Arista EOSでLayer3 EVPN環境で、インターネットや他拠点とダイナミックルーティングを設定する方法を説明します。
- Arista vEOSの基本的な使い方
- Arista cEOSの基本的な使い方
- Arista cEOS docker-composeを使った操作例
- Arista cEOS docker-topoを使った操作例
- Arista EOSの基本操作 SSHログインが出来るようになるまで
- Arista EOS vxlanの設定紹介
- Arista EOS Layer2 EVPNの設定紹介
- Arista EOS Layer3 EVPNの設定紹介
- Arista EOS Layer3 EVPNとダイナミックルーティングの併用 (いまここ)
- Arista EOS MLAGの設定方法
- Arista EOS 実践的なvxlan設定
- Arista EOS 実践的なLayer2 EVPN設定
- Arista EOS アップリンク二重障害の対応
- Arista EOS 実践的なLayer3 EVPN設定
- Arista EOS 実践的なEVPNとダイナミックルーティング併用例
- Arista EOS ゼロタッチプロビジョニングの設定
構成図
以下の環境で動作確認を行います。leaf01, leaf02がそれぞれisp01とisp02に接続されており、isp01とisp02がそれぞれ疎通可能になるようなシナリオについて考察します
+---------------+
192.168.13.0/24 .3 | spine03 | .3 192.168.23.0/24
+-----------+Lo0:10.3.3.3/32+----------+
| e1 +---------------+ e2 |
| |
e2 | .1 e1 | .2
+-------------+----------------+ +-------------+----------------+
| leaf01 | | leaf02 |
| Lo0:10.1.1.1/32 | | Lo0:10.2.2.2/32 |
| vlan100:192.168.100.254/24 | | vlan100:192.168.200.254/24 |
+-------------+----------------+ +-------------+----------------+
e1 | vlan100 e2 | vlan200
| |
e1 | vlan100 e1 | vlan200
+-------------+----------------+ +-------------+----------------+
| isp01 | | isp02 |
| vlan100:192.168.100.1/24 | | vlan200:192.168.200.2/24 |
| Lo0:10.11.11.11/32 | | Lo0:10.22.22.22/32 |
+------------------------------+ +------------------------------+
初期設定
初期設定時点でisp01のvlan100とisp02のvlan200が互いに疎通可能な状態とします。
isp01のLo0とisp02のLo02は互いに疎通不能で、このLoopback同士が互いに接続可能になるようなダイナミックルーティングの設定について考察します。
動作確認(1) 初期設定の確認
疎通確認
isp01とisp02の間でvlan interface同士は疎通可能であるものの、Loopback同士は疎通不能である事を確認します。
isp01#ping 192.168.200.2 PING 192.168.200.2 (192.168.200.2) 72(100) bytes of data. 80 bytes from 192.168.200.2: icmp_seq=1 ttl=62 time=20.6 ms 80 bytes from 192.168.200.2: icmp_seq=2 ttl=62 time=18.2 ms 80 bytes from 192.168.200.2: icmp_seq=3 ttl=62 time=18.1 ms 80 bytes from 192.168.200.2: icmp_seq=4 ttl=62 time=22.9 ms 80 bytes from 192.168.200.2: icmp_seq=5 ttl=62 time=23.2 ms --- 192.168.200.2 ping statistics --- 5 packets transmitted, 5 received, 0% packet loss, time 60ms rtt min/avg/max/mdev = 18.146/20.636/23.238/2.204 ms, pipe 3, ipg/ewma 15.109/20.787 ms isp01# isp01# isp01#ping 10.22.22.22 PING 10.22.22.22 (10.22.22.22) 72(100) bytes of data. From 192.168.100.101 icmp_seq=1 Destination Net Unreachable --- 10.22.22.22 ping statistics --- 5 packets transmitted, 0 received, +1 errors, 100% packet loss, time 39ms pipe 2 isp01#
ルーティング等の確認
leaf01とleaf02の間でルーティングとMACアドレスを互いに学習している事を確認します。
leaf01#show vxlan address-table
Vxlan Mac Address Table
----------------------------------------------------------------------
VLAN Mac Address Type Prt VTEP Moves Last Move
---- ----------- ---- --- ---- ----- ---------
4094 0050.5607.225b EVPN Vx1 10.2.2.2 1 0:02:12 ago
Total Remote Mac Addresses for this criterion: 1
leaf01#
leaf01#
leaf01#
leaf01#show bgp evpn
BGP routing table information for VRF default
Router identifier 10.1.1.1, local AS number 65000
Route status codes: s - suppressed, * - valid, > - active, E - ECMP head, e - ECMP
S - Stale, c - Contributing to ECMP, b - backup
% - Pending BGP convergence
Origin codes: i - IGP, e - EGP, ? - incomplete
AS Path Attributes: Or-ID - Originator ID, C-LST - Cluster List, LL Nexthop - Link Local Nexthop
Network Next Hop Metric LocPref Weight Path
* > RD: 10.1.1.1:100 mac-ip 000c.2905.9ba5
- - - 0 i
* > RD: 10.1.1.1:100 mac-ip 000c.2905.9ba5 192.168.100.1
- - - 0 i
* > RD: 10.2.2.2:200 mac-ip 0050.56f4.e19e
10.2.2.2 - 100 0 i
* > RD: 10.2.2.2:200 mac-ip 0050.56f4.e19e 192.168.200.2
10.2.2.2 - 100 0 i
* > RD: 10.1.1.1:100 mac-ip 5555.5555.5555
- - - 0 i
* > RD: 10.2.2.2:200 mac-ip 5555.5555.5555
10.2.2.2 - 100 0 i
* > RD: 10.1.1.1:100 imet 10.1.1.1
- - - 0 i
* > RD: 10.2.2.2:200 imet 10.2.2.2
10.2.2.2 - 100 0 i
* > RD: 10.1.1.1:9999 ip-prefix 192.168.100.0/24
- - - 0 i
* > RD: 10.2.2.2:9999 ip-prefix 192.168.200.0/24
10.2.2.2 - 100 0 i
leaf01#
leaf01#
leaf01#
leaf01#show bgp evpn
BGP routing table information for VRF default
Router identifier 10.1.1.1, local AS number 65000
Route status codes: s - suppressed, * - valid, > - active, E - ECMP head, e - ECMP
S - Stale, c - Contributing to ECMP, b - backup
% - Pending BGP convergence
Origin codes: i - IGP, e - EGP, ? - incomplete
AS Path Attributes: Or-ID - Originator ID, C-LST - Cluster List, LL Nexthop - Link Local Nexthop
Network Next Hop Metric LocPref Weight Path
* > RD: 10.1.1.1:100 mac-ip 000c.2905.9ba5
- - - 0 i
* > RD: 10.1.1.1:100 mac-ip 000c.2905.9ba5 192.168.100.1
- - - 0 i
* > RD: 10.2.2.2:200 mac-ip 0050.56f4.e19e
10.2.2.2 - 100 0 i
* > RD: 10.2.2.2:200 mac-ip 0050.56f4.e19e 192.168.200.2
10.2.2.2 - 100 0 i
* > RD: 10.1.1.1:100 mac-ip 5555.5555.5555
- - - 0 i
* > RD: 10.2.2.2:200 mac-ip 5555.5555.5555
10.2.2.2 - 100 0 i
* > RD: 10.1.1.1:100 imet 10.1.1.1
- - - 0 i
* > RD: 10.2.2.2:200 imet 10.2.2.2
10.2.2.2 - 100 0 i
* > RD: 10.1.1.1:9999 ip-prefix 192.168.100.0/24
- - - 0 i
* > RD: 10.2.2.2:9999 ip-prefix 192.168.200.0/24
10.2.2.2 - 100 0 i
leaf01#
動作確認(2) OSPFによる接続例
OSPFの設定
isp01とleaf01の間でOSPFを設定します。
# ips01 router ospf 1 network 10.11.11.11/32 area 0.0.0.0 network 192.168.100.0/24 area 0.0.0.0 # leaf01 router ospf 2 vrf GATEWAY redistribute bgp network 192.168.100.0/24 area 0.0.0.0
isp01とleaf01の間でOSPF neighborが確立された事を確認します。
leaf01#show ip ospf neighbor vrf GATEWAY Neighbor ID Instance VRF Pri State Dead Time Address Interface 10.11.11.11 2 GATEWAY 1 FULL/DR 00:00:37 192.168.100.1 Vlan100
leaf01でOSPFとBGPの再配送を行います。
# leaf01
router ospf 2 vrf GATEWAY
redistribute bgp
!
router bgp 65000
vrf GATEWAY
redistribute ospf
isp01がleaf02のプレフィックス(192.168.200.0/24)を学習している事を確認します。
isp01#show ip route
VRF: default
Codes: C - connected, S - static, K - kernel,
O - OSPF, IA - OSPF inter area, E1 - OSPF external type 1,
E2 - OSPF external type 2, N1 - OSPF NSSA external type 1,
N2 - OSPF NSSA external type2, B - BGP, B I - iBGP, B E - eBGP,
R - RIP, I L1 - IS-IS level 1, I L2 - IS-IS level 2,
O3 - OSPFv3, A B - BGP Aggregate, A O - OSPF Summary,
NG - Nexthop Group Static Route, V - VXLAN Control Service,
DH - DHCP client installed default route, M - Martian,
DP - Dynamic Policy Route, L - VRF Leaked,
RC - Route Cache Route
Gateway of last resort:
S 0.0.0.0/0 [1/0] via 192.168.100.254, Vlan100
C 10.11.11.11/32 is directly connected, Loopback0
C 192.168.100.0/24 is directly connected, Vlan100
O E2 192.168.200.0/24 [110/1] via 192.168.100.101, Vlan100
isp01#
leaf02がisp01のプレフィックス(10.11.11.11/32)を学習している事を確認します。
leaf02#show ip route vrf GATEWAY
VRF: GATEWAY
Codes: C - connected, S - static, K - kernel,
O - OSPF, IA - OSPF inter area, E1 - OSPF external type 1,
E2 - OSPF external type 2, N1 - OSPF NSSA external type 1,
N2 - OSPF NSSA external type2, B - BGP, B I - iBGP, B E - eBGP,
R - RIP, I L1 - IS-IS level 1, I L2 - IS-IS level 2,
O3 - OSPFv3, A B - BGP Aggregate, A O - OSPF Summary,
NG - Nexthop Group Static Route, V - VXLAN Control Service,
DH - DHCP client installed default route, M - Martian,
DP - Dynamic Policy Route, L - VRF Leaked,
RC - Route Cache Route
Gateway of last resort is not set
B I 10.11.11.11/32 [200/0] via VTEP 10.1.1.1 VNI 9999 router-mac 00:50:56:96:2a:5a
B I 192.168.100.1/32 [200/0] via VTEP 10.1.1.1 VNI 9999 router-mac 00:50:56:96:2a:5a
B I 192.168.100.0/24 [200/0] via VTEP 10.1.1.1 VNI 9999 router-mac 00:50:56:96:2a:5a
C 192.168.200.0/24 is directly connected, Vlan200
leaf02#
疎通確認
isp02からisp01 Loopback0への疎通が可能になった事を確認します。
isp02#ping 10.11.11.11 PING 10.11.11.11 (10.11.11.11) 72(100) bytes of data. 80 bytes from 10.11.11.11: icmp_seq=1 ttl=62 time=37.6 ms 80 bytes from 10.11.11.11: icmp_seq=2 ttl=62 time=29.0 ms 80 bytes from 10.11.11.11: icmp_seq=3 ttl=62 time=22.0 ms 80 bytes from 10.11.11.11: icmp_seq=4 ttl=62 time=15.1 ms 80 bytes from 10.11.11.11: icmp_seq=5 ttl=62 time=15.1 ms --- 10.11.11.11 ping statistics --- 5 packets transmitted, 5 received, 0% packet loss, time 62ms rtt min/avg/max/mdev = 15.111/23.817/37.637/8.629 ms, pipe 4, ipg/ewma 15.665/30.159 ms isp02#
動作確認(3) BGPによる接続例
BGPの設定
isp02とleaf02の間でOSPFを設定します。
# ips02
router bgp 65000
timers bgp 10 30
neighbor 192.168.200.102 remote-as 65000
network 10.22.22.22/32
# leaf02
router bgp 65000
timers bgp 10 30
vrf GATEWAY
neighbor 192.168.200.2 remote-as 65000
address-family ipv4
neighbor 192.168.200.2 activate
isp01とleaf01の間でBGP neighborが確立された事を確認します。
leaf02#show ip bgp sum vrf GATEWAY BGP summary information for VRF GATEWAY Router identifier 192.168.200.102, local AS number 65000 Neighbor Status Codes: m - Under maintenance Neighbor V AS MsgRcvd MsgSent InQ OutQ Up/Down State PfxRcd PfxAcc 192.168.200.2 4 65000 7 7 0 0 00:00:18 Estab 1 1 leaf02#
leaf01, leaf02, isp02は共にiBGP neighborです。そのため、スプリットホライズンの原則が働き、互いに経路を交換しません。スプリットホライズンを打ち消すようroute reflectorを設定します。
router bgp 65000
neighbor 10.1.1.1 route-reflector-client
vrf GATEWAY
neighbor 192.168.200.2 route-reflector-client
leaf01がisp02のプレフィックス(10.22.22.22/32)を学習している事を確認します。
leaf01#show ip route vrf GATEWAY
VRF: GATEWAY
Codes: C - connected, S - static, K - kernel,
O - OSPF, IA - OSPF inter area, E1 - OSPF external type 1,
E2 - OSPF external type 2, N1 - OSPF NSSA external type 1,
N2 - OSPF NSSA external type2, B - BGP, B I - iBGP, B E - eBGP,
R - RIP, I L1 - IS-IS level 1, I L2 - IS-IS level 2,
O3 - OSPFv3, A B - BGP Aggregate, A O - OSPF Summary,
NG - Nexthop Group Static Route, V - VXLAN Control Service,
DH - DHCP client installed default route, M - Martian,
DP - Dynamic Policy Route, L - VRF Leaked,
RC - Route Cache Route
Gateway of last resort is not set
O 10.11.11.11/32 [110/20] via 192.168.100.1, Vlan100
B I 10.22.22.22/32 [200/0] via VTEP 10.2.2.2 VNI 9999 router-mac 00:50:56:07:22:5b
C 192.168.100.0/24 is directly connected, Vlan100
B I 192.168.200.2/32 [200/0] via VTEP 10.2.2.2 VNI 9999 router-mac 00:50:56:07:22:5b
B I 192.168.200.0/24 [200/0] via VTEP 10.2.2.2 VNI 9999 router-mac 00:50:56:07:22:5b
leaf01#
isp02がleaf01のプレフィックス(192.168.100.0/24)を学習している事を確認します。
isp02#show ip route
VRF: default
Codes: C - connected, S - static, K - kernel,
O - OSPF, IA - OSPF inter area, E1 - OSPF external type 1,
E2 - OSPF external type 2, N1 - OSPF NSSA external type 1,
N2 - OSPF NSSA external type2, B - BGP, B I - iBGP, B E - eBGP,
R - RIP, I L1 - IS-IS level 1, I L2 - IS-IS level 2,
O3 - OSPFv3, A B - BGP Aggregate, A O - OSPF Summary,
NG - Nexthop Group Static Route, V - VXLAN Control Service,
DH - DHCP client installed default route, M - Martian,
DP - Dynamic Policy Route, L - VRF Leaked,
RC - Route Cache Route
Gateway of last resort:
S 0.0.0.0/0 [1/0] via 192.168.200.254, Vlan200
B I 10.11.11.11/32 [200/0] via 192.168.200.102, Vlan200
C 10.22.22.22/32 is directly connected, Loopback0
B I 192.168.100.1/32 [200/0] via 192.168.200.102, Vlan200
B I 192.168.100.0/24 [200/0] via 192.168.200.102, Vlan200
C 192.168.200.0/24 is directly connected, Vlan200
isp02#
疎通確認
isp01とisp02が互いにLoopback同士で疎通可能になった事を確認します。
isp01#ping 10.22.22.22 source Lo0 PING 10.22.22.22 (10.22.22.22) from 10.11.11.11 : 72(100) bytes of data. 80 bytes from 10.22.22.22: icmp_seq=1 ttl=62 time=15.2 ms 80 bytes from 10.22.22.22: icmp_seq=2 ttl=62 time=14.2 ms 80 bytes from 10.22.22.22: icmp_seq=3 ttl=62 time=11.3 ms 80 bytes from 10.22.22.22: icmp_seq=4 ttl=62 time=11.3 ms 80 bytes from 10.22.22.22: icmp_seq=5 ttl=62 time=11.8 ms --- 10.22.22.22 ping statistics --- 5 packets transmitted, 5 received, 0% packet loss, time 54ms rtt min/avg/max/mdev = 11.314/12.812/15.279/1.647 ms, pipe 2, ipg/ewma 13.527/13.957 ms isp01#
