基于OpenVSwitch实现Vlan进行测试
背景
目前公司二层网络机器和交换机越来越多，当广播的时候二层网络上的机器都会受到报文，这样网络性能就会下降。
解决方案：
1.物理隔离:需要通信的交换机连接在单独的交换机上，交换机之间通过路由器连接。
2.虚拟隔离(VPC采用的技术)：VLan/VxLan/GRE。使用VLan可以连接在一个交换机上的机器进行通信隔离。
VLan介绍
VLan技术在原来的二层报文的头上加一个 TAG，里面有一个 VLAN ID，一共 12 位，可以划分 4096 个 VLAN，如下图所示。。该数量不足以支持目前的云计算，故云计算中采用的是VxLan，有24位VID标识。
交换机有Access口和Trunk口，其作用如下。
- Trunk Port
- 这个port配置VID用于代表特定的VPC，1个Port可以配置多个VID。
- 从这个port出入的包不会添加VID和剥离VID。
- 如果Port配置VID为空，允许所有的包通过。
- 如果配置了具体的VID，仅允许带这些VID的包通过，不允许除此之外的包通过。
- Access Port
- Access port配置VID，1个Port只能配置1个VID。
- 从这个port进来的包会被打上配置的VID，出去会剥离VID。
- 如果进来的包所带的VID与Access Port配置的VID一致，则允许从这个Port出去，否则不允许。
实验环境
为了验证VLan的功能，我们将搭建如下的实验环境。
上面的如晦涩南理解，简化为一以下的网络架构图。
搭建步骤
- 安装KVM所需的安装包
sudo apt-get install qemu-kvm qemu-system libvirt-bin virt-manager bridge-utils vlan
- 确认是否可以虚拟化
egrep -o ‘(vmx|svm)’ /proc/cpuinfo
vmx
- 查看Libvirtd 是否已经启动
service libvirt-bin status
如果没有，则启动Libvirted服务
service libvirt-bin start
- 其用图形化管理工具virt-manager，这里，xManager最好有6.0版本，4.0版本会出现崩溃现象。
virt-manager
- 创建所需3台虚拟机，为虚拟机分配CPU和内存
6.可以查下看创建的虚拟机
virsh list
7.创建虚拟交换机
ovs-vsctl add-br ubuntu_br
ovs-vsctl add-port ubuntu_br ens33
以下命令正常情况下不需要执行
sudo ifconfig ubuntu_br 192.168.112.2 netmask 255.255.255.0
sudo route add default gw 192.168.112.2 ubuntu_br
sudo route del default gw 192.168.112.2 ens33
sudo route del -net 192.168.112.0 netmask 255.255.255.0 dev ens33
8.修改宿主机/etc/network/interfaces文件如下，然后重启主机
#This file describes the network interfaces available on your system
#and how to activate them. For more information, see interfaces(5).source /etc/network/interfaces.d/*
#The loopback network interface auto lo iface lo inet loopback
#The primary network interface
auto ens33
iface ens33 inet manual
dns-nameserver 192.168.112.2auto br0
iface br0 inet dhcp
bridge_stp off
bridge_waitport 0
bridge_fd 0
bridge_ports ens33
- 配置ens33 IP，并通过Xmanager修改3台虚拟机网络配置为网桥br0
sudo ifconfig ens33 192.168.112.139 netmask 255.255.255.0
brctl show 查看宿主机上的网络配置
- 宿主机上查看对应虚拟机的网络设备
virsh domiflist VM1
- 创建网络拓扑
ovs-vsctl add-port ubuntu_br vnet0
ovs-vsctl add-port ubuntu_br vnet1
ovs-vsctl add-port ubuntu_br vnet2
ovs-vsctl set Port vnet0 tag=101
ovs-vsctl set Port vnet1 tag=102
ovs-vsctl set Port vnet2 tag=103
ovs-vsctl add-port ubuntu_br first_br
ovs-vsctl add-port ubuntu_br second_br
ovs-vsctl add-port ubuntu_br third_br
ovs-vsctl set Port first_br tag=103
ovs-vsctl clear Port second_br tag
ovs-vsctl set Port third_br trunks=101,102
需要监听ARP，所以禁止MAC地址学习
ovs-vsctl set bridge ubuntu_br flood-vlans=101,102,103
ip link add first_br type veth peer name first_if
ip link add second_br type veth peer name second_if
ip link add third_br type veth peer name third_if
- 测试：抓包验证
12.1 在generic-3 tag103 上ping first_if（tag103）192.168.112.135
结果1：从first_if出来没有vlan:
root@localhost:/home/chenzb# tcpdump -n -e -i first_if arp
tcpdump: verbose output suppressed, use -v or -vv for full protocol
decodelistening on first_if, link-type EN10MB (Ethernet), capture size
262144 bytes21:36:19.698158 52:54:00:62:ce:24 > ff:ff:ff:ff:ff:ff, ethertype ARP
(0x0806), length 42: Request who-has 192.168.122.1 tell
192.168.122.181, length 2821:36:20.697732 52:54:00:62:ce:24 > ff:ff:ff:ff:ff:ff, ethertype ARP
(0x0806), length 42: Request who-has 192.168.122.1 tell
192.168.122.181, length 2821:36:21.695594 52:54:00:62:ce:24 > ff:ff:ff:ff:ff:ff, ethertype ARP
(0x0806), length 42: Request who-has 192.168.122.1 tell
192.168.122.181, length 2821:36:22.704178 52:54:00:62:ce:24 > ff:ff:ff:ff:ff:ff, ethertype ARP
(0x0806), length 42: Request who-has 192.168.122.1 tell
192.168.122.181, length 28
结果2：从second_if出来有vlan id,因为 second_br 是 trunk port
root@localhost:/home/chenzb# tcpdump -n -e -i second_if arp
tcpdump: verbose output suppressed, use -v or -vv for full protocol
decodelistening on second_if, link-type EN10MB (Ethernet), capture size
262144 bytes21:41:02.569849 52:54:00:62:ce:24 > ff:ff:ff:ff:ff:ff, ethertype
802.1Q (0x8100), length 46: vlan 103, p 0, ethertype ARP, Request who-has 192.168.122.1 tell 192.168.122.181, length 2821:41:03.568726 52:54:00:62:ce:24 > ff:ff:ff:ff:ff:ff, ethertype
802.1Q (0x8100), length 46: vlan 103, p 0, ethertype ARP, Request who-has 192.168.122.1 tell 192.168.122.181, length 28
结果3：从third_if出来没有响应
12.2 在generic(tag 101)ping third_if(trunk:tag101,102) 192.168.112.137
结果1：second_if和third_if可以收到包，vlanID为101 :
root@localhost:/home/chenzb#
tcpdump -n -e -i third_if arptcpdump: verbose output suppressed, use -v or -vv for full protocol
decode listening on third_if, link-type EN10MB (Ethernet), capture
size 262144 bytes21:56:33.761049 52:54:00:1a:8a:e2 > ff:ff:ff:ff:ff:ff, ethertype
802.1Q (0x8100), length 46: vlan 101, p 0, ethertype ARP, Request who-has 192.168.122.1 tell 192.168.122.168, length 2821:56:34.762034 52:54:00:1a:8a:e2 > ff:ff:ff:ff:ff:ff, ethertype
802.1Q (0x8100), length 46: vlan 101, p 0, ethertype ARP, Request who-has 192.168.122.1 tell 192.168.122.168, length 28================================================================
root@localhost:/home/chenzb# tcpdump -n -e -i second_if arptcpdump: verbose output suppressed, use -v or -vv for full protocol
decode listening on second_if, link-type EN10MB (Ethernet), capture
size 262144 bytes21:50:06.428757 52:54:00:1a:8a:e2 > ff:ff:ff:ff:ff:ff, ethertype
802.1Q (0x8100), length 46: vlan 101, p 0, ethertype ARP, Request who-has 192.168.122.1 tell 192.168.122.168, length 2821:50:07.428706 52:54:00:1a:8a:e2 > ff:ff:ff:ff:ff:ff, ethertype
802.1Q (0x8100), length 46: vlan 101, p 0, ethertype ARP, Request who-has 192.168.122.1 tell 192.168.122.168, length 28
结果2：first_if收不到包
- 清理环境
ovs-vsctl clear Bridge ubuntu_br flood_vlans
ovs-vsctl list Port
ovs-vsctl clear Port vnet1 tag
ovs-vsctl clear Port vnet0 tag
ovs-vsctl clear Port first_br tag
ovs-vsctl clear Port third_br trunks