Arista EOSでLayer2 EVPNを設定する方法を説明します。「Arista EOS vxlanの設定紹介」で紹介した手法はvxlanの宛先をstaticに設定する必要がありますが、EVPNを使えばvxlanの宛先をBGP communityを用いて動的に変化させる事ができます。
- Arista vEOSの基本的な使い方
- Arista cEOSの基本的な使い方
- Arista cEOS docker-composeを使った操作例
- Arista cEOS docker-topoを使った操作例
- Arista EOSの基本操作 SSHログインが出来るようになるまで
- Arista EOS vxlanの設定紹介
- Arista EOS Layer2 EVPNの設定紹介 (いまここ)
- Arista EOS Layer3 EVPNの設定紹介
- Arista EOS Layer3 EVPNとダイナミックルーティングの併用
- Arista EOS MLAGの設定方法
- Arista EOS 実践的なvxlan設定
- Arista EOS 実践的なLayer2 EVPN設定
- Arista EOS アップリンク二重障害の対応
- Arista EOS 実践的なLayer3 EVPN設定
- Arista EOS 実践的なEVPNとダイナミックルーティング併用例
- Arista EOS ゼロタッチプロビジョニングの設定
構成図
以下の環境で動作確認を行います。
+---------------+ 192.168.13.0/24 .3 | spine03 | .3 192.168.23.0/24 +-----------+Lo0:10.3.3.3/32+----+ | e1 +---------------+ e2 | | | e2 | .1 e1 | .2 +-------+-------+ +-------+-------+ | leaf01 | | leaf02 | |Lo0:10.1.1.1/32| |Lo0:10.2.2.2/32| +-------+-------+ +-------+-------+ e1 | vlan100 e2 | vlan100 | | | 192.168.100.0/24 | 192.168.100.0/24 | | e1 | .1 e1 | .2 +-------+-------+ +-------+-------+ | host01 | | host02 | +---------------+ +---------------+
初期設定
初期設定はIPアドレスのみです。この状態からEVPNに必要な設定を投入していきます。
動作確認
アンダーレイネットワークの構築
以下の設定を投入し、leaf01, spine03, leaf02間が互いに疎通可能にあるようにします。「Arista EOS vxlanの設定紹介」にて紹介した設定と全く同じ設定を入れます。
# leaf01 ip routing router ospf 1 network 10.1.1.1/32 area 0.0.0.0 network 192.168.13.0/24 area 0.0.0.0 # spine03 ip routing router ospf 1 network 10.3.3.3/32 area 0.0.0.0 network 192.168.13.0/24 area 0.0.0.0 network 192.168.23.0/24 area 0.0.0.0 # leaf02 ip routing router ospf 1 network 10.2.2.2/32 area 0.0.0.0 network 192.168.23.0/24 area 0.0.0.0
leaf01とleaf02の間が互いに疎通可能である事を確認します。
leaf01#show ip route ospf VRF: default Codes: C - connected, S - static, K - kernel, O - OSPF, IA - OSPF inter area, E1 - OSPF external type 1, E2 - OSPF external type 2, N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type2, B - BGP, B I - iBGP, B E - eBGP, R - RIP, I L1 - IS-IS level 1, I L2 - IS-IS level 2, O3 - OSPFv3, A B - BGP Aggregate, A O - OSPF Summary, NG - Nexthop Group Static Route, V - VXLAN Control Service, DH - DHCP client installed default route, M - Martian, DP - Dynamic Policy Route, L - VRF Leaked, RC - Route Cache Route O 10.2.2.2/32 [110/30] via 192.168.13.3, Ethernet2 O 10.3.3.3/32 [110/20] via 192.168.13.3, Ethernet2 O 192.168.23.0/24 [110/20] via 192.168.13.3, Ethernet2 leaf01# leaf01#ping 10.2.2.2 source Loopback0 PING 10.2.2.2 (10.2.2.2) from 10.1.1.1 : 72(100) bytes of data. 80 bytes from 10.2.2.2: icmp_seq=1 ttl=63 time=4.64 ms 80 bytes from 10.2.2.2: icmp_seq=2 ttl=63 time=2.49 ms 80 bytes from 10.2.2.2: icmp_seq=3 ttl=63 time=3.72 ms 80 bytes from 10.2.2.2: icmp_seq=4 ttl=63 time=2.68 ms 80 bytes from 10.2.2.2: icmp_seq=5 ttl=63 time=2.36 ms --- 10.2.2.2 ping statistics --- 5 packets transmitted, 5 received, 0% packet loss, time 17ms rtt min/avg/max/mdev = 2.367/3.181/4.641/0.875 ms, ipg/ewma 4.367/3.875 ms leaf01#
VXLANの設定
leaf01, leaf02にvxlanの設定を入れます。「Arista EOS vxlanの設定紹介」と異なり、vxlan floot vtepコマンドでトンネルの宛先をstaticに設定しない事に注意ください。トンネルの宛先はEVPNによって動的に取得します。
# leaf01 interface Vxlan1 vxlan source-interface Loopback0 vxlan vlan 100 vni 90100 # leaf02 interface Vxlan1 vxlan source-interface Loopback0 vxlan vlan 100 vni 90100
この時点ではinterface vxlanはdown状態です。EVPNの設定が完了次第、interfaceがupに変わります。
leaf01#show interfaces vxlan 1 Vxlan1 is down, line protocol is down (notconnect) Hardware is Vxlan Source interface is Loopback0 and is active with 10.1.1.1 Replication/Flood Mode is not initialized yet Remote MAC learning via Datapath VNI mapping to VLANs Static VLAN to VNI mapping is [100, 90100] Note: All Dynamic VLANs used by VCS are internal VLANs. Use 'show vxlan vni' for details. Static VRF to VNI mapping is not configured MLAG Shared Router MAC is 0000.0000.0000 leaf01#
routing protocols model multi-agent
EVPNを使用するには「routing protocols model multi-agent」という機能を有効にする必要があります。もし、有効にしていない場合は以下のような警告が表示されます。
また、「routing protocols model multi-agent」の有効化設定を反映するには再起動が必要です。
leaf02(config)#router bgp 65000 leaf02(config-router-bgp)#no bgp default ipv4-unicast leaf02(config-router-bgp)#address-family evpn ! Routing protocols model multi-agent must be configured for EVPN address-family leaf02(config-router-bgp-af)#exit leaf02(config-router-bgp)#exit leaf02(config)#service routing protocols model multi-agent ! Change will take effect only after switch reboot leaf02(config)#
leaf01, leaf02に対し「routing protocols model multi-agent」を有効にします。設定反映には再起動が必要である事に留意ください。
# leaf01 service routing protocols model multi-agent # leaf02 service routing protocols model multi-agent
bgp address-family evpn
leaf01とleaf02の間でbgp address-family evpn neighborを確立します。
# leaf01 router bgp 65000 no bgp default ipv4-unicast timers bgp 10 30 neighbor 10.2.2.2 remote-as 65000 neighbor 10.2.2.2 update-source Loopback0 neighbor 10.2.2.2 send-community ! vlan 100 rd 10.1.1.1:100 route-target both 100:90100 redistribute learned ! address-family evpn neighbor 10.2.2.2 activate # leaf02 router bgp 65000 no bgp default ipv4-unicast timers bgp 10 30 neighbor 10.1.1.1 remote-as 65000 neighbor 10.1.1.1 update-source Loopback0 neighbor 10.1.1.1 send-community ! vlan 100 rd 10.2.2.2:100 route-target both 100:90100 redistribute learned ! address-family evpn neighbor 10.1.1.1 activate
BGP neighborがEstabの状態になった事を確認します。
leaf01#show bgp evpn summary BGP summary information for VRF default Router identifier 10.1.1.1, local AS number 65000 Neighbor Status Codes: m - Under maintenance Neighbor V AS MsgRcvd MsgSent InQ OutQ Up/Down State PfxRcd PfxAcc 10.2.2.2 4 65000 41 41 0 0 00:05:01 Estab 1 1 leaf01#
show bgp evpn detailコマンドを使用すると、MACアドレステーブルがBGP拡張コミュニティのルートターゲット100:90100にて、情報が授受されている事を確認できます。通常、ここまでの確認は不要かと思いますが、トラブルシュートの時はこのコマンドを使用してみるのも良いでしょう。
leaf01#show bgp evpn detail BGP routing table information for VRF default Router identifier 10.1.1.1, local AS number 65000 BGP routing table entry for mac-ip 5555.5555.5555, Route Distinguisher: 10.1.1.1:100 Paths: 1 available Local - from - (0.0.0.0) Origin IGP, metric -, localpref -, weight 0, valid, local, best Extended Community: Route-Target-AS:100:90100 TunnelEncap:tunnelTypeVxlan VNI: 90100 ESI: 0000:0000:0000:0000:0000 <omitted>
最低でも1つのMACアドレスが授受される状態になると、interface vxlan 1はup状態に変わります。
このシナリオではstaticにvtepの宛先を指定してないので、「Static VRF to VNI mapping is not configured」と表示されています。
また、EVPNによって対向の10.2.2.2を認識しましたので、「Headend replication flood vtep list is」に「10.2.2.2」と表示されています。
leaf01#show interfaces vxlan 1 Vxlan1 is up, line protocol is up (connected) Hardware is Vxlan Source interface is Loopback0 and is active with 10.1.1.1 Replication/Flood Mode is headend with Flood List Source: EVPN Remote MAC learning via EVPN VNI mapping to VLANs Static VLAN to VNI mapping is [100, 90100] Note: All Dynamic VLANs used by VCS are internal VLANs. Use 'show vxlan vni' for details. Static VRF to VNI mapping is not configured Headend replication flood vtep list is: 100 10.2.2.2 MLAG Shared Router MAC is 0000.0000.0000
疎通確認
host01からhost02への疎通を確認します。
host01#ping 192.168.100.2 PING 192.168.100.2 (192.168.100.2) 72(100) bytes of data. 80 bytes from 192.168.100.2: icmp_seq=1 ttl=64 time=28.3 ms 80 bytes from 192.168.100.2: icmp_seq=2 ttl=64 time=19.7 ms 80 bytes from 192.168.100.2: icmp_seq=3 ttl=64 time=11.6 ms 80 bytes from 192.168.100.2: icmp_seq=4 ttl=64 time=19.4 ms 80 bytes from 192.168.100.2: icmp_seq=5 ttl=64 time=18.2 ms --- 192.168.100.2 ping statistics --- 5 packets transmitted, 5 received, 0% packet loss, time 71ms rtt min/avg/max/mdev = 11.621/19.484/28.356/5.331 ms, pipe 3, ipg/ewma 17.882/23.796 ms host01#
pingによる疎通確認直後に以下のコマンドをleaf01やleaf02で実行すると、vxlanが管理しているMacアドレステーブルを確認する事ができます。
leaf01#show vxlan address-table Vxlan Mac Address Table ---------------------------------------------------------------------- VLAN Mac Address Type Prt VTEP Moves Last Move ---- ----------- ---- --- ---- ----- --------- 100 0050.56f4.e19e EVPN Vx1 10.2.2.2 1 0:00:25 ago Total Remote Mac Addresses for this criterion: 1 leaf01#
EVPNによって授受されたMACアドレスは以下のコマンドで確認します。
leaf01#show bgp evpn BGP routing table information for VRF default Router identifier 10.1.1.1, local AS number 65000 Route status codes: s - suppressed, * - valid, > - active, E - ECMP head, e - ECMP S - Stale, c - Contributing to ECMP, b - backup % - Pending BGP convergence Origin codes: i - IGP, e - EGP, ? - incomplete AS Path Attributes: Or-ID - Originator ID, C-LST - Cluster List, LL Nexthop - Link Local Nexthop Network Next Hop Metric LocPref Weight Path * > RD: 10.1.1.1:100 mac-ip 000c.2905.9ba5 - - - 0 i * > RD: 10.2.2.2:100 mac-ip 0050.56f4.e19e 10.2.2.2 - 100 0 i * > RD: 10.1.1.1:100 mac-ip 5555.5555.5555 - - - 0 i * > RD: 10.1.1.1:100 imet 10.1.1.1 - - - 0 i * > RD: 10.2.2.2:100 imet 10.2.2.2 10.2.2.2 - 100 0 i leaf01#
パケットキャプチャ
この通信をleaf01/spine03間でパケットキャプチャすると以下のようになります。
host01からhost02へのARP requestを送る前に、leaf01配下にhost01が居る事を伝えるBGP updateを送っている事が分かります。
20 22.475148 10.1.1.1 10.2.2.2 BGP 170 UPDATE Message 21 22.475350 VMware_05:9b:a5 Broadcast ARP 110 Who has 192.168.100.2? Tell 192.168.100.1 22 22.481529 10.2.2.2 10.1.1.1 TCP 66 179 → 38555 [ACK] Seq=58 Ack=162 Win=226 Len=0 TSval=310369 TSecr=304146 23 22.493724 10.2.2.2 10.1.1.1 BGP 170 UPDATE Message 24 22.493818 VMware_f4:e1:9e VMware_05:9b:a5 ARP 110 192.168.100.2 is at 00:50:56:f4:e1:9e 25 22.495288 10.1.1.1 10.2.2.2 TCP 66 38555 → 179 [ACK] Seq=162 Ack=162 Win=228 Len=0 TSval=304151 TSecr=310372 26 22.502994 192.168.100.1 192.168.100.2 ICMP 164 Echo (ping) request id=0x0c21, seq=1/256, ttl=64 (reply in 31) 27 22.503114 192.168.100.1 192.168.100.2 ICMP 164 Echo (ping) request id=0x0c21, seq=2/512, ttl=64 (reply in 32) 28 22.505353 192.168.100.1 192.168.100.2 ICMP 164 Echo (ping) request id=0x0c21, seq=3/768, ttl=64 (reply in 33) 29 22.505470 192.168.100.1 192.168.100.2 ICMP 164 Echo (ping) request id=0x0c21, seq=4/1024, ttl=64 (reply in 34) 30 22.508540 192.168.100.1 192.168.100.2 ICMP 164 Echo (ping) request id=0x0c21, seq=5/1280, ttl=64 (reply in 35) 31 22.516073 192.168.100.2 192.168.100.1 ICMP 164 Echo (ping) reply id=0x0c21, seq=1/256, ttl=64 (request in 26) 32 22.516214 192.168.100.2 192.168.100.1 ICMP 164 Echo (ping) reply id=0x0c21, seq=2/512, ttl=64 (request in 27) 33 22.519617 192.168.100.2 192.168.100.1 ICMP 164 Echo (ping) reply id=0x0c21, seq=3/768, ttl=64 (request in 28) 34 22.519733 192.168.100.2 192.168.100.1 ICMP 164 Echo (ping) reply id=0x0c21, seq=4/1024, ttl=64 (request in 29) 35 22.520379 192.168.100.2 192.168.100.1 ICMP 164 Echo (ping) reply id=0x0c21, seq=5/1280, ttl=64 (request in 30)
host01のMACアドレス00:0c:29:05:9b:a5を通知している様子が読み取れます。通知したMACアドレスがどのvlan, vniとマッピングすれば良いか分かるように、併せてroute-target 100:90100も通知されています。
No. Time Source Destination Protocol Length Info 20 22.475148 10.1.1.1 10.2.2.2 BGP 170 UPDATE Message Frame 20: 170 bytes on wire (1360 bits), 170 bytes captured (1360 bits) Ethernet II, Src: VMware_96:2a:5a (00:50:56:96:2a:5a), Dst: VMware_48:69:be (00:50:56:48:69:be) Internet Protocol Version 4, Src: 10.1.1.1, Dst: 10.2.2.2 Transmission Control Protocol, Src Port: 38555, Dst Port: 179, Seq: 58, Ack: 58, Len: 104 Border Gateway Protocol - UPDATE Message Marker: ffffffffffffffffffffffffffffffff Length: 104 Type: UPDATE Message (2) Withdrawn Routes Length: 0 Total Path Attribute Length: 81 Path attributes Path Attribute - ORIGIN: IGP Flags: 0x40, Transitive, Well-known, Complete Type Code: ORIGIN (1) Length: 1 Origin: IGP (0) Path Attribute - AS_PATH: empty Flags: 0x40, Transitive, Well-known, Complete Type Code: AS_PATH (2) Length: 0 Path Attribute - LOCAL_PREF: 100 Flags: 0x40, Transitive, Well-known, Complete Type Code: LOCAL_PREF (5) Length: 4 Local preference: 100 Path Attribute - MP_REACH_NLRI Flags: 0x90, Optional, Extended-Length, Non-transitive, Complete Type Code: MP_REACH_NLRI (14) Length: 44 Address family identifier (AFI): Layer-2 VPN (25) Subsequent address family identifier (SAFI): EVPN (70) Next hop network address (4 bytes) Number of Subnetwork points of attachment (SNPA): 0 Network layer reachability information (35 bytes) EVPN NLRI: MAC Advertisement Route Route Type: MAC Advertisement Route (2) Length: 33 Route Distinguisher: 00010a0101010064 (10.1.1.1:100) ESI: 00:00:00:00:00:00:00:00:00:00 Ethernet Tag ID: 0 MAC Address Length: 48 MAC Address: VMware_05:9b:a5 (00:0c:29:05:9b:a5) IP Address Length: 0 IP Address: NOT INCLUDED 0000 0001 0101 1111 1111 .... = MPLS Label 1: 5631 Path Attribute - EXTENDED_COMMUNITIES Flags: 0xc0, Optional, Transitive, Complete Type Code: EXTENDED_COMMUNITIES (16) Length: 16 Carried extended communities: (2 communities) Route Target: 100:90100 [Transitive 2-Octet AS-Specific] Encapsulation: VXLAN Encapsulation [Transitive Opaque]
BGP updateの後に、vxlanでカプセル化されたARP requestが観測されます。
No. Time Source Destination Protocol Length Info 21 22.475350 VMware_05:9b:a5 Broadcast ARP 110 Who has 192.168.100.2? Tell 192.168.100.1 Frame 21: 110 bytes on wire (880 bits), 110 bytes captured (880 bits) Ethernet II, Src: VMware_96:2a:5a (00:50:56:96:2a:5a), Dst: VMware_48:69:be (00:50:56:48:69:be) Internet Protocol Version 4, Src: 10.1.1.1, Dst: 10.2.2.2 User Datagram Protocol, Src Port: 19795, Dst Port: 4789 Virtual eXtensible Local Area Network Ethernet II, Src: VMware_05:9b:a5 (00:0c:29:05:9b:a5), Dst: Broadcast (ff:ff:ff:ff:ff:ff) Address Resolution Protocol (request)