ensp pro VXLAN集中式网关实验

集中式网关

集中式网关意思是所有BD的网关集中放在一个设备上

MAC VRF（BD中的EVPN实例）是二层vni
IP VRF是三层vni

三层vni在转发平面上解决跨网段通讯问题
二层vni在转发平面上解决同网段通讯问题
集中式网关只涉及到二层vni

东西向靠直连路由，南北靠默认路由

集中式网关仅靠直连路由进行东西互访

拓扑

实验目的

全网互通，使用集中式网关实现同网段通信和跨网段通信

配置

业务接入点配置

SW1:
#
vlan batch 10 20
#
interface GE1/0/1
 port link-type trunk
 port trunk allow-pass vlan 10 20
#
interface GE1/0/2
 port default vlan 10
#
interface GE1/0/3
 port default vlan 20


SW2:
#
vlan batch 10 20
#
interface GE1/0/1
 port link-type trunk
 port trunk allow-pass vlan 10 20
#
interface GE1/0/2
 port default vlan 10
#
interface GE1/0/3
 port default vlan 20


CE1:
#
bridge-domain 1000
 vxlan vni 1000
#
bridge-domain 2000
 vxlan vni 2000
#
interface GE1/0/1.10 mode l2
 encapsulation dot1q vid 10
 bridge-domain 1000
#
interface GE1/0/1.20 mode l2
 encapsulation dot1q vid 20
 bridge-domain 2000


CE2:
#
bridge-domain 1000
 vxlan vni 1000
#
bridge-domain 2000
 vxlan vni 2000
#
interface GE1/0/2.10 mode l2
 encapsulation dot1q vid 10
 bridge-domain 1000
#
interface GE1/0/2.20 mode l2
 encapsulation dot1q vid 20
 bridge-domain 2000

spine-leaf之间的underlay不需要关注是多少，这里已经预配完

VTEP配置 EVPN

CE1:
#
e-overlay enable 
#
bridge-domain 1000
e
 route-distinguisher 1:1
 -target 10:10 export-extcommunity
 -target 10:10 import-extcommunity
 #
bridge-domain 2000
e
 route-distinguisher 2:1
 -target 20:20 export-extcommunity
 -target 20:20 import-extcommunity
 #
interface Nve1
source 1.1.1.1
vni 1000 head-end peer-list protocol bgp
vni 2000 head-end peer-list protocol bgp
#
bgp 100
router-id 11.11.11.11
undo default ipv4-unicast
private-4-byte-as enable
peer 33.33.33.33 as-number 100
peer 33.33.33.33 connect-interface LoopBack1
#
ipv4-family unicast
 undo peer 33.33.33.33 enable
#
l2-family e
 policy -target
 peer 33.33.33.33 enable



CE2:
#
e-overlay enable 
#
bridge-domain 1000
e
 route-distinguisher 1:2
 -target 10:10 export-extcommunity
 -target 10:10 import-extcommunity
 #
bridge-domain 2000
e
 route-distinguisher 2:2
 -target 20:20 export-extcommunity
 -target 20:20 import-extcommunity
 #
interface Nve1
source 2.2.2.2
vni 1000 head-end peer-list protocol bgp
vni 2000 head-end peer-list protocol bgp
#
bgp 100
router-id 22.22.22.22
undo default ipv4-unicast
private-4-byte-as enable
peer 33.33.33.33 as-number 100
peer 33.33.33.33 connect-interface LoopBack1
#
ipv4-family unicast
 undo peer 33.33.33.33 enable
#
l2-family e
 policy -target
 peer 33.33.33.33 enable



CE3:
#
e-overlay enable 
#
bridge-domain 1000
 vxlan vni 1000
e
 route-distinguisher 1:3
 -target 10:10 export-extcommunity
 -target 10:10 import-extcommunity
 #
bridge-domain 2000
vxlan vni 2000
e
 route-distinguisher 2:3
 -target 20:20 export-extcommunity
 -target 20:20 import-extcommunity
 #
interface Nve1
source 3.3.3.3
vni 1000 head-end peer-list protocol bgp
vni 2000 head-end peer-list protocol bgp
#
bgp 100
router-id 33.33.33.33
undo default ipv4-unicast
private-4-byte-as enable
peer 11.11.11.11 as-number 100
peer 11.11.11.11 connect-interface LoopBack1
peer 22.22.22.22 as-number 100
peer 22.22.22.22 connect-interface LoopBack1
#
ipv4-family unicast
 undo peer 11.11.11.11 enable
 undo peer 22.22.22.22 enable
#
l2-family e
 policy -target
 peer 11.11.11.11 enable
 peer 11.11.11.11 reflect-client
 peer 22.22.22.22 enable
 peer 22.22.22.22 reflect-client
 #
interface Vbdif1000
ip address 192.168.1.254 255.255.255.0
#
interface Vbdif2000
ip address 192.168.2.254 255.255.255.0

验证

隧道是建立好了的

CE2会使用EVPN通过NLRI传递Type 2 MAC类型的路由，来通告CE2租户侧的MAC地址给CE1,CE3。只要CE2的MAC表有就会通告

缺点

而集中式网关场景下，网关设备需要维护所有租户的MAC地址，而三层网关上的ARP表项规格有限，这不利于数据中心网络的扩展

转发路径不是最优：同一二层网关下跨子网的数据中心三层流量都需要经过集中三层网关转发