配置VXLAN分布式网关作为DHCPv4中继示例
组网需求
某企业有位于BD10的用户,网关部署方式为分布式网关。另外还有位于BD20的DHCP服务器,与用户不在同一网段。现在需要在用户接入的分布式网关上使能DHCP relay功能,使得用户可以通过DHCP协议从DHCP服务器获得动态IP地址。
图1-70所示,企业的DHCP服务器和用户在不同的网段,VTEP2和VTEP3为用户接入的网关,配置了相同的IP地址,构成分布式网关。VTEP1为DHCP服务器的接入网关。
以下配置方案的详细介绍请参见(可选)配置VXLAN分布式网关作为DHCP中继。
本举例中VXLAN隧道侧接口以X系列单板为例。
数据准备
设备 |
EVPN实例 |
RD值 |
BD |
VNI |
Router id |
Peer IP |
---|---|---|---|---|---|---|
VTEP1 |
evpn20:
|
1:20 |
20 |
20 |
10.1.1.1 |
10.2.2.2;10.3.3.3 |
VTEP2 |
evpn10:
|
2:10 |
10 |
10 |
10.2.2.2 |
10.1.1.1;10.3.3.3 |
VTEP3 |
evpn10:
|
3:10 |
10 |
10 |
10.3.3.3 |
10.1.1.1;10.2.2.2 |
设备 |
接口 |
VPN实例 |
VNI |
RD值 |
---|---|---|---|---|
VTEP1 |
VBDIF 20 |
vpn1:
|
100 |
1:100 |
VTEP2 |
VBDIF 10 |
vpn1:
|
100 |
2:100 |
VTEP3 |
VBDIF 10 |
vpn1:
|
100 |
3:100 |
配置思路
采用如下思路配置VXLAN分布式网关作为DHCPv4 Relay:
配置VXLAN网络。
- 分别在VTEP1、VTEP2、VTEP3上配置路由协议,保证网络三层互通。
- 分别在VTEP1、VTEP2、VTEP3上配置VXLAN接入业务部署方式,在Switch1、Switch2上配置VLAN。
- 分别在VTEP1、VTEP2、VTEP3上配置EVPN实例并绑定BD域。
- 分别在VTEP1、VTEP2、VTEP3上配置VPN实例并绑定VBDIF接口。
- 分别在VTEP1、VTEP2、VTEP3上配置之间的BGP EVPN对等体关系。
- 分别在VTEP1、VTEP2、VTEP3上配置VXLAN隧道目的端地址。
- 分别在VTEP1、VTEP2、VTEP3上配置VXLAN网关。
配置分布式网关的DHCP Relay功能。
在VTEP2、VTEP3上配置VXLAN隧道侧接口加入端口防攻击的白名单。
配置DHCP Server。
园区网络的三层互通是构建虚拟网络的基础条件,现网中,如果园区网络已经实现三层网络的互通,那么该举例中的步骤1可以省略。
操作步骤
- 配置路由协议
# 配置VTEP1各接口IP地址。VTEP2和VTEP3的配置与VTEP1类似,这里不再赘述。配置OSPF时,注意需要发布设备上的Loopback接口地址。
<HUAWEI> system-view [HUAWEI] sysname VTEP1 [VTEP1] interface loopback 1 [VTEP1-LoopBack1] ip address 10.1.1.1 32 [VTEP1-LoopBack1] quit [VTEP1] interface gigabitethernet 1/0/1 [VTEP1-GigabitEthernet1/0/1] undo portswitch [VTEP1-GigabitEthernet1/0/1] ip address 192.168.1.2 24 [VTEP1-GigabitEthernet1/0/1] quit [VTEP1] interface gigabitethernet 1/0/2 [VTEP1-GigabitEthernet1/0/2] undo portswitch [VTEP1-GigabitEthernet1/0/2] ip address 192.168.2.1 24 [VTEP1-GigabitEthernet1/0/2] quit [VTEP1] ospf router-id 10.1.1.1 [VTEP1-ospf-1] area 0 [VTEP1-ospf-1-area-0.0.0.0] network 10.1.1.1 0.0.0.0 [VTEP1-ospf-1-area-0.0.0.0] network 192.168.1.0 0.0.0.255 [VTEP1-ospf-1-area-0.0.0.0] network 192.168.2.0 0.0.0.255 [VTEP1-ospf-1-area-0.0.0.0] quit [VTEP1-ospf-1] quit
# OSPF成功配置后,VTEP1、VTEP2和VTEP3之间可通过OSPF协议发现对方的Loopback接口的IP地址,并能互相ping通。以VTEP1 ping VTEP2的显示为例。
[VTEP1] ping 10.2.2.2 PING 10.2.2.2: 56 data bytes, press CTRL_C to break Reply from 10.2.2.2: bytes=56 Sequence=1 ttl=255 time=240 ms Reply from 10.2.2.2: bytes=56 Sequence=2 ttl=255 time=5 ms Reply from 10.2.2.2: bytes=56 Sequence=3 ttl=255 time=5 ms Reply from 10.2.2.2: bytes=56 Sequence=4 ttl=255 time=14 ms Reply from 10.2.2.2: bytes=56 Sequence=5 ttl=255 time=5 ms --- 10.2.2.2 ping statistics --- 5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 5/53/240 ms
- 分别在Switch1、Switch2上进行VLAN接入的配置,在VTEP1、VTEP2、VTEP3上配置VXLAN业务接入点
# 配置Switch1。
<HUAWEI> system-view [HUAWEI] sysname Switch1 [Switch1] vlan 10 [Switch1-vlan10] quit [Switch1] interface gigabitethernet 1/0/2 [Switch1-GigabitEthernet1/0/2] port link-type access [Switch1-GigabitEthernet1/0/2] port default vlan 10 [Switch1-GigabitEthernet1/0/2] quit [Switch1] interface gigabitethernet 1/0/1 [Switch1-GigabitEthernet1/0/1] port link-type trunk [Switch1-GigabitEthernet1/0/1] port trunk allow-pass vlan 10 [Switch1-GigabitEthernet1/0/1] quit
# 配置Switch2。
<HUAWEI> system-view [HUAWEI] sysname Switch2 [Switch2] vlan 10 [Switch2-vlan10] quit [Switch2] interface gigabitethernet 1/0/2 [Switch2-GigabitEthernet1/0/2] port link-type access [Switch2-GigabitEthernet1/0/2] port default vlan 10 [Switch2-GigabitEthernet1/0/2] quit [Switch2] interface gigabitethernet 1/0/1 [Switch2-GigabitEthernet1/0/1] port link-type trunk [Switch2-GigabitEthernet1/0/1] port trunk allow-pass vlan 10 [Switch2-GigabitEthernet1/0/1] quit
# 配置VTEP1。
[VTEP1] vlan 20 [VTEP1-vlan20] quit [VTEP1] bridge-domain 20 [VTEP1-bd20] l2 binding vlan 20 [VTEP1-bd20] quit [VTEP1] interface gigabitethernet 1/0/3 [VTEP1-GigabitEthernet1/0/3] port link-type access [VTEP1-GigabitEthernet1/0/3] port default vlan 20 [VTEP1-GigabitEthernet1/0/3] quit
# 配置VTEP2。
[VTEP2] bridge-domain 10 [VTEP2-bd10] quit [VTEP2] vcmp role silent [VTEP2] interface gigabitethernet 1/0/2 [VTEP2-GigabitEthernet1/0/2] port link-type trunk [VTEP2-GigabitEthernet1/0/2] quit [VTEP2] interface gigabitethernet 1/0/2.1 mode l2 [VTEP2-GigabitEthernet1/0/2.1] encapsulation dot1q vid 10 [VTEP2-GigabitEthernet1/0/2.1] bridge-domain 10 [VTEP2-GigabitEthernet1/0/2.1] quit
# 配置VTEP3。
[VTEP3] bridge-domain 10 [VTEP3-bd10] quit [VTEP3] vcmp role silent [VTEP3] interface gigabitethernet 1/0/2 [VTEP3-GigabitEthernet1/0/2] port link-type trunk [VTEP3-GigabitEthernet1/0/2] quit [VTEP3] interface gigabitethernet 1/0/2.1 mode l2 [VTEP3-GigabitEthernet1/0/2.1] encapsulation dot1q vid 10 [VTEP3-GigabitEthernet1/0/2.1] bridge-domain 10 [VTEP3-GigabitEthernet1/0/2.1] quit
- 分别在VTEP1、VTEP2、VTEP3上配置EVPN实例并绑定BD域
# 配置VTEP1。
[VTEP1] evpn vpn-instance evpn20 bd-mode [VTEP1-evpn-instance-evpn20] route-distinguisher 1:20 [VTEP1-evpn-instance-evpn20] vpn-target 20:1 both [VTEP1-evpn-instance-evpn20] vpn-target 1:100 export-extcommunity [VTEP1-evpn-instance-evpn20] quit [VTEP1] bridge-domain 20 [VTEP1-bd20] vxlan vni 20 [VTEP1-bd20] evpn binding vpn-instance evpn20 [VTEP1-bd20] quit
# 配置VTEP2。
[VTEP2] evpn vpn-instance evpn10 bd-mode [VTEP2-evpn-instance-evpn10] route-distinguisher 2:10 [VTEP2-evpn-instance-evpn10] vpn-target 10:1 both [VTEP2-evpn-instance-evpn10] vpn-target 1:100 export-extcommunity [VTEP2-evpn-instance-evpn10] quit [VTEP2] bridge-domain 10 [VTEP2-bd10] vxlan vni 10 [VTEP2-bd10] evpn binding vpn-instance evpn10 [VTEP2-bd10] quit
# 配置VTEP3。
[VTEP3] evpn vpn-instance evpn10 bd-mode [VTEP3-evpn-instance-evpn10] route-distinguisher 3:10 [VTEP3-evpn-instance-evpn10] vpn-target 10:1 both [VTEP3-evpn-instance-evpn10] vpn-target 1:100 export-extcommunity [VTEP3-evpn-instance-evpn10] quit [VTEP3] bridge-domain 10 [VTEP3-bd10] vxlan vni 10 [VTEP3-bd10] evpn binding vpn-instance evpn10 [VTEP3-bd10] quit
- 分别在VTEP1、VTEP2、VTEP3上配置VPN实例并绑定VBDIF接口
# 配置VTEP1。
[VTEP1] ip vpn-instance vpn1 [VTEP1-vpn-instance-vpn1] ipv4-family [VTEP1-vpn-instance-vpn1-af-ipv4] route-distinguisher 1:100 [VTEP1-vpn-instance-vpn1-af-ipv4] vpn-target 1:100 both evpn [VTEP1-vpn-instance-vpn1-af-ipv4] quit [VTEP1-vpn-instance-vpn1] vxlan vni 100 [VTEP1-vpn-instance-vpn1] quit [VTEP1] interface vbdif 20 [VTEP1-Vbdif20] ip binding vpn-instance vpn1 [VTEP1-Vbdif20] quit
# 配置VTEP2。
[VTEP2] ip vpn-instance vpn1 [VTEP2-vpn-instance-vpn1] ipv4-family [VTEP2-vpn-instance-vpn1-af-ipv4] route-distinguisher 2:100 [VTEP2-vpn-instance-vpn1-af-ipv4] vpn-target 1:100 both evpn [VTEP2-vpn-instance-vpn1-af-ipv4] quit [VTEP2-vpn-instance-vpn1] vxlan vni 100 [VTEP2-vpn-instance-vpn1] quit [VTEP2] interface vbdif 10 [VTEP2-Vbdif10] ip binding vpn-instance vpn1 [VTEP2-Vbdif10] quit
# 配置VTEP3。
[VTEP3] ip vpn-instance vpn1 [VTEP3-vpn-instance-vpn1] ipv4-family [VTEP3-vpn-instance-vpn1-af-ipv4] route-distinguisher 3:100 [VTEP3-vpn-instance-vpn1-af-ipv4] vpn-target 1:100 both evpn [VTEP3-vpn-instance-vpn1-af-ipv4] quit [VTEP3-vpn-instance-vpn1] vxlan vni 100 [VTEP3-vpn-instance-vpn1] quit [VTEP3] interface vbdif 10 [VTEP3-Vbdif10] ip binding vpn-instance vpn1 [VTEP3-Vbdif10] quit
- 配置VTEP1、VTEP2、VTEP3之间的BGP EVPN对等体关系
# 配置VTEP1。
[VTEP1] bgp 100 [VTEP1-bgp] router-id 10.1.1.1 [VTEP1-bgp] peer 10.2.2.2 as-number 100 [VTEP1-bgp] peer 10.2.2.2 connect-interface LoopBack1 [VTEP1-bgp] peer 10.3.3.3 as-number 100 [VTEP1-bgp] peer 10.3.3.3 connect-interface LoopBack1 [VTEP1-bgp] l2vpn-family evpn [VTEP1-bgp-af-evpn] peer 10.2.2.2 enable [VTEP1-bgp-af-evpn] peer 10.2.2.2 advertise irb [VTEP1-bgp-af-evpn] peer 10.3.3.3 enable [VTEP1-bgp-af-evpn] peer 10.3.3.3 advertise irb [VTEP1-bgp-af-evpn] quit [VTEP1-bgp] ipv4-family vpn-instance vpn1 [VTEP1-bgp-vpn1] advertise l2vpn evpn [VTEP1-bgp-vpn1] import-route direct [VTEP1-bgp-vpn1] quit [VTEP1-bgp] quit
# 配置VTEP2。
[VTEP2] bgp 100 [VTEP2-bgp] router-id 10.2.2.2 [VTEP2-bgp] peer 10.1.1.1 as-number 100 [VTEP2-bgp] peer 10.1.1.1 connect-interface LoopBack1 [VTEP2-bgp] peer 10.3.3.3 as-number 100 [VTEP2-bgp] peer 10.3.3.3 connect-interface LoopBack1 [VTEP2-bgp] l2vpn-family evpn [VTEP2-bgp-af-evpn] peer 10.1.1.1 enable [VTEP2-bgp-af-evpn] peer 10.1.1.1 advertise irb [VTEP2-bgp-af-evpn] peer 10.3.3.3 enable [VTEP2-bgp-af-evpn] peer 10.3.3.3 advertise irb [VTEP2-bgp-af-evpn] quit [VTEP2-bgp] ipv4-family vpn-instance vpn1 [VTEP2-bgp-vpn1] advertise l2vpn evpn [VTEP2-bgp-vpn1] import-route direct [VTEP2-bgp-vpn1] quit [VTEP2-bgp] quit
# 配置VTEP3。
[VTEP3] bgp 100 [VTEP3-bgp] router-id 10.3.3.3 [VTEP3-bgp] peer 10.1.1.1 as-number 100 [VTEP3-bgp] peer 10.1.1.1 connect-interface LoopBack1 [VTEP3-bgp] peer 10.2.2.2 as-number 100 [VTEP3-bgp] peer 10.2.2.2 connect-interface LoopBack1 [VTEP3-bgp] l2vpn-family evpn [VTEP3-bgp-af-evpn] peer 10.1.1.1 enable [VTEP3-bgp-af-evpn] peer 10.1.1.1 advertise irb [VTEP3-bgp-af-evpn] peer 10.2.2.2 enable [VTEP3-bgp-af-evpn] peer 10.2.2.2 advertise irb [VTEP3-bgp-af-evpn] quit [VTEP3-bgp] ipv4-family vpn-instance vpn1 [VTEP3-bgp-vpn1] advertise l2vpn evpn [VTEP3-bgp-vpn1] import-route direct [VTEP3-bgp-vpn1] quit [VTEP3-bgp] quit
- 在VTEP1、VTEP2、VTEP3上配置VXLAN隧道目的端地址
# 配置VTEP1。
[VTEP1] interface nve 1 [VTEP1-Nve1] source 10.1.1.1 [VTEP1-Nve1] vni 20 head-end peer-list protocol bgp [VTEP1-Nve1] quit
# 配置VTEP2。
[VTEP2] interface nve 1 [VTEP2-Nve1] source 10.2.2.2 [VTEP2-Nve1] vni 10 head-end peer-list protocol bgp [VTEP2-Nve1] quit
# 配置VTEP3。
[VTEP3] interface nve 1 [VTEP3-Nve1] source 10.3.3.3 [VTEP3-Nve1] vni 10 head-end peer-list protocol bgp [VTEP3-Nve1] quit
- 在VTEP2、VTEP3上配置VXLAN分布式网关,VTEP1上配置普通的VXLAN网关
# 配置VTEP1。
[VTEP1] interface vbdif 20 [VTEP1-Vbdif20] ip address 192.168.20.1 24 [VTEP1-Vbdif20] quit
# 配置VTEP2。
[VTEP2] interface vbdif 10 [VTEP2-Vbdif10] ip address 192.168.10.1 24 [VTEP2-Vbdif10] arp distribute-gateway enable [VTEP2-Vbdif10] arp collect host enable [VTEP2-Vbdif10] mac-address 0000-5e00-0101 [VTEP2-Vbdif10] quit
# 配置VTEP3。
[VTEP3] interface vbdif 10 [VTEP3-Vbdif10] ip address 192.168.10.1 24 [VTEP3-Vbdif10] arp distribute-gateway enable [VTEP3-Vbdif10] arp collect host enable [VTEP3-Vbdif10] mac-address 0000-5e00-0101 [VTEP3-Vbdif10] quit
- 验证VXLAN网络配置结果
# 上述配置成功后,在VTEP1、VTEP2、VTEP3上执行命令display vxlan tunnel可查看到VXLAN隧道的信息。以VTEP1显示为例。
[VTEP1] display vxlan tunnel Tunnel ID Source Destination State Type ---------------------------------------------------------------------------- 11 10.1.1.1 10.2.2.2 up l3 dynamic 13 10.1.1.1 10.3.3.3 up l3 dynamic ---------------------------------------------------------------------------- Number of vxlan tunnel : Total : 2 Static: 0 L2 dynamic: 0 L3 dynamic: 2
- 在VTEP2、VTEP3上配置DHCP Relay功能以及分布式网关的DHCP Relay重选路由功能
# 配置VTEP2。
[VTEP2] dhcp enable [VTEP2] dhcp option82 vendor-specific format vendor-sub-option 2 ip-address 10.2.2.2 [VTEP2] bridge-domain 10 [VTEP2-bd10] dhcp option82 insert enable [VTEP2-bd10] dhcp option82 encapsulation vendor-specific-id [VTEP2-bd10] quit [VTEP2] interface vbdif 10 [VTEP2-Vbdif10] dhcp select relay [VTEP2-Vbdif10] dhcp relay server-ip 192.168.20.10 [VTEP2-Vbdif10] dhcp relay information enable [VTEP2-Vbdif10] dhcp relay anycast gateway re-route enable [VTEP2-Vbdif10] quit
# 配置VTEP3。
[VTEP3] dhcp enable [VTEP3] dhcp option82 vendor-specific format vendor-sub-option 2 ip-address 10.3.3.3 [VTEP3] bridge-domain 10 [VTEP3-bd10] dhcp option82 insert enable [VTEP3-bd10] dhcp option82 encapsulation vendor-specific-id [VTEP3-bd10] quit [VTEP3] interface vbdif 10 [VTEP3-Vbdif10] dhcp select relay [VTEP3-Vbdif10] dhcp relay server-ip 192.168.20.10 [VTEP3-Vbdif10] dhcp relay information enable [VTEP3-Vbdif10] dhcp relay anycast gateway re-route enable [VTEP3-Vbdif10] quit
- 在VTEP2、VTEP3上配置VXLAN隧道侧接口加入端口防攻击的白名单。
# 在VTEP2上配置VXLAN隧道侧接口GigabitEthernet1/0/1加入端口防攻击的白名单。
[VTEP2] cpu-defend policy vxlan_tunnel_side [VTEP2-cpu-defend-policy-vxlan_tunnel_side] auto-port-defend whitelist 1 interface GigabitEthernet1/0/1 [VTEP2-cpu-defend-policy-vxlan_tunnel_side] quit [VTEP2] cpu-defend-policy vxlan_tunnel_side global
# 在VTEP3上配置VXLAN隧道侧接口GigabitEthernet1/0/1加入端口防攻击的白名单。
[VTEP3] cpu-defend policy vxlan_tunnel_side [VTEP3-cpu-defend-policy-vxlan_tunnel_side] auto-port-defend whitelist 1 interface GigabitEthernet1/0/1 [VTEP3-cpu-defend-policy-vxlan_tunnel_side] quit [VTEP3] cpu-defend-policy vxlan_tunnel_side global
- 验证DHCP Relay功能配置结果
# 上述配置成功后,在VTEP2、VTEP3上执行命令display dhcp relay可查看接口DHCP Relay配置情况。以VTEP2显示为例。
[VTEP2] display dhcp relay interface vbdif 10 DHCP relay agent running information of interface Vbdif10 : Server IP address [00] : 192.168.20.10 Gateway address in use : 192.168.10.1
- 配置DHCP服务器具体配置过程略。DHCP服务器需要满足以下条件:
- 在DHCP服务器上配置地址池,以便服务器端分配正确的IP地址给客户端。
- 建议配置地址池租期,提高IP地址的使用效率。
配置文件
VTEP1的配置文件
# sysname VTEP1 # vlan batch 20 # ip vpn-instance vpn1 ipv4-family route-distinguisher 1:100 vpn-target 1:100 export-extcommunity evpn vpn-target 1:100 import-extcommunity evpn vxlan vni 100 # evpn vpn-instance evpn20 bd-mode route-distinguisher 1:20 vpn-target 1:100 20:1 export-extcommunity vpn-target 20:1 import-extcommunity # bridge-domain 20 l2 binding vlan 20 vxlan vni 20 evpn binding vpn-instance evpn20 # interface GigabitEthernet1/0/1 undo portswitch ip address 192.168.1.2 255.255.255.0 # interface GigabitEthernet1/0/2 undo portswitch ip address 192.168.2.1 255.255.255.0 # interface GigabitEthernet1/0/3 port link-type access port default vlan 20 # interface LoopBack1 ip address 10.1.1.1 255.255.255.255 # interface Vbdif20 ip binding vpn-instance vpn1 ip address 192.168.20.1 255.255.255.0 # interface Nve1 source 10.1.1.1 vni 20 head-end peer-list protocol bgp # bgp 100 router-id 10.1.1.1 peer 10.2.2.2 as-number 100 peer 10.2.2.2 connect-interface LoopBack1 peer 10.3.3.3 as-number 100 peer 10.3.3.3 connect-interface LoopBack1 # ipv4-family unicast undo synchronization peer 10.2.2.2 enable peer 10.3.3.3 enable # l2vpn-family evpn policy vpn-target peer 10.2.2.2 enable peer 10.2.2.2 advertise irb peer 10.3.3.3 enable peer 10.3.3.3 advertise irb # ipv4-family vpn-instance vpn1 import-route direct advertise l2vpn evpn # ospf 1 router-id 10.1.1.1 area 0.0.0.0 network 10.1.1.1 0.0.0.0 network 192.168.1.0 0.0.0.255 network 192.168.2.0 0.0.0.255 # return
VTEP2的配置文件
# sysname VTEP2 # vcmp role silent # dhcp enable # dhcp option82 vendor-specific format vendor-sub-option 2 ip-address 10.2.2.2 # ip vpn-instance vpn1 ipv4-family route-distinguisher 2:100 vpn-target 1:100 export-extcommunity evpn vpn-target 1:100 import-extcommunity evpn vxlan vni 100 # evpn vpn-instance evpn10 bd-mode route-distinguisher 2:10 vpn-target 1:100 10:1 export-extcommunity vpn-target 10:1 import-extcommunity # bridge-domain 10 vxlan vni 10 evpn binding vpn-instance evpn10 dhcp option82 insert enable dhcp option82 encapsulation vendor-specific-id # interface GigabitEthernet1/0/1 undo portswitch ip address 192.168.1.1 255.255.255.0 # interface GigabitEthernet1/0/2 port link-type trunk # interface GigabitEthernet1/0/2.1 mode l2 encapsulation dot1q vid 10 bridge-domain 10 # interface LoopBack1 ip address 10.2.2.2 255.255.255.255 # interface Vbdif10 mac-address 0000-5e00-0101 ip binding vpn-instance vpn1 arp collect host enable arp distribute-gateway enable ip address 192.168.10.1 255.255.255.0 dhcp select relay dhcp relay server-ip 192.168.20.10 dhcp relay information enable dhcp relay anycast gateway re-route enable # interface Nve1 source 10.2.2.2 vni 10 head-end peer-list protocol bgp # bgp 100 router-id 10.2.2.2 peer 10.1.1.1 as-number 100 peer 10.1.1.1 connect-interface LoopBack1 peer 10.3.3.3 as-number 100 peer 10.3.3.3 connect-interface LoopBack1 # ipv4-family unicast undo synchronization peer 10.1.1.1 enable peer 10.3.3.3 enable # l2vpn-family evpn policy vpn-target peer 10.1.1.1 enable peer 10.1.1.1 advertise irb peer 10.3.3.3 enable peer 10.3.3.3 advertise irb # ipv4-family vpn-instance vpn1 import-route direct advertise l2vpn evpn # ospf 1 router-id 10.2.2.2 area 0.0.0.0 network 10.2.2.2 0.0.0.0 network 192.168.1.0 0.0.0.255 # cpu-defend policy vxlan_tunnel_side auto-defend whitelist 1 interface GigabitEthernet1/0/1 # cpu-defend-policy vxlan_tunnel_side global # return
VTEP3的配置文件
# sysname VTEP3 # vcmp role silent # dhcp enable # dhcp option82 vendor-specific format vendor-sub-option 2 ip-address 10.3.3.3 # ip vpn-instance vpn1 ipv4-family route-distinguisher 3:100 vpn-target 1:100 export-extcommunity evpn vpn-target 1:100 import-extcommunity evpn vxlan vni 100 # evpn vpn-instance evpn10 bd-mode route-distinguisher 3:10 vpn-target 1:100 10:1 export-extcommunity vpn-target 10:1 import-extcommunity # bridge-domain 10 vxlan vni 10 evpn binding vpn-instance evpn10 dhcp option82 insert enable dhcp option82 encapsulation vendor-specific-id # interface GigabitEthernet1/0/1 undo portswitch ip address 192.168.2.2 255.255.255.0 # interface GigabitEthernet1/0/2 port link-type trunk # interface GigabitEthernet1/0/2.1 mode l2 encapsulation dot1q vid 10 bridge-domain 10 # interface LoopBack1 ip address 10.3.3.3 255.255.255.255 # interface Vbdif10 mac-address 0000-5e00-0101 ip binding vpn-instance vpn1 arp collect host enable arp distribute-gateway enable ip address 192.168.10.1 255.255.255.0 dhcp select relay dhcp relay server-ip 192.168.20.10 dhcp relay information enable dhcp relay anycast gateway re-route enable # interface Nve1 source 10.3.3.3 vni 10 head-end peer-list protocol bgp # bgp 100 router-id 10.3.3.3 peer 10.1.1.1 as-number 100 peer 10.1.1.1 connect-interface LoopBack1 peer 10.2.2.2 as-number 100 peer 10.2.2.2 connect-interface LoopBack1 # ipv4-family unicast undo synchronization peer 10.1.1.1 enable peer 10.2.2.2 enable # l2vpn-family evpn policy vpn-target peer 10.1.1.1 enable peer 10.1.1.1 advertise irb peer 10.2.2.2 enable peer 10.2.2.2 advertise irb # ipv4-family vpn-instance vpn1 import-route direct advertise l2vpn evpn # ospf 1 router-id 10.3.3.3 area 0.0.0.0 network 10.3.3.3 0.0.0.0 network 192.168.2.0 0.0.0.255 # cpu-defend policy vxlan_tunnel_side auto-defend whitelist 1 interface GigabitEthernet1/0/1 # cpu-defend-policy vxlan_tunnel_side global # return
Switch1的配置文件
# sysname Switch1 # vlan 10 # interface GigabitEthernet1/0/1 port link-type trunk port trunk allow-pass vlan 10 # interface GigabitEthernet1/0/2 port link-type access port default vlan 10 # return
Switch2的配置文件
# sysname Switch2 # vlan 10 # interface GigabitEthernet1/0/1 port link-type trunk port trunk allow-pass vlan 10 # interface GigabitEthernet1/0/2 port link-type access port default vlan 10 # return