evpn vxlan场景如何配置非对称irb

不要配置l3vni，只需要配置多个vsi即可，比如本端有vxlan100，对端vxlan200，那么此时你可以在本端配置一个vxlan200（不需要ac口，其余的都要），对端同理配置vxlan100，这就是非对称irb

2.22.4  非对称IRB方式分布式IPv4 EVPN网关配置举例

1. 组网需求

Switch A、Switch B为分布式EVPN网关设备；Switch C为与广域网连接的边界网关设备；Switch D为RR，负责在交换机之间反射BGP路由。

虚拟机VM 1和VM 3属于VXLAN 10；VM 2和VM 4属于VXLAN 20。相同VXLAN之间可以二层互通；不同站点、相同VXLAN的VM通过分布式EVPN网关实现三层互通，并采用非对称IRB方式转发流量；VXLAN与广域网之间通过边界网关实现三层互通。

2. 组网图

图2-5 分布式EVPN网关配置组网图

‌

3. 配置步骤

(1)     配置设备的硬件资源模式

# 配置Switch A、Switch B工作的硬件资源模式，并重启设备。以Switch A为例，其他设备的配置方法与此相同。

[SwitchA] hardware-resource vxlan l3gw16k

Do you want to change the specified hardware resource working mode? [Y/N]:y

The hardware resource working mode is changed, please save the configuration and

 reboot the system to make it effective.

[SwitchA] quit

<SwitchA> reboot

Start to check configuration with next startup configuration file, please wait..

.......DONE!

Current configuration may be lost after the reboot, save current configuration?

[Y/N]:y

This command will reboot the device. Continue? [Y/N]:y

# 配置Switch C工作的硬件资源模式，并重启设备。

[SwitchC] hardware-resource vxlan border24k

Do you want to change the specified hardware resource working mode? [Y/N]:y

The hardware resource working mode is changed, please save the configuration and

 reboot the system to make it effective.

[SwitchC] quit

<SwitchC> reboot

Start to check configuration with next startup configuration file, please wait..

.......DONE!

Current configuration may be lost after the reboot, save current configuration?

[Y/N]:y

This command will reboot the device. Continue? [Y/N]:y

(2)     配置IP地址和单播路由协议

# 在VM 1、VM 2、VM 3和VM 4上分别指定网关地址为10.1.1.1、10.1.2.1、20.1.1.1、20.1.2.1。（具体配置过程略）

# 请按照图2-5配置各接口的IP地址和子网掩码；在IP核心网络内配置OSPF协议，确保交换机之间路由可达。（具体配置过程略）

(3)     配置Switch A

# 开启L2VPN能力。

<SwitchA> system-view

[SwitchA] l2vpn enable

# 关闭远端MAC地址和远端ARP自动学习功能。

[SwitchA] vxlan tunnel mac-learning disable

[SwitchA] vxlan tunnel arp-learning disable

# 配置EVPN VXLAN采用非对称IRB方式转发流量。

[SwitchA] evpn irb asymmetric

# 在VSI实例vpna下创建EVPN实例，并配置自动生成EVPN实例的RD和RT。

[SwitchA] vsi vpna

[SwitchA-vsi-vpna] evpn encapsulation vxlan

[SwitchA-vsi-vpna-evpn-vxlan] route-distinguisher auto

[SwitchA-vsi-vpna-evpn-vxlan] vpn-target auto

[SwitchA-vsi-vpna-evpn-vxlan] quit

# 创建VXLAN 10。

[SwitchA-vsi-vpna] vxlan 10

[SwitchA-vsi-vpna-vxlan-10] quit

[SwitchA-vsi-vpna] quit

# 在VSI实例vpnb下创建EVPN实例，并配置自动生成EVPN实例的RD和RT。

[SwitchA] vsi vpnb

[SwitchA-vsi-vpnb] evpn encapsulation vxlan

[SwitchA-vsi-vpnb-evpn-vxlan] route-distinguisher auto

[SwitchA-vsi-vpnb-evpn-vxlan] vpn-target auto

[SwitchA-vsi-vpnb-evpn-vxlan] quit

# 创建VXLAN 20。

[SwitchA-vsi-vpnb] vxlan 20

[SwitchA-vsi-vpnb-vxlan-20] quit

[SwitchA-vsi-vpnb] quit

# 配置BGP发布EVPN路由。

[SwitchA] bgp 200

[SwitchA-bgp-default] peer 4.4.4.4 as-number 200

[SwitchA-bgp-default] peer 4.4.4.4 connect-interface loopback 0

[SwitchA-bgp-default] address-family l2vpn evpn

[SwitchA-bgp-default-evpn] peer 4.4.4.4 enable

[SwitchA-bgp-default-evpn] quit

[SwitchA-bgp-default] quit

# 在接入服务器的接口Ten-GigabitEthernet1/0/1上创建以太网服务实例1000，该实例用来匹配VLAN 2的数据帧。

[SwitchA] interface ten-gigabitethernet 1/0/1

[SwitchA-Ten-GigabitEthernet1/0/1] service-instance 1000

[SwitchA-Ten-GigabitEthernet1/0/1-srv1000] encapsulation s-vid 2

# 配置以太网服务实例1000与VSI实例vpna关联。

[SwitchA-Ten-GigabitEthernet1/0/1-srv1000] xconnect vsi vpna

[SwitchA-Ten-GigabitEthernet1/0/1-srv1000] quit

# 在接口Ten-GigabitEthernet1/0/1上创建以太网服务实例2000，该实例用来匹配VLAN 3的数据帧。

[SwitchA-Ten-GigabitEthernet1/0/1] service-instance 2000

[SwitchA-Ten-GigabitEthernet1/0/1-srv2000] encapsulation s-vid 3

# 配置以太网服务实例2000与VSI实例vpnb关联。

[SwitchA-Ten-GigabitEthernet1/0/1-srv2000] xconnect vsi vpnb

[SwitchA-Ten-GigabitEthernet1/0/1-srv2000] quit

[SwitchA-Ten-GigabitEthernet1/0/1] quit

# 配置L3VNI的RD和RT。

[SwitchA] ip vpn-instance l3vpna

[SwitchA-vpn-instance-l3vpna] route-distinguisher 1:1

[SwitchA-vpn-instance-l3vpna] address-family ipv4

[SwitchA-vpn-ipv4-l3vpna] vpn-target 2:2

[SwitchA-vpn-ipv4-l3vpna] quit

[SwitchA-vpn-instance-l3vpna] address-family evpn

[SwitchA-vpn-evpn-l3vpna] vpn-target 1:1

[SwitchA-vpn-evpn-l3vpna] quit

[SwitchA-vpn-instance-l3vpna] quit

# 配置VSI虚接口VSI-interface1。

[SwitchA] interface vsi-interface 1

[SwitchA-Vsi-interface1] ip binding vpn-instance l3vpna

[SwitchA-Vsi-interface1] ip address 10.1.1.1 255.255.255.0

[SwitchA-Vsi-interface1] mac-address 1-1-1

[SwitchA-Vsi-interface1] distributed-gateway local

[SwitchA-Vsi-interface1] local-proxy-arp enable

[SwitchA-Vsi-interface1] quit

# 配置VSI虚接口VSI-interface2。

[SwitchA] interface vsi-interface 2

[SwitchA-Vsi-interface2] ip binding vpn-instance l3vpna

[SwitchA-Vsi-interface2] ip address 10.1.2.1 255.255.255.0

[SwitchA-Vsi-interface2] mac-address 2-2-2

[SwitchA-Vsi-interface2] distributed-gateway local

[SwitchA-Vsi-interface2] local-proxy-arp enable

[SwitchA-Vsi-interface2] quit

# 创建VSI虚接口VSI-interface3，在该接口上配置VPN实例l3vpna对应的L3VNI为1000。

[SwitchA] interface vsi-interface 3

[SwitchA-Vsi-interface3] ip binding vpn-instance l3vpna

[SwitchA-Vsi-interface3] l3-vni 1000

[SwitchA-Vsi-interface3] quit

# 配置VXLAN 10所在的VSI实例和接口VSI-interface1关联。

[SwitchA] vsi vpna

[SwitchA-vsi-vpna] gateway vsi-interface 1

[SwitchA-vsi-vpna] quit

# 配置VXLAN 20所在的VSI实例和接口VSI-interface2关联。

[SwitchA] vsi vpnb

[SwitchA-vsi-vpnb] gateway vsi-interface 2

[SwitchA-vsi-vpnb] quit

(4)     配置Switch B

# 开启L2VPN能力。

<SwitchB> system-view

[SwitchB] l2vpn enable

# 关闭远端MAC地址和远端ARP自动学习功能。

[SwitchB] vxlan tunnel mac-learning disable

[SwitchB] vxlan tunnel arp-learning disable

# 配置EVPN VXLAN采用非对称IRB方式转发流量。

[SwitchA] evpn irb asymmetric

# 在VSI实例vpna下创建EVPN实例，并配置自动生成EVPN实例的RD和RT。

[SwitchB] vsi vpna

[SwitchB-vsi-vpna] evpn encapsulation vxlan

[SwitchB-vsi-vpna-evpn-vxlan] route-distinguisher auto

[SwitchB-vsi-vpna-evpn-vxlan] vpn-target auto

[SwitchB-vsi-vpna-evpn-vxlan] quit

# 创建VXLAN 10。

[SwitchB-vsi-vpna] vxlan 10

[SwitchB-vsi-vpna-vxlan-10] quit

[SwitchB-vsi-vpna] quit

# 在VSI实例vpnb下创建EVPN实例，并配置自动生成EVPN实例的RD和RT。

[SwitchB] vsi vpnb

[SwitchB-vsi-vpnb] evpn encapsulation vxlan

[SwitchB-vsi-vpnb-evpn-vxlan] route-distinguisher auto

[SwitchB-vsi-vpnb-evpn-vxlan] vpn-target auto

[SwitchB-vsi-vpnb-evpn-vxlan] quit

# 创建VXLAN 20。

[SwitchB-vsi-vpnb] vxlan 20

[SwitchB-vsi-vpnb-vxlan-20] quit

[SwitchB-vsi-vpnb] quit

# 配置BGP发布EVPN路由。

[SwitchB] bgp 200

[SwitchB-bgp-default] peer 4.4.4.4 as-number 200

[SwitchB-bgp-default] peer 4.4.4.4 connect-interface loopback 0

[SwitchB-bgp-default] address-family l2vpn evpn

[SwitchB-bgp-default-evpn] peer 4.4.4.4 enable

[SwitchB-bgp-default-evpn] quit

[SwitchB-bgp-default] quit

# 在接入服务器的接口Ten-GigabitEthernet1/0/1上创建以太网服务实例1000，该实例用来匹配VLAN 2的数据帧。

[SwitchB] interface ten-gigabitethernet 1/0/1

[SwitchB-Ten-GigabitEthernet1/0/1] service-instance 1000

[SwitchB-Ten-GigabitEthernet1/0/1-srv1000] encapsulation s-vid 2

# 配置以太网服务实例1000与VSI实例vpna关联。

[SwitchB-Ten-GigabitEthernet1/0/1-srv1000] xconnect vsi vpna

[SwitchB-Ten-GigabitEthernet1/0/1-srv1000] quit

[SwitchB-Ten-GigabitEthernet1/0/1] quit

# 在接口Ten-GigabitEthernet1/0/2上创建以太网服务实例2000，该实例用来匹配VLAN 3的数据帧。

[SwitchB] interface ten-gigabitethernet 1/0/2

[SwitchB-Ten-GigabitEthernet1/0/2] service-instance 2000

[SwitchB-Ten-GigabitEthernet1/0/2-srv2000] encapsulation s-vid 3

# 配置以太网服务实例2000与VSI实例vpnb关联。

[SwitchB-Ten-GigabitEthernet1/0/2-srv2000] xconnect vsi vpnb

[SwitchB-Ten-GigabitEthernet1/0/2-srv2000] quit

[SwitchB-Ten-GigabitEthernet1/0/2] quit

# 配置L3 VNI的RD和RT。

[SwitchB] ip vpn-instance l3vpna

[SwitchB-vpn-instance-l3vpna] route-distinguisher 1:2

[SwitchB-vpn-instance-l3vpna] address-family ipv4

[SwitchB-vpn-ipv4-l3vpna] vpn-target 2:2

[SwitchB-vpn-ipv4-l3vpna] quit

[SwitchB-vpn-instance-l3vpna] address-family evpn

[SwitchB-vpn-evpn-l3vpna] vpn-target 1:1

[SwitchB-vpn-evpn-l3vpna] quit

[SwitchB-vpn-instance-l3vpna] quit

# 配置VSI虚接口VSI-interface1。

[SwitchB] interface vsi-interface 1

[SwitchB-Vsi-interface1] ip binding vpn-instance l3vpna

[SwitchB-Vsi-interface1] ip address 20.1.1.1 255.255.255.0

[SwitchB-Vsi-interface1] mac-address 1-1-1

[SwitchB-Vsi-interface1] distributed-gateway local

[SwitchB-Vsi-interface1] local-proxy-arp enable

[SwitchB-Vsi-interface1] quit

# 创建VSI虚接口VSI-interface2。

[SwitchB] interface vsi-interface 2

[SwitchB-Vsi-interface2] ip binding vpn-instance l3vpna

[SwitchB-Vsi-interface2] ip address 20.1.2.1 255.255.255.0

[SwitchB-Vsi-interface2] mac-address 2-2-2

[SwitchB-Vsi-interface2] distributed-gateway local

[SwitchB-Vsi-interface2] local-proxy-arp enable

[SwitchB-Vsi-interface2] quit

# 创建VSI虚接口VSI-interface3，在该接口上配置VPN实例l3vpna对应的L3VNI为1000。

[SwitchB] interface vsi-interface 3

[SwitchB-Vsi-interface3] ip binding vpn-instance l3vpna

[SwitchB-Vsi-interface3] l3-vni 1000

[SwitchB-Vsi-interface3] quit

# 配置VXLAN 10所在的VSI实例和接口VSI-interface1关联。

[SwitchB] vsi vpna

[SwitchB-vsi-vpna] gateway vsi-interface 1

[SwitchB-vsi-vpna] quit

# 配置VXLAN 20所在的VSI实例和接口VSI-interface2关联。

[SwitchB] vsi vpnb

[SwitchB-vsi-vpnb] gateway vsi-interface 2

[SwitchB-vsi-vpnb] quit

(5)     配置Switch C

# 开启L2VPN能力。

<SwitchC> system-view

[SwitchC] l2vpn enable

# 关闭远端MAC地址和远端ARP自动学习功能。

[SwitchC] vxlan tunnel mac-learning disable

[SwitchC] vxlan tunnel arp-learning disable

# 配置BGP发布EVPN路由。

[SwitchC] bgp 200

[SwitchC-bgp-default] peer 4.4.4.4 as-number 200

[SwitchC-bgp-default] peer 4.4.4.4 connect-interface loopback 0

[SwitchC-bgp-default] address-family l2vpn evpn

[SwitchC-bgp-default-evpn] peer 4.4.4.4 enable

[SwitchC-bgp-default-evpn] quit

[SwitchC-bgp-default] quit

# 配置L3 VNI的RD和RT。

[SwitchC] ip vpn-instance l3vpna

[SwitchC-vpn-instance-l3vpna] route-distinguisher 1:3

[SwitchC-vpn-instance-l3vpna] address-family ipv4

[SwitchC-vpn-ipv4-l3vpna] vpn-target 2:2

[SwitchC-vpn-ipv4-l3vpna] quit

[SwitchC-vpn-instance-l3vpna] address-family evpn

[SwitchC-vpn-evpn-l3vpna] vpn-target 1:1

[SwitchC-vpn-evpn-l3vpna] quit

[SwitchC-vpn-instance-l3vpna] quit

# 创建VSI虚接口VSI-interface3，在该接口上配置VPN实例l3vpna对应的L3VNI为1000。

[SwitchC] interface vsi-interface 3

[SwitchC-Vsi-interface3] ip binding vpn-instance l3vpna

[SwitchC-Vsi-interface3] l3-vni 1000

[SwitchC-Vsi-interface3] quit

# 配置缺省路由，下一跳为广域网中某台设备的IP地址20.1.1.100。

[SwitchC] ip route-static vpn-instance l3vpna 0.0.0.0 0 20.1.1.100

# 将缺省路由引入到VPN实例l3vpna的BGP IPv4单播路由表中。

[SwitchC] bgp 200

[SwitchC-bgp-default] ip vpn-instance l3vpna

[SwitchC-bgp-default-l3vpna] address-family ipv4 unicast

[SwitchC-bgp-default-ipv4-l3vpna] default-route imported

[SwitchC-bgp-default-ipv4-l3vpna] import-route static

[SwitchC-bgp-default-ipv4-l3vpna] quit

[SwitchC-bgp-default-l3vpna] quit

[SwitchC-bgp-default] quit

# 配置连接广域网的接口Vlan-interface20与VPN实例l3vpna关联。

[SwitchC] interface vlan-interface 20

[SwitchC-Vlan-interface20] ip binding vpn-instance l3vpna

[SwitchC-Vlan-interface20] ip address 20.1.1.3 24

[SwitchC-Vlan-interface20] quit

(6)     配置Switch D

# 配置Switch D与其他交换机建立BGP连接。

<SwitchD> system-view

[SwitchD] bgp 200

[SwitchD-bgp-default] group evpn

[SwitchD-bgp-default] peer 1.1.1.1 group evpn

[SwitchD-bgp-default] peer 2.2.2.2 group evpn

[SwitchD-bgp-default] peer 3.3.3.3 group evpn

[SwitchD-bgp-default] peer evpn as-number 200

[SwitchD-bgp-default] peer evpn connect-interface loopback 0

# 配置BGP发布EVPN路由，并关闭BGP EVPN路由的VPN-Target过滤功能。

[SwitchD-bgp-default] address-family l2vpn evpn

[SwitchD-bgp-default-evpn] peer evpn enable

[SwitchD-bgp-default-evpn] undo policy vpn-target

# 配置Switch D为路由反射器。

[SwitchD-bgp-default-evpn] peer evpn reflect-client

[SwitchD-bgp-default-evpn] quit

[SwitchD-bgp-default] quit

4. 验证配置

(1)     验证分布式EVPN网关设备Switch A

# 查看Switch A上的EVPN路由信息，可以看到Switch A发送了网关的IP前缀路由、各VSI的IMET路由和MAC/IP路由，并接收到Switch B发送的网关IP前缀路由、各VSI的IMET路由和MAC/IP路由。（具体显示信息略）

# 查看Switch A上的Tunnel接口信息，可以看到VXLAN模式的Tunnel接口处于up状态。（以Tunnel0接口为例）

[SwitchA] display interface tunnel 0

Tunnel0

Current state: UP

Line protocol state: UP

Description: Tunnel0 Interface

Bandwidth: 64 kbps

Maximum transmission unit: 1464

Internet protocol processing: Disabled

Last clearing of counters: Never

Tunnel source 1.1.1.1, destination 2.2.2.2

Tunnel protocol/transport UDP_VXLAN/IP

Last 300 seconds input rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Last 300 seconds output rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Input: 0 packets, 0 bytes, 0 drops

Output: 0 packets, 0 bytes, 0 drops

# 查看Switch A上的VSI虚接口信息，可以看到VSI虚接口处于up状态。（以VSI虚接口1为例）

[SwitchA] display interface vsi-interface 1

Vsi-interface1

Current state: UP

Line protocol state: UP

Description: Vsi-interface1 Interface

Bandwidth: 1000000 kbps

Maximum transmission unit: 1500

Internet address: 10.1.1.1/24 (primary)

IP packet frame type: Ethernet II, hardware address: 0003-0003-0003

IPv6 packet frame type: Ethernet II, hardware address: 0003-0003-0003

Physical: Unknown, baudrate: 1000000 kbps

Last clearing of counters: Never

Last 300 seconds input rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Last 300 seconds output rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec

Input: 0 packets, 0 bytes, 0 drops

Output: 0 packets, 0 bytes, 0 drops

# 查看Switch A上的VSI信息，可以看到VSI内创建的VXLAN、与VXLAN关联的VXLAN隧道、与VSI关联的VSI虚接口等信息。

[SwitchA] display l2vpn vsi verbose

VSI Name: Auto_L3VNI1000_3

  VSI Index               : 1

  VSI State               : Down

  MTU                     : 1500

  Bandwidth               : Unlimited

  Broadcast Restrain      : Unlimited

  Multicast Restrain      : Unlimited

  Unknown Unicast Restrain: Unlimited

  MAC Learning            : Enabled

  MAC Table Limit         : Unlimited

  MAC Learning rate       : -

  Drop Unknown            : Disabled

  Flooding                : Enabled

  Statistics              : Disabled

  Gateway Interface       : VSI-interface 3

  VXLAN ID                : 1000

  Tunnel Statistics       : Disabled

VSI Name: vpna

  VSI Index               : 0

  VSI State               : Up

  MTU                     : 1500

  Bandwidth               : Unlimited

  Broadcast Restrain      : Unlimited

  Multicast Restrain      : Unlimited

  Unknown Unicast Restrain: Unlimited

  MAC Learning            : Enabled

  MAC Table Limit         : Unlimited

  MAC Learning rate       : -

  Drop Unknown            : Disabled

  Flooding                : Enabled

  Statistics              : Disabled

  Gateway Interface       : VSI-interface 1

  VXLAN ID                : 10

  Tunnels:

    Tunnel Name          Link ID    State  Type      Flood proxy

    Tunnel0              0x5000000  UP     Auto      Disabled

  ACs:

    AC                               Link ID    State    Type

    XGE1/0/1 srv1000                 0x0        Up       Manual

VSI Name: vpnb

  VSI Index               : 2

  VSI State               : Up

  MTU                     : 1500

  Bandwidth               : Unlimited

  Broadcast Restrain      : Unlimited

  Multicast Restrain      : Unlimited

  Unknown Unicast Restrain: Unlimited

  MAC Learning            : Enabled

  MAC Table Limit         : Unlimited

  MAC Learning rate       : -

  Drop Unknown            : Disabled

  Flooding                : Enabled

  Statistics              : Disabled

  Gateway Interface       : VSI-interface 2

  VXLAN ID                : 20

  Tunnels:

    Tunnel Name          Link ID    State  Type      Flood proxy

    Tunnel0              0x5000000  UP     Auto      Disabled

  ACs:

    AC                               Link ID    State    Type

    XGE1/0/1 srv2000                 0x0        Up       Manual

# 查看Switch A上VSI的ARP表项信息，可以看到已学习到了本地虚拟机的ARP信息。

# 以VSI实例vpna为例，查看Switch A上VSI的EVPN ARP表项信息，可以看到已学习到了本地和远端虚拟机的ARP信息。

[SwitchA] display evpn route arp

Flags: D - Dynamic   B - BGP      L - Local active

       G - Gateway   S - Static   M - Mapping        I - Invalid

       E - Multihoming ES sync    F - Leaf

VPN instance: l3vpna                          Interface: Vsi-interface1

IP address      MAC address     Router MAC      VSI index   Flags

10.1.1.1        0001-0001-0001  522b-3413-0200  0           GL

10.1.1.10       521f-b814-0106  522b-3413-0200  0           DL

20.1.1.20       522b-3c6a-0406  522b-38cd-0300  0           B

(2)     验证主机之间可以互访

虚拟机VM 1和VM 3、VM 2和VM 4之间分别可以互访。