VPP基本操作练习
目录
基本操作
启动
输入命令到vpp1
开启vpp shell
接口操作
创建veth
创建vpp接口
设置vpp接口IP
Trace数据包
连接两个VPP实例
查看ARP
查看VPP路由表
启动第二个VPP实例
创建memif
路由操作
添加主机路由
添加vpp2路由
Trace Ping
SWITCHING
重新启动两个VPP实例
建立veth为vpp1
建立veth为vpp2
vpp1建桥
vpp2创建loopback口
vpp2建桥
Trace数据包
检查l2 fib
NAT
创建veth
添加网络域名
配置VPP1 SNAT
检查插件
VPP配置NAT
测试NAT
根据https://wiki.fd.io/view/VPP/Progressive_VPP_Tutorial官方的教程操作一遍的记录
操作内容包括启动多个vpp实例，创建配置接口，memif通信，路由，交换，NAT。
基本操作
启动
sudo vpp unix {cli-listen /run/vpp/cli-vpp1.sock} api-segment { prefix vpp1 }参数说明
prefix vpp1, 实例名，命令两个文件
[ckun@localhost ~]$ cd /dev/shm/
[ckun@localhost shm]$ ls
vpp1-global_vm vpp1-vpe-apicli-listen /run/vpp/cli-vpp1.sock
vppctl用非默认socket文件连接该实例
[ckun@localhost shm]$ cd /run/vpp
[ckun@localhost vpp]$ ls
cli-vpp1.sock输入命令到vpp1
[ckun@localhost vpp_plugins]$ sudo vppctl -s /run/vpp/cli-vpp1.sock show ver
vpp v18.10-13~g00adccea built by vincent on centos at Wed Nov 28 15:53:26 CST 2018开启vpp shell
vppctrl开启一个vpp shell
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp1.sock
_______ _ _ _____ ___
__/ __/ _ \ (_)__ | | / / _ \/ _ \
_/ _// // / / / _ \ | |/ / ___/ ___/
/_/ /____(_)_/\___/ |___/_/ /_/
vpp# quit
[ckun@localhost pkgs]$ 接口操作
创建veth
ckun@localhost pkgs]$ sudo ip link add name vpp1out type veth peer name vpp1host
[sudo] password for ckun:
[ckun@localhost pkgs]$
[ckun@localhost pkgs]$ ip addr show vpp1host
6: vpp1host@vpp1out: mtu 1500 qdisc noop state DOWN group default qlen 1000
link/ether 0e:cb:49:6b:ac:ec brd ff:ff:ff:ff:ff:ff
[ckun@localhost pkgs]$
[ckun@localhost pkgs]$ sudo ip link set dev vpp1out up
[ckun@localhost pkgs]$ sudo ip link set dev vpp1host up
[ckun@localhost pkgs]$ sudo ip addr add 66.6.6.6/24 dev vpp1host
[ckun@localhost pkgs]$ sudo ip addr show vpp1host
6: vpp1host@vpp1out: mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 0e:cb:49:6b:ac:ec brd ff:ff:ff:ff:ff:ff
inet 66.6.6.6/24 scope global vpp1host
valid_lft forever preferred_lft forever
inet6 fe80::ccb:49ff:fe6b:acec/64 scope link
valid_lft forever preferred_lft forever 创建vpp接口
关联到veth
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp1.sock create host-interface name vpp1out
[sudo] password for ckun:
host-vpp1out
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp1.sock show hardware
Name Idx Link Hardware
host-vpp1out 1 up host-vpp1out
Ethernet address 02:fe:e3:84:cc:fd
Linux PACKET socket interface
local0 0 down local0
local设置vpp接口IP
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp1.sock set state host-vpp1out up
set: unknown input `state host-vpp1out up'
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp1.sock set int state host-vpp1out up
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp1.sock set int ip address host-vpp1out 66.6.6.7/24
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp1.sock show int
Name Idx State MTU (L3/IP4/IP6/MPLS) Counter Count
host-vpp1out 1 up 9000/0/0/0
local0 0 down 0/0/0/0
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp1.sock show int address
host-vpp1out (up):
L3 66.6.6.7/24Trace数据包
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp1.sock trace add af-packet-input 10
[ckun@localhost pkgs]$
[ckun@localhost pkgs]$ ping -c 1 66.6.6.7
PING 66.6.6.7 (66.6.6.7) 56(84) bytes of data.
64 bytes from 66.6.6.7: icmp_seq=1 ttl=64 time=0.586 ms
--- 66.6.6.7 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.586/0.586/0.586/0.000 ms
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp1.sock show trace
------------------- Start of thread 0 vpp_main -------------------
Packet 1
01:40:31:378778: af-packet-input
af_packet: hw_if_index 1 next-index 4
tpacket2_hdr:
status 0x20000001 len 98 snaplen 98 mac 66 net 80
sec 0x5bff6929 nsec 0x2d87130 vlan 0 vlan_tpid 0
01:40:31:378794: ethernet-input
IP4: 0e:cb:49:6b:ac:ec -> 02:fe:e3:84:cc:fd
01:40:31:378803: ip4-input
ICMP: 66.6.6.6 -> 66.6.6.7
tos 0x00, ttl 64, length 84, checksum 0x9b12
fragment id 0x0f7e, flags DONT_FRAGMENT
ICMP echo_request checksum 0x8ef0
01:40:31:378806: ip4-lookup
fib 0 dpo-idx 5 flow hash: 0x00000000
ICMP: 66.6.6.6 -> 66.6.6.7
tos 0x00, ttl 64, length 84, checksum 0x9b12
fragment id 0x0f7e, flags DONT_FRAGMENT
ICMP echo_request checksum 0x8ef0
01:40:31:378813: ip4-local
ICMP: 66.6.6.6 -> 66.6.6.7
tos 0x00, ttl 64, length 84, checksum 0x9b12
fragment id 0x0f7e, flags DONT_FRAGMENT
ICMP echo_request checksum 0x8ef0
01:40:31:378814: ip4-icmp-input
ICMP: 66.6.6.6 -> 66.6.6.7
tos 0x00, ttl 64, length 84, checksum 0x9b12
fragment id 0x0f7e, flags DONT_FRAGMENT
ICMP echo_request checksum 0x8ef0
01:40:31:378816: ip4-icmp-echo-request
ICMP: 66.6.6.6 -> 66.6.6.7
tos 0x00, ttl 64, length 84, checksum 0x9b12
fragment id 0x0f7e, flags DONT_FRAGMENT
ICMP echo_request checksum 0x8ef0
01:40:31:378817: ip4-load-balance
fib 0 dpo-idx 13 flow hash: 0x00000000
ICMP: 66.6.6.7 -> 66.6.6.6
tos 0x00, ttl 64, length 84, checksum 0xe0dd
fragment id 0xc9b2, flags DONT_FRAGMENT
ICMP echo_reply checksum 0x96f0
01:40:31:378819: ip4-rewrite
tx_sw_if_index 1 dpo-idx 1 : ipv4 via 66.6.6.6 host-vpp1out: mtu:9000 0ecb496bacec02fee384ccfd0800 flow hash: 0x00000000
00000000: 0ecb496bacec02fee384ccfd080045000054c9b240004001e0dd420606074206
00000020: 0606000096f021bc00012969ff5b000000005fba0000000000001011
01:40:31:378821: host-vpp1out-output
host-vpp1out
IP4: 02:fe:e3:84:cc:fd -> 0e:cb:49:6b:ac:ec
ICMP: 66.6.6.7 -> 66.6.6.6
tos 0x00, ttl 64, length 84, checksum 0xe0dd
fragment id 0xc9b2, flags DONT_FRAGMENT
ICMP echo_reply checksum 0x96f0
sudo vppctl -s /run/vpp/cli-vpp1.sock clear trace连接两个VPP实例
查看ARP
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp1.sock show ip arp
Time IP4 Flags Ethernet Interface
12853.6336 66.6.6.6 D 0e:cb:49:6b:ac:ec host-vpp1out查看VPP路由表
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp1.sock show ip fib
ipv4-VRF:0, fib_index:0, flow hash:[src dst sport dport proto ] locks:[src:plugin-hi:2, src:adjacency:1, src:default-route:1, ]
0.0.0.0/0
unicast-ip4-chain
[@0]: dpo-load-balance: [proto:ip4 index:1 buckets:1 uRPF:0 to:[0:0]]
[0] [@0]: dpo-drop ip4
0.0.0.0/32
unicast-ip4-chain
[@0]: dpo-load-balance: [proto:ip4 index:2 buckets:1 uRPF:1 to:[0:0]]
[0] [@0]: dpo-drop ip4
66.6.6.0/32
unicast-ip4-chain
[@0]: dpo-load-balance: [proto:ip4 index:10 buckets:1 uRPF:9 to:[0:0]]
[0] [@0]: dpo-drop ip4
66.6.6.6/32
unicast-ip4-chain
[@0]: dpo-load-balance: [proto:ip4 index:13 buckets:1 uRPF:12 to:[21:1764] via:[4:336]]
[0] [@5]: ipv4 via 66.6.6.6 host-vpp1out: mtu:9000 0ecb496bacec02fee384ccfd0800
66.6.6.0/24
unicast-ip4-chain
[@0]: dpo-load-balance: [proto:ip4 index:9 buckets:1 uRPF:8 to:[0:0]]
[0] [@4]: ipv4-glean: host-vpp1out: mtu:9000 ffffffffffff02fee384ccfd0806
66.6.6.7/32
unicast-ip4-chain
[@0]: dpo-load-balance: [proto:ip4 index:12 buckets:1 uRPF:13 to:[25:2100]]
[0] [@2]: dpo-receive: 66.6.6.7 on host-vpp1out
66.6.6.255/32
unicast-ip4-chain
[@0]: dpo-load-balance: [proto:ip4 index:11 buckets:1 uRPF:11 to:[0:0]]
[0] [@0]: dpo-drop ip4
224.0.0.0/4
unicast-ip4-chain
[@0]: dpo-load-balance: [proto:ip4 index:4 buckets:1 uRPF:3 to:[0:0]]
[0] [@0]: dpo-drop ip4
240.0.0.0/4
unicast-ip4-chain
[@0]: dpo-load-balance: [proto:ip4 index:3 buckets:1 uRPF:2 to:[0:0]]
[0] [@0]: dpo-drop ip4
255.255.255.255/32
unicast-ip4-chain
[@0]: dpo-load-balance: [proto:ip4 index:5 buckets:1 uRPF:4 to:[0:0]]
[0] [@0]: dpo-drop ip4启动第二个VPP实例
sudo vpp unix {cli-listen /run/vpp/cli-vpp2.sock} api-segment { prefix vpp2 }
创建memif
sudo vppctl -s /run/vpp/cli-vpp1.sock create interface memif id 0 master
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp1.sock create interface memif id 0 master
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp2.sock create interface memif id 0 slave
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp1.sock set int state memif0/0 up
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp1.sock set int ip address memif0/0 66.6.2.1/24
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp1.sock show int
Name Idx State MTU (L3/IP4/IP6/MPLS) Counter Count
host-vpp1out 1 up 9000/0/0/0 rx packets 32
rx bytes 2744
tx packets 32
tx bytes 2744
drops 21
ip4 25
local0 0 down 0/0/0/0
memif0/0 2 up 9000/0/0/0
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp1.sock show int address
host-vpp1out (up):
L3 66.6.6.7/24
local0 (dn):
memif0/0 (up):
L3 66.6.2.1/24
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp2.sock set int state memif0/0 up
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp2.sock set int ip address memif0/0 66.6.2.2/24
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp2.sock show int
Name Idx State MTU (L3/IP4/IP6/MPLS) Counter Count
local0 0 down 0/0/0/0
memif0/0 1 up 9000/0/0/0
[ckun@localhost pkgs]$
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp2.sock show int addr
local0 (dn):
memif0/0 (up):
L3 66.6.2.2/24路由操作
添加主机路由
去66.6.2.0/24网段，得经过66.6.6.7(vpp1)的网关
[ckun@localhost pkgs]$ sudo ip route add 66.6.2.0/24 via 66.6.6.7添加vpp2路由
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp2.sock ip route add 66.6.6.0/24 via 66.6.2.1Trace Ping
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp1.sock clear trace
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp2.sock clear trace
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp1.sock trace add af-packet-input 10
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp1.sock trace add memif-input 10
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp2.sock trace add memif-input 10
ping vpp2的66.6.2.2
[ckun@localhost pkgs]$ ping -c 1 66.6.2.2
PING 66.6.2.2 (66.6.2.2) 56(84) bytes of data.
64 bytes from 66.6.2.2: icmp_seq=1 ttl=63 time=32.3 ms
--- 66.6.2.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 32.306/32.306/32.306/0.000 ms
Trace vpp1
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp1.sock show trace
------------------- Start of thread 0 vpp_main -------------------
Packet 1
06:32:31:320642: af-packet-input
af_packet: hw_if_index 1 next-index 4
tpacket2_hdr:
status 0x20000001 len 98 snaplen 98 mac 66 net 80
sec 0x5bffada8 nsec 0x33382c28 vlan 0 vlan_tpid 0
06:32:31:320646: ethernet-input
IP4: 0e:cb:49:6b:ac:ec -> 02:fe:e3:84:cc:fd
06:32:31:320649: ip4-input
ICMP: 66.6.6.6 -> 66.6.2.2
tos 0x00, ttl 64, length 84, checksum 0xb482
fragment id 0xfa12, flags DONT_FRAGMENT
ICMP echo_request checksum 0xb2aa
06:32:31:320651: ip4-lookup
fib 0 dpo-idx 3 flow hash: 0x00000000
ICMP: 66.6.6.6 -> 66.6.2.2
tos 0x00, ttl 64, length 84, checksum 0xb482
fragment id 0xfa12, flags DONT_FRAGMENT
ICMP echo_request checksum 0xb2aa
06:32:31:320653: ip4-rewrite
tx_sw_if_index 2 dpo-idx 3 : ipv4 via 66.6.2.2 memif0/0: mtu:9000 02fe41ed93e802feed6375990800 flow hash: 0x00000000
00000000: 02fe41ed93e802feed637599080045000054fa1240003f01b582420606064206
00000020: 02020800b2aa2e5b0001a8adff5b00000000a31c0d00000000001011
06:32:31:320655: memif0/0-output
memif0/0
IP4: 02:fe:ed:63:75:99 -> 02:fe:41:ed:93:e8
ICMP: 66.6.6.6 -> 66.6.2.2
tos 0x00, ttl 63, length 84, checksum 0xb582
fragment id 0xfa12, flags DONT_FRAGMENT
ICMP echo_request checksum 0xb2aa
Packet 2
06:32:31:331352: memif-input
memif: hw_if_index 2 next-index 4
slot: ring 0
Trace vpp2
[ckun@localhost vpp]$ sudo vppctl -s /run/vpp/cli-vpp2.sock show trace
[sudo] password for ckun:
------------------- Start of thread 0 vpp_main -------------------
Packet 1
02:48:16:790140: memif-input
memif: hw_if_index 1 next-index 4
slot: ring 0
02:48:16:790145: ethernet-input
IP4: 02:fe:ed:63:75:99 -> 02:fe:41:ed:93:e8
02:48:16:790148: ip4-input
ICMP: 66.6.6.6 -> 66.6.2.2
tos 0x00, ttl 63, length 84, checksum 0xb582
fragment id 0xfa12, flags DONT_FRAGMENT
ICMP echo_request checksum 0xb2aa
02:48:16:790151: ip4-lookup
fib 0 dpo-idx 5 flow hash: 0x00000000
ICMP: 66.6.6.6 -> 66.6.2.2
tos 0x00, ttl 63, length 84, checksum 0xb582
fragment id 0xfa12, flags DONT_FRAGMENT
ICMP echo_request checksum 0xb2aa
02:48:16:790154: ip4-local
ICMP: 66.6.6.6 -> 66.6.2.2
tos 0x00, ttl 63, length 84, checksum 0xb582
fragment id 0xfa12, flags DONT_FRAGMENT
ICMP echo_request checksum 0xb2aa
02:48:16:790155: ip4-icmp-input
ICMP: 66.6.6.6 -> 66.6.2.2
tos 0x00, ttl 63, length 84, checksum 0xb582
fragment id 0xfa12, flags DONT_FRAGMENT
ICMP echo_request checksum 0xb2aa
02:48:16:790156: ip4-icmp-echo-request
ICMP: 66.6.6.6 -> 66.6.2.2
tos 0x00, ttl 63, length 84, checksum 0xb582
fragment id 0xfa12, flags DONT_FRAGMENT
ICMP echo_request checksum 0xb2aa
02:48:16:790158: ip4-load-balance
fib 0 dpo-idx 14 flow hash: 0x00000000
ICMP: 66.6.2.2 -> 66.6.6.6
tos 0x00, ttl 64, length 84, checksum 0x88b5
fragment id 0x25e0, flags DONT_FRAGMENT
ICMP echo_reply checksum 0xbaaa
fib 0 dpo-idx 13 flow hash: 0x00000000
ICMP: 66.6.2.2 -> 66.6.6.6
tos 0x00, ttl 64, length 84, checksum 0x88b5
fragment id 0x25e0, flags DONT_FRAGMENT
ICMP echo_reply checksum 0xbaaa
02:48:16:790160: ip4-rewrite
tx_sw_if_index 1 dpo-idx 1 : ipv4 via 66.6.2.1 memif0/0: mtu:9000 02feed63759902fe41ed93e80800 flow hash: 0x00000000
00000000: 02feed63759902fe41ed93e808004500005425e04000400188b5420602024206
00000020: 06060000baaa2e5b0001a8adff5b00000000a31c0d00000000001011
02:48:16:790161: memif0/0-output
memif0/0
IP4: 02:fe:41:ed:93:e8 -> 02:fe:ed:63:75:99
ICMP: 66.6.2.2 -> 66.6.6.6
tos 0x00, ttl 64, length 84, checksum 0x88b5
fragment id 0x25e0, flags DONT_FRAGMENT
ICMP echo_reply checksum 0xbaaaSWITCHING
先reboot或者杀掉vpp进程，清除veth。
重新启动两个VPP实例
sudo vpp unix {cli-listen /run/vpp/cli-vpp1.sock} api-segment { prefix vpp1 }
sudo vpp unix {cli-listen /run/vpp/cli-vpp2.sock} api-segment { prefix vpp2 }建立veth为vpp1
sudo ip link add name vpp1host type veth peer name vpp1out
sudo ip link set dev vpp1host up
sudo ip link set dev vpp1out up
sudo ip addr add 66.6.1.1/24 dev vpp1host
sudo vppctl -s /run/vpp/cli-vpp1.sock create host-interface name vpp1out
sudo vppctl -s /run/vpp/cli-vpp1.sock show int
sudo vppctl -s /run/vpp/cli-vpp1.sock set int state host-vpp1out up
sudo vppctl -s /run/vpp/cli-vpp1.sock show int addr建立veth为vpp2
sudo ip link add name vpp1vpp2 type veth peer name vpp2vpp1
sudo ip link set dev vpp1vpp2 up
sudo ip link set dev vpp2vpp1 up
sudo vppctl -s /run/vpp/cli-vpp1.sock create host-interface name vpp1vpp2
sudo vppctl -s /run/vpp/cli-vpp1.sock set int state host-vpp1vpp2 up
sudo vppctl -s /run/vpp/cli-vpp2.sock create host-interface name vpp2vpp1
sudo vppctl -s /run/vpp/cli-vpp2.sock set int state host-vpp2vpp1 up
[ckun@localhost ~]$ sudo vppctl -s /run/vpp/cli-vpp2.sock show int
Name Idx State MTU (L3/IP4/IP6/MPLS) Counter Count
host-vpp2vpp1 1 up 9000/0/0/0
local0 0 down 0/0/0/0
[ckun@localhost ~]$
[ckun@localhost ~]$
[ckun@localhost ~]$ sudo vppctl -s /run/vpp/cli-vpp1.sock show int
Name Idx State MTU (L3/IP4/IP6/MPLS) Counter Count
host-vpp1out 1 up 9000/0/0/0 rx packets 29
rx bytes 4177
drops 29
ip4 15
ip6 14
host-vpp1vpp2 2 up 9000/0/0/0
local0 0 down 0/0/0/0vpp1建桥
[ckun@localhost ~]$ sudo vppctl -s /run/vpp/cli-vpp1.sock set int l2 bridge host-vpp1out 1
[ckun@localhost ~]$ sudo vppctl -s /run/vpp/cli-vpp1.sock set int l2 bridge host-vpp1vpp2 1
[ckun@localhost ~]$ sudo vppctl -s /run/vpp/cli-vpp1.sock show bridge-domain
BD-ID Index BSN Age(min) Learning U-Forwrd UU-Flood Flooding ARP-Term BVI-Intf
1 1 0 off on on flood on off N/A
[ckun@localhost ~]$
[ckun@localhost ~]$ sudo vppctl -s /run/vpp/cli-vpp1.sock show bridge-domain 1 detail
BD-ID Index BSN Age(min) Learning U-Forwrd UU-Flood Flooding ARP-Term BVI-Intf
1 1 0 off on on flood on off N/A
Interface If-idx ISN SHG BVI TxFlood VLAN-Tag-Rewrite
host-vpp1out 1 3 0 - * none
host-vpp1vpp2 2 3 0 - * none vpp2创建loopback口
[ckun@localhost ~]$ sudo vppctl -s /run/vpp/cli-vpp2.sock create loopback interface
loop0
[ckun@localhost ~]$ sudo vppctl -s /run/vpp/cli-vpp2.sock set int state loop0 up
[ckun@localhost ~]$ sudo vppctl -s /run/vpp/cli-vpp2.sock set int ip address loop0 66.6.1.2/24
vpp2建桥
sudo vppctl -s /run/vpp/cli-vpp2.sock set int l2 bridge loop0 1 bvi
sudo vppctl -s /run/vpp/cli-vpp2.sock set int l2 bridge host-vpp2vpp1 1
[ckun@localhost ~]$ sudo vppctl -s /run/vpp/cli-vpp2.sock show bridge-domain 1 detail
BD-ID Index BSN Age(min) Learning U-Forwrd UU-Flood Flooding ARP-Term BVI-Intf
1 1 0 off on on flood on off loop0
Interface If-idx ISN SHG BVI TxFlood VLAN-Tag-Rewrite
loop0 2 1 0 * * none
host-vpp2vpp1 1 1 0 - * none
Trace数据包
[ckun@localhost ~]$ sudo vppctl -s /run/vpp/cli-vpp1.sock trace add af-packet-input 10
[ckun@localhost ~]$ sudo vppctl -s /run/vpp/cli-vpp2.sock trace add af-packet-input 10
[ckun@localhost ~]$ sudo vppctl -s /run/vpp/cli-vpp2.sock ping 66.6.1.1
64 bytes from 66.6.1.1: icmp_seq=1 ttl=64 time=10.4932 ms
^C
[ckun@localhost ~]$ sudo vppctl -s /run/vpp/cli-vpp2.sock show trace
------------------- Start of thread 0 vpp_main -------------------
Packet 1
00:47:31:078594: af-packet-input
af_packet: hw_if_index 1 next-index 4
tpacket2_hdr:
status 0x1 len 98 snaplen 98 mac 66 net 80
sec 0x5c00a570 nsec 0x1985de22 vlan 0 vlan_tpid 0
00:47:31:078597: ethernet-input
IP4: 5a:ee:dd:35:b9:81 -> de:ad:00:00:00:00
00:47:31:078599: l2-input
l2-input: sw_if_index 1 dst de:ad:00:00:00:00 src 5a:ee:dd:35:b9:81
00:47:31:078600: l2-learn
l2-learn: sw_if_index 1 dst de:ad:00:00:00:00 src 5a:ee:dd:35:b9:81 bd_index 1
00:47:31:078601: l2-fwd
l2-fwd: sw_if_index 1 dst de:ad:00:00:00:00 src 5a:ee:dd:35:b9:81 bd_index 1
00:47:31:078602: ip4-input
ICMP: 66.6.1.1 -> 66.6.1.2
tos 0x00, ttl 64, length 84, checksum 0x4588
fragment id 0xaf12
ICMP echo_reply checksum 0xe145
00:47:31:078603: ip4-lookup
fib 0 dpo-idx 5 flow hash: 0x00000000
ICMP: 66.6.1.1 -> 66.6.1.2
tos 0x00, ttl 64, length 84, checksum 0x4588
fragment id 0xaf12
ICMP echo_reply checksum 0xe145
00:47:31:078604: ip4-local
ICMP: 66.6.1.1 -> 66.6.1.2
tos 0x00, ttl 64, length 84, checksum 0x4588
fragment id 0xaf12
ICMP echo_reply checksum 0xe145
00:47:31:078605: ip4-icmp-input
ICMP: 66.6.1.1 -> 66.6.1.2
tos 0x00, ttl 64, length 84, checksum 0x4588
fragment id 0xaf12
ICMP echo_reply checksum 0xe145
00:47:31:078606: ip4-icmp-echo-reply
ICMP echo id 59385 seq 1
00:47:31:078609: ip4-drop
ICMP: 66.6.1.1 -> 66.6.1.2
tos 0x00, ttl 64, length 84, checksum 0x4588
fragment id 0xaf12
ICMP echo_reply checksum 0xe145
00:47:31:078609: error-drop
ip4-icmp-input: unknown type
[ckun@localhost ~]$ sudo vppctl -s /run/vpp/cli-vpp1.sock show trace
------------------- Start of thread 0 vpp_main -------------------
Packet 1
00:47:32:458501: af-packet-input
af_packet: hw_if_index 2 next-index 4
tpacket2_hdr:
status 0x1 len 98 snaplen 98 mac 66 net 80
sec 0x5c00a570 nsec 0x19849fbf vlan 0 vlan_tpid 0
00:47:32:458505: ethernet-input
IP4: de:ad:00:00:00:00 -> 5a:ee:dd:35:b9:81
00:47:32:458507: l2-input
l2-input: sw_if_index 2 dst 5a:ee:dd:35:b9:81 src de:ad:00:00:00:00
00:47:32:458509: l2-learn
l2-learn: sw_if_index 2 dst 5a:ee:dd:35:b9:81 src de:ad:00:00:00:00 bd_index 1
00:47:32:458511: l2-fwd
l2-fwd: sw_if_index 2 dst 5a:ee:dd:35:b9:81 src de:ad:00:00:00:00 bd_index 1
00:47:32:458512: l2-output
l2-output: sw_if_index 1 dst 5a:ee:dd:35:b9:81 src de:ad:00:00:00:00 data 08 00 45 00 00 54 00 00 00 00 fe 01
00:47:32:458513: host-vpp1out-output
host-vpp1out
IP4: de:ad:00:00:00:00 -> 5a:ee:dd:35:b9:81
ICMP: 66.6.1.2 -> 66.6.1.1
tos 0x00, ttl 254, length 84, checksum 0x369a
fragment id 0x0000
ICMP echo_request checksum 0xd945
Packet 2
00:47:32:458553: af-packet-input
af_packet: hw_if_index 1 next-index 4
tpacket2_hdr:
status 0x1 len 98 snaplen 98 mac 66 net 80
sec 0x5c00a570 nsec 0x1985b56f vlan 0 vlan_tpid 0
00:47:32:458554: ethernet-input
IP4: 5a:ee:dd:35:b9:81 -> de:ad:00:00:00:00
00:47:32:458555: l2-input
l2-input: sw_if_index 1 dst de:ad:00:00:00:00 src 5a:ee:dd:35:b9:81
00:47:32:458555: l2-learn
l2-learn: sw_if_index 1 dst de:ad:00:00:00:00 src 5a:ee:dd:35:b9:81 bd_index 1
00:47:32:458555: l2-fwd
l2-fwd: sw_if_index 1 dst de:ad:00:00:00:00 src 5a:ee:dd:35:b9:81 bd_index 1
00:47:32:458556: l2-output
l2-output: sw_if_index 2 dst de:ad:00:00:00:00 src 5a:ee:dd:35:b9:81 data 08 00 45 00 00 54 af 12 00 00 40 01
00:47:32:458556: host-vpp1vpp2-output
host-vpp1vpp2
IP4: 5a:ee:dd:35:b9:81 -> de:ad:00:00:00:00
ICMP: 66.6.1.1 -> 66.6.1.2
tos 0x00, ttl 64, length 84, checksum 0x4588
fragment id 0xaf12
ICMP echo_reply checksum 0xe145检查l2 fib
[ckun@localhost ~]$ sudo vppctl -s /run/vpp/cli-vpp1.sock show l2fib verbose
Mac-Address BD-Idx If-Idx BSN-ISN Age(min) static filter bvi Interface-Name
de:ad:00:00:00:00 1 2 0/3 - - - - host-vpp1vpp2
5a:ee:dd:35:b9:81 1 1 0/3 - - - - host-vpp1out
L2FIB total/learned entries: 2/2 Last scan time: 6.0619e-4sec Learn limit: 4194304
[ckun@localhost ~]$ sudo vppctl -s /run/vpp/cli-vpp2.sock show l2fib verbose
Mac-Address BD-Idx If-Idx BSN-ISN Age(min) static filter bvi Interface-Name
de:ad:00:00:00:00 1 2 0/0 no * - * loop0
5a:ee:dd:35:b9:81 1 1 0/1 - - - - host-vpp2vpp1
L2FIB total/learned entries: 2/1 Last scan time: 0.0000e0sec Learn limit: 4194304 NAT
清除配置，重启一个VPP1实例
创建veth
[ckun@localhost pkgs]$ sudo ip link add name vpp1outside type veth peer name vpp1outsidehost
[sudo] password for ckun:
[ckun@localhost pkgs]$
[ckun@localhost pkgs]$
[ckun@localhost pkgs]$ sudo ip addr add 66.6.1.1/24 dev vpp1outsidehost
[ckun@localhost pkgs]$
[ckun@localhost pkgs]$ sudo ip link add name vpp1inside type veth peer name vpp1insidehost
[ckun@localhost pkgs]$ sudo ip addr add 66.6.2.1/24 dev vpp1insidehost
[ckun@localhost pkgs]$
[ckun@localhost pkgs]$ sudo ip link set dev vpp1outsidehost up
[ckun@localhost pkgs]$ sudo ip link set dev vpp1insidehost up
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp1.sock set int ip address host-vpp1outside 66.6.1.2/24
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp1.sock set int ip address host-vpp1inside 66.6.2.2/24
[ckun@localhost pkgs]$
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp1.sock set int state host-vpp1outside up
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp1.sock set int state host-vpp1inside up
添加网络域名
[ckun@localhost pkgs]$ sudo ip netns add inside
[ckun@localhost pkgs]$
[ckun@localhost pkgs]$ sudo ip link set dev vpp1insidehost up netns inside
[ckun@localhost pkgs]$ sudo ip netns exec inside ip addr add 66.6.2.1/24 dev vpp1insidehost
[ckun@localhost pkgs]$ sudo ip netns exec inside ip route add 66.6.1.0/24 via 66.6.2.2配置VPP1 SNAT
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp1.sock snat add interface address host-vpp1outside
unknown input `snat add interface address hos...'检查插件
[ckun@localhost pkgs]$ sudo vppctl -s /run/vpp/cli-vpp1.sock show plugin
Plugin path is: /usr/lib/vpp_plugins
Plugin Version Description
1. ioam_plugin.so 18.10-13~g00adccea Inbound OAM
2. memif_plugin.so 18.10-13~g00adccea Packet Memory Interface (experimental)
3. nsh_plugin.so 18.10-13~g00adccea Network Service Header
4. avf_plugin.so 18.10-13~g00adccea Intel Adaptive Virtual Function (AVF) Device Plugin
5. pppoe_plugin.so 18.10-13~g00adccea PPPoE
6. abf_plugin.so 18.10-13~g00adccea ACL based Forwarding
7. srv6am_plugin.so 18.10-13~g00adccea Masquerading SRv6 proxy
8. ila_plugin.so 18.10-13~g00adccea Identifier-locator addressing for IPv6
9. l2e_plugin.so 18.10-13~g00adccea L2 Emulation
10. tlsopenssl_plugin.so 18.10-13~g00adccea openssl based TLS Engine
11. gtpu_plugin.so 18.10-13~g00adccea GTPv1-U
12. map_plugin.so 18.10-13~g00adccea Mapping of address and port (MAP)
13. stn_plugin.so 18.10-13~g00adccea VPP Steals the NIC for Container integration
14. acl_plugin.so 18.10-13~g00adccea Access Control Lists
15. cdp_plugin.so 18.10-13~g00adccea
16. lacp_plugin.so 18.10-13~g00adccea Link Aggregation Control Protocol
17. flowprobe_plugin.so 18.10-13~g00adccea Flow per Packet
18. svs_plugin.so 18.10-13~g00adccea Source VRF Select
19. nsim_plugin.so 18.10-13~g00adccea network delay simulator plugin
20. mactime_plugin.so 18.10-13~g00adccea Time-based MAC source-address filter
21. lb_plugin.so 18.10-13~g00adccea Load Balancer
22. srv6as_plugin.so 18.10-13~g00adccea Static SRv6 proxy
23. srv6ad_plugin.so 18.10-13~g00adccea Dynamic SRv6 proxy
24. vmxnet3_plugin.so 18.10-13~g00adccea VMWare Vmxnet3 Device Plugin
25. gbp_plugin.so 18.10-13~g00adccea Group Based Policy
26. igmp_plugin.so 18.10-13~g00adccea IGMP messaging
27. nat_plugin.so 18.10-13~g00adccea Network Address Translation没有snat_plugin.so, 但是有nat_plugin.so. 经过尝试也可以继续配置
VPP配置NAT
vpp# nat44 add interface address host-vpp1outside
vpp# set interface nat44 in host-vpp1inside out host-vpp1outside
vpp#
vpp# show nat44 interface address host-vpp1inside
NAT44 pool address interfaces:
host-vpp1outside
NAT44 twice-nat pool address interfaces:
unknown input `host-vpp1inside'
vpp#
vpp# show nat44 interface address host-vpp1outside
NAT44 pool address interfaces:
host-vpp1outside
NAT44 twice-nat pool address interfaces:
unknown input `host-vpp1outside'
vpp# 测试NAT
从主机66.6.2.1 ping 66.6.1.1
根据路由Nexthop为66.6.2.2，也就VPP host-vpp1inside口
ICMP包经过VPP的NAT，从66.6.1.2出到主机66.6.1.1
[ckun@localhost vpp_plugins]$ sudo ip netns exec inside ping -c 1 66.6.1.1
PING 66.6.1.1 (66.6.1.1) 56(84) bytes of data.
64 bytes from 66.6.1.1: icmp_seq=1 ttl=63 time=0.125 ms
--- 66.6.1.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.125/0.125/0.125/0.000 ms
[ckun@localhost ~]$ sudo tcpdump -i vpp1outsidehost -s 0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on vpp1outsidehost, link-type EN10MB (Ethernet), capture size 262144 bytes
14:54:29.290420 IP 66-6-1-2.d2.itctel.com > 66-6-1-1.d2.itctel.com: ICMP echo request, id 25801, seq 1, length 64
14:54:29.290440 IP 66-6-1-1.d2.itctel.com > 66-6-1-2.d2.itctel.com: ICMP echo reply, id 25801, seq 1, length 64
^C
2 packets captured
2 packets received by filter
0 packets dropped by kernel
[ckun@localhost ~]$
vpp# trace add af-packet-input 10
vpp#
vpp# show trace
------------------- Start of thread 0 vpp_main -------------------
Packet 1
03:46:53:080613: af-packet-input
af_packet: hw_if_index 2 next-index 4
tpacket2_hdr:
status 0x20000001 len 98 snaplen 98 mac 66 net 80
sec 0x5c00dea5 nsec 0x114e84e9 vlan 0 vlan_tpid 0
03:46:53:080623: ethernet-input
IP4: 76:97:dd:07:3b:cf -> 02:fe:69:50:a2:c5
03:46:53:080629: ip4-input
ICMP: 66.6.2.1 -> 66.6.1.1
tos 0x00, ttl 64, length 84, checksum 0x06c8
fragment id 0xacd3, flags DONT_FRAGMENT
ICMP echo_request checksum 0x5513
03:46:53:080631: nat44-in2out
NAT44_IN2OUT_FAST_PATH: sw_if_index 2, next index 3, session -1
03:46:53:080633: nat44-in2out-slowpath
NAT44_IN2OUT_SLOW_PATH: sw_if_index 2, next index 0, session 4
03:46:53:080643: ip4-lookup
fib 0 dpo-idx 3 flow hash: 0x00000000
ICMP: 66.6.1.2 -> 66.6.1.1
tos 0x00, ttl 64, length 84, checksum 0x07c7
fragment id 0xacd3, flags DONT_FRAGMENT
ICMP echo_request checksum 0x5ba
03:46:53:080648: ip4-rewrite
tx_sw_if_index 1 dpo-idx 3 : ipv4 via 66.6.1.1 host-vpp1outside: mtu:9000 f69c3440da9602fe3319c6f70800 flow hash: 0x00000000
00000000: f69c3440da9602fe3319c6f7080045000054acd340003f0108c7420601024206
00000020: 0101080005ba64c90001a5de005c00000000246e0400000000001011
03:46:53:080650: host-vpp1outside-output
host-vpp1outside
IP4: 02:fe:33:19:c6:f7 -> f6:9c:34:40:da:96
ICMP: 66.6.1.2 -> 66.6.1.1
tos 0x00, ttl 63, length 84, checksum 0x08c7
fragment id 0xacd3, flags DONT_FRAGMENT
ICMP echo_request checksum 0x5ba
Packet 2
03:46:53:080692: af-packet-input
af_packet: hw_if_index 1 next-index 4
tpacket2_hdr:
status 0x20000001 len 98 snaplen 98 mac 66 net 80
sec 0x5c00dea5 nsec 0x114fc9d1 vlan 0 vlan_tpid 0