H3C EVPN 网关配置

标签：ip H3C 网关 vpn target 0.0 address interface EVPN

一、H3C集中式EVPN网关配置

1、需求：

使用Router A、Router B为与服务器连接的VTEP设备；

Router C为与广域网连接的集中式EVPN网关设备；

Router D为RR，负责在路由器之间反射BGP路由。

虚拟机VM 1和VM 3属于VXLAN 10；VM 2和VM 4属于VXLAN 20。

相同VXLAN之间可以二层互通，不同VXLAN之间、VXLAN与广域网之间可以通过集中式EVPN网关互通。

2、实验步骤：

1、配置IP地址和单播路由协议

2、配置VXLAN与VSI，创建EVPN实例

3、配置BGP L2VPN EVPN

4、接口关联VSI实例

3、拓扑架构：

4、配置命令：

Device-RTD:



#

sysname RTD

#

ip vpn-instance vpn1     //创建VPN实例

route-distinguisher 1:1  //赋予RD值，RD是本地PE路由器上VPN的唯一标识

#

address-family ipv4     //创建RIB IPv4地址族，并进入RIB IPv4地址族视图

vpn-target 2:2 import-extcommunity    //配置入方向的RT值

vpn-target 2:2 export-extcommunity  //配置出方向的RT值

#

address-family evpn   //进入IPV4 EVPN视图

vpn-target 1:1 import-extcommunity  //配置入方向的RT值

vpn-target 1:1 export-extcommunity  //配置出方向的RT值

#

vxlan tunnel mac-learning disable   //命令用来关闭远端MAC地址自动学习功能，如果网络中存在攻击，为了避免学习到错误的远端MAC地址，可以通过本命令手工关闭远端MAC地址自动学习功能。

#

ospf 1    //配置OSPF路由

area 0.0.0.0

#

l2vpn enable   //全局开启l2vpn能力

vxlan tunnel arp-learning disable   //命令用来关闭远端ARP自动学习功能

#

vsi vpna    //VXLAN与VSI绑定

gateway vsi-interface 1

vxlan 10

evpn encapsulation vxlan

route-distinguisher auto

vpn-target auto export-extcommunity

vpn-target auto import-extcommunity

#

interface LoopBack0

ip address 4.4.4.4 255.255.255.255

ospf 1 area 0.0.0.0

#

interface GigabitEthernet0/0

ip address 11.1.1.1 255.255.255.252

ospf 1 area 0.0.0.0

#

interface GigabitEthernet0/1

ip address 12.1.1.1 255.255.255.252

ospf 1 area 0.0.0.0

#

interface GigabitEthernet0/2

ip address 13.1.1.1 255.255.255.252

ospf 1 area 0.0.0.0

#

interface Vsi-interface1   //创建VSI接口并绑定VPN实例

ip binding vpn-instance vpn1

ip address 10.1.1.1 255.255.255.0

mac-address 0001-0001-0001

distributed-gateway local   //命令用来配置VSI虚接口为分布式网关接口。在分布式VXLAN IP网关组网中，多个网关上同一VXLAN的VSI虚接口需要配置相同的IP地址。为了避免IP地址冲突，需要在VSI虚接口上执行本命令，以防止VSI虚接口上报地址冲突，导致VSI虚接口不可用。

#

interface Vsi-interface2

ip binding vpn-instance vpn1

l3-vni 1000  //配置L3VPN的VXLAN ID，分布式网关组网中，需要在网关上配置L3VNI。在网关之间通过VXLAN隧道转发流量时，属于同一租户的流量通过L3VNI来标识。

#

bgp 200

group evpn internal

peer evpn connect-interface LoopBack0

peer 1.1.1.1 group evpn

peer 2.2.2.2 group evpn

peer 3.3.3.3 group evpn

#

address-family l2vpn evpn

undo policy vpn-target

peer evpn enable

peer evpn reflect-client

#

Device-RTA:



#

sysname RTA

#

vxlan tunnel mac-learning disable

#

ospf 1

area 0.0.0.0

#

l2vpn enable

#

vsi vpna

arp suppression enable

vxlan 10

evpn encapsulation vxlan

route-distinguisher auto

vpn-target auto export-extcommunity

vpn-target auto import-extcommunity

#

vsi vpnb

arp suppression enable

vxlan 20

evpn encapsulation vxlan

route-distinguisher auto

vpn-target auto export-extcommunity

vpn-target auto import-extcommunity

#

interface LoopBack0

ip address 1.1.1.1 255.255.255.255

ospf 1 area 0.0.0.0

#

interface GigabitEthernet0/0

ip address 11.1.1.2 255.255.255.252

ospf 1 area 0.0.0.0

#

bgp 200

peer 4.4.4.4 as-number 200

peer 4.4.4.4 connect-interface LoopBack0

#

address-family l2vpn evpn

peer 4.4.4.4 enable

#

Device-RTB:

#

sysname RTB

#

vxlan tunnel mac-learning disable

#

ospf 1

area 0.0.0.0

#

l2vpn enable

#

vsi vpna

arp suppression enable

vxlan 10

evpn encapsulation vxlan

route-distinguisher auto

vpn-target auto export-extcommunity

vpn-target auto import-extcommunity

#

vsi vpnb

arp suppression enable

vxlan 20

evpn encapsulation vxlan

route-distinguisher auto

vpn-target auto export-extcommunity

vpn-target auto import-extcommunity

#

interface LoopBack0

ip address 2.2.2.2 255.255.255.255

ospf 1 area 0.0.0.0

#

interface GigabitEthernet0/0

ip address 12.1.1.2 255.255.255.252

ospf 1 area 0.0.0.0

#

interface GigabitEthernet0/1

xconnect vsi vpna    //将三层接口与VSI关联后，从该接口接收到的报文，将通过查找关联VSI的MAC地址表进行转发。

#

interface GigabitEthernet0/2

xconnect vsi vpnb

#

bgp 200

peer 4.4.4.4 as-number 200

peer 4.4.4.4 connect-interface LoopBack0

#

address-family l2vpn evpn

peer 4.4.4.4 enable

#

Device-RTC:



#

sysname RTC

#

vxlan tunnel mac-learning disable

#

ospf 1

default-route-advertise always     //将缺省路由引入到OSPF路由区域，使用import-route命令不能引入缺省路由，如果要引入缺省路由，必须使用该命令。当本地路由器的路由表中没有缺省路由时，要产生一个描述缺省路由的Type-5 LSA应使用always关键字

area 0.0.0.0

l2vpn enable

#

vsi vpna

gateway vsi-interface 1

vxlan 10

evpn encapsulation vxlan

route-distinguisher auto

vpn-target auto export-extcommunity

vpn-target auto import-extcommunity

#

vsi vpnb

gateway vsi-interface 2

vxlan 20

evpn encapsulation vxlan

route-distinguisher auto

vpn-target auto export-extcommunity

vpn-target auto import-extcommunity

#

interface LoopBack0

ip address 3.3.3.3 255.255.255.255

ospf 1 area 0.0.0.0

#

interface LoopBack1

ip address 20.1.1.1 255.255.255.255

#

interface GigabitEthernet0/0

ip address 13.1.1.2 255.255.255.252

ospf 1 area 0.0.0.0

#

interface Vsi-interface1

ip address 10.1.1.1 255.255.255.0

#

interface Vsi-interface2

ip address 10.1.2.1 255.255.255.0

#

bgp 200

peer 4.4.4.4 as-number 200

peer 4.4.4.4 connect-interface LoopBack0

#

address-family l2vpn evpn

peer 4.4.4.4 enable

5、VM配置截图：

6、测试结果：

查看Router C上的EVPN路由信息，可以看到Router C发送了网关的MAC/IP路由和IMET（Inclusive multicast Ethernet tag route集成多播以太标记路由）路由，并接收到Router A和Router B发送的MAC/IP路由和IMET路由。

查看Router C上的Tunnel接口信息，可以看到VXLAN模式的Tunnel接口处于up状态。

查看Router C上的VSI虚接口信息，可以看到VSI虚接口处于up状态。

查看Router C上的VSI信息，可以看到VSI内创建的VXLAN、与VXLAN关联的VXLAN隧道、与VSI关联的VSI虚接口等信息。

查看Router C上VSI的EVPN ARP表项信息，可以看到已学习到了虚拟机的ARP信息。

查看Router C上FIB表项信息，可以看到已学习到了虚拟机的转发表项信息。

虚拟机VM 1、VM 2、VM 3、VM 4之间互访测试。

二、H3C 分布式EVPN网关配置

1、拓扑说明：

Router A、Router B为分布式EVPN网关设备；

Router C为与外部网络（广域网）连接的边界网关设备；

Router D为RR（反射器），负责在路由器之间反射BGP路由；

虚拟机VM 1和VM 3属于VXLAN 10；

VM 2和VM 4属于VXLAN 20；

相同VXLAN之间可以二层互通；

不同VXLAN之间通过分布式EVPN网关实现三层互通；

VXLAN与广域网之间通过边界网关实现三层互通。

2、配置命令：

RTA:

RTA:

#

sysname RTA

#

ip vpn-instance vpn1

route-distinguisher 1:1

#

address-family ipv4

vpn-target 2:2 import-extcommunity

vpn-target 2:2 export-extcommunity

#

address-family evpn

vpn-target 1:1 import-extcommunity

vpn-target 1:1 export-extcommunity

#

vxlan tunnel mac-learning disable

#

ospf 1

area 0.0.0.0

#

l2vpn enable

vxlan tunnel arp-learning disable

#

vsi vpna

gateway vsi-interface 1

arp suppression enable

vxlan 10

evpn encapsulation vxlan

route-distinguisher auto

vpn-target auto export-extcommunity

vpn-target auto import-extcommunity

#

vsi vpnb

gateway vsi-interface 2

arp suppression enable

vxlan 20

evpn encapsulation vxlan

route-distinguisher auto

vpn-target auto export-extcommunity

vpn-target auto import-extcommunity

#

interface LoopBack0

ip address 1.1.1.1 255.255.255.255

ospf 1 area 0.0.0.0

#

interface GigabitEthernet0/0

port link-mode route

combo enable copper

ip address 11.1.1.2 255.255.255.252

ospf 1 area 0.0.0.0

#

interface GigabitEthernet0/1

port link-mode route

combo enable copper

xconnect vsi vpna

#

interface GigabitEthernet0/2

port link-mode route

combo enable copper

xconnect vsi vpnb

#

interface Vsi-interface1

ip binding vpn-instance vpn1

ip address 10.1.1.1 255.255.255.0

mac-address 0001-0001-0001

local-proxy-arp enable

distributed-gateway local

#

interface Vsi-interface2

ip binding vpn-instance vpn1

ip address 10.1.2.1 255.255.255.0

mac-address 0002-0002-0002

local-proxy-arp enable

distributed-gateway local

#

interface Vsi-interface3

ip binding vpn-instance vpn1

l3-vni 1000

#

bgp 200

peer 4.4.4.4 as-number 200

peer 4.4.4.4 connect-interface LoopBack0

#

address-family l2vpn evpn

peer 4.4.4.4 enable

#

RTB:

#

sysname RTB

#

ip vpn-instance vpn1

route-distinguisher 1:2

#

address-family ipv4

vpn-target 2:2 import-extcommunity

vpn-target 2:2 export-extcommunity

#

address-family evpn

vpn-target 1:1 import-extcommunity

vpn-target 1:1 export-extcommunity

#

vxlan tunnel mac-learning disable

#

ospf 1

area 0.0.0.0

#

vlan 1

#

l2vpn enable

vxlan tunnel arp-learning disable

#

vsi vpna

gateway vsi-interface 1

arp suppression enable

vxlan 10

evpn encapsulation vxlan

route-distinguisher auto

vpn-target auto export-extcommunity

vpn-target auto import-extcommunity

#

vsi vpnb

gateway vsi-interface 2

arp suppression enable

vxlan 20

evpn encapsulation vxlan

route-distinguisher auto

vpn-target auto export-extcommunity

vpn-target auto import-extcommunity

#

interface LoopBack0

ip address 2.2.2.2 255.255.255.255

ospf 1 area 0.0.0.0

#

interface GigabitEthernet0/0

port link-mode route

combo enable copper

ip address 12.1.1.2 255.255.255.252

ospf 1 area 0.0.0.0

#

interface GigabitEthernet0/1

port link-mode route

combo enable copper

xconnect vsi vpna

#

interface GigabitEthernet0/2

port link-mode route

combo enable copper

xconnect vsi vpnb

#

interface Vsi-interface1

ip binding vpn-instance vpn1

ip address 10.1.1.1 255.255.255.0

mac-address 0001-0001-0001

local-proxy-arp enable

distributed-gateway local

#

interface Vsi-interface2

ip binding vpn-instance vpn1

ip address 10.1.2.1 255.255.255.0

mac-address 0002-0002-0002

local-proxy-arp enable

distributed-gateway local

#

interface Vsi-interface3

ip binding vpn-instance vpn1

l3-vni 1000

#

bgp 200

peer 4.4.4.4 as-number 200

peer 4.4.4.4 connect-interface LoopBack0

#

address-family l2vpn evpn

peer 4.4.4.4 enable

#

RTC:

#

sysname RTC

#

ip vpn-instance vpn1

route-distinguisher 1:3

#

address-family ipv4

vpn-target 2:2 import-extcommunity

vpn-target 2:2 export-extcommunity

#

address-family evpn

vpn-target 1:1 import-extcommunity

vpn-target 1:1 export-extcommunity

#

vxlan tunnel mac-learning disable

#

ospf 1

default-route-advertise always

area 0.0.0.0

#

l2vpn enable

vxlan tunnel arp-learning disable

#

interface LoopBack0

ip address 3.3.3.3 255.255.255.255

ospf 1 area 0.0.0.0

#

interface LoopBack1

ip binding vpn-instance vpn1

ip address 20.1.1.1 255.255.255.255

#

interface GigabitEthernet0/0

port link-mode route

combo enable copper

ip address 13.1.1.2 255.255.255.252

ospf 1 area 0.0.0.0

#

interface Vsi-interface3

ip binding vpn-instance vpn1

l3-vni 1000

#

bgp 200

peer 4.4.4.4 as-number 200

peer 4.4.4.4 connect-interface LoopBack0

#

address-family l2vpn evpn

peer 4.4.4.4 enable

#

ip vpn-instance vpn1

#

address-family ipv4 unicast

import-route direct

#

RTD:

#

sysname RR

#

ospf 1

area 0.0.0.0

#

interface LoopBack0

ip address 4.4.4.4 255.255.255.255

ospf 1 area 0.0.0.0

#

interface GigabitEthernet0/0

port link-mode route

combo enable copper

ip address 11.1.1.1 255.255.255.252

ospf 1 area 0.0.0.0

#

interface GigabitEthernet0/1

port link-mode route

combo enable copper

ip address 12.1.1.1 255.255.255.252

ospf 1 area 0.0.0.0

#

interface GigabitEthernet0/2

port link-mode route

combo enable copper

ip address 13.1.1.1 255.255.255.252

ospf 1 area 0.0.0.0

#

bgp 200

group evpn internal

peer evpn connect-interface LoopBack0

peer 1.1.1.1 group evpn

peer 2.2.2.2 group evpn

peer 3.3.3.3 group evpn

#

address-family l2vpn evpn

undo policy vpn-target

peer evpn enable

peer evpn reflect-client

#