Arista EOSにおける実践的なLayer2 EVPNの設定を紹介します。冗長性かつActive/Active構成にするにはMLAGとVXLANを併用する必要があります。この構成を採用するためには、MLAGピア同士でIPアドレスを重複させたLoopbackアドレスを持たせる必要があります。
- Arista vEOSの基本的な使い方
- Arista cEOSの基本的な使い方
- Arista cEOS docker-composeを使った操作例
- Arista cEOS docker-topoを使った操作例
- Arista EOSの基本操作 SSHログインが出来るようになるまで
- Arista EOS vxlanの設定紹介
- Arista EOS Layer2 EVPNの設定紹介
- Arista EOS Layer3 EVPNの設定紹介
- Arista EOS Layer3 EVPNとダイナミックルーティングの併用
- Arista EOS MLAGの設定方法
- Arista EOS 実践的なvxlan設定
- Arista EOS 実践的なLayer2 EVPN設定 (いまここ)
- Arista EOS アップリンク二重障害の対応
- Arista EOS 実践的なLayer3 EVPN設定
- Arista EOS 実践的なEVPNとダイナミックルーティング併用例
- Arista EOS ゼロタッチプロビジョニングの設定
構成図
以下の環境で動作確認を行います。
初期設定
初期設定はIPアドレスのみです。
動作確認
MLAGの設定
leaf01とleaf02、leaf03とleaf04でMLAGを構成します。
# leaf01 vlan 12 interface Vlan12 ip address 192.168.12.1/24 mlag configuration domain-id domain12 local-interface Vlan12 peer-address 192.168.12.2 peer-link Ethernet3 # leaf02 vlan 12 interface Vlan12 ip address 192.168.12.2/24 mlag configuration domain-id domain12 local-interface Vlan12 peer-address 192.168.12.1 peer-link Ethernet3 # leaf03 vlan 34 interface Vlan34 ip address 192.168.34.3/24 mlag configuration domain-id domain34 local-interface Vlan34 peer-address 192.168.34.4 peer-link Ethernet3 # leaf04 vlan 34 interface Vlan34 ip address 192.168.34.4/24 mlag configuration domain-id domain34 local-interface Vlan34 peer-address 192.168.34.3 peer-link Ethernet3
MLAGがUP状態である事を確認します。
leaf01#show mlag
MLAG Configuration:
domain-id : domain12
local-interface : Vlan12
peer-address : 192.168.12.2
peer-link : Ethernet3
peer-config : consistent
MLAG Status:
state : Active
negotiation status : Connected
peer-link status : Up
local-int status : Up
system-id : 02:50:56:03:94:09
dual-primary detection : Disabled
dual-primary interface errdisabled : False
MLAG Ports:
Disabled : 0
Configured : 0
Inactive : 0
Active-partial : 0
Active-full : 0
leaf01#
leaf04#show mlag
MLAG Configuration:
domain-id : domain34
local-interface : Vlan34
peer-address : 192.168.34.3
peer-link : Ethernet3
peer-config : consistent
MLAG Status:
state : Active
negotiation status : Connected
peer-link status : Up
local-int status : Up
system-id : 02:50:56:9e:a4:3a
dual-primary detection : Disabled
dual-primary interface errdisabled : False
MLAG Ports:
Disabled : 0
Configured : 0
Inactive : 0
Active-partial : 0
Active-full : 1
leaf04#
LAGの作成
リーフスイッチとホストの間でLAGを構成します。
# leaf01, leaf02, leaf03, leaf04 interface Ethernet4 switchport mode trunk channel-group 4 mode on interface Port-Channel4 switchport mode trunk mlag 4 # host07, host08 interface Ethernet1,2 switchport mode trunk channel-group 12 mode on interface Port-Channel12 switchport mode trunk
LAGがUP状態である事を確認します。
leaf01#show port-channel summary
Flags
------------------------ ---------------------------- -------------------------
a - LACP Active p - LACP Passive * - static fallback
F - Fallback enabled f - Fallback configured ^ - individual fallback
U - In Use D - Down
+ - In-Sync - - Out-of-Sync i - incompatible with agg
P - bundled in Po s - suspended G - Aggregable
I - Individual S - ShortTimeout w - wait for agg
E - Inactive. The number of configured port channels exceeds the config limit
Number of channels in use: 1
Number of aggregators: 1
Port-Channel Protocol Ports
------------------ -------------- ---------------
Po4(U) Static Et4(P) PEt4(P)
leaf01#
leaf03#show port-channel summary
Flags
------------------------ ---------------------------- -------------------------
a - LACP Active p - LACP Passive * - static fallback
F - Fallback enabled f - Fallback configured ^ - individual fallback
U - In Use D - Down
+ - In-Sync - - Out-of-Sync i - incompatible with agg
P - bundled in Po s - suspended G - Aggregable
I - Individual S - ShortTimeout w - wait for agg
E - Inactive. The number of configured port channels exceeds the config limit
Number of channels in use: 1
Number of aggregators: 1
Port-Channel Protocol Ports
------------------ -------------- ---------------
Po4(U) Static Et4(P) PEt4(P)
leaf03#
アンダーレイのルーティング
リーフ/スパイン間のルーティングを設定します。Active/Activeの通信経路になるよう、maximum-pathsも忘れずに設定します。
# leaf01 ip routing router bgp 65000 timers bgp 10 30 maximum-paths 8 ecmp 16 neighbor 192.168.15.5 remote-as 65000 neighbor 192.168.16.6 remote-as 65000 network 10.1.1.1/32 # leaf02 ip routing router bgp 65000 timers bgp 10 30 maximum-paths 8 ecmp 16 neighbor 192.168.25.5 remote-as 65000 neighbor 192.168.26.6 remote-as 65000 network 10.2.2.2/32 # leaf03 ip routing router bgp 65000 timers bgp 10 30 maximum-paths 8 ecmp 16 neighbor 192.168.35.5 remote-as 65000 neighbor 192.168.36.6 remote-as 65000 network 10.3.3.3/32 # leaf04 ip routing router bgp 65000 timers bgp 10 30 maximum-paths 8 ecmp 16 neighbor 192.168.45.5 remote-as 65000 neighbor 192.168.46.6 remote-as 65000 network 10.4.4.4/32 # spine05 ip routing router bgp 65000 timers bgp 10 30 maximum-paths 8 ecmp 16 neighbor 192.168.15.1 remote-as 65000 neighbor 192.168.15.1 route-reflector-client neighbor 192.168.25.2 remote-as 65000 neighbor 192.168.25.2 route-reflector-client neighbor 192.168.35.3 remote-as 65000 neighbor 192.168.35.3 route-reflector-client neighbor 192.168.45.4 remote-as 65000 neighbor 192.168.45.4 route-reflector-client network 192.168.15.0/24 network 192.168.25.0/24 network 192.168.35.0/24 network 192.168.45.0/24 network 10.5.5.5/32 # spine06 ip routing router bgp 65000 timers bgp 10 30 maximum-paths 8 ecmp 16 neighbor 192.168.16.1 remote-as 65000 neighbor 192.168.16.1 route-reflector-client neighbor 192.168.26.2 remote-as 65000 neighbor 192.168.26.2 route-reflector-client neighbor 192.168.36.3 remote-as 65000 neighbor 192.168.36.3 route-reflector-client neighbor 192.168.46.4 remote-as 65000 neighbor 192.168.46.4 route-reflector-client network 192.168.16.0/24 network 192.168.26.0/24 network 192.168.36.0/24 network 192.168.46.0/24 network 10.6.6.6/32
leaf01,leaf02,leaf03,leaf04の間で互いに経路を交換できている事を確認します。また、Active/Activeの通信経路になっている事を確認します。
leaf01#show ip route bgp
VRF: default
Codes: C - connected, S - static, K - kernel,
O - OSPF, IA - OSPF inter area, E1 - OSPF external type 1,
E2 - OSPF external type 2, N1 - OSPF NSSA external type 1,
N2 - OSPF NSSA external type2, B - BGP, B I - iBGP, B E - eBGP,
R - RIP, I L1 - IS-IS level 1, I L2 - IS-IS level 2,
O3 - OSPFv3, A B - BGP Aggregate, A O - OSPF Summary,
NG - Nexthop Group Static Route, V - VXLAN Control Service,
DH - DHCP client installed default route, M - Martian,
DP - Dynamic Policy Route, L - VRF Leaked,
RC - Route Cache Route
B I 10.2.2.2/32 [200/0] via 192.168.15.5, Ethernet1
via 192.168.16.6, Ethernet2
B I 10.3.3.3/32 [200/0] via 192.168.15.5, Ethernet1
via 192.168.16.6, Ethernet2
B I 10.4.4.4/32 [200/0] via 192.168.15.5, Ethernet1
via 192.168.16.6, Ethernet2
B I 10.5.5.5/32 [200/0] via 192.168.15.5, Ethernet1
B I 10.6.6.6/32 [200/0] via 192.168.16.6, Ethernet2
B I 192.168.25.0/24 [200/0] via 192.168.15.5, Ethernet1
B I 192.168.26.0/24 [200/0] via 192.168.16.6, Ethernet2
B I 192.168.35.0/24 [200/0] via 192.168.15.5, Ethernet1
B I 192.168.36.0/24 [200/0] via 192.168.16.6, Ethernet2
B I 192.168.45.0/24 [200/0] via 192.168.15.5, Ethernet1
B I 192.168.46.0/24 [200/0] via 192.168.16.6, Ethernet2
leaf01#
重複IPアドレスの作成
MLAGピアとなるリーフスイッチで、Loopbackに対して重複するIPアドレスを設定します。
後ほどの手順にて、このLoopbackをvxlanの送信元とする事で、Acitve/Active構成を実現します。
なお、この後に再起動操作をするとbgp router-idが重複してしまいますので、route-idの明示指定も必要です。
# leaf01 interface Loopback10 ip address 10.12.12.12/32 router bgp 65000 router-id 10.1.1.1 network 10.12.12.12/32 # leaf02 interface Loopback10 ip address 10.12.12.12/32 router bgp 65000 router-id 10.2.2.2 network 10.12.12.12/32 # leaf03 interface Loopback10 ip address 10.34.34.34/32 router bgp 65000 router-id 10.3.3.3 network 10.34.34.34/32 # leaf04 interface Loopback10 ip address 10.34.34.34/32 router bgp 65000 router-id 10.4.4.4 network 10.34.34.34/32
Loopback10のIPアドレスが互いに経路交換されている事を確認します。
leaf01#show ip route 10.34.34.34
VRF: default
Codes: C - connected, S - static, K - kernel,
O - OSPF, IA - OSPF inter area, E1 - OSPF external type 1,
E2 - OSPF external type 2, N1 - OSPF NSSA external type 1,
N2 - OSPF NSSA external type2, B - BGP, B I - iBGP, B E - eBGP,
R - RIP, I L1 - IS-IS level 1, I L2 - IS-IS level 2,
O3 - OSPFv3, A B - BGP Aggregate, A O - OSPF Summary,
NG - Nexthop Group Static Route, V - VXLAN Control Service,
DH - DHCP client installed default route, M - Martian,
DP - Dynamic Policy Route, L - VRF Leaked,
RC - Route Cache Route
B I 10.34.34.34/32 [200/0] via 192.168.15.5, Ethernet1
via 192.168.16.6, Ethernet2
leaf01#
VXLANの設定
リーフスイッチに対してvxlanの設定を行います。
# leaf01, leaf02, leaf03, leaf04 vlan 78 interface Vxlan1 vxlan source-interface Loopback10 vxlan vlan 78 vni 9078
vxlanのflood先はEVPNによって学習する想定です。この時点ではEVPNは設定されていないので、interface vxlanはdown状態になります。
leaf01#show interfaces vxlan 1
Vxlan1 is down, line protocol is down (notconnect)
Hardware is Vxlan
Source interface is Loopback10 and is active with 10.12.12.12
Replication/Flood Mode is not initialized yet
Remote MAC learning via Datapath
VNI mapping to VLANs
Static VLAN to VNI mapping is
[78, 9078]
Note: All Dynamic VLANs used by VCS are internal VLANs.
Use 'show vxlan vni' for details.
Static VRF to VNI mapping is not configured
MLAG Shared Router MAC is 0000.0000.0000
leaf01#
EVPN
リーフ/スパイン間でEVPN neighborを確立します。EVPNを使用するにはservice routing protocols model multi-agentコマンドが必要であり、これの設定反映には再起動が必要です。
また、EVPNは拡張コミにティによって情報を伝搬しますので、send-communityも必要です。
# leaf01
service routing protocols model multi-agent
!
router bgp 65000
neighbor 192.168.15.5 send-community
neighbor 192.168.16.6 send-community
!
vlan 78
rd 10.1.1.1:9078
route-target both 9078:9078
redistribute learned
!
address-family evpn
neighbor 192.168.15.5 activate
neighbor 192.168.16.6 activate
# leaf02
service routing protocols model multi-agent
!
router bgp 65000
neighbor 192.168.25.5 send-community
neighbor 192.168.26.6 send-community
!
vlan 78
rd 10.2.2.2:9078
route-target both 9078:9078
redistribute learned
!
address-family evpn
neighbor 192.168.25.5 activate
neighbor 192.168.26.6 activate
# leaf03
service routing protocols model multi-agent
!
router bgp 65000
neighbor 192.168.35.5 send-community
neighbor 192.168.36.6 send-community
!
vlan 78
rd 10.3.3.3:9078
route-target both 9078:9078
redistribute learned
!
address-family evpn
neighbor 192.168.35.5 activate
neighbor 192.168.36.6 activate
# leaf04
service routing protocols model multi-agent
!
router bgp 65000
neighbor 192.168.45.5 send-community
neighbor 192.168.46.6 send-community
!
vlan 78
rd 10.4.4.4:9078
route-target both 9078:9078
redistribute learned
!
address-family evpn
neighbor 192.168.45.5 activate
neighbor 192.168.46.6 activate
# spine05
service routing protocols model multi-agent
!
router bgp 65000
neighbor 192.168.15.1 send-community
neighbor 192.168.25.2 send-community
neighbor 192.168.35.3 send-community
neighbor 192.168.45.4 send-community
!
address-family evpn
neighbor 192.168.15.1 activate
neighbor 192.168.25.2 activate
neighbor 192.168.35.3 activate
neighbor 192.168.45.4 activate
# spine06
service routing protocols model multi-agent
!
router bgp 65000
neighbor 192.168.16.1 send-community
neighbor 192.168.26.2 send-community
neighbor 192.168.36.3 send-community
neighbor 192.168.46.4 send-community
!
address-family evpn
neighbor 192.168.16.1 activate
neighbor 192.168.26.2 activate
neighbor 192.168.36.3 activate
neighbor 192.168.46.4 activate
BGP evpn neighborが確立されており、互いに経路を交換している事を確認します。
leaf01#show bgp evpn summary
BGP summary information for VRF default
Router identifier 10.1.1.1, local AS number 65000
Neighbor Status Codes: m - Under maintenance
Neighbor V AS MsgRcvd MsgSent InQ OutQ Up/Down State PfxRcd PfxAcc
192.168.15.5 4 65000 355 335 0 0 00:01:19 Estab 3 3
192.168.16.6 4 65000 327 300 0 0 00:01:04 Estab 3 3
leaf01#
leaf01#
leaf01#show bgp evpn
BGP routing table information for VRF default
Router identifier 10.1.1.1, local AS number 65000
Route status codes: s - suppressed, * - valid, > - active, E - ECMP head, e - ECMP
S - Stale, c - Contributing to ECMP, b - backup
% - Pending BGP convergence
Origin codes: i - IGP, e - EGP, ? - incomplete
AS Path Attributes: Or-ID - Originator ID, C-LST - Cluster List, LL Nexthop - Link Local Nexthop
Network Next Hop Metric LocPref Weight Path
* > RD: 10.1.1.1:9078 imet 10.12.12.12
- - - 0 i
RD: 10.2.2.2:9078 imet 10.12.12.12
10.12.12.12 - 100 0 i Or-ID: 10.2.2.2 C-LST: 192.168.45.5
RD: 10.2.2.2:9078 imet 10.12.12.12
10.12.12.12 - 100 0 i Or-ID: 10.2.2.2 C-LST: 192.168.46.6
* >Ec RD: 10.3.3.3:9078 imet 10.34.34.34
10.34.34.34 - 100 0 i Or-ID: 10.3.3.3 C-LST: 192.168.45.5
* ec RD: 10.3.3.3:9078 imet 10.34.34.34
10.34.34.34 - 100 0 i Or-ID: 10.3.3.3 C-LST: 192.168.46.6
* >Ec RD: 10.4.4.4:9078 imet 10.34.34.34
10.34.34.34 - 100 0 i Or-ID: 10.4.4.4 C-LST: 192.168.45.5
* ec RD: 10.4.4.4:9078 imet 10.34.34.34
10.34.34.34 - 100 0 i Or-ID: 10.4.4.4 C-LST: 192.168.46.6
leaf01#
インターフェスvxlanがup状態に変わり、flood vtepの宛先がEVPNによって認識された事を確認します。
leaf01#show int vxlan 1
Vxlan1 is up, line protocol is up (connected)
Hardware is Vxlan
Source interface is Loopback10 and is active with 10.12.12.12
Replication/Flood Mode is headend with Flood List Source: EVPN
Remote MAC learning via EVPN
VNI mapping to VLANs
Static VLAN to VNI mapping is
[78, 9078]
Note: All Dynamic VLANs used by VCS are internal VLANs.
Use 'show vxlan vni' for details.
Static VRF to VNI mapping is not configured
Headend replication flood vtep list is:
78 10.34.34.34
MLAG Shared Router MAC is 0000.0000.0000
疎通
host07とhost08の間で互いに疎通可能である事を確認します。
host07#ping 192.168.78.80 PING 192.168.78.80 (192.168.78.80) 72(100) bytes of data. 80 bytes from 192.168.78.80: icmp_seq=1 ttl=64 time=49.3 ms 80 bytes from 192.168.78.80: icmp_seq=2 ttl=64 time=40.4 ms 80 bytes from 192.168.78.80: icmp_seq=3 ttl=64 time=31.6 ms 80 bytes from 192.168.78.80: icmp_seq=4 ttl=64 time=22.8 ms 80 bytes from 192.168.78.80: icmp_seq=5 ttl=64 time=14.1 ms --- 192.168.78.80 ping statistics --- 5 packets transmitted, 5 received, 0% packet loss, time 40ms rtt min/avg/max/mdev = 14.101/31.678/49.307/12.438 ms, pipe 5, ipg/ewma 10.082/39.585 ms host07#
MACアドレス等の情報を互いに学習している事を確認します。
host07#show arp
Address Age (sec) Hardware Addr Interface
192.168.78.80 0:00:12 0050.562d.680f Vlan78, Ethernet1
host07#
host08#show arp
Address Age (sec) Hardware Addr Interface
192.168.78.70 0:00:24 0050.56ea.fea3 Vlan78, Ethernet1
host08#
leaf01#show vxlan address-table
Vxlan Mac Address Table
----------------------------------------------------------------------
VLAN Mac Address Type Prt VTEP Moves Last Move
---- ----------- ---- --- ---- ----- ---------
78 0050.562d.680f EVPN Vx1 10.34.34.34 1 0:00:41 ago
Total Remote Mac Addresses for this criterion: 1
leaf01#
leaf03#show vxlan address-table
Vxlan Mac Address Table
----------------------------------------------------------------------
VLAN Mac Address Type Prt VTEP Moves Last Move
---- ----------- ---- --- ---- ----- ---------
78 0050.56ea.fea3 EVPN Vx1 10.12.12.12 1 0:01:02 ago
Total Remote Mac Addresses for this criterion: 1
leaf03#
