使用路由服务器配置Nexus EVPN-VXLAN多站点
下载选项
已更新: 2025 年 7 月 24 日
文档 ID:223286
非歧视性语言
此产品的文档集力求使用非歧视性语言。在本文档集中，非歧视性语言是指不隐含针对年龄、残障、性别、种族身份、族群身份、性取向、社会经济地位和交叉性的歧视的语言。由于产品软件的用户界面中使用的硬编码语言、基于 RFP 文档使用的语言或引用的第三方产品使用的语言，文档中可能无法确保完全使用非歧视性语言。 深入了解思科如何使用包容性语言。
关于此翻译
思科采用人工翻译与机器翻译相结合的方式将此文档翻译成不同语言，希望全球的用户都能通过各自的语言得到支持性的内容。 请注意：即使是最好的机器翻译，其准确度也不及专业翻译人员的水平。 Cisco Systems, Inc. 对于翻译的准确性不承担任何责任，并建议您总是参考英文原始文档（已提供链接）。
简介
本文档介绍如何在具有路由服务器集成的Cisco Nexus 9000交换机上配置和验证EVPN/VXLAN多站点环境。
先决条件
要求
Cisco 建议您了解以下主题：
- 多协议标签交换(MPLS)第3层VPN
- 多协议边界网关协议(MP-BGP)
- 以太网VPN/虚拟可扩展局域网(EVPN/VXLAN)
使用的组件
本文档中的信息基于以下软件和硬件版本：
- Cisco Nexus 9000系列交换机（实验室环境中使用的特定型号）
- 提供的示例中配置的软件和硬件版本
本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始（默认）配置。如果您的网络处于活动状态，请确保您了解所有命令的潜在影响。
背景信息
数据中心是一个资源池，其中包含计算能力、存储和必要的应用，以支持任何业务环境。
正确规划数据中心基础设施设计至关重要。本文档介绍医院网络等关键要求，以及如何满足或超过这些要求。
现代IT基础设施和数据中心部署需要高可用性(HA)、以更快的速度扩展的能力以及始终保持的高性能。
下面是一些在DC设计/架构领域探讨的关键要求：
- 端口密度通过交换矩阵扩展器(FEX)得以改善。
- 通过硬件虚拟化(UCS)提高了计算容量。
- 接入层上行链路带宽通过端口通道提高。
- 机箱级冗余通过vPC得以改进。
- 软件定义网络(SDN)交换矩阵通过以应用为中心的基础设施(ACI)进行了改进 — 在交换矩阵中自动进行底层和重叠。
- 通过数据中心网络管理器(DCNM)可改进新服务的快速部署和支持。
- 通过暗光纤或波长服务提高了长距离应用的带宽要求。
地理冗余和扩展是扩展数据中心环境的重要属性。多站点VXLAN/EVPN有助于提供更好的数据中心互联(DCI)解决方案。
外部连接包括数据中心与网络其余部分的连接：到Internet、WAN或园区。为外部连接提供的所有选项都是多租户感知的，并侧重于到外部网络域的第3层(L3)传输。
EVPN是下一代一体化VPN解决方案。它不仅能完成许多其他的VPN技术，而且性能更佳。功能包括：
- 与传统网络集成。
- 选择性通告/扩展：仅扩展第2层(L2) — 使用第2类路由的特定VLAN/子网。仅使用第5类路由扩展L3 — 特定的L3域。
- 自动发现具有类型4路由的冗余组。
- 混叠、大量提取地址、水平分割(SH)多归属(MH)指示和1类路由。
- 使用类型3路由自动发现组播隧道终端和组播(MCAST)隧道类型。
其他优势：
- 在数据中心和云之间平衡工作负载。
- 对中断做出主动响应 — 降低即将到来的灾难（如飓风和洪水）的风险。
- 数据中心维护和迁移 — 计划在一段时间内发生的事件，并与传统网络集成。
- 备份和灾难恢复即服务(aaS)。
配置
网络图
作者要填充的占位符内容
站点1枝叶1配置
这是站点1枝叶1的配置。每个命令启用关键功能并配置EVPN-VXLAN多站点操作所需的接口、VRF、VLAN和路由协议。
feature nxapi cfs ipv4 distribute nv overlay evpn feature ospf feature bgp feature pim feature fabric forwarding feature interface-vlan feature vn-segment-vlan-based feature lacp feature vpc feature nv overlay fabric forwarding anycast-gateway-mac 0000.1111.2222 ip pim rp-address 10.102.0.2 group-list 224.0.0.0/4 ip pim ssm range 232.0.0.0/8 ip igmp snooping vxlan vlan 1,100,200,300-350,2001 vlan 100 vn-segment 4000100 vlan 200 vn-segment 4000200 vlan 301 vn-segment 4000301 vlan 302 vn-segment 4000302 vlan 303 vn-segment 4000303 vlan 350 name L3-VNI vn-segment 4000999 vlan 2001 vn-segment 4000502 vrf context L3VNI4000999 vni 4000999 rd auto address-family ipv4 unicast route-target both auto route-target both auto evpn vrf context vrf_1 vni 4000501 rd auto address-family ipv4 unicast route-target both auto route-target both auto evpn vrf context vrf_2 vni 4000502 rd auto address-family ipv4 unicast route-target both auto route-target both auto evpn vpc domain 100 peer-switch peer-keepalive destination 10.197.214.54 source 10.197.214.53 virtual peer-link destination 10.102.1.9 source 10.102.1.8 dscp 56 delay restore 150 peer-gateway ip arp synchronize interface Vlan100 no shutdown mtu 9216 vrf member vrf_2 no ip redirects ip address 192.168.100.254/24 no ipv6 redirects fabric forwarding mode anycast-gateway interface Vlan200 no shutdown mtu 9216 vrf member vrf_2 no ip redirects ip address 192.168.200.254/24 no ipv6 redirects fabric forwarding mode anycast-gateway interface Vlan301 no shutdown mtu 9216 vrf member vrf_1 no ip redirects ip address 172.16.11.254/24 no ipv6 redirects fabric forwarding mode anycast-gateway interface Vlan302 no shutdown mtu 9216 vrf member vrf_1 no ip redirects ip address 172.16.12.254/24 no ipv6 redirects fabric forwarding mode anycast-gateway interface Vlan303 no shutdown mtu 9216 vrf member vrf_1 no ip redirects ip address 172.16.13.254/24 no ipv6 redirects fabric forwarding mode anycast-gateway interface Vlan2001 no shutdown mtu 9000 vrf member vrf_2 no ip redirects ip forward ipv6 address use-link-local-only no ipv6 redirects interface port-channel10 switchport switchport mode trunk switchport trunk allowed vlan 100,200,300-350,2001 spanning-tree port type network vpc peer-link interface port-channel100 switchport switchport mode trunk switchport trunk allowed vlan 100,200 mtu 9216 vpc 100 interface nve1 no shutdown host-reachability protocol bgp advertise virtual-rmac source-interface loopback1 member vni 4000100 suppress-arp mcast-group 231.0.0.1 member vni 4000200 suppress-arp mcast-group 231.0.0.2 member vni 4000502 associate-vrf interface Ethernet1/1 switchport switchport mode trunk switchport trunk allowed vlan 100,200 mtu 9216 channel-group 100 no shutdown interface Ethernet1/2 mtu 9216 port-type fabric medium p2p ip address 192.168.17.12/24 ip ospf network point-to-point ip router ospf 100 area 0.0.0.0 ip pim sparse-mode no shutdown interface loopback0 ip address 10.102.0.5/32 ip router ospf 100 area 0.0.0.0 ip pim sparse-mode interface loopback1 ip address 10.102.1.8/32 ip address 10.201.201.201/32 secondary ip router ospf 100 area 0.0.0.0 ip pim sparse-mode router ospf 100 router-id 10.102.0.5 router bgp 100 router-id 10.102.0.5 log-neighbor-changes address-family l2vpn evpn advertise-pip neighbor 10.102.0.2 remote-as 100 update-source loopback0 address-family ipv4 unicast address-family ipv6 unicast send-community send-community extended address-family l2vpn evpn send-community send-community extended neighbor 10.102.0.3 remote-as 100 update-source loopback0 address-family ipv4 unicast address-family ipv6 unicast send-community send-community extended address-family l2vpn evpn send-community send-community extended evpn vni 4000100 l2 rd auto route-target import auto route-target export auto vni 4000200 l2 rd auto route-target import auto route-target export auto vni 4000301 l2 rd auto route-target import auto route-target export auto vni 4000302 l2 rd auto route-target import auto route-target export auto vni 4000303 l2 rd auto route-target import auto route-target export auto
站点1枝叶2配置
feature nxapi feature sftp-server cfs ipv4 distribute nv overlay evpn feature ospf feature bgp feature pim feature fabric forwarding feature interface-vlan feature vn-segment-vlan-based feature lacp feature vpc feature nv overlay fabric forwarding anycast-gateway-mac 0000.1111.2222 ip pim rp-address 10.102.0.2 group-list 224.0.0.0/4 ip pim ssm range 232.0.0.0/8 vlan 1,100,200,300-350,2001 vlan 100 vn-segment 4000100 vlan 200 vn-segment 4000200 vlan 301 vn-segment 4000301 vlan 302 vn-segment 4000302 vlan 303 vn-segment 4000303 vlan 350 name L3-VNI vn-segment 4000999 vlan 2001 vn-segment 4000502 vrf context L3VNI4000999 vni 4000999 rd auto address-family ipv4 unicast route-target both auto route-target both auto evpn vrf context vrf_1 vni 4000501 rd auto address-family ipv4 unicast route-target both auto route-target both auto evpn vrf context vrf_2 vni 4000502 rd auto address-family ipv4 unicast route-target both auto route-target both auto evpn vpc domain 100 peer-switch peer-keepalive destination 10.197.214.53 source 10.197.214.54 virtual peer-link destination 10.102.1.8 source 10.102.1.9 dscp 56 delay restore 150 peer-gateway ip arp synchronize interface Vlan100 no shutdown mtu 9216 vrf member vrf_2 no ip redirects ip address 192.168.100.254/24 no ipv6 redirects fabric forwarding mode anycast-gateway interface Vlan200 no shutdown mtu 9216 vrf member vrf_2 no ip redirects ip address 192.168.200.254/24 no ipv6 redirects fabric forwarding mode anycast-gateway interface Vlan301 no shutdown mtu 9216 vrf member vrf_1 no ip redirects ip address 172.16.11.254/24 no ipv6 redirects fabric forwarding mode anycast-gateway interface Vlan302 no shutdown mtu 9216 vrf member vrf_1 no ip redirects ip address 172.16.12.254/24 no ipv6 redirects fabric forwarding mode anycast-gateway interface Vlan303 no shutdown mtu 9216 vrf member vrf_1 no ip redirects ip address 172.16.13.254/24 no ipv6 redirects fabric forwarding mode anycast-gateway interface Vlan2001 no shutdown mtu 9000 vrf member vrf_2 no ip redirects ip forward ipv6 address use-link-local-only no ipv6 redirects interface port-channel10 switchport switchport mode trunk switchport trunk allowed vlan 100,200,300-350,2001 spanning-tree port type network vpc peer-link interface port-channel100 switchport switchport mode trunk switchport trunk allowed vlan 100,200 mtu 9216 vpc 100 interface nve1 no shutdown host-reachability protocol bgp advertise virtual-rmac source-interface loopback1 member vni 4000100 suppress-arp mcast-group 231.0.0.1 member vni 4000200 suppress-arp mcast-group 231.0.0.2 member vni 4000502 associate-vrf interface Ethernet1/1 switchport switchport mode trunk switchport trunk allowed vlan 100,200 mtu 9216 channel-group 100 no shutdown interface Ethernet1/2 mtu 9216 port-type fabric medium p2p ip address 192.168.18.12/24 ip ospf network point-to-point ip router ospf 100 area 0.0.0.0 ip pim sparse-mode no shutdown interface loopback0 ip address 10.102.0.8/32 ip router ospf 100 area 0.0.0.0 ip pim sparse-mode interface loopback1 ip address 10.102.1.9/32 ip address 10.201.201.201/32 secondary ip router ospf 100 area 0.0.0.0 ip pim sparse-mode icam monitor scale router ospf 100 router-id 10.102.0.8 router bgp 100 router-id 10.102.0.8 log-neighbor-changes address-family l2vpn evpn advertise-pip neighbor 10.102.0.2 remote-as 100 update-source loopback0 address-family ipv4 unicast address-family ipv6 unicast send-community send-community extended address-family l2vpn evpn send-community send-community extended neighbor 10.102.0.3 remote-as 100 update-source loopback0 address-family ipv4 unicast address-family ipv6 unicast send-community send-community extended address-family l2vpn evpn send-community send-community extended evpn vni 4000100 l2 rd auto route-target import auto route-target export auto vni 4000200 l2 rd auto route-target import auto route-target export auto vni 4000301 l2 rd auto route-target import auto route-target export auto vni 4000302 l2 rd auto route-target import auto route-target export auto vni 4000303 l2 rd auto route-target import auto route-target export auto
为了文档简洁性和可读性，源内容中包含其他设备的完整配置，可以在此处引用。每个配置遵循与上述相同的详细结构，启用所需功能，定义VLAN、VNI、VRF、接口和路由协议，并根据每个设备的角色配置NVE、BGP EVPN和多站点边界网关参数。
验证
本节提供确认EVPN-VXLAN多站点配置是否正常运行的验证步骤和示例输出。
步骤 1：使用Ping检验端到端连接
Host2# ping 192.168.200.103 PING 192.168.200.103 (192.168.200.103): 56 data bytes 64 bytes from 192.168.200.103: icmp_seq=0 ttl=254 time=1.21 ms 64 bytes from 192.168.200.103: icmp_seq=1 ttl=254 time=0.627 ms 64 bytes from 192.168.200.103: icmp_seq=2 ttl=254 time=0.74 ms 64 bytes from 192.168.200.103: icmp_seq=3 ttl=254 time=0.737 ms 64 bytes from 192.168.200.103: icmp_seq=4 ttl=254 time=0.542 ms --- 192.168.200.103 ping statistics --- 5 packets transmitted, 5 packets received, 0.00% packet loss round-trip min/avg/max = 0.542/0.771/1.21 ms
步骤 2：通过其他Ping检验第2层和第3层连通性
Host2# ping 192.168.100.103 PING 192.168.100.103 (192.168.100.103): 56 data bytes 64 bytes from 192.168.100.103: icmp_seq=0 ttl=254 time=1.195 ms 64 bytes from 192.168.100.103: icmp_seq=1 ttl=254 time=0.613 ms 64 bytes from 192.168.100.103: icmp_seq=2 ttl=254 time=0.575 ms 64 bytes from 192.168.100.103: icmp_seq=3 ttl=254 time=0.522 ms 64 bytes from 192.168.100.103: icmp_seq=4 ttl=254 time=0.534 ms --- 192.168.100.103 ping statistics --- 5 packets transmitted, 5 packets received, 0.00% packet loss round-trip min/avg/max = 0.522/0.687/1.195 ms
Host2# ping 192.168.100.100 PING 192.168.100.100 (192.168.100.100): 56 data bytes 64 bytes from 192.168.100.100: icmp_seq=0 ttl=254 time=1.029 ms 64 bytes from 192.168.100.100: icmp_seq=1 ttl=254 time=0.561 ms 64 bytes from 192.168.100.100: icmp_seq=2 ttl=254 time=0.579 ms 64 bytes from 192.168.100.100: icmp_seq=3 ttl=254 time=0.511 ms 64 bytes from 192.168.100.100: icmp_seq=4 ttl=254 time=0.496 ms --- 192.168.100.100 ping statistics --- 5 packets transmitted, 5 packets received, 0.00% packet loss round-trip min/avg/max = 0.496/0.635/1.029 ms
HOST_3(config)# ping 192.168.100.100 PING 192.168.100.100 (192.168.100.100): 56 data bytes 64 bytes from 192.168.100.100: icmp_seq=0 ttl=254 time=1.319 ms 64 bytes from 192.168.100.100: icmp_seq=1 ttl=254 time=0.77 ms 64 bytes from 192.168.100.100: icmp_seq=2 ttl=254 time=0.505 ms 64 bytes from 192.168.100.100: icmp_seq=3 ttl=254 time=0.542 ms 64 bytes from 192.168.100.100: icmp_seq=4 ttl=254 time=0.486 ms --- 192.168.100.100 ping statistics --- 5 packets transmitted, 5 packets received, 0.00% packet loss round-trip min/avg/max = 0.486/0.724/1.319 ms
步骤 3：检验ARP表
device# show ip arp Flags: * - Adjacencies learnt on non-active FHRP router + - Adjacencies synced via CFSoE # - Adjacencies Throttled for Glean CP - Added via L2RIB, Control plane Adjacencies PS - Added via L2RIB, Peer Sync RO - Re-Originated Peer Sync Entry D - Static Adjacencies attached to down interface IP ARP Table for context default Total number of entries: 8 Flags
步骤 4：检验MAC地址表
device# show mac address-table Legend: * - primary entry, G - Gateway MAC, (R) - Routed MAC, O - Overlay MAC age - seconds since last seen, + - primary entry using vPC Peer-Link, (T) - True, (F) - False, C - ControlPlane MAC, ~ - vsan VLAN MAC Address Type age Secure NTFY Ports ---------+-----------------+--------+---------+------+----+------------------
步骤 5：检验BGP EVPN路由
device# show bgp l2vpn evpn BGP routing table information for VRF default, address family L2VPN EVPN BGP table version is 3291, Local Router ID is 10.102.0.5 Status: s-suppressed, x-deleted, S-stale, d-dampened, h-history, *-valid, >-best Path type: i-internal, e-external, c-confed, l-local, a-aggregate, r-redist, I-inject Origin codes: i - IGP, e - EGP, ? - incomplete, | - multipath, & - backup, 2 - best2 Network Next Hop Metric LocPrf Weight Path *>i[2]:[0]:[0]:[48]:[6c8b.d3fe.df3b]:[32]:[192.168.100.104]/27 210. 100. 100. 1 100 0 300 200 i ...
步骤 6：验证vPC状态
device# show vpc brief Legend:(*) - local vPC is down, forwarding via vPC peer-link vPC domain id : 100 Peer status : peer adjacency formed ok vPC keep-alive status : peer is alive Configuration consistency status : success Per-vlan consistency status : success Type-2 consistency status : success vPC role : secondary Number of vPCs configured : 1 Peer Gateway : Enabled Dual-active excluded VLANs : - Graceful Consistency Check : Enabled Auto-recovery status : Disabled Delay-restore status : Timer is off.(timeout = 150s) Delay-restore SVI status : Timer is off.(timeout = 10s) Delay-restore Orphan-port status: Timer is off.(timeout = 0s) Operational Layer3 Peer-router : Disabled Virtual-peerlink mode : Enabled vPC Peer-link status id Port Status Active vlans 1 Po10 up 100,200,300-350,2001 vPC status Id Port Status Consistency Reason Active vlans 100 Po100 up success success 100,200
故障排除
本节提供对EVPN-VXLAN多站点配置进行故障排除的命令和方法。
步骤 1：检验ARP表
device# show ip arp Flags: * - Adjacencies learnt on non-active FHRP router + - Adjacencies synced via CFSoE # - Adjacencies Throttled for Glean CP - Added via L2RIB, Control plane Adjacencies PS - Added via L2RIB, Peer Sync RO - Re-Originated Peer Sync Entry D - Static Adjacencies attached to down interface IP ARP Table for context default Total number of entries: 8 Flags
步骤 2：检验MAC地址表
device# show mac address-table Legend: * - primary entry, G - Gateway MAC, (R) - Routed MAC, O - Overlay MAC age - seconds since last seen, + - primary entry using vPC Peer-Link, (T) - True, (F) - False, C - ControlPlane MAC, ~ - vsan VLAN MAC Address Type age Secure NTFY Ports ---------+-----------------+--------+---------+------+----+------------------
步骤 3：检验BGP EVPN
device# show bgp l2vpn evpn
步骤 4：验证vPC状态
device# show vpc brief
步骤 5：使用Cisco CLI分析器
思科 CLI 分析器（仅适用于注册客户）支持某些 show 命令。要查看对 show 命令输出的分析，请使用思科 CLI 分析器。
相关信息
修订历史记录
| 版本 | 发布日期 | 备注 |
|---|---|---|
1.0 |
24-Jul-2025
|
初始版本 |
由思科工程师提供
- TAC工程师
反馈