Go to Qiita Advent Calendar 2024 Top
LoginSignup
0
0

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?

@k-maki(Katsumi Maki)

EVPN/VXLANのマルチホーミングで装置冗長したL2SWを作ってみる

Last updated at Posted at 2024-09-15

ジュニパー機器の仮想イメージのvJunos-switchで、EVPN/VXLANのマルチホーミングを動作させた際のメモ
(ネットワークシュミレータを利用)

モチベーション

  • 以下の動画の EVPN/VXLAN で MAC-VRF 形式の VLAN Aware をやってみたい
    https://youtu.be/kTB6f3Utfls?si=DB-rixfATYh06Hg0
  • 合わせて OSPF の unnumbered もやってみたい
  • 無償で利用できる環境でやってみたい:laughing:

ということで、ネットワークシュミレータ上で動作を確認をしてみました
( 無償で利用できる vJunos-switch を利用しました )

VXLAN・EVPN/VXLAN とは

以下のサイトが分かりやすかったです
https://www.infraexpert.com/study/virtual3.html

構成

以下の構成で確認しました
image.png

  • 中心の vJunos-switch 2台で EVPN/VXLAN のマルチホーミングを利用し装置冗長した L2SW を構築
  • vJunos-switch の両端の L2SW は freeRouter で構築
  • 両端に VLAN:100 と VLAN:200 のPCを配置
  • LAG はすべて LACP(slow) を利用
  • vJunos-switch 間は OSPF でお互いの loopback アドレスを広報、接続するインターフェースに unnumbered 設定して IPアドレスは設定しない
  • OSPFにて学習したloopbackアドレス同士で、MP-BGPで接続してEVPNの経路交換を行う
  • VLAN:100とVLAN:200を、MAC-VRF 形式の VLAN Aware で 1つの MAC-VRF の中に2つの VLAN を設定

準備

vJunos-switch をダウンロードする

こちらからダウンロードできます。内容を確認し同意した上でダウンロードしてください
https://support.juniper.net/support/downloads/?p=vjunos-switch
(JUNOSバージョンは、23.2R1.14で今回確認しました)

ネットワークシュミレータへの設定は以下を参考にしてください
https://www.eve-ng.net/index.php/documentation/howtos/vjunos-ex-switch/

ネットワークシュミレータ や freeRouter を準備する

以下のサイト参考にしてください
https://qiita.com/k-maki/items/5b3e705cb3948e2b5664

コンフィグ

以下のコンフィグで設定

vJunosSwitch-1
vJunosSwitch-1
set version 23.2R1.14
set system host-name vJunosSwitch-1

set system syslog file interactive-commands interactive-commands any
set system syslog file messages any notice
set system syslog file messages authorization info
set chassis aggregated-devices ethernet device-count 20
set interfaces ge-0/0/1 description To_FreeRTR-L2SW-1
set interfaces ge-0/0/1 ether-options 802.3ad ae1
set interfaces ge-0/0/2 description To_FreeRTR-L2SW-2
set interfaces ge-0/0/2 ether-options 802.3ad ae2
set interfaces ge-0/0/9 description To_vJunosSwitch-2
set interfaces ge-0/0/9 mac 50:00:00:00:01:09
set interfaces ge-0/0/9 ether-options 802.3ad ae9
set interfaces ae1 description To_FreeRTR-L2SW-1
set interfaces ae1 flexible-vlan-tagging
set interfaces ae1 encapsulation flexible-ethernet-services
set interfaces ae1 esi auto-derive lacp-pe-system-id-and-admin-key
set interfaces ae1 esi all-active
set interfaces ae1 aggregated-ether-options lacp active
set interfaces ae1 aggregated-ether-options lacp periodic slow
set interfaces ae1 aggregated-ether-options lacp system-id 00:01:01:01:01:01
set interfaces ae1 unit 100 encapsulation vlan-bridge
set interfaces ae1 unit 100 vlan-id 100
set interfaces ae1 unit 200 encapsulation vlan-bridge
set interfaces ae1 unit 200 vlan-id 200
set interfaces ae2 description To_FreeRTR-L2SW-2
set interfaces ae2 flexible-vlan-tagging
set interfaces ae2 encapsulation flexible-ethernet-services
set interfaces ae2 esi auto-derive lacp-pe-system-id-and-admin-key
set interfaces ae2 esi all-active
set interfaces ae2 aggregated-ether-options lacp active
set interfaces ae2 aggregated-ether-options lacp periodic slow
set interfaces ae2 aggregated-ether-options lacp system-id 00:02:02:02:02:02
set interfaces ae2 unit 100 encapsulation vlan-bridge
set interfaces ae2 unit 100 vlan-id 100
set interfaces ae2 unit 200 encapsulation vlan-bridge
set interfaces ae2 unit 200 vlan-id 200
set interfaces ae9 description To_vJunosSwitch-2
set interfaces ae9 mac 50:00:00:00:01:09
set interfaces ae9 aggregated-ether-options lacp active
set interfaces ae9 aggregated-ether-options lacp periodic slow
set interfaces ae9 aggregated-ether-options lacp system-id 50:00:00:00:01:09
set interfaces ae9 unit 0 family inet unnumbered-address lo0.0
set interfaces lo0 unit 0 family inet address 10.0.0.1/32
set policy-options policy-statement LOAD-BALANCE then load-balance per-packet
set routing-instances EVPN-VXLAN instance-type mac-vrf
set routing-instances EVPN-VXLAN protocols evpn encapsulation vxlan
set routing-instances EVPN-VXLAN vtep-source-interface lo0.0
set routing-instances EVPN-VXLAN service-type vlan-aware
set routing-instances EVPN-VXLAN route-distinguisher 10.0.0.1:1
set routing-instances EVPN-VXLAN vrf-target target:65000:1
set routing-instances EVPN-VXLAN vlans VLAN0100 vlan-id 100
set routing-instances EVPN-VXLAN vlans VLAN0100 interface ae1.100
set routing-instances EVPN-VXLAN vlans VLAN0100 interface ae2.100
set routing-instances EVPN-VXLAN vlans VLAN0100 vxlan vni 100
set routing-instances EVPN-VXLAN vlans VLAN0200 vlan-id 200
set routing-instances EVPN-VXLAN vlans VLAN0200 interface ae1.200
set routing-instances EVPN-VXLAN vlans VLAN0200 interface ae2.200
set routing-instances EVPN-VXLAN vlans VLAN0200 vxlan vni 200
set routing-options router-id 10.0.0.1
set routing-options autonomous-system 65000
set routing-options forwarding-table export LOAD-BALANCE
set protocols bgp group BGP_EVPN type internal
set protocols bgp group BGP_EVPN local-address 10.0.0.1
set protocols bgp group BGP_EVPN family evpn signaling
set protocols bgp group BGP_EVPN local-as 65000
set protocols bgp group BGP_EVPN neighbor 10.0.0.2
set protocols ospf area 0.0.0.0 interface lo0.0 passive
set protocols ospf area 0.0.0.0 interface ae9.0 interface-type p2p
vJunosSwitch-2
vJunosSwitch-2
set version 23.2R1.14
set system host-name vJunosSwitch-2

set system syslog file interactive-commands interactive-commands any
set system syslog file messages any notice
set system syslog file messages authorization info
set chassis aggregated-devices ethernet device-count 20
set interfaces ge-0/0/1 description To_FreeRTR-L2SW-1
set interfaces ge-0/0/1 ether-options 802.3ad ae1
set interfaces ge-0/0/2 description To_FreeRTR-L2SW-2
set interfaces ge-0/0/2 ether-options 802.3ad ae2
set interfaces ge-0/0/9 description To_vJunosSwitch-1
set interfaces ge-0/0/9 mac 50:00:00:00:02:09
set interfaces ge-0/0/9 ether-options 802.3ad ae9
set interfaces ae1 description To_FreeRTR-L2SW-1
set interfaces ae1 flexible-vlan-tagging
set interfaces ae1 encapsulation flexible-ethernet-services
set interfaces ae1 esi auto-derive lacp-pe-system-id-and-admin-key
set interfaces ae1 esi all-active
set interfaces ae1 aggregated-ether-options lacp active
set interfaces ae1 aggregated-ether-options lacp periodic slow
set interfaces ae1 aggregated-ether-options lacp system-id 00:01:01:01:01:01
set interfaces ae1 unit 100 encapsulation vlan-bridge
set interfaces ae1 unit 100 vlan-id 100
set interfaces ae1 unit 200 encapsulation vlan-bridge
set interfaces ae1 unit 200 vlan-id 200
set interfaces ae2 description To_FreeRTR-L2SW-2
set interfaces ae2 flexible-vlan-tagging
set interfaces ae2 encapsulation flexible-ethernet-services
set interfaces ae2 esi auto-derive lacp-pe-system-id-and-admin-key
set interfaces ae2 esi all-active
set interfaces ae2 aggregated-ether-options lacp active
set interfaces ae2 aggregated-ether-options lacp periodic slow
set interfaces ae2 aggregated-ether-options lacp system-id 00:02:02:02:02:02
set interfaces ae2 unit 100 encapsulation vlan-bridge
set interfaces ae2 unit 100 vlan-id 100
set interfaces ae2 unit 200 encapsulation vlan-bridge
set interfaces ae2 unit 200 vlan-id 200
set interfaces ae9 description To_vJunosSwitch-2
set interfaces ae9 mac 50:00:00:00:02:09
set interfaces ae9 aggregated-ether-options lacp active
set interfaces ae9 aggregated-ether-options lacp periodic slow
set interfaces ae9 aggregated-ether-options lacp system-id 50:00:00:00:02:09
set interfaces ae9 unit 0 family inet unnumbered-address lo0.0
set interfaces lo0 unit 0 family inet address 10.0.0.2/32
set policy-options policy-statement LOAD-BALANCE then load-balance per-packet
set routing-instances EVPN-VXLAN instance-type mac-vrf
set routing-instances EVPN-VXLAN protocols evpn encapsulation vxlan
set routing-instances EVPN-VXLAN vtep-source-interface lo0.0
set routing-instances EVPN-VXLAN service-type vlan-aware
set routing-instances EVPN-VXLAN route-distinguisher 10.0.0.2:1
set routing-instances EVPN-VXLAN vrf-target target:65000:1
set routing-instances EVPN-VXLAN vlans VLAN0100 vlan-id 100
set routing-instances EVPN-VXLAN vlans VLAN0100 interface ae1.100
set routing-instances EVPN-VXLAN vlans VLAN0100 interface ae2.100
set routing-instances EVPN-VXLAN vlans VLAN0100 vxlan vni 100
set routing-instances EVPN-VXLAN vlans VLAN0200 vlan-id 200
set routing-instances EVPN-VXLAN vlans VLAN0200 interface ae1.200
set routing-instances EVPN-VXLAN vlans VLAN0200 interface ae2.200
set routing-instances EVPN-VXLAN vlans VLAN0200 vxlan vni 200
set routing-options router-id 10.0.0.2
set routing-options autonomous-system 65000
set routing-options forwarding-table export LOAD-BALANCE
set protocols bgp group BGP_EVPN type internal
set protocols bgp group BGP_EVPN local-address 10.0.0.2
set protocols bgp group BGP_EVPN family evpn signaling
set protocols bgp group BGP_EVPN local-as 65000
set protocols bgp group BGP_EVPN neighbor 10.0.0.1
set protocols ospf area 0.0.0.0 interface lo0.0 passive
set protocols ospf area 0.0.0.0 interface ae9.0 interface-type p2p
FreeRTR-L2SW-01
FreeRTR-L2SW-01
hostname FreeRTR-L2SW-01
buggy
!
!
bundle 99
 description BUNDLE_AGGREGATE_PORT
 exit
!
bridge 100
 description BRIDGE_VLAN_100
 mac-learn
 exit
!
bridge 200
 description BRIDGE_VLAN_200
 mac-learn
 exit
!
vrf definition host
 exit
!
interface bundle99
 description To_vJunosSwitch
 no shutdown
 no log-link-change
 exit
!
interface bundle99.100
 description To_vJunosSwitch(VALN_100)
 bridge-group 100
 no shutdown
 no log-link-change
 exit
!
interface bundle99.200
 description To_vJunosSwitch(VALN_200)
 bridge-group 200
 no shutdown
 no log-link-change
 exit
!
interface bvi100
 description BVI_VLAN_100
 no shutdown
 no log-link-change
 exit
!
interface bvi200
 description BVI_VLAN_200
 no shutdown
 no log-link-change
 exit
!
interface ethernet1
 description To_vJunosSwitch-1
 lacp 0000.0000.1111 11 2
 bundle-group 99
 no shutdown
 no log-link-change
 exit
!
interface ethernet2
 description To_vJunosSwitch-2
 lacp 0000.0000.1111 11 2
 bundle-group 99
 no shutdown
 no log-link-change
 exit
!
interface ethernet20001
 shutdown
 no log-link-change
 exit
!
interface ethernet3
 description To_VPC100(VALN_100)
 bridge-group 100
 no shutdown
 no log-link-change
 exit
!
interface ethernet4
 description To_VPC200(VALN_200)
 bridge-group 200
 no shutdown
 no log-link-change
 exit
!
end
FreeRTR-L2SW-02
FreeRTR-L2SW-02
hostname FreeRTR-L2SW-02
buggy
!
!
bundle 99
 description BUNDLE_AGGREGATE_PORT
 exit
!
bridge 100
 description BRIDGE_VLAN_100
 mac-learn
 exit
!
bridge 200
 description BRIDGE_VLAN_200
 mac-learn
 exit
!
vrf definition host
 exit
!
interface bundle99
 description To_vJunosSwitch
 no shutdown
 no log-link-change
 exit
!
interface bundle99.100
 description To_vJunosSwitch(VALN_100)
 bridge-group 100
 no shutdown
 no log-link-change
 exit
!
interface bundle99.200
 description To_vJunosSwitch(VALN_200)
 bridge-group 200
 no shutdown
 no log-link-change
 exit
!
interface bvi100
 description BVI_VLAN_100
 no shutdown
 no log-link-change
 exit
!
interface bvi200
 description BVI_VLAN_200
 no shutdown
 no log-link-change
 exit
!
interface ethernet1
 description To_vJunosSwitch-1
 lacp 0000.0000.2222 11 2
 bundle-group 99
 no shutdown
 no log-link-change
 exit
!
interface ethernet2
 description To_vJunosSwitch-2
 lacp 0000.0000.2222 11 2
 bundle-group 99
 no shutdown
 no log-link-change
 exit
!
interface ethernet20001
 shutdown
 no log-link-change
 exit
!
interface ethernet3
 description To_VPC100(VALN_100)
 bridge-group 100
 no shutdown
 no log-link-change
 exit
!
interface ethernet4
 description To_VPC200(VALN_200)
 bridge-group 200
 no shutdown
 no log-link-change
 exit
!
end

vJunosSwitch について、rootのパスワード設定は外しています「set system root-authentication plain-text-password」でパスワード設定してからコンフィグを入れてください。詳細はこちらのサイトをご確認お願い致します

確認

pingで疎通確認

VLAN:100 同士はPING疎通すること、VLAN:100 → VLAN:200 は疎通しないことを確認できた
image.png

FDBテーブル確認

vJunosSwitch でFDBテーブルを確認してVLAN毎でアドレスを学習していることを確認

root@vJunosSwitch-1> show mac-vrf forwarding mac-table

MAC flags (S - static MAC, D - dynamic MAC, L - locally learned, P - Persistent static
           SE - statistics enabled, NM - non configured MAC, R - remote PE MAC, O - ovsdb MAC,
           B - Blocked MAC)


Ethernet switching table : 4 entries, 4 learned
Routing instance : EVPN-VXLAN
   Vlan                MAC                 MAC       GBP    Logical                SVLBNH/      Active
   name                address             flags     tag    interface              VENH Index   source
   VLAN0100            00:50:79:66:68:99   DLR              ae1.100
   VLAN0100            00:50:79:66:68:9b   DLR              ae2.100
   VLAN0200            00:50:79:66:68:9a   DLR              ae1.200
   VLAN0200            00:50:79:66:68:9c   DLR              ae2.200

root@vJunosSwitch-1>

参考：つまづいた箇所

vJunosSwitch 間で MAC アドレスが重複

自分の環境だとset chassis aggregated-devices ethernet device-count 20を設定したタイミングでMACアドレスがネットワークシュミレータ上で指定したMACアドレスから変更されてしまい、2台の vJunosSwitch でMACアドレスが重複してしまいました

装置間を直接接続する箇所については、MACアドレスがかぶると LACP の system-id も重複してしまって LAG-IF の ae9 がリンクアップしなかったので、以下の設定でMACアドレスとlacp system-idを手動設定しました

vJunosSwitch-1
set interfaces ge-0/0/9 mac 50:00:00:00:01:09
set interfaces ae9 mac 50:00:00:00:01:09
set interfaces ae9 aggregated-ether-options lacp system-id 50:00:00:00:01:09
vJunosSwitch-2
set interfaces ge-0/0/9 mac 50:00:00:00:02:09
set interfaces ae9 mac 50:00:00:00:02:09
set interfaces ae9 aggregated-ether-options lacp system-id 50:00:00:00:02:09

freeRouter 再起動しないと設定反映されないことがあった

interface bundle99.100など設定してもうまく反映されず、reloadコマンドで再起動すると反映されることが何度かありました

最後に

vJunos-switchを利用して EVPN/VXLAN のマルチホーミング動作を確認できました

OSPFの unnumbered は普段IPアドレスを設定するインターフェースを
set interfaces ae9 unit 0 family inet unnumbered-address lo0.0
に置きかけるだけで利用できました。unnumbered を利用することで loopback 以外は IPアドレス設定が不要になり管理が楽になることが期待できそうでした

Junos の EVPN/VXLAN 設定は、今回の MAC-VRF 形式の設定の仕方とは別に、set protocols evpn のコンフィグ形式でも設定できますが、MAC-VRF 形式でのメリットを ChatGPT に聞いてみたら以下の通り教えてくれました

EVPN VXLANでMAC-VRFを利用することにより、マルチテナント環境のスケーラビリティとセキュリティを向上させ、トラフィックの分離や管理の効率化が図れます。大規模で多様なネットワークの運用において、MAC-VRFは非常に有効な手段です。

今回の小さな構成ではあまり違いが見えにくかったですが規模が大きくなった際は効果がありそう

0
0
0

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
Sign upLogin
0
0

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?