VXLAN配置案例

VXLAN（虚拟可扩展局域网）- 该技术提供与当前 VLAN 相同的以太网第 2 层网络服务，但其可扩展性和灵活性更为出色。

VNID（VXLAN 网络标识符）- 用于定义广播域的 24 位网段 ID。可与“VXLAN 网段 ID”互换。

VTEP（虚拟隧道终端）- 这是执行封装和解封的设备。

NVE（网络虚拟接口）- 执行封装和解封所在的逻辑接口。

什么是 VXLAN？
    VXLAN 是一种可以使用任何 IP 路由协议在第 3 层 (L3) 底层网络上重叠第 2 层 (L2) 网络的技术。
    它使用 MAC-in-UDP 封装（将 MAC 封装到 UDP 中）。

VXLAN 解决了三个主要问题：
    支持 1600 万个 VNI（广播域），而传统 VLAN 仅提供 4000 个。
    允许在 IP 网络中的任意位置扩展第 2 层网络。
    泛洪功能经过优化。

为什么实施 VXLAN？
    VLAN 可扩展性 - VXLAN 可将第 2 层网段 ID 字段扩展到 24 位，最多可在同一个网络上支持 1600 万个唯一的第 2 层网段。
    第 3 层边界上的第 2 层网段弹性 - VXLAN 将第 2 层帧封装在 IP UDP 报头中，因此第 2 层邻接关系可以跨路由器边界。
    在传输网络中利用组播，以便模拟第 2 层网段中的广播、未知单播和组播泛洪行为。
    利用等价多路径 (ECMP)，以通过传输网络实现最佳路径使用情况。

配置
    这些配置是 VXLAN 配置部分的特定配置。请注意，9396-A 和 B 在 vPC 域中，而 3172-A 不在。这些配置假设，通过您选择的路由协议，可以完全访问拓扑中的所有第 3 层接口。本示例中使用的是开放最短路径优先 (OSPF)。此外还假设，已在这些相同的第 3 层接口上建立组播路由。

3172-A========================================
feature ospf
feature pim
feature vn-segment-vlan-based
feature nv overlay

vlan 10
  vn-segment 160010
vlan 20
  vn-segment 160020

interface nve1
  source-interface loopback1
  member vni 160010 mcast-group 231.1.1.1
  member vni 160020 mcast-group 231.1.1.1
  no shutdown
  
interface Ethernet1/3
  no switchport
  ip address 192.168.1.10/30
  ip router ospf 2 area 0.0.0.0
  ip pim sparse-mode

interface loopback1
  ip address 192.168.2.5/32
  ip router ospf 2 area 0.0.0.0
  ip pim sparse-mode

9396-A===================================================
Note:当 vPC 用作 VTEP 时，在两个对等体之间使用并共享环回接口的辅助 IP。两个对等体通过此方式向远程 NVE 对等体表示自己是一个 VTEP。

feature ospf
feature pim
feature vn-segment-vlan-based
feature nv overlay

ip pim rp-address 192.168.1.100 group-list 224.0.0.0/4

vlan 1,10,20
vlan 10
  vn-segment 160010
vlan 20
  vn-segment 160020

vpc domain 1
  peer-switch
  peer-keepalive destination 10.122.140.99
  peer-gateway

interface port-channel1
  switchport mode trunk
  spanning-tree port type network
  vpc peer-link

interface port-channel48
  switchport mode trunk
  vpc 48  

interface nve1
  mtu 9216
  no shutdown
  source-interface loopback1
  member vni 160010 mcast-group 231.1.1.1
  member vni 160020 mcast-group 231.1.1.1

interface Ethernet1/7
  no switchport
  ip address 192.168.1.2/30
  ip router ospf 1 area 0.0.0.0
  ip pim sparse-mode
  no shutdown
  
interface loopback1
  ip address 192.168.2.2/32
  ip address 192.168.2.1/32 secondary
  ip router ospf 1 area 0.0.0.0
  ip pim sparse-mode

9396-B====================================
Note:当 vPC 用作 VTEP 时，在两个对等体之间使用并共享环回接口的辅助 IP。两个对等体通过此方式向远程 NVE 对等体表示自己是一个 VTEP。

feature ospf
feature pim
feature vn-segment-vlan-based
feature nv overlay

ip pim rp-address 192.168.1.100 group-list 224.0.0.0/4

vlan 1,10,20
vlan 10
  vn-segment 160010
vlan 20
  vn-segment 160020
  
vpc domain 1
  peer-switch
  peer-keepalive destination 10.122.140.98
  peer-gateway

interface port-channel1
  switchport mode trunk
  spanning-tree port type network
  vpc peer-link

interface port-channel48
  switchport mode trunk
  vpc 48
 
interface nve1
  mtu 9216
  no shutdown
  source-interface loopback1
  member vni 160010 mcast-group 231.1.1.1
  member vni 160020 mcast-group 231.1.1.1
    
interface Ethernet1/7
  no switchport
  ip address 192.168.1.6/30
  ip router ospf 1 area 0.0.0.0
  ip pim sparse-mode
  no shutdown
  
interface loopback1
  ip address 192.168.2.3/32
  ip address 192.168.2.1/32 secondary
  ip router ospf 1 area 0.0.0.0
  ip pim sparse-mode
Verify
Use this section to confirm that your configuration works properly.

思科 CLI 分析器（仅适用于注册客户）支持某些 show 命令。要查看对 show 命令输出的分析，请使用思科 CLI 分析器。

show nve peers <---在重叠网络两侧都发起流量之前，您不会看到此命令的任何输出
show nve vni
show run interface nve1
show nve internal platform interface detail（仅 9K）
show mac address-table
show ip mroute detail
输出示例
这些输出都处于稳定状态。VTEP 对等体已发现彼此，且二者间已在封装和解封两个方向传输流量。

3172-A
3172-A# show nve peers
Interface          Peer-IP           Peer-State
----------------   ---------------   -------------
nve1               192.168.2.1        Up         

3712-A# show nve vni
Interface          VNI        Multicast-group   VNI State
----------------   --------   ---------------   ---------
nve1               160010     231.1.1.1         Up  
nve1               160020     231.1.1.1         Up            

3172-A# show run interface nve1

!Command: show running-config interface nve1
!Time: Sat Apr 25 15:09:13 2015

version 6.0(2)U5(1)

interface nve1
  source-interface loopback1
  member vni 160010 mcast-group 231.1.1.1
  member vni 160020 mcast-group 231.1.1.1
  no shutdown

3172-A# show nve internal platform interface detail

3172-A# show mac address-table vlan 10
Legend: 
        * - primary entry, G - Gateway MAC, (R) - Routed MAC, O - Overlay MAC
        age - seconds since first seen,+ - primary entry using vPC Peer-Link
   VLAN     MAC Address      Type      age     Secure NTFY   Ports/SWID.SSID.LID
---------+-----------------+--------+---------+------+----+------------------
* 10       0000.1111.1111    dynamic   5030       F    F  Eth1/48
* 10       0000.2222.2222    dynamic   5010       F    F  nve1(192.168.2.1)

3172-A# show ip mroute detail 
IP Multicast Routing Table for VRF "default"

Total number of routes: 3
Total number of (*,G) routes: 1
Total number of (S,G) routes: 1
Total number of (*,G-prefix) routes: 1

(*, 231.1.1.1/32), uptime: 3w3d, static(1) pim(0) ip(0) 
  Stats: 15/1539 [Packets/Bytes], 0.000   bps
  Incoming interface: Ethernet1/3, RPF nbr: 192.168.1.9, uptime: 1w0d
  Outgoing interface list: (count: 1)
    loopback1, uptime: 3w3d, static

(192.168.2.5/32, 231.1.1.1/32), uptime: 3w3d, ip(0) mrib(1) pim(1) 
  Stats: 142751/9136064 [Packets/Bytes], 34.133  bps
  Incoming interface: loopback1, RPF nbr: 192.168.2.5, uptime: 3w3d
  Outgoing interface list: (count: 2)
    Ethernet1/3, uptime: 1w0d, pim
    loopback1, uptime: 3w3d, mrib, (RPF)

(*, 232.0.0.0/8), uptime: 3w3d, pim(0) ip(0) 
  Stats: 0/0 [Packets/Bytes], 0.000   bps
  Incoming interface: Null, RPF nbr: 0.0.0.0, uptime: 3w3d
  Outgoing interface list: (count: 0)
9396-A
9396-A# show nve peers
Interface Peer-IP          State LearnType Uptime   Router-Mac       
--------- ---------------  ----- --------- -------- -----------------
nve1      192.168.2.5      Up    DP        2d20h    n/a              

9396-A# show nve vni
Codes: CP - Control Plane        DP - Data Plane          
       UC - Unconfigured         SA - Suppress ARP
       
Interface VNI      Multicast-group   State Mode Type [BD/VRF]      Flags
--------- -------- ----------------- ----- ---- ------------------ -----
nve1      160010   231.1.1.1         Up    DP   L2 [10]    
nve1      160020   231.1.1.1         Up    DP   L2 [20]                              

9396-A# show run interface nve1

!Command: show running-config interface nve1
!Time: Sat Apr 25 15:20:45 2015

version 7.0(3)I1(1a)

interface nve1
  mtu 9216
  no shutdown
  source-interface loopback1
  member vni 160010 mcast-group 231.1.1.1
  member vni 160020 mcast-group 231.1.1.1

9396-A# show nve internal platform interface detail 
Printing details of all NVE Interfaces
|======|=========================|===============|===============|=====|=====|
|Intf  |State                    |PriIP          |SecIP          |Vnis |Peers|
|======|=========================|===============|===============|=====|=====|
|nve1  |UP                       |192.168.2.2    |192.168.2.1    |2    |1    |
|======|=========================|===============|===============|=====|=====|

SW_BD/VNIs of interface nve1:
================================================
|======|======|=========================|======|====|======|
|Sw BD |Vni   |State                    |Intf  |Type|Vrf-ID|
|======|======|=========================|======|====|======|
|10    |160010|UP                       |nve1  |DP  |0     
|20    |160020|UP                       |nve1  |DP  |0     
|======|======|=========================|======|====|======|
Peers of interface nve1:
============================================

peer_ip: 192.168.2.5, peer_id: 1, state: UP MAC-learning: Enabled
active_swbds: 
add_pending_swbds: 
rem_pending_swbds:

9396-A# show mac address-table vlan 10
Legend: 
        * - primary entry, G - Gateway MAC, (R) - Routed MAC, O - Overlay MAC
        age - seconds since last seen,+ - primary entry using vPC Peer-Link,
        (T) - True, (F) - False
   VLAN     MAC Address      Type      age     Secure NTFY Ports
---------+-----------------+--------+---------+------+----+------------------
+   10     0000.1111.1111   dynamic  0         F      F    nve1(192.168.2.5)
*   10     0000.2222.2222   dynamic  0         F      F    Po48
G    -     7c0e.ceca.f177   static   -         F      F    sup-eth1(R)

9396-A# show ip mroute detail 
IP Multicast Routing Table for VRF "default"

Total number of routes: 4
Total number of (*,G) routes: 1
Total number of (S,G) routes: 2
Total number of (*,G-prefix) routes: 1

(*, 231.1.1.1/32), uptime: 2d21h, nve(1) ip(0) pim(0) 
  Data Created: No
  Stats: 1/64 [Packets/Bytes], 0.000   bps
  Stats: Inactive Flow
  Incoming interface: Ethernet1/7, RPF nbr: 192.168.1.1
  Outgoing interface list: (count: 1)
    nve1, uptime: 2d21h, nve

(192.168.2.1/32, 231.1.1.1/32), uptime: 2d21h, nve(0) ip(0) mrib(0) pim(0) 
  Data Created: Yes
  VXLAN Flags
    VXLAN Encap
  Stats: 1/51 [Packets/Bytes], 0.000   bps
  Stats: Inactive Flow
  Incoming interface: loopback1, RPF nbr: 192.168.2.1
  Outgoing interface list: (count: 0)

(192.168.2.5/32, 231.1.1.1/32), uptime: 2d21h, ip(0) mrib(0) nve(1) pim(0) 
  Data Created: Yes
  Stats: 16474/1370086 [Packets/Bytes], 13.600  bps
  Stats: Active Flow
  Incoming interface: Ethernet1/7, RPF nbr: 192.168.1.1
  Outgoing interface list: (count: 1)
    nve1, uptime: 2d21h, nve

(*, 232.0.0.0/8), uptime: 2d21h, pim(0) ip(0) 
  Data Created: No
  Stats: 0/0 [Packets/Bytes], 0.000   bps
  Stats: Inactive Flow
  Incoming interface: Null, RPF nbr: 0.0.0.0
  Outgoing interface list: (count: 0)

9396-A# show vpc
Legend:
                (*) - local vPC is down, forwarding via vPC peer-link

vPC domain id                     : 1   
Peer status                       : peer adjacency formed ok      
vPC keep-alive status             : peer is alive                 
Configuration consistency status  : success 
Per-vlan consistency status       : success                       
Type-2 consistency status         : success 
vPC role                          : secondary                     
Number of vPCs configured         : 1   
Peer Gateway                      : Enabled
Dual-active excluded VLANs        : -
Graceful Consistency Check        : Enabled
Auto-recovery status              : Disabled

vPC Peer-link status
---------------------------------------------------------------------
id   Port   Status Active vlans    
--   ----   ------ --------------------------------------------------
1    Po1    up     1,10,20                                                

vPC status
----------------------------------------------------------------------
id   Port   Status Consistency Reason                     Active vlans
--   ----   ------ ----------- ------                     ------------
48   Po48   up     success     success                    1,10
9396-B
9396-B# show nve peers 
Interface Peer-IP          State LearnType Uptime   Router-Mac       
--------- ---------------  ----- --------- -------- -----------------
nve1      192.168.2.5      Up    DP        1w0d     n/a              

9396-B# show nve vni
Codes: CP - Control Plane        DP - Data Plane          
       UC - Unconfigured         SA - Suppress ARP
       
Interface VNI      Multicast-group   State Mode Type [BD/VRF]      Flags
--------- -------- ----------------- ----- ---- ------------------ -----
nve1      160010   231.1.1.1         Up    DP   L2 [10]  
nve1      160020   231.1.1.1         Up    DP   L2 [20]                                

9396-B# show run interface nve1

!Command: show running-config interface nve1
!Time: Sat Apr 25 15:23:25 2015

version 7.0(3)I1(1b)

interface nve1
  mtu 9216
  no shutdown
  source-interface loopback1
  member vni 160010 mcast-group 231.1.1.1
  member vni 160020 mcast-group 231.1.1.1
  
9396-B# show nve internal platform interface detail
Printing details of all NVE Interfaces
|======|=========================|===============|===============|=====|=====|
|Intf  |State                    |PriIP          |SecIP          |Vnis |Peers|
|======|=========================|===============|===============|=====|=====|
|nve1  |UP                       |192.168.2.3    |192.168.2.1    |2    |1    |
|======|=========================|===============|===============|=====|=====|

SW_BD/VNIs of interface nve1:
================================================
|======|======|=========================|======|====|======|
|Sw BD |Vni   |State                    |Intf  |Type|Vrf-ID|
|======|======|=========================|======|====|======|
|10    |160010|UP                       |nve1  |DP  |0     
|20    |160020|UP                       |nve1  |DP  |0     
|======|======|=========================|======|====|======|
Peers of interface nve1:
============================================

peer_ip: 192.168.2.5, peer_id: 1, state: UP MAC-learning: Enabled
active_swbds: 
add_pending_swbds: 
rem_pending_swbds: 

9396-B# show mac address-table vlan 10
Legend: 
        * - primary entry, G - Gateway MAC, (R) - Routed MAC, O - Overlay MAC
        age - seconds since last seen,+ - primary entry using vPC Peer-Link,
        (T) - True, (F) - False
   VLAN     MAC Address      Type      age     Secure NTFY Ports
---------+-----------------+--------+---------+------+----+------------------
*   10     0000.1111.1111   dynamic  0         F      F    nve1(192.168.2.5)
+   10     0000.2222.2222   dynamic  0         F      F    Po48
G    -     58f3.9ca3.64dd   static   -         F      F    sup-eth1(R)

9396-B# show ip mroute detail 
IP Multicast Routing Table for VRF "default"

Total number of routes: 4
Total number of (*,G) routes: 1
Total number of (S,G) routes: 2
Total number of (*,G-prefix) routes: 1

(*, 231.1.1.1/32), uptime: 2w1d, nve(1) ip(0) pim(0) 
  Data Created: No
  VXLAN Flags
    VXLAN Decap
  VPC Flags
    RPF-Source Forwarder
  Stats: 1/64 [Packets/Bytes], 0.000   bps
  Stats: Inactive Flow
  Incoming interface: Ethernet1/7, RPF nbr: 192.168.1.5
  Outgoing interface list: (count: 1)
    nve1, uptime: 2w1d, nve

(192.168.2.1/32, 231.1.1.1/32), uptime: 2w1d, nve(0) ip(0) mrib(0) pim(1) 
  Data Created: Yes
  VXLAN Flags
    VXLAN Encap
  VPC Flags
    RPF-Source Forwarder
  Stats: 5/511 [Packets/Bytes], 0.000   bps
  Stats: Inactive Flow
  Incoming interface: loopback1, RPF nbr: 192.168.2.1
  Outgoing interface list: (count: 1)
    Ethernet1/7, uptime: 1w0d, pim

(192.168.2.5/32, 231.1.1.1/32), uptime: 2w1d, ip(0) mrib(0) pim(0) nve(1) 
  Data Created: Yes
  VXLAN Flags
    VXLAN Decap
  VPC Flags
    RPF-Source Forwarder
  Stats: 86621/7241564 [Packets/Bytes], 13.600  bps
  Stats: Active Flow
  Incoming interface: Ethernet1/7, RPF nbr: 192.168.1.5
  Outgoing interface list: (count: 1)
    nve1, uptime: 2w1d, nve

(*, 232.0.0.0/8), uptime: 2w1d, pim(0) ip(0) 
  Data Created: No
  Stats: 0/0 [Packets/Bytes], 0.000   bps
  Stats: Inactive Flow
  Incoming interface: Null, RPF nbr: 0.0.0.0
  Outgoing interface list: (count: 0)

9396-B# show vpc
Legend:
                (*) - local vPC is down, forwarding via vPC peer-link

vPC domain id                     : 1   
Peer status                       : peer adjacency formed ok      
vPC keep-alive status             : peer is alive                 
Configuration consistency status  : success 
Per-vlan consistency status       : success                       
Type-2 consistency status         : success 
vPC role                          : primary                       
Number of vPCs configured         : 1   
Peer Gateway                      : Enabled
Dual-active excluded VLANs        : -
Graceful Consistency Check        : Enabled
Auto-recovery status              : Disabled

vPC Peer-link status
---------------------------------------------------------------------
id   Port   Status Active vlans    
--   ----   ------ --------------------------------------------------
1    Po1    up     1,10,20                                                

vPC status
----------------------------------------------------------------------
id   Port   Status Consistency Reason                     Active vlans
--   ----   ------ ----------- ------                     ------------
48   Po48   up     success     success                    1,10
VXLAN 数据包捕获
数据包捕获 (PCAP) 来自上一个拓扑，并包括网络图中所示拓扑的 OSPF hello 数据包、PIM 加入/注册消息和 VXLAN 封装流量。您将注意到一些互联网控制消息协议 (ICMP) 标记，例如“no response”。这是因为 RP 上完成的监控会话的性质而造成的。

监控会话包括接口 Eth4/17-18 和 Eth4/20，因此它会抛出一些 Wireshark。重要的信息是格式和标记。

Note:所有封装数据包（BUM 或称已知单播）均来自远程 VTEP 环回 IP 并发往远程 VTEP 环回 IP。这是任何 vPC VTEP 上的辅助环回 IP。

BUM（广播，未知单播、组播）流量将发往组播组。

单播流量将发往远程 VTEP 环回 IP。