在Catalyst 9000系列交换机上实施BGP EVPN保护重叠分段
目录
简介
本文档介绍如何在Catalyst 9000系列交换机上实施BGP EVPN VXLAN保护的重叠分段。
先决条件
要求
Cisco 建议您了解以下主题：
- BGP EVPN VxLAN概念
- BGP EVPN单播故障排除
- BGP EVPN VxLAN路由策略
使用的组件
本文档中的信息基于以下软件和硬件版本：
- Catalyst 9300
- Catalyst 9400
- Catalyst 9500
- Catalyst 9600
- Cisco IOS® XE 17.12.1及更高版本
本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始（默认）配置。如果您的网络处于活动状态，请确保您了解所有命令的潜在影响。
背景信息
高级功能说明
受保护网段功能是一种安全措施，可防止端口相互转发流量，即使端口位于同一VLAN和同一交换机上也是如此
- 此功能类似于“受交换机端口保护”或专用Vlan，但适用于EVPN交换矩阵。
- 此设计会强制所有流量发送到CGW，在将其发送到最终目的地之前，防火墙会对其进行检查。
- 流量可控制、确定且易于使用集中式安全设备进行检查。
文档详细信息
本文档是第2部分或第3部分相互关联的文档：
- 文档1:在Catalyst 9000系列交换机上实施BGP EVPN路由策略介绍如何在重叠中控制BGP BUM流量，必须首先进行配置
- 文档2:此文档。本文档基于文档1的重叠设计和策略，介绍“protected”关键字的实施
- 文档3:即将推出！
注意：在实施受保护的分段配置之前，必须实施文档1中的配置。
受保护的分段类型
完全隔离
- 仅允许从北向南通信，
- 网关通过“default-gateway advertise” CLI通告到交换矩阵
大部分隔离
- 允许从北向南通信（在本例中，根据防火墙流量策略允许东/西流量）
- 允许从东向西通信（基于防火墙流量策略）
- 网关位于交换矩阵外部，不会使用“default-gateway advertise” CLI通告SVI
交换机行为
- 即使主机连接到同一台交换机，它们也无法直接相互通信(当主机位于同一VRF/Vlan/Segment中时，ARP请求不会发送到同一交换机上的其他端口)。
- 第2层VTEP之间没有BUM流量(使用路由策略配置过滤的IMET前缀)
- 来自主机的所有数据包都会中继到边界枝叶以转发。(这表示主机1要与同一枝叶上的主机2通信，流量被固定到CGW)
路由类型2处理
- 接入枝叶使用E-Tree Extended Community和Leaf标志集通告本地RT2。
- 接入枝叶不会安装数据平面中设置了E-Tree Extended Community和Leaf标志的任何远程RT2。
- 接入枝叶不会相互将RT2安装在数据平面中。
- 接入枝叶和边界枝叶(CGW)相互将RT2安装在数据平面中。
- 无需在接入枝叶或边界枝叶上进行配置更改。
设计摘要
- 对于广播(BUM),RT3拓扑是集中星型拓扑，以强制广播流量（例如ARP）达到GCW。
- 为了考虑主机移动性，RT2在BGP控制平面全网状（当主机从一个VTEP移动到另一个VTEP时，RT2中的序列号会递增）
- 数据平面选择性地安装MAC地址。
- 枝叶仅安装包含DEF GW属性的本地MAC和RT2
- CGW没有受保护的KW，并将所有本地MAC和远程RT2安装在其数据平面中。
术语
| VRF |
虚拟路由转发 |
定义与其他VRF和全局IPv4/IPv6路由域分离的第3层路由域 |
| AF |
地址系列 |
定义BGP处理哪些类型前缀和路由信息 |
| AS |
自治系统 |
一组互联网可路由IP前缀，它们属于一个网络或一组网络，由单个实体或组织管理、控制和监督 |
| EVPN |
以太网虚拟专用网络 |
允许BGP传输第2层MAC和第3层IP信息的扩展是EVPN和 使用多协议边界网关协议(MP-BGP)作为协议，以分发与VXLAN重叠网络相关的可达性信息。 |
| VXLAN |
虚拟可扩展LAN（局域网） |
VXLAN旨在克服VLAN和STP的固有局限性。推荐的IETF标准[RFC 7348]提供与VLAN相同的以太网第2层网络服务，但灵活性更高。功能上，它是MAC-in-UDP封装协议，在第3层底层网络上作为虚拟重叠运行。 |
| CGW |
集中网关 |
以及网关SVI不在每个枝叶上的EVPN的实施。相反，所有路由都由使用非对称IRB（集成路由和桥接）的特定枝叶完成 |
| DEF网关 |
默认网关 |
通过“l2vpn evpn”配置部分下的命令“default-gateway advertise enable”添加到MAC/IP前缀的BGP扩展社区属性。 |
| IMET(RT3) |
包含组播以太网标记（路由） |
也称为BGP类型3路由。此路由类型在EVPN中用于在VTEP之间传输BUM（广播/未知单播/组播）流量。 |
| RT2 |
路由类型2 |
BGP MAC或MAC/IP前缀，表示主机MAC或网关MAC-IP |
| EVPN管理器 |
EVPN管理器 |
用于各种其他组件的中央管理组件（例如：从SISF学习并向L2RIB发送信号） |
| SISF |
交换机集成安全功能 |
EVPN使用的不可知主机跟踪表，用于了解枝叶上的本地主机 |
| L2RIB |
第2层路由信息库 |
在用于管理BGP、EVPN管理器、L2FIB之间交互的中间组件中 |
| 美联储 |
转发引擎驱动程序 |
对ASIC（硬件）层进行编程 |
| MATLAB |
Mac地址表管理器 |
IOS MATM：仅安装本地地址和 FED MATM：安装从控制平面获取的本地和远程地址的硬件表，属于硬件转发平面 |
流程图
路由类型2(RT2)图
下图显示了第2类MAC/MAC-IP主机前缀的全网状设计。
注意：支持移动性和漫游需要全网状
路由类型3(RT3)图
下图显示广播IMET(RT3)隧道的集中星型设计
注意：需要集中星型广播来防止具有相同网段的枝叶直接相互发送广播。
地址解析(ARP)图
此图显示，ARP不允许到达同一EPVN网段中的任何主机。当另一台主机的主机ARP时，只有CGW获取此ARP并回复
注：此ARP行为更改通过使用“protected”关键字进行实例化。
示例：成员evpn实例202 vni受20201护
配置（完全隔离）
网络图
受保护配置关键字应用于枝叶交换机。CGW是混合设备，会安装所有mac地址。
注意：在Catalyst 9000系列交换机上实施BGP EVPN路由策略中显示了控制IMET前缀的导入/导出的路由策略社区列表和路由映射配置。 本文档中仅显示受保护的分段差异。
枝叶–01（基本EVPN配置）
Leaf-01#show run | sec l2vpn
l2vpn evpn
replication-type static
flooding-suppression address-resolution disable <-- Disables ARP caching so ARP is always sent up to the CGW
router-id Loopback1
l2vpn evpn instance 201 vlan-based encapsulation vxlan replication-type ingress <-- Sets segment to use Unicast replication of BUM traffic via RT3 type BGP routes multicast advertise enable
Leaf01#show run | sec vlan config vlan configuration 201 member evpn-instance 201 vni 20101 protected <-- protected keyword added
CGW（基本配置）
CGW#show running-config | beg l2vpn evpn instance 201 l2vpn evpn instance 201 vlan-based encapsulation vxlan replication-type ingress default-gateway advertise enable <-- adds the BGP attribute EVPN DEF GW:0:0 to the MAC/IP prefix multicast advertise enable
CGW#show running-config | sec vlan config vlan configuration 201
member evpn-instance 201 vni 20101
CGW#show run int nve 1 Building configuration... Current configuration : 313 bytes ! interface nve1 no ip address source-interface Loopback1 host-reachability protocol bgp
member vni 20101 ingress-replication local-routing <-- 'ingress-replication' (Unicast all BUM traffic) / 'local-routing' (Enables vxlan centralized gateway forwarding)
CGW#show run interface vlan 201 Building configuration... Current configuration : 231 bytes ! interface Vlan201 mac-address 0000.beef.cafe <-- MAC is static in this example for viewing simplicity. This is not required vrf forwarding red <-- SVI is in VRF red ip address 10.1.201.1 255.255.255.0 no ip redirects ip local-proxy-arp <-- Sets CGW to Proxy reply even for local subnet ARP requests ip pim sparse-mode ip route-cache same-interface <-- This is auto added when local-proxy-arp is configured. However, this is a legacy 'fast switching' command that is not used by CEF & is not required for forwarding ip igmp version 3 no autostate
注：在CGW上未应用BGP策略。允许CGW接收和发送所有前缀类型(RT2、RT5 / RT3)。
验证（完全隔离）
EVI详细信息
Leaf01#sh l2vpn evpn evi 201 detail
EVPN instance: 201 (VLAN Based)
RD: 172.16.254.3:201 (auto)
Import-RTs: 65001:201
Export-RTs: 65001:201
Per-EVI Label: none
State: Established
Replication Type: Ingress
Encapsulation: vxlan
IP Local Learn: Enabled (global)
Adv. Def. Gateway: Disabled (global)
Re-originate RT5: Disabled
Adv. Multicast: Enabled
AR Flood Suppress: Disabled (global)
Vlan: 201
Protected: True (local access p2p blocked) <-- Vlan 201 is in protected mode
<...snip...>
本地RT2生成（本地主机到RT2）
验证从本地主机学习到RT2生成的组件依赖关系链：
- SISF（当枝叶没有SVI时，SISF仍然通过来自主机的ARP帧来收集主机信息）
- EVPN管理器
- L2RIB
- 调试输出中显示“BGP
提示：如果之前的组件未正确编程整个依赖关系链中断（例如：SISF没有条目时，BGP无法创建RT2）。
SISF
验证SISF是否已在数据库中获取主机（从DHCP或ARP获取主机信息）
- SISF从IOS-MATM learning获取MAC条目，然后发送至EVPN Mgr(必须使用策略“evpn-sisf-policy”实现MAC可访问)。
- SISF在本地VTEP上收集IP/MAC绑定，并使用EVPN管理器将信息编程为通过BGP到其他枝叶的/32路由。
注意：在此场景中，主机有一个静态IP，因此SISF使用ARP来收集主机详细信息。在Most Isolated部分显示DHCP和DHCP监听。
Leaf01#show device-tracking database vlanid 201
vlanDB has 1 entries for vlan 201, 1 dynamic
Codes: L - Local, S - Static, ND - Neighbor Discovery, ARP - Address Resolution Protocol, DH4 - IPv4 DHCP, DH6 - IPv6 DHCP, PKT - Other Packet, API - API created
Preflevel flags (prlvl):
0001:MAC and LLA match 0002:Orig trunk 0004:Orig access
0008:Orig trusted trunk 0010:Orig trusted access 0020:DHCP assigned
0040:Cga authenticated 0080:Cert authenticated 0100:Statically assigned
Network Layer Address Link Layer Address Interface vlan prlvl age state Time left
ARP 10.1.201.10 0006.f601.cd43 Gi1/0/1 201 0005 3mn REACHABLE 86 s <-- Gleaned from local host ARP Request
EVPN管理器
EVPN 经理 学习本地MAC并安装到L2RIB中。EVPN 经理 也从L2RIB获取远程MAC，但条目仅用于处理MAC移动性
确认已使用SISF条目更新EVPN管理器
Leaf01#show l2vpn evpn mac evi 201 MAC Address EVI VLAN ESI Ether Tag Next Hop(s) -------------- ----- ----- ------------------------ ---------- --------------- 0006.f601.cd43 201 201 0000.0000.0000.0000.0000 0 Gi1/0/1:201 <-- MAC in VLan 201 local interface Gi1/0/1:service instance 201 <...snip...>
L2RIB
- L2RIB从EVPN管理器获取本地MAC并发送到BGP和L2FIB。
- L2RIB还负责从BGP学习远程MAC以更新EVPN管理器和L2FIB。
- L2RIB需要“本地”和“远程”两个选项才能正确更新其他组件。
- L2RIB组件位于本地和远程MAC学习之间，具体取决于需要更新的方向/组件
验证L2RIB是否已使用来自EVPN管理器的本地MAC进行更新
Leaf01#show l2route evpn mac topology 201 <-- View the overall topology for this segment EVI ETag Prod Mac Address Next Hop(s) Seq Number ----- ---------- ----- -------------- ---------------------------------------------------- ---------- 201 0 BGP 0000.beef.cafe V:20101 172.16.254.6 0 <-- produced by BGP who updated L2RIB (remote learn) 201 0 L2VPN 0006.f601.cd43 Gi1/0/1:201 0 <-- produced by EVPN Mgr who updated L2RIB (local learn) Leaf01#show l2route evpn mac mac-address 0006.f601.cd43 detail EVPN Instance: 201 Ethernet Tag: 0 Producer Name: L2VPN <-- Produced by local MAC Address: 0006.f601.cd43 <-- Host MAC Address Num of MAC IP Route(s): 1 Sequence Number: 0 ESI: 0000.0000.0000.0000.0000 Flags: B() Next Hop(s): Gi1/0/1:201 (E-LEAF) <-- Port:Instance and info about the Role (Leaf)
调试输出中显示“BGP
验证BGP是否已由L2RIB更新
Leaf01#show bgp l2vpn evpn route-type 2 0 0006.f601.cd43 *
BGP routing table entry for [2][172.16.254.3:201][0][48][0006F601CD43][0][*]/20, version 268232
Paths: (1 available, best #1, table evi_201) <-- In the totally isolated evi context
Advertised to update-groups:
2
Refresh Epoch 1
Local
0.0.0.0 (via default) from 0.0.0.0 (172.16.255.3) <-- from 0.0.0.0 indicates local
Origin incomplete, localpref 100, weight 32768, valid, sourced, local, best <-- also indicates local
EVPN ESI: 00000000000000000000, Label1 20101
Extended Community: RT:65001:201 ENCAP:8 EVPN E-Tree:flag:1,label:0 <-- EVPN e-Tree attribute with Leaf flag = 1 (added to indicate this is a host address)
Local irb vxlan vtep:
vrf:not found, l3-vni:0
local router mac:0000.0000.0000
core-irb interface:(not found)
vtep-ip:172.16.254.3 <-- Local VTEP Loopback
rx pathid: 0, tx pathid: 0x0
Updated on Sep 14 2023 20:16:17 UTC
远程RT2学习（默认网关RT2）
调试输出中显示“BGP
验证BGP已获取CGW RT2前缀
Leaf01#show bgp l2vpn evpn route-type 2 0 0000.beef.cafe 10.1.201.1
BGP routing table entry for [2][172.16.254.3:201][0][48][0000BEEFCAFE][32][10.1.201.1]/24, version 114114
Paths: (1 available, best #1, table evi_201) <-- EVI context is 201
Flag: 0x100
Not advertised to any peer
Refresh Epoch 2
Local, imported path from [2][172.16.254.6:201][0][48][0000BEEFCAFE][32][10.1.201.1]/24 (global)
172.16.254.6 (metric 3) (via default) from 172.16.255.1 (172.16.255.1)
Origin incomplete, metric 0, localpref 100, valid, internal, best
EVPN ESI: 00000000000000000000, Label1 20101 <-- Correct segment identifier
Extended Community: RT:65001:201 ENCAP:8 EVPN DEF GW:0:0 <-- Default gateway attribute is added via the 'default gateway advertise CLI'
Originator: 172.16.255.6, Cluster list: 172.16.255.1
rx pathid: 0, tx pathid: 0x0
Updated on Sep 1 2023 15:27:45 UTC
L2RIB
验证BGP更新的L2RIB
- L2RIB从EVPN管理器获取本地MAC并发送到BGP和L2FIB。L2RIB还负责从BGP学习远程MAC以更新EVPN管理器和L2FIB。
- L2RIB需要“本地”和“远程”两个选项才能正确更新其他组件。
- L2RIB组件位于本地和远程MAC学习之间，具体取决于需要更新的方向和组件。
Leaf01#show l2route evpn default-gateway host-ip 10.1.201.1 EVI ETag Prod Mac Address Host IP Next Hop(s) ----- ---------- ----- -------------- --------------------------------------- -------------------------------------------------- 201 0 BGP 0000.beef.cafe 10.1.201.1 V:20101 172.16.254.6 <-- L2RIB has the MAC-IP of the Gateway programmed
L2FIB
在L2FIB中验证
- 负责使用MAC更新FED以在硬件中编程的组件。
- 由L2FIB安装到FED-MATM的远程MAC条目不会传送到IOS-MATM。(IOS-MATM仅显示本地MAC，而FED-MATM显示本地和远程MAC)
- L2FIB输出仅显示远程MAC（它不负责对本地MAC进行编程）。
Leaf01#show l2fib bridge-domain 201 address unicast 0000.beef.cafe MAC Address : 0000.beef.cafe <-- CGW MAC Reference Count : 1 Epoch : 0 Producer : BGP <-- Learned from BGP Flags : Static Adjacency : VXLAN_UC PL:2973(1) T:VXLAN_UC [MAC]20101:172.16.254.6 <-- CGW Loopback IP PD Adjacency : VXLAN_UC PL:2973(1) T:VXLAN_UC [MAC]20101:172.16.254.6 Packets : 6979 Bytes : 0
美联储
在FED MATM中验证
- 在配置了“protected关键字”的枝叶的硬件级别，您应该只能看到CGW默认网关MAC和本地主机MAC。
- 交换机查看DEF GW属性的RT2前缀，以确定哪些远程MAC适合安装。
Leaf01#show platform software fed switch active matm macTable vlan 201
VLAN MAC Type Seq# EC_Bi Flags machandle siHandle riHandle diHandle *a_time *e_time ports Con ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ 201 0000.beef.cafe 0x5000001 0 0 64 0x7a199d182498 0x7a199d183578 0x71e059173e08 0x0 0 82 VTEP 172.16.254.6 adj_id 9 No
<-- Only remote MAC installed in Fed is the Default Gateway (0x5000001 type) Conn = No (meaning not directly connected) 201 0006.f601.cd01 0x1 2458 0 0 0x7a199d1a2248 0x7a199d19eef8 0x0 0x7a199c6f7cd8 300 2 GigabitEthernet1/0/1 Yes 201 0006.f601.cd43 0x1 8131 0 0 0x7a199d195a98 0x7a199d19eef8 0x0 0x7a199c6f7cd8 300 84 GigabitEthernet1/0/1
<-- Two local MAC addresses (0x1 type) Conn = Yes (directly connected)
Total Mac number of addresses:: 5 Summary: Total number of secure addresses:: 0 Total number of drop addresses:: 0 Total number of lisp local addresses:: 0 Total number of lisp remote addresses:: 3 *a_time=aging_time(secs) *e_time=total_elapsed_time(secs) Type: MAT_DYNAMIC_ADDR 0x1 MAT_STATIC_ADDR 0x2 MAT_CPU_ADDR 0x4 MAT_DISCARD_ADDR 0x8 MAT_ALL_VLANS 0x10 MAT_NO_FORWARD 0x20 MAT_IPMULT_ADDR 0x40 MAT_RESYNC 0x80 MAT_DO_NOT_AGE 0x100 MAT_SECURE_ADDR 0x200 MAT_NO_PORT 0x400 MAT_DROP_ADDR 0x800 MAT_DUP_ADDR 0x1000 MAT_NULL_DESTINATION 0x2000 MAT_DOT1X_ADDR 0x4000 MAT_ROUTER_ADDR 0x8000 MAT_WIRELESS_ADDR 0x10000 MAT_SECURE_CFG_ADDR 0x20000 MAT_OPQ_DATA_PRESENT 0x40000 MAT_WIRED_TUNNEL_ADDR 0x80000 MAT_DLR_ADDR 0x100000 MAT_MRP_ADDR 0x200000 MAT_MSRP_ADDR 0x400000 MAT_LISP_LOCAL_ADDR 0x800000 MAT_LISP_REMOTE_ADDR 0x1000000 MAT_VPLS_ADDR 0x2000000 MAT_LISP_GW_ADDR 0x4000000
<-- the addition of these values = 0x5000001
MAT_LISP_REMOTE_ADDR 0x1000000
MAT_LISP_GW_ADDR 0x4000000
MAT_DYNAMIC_ADDR 0x1
数据平面邻接
作为确认FED条目后的最后一步，您可以解析重写索引(RI)
Leaf01#sh platform hardware fed switch active fwd-asic abstraction print-resource-handle 0x71e059173e08 0
<-- 0x71e059173e08 is taken from previous FED command riHandle for the CGW MAC Handle:0x71e059173e08 Res-Type:ASIC_RSC_RI Res-Switch-Num:255 Asic-Num:255 Feature-ID:AL_FID_L2_WIRELESS Lkp-ftr-id:LKP_FEAT_INVALID ref_count:1 priv_ri/priv_si Handle: 0x71e05917b8d8Hardware Indices/Handles: index0:0x38 mtu_index/l3u_ri_index0:0x0 index1:0x38 mtu_index/l3u_ri_index1:0x0 Features sharing this resource:58 (1)] Brief Resource Information (ASIC_INSTANCE# 0) ---------------------------------------- ASIC#:0 RI:56 Rewrite_type:AL_RRM_REWRITE_LVX_IPV4_L2_PAYLOAD_ENCAP_EPG(116) Mapped_rii:LVX_L3_ENCAP_L2_PAYLOAD_EPG(137) Src IP: 172.16.254.3 <-- source tunnel IP Dst IP: 172.16.254.6 <-- dest tunnel IP iVxlan dstMac: 0x9db:0x00:0x00 iVxlan srcMac: 0x00:0x00:0x00 IPv4 TTL: 0 iid present: 0 lisp iid: 20101 <-- Segment 20101 lisp flags: 0 dst Port: 4789 <-- VxLAN update only l3if: 0 is Sgt: 0 is TTL Prop: 0 L3if LE: 53 (0) Port LE: 281 (0) Vlan LE: 8 (0)
注意：您还可以使用“show platform software fed switch active matm macTable vlan 201 detail”，它将此命令与FED命令链接到一个结果中
配置（部分隔离）
网络图
注意：本部分仅介绍与完全隔离网段的区别。
- 使用DEF GW属性标记GCW网关MAC IP的路由策略
- 需要自定义设备跟踪策略以防止MAC摆动
- GW MAC IP的静态设备跟踪绑定
枝叶–01（基本EVPN配置）
Leaf-01#show run | sec l2vpn
l2vpn evpn
replication-type static
flooding-suppression address-resolution disable <-- Disables ARP caching so ARP is always sent up to the CGW
router-id Loopback1 l2vpn evpn instance 202 vlan-based encapsulation vxlan replication-type ingress multicast advertise enable
Leaf01#show run | sec vlan config vlan configuration 202 member evpn-instance 202 vni 20201 protected <-- protected keyword added
CGW（基本配置）
在nve下设置复制模式
CGW#show run int nve 1 Building configuration... Current configuration : 313 bytes ! interface nve1 no ip address source-interface Loopback1 host-reachability protocol bgp member vni 20201 ingress-replication local-routing <-- 'ingress-replication' (Unicast all BUM traffic) / 'local-routing' (Enables vxlan centralized gateway forwarding) end
配置外部网关SVI
CGW#show run interface vlan 2021 Building configuration... Current configuration : 231 bytes ! interface Vlan2021 mac-address 0000.beef.cafe <-- MAC is static in this example for viewing simplicity. This is not required vrf forwarding pink <-- SVI is in VRF pink ip address 10.1.202.1 255.255.255.0 no ip redirects ip local-proxy-arp <-- Sets CGW to Proxy reply even for local subnet ARP requests ip pim sparse-mode ip route-cache same-interface <-- This is auto added when local-proxy-arp is configured. However, this is a legacy 'fast switching' command that is not used by CEF & is not required for forwarding ip igmp version 3 no autostate end
创建禁用了收集功能的策略
device-tracking policy dt-no-glean <-- Configure device tracking policy to prevent MAC-IP flapping security-level glean no protocol ndp no protocol dhcp6 no protocol arp no protocol dhcp4
连接到externalgatewayevi/vlan
CGW#show running-config | sec vlan config vlan configuration 202 member evpn-instance 202 vni 20201
device-tracking attach-policy dt-no-glean <-- apply the new device tracking policy to the vlan configuration
将静态条目添加到外部网关mac-ip的设备跟踪表
device-tracking binding vlan 202 10.1.202.1 interface TwentyFiveGigE1/0/1 0000.beef.cafe
<-- All static entries in device tracking table should be for external gateway mac-ip’s.
If there is any other static entry in device tracking table, match ip/ipv6 configurations in route map with prefix lists (permit/deny) are required to attach default gateway extended community to external gateway mac-ip routes only.
创建BGP路由映射以匹配RT2 MAC-IP前缀并设置默认网关扩展社区
route-map CGW_DEF_GW permit 10
match evpn route-type 2-mac-ip <-- match RT2 type MAC-IP
set extcommunity default-gw <-- Set Default-gateway (DEF GW 0:0) extended community
route-map CGW_DEF_GW permit 20
将路由映射应用于BGP路由反射器邻居
CGW#sh run | s r bgp
address-family l2vpn evpn
neighbor 172.16.255.1 activate
neighbor 172.16.255.1 send-community both
neighbor 172.16.255.1 route-map CGW_DEF_GW out <-- Sets the DEF GW Community when it advertises MAC-IP type RT2 to the RR
neighbor 172.16.255.2 activate
neighbor 172.16.255.2 send-community both
neighbor 172.16.255.2 route-map CGW_DEF_GW out <-- Sets the DEF GW Community when it advertises MAC-IP type RT2 to the RR
验证（部分隔离）
EVI详细信息
Leaf01#show l2vpn evpn evi 202 detail
EVPN instance: 202 (VLAN Based)
RD: 172.16.254.3:202 (auto)
Import-RTs: 65001:202
Export-RTs: 65001:202
Per-EVI Label: none
State: Established
Replication Type: Ingress
Encapsulation: vxlan
IP Local Learn: Enabled (global)
Adv. Def. Gateway: Enabled (global)
Re-originate RT5: Disabled
Adv. Multicast: Enabled
Vlan: 202
Protected: True (local access p2p blocked) <-- Vlan 202 is in protected mode
<...snip...>
本地RT2生成（本地主机到RT2）
涵盖在前一个完全孤立的示例中
远程RT2学习（默认网关RT2）
涵盖与完全隔离的区别
CGW默认网关前缀（枝叶）
检查前缀是否具有适当的属性，以便有资格安装到硬件中
注意：这对于DHCP L2中继正常运行至关重要
Leaf01#show bgp l2vpn evpn route-type 2 0 0000.beef.cafe 10.1.202.1
BGP routing table entry for [2][172.16.254.3:202][0][48][0000BEEFCAFE][32][10.1.202.1]/24, version 184602
Paths: (1 available, best #1, table evi_202) <-- the EVI context of 202 which matches the Vlan/EVI we are concerned about
Not advertised to any peer
Refresh Epoch 2
Local, imported path from [2][172.16.254.6:202][0][48][0000BEEFCAFE][32][10.1.202.1]/24 (global)
172.16.254.6 (metric 3) (via default) from 172.16.255.1 (172.16.255.1)
Origin incomplete, metric 0, localpref 100, valid, internal, best
EVPN ESI: 00000000000000000000, Label1 20201 <-- Correct Segment ID
Extended Community: RT:65001:202 ENCAP:8 EVPN DEF GW:0:0 <-- prefix has the Default GW attribute added
Originator: 172.16.255.6, Cluster list: 172.16.255.1
rx pathid: 0, tx pathid: 0x0
Updated on Sep 7 2023 19:56:43 UTC
FED MATM（叶）
F241.03.23-9300-Leaf01#show platform software fed active matm macTable vlan 202 mac 0000.beef.cafe VLAN MAC Type Seq# EC_Bi Flags machandle siHandle riHandle diHandle *a_time *e_time ports Con ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ 202 0000.beef.cafe 0x5000001 0 0 64 0x71e058da7858 0x71e05916c0d8 0x71e059171678 0x0 0 5 VTEP 172.16.254.6 adj_id 651 No
<-- MAC of Default GW is installed in FED
SISF(CGW)
CGW#sh device-tracking database vlanid 202
vlanDB has 1 entries for vlan 202, 0 dynamic
Codes: L - Local, S - Static, ND - Neighbor Discovery, ARP - Address Resolution Protocol, DH4 - IPv4 DHCP, DH6 - IPv6 DHCP, PKT - Other Packet, API - API created
Preflevel flags (prlvl):
0001:MAC and LLA match 0002:Orig trunk 0004:Orig access
0008:Orig trusted trunk 0010:Orig trusted access 0020:DHCP assigned
0040:Cga authenticated 0080:Cert authenticated 0100:Statically assigned
Network Layer Address Link Layer Address Interface vlan prlvl age state Time left
S 10.1.202.1 0000.beef.cafe Twe1/0/1 202 0100 13006mn STALE N/A
IOS MATM(CGW)
CGW#show mac address-table address 0000.beef.cafe
Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
201 0000.beef.cafe STATIC Vl201
2021 0000.beef.cafe STATIC Vl2021 <-- The Vlan 2021 SVI MAC advertised out Tw1/0/1
202 0000.beef.cafe DYNAMIC Twe1/0/1 <-- The Vlan 2021 SVI MAC learned dynamically after passing through the Firewall and the Dot1q tag swapped to fabric Vlan 202
故障排除
地址解析(ARP)
隔离ARP问题的常规步骤
- 确认IMET隧道已就绪
- 在CGW上行链路上捕获，以检验从枝叶交换机封装的ARP是否收到
- 如果没有ARP发现到达上行链路上的封装。
- 验证枝叶和CGW上的IMET隧道均已就绪。
- 在枝叶上行链路上捕获，确认ARP已封装并发送。
- 排除中间路径故障。
- 如果ARP到达边界IMET隧道捕获，但未在VRF ARP表中编程。
- 排除CPU/CoPP传送路径故障，确认传送到CPU的ARP。
- 确认IP地址/客户端信息是否正确。
- 在VRF中调试ARP，以查看可能影响ARP进程的事项
- 验证作为下一跳/目标mac安装在主机上的CGW MAC
- 确认CGW具有两个包含实际主机MAC的ARP条目
- 验证防火墙策略是否允许此类流量
注意：启用调试时务必小心！
确保您已禁用泛洪抑制
Leaf-01#show run | sec l2vpn
l2vpn evpn
replication-type static
flooding-suppression address-resolution disable <-- This CLI prevents a VTEP from trying to unicast other VTEPs based on its EVPN table
当枝叶02上的主机为枝叶01上的主机解析ARP时，不会将ARP请求直接广播到枝叶01
- 相反，ARP会向上传递在Leaf-02上编程的指向CGW的唯一BUM隧道
- CGW不会将此转发到Leaf-01，而是使用其自己的MAC进行回复
- 这会导致所有通信向上传递到CGW，然后路由到主机之间
- CGW路由数据包，即使它们位于同一本地子网上
此图有助于直观显示本节所述的ARP解析过程。
ARP请求显示为紫色
- 此ARP请求用于解析Leaf-01上的主机10.1.202.10的MAC地址
- 请注意，紫色线路在CGW终止，并且未到达枝叶01
ARP应答显示为绿色
- 该应答包含Vlan 202的CGW SVI的MAC
- 请注意，绿线来自CGW，而不是来自实际主机
注：红色X表示此通信不涉及向枝叶01发送流量。
观察每台相应主机上的ARP条目
Leaf02-HOST#sh ip arp 10.1.202.10 Protocol Address Age (min) Hardware Addr Type Interface Internet 10.1.202.10 1 0000.beef.cafe ARPA Vlan202 <-- MAC address for Leaf01 host is CGW MAC Leaf01-HOST#sh ip arp 10.1.202.11 Protocol Address Age (min) Hardware Addr Type Interface Internet 10.1.202.11 7 0000.beef.cafe ARPA Vlan202 <-- MAC address for Leaf02 host is CGW MAC
观察在CGW上获知RT2前缀。CGW路由数据包需要此步骤
CGW#sh bgp l2vpn evpn route-type 2 0 0006.f617.eec4 * <-- Leaf02 actual MAC
BGP routing table entry for [2][172.16.254.6:202][0][48][0006F617EEC4][0][*]/20, version 235458
Paths: (1 available, best #1, table evi_202)
Not advertised to any peer
Refresh Epoch 2
Local, imported path from [2][172.16.254.4:202][0][48][0006F617EEC4][0][*]/20 (global)
172.16.254.4 (metric 3) (via default) from 172.16.255.1 (172.16.255.1)
Origin incomplete, metric 0, localpref 100, valid, internal, best
EVPN ESI: 00000000000000000000, Label1 20201 <-- correct segment identifier
Extended Community: RT:65001:202 ENCAP:8 EVPN E-Tree:flag:1,label:0 <-- prefix contains the Leaf flag indicating this is a normal host
Originator: 172.16.255.4, Cluster list: 172.16.255.1
rx pathid: 0, tx pathid: 0x0
Updated on Apr 9 2025 17:11:22 UTC
CGW#sh bgp l2vpn evpn route-type 2 0 0006.f601.cd44 * <-- Leaf01 actual MAC
BGP routing table entry for [2][172.16.254.6:202][0][48][0006F601CD44][0][*]/20, version 235521
Paths: (1 available, best #1, table evi_202)
Not advertised to any peer
Refresh Epoch 2
Local, imported path from [2][172.16.254.3:202][0][48][0006F601CD44][0][*]/20 (global)
172.16.254.3 (metric 3) (via default) from 172.16.255.1 (172.16.255.1)
Origin incomplete, metric 0, localpref 100, valid, internal, best
EVPN ESI: 00000000000000000000, Label1 20201 <-- correct segment identifier
Extended Community: RT:65001:202 ENCAP:8 EVPN E-Tree:flag:1,label:0 <-- prefix contains the Leaf flag indicating this is a normal host
Originator: 172.16.255.3, Cluster list: 172.16.255.1
rx pathid: 0, tx pathid: 0x0
Updated on Apr 9 2025 17:17:06 UTC
捕获上行链路上的ARP交换以确认双向通信
- 您可以在交换矩阵上行链路上使用嵌入式数据包捕获(EPC)
- 此场景显示Leaf01上行链路上的EPC。如有必要，在CGW上重复此过程
配置EPC
Leaf01#monitor capture 1 interface range te 1/1/2 , te 1/1/4 both match any buffer size 100 <-- both Uplinks toward fabric included
启动捕获
Leaf01#monitor capture 1 start
启动ping以触发ARP请求（在本例中，ping是从Leaf01主机10.1.201.10到Leaf02主机10.1.201.11）
Leaf01-HOST#ping vrf red 10.1.201.11
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.201.11, timeout is 2 seconds:
...!!
Success rate is 40 percent (2/5), round-trip min/avg/max = 1/1/1 ms
停止捕获和检查ARP帧
Leaf01#mon cap 1 stop
F241.03.23-9300-Leaf01#show mon cap 1 buff br | i ARP
11 8.153510 00:06:f6:01:cd:42 -> ff:ff:ff:ff:ff:ff ARP 110 Who has 10.1.201.11? Tell 10.1.201.10 <-- .10 requests .11 MAC (this is Frame 11)
12 8.154030 00:00:be:ef:ca:fe -> 00:06:f6:01:cd:42 ARP 110 10.1.201.11 is at 00:00:be:ef:ca:fe <-- CGW replies with its MAC
详细查看捕获数据包。如果您想查看有关数据包的更多信息，请使用EPC的detail选项
- 请注意，为了简洁起见，此输出在各个位置被剪切
Leaf01#show mon cap 1 buffer detailed | beg Frame 11 <-- begin detail result from Frame 11 (ARP Request)
Frame 11: 110 bytes on wire (880 bits), 110 bytes captured (880 bits) on interface /tmp/epc_ws/wif_to_ts_pipe, id 0
Ethernet II, Src: 00:00:00:00:00:00 (00:00:00:00:00:00), Dst: 00:00:00:00:00:00 (00:00:00:00:00:00) <-- Expected to see all zeros for outbound VxLAN encapped packet
Destination: 00:00:00:00:00:00 (00:00:00:00:00:00)
Address: 00:00:00:00:00:00 (00:00:00:00:00:00)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Source: 00:00:00:00:00:00 (00:00:00:00:00:00)
Address: 00:00:00:00:00:00 (00:00:00:00:00:00)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: 172.16.254.3, Dst: 172.16.254.6 <--- Outer tunnel IP header
Source: 172.16.254.3
Destination: 172.16.254.6
User Datagram Protocol, Src Port: 65483, Dst Port: 4789 <-- VXLAN Dest port
Virtual eXtensible Local Area Network
VXLAN Network Identifier (VNI): 20101 <-- Verify the VNI for the segment you are investigating
Reserved: 0
Ethernet II, Src: 00:06:f6:01:cd:42 (00:06:f6:01:cd:42), Dst: ff:ff:ff:ff:ff:ff (ff:ff:ff:ff:ff:ff) <-- Start of inner payload info
Type: ARP (0x0806)
Trailer: 000000000000000000000000000000000000
Address Resolution Protocol (request) <-- is an ARP request
Hardware type: Ethernet (1)
Protocol type: IPv4 (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: request (1)
Sender MAC address: 00:06:f6:01:cd:42 (00:06:f6:01:cd:42) <-- Sending host
Sender IP address: 10.1.201.10
Target MAC address: 00:00:00:00:00:00 (00:00:00:00:00:00) <-- Trying to resolve MAC for host
Target IP address: 10.1.201.11
Frame 12: 110 bytes on wire (880 bits), 110 bytes captured (880 bits) on interface /tmp/epc_ws/wif_to_ts_pipe, id 0 <-- ARP reply
Ethernet II, Src: dc:77:4c:8a:6d:7f (dc:77:4c:8a:6d:7f), Dst: 68:2c:7b:f8:87:48 (68:2c:7b:f8:87:48) <-- Underlay MACs
Internet Protocol Version 4, Src: 172.16.254.6, Dst: 172.16.254.3 <-- From CGW loopback to Leaf01 loopback
User Datagram Protocol, Src Port: 65410, Dst Port: 4789
Virtual eXtensible Local Area Network
VXLAN Network Identifier (VNI): 20101
Reserved: 0
Ethernet II, Src: 00:00:be:ef:ca:fe (00:00:be:ef:ca:fe), Dst: 00:06:f6:01:cd:42 (00:06:f6:01:cd:42) <-- Start of payload
Type: ARP (0x0806)
Trailer: 000000000000000000000000000000000000
Address Resolution Protocol (reply) <-- is an ARP reply
Hardware type: Ethernet (1)
Protocol type: IPv4 (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: reply (2)
Sender MAC address: 00:00:be:ef:ca:fe (00:00:be:ef:ca:fe) <-- Reply is that of the CGW MAC due to local proxy on SVI
Sender IP address: 10.1.201.11
Target MAC address: 00:06:f6:01:cd:42 (00:06:f6:01:cd:42)
Target IP address: 10.1.201.10
CGW RT2网关前缀
缺少网关前缀
如上一节关于部分隔离网段中所述，需要在交换矩阵VLAN中获取MAC
- 如果没有流量流向网关的时间超过MAC老化计时器，则可能会出现此问题。
- 如果缺少CGW网关前缀，您需要确认存在MAC
CGW#show bgp l2vpn evpn route-type 2 0 0000.beef.cafe 10.1.202.1
% Network not in table <-- RT2 not generated on CGW
CGW#show mac address-table address 0000.beef.cafe
Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
201 0000.beef.cafe STATIC Vl201
2021 0000.beef.cafe STATIC Vl2021
<-- MAC is not learned in Fabric Vlan 202
Total Mac Addresses for this criterion: 2
缺少网关前缀的补救
在大多数生产网络中，可能始终存在某些流量。但是，如果您遇到此问题，可以使用以下选项之一来修复问题：
- 添加静态MAC条目，例如“mac address-table static 0000.beef.cafe vlan 202 interface TwentyFiveGigE1/0/1”
- 使用“mac address-table aging-time <seconds>”增加MAC老化计时器。 （请记住，这会增加所有MAC地址的老化时间，因此首选静态MAC选项）
缺少DEF GW属性
对于部分隔离网段，有许多附加配置可添加此属性。
缺少DEF GW属性补救
确认以下详细信息：
- 您正在运行17.12.1或更高版本
- 配置中存在SISF（设备跟踪）CLI
- 配置了route-map match & set命令并将路由映射应用于BGP邻居
- 您已刷新BGP通告(您必须清除BGP以使用新属性重新通告前缀
无线漫游
频繁漫游可能导致BGP更新过于频繁，在交换机声明它拥有MAC并发送RT2更新之前，应增加每个时间间隔的漫游
- 当主机在不同交换机上的两个AP之间移动时会发生这种情况。
- 漫游的默认限制为每180秒5次
Leaf01#sh run | sec l2vpn
l2vpn evpn
replication-type static
flooding-suppression address-resolution disable
ip duplication limit 10 time 180 <--- You can adjust this default in the global l2vpn section
mac duplication limit 10 time 180
Leaf01#sh l2vpn evpn summary
L2VPN EVPN
EVPN Instances (excluding point-to-point): 4
VLAN Based: 4
Vlans: 4
BGP: ASN 65001, address-family l2vpn evpn configured
Router ID: 172.16.254.3
Global Replication Type: Static
ARP/ND Flooding Suppression: Disabled
Connectivity to Core: UP
MAC Duplication: seconds 180 limit 10
MAC Addresses: 13
Local: 6
Remote: 7
Duplicate: 0
IP Duplication: seconds 180 limit 10
IP Addresses: 7
Local: 4
Remote: 3
Duplicate: 0
<...snip...>
为TAC收集的命令
如果此指南未能解决您的问题，请收集显示的命令列表，并将其附加到TAC服务请求中。
要收集的最低信息
(在重新加载/恢复操作之前收集数据的时间有限)
- Show tech evpn
- Show tech
- Show tech sisf
要收集的详细信息
(如果有时间收集更完整的数据，则首选)
-
show tech
-
show tech evpn
-
show tech platform evpn_vxlan switch <number>
-
显示技术平台。
-
show tech resource
-
show tech sisf
-
show tech isis
-
show tech bgp
-
show monitor event-trace evpn event all
-
show monitor event-trace evpn error all
-
request platform software trace archive
相关信息
- 在Catalyst 9000系列交换机上实施BGP EVPN路由策略
- DHCP第2层中继（即将推出）
修订历史记录
| 版本 | 发布日期 | 备注 |
|---|---|---|
1.0 |
20-Sep-2023 |
初始版本 |
反馈