as-number 100 [*Spine-bgp] peer 1.1.1.1 connect-interface LoopBack1 [*Spine-bgp] peer 2.2.2.2 as-number 100 [*Spine-bgp] peer 2.2.2.2 connect-interface LoopBack1 [*Spine-bgp] peer 3.3.3.3 as-number 100 [*Spine-bgp] peer 3.3.3.3 connect-interface LoopBack1 [*Spine-bgp] l2vpn-family evpn [*Spine-bgp-af-evpn] peer 1.1.1.1 enable Warning: This operation will reset the peer session. Continue? [Y/N]: y [*Spine-bgp-af-evpn] peer 1.1.1.1 reflect-client [*Spine-bgp-af-evpn] peer 2.2.2.2 enable Warning: This operation will reset the peer session. Continue? [Y/N]: y [*Spine-bgp-af-evpn] peer 2.2.2.2 reflect-client [*Spine-bgp-af-evpn] peer 3.3.3.3 enable Warning: This operation will reset the peer session. Continue? [Y/N]: y [*Spine-bgp-af-evpn] peer 3.3.3.3 reflect-client [*Spine-bgp-af-evpn] undo policy vpn-target [*Spine-bgp-af-evpn] quit [*Spine-bgp] quit [*Spine] commit
- 在Leaf1和Leaf2上配置VPN实例和EVPN实例。
[~Leaf1] ip vpn-instance vpn1 [*Leaf1-vpn-instance-vpn1] vxlan vni 5010 [*Leaf1-vpn-instance-vpn1] ipv4-family [*Leaf1-vpn-instance-vpn1-af-ipv4] route-distinguisher 20:1 [*Leaf1-vpn-instance-vpn1-af-ipv4] vpn-target 100:5010 evpn [*Leaf1-vpn-instance-vpn1-af-ipv4] quit [*Leaf1-vpn-instance-vpn1] quit [*Leaf1] bridge-domain 10 [*Leaf1-bd10] vxlan vni 10 [*Leaf1-bd10] evpn [*Leaf1-bd10-evpn] route-distinguisher 10:1 [*Leaf1-bd10-evpn] vpn-target 100:10 [*Leaf1-bd10-evpn] vpn-target 100:5010 export-extcommunity [*Leaf1-bd10-evpn] quit [*Leaf1-bd10] quit [*Leaf1] commit
Leaf2的配置与Leaf1配置类似,这里不再赘述。具体配置过程略,请参考配置文件。
- 分别在Leaf1、Leaf2上使能头端复制功能。
# 在Leaf1上使能头端复制功能。
[~Leaf1] interface nve 1 [*Leaf1-Nve1] source 1.1.1.1 [*Leaf1-Nve1] vni 10 head-end peer-list protocol bgp [*Leaf1-Nve1] quit [*Leaf1] commit
Leaf2的配置与Leaf1配置类似,这里不再赘述。具体配置过程略,请参考配置文件。
- 在Leaf1、Leaf2上配置VXLAN三层网关。
# 在Leaf1上配置VXLAN三层网关。
[~Leaf1] interface vbdif10 [*Leaf1-Vbdif10] ip binding vpn-instance vpn1 [*Leaf1-Vbdif10] ip address 10.1.1.1 24 [*Leaf1-Vbdif10] vxlan anycast-gateway enable [*Leaf1-Vbdif10] arp collect host enable [*Leaf1-Vbdif10] quit [*Leaf1] commit
Leaf2的配置与Leaf1配置类似,这里不再赘述。具体配置过程略,请参考配置文件。
- 在Spine与Leaf1、Leaf2之间配置BGP对邻居发布IRB类型的路由。
# 配置Spine。
[~Spine] bgp 100 [~Spine-bgp] l2vpn-family evpn [~Spine-bgp-af-evpn] peer 1.1.1.1 advertise irb [*Spine-bgp-af-evpn] peer 2.2.2.2 advertise irb [*Spine-bgp-af-evpn] quit [*Spine-bgp] quit [*Spine] commit
# 配置Leaf1。
[~Leaf1] bgp 100 [~Leaf1-bgp] l2vpn-family evpn [~Leaf1-bgp-af-evpn] peer 4.4.4.4 advertise irb [*Leaf1-bgp-af-evpn] quit [*Leaf1-bgp] quit [*Leaf1] commit
Leaf2的配置与Leaf1配置类似,这里不再赘述。具体配置过程略,请参考配置文件。
- 在Leaf1、Leaf2、Leaf3上配置用于DHCP业务的VPN实例。
# 配置Leaf3。创建DHCP VPN实例,并将与DHCP Server相连的接口绑定至VPN实例。
[~Leaf3] ip vpn-instance dhcp [*Leaf3-vpn-instance-dhcp] vxlan vni 5000 [*Leaf3-vpn-instance-dhcp] ipv4-family [*Leaf3-vpn-instance-dhcp-af-ipv4] route-distinguisher 30:3 [*Leaf3-vpn-instance-dhcp-af-ipv4] vpn-target 100:5000 evpn [*Leaf3-vpn-instance-dhcp-af-ipv4] quit [*Leaf3-vpn-instance-dhcp] quit [*Leaf3] vlan batch 30 [*Leaf3] interface 10ge 1/0/2 [*Leaf3-10GE1/0/2] port default vlan 30 [*Leaf3-10GE1/0/2] quit [*Leaf3] interface vlanif 30 [*Leaf3-Vlanif30] ip binding vpn-instance dhcp [*Leaf3-Vlanif30] ip address 10.1.5.1 24 [*Leaf3-Vlanif30] quit [*Leaf3] commit
# 配置Leaf1。创建DHCP VPN实例,并创建一个LoopBack口,绑定至VPN实例。LoopBack口IP地址可以和网关VBDIF接口相同。
[~Leaf1] ip vpn-instance dhcp [*Leaf1-vpn-instance-dhcp] vxlan vni 5000 [*Leaf1-vpn-instance-dhcp] ipv4-family [*Leaf1-vpn-instance-dhcp-af-ipv4] route-distinguisher 30:1 [*Leaf1-vpn-instance-dhcp-af-ipv4] vpn-target 100:5000 evpn [*Leaf1-vpn-instance-dhcp-af-ipv4] quit [*Leaf1-vpn-instance-dhcp] quit [*Leaf1] interface loopback 2 [*Leaf1-LoopBack2] ip binding vpn-instance dhcp [*Leaf1-LoopBack2] ip address 10.1.1.1 24 [*Leaf1-LoopBack2] quit [*Leaf1] commit
Leaf2的配置与Leaf1配置类似,这里不再赘述。具体配置过程略,请参考配置文件。
- 在Leaf3、Leaf1、Leaf2上发布IP前缀类型路由,使各DHCP VPN实例的路由可以互通。
# 配置Leaf3。
[~Leaf3] bgp 100 [*Leaf3-bgp] ipv4-family vpn-instance dhcp [*Leaf3-bgp-dhcp] import-route direct [*Leaf3-bgp-dhcp] advertise l2vpn evpn [*Leaf3-bgp-dhcp] quit [*Leaf3-bgp] quit [*Leaf3] interface nve 1 [*Leaf3-Nve1] source 3.3.3.3 [*Leaf3-Nve1] quit [*Leaf3] commit
# 配置Leaf1。
[~Leaf1] bgp 100 [*Leaf1-bgp] ipv4-family vpn-instance dhcp [*Leaf1-bgp-dhcp] import-route direct [*Leaf1-bgp-dhcp] advertise l2vpn evpn [*Leaf1-bgp-dhcp] quit [*Leaf1-bgp] quit [*Leaf1] commit
Leaf2的配置与Leaf1配置类似,这里不再赘述。具体配置过程略,请参考配置文件。
- 在Leaf1和Leaf2上配置DHCP Relay。
# 配置Leaf1。
[~Leaf1] dhcp enable [*Leaf1] interface loopback 3 [*Leaf1-LoopBack3] ip binding vpn-instance dhcp [*Leaf1-LoopBack3] ip address 5.5.5.5 32 [*Leaf1-LoopBack3] quit [*Leaf1] interface vbdif10 [*Leaf1-Vbdif10] dhcp select relay [*Leaf1-Vbdif10] dhcp relay binding server ip 10.1.5.2 vpn-instance dhcp [*Leaf1-Vbdif10] dhcp relay giaddr outgoing-interface-address [*Leaf1-Vbdif10] dhcp option82 vss-control insert enable [*Leaf1-Vbdif10] dhcp option82 link-selection insert enable [*Leaf1-Vbdif10] dhcp option82 server-id-override insert enable [*Leaf1-Vbdif10] dhcp option82 vendor-specific insert enable [*Leaf1-Vbdif10] dhcp option82 vendor-specific format vendor-sub-option 10 source-ip-address 5.5.5.5 [*Leaf1-Vbdif10] quit [*Leaf1] commit
Leaf2的配置与Leaf1配置类似,这里不再赘述。具体配置过程略,请参考配置文件。
- 配置DHCP服务器。
具体配置过程略。DHCP服务器需要满足以下条件:
- 验证配置结果
# 在Leaf1上通过display dhcp relay命令查看接口的DHCP中继配置情况。
[~Leaf1] display dhcp relay interface vbdif10 DHCP relay agent running information of interface Vbdif10 : Server IP address/VPN Name : 10.1.5.2 dhcp Gateway address in use : 10.1.1.1
配置文件
-
# sysname Spine # assign forward nvo3 acl extend enable //仅CE12800需要配置此步骤 # evpn-overlay enable # interface 10GE1/0/1 undo portswitch ip address 192.168.1.2 255.255.255.0 # interface 10GE1/0/2 undo portswitch ip address 192.168.2.2 255.255.255.0 # interface 10GE1/0/3 undo portswitch ip address 192.168.3.2 255.255.255.0 # interface LoopBack1 ip address 4.4.4.4 255.255.255.255 # bgp 100 peer 1.1.1.1 as-number 100 peer 1.1.1.1 connect-interface LoopBack1 peer 2.2.2.2 as-number 100 peer 2.2.2.2 connect-interface LoopBack1 peer 3.3.3.3 as-number 100 peer 3.3.3.3 connect-interface LoopBack1 # ipv4-family unicast peer 1.1.1.1 enable peer 2.2.2.2 enable peer 3.3.3.3 enable # l2vpn-family evpn undo policy vpn-target peer 1.1.1.1 enable peer 1.1.1.1 advertise irb peer 1.1.1.1 reflect-client peer 2.2.2.2 enable peer 2.2.2.2 advertise irb peer 2.2.2.2 reflect-client peer 3.3.3.3 enable peer 3.3.3.3 reflect-client # ospf 1 area 0.0.0.0 network 4.4.4.4 0.0.0.0 network 192.168.1.0 0.0.0.255 network 192.168.2.0 0.0.0.255 network 192.168.3.0 0.0.0.255 # return
-
# sysname Leaf1 # assign forward nvo3 acl extend enable //仅CE12800需要配置此步骤 # dhcp enable # evpn-overlay enable # ip vpn-instance dhcp ipv4-family route-distinguisher 30:1 vpn-target 100:5000 export-extcommunity evpn vpn-target 100:5000 import-extcommunity evpn vxlan vni 5000 # ip vpn-instance vpn1 ipv4-family route-distinguisher 20:1 vpn-target 100:5010 export-extcommunity evpn vpn-target 100:5010 import-extcommunity evpn vxlan vni 5010 # bridge-domain 10 vxlan vni 10 evpn route-distinguisher 10:1 vpn-target 100:5010 export-extcommunity vpn-target 100:10 export-extcommunity vpn-target 100:10 import-extcommunity # interface Vbdif10 ip binding vpn-instance vpn1 ip address 10.1.1.1 255.255.255.0 dhcp select relay dhcp relay binding server ip 10.1.5.2 vpn-instance dhcp dhcp relay giaddr outgoing-interface-address dhcp option82 vss-control insert enable dhcp option82 server-id-override insert enable dhcp option82 link-selection insert enable dhcp option82 vendor-specific insert enable dhcp option82 vendor-specific format vendor-sub-option 10 source-ip-address 5.5.5.5 vxlan anycast-gateway enable arp collect host enable # interface 10GE1/0/1 undo portswitch ip address 192.168.1.1 255.255.255.0 # interface 10GE1/0/2.1 mode l2 encapsulation dot1q vid 10 bridge-domain 10 # interface LoopBack1 ip address 1.1.1.1 255.255.255.255 # interface LoopBack2 ip binding vpn-instance dhcp ip address 10.1.1.1 255.255.255.0 # interface LoopBack3 ip binding vpn-instance dhcp ip address 5.5.5.5 255.255.255.255 # interface Nve1 source 1.1.1.1 vni 10 head-end peer-list protocol bgp # bgp 100 peer 4.4.4.4 as-number 100 peer 4.4.4.4 connect-interface LoopBack1 # ipv4-family unicast peer 4.4.4.4 enable # ipv4-family vpn-instance dhcp import-route direct advertise l2vpn evpn # l2vpn-family evpn policy vpn-target peer 4.4.4.4 enable peer 4.4.4.4 advertise irb # ospf 1 area 0.0.0.0 network 1.1.1.1 0.0.0.0 network 192.168.1.0 0.0.0.255 # return
-
# sysname Leaf2 # assign forward nvo3 acl extend enable //仅CE12800需要配置此步骤 # dhcp enable # evpn-overlay enable # ip vpn-instance dhcp ipv4-family route-distinguisher 30:2 vpn-target 100:5000 export-extcommunity evpn vpn-target 100:5000 import-extcommunity evpn vxlan vni 5000 # ip vpn-instance vpn1 ipv4-family route-distinguisher 20:2 vpn-target 100:5010 export-extcommunity evpn vpn-target 100:5010 import-extcommunity evpn vxlan vni 5010 # bridge-domain 20 vxlan vni 20 evpn route-distinguisher 10:2 vpn-target 100:20 export-extcommunity vpn-target 100:5010 export-extcommunity vpn-target 100:20 import-extcommunity # interface Vbdif20 ip binding vpn-instance vpn1 ip address 10.1.2.1 255.255.255.0 dhcp select relay dhcp relay binding server ip 10.1.5.2 vpn-instance dhcp dhcp relay giaddr outgoing-interface-address dhcp option82 vss-control insert enable dhcp option82 server-id-override insert enable dhcp option82 link-selection insert enable dhcp option82 vendor-specific insert enable dhcp option82 vendor-specific format vendor-sub-option 20 source-ip-address 6.6.6.6 vxlan anycast-gateway enable arp collect host enable # interface 10GE1/0/1 undo portswitch ip address 192.168.2.1 255.255.255.0 # interface 10GE1/0/2.1 mode l2 encapsulation dot1q vid 20 bridge-domain 20 # interface LoopBack1 ip address 2.2.2.2 255.255.255.255 # interface LoopBack2 ip binding vpn-instance dhcp ip address 10.1.2.1 255.255.255.0 # interface LoopBack3 ip binding vpn-instance dhcp ip address 6.6.6.6 255.255.255.255 # interface Nve1 source 2.2.2.2 vni 20 head-end peer-list protocol bgp # bgp 100 peer 4.4.4.4 as-number 100 peer 4.4.4.4 connect-interface LoopBack1 # ipv4-family unicast peer 4.4.4.4 enable # ipv4-family vpn-instance dhcp import-route direct advertise l2vpn evpn # l2vpn-family evpn policy vpn-target peer 4.4.4.4 enable peer 4.4.4.4 advertise irb # ospf 1 area 0.0.0.0 network 2.2.2.2 0.0.0.0 network 192.168.2.0 0.0.0.255 # return
-
# sysname Leaf3 # assign forward nvo3 acl extend enable //仅CE12800需要配置此步骤 # vlan batch 30 # evpn-overlay enable # ip vpn-instance dhcp ipv4-family route-distinguisher 30:3 vpn-target 100:5000 export-extcommunity evpn vpn-target 100:5000 import-extcommunity evpn vxlan vni 5000 # interface Vlanif30 ip binding vpn-instance dhcp ip address 10.1.5.1 255.255.255.0 # interface 10GE1/0/1 undo portswitch ip address 192.168.3.1 255.255.255.0 # interface 10GE1/0/2 port default vlan 30 # interface LoopBack1 ip address 3.3.3.3 255.255.255.255 # interface Nve1 source 3.3.3.3 # bgp 100 peer 4.4.4.4 as-number 100 peer 4.4.4.4 connect-interface LoopBack1 # ipv4-family unicast peer 4.4.4.4 enable # ipv4-family vpn-instance dhcp import-route direct advertise l2vpn evpn # l2vpn-family evpn policy vpn-target peer 4.4.4.4 enable # ospf 1 area 0.0.0.0 network 3.3.3.3 0.0.0.0 network 192.168.3.0 0.0.0.255 # return