2018年8月8日水曜日

Contrail/TungstanFabricとQFXのEVPN/VXLAN接続

Contrail/TungstenFabric 4.1からEVPN/VXLANをサポートしています。
**従来のOVSDB/VXLANはスケールやスタビリティの問題により5.0で廃止されています。

5.0時点ではEVPN/VXLAN関連のコンフィグはJuniper QFX51x0シリーズのみコントローラから自動で打ち込むことができます。
**5.1でマルチベンダ対応予定

設定方法
この例ではJuniperのQFX5100を使用します

1.Leaf Switchの登録

Configure > Physical Devices > Physical Routers
+ からNetconf Managed Physical Routerを選択
Name: Leaf Switch (HVTEP)のホスト名
Vender: Juniper
Model: qfx5100
Management IP: NetconfやSSHで接続するIP Address
Netconf Username: Netconf でコンフィグを受け付けるユーザー名
Netconf Password: Netconf でコンフィグを受け付けるパスワード
Role: Leaf
EVPN Peered TOR: チェックを入れる
JUNOS Service Port: Leaf SwitchのNetconf 待受ポート

2.BGP Routerの設定

Configure > Infrastructure > BGP Routers
Router Type: BGP Router
Name: Leaf Switch (HVTEP)のホスト名
Vender ID: Juniper
IP Address: BGPのソースIP Loopback IPとしてコンフィグされる
Router ID: BGPのルータID 通常 IP Addressと同じ
Autonomous System: Leaf SwitchのAS番号
BGP Router ASN: Leaf SwitchがBGP peerと接続する際に使用するAS番号 通常Autonomous Systeと同じ
Address Families: inet-vpn, route-target, e-vpnのみ指定
Advanced Options > Physical Router: Physical Deviceで登録したLeaf Switchを選択
Assosiate Peer(s) > Peer: Control nodeを指定

3.VTEP情報の設定

Configure > Physical Devices > Physical Routers
作成したPhysical RoutersのVTEP情報を設定する。右の歯車アイコンをクリック。
VTEP Address: Loopback IPを設定
Loopback IP: Loopback IP を設定


4.Leaf Switchの確認

Contrail/TungstenFabricでコンフィグをJunosに打ち込むと group __contrail__配下にコンフィグされる。
show configuration groups __contrail__で確認すると以下のようにループバックやBGPのコンフィグが確認できます。
interfaces {
    /* Interfaces Configuration */
    lo0 {
        /* Router Loopback Interface */
        unit 0 {
            family inet {
                address 10.84.54.2/32 {
                    primary;
                    preferred;
                }
            }
        }
    }
}
routing-options {
    /* Global Routing Options */
    router-id 10.84.54.2;
    route-distinguisher-id 10.84.54.2;
    autonomous-system 64519;
    resolution {
        rib bgp.rtarget.0 {
            resolution-ribs inet.0;
        }
    }
}
protocols {
    /* Protocols Configuration */
    bgp {
        /* BGP Router: qfx5100-48t-1, UUID: 5e96224d-f708-4207-9ac3-b15a2699494e */
        group _contrail_asn-64519 {
            type internal;
            local-address 10.84.54.2;
            hold-time 90;
            family evpn {
                signaling;
            }
            family route-target;
        }
        /* BGP Router: qfx5100-48t-1, UUID: 5e96224d-f708-4207-9ac3-b15a2699494e */
        group _contrail_asn-64519-external {
            type external;
            multihop;
            local-address 10.84.54.2;
            hold-time 90;
            family evpn {
                signaling;
            }
            family route-target;
            /* BGP Router: overcloud-contrailcontroller-0, UUID: 72950843-4008-4e6f-8019-0d875e06dcd6 */
            neighbor 10.84.50.91 {
                peer-as 65534;
            }
        }
    }
}
policy-options {
    community _contrail_switch_policy_ members target:64519:1;
}
switch-options {
    vtep-source-interface lo0.0;
}

5.仮想ネットワークをLeaf Switchに設定する

Configure > Physical Devices > Interfaces > {Leaf Swtich}
Name: 設定するインターフェイスを設定 xe-0/0/1.0 のようにサブインターフェイスまで指定
Logical Interface Properties > Logical Interface Type: Server
Logical Interface Properties > VLAN ID: VLAN番号を指定。Untagの場合は 0
Logical Interface Properties > Virtual Network: ポートに割り当てる仮想ネットワークを指定
Logical Interface Properties > Server MAC: ベアメタルサーバにDHCPでIPアドレスを割り当てる場合はMACアドレスを設定。ダミーでも可
** TSNが必要
Logical Interface Properties > IP address: 割り当てるIPアドレスを設定　空欄でも可

6.Leaf Switchの確認

自動的にインターフェイスがコンフィグされ、VNIやRoute-targetなど必要なものもコンフィグされる
__contrail__ {
    interfaces {
        /* Interfaces Configuration */
        lo0 {
            /* Router Loopback Interface */
            unit 0 {
                family inet {
                    address 10.84.54.2/32 {
                        primary;
                        preferred;
                    }
                }
            }
        }
        xe-0/0/1 {
            flexible-vlan-tagging;
            native-vlan-id 4094;
            encapsulation extended-vlan-bridge;
            /* L2 EVPN Untagged Interface, Virtual Network: vxlan-vn1, UUID: 1e1009e1-8113-4e62-b06f-24a3f5467b3f */
            unit 0 {
                vlan-id 4094;
            }
        }
    }
    routing-options {
        /* Global Routing Options */
        router-id 10.84.54.2;
        route-distinguisher-id 10.84.54.2;
        autonomous-system 64519;
        resolution {
            rib bgp.rtarget.0 {
                resolution-ribs inet.0;
            }
        }
    }
    protocols {
        /* Protocols Configuration */
        bgp {
            /* BGP Router: qfx5100-48t-1, UUID: 5e96224d-f708-4207-9ac3-b15a2699494e */
            group _contrail_asn-64519 {
                type internal;
                local-address 10.84.54.2;
                hold-time 90;
                family evpn {
                    signaling;
                }
                family route-target;
            }
            /* BGP Router: qfx5100-48t-1, UUID: 5e96224d-f708-4207-9ac3-b15a2699494e */
            group _contrail_asn-64519-external {
                type external;
                multihop;
                local-address 10.84.54.2;
                hold-time 90;
                family evpn {
                    signaling;
                }
                family route-target;
                /* BGP Router: overcloud-contrailcontroller-0, UUID: 72950843-4008-4e6f-8019-0d875e06dcd6 */
                neighbor 10.84.50.91 {
                    peer-as 65534;
                }
            }
        }
        evpn {
            vni-options {
                vni 5 {
                    vrf-target target:64512:100000;
                }
            }
            encapsulation vxlan;
            multicast-mode ingress-replication;
            extended-vni-list all;
        }
    }
    policy-options {
        /* Policy Options */
        /* Virtual Network: vxlan-vn1, UUID: 1e1009e1-8113-4e62-b06f-24a3f5467b3f, Route Targets Type: Import */
        policy-statement _contrail_vxlan-vn1-l2-5-import {
            term _contrail_switch_policy_ {
                from community _contrail_switch_policy_;
                then accept;
            }
            term t1 {
                from community [ _contrail_target_65534_8000003 _contrail_target_64512_100000 ];
                then accept;
            }
        }
        /* L2 Switch Global Export Policy */
        policy-statement _contrail_switch_export_policy_ {
            term t1 {
                then {
                    community add _contrail_switch_export_community_;
                }
            }
        }
        community _contrail_switch_export_community_ members [ target:65534:8000003 target:64512:100000 ];
        community _contrail_target_65534_8000003 members target:65534:8000003;
        community _contrail_target_64512_100000 members target:64512:100000;
        community _contrail_switch_policy_ members target:64519:1;
    }
    switch-options {
        vtep-source-interface lo0.0;
        route-distinguisher 10.84.54.2:1;
        vrf-import _contrail_vxlan-vn1-l2-5-import;
        vrf-export _contrail_switch_export_policy_;
        vrf-target {
            target:64519:1;
            auto;
        }
    }
    vlans {
        contrail_vxlan-vn1-l2-5 {
            interface xe-0/0/1.0;
            vxlan {
                vni 5;
            }
        }
    }
}

7.Leaf Switchのテーブル確認

BGPやEthernetテーブルを確認すると、コントローラやBGPピアからMACアドレスやRemote VTEPの情報が確認できる。
show ethernet-switching table 
MAC flags (S - static MAC, D - dynamic MAC, L - locally learned, P - Persistent static
           SE - statistics enabled, NM - non configured MAC, R - remote PE MAC, O - ovsdb MAC)


Ethernet switching table : 5 entries, 5 learned
Routing instance : default-switch
   Vlan                MAC                 MAC      Logical                Active
   name                address             flags    interface              source
   contrail_vxlan-vn1-l2-5 00:00:5e:00:01:01 DR     esi.1736               05:00:00:fc:00:00:00:00:05:00
   contrail_vxlan-vn1-l2-5 02:ed:68:05:27:94 D      vtep.32769             10.84.50.94
   contrail_vxlan-vn1-l2-5 08:81:f4:89:72:e0 D      vtep.32771             10.84.54.1
   contrail_vxlan-vn1-l2-5 10:0e:7e:dd:8f:43 D      vtep.32770             10.84.54.4
   contrail_vxlan-vn1-l2-5 10:0e:7e:dd:8f:44 D      xe-0/0/1.0
show route table bgp.evpn.0
   bgp.evpn.0: 12 destinations, 12 routes (12 active, 0 holddown, 0 hidden)
   + = Active Route, - = Last Active, * = Both

   1:10.84.54.1:0::050000fc000000000500::FFFF:FFFF/192 AD/ESI
                      *[BGP/170] 00:03:34, localpref 100, from 10.84.50.91
                         AS path: 65534 64512 I, validation-state: unverified
                       > to 10.84.53.13 via xe-0/0/46.0
   2:10.84.50.94:20::5::02:ed:68:05:27:94/304 MAC/IP
                      *[BGP/170] 00:03:34, MED 100, localpref 100, from 10.84.50.91
                         AS path: 65534 ?, validation-state: unverified
                       > to 10.84.53.13 via xe-0/0/46.0
   2:10.84.54.1:7::5::00:00:5e:00:01:01/304 MAC/IP
                      *[BGP/170] 00:03:34, localpref 100, from 10.84.50.91
                         AS path: 65534 64512 I, validation-state: unverified
                       > to 10.84.53.13 via xe-0/0/46.0
   2:10.84.54.1:7::5::08:81:f4:89:72:e0/304 MAC/IP
                      *[BGP/170] 00:03:34, localpref 100, from 10.84.50.91
                         AS path: 65534 64512 I, validation-state: unverified
                       > to 10.84.53.13 via xe-0/0/46.0
   2:10.84.54.4:1::5::10:0e:7e:dd:8f:43/304 MAC/IP
                      *[BGP/170] 00:03:34, localpref 100, from 10.84.50.91
                         AS path: 65534 64520 I, validation-state: unverified
                       > to 10.84.53.13 via xe-0/0/46.0
   2:10.84.50.94:20::5::02:ed:68:05:27:94::10.0.0.6/304 MAC/IP
                      *[BGP/170] 00:03:34, MED 100, localpref 100, from 10.84.50.91
                         AS path: 65534 ?, validation-state: unverified
                       > to 10.84.53.13 via xe-0/0/46.0
   2:10.84.54.1:7::5::00:00:5e:00:01:01::10.0.0.1/304 MAC/IP
                      *[BGP/170] 00:03:34, localpref 100, from 10.84.50.91
                         AS path: 65534 64512 I, validation-state: unverified
                       > to 10.84.53.13 via xe-0/0/46.0
   2:10.84.54.1:7::5::08:81:f4:89:72:e0::10.0.0.14/304 MAC/IP
                      *[BGP/170] 00:03:34, localpref 100, from 10.84.50.91
                         AS path: 65534 64512 I, validation-state: unverified
                       > to 10.84.53.13 via xe-0/0/46.0
   3:10.84.50.94:20::5::10.84.50.94/248 IM
                      *[BGP/170] 00:03:34, MED 200, localpref 100, from 10.84.50.91
                         AS path: 65534 ?, validation-state: unverified
                       > to 10.84.53.13 via xe-0/0/46.0
   3:10.84.54.1:7::5::10.84.54.1/248 IM
                      *[BGP/170] 00:03:34, localpref 100, from 10.84.50.91
                         AS path: 65534 64512 I, validation-state: unverified
                       > to 10.84.53.13 via xe-0/0/46.0
   3:10.84.54.2:1::5::10.84.54.2/248 IM
                      *[EVPN/170] 00:03:33
                         Indirect
   3:10.84.54.4:1::5::10.84.54.4/248 IM
                      *[BGP/170] 00:03:34, localpref 100, from 10.84.50.91
                         AS path: 65534 64520 I, validation-state: unverified
                       > to 10.84.53.13 via xe-0/0/46.0



投稿者 時刻: 1 件のコメント:
登録: 投稿 (Atom)