The eighth day of FRR learning -- Distributed symmetric gateway

Keywords: C++ network Mac vnc Attribute

Distributed symmetric gateway

spine configuration

bgp evpn configuration

router bgp 7677
 bgp router-id 192.168.59.130
 bgp bestpath as-path multipath-relax
 neighbor fabric peer-group
 neighbor fabric remote-as external
 neighbor 192.168.59.128 peer-group fabric
 neighbor 192.168.59.129 peer-group fabric
 !
 address-family l2vpn evpn
  neighbor fabric activate
 exit-address-family
!

leaf1 and host1 configuration

Interface configuration

#Configure under root 
#!/bin/bash

#enable forward
sysctl -w net.ipv4.ip_forward=1  
sysctl -p

#add host1
ip netns add host1
ip link add veth1 type veth peer name eth0 netns host1
ip netns exec host1 ip link set lo up
ip netns exec host1 ip link set eth0 up
ip netns exec host1 ip addr add 2.2.2.2/24 dev eth0
ip netns exec host1 ip route add default via 2.2.2.254 dev eth0

ip link add br10 type bridge
ip link add vxlan10 type vxlan id 10 local 192.168.59.128 dstport 4789 nolearning
ip link set br10 up
ip link set veth1 up
ip link set vxlan10 up
ip link set veth1 master br10
ip link set vxlan10 master br10
ip link set dev br10 address 00:00:01:02:03:10
ip addr add 2.2.2.254/24 dev br10

#add l3 vni
ip link add br100 type bridge
ip link add vxlan100 type vxlan id 100 local 192.168.59.128 dstport 4789 nolearning
ip link set br100 up
ip link set vxlan100 up
ip link set vxlan100 master br100  
ip link set dev br100 address 00:00:01:02:03:04

# add vrf
ip link add evpn-vrf type vrf table 100
ip link set evpn-vrf up
ip link set br100 master evpn-vrf  
ip link set br10 master evpn-vrf 

bgp evpn configuration

vrf evpn-vrf
 vni 100
 exit-vrf
!
router bgp 7675
 bgp router-id 192.168.59.128
 bgp bestpath as-path multipath-relax
 neighbor fabric peer-group
 neighbor fabric remote-as external
 neighbor 192.168.59.130 peer-group fabric
 !
 address-family l2vpn evpn
  neighbor fabric activate
  advertise-all-vni
 exit-address-family
!
router bgp 7675 vrf evpn-vrf
 !
 address-family l2vpn evpn
  advertise ipv4 unicast
 exit-address-family
!
line vty
!
end

Note:

vrf evpn-vrf
 vni 100
 exit-vrf

This instruction indicates that an l3vni is specified

router bgp 7675 vrf evpn-vrf
 !
 address-family l2vpn evpn
  advertise ipv4 unicast
 exit-address-family
!

This instruction, advertisement IPv4 unicast, indicates that RT-5 route is declared.

leaf2 and host2 configurations

Interface configuration

#Configure under root
#!/bin/bash

#enable forward
sysctl -w net.ipv4.ip_forward=1  
sysctl -p

#add host2
ip netns add host2
ip link add veth2 type veth peer name eth0 netns host2
ip netns exec host2 ip link set lo up
ip netns exec host2 ip link set eth0 up
ip netns exec host2 ip addr add 1.1.1.1/24 dev eth0
ip netns exec host2 ip route add default via 1.1.1.254 dev eth0 

#add br20
ip link add br20 type bridge
ip link set br20 up
ip link set veth2 up
ip link set veth2 master br20
ip addr add 1.1.1.254/24 dev br20

#add host3
ip netns add host3
ip link add veth3 type veth peer name eth0 netns host3
ip netns exec host3 ip link set lo up
ip netns exec host3 ip link set eth0 up
ip netns exec host3 ip addr add 2.2.2.3/24 dev eth0
ip netns exec host3 ip route add default via 2.2.2.254 dev eth0

ip link add br30 type bridge
ip link add vxlan10 type vxlan id 10 local 192.168.59.129 dstport 4789 nolearning
ip link set vxlan10 up
ip link set vxlan10 master br30
ip link set br30 up
ip link set veth3 up
ip link set veth3 master br30
ip addr add 2.2.2.254/24 dev br30
ip link set dev br30 address 00:00:01:02:03:10

#add l3vni
ip link add br100 type bridge
ip link add vxlan100 type vxlan id 100 local 192.168.59.129 dstport 4789 nolearning
ip link set br100 up
ip link set vxlan100 up
ip link set vxlan100 master br100  
ip link set dev br100 address 00:00:01:02:03:05 

#add vrf
ip link add evpn-vrf type vrf table 100
ip link set evpn-vrf up
ip link set br100 master evpn-vrf  
ip link set br20 master evpn-vrf 
ip link set br30 master evpn-vrf 

bgp evpn configuration

vrf evpn-vrf
 vni 100
 exit-vrf
!
router bgp 7676
 bgp router-id 192.168.59.129
 bgp bestpath as-path multipath-relax
 neighbor fabric peer-group
 neighbor fabric remote-as external
 neighbor 192.168.59.130 peer-group fabric
 !
 address-family l2vpn evpn
  neighbor fabric activate
  advertise-all-vni
 exit-address-family
!
router bgp 7676 vrf evpn-vrf
 !
 address-family l2vpn evpn
  advertise ipv4 unicast
 exit-address-family
!
line vty
!
end

View bgp information

On host3, pinghost1:

root@3cfbe6f4301d:/# ip netns exec host3 ping 2.2.2.2 -c 1
PING 2.2.2.2 (2.2.2.2): 56 data bytes
64 bytes from 2.2.2.2: icmp_seq=0 ttl=64 time=0.095 ms
--- 2.2.2.2 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max/stddev = 0.095/0.095/0.095/0.000 ms
root@3cfbe6f4301d:/# 

leaf1

  • View route information
70cf8caaa686# show ip bgp l2vpn evpn 
BGP table version is 30, local router ID is 192.168.59.128
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
Route Distinguisher: ip 192.168.59.128:3

*> [2]:[0]:[48]:[06:20:e4:53:a6:8a]
                    192.168.59.128                     32768 i
*> [2]:[0]:[48]:[06:20:e4:53:a6:8a]:[32]:[2.2.2.2]
                    192.168.59.128                     32768 i
*> [3]:[0]:[32]:[192.168.59.128]
                    192.168.59.128                     32768 i
Route Distinguisher: ip 192.168.59.129:3

*> [2]:[0]:[48]:[4e:3b:63:e3:19:5e]
                    192.168.59.129                         0 7677 7676 i
*> [2]:[0]:[48]:[4e:3b:63:e3:19:5e]:[32]:[2.2.2.3]
                    192.168.59.129                         0 7677 7676 i
*> [3]:[0]:[32]:[192.168.59.129]
                    192.168.59.129                         0 7677 7676 i

Displayed 6 out of 6 total prefixes
70cf8caaa686# 
  • View kernel routing information
70cf8caaa686# show ip route vrf evpn-vrf
Codes: K - kernel route, C - connected, S - static, R - RIP,
       O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
       T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
       F - PBR, f - OpenFabric,
       > - selected route, * - FIB route, q - queued route, r - rejected route


VRF evpn-vrf:
C>* 2.2.2.0/24 is directly connected, br10, 02:35:07
B>* 2.2.2.3/32 [20/0] via 192.168.59.129, br100 onlink, 00:12:45
70cf8caaa686# 

leaf2

  • View route information
3cfbe6f4301d# show ip bgp l2vpn evpn 
BGP table version is 40, local router ID is 192.168.59.129
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
Route Distinguisher: ip 192.168.59.128:3

*> [2]:[0]:[48]:[06:20:e4:53:a6:8a]
                    192.168.59.128                         0 7677 7675 i
*> [2]:[0]:[48]:[06:20:e4:53:a6:8a]:[32]:[2.2.2.2]
                    192.168.59.128                         0 7677 7675 i
*> [3]:[0]:[32]:[192.168.59.128]
                    192.168.59.128                         0 7677 7675 i
Route Distinguisher: ip 192.168.59.129:3

*> [2]:[0]:[48]:[4e:3b:63:e3:19:5e]
                    192.168.59.129                     32768 i
*> [2]:[0]:[48]:[4e:3b:63:e3:19:5e]:[32]:[2.2.2.3]
                    192.168.59.129                     32768 i
*> [3]:[0]:[32]:[192.168.59.129]
                    192.168.59.129                     32768 i

Displayed 6 out of 6 total prefixes
3cfbe6f4301d# 
  • View kernel routing information
3cfbe6f4301d# show ip route vrf evpn-vrf
Codes: K - kernel route, C - connected, S - static, R - RIP,
       O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
       T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
       F - PBR, f - OpenFabric,
       > - selected route, * - FIB route, q - queued route, r - rejected route


VRF evpn-vrf:
C>* 1.1.1.0/24 is directly connected, br20, 01:50:19
C>* 2.2.2.0/24 is directly connected, br30, 01:50:19
B>* 2.2.2.2/32 [20/0] via 192.168.59.128, br100 onlink, 00:14:22
3cfbe6f4301d# 

As can be seen from the above, BGP evpn installs an exact host route for host1.

Capture analysis


In symmetric mode, the type-2 route will carry two vnis. When the neighbor receives the route, the fdb table entry will be installed in the routing table where vni is, and the exact routing table entry will be installed. Note the above router mac extended community attribute, which is a routing mac. When installing the exact routing, a neighbor table entry will be installed for the nexthop. The mac address is the mac.

Segment routing

At present, host2 cannot ping host1, because there is no 1.1.1.0/24 route in the vtep where host1 is located. At this time, the vtep where host2 is located needs to publish the network segment route.

Use the network command to publish:

router bgp 7676 vrf evpn-vrf
 !
 address-family ipv4 unicast
  network 1.1.1.0/24
 exit-address-family
 !

It is worth noting that the address family context is ipv4, not evpn. This is not very understandable.

You can also use the redistribute connected command to publish all the direct network segment routes.

leaf01

  • View evpn routing information
70cf8caaa686# show ip bgp l2vpn evpn 
BGP table version is 7, local router ID is 192.168.59.128
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
Route Distinguisher: ip 2.2.2.254:2

*> [5]:[0]:[24]:[1.1.1.0]
                    192.168.59.129                         0 7677 7676 i
Route Distinguisher: ip 192.168.59.128:3

*> [2]:[0]:[48]:[06:20:e4:53:a6:8a]
                    192.168.59.128                     32768 i
*> [2]:[0]:[48]:[06:20:e4:53:a6:8a]:[32]:[2.2.2.2]
                    192.168.59.128                     32768 i
*> [3]:[0]:[32]:[192.168.59.128]
                    192.168.59.128                     32768 i
Route Distinguisher: ip 192.168.59.129:3

*> [2]:[0]:[48]:[4e:3b:63:e3:19:5e]
                    192.168.59.129                         0 7677 7676 i
*> [2]:[0]:[48]:[4e:3b:63:e3:19:5e]:[32]:[2.2.2.3]
                    192.168.59.129                         0 7677 7676 i
*> [3]:[0]:[32]:[192.168.59.129]
                    192.168.59.129                         0 7677 7676 i

Displayed 7 out of 7 total prefixes
70cf8caaa686# 

You can see that there is an extra route of type-5.

  • host1 ping 1.1.1.1
root@70cf8caaa686:/# ip netns exec host1 ping 1.1.1.1 -c 1
PING 1.1.1.1 (1.1.1.1): 56 data bytes
64 bytes from 1.1.1.1: icmp_seq=0 ttl=62 time=0.133 ms
--- 1.1.1.1 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max/stddev = 0.133/0.133/0.133/0.000 ms
root@70cf8caaa686:/# 

Capture analysis


The above message is a type-5 prefix routing message, and the corresponding network segment routing model of this message is interface less. In this route, the router MAC extension community is carried. The value is the MAC address of br100 on the vtep where host2 is located. When host 1's vtep encapsulates the message, the inner destination MAC will use the Mac.

summary

In the distributed symmetric model, when routing across network segments, whether the hit route is precise route or network segment route, whether there is a destination network segment vni or not, l3 vni is used for packet encapsulation, fdb forwarding is used for the same network segment, and vni is the vni of the network segment.

Posted by Bunkermaster on Tue, 19 Nov 2019 01:26:44 -0800