X-Git-Url: https://git.proxmox.com/?a=blobdiff_plain;f=vxlan-and-evpn.adoc;h=ec1bc0701ffd17a6f848c94108c5761cde5af020;hb=513e2f5752c531b706e9217d27a1178189f92dbb;hp=5b9a8c26214e6b40dad1f3cac1c24cdba7f26406;hpb=fc8f7b53797438f4514a2b3f8ce031ac6971fd53;p=pve-docs.git diff --git a/vxlan-and-evpn.adoc b/vxlan-and-evpn.adoc index 5b9a8c2..ec1bc07 100644 --- a/vxlan-and-evpn.adoc +++ b/vxlan-and-evpn.adoc @@ -1126,8 +1126,8 @@ line vty ! ---- -VXLAN layer3 routing with anycast gateway + routing to outside with external router -~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +VXLAN layer3 routing with anycast gateway + routing to outside with external router with static default gw +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Routing to outside need the symmetric model. 1 gateway node @@ -1155,6 +1155,8 @@ iface vmbr0 inet static bridge_ports eno1 bridge_stp off bridge_fd 0 + ip-forward on + ip6-forward on auto vxlan2 iface vxlan2 inet manual @@ -1237,6 +1239,10 @@ router bgp 1234 import vrf vrf1 exit-address-family ! + address-family ipv6 unicast + import vrf vrf1 + exit-address-family + ! address-family l2vpn evpn neighbor 192.168.0.2 activate neighbor 192.168.0.3 activate @@ -1245,8 +1251,17 @@ router bgp 1234 ! router bgp 1234 vrf vrf1 ! + address-family ipv4 unicast + redistribute connected + exit-address-family + ! + address-family ipv6 unicast + redistribute connected + exit-address-family + ! address-family l2vpn evpn default-originate ipv4 + default-originate ipv6 exit-address-family ! line vty @@ -1478,6 +1493,16 @@ The external router have ecmp routes to all proxmox nodes.(balancing). If the router send the packet to a wrong node (vm is not on this node), this node will route through vxlan the packet to final destination. +If you have multiple gateway nodes, disable rp_filter as packet could incoming in a 1 node, and outgoing +to another node. + +sysctl.conf tuning +----- +net.ipv4.conf.default.rp_filter=0 +net.ipv4.conf.all.rp_filter=0 +----- + + *node1 ---- @@ -1497,6 +1522,8 @@ iface vmbr0 inet static bridge_ports eno1 bridge_stp off bridge_fd 0 + ip-forward on + ip6-forward on auto vxlan2 iface vxlan2 inet manual @@ -1579,6 +1606,10 @@ router bgp 1234 import vrf vrf1 exit-address-family ! + address-family ipv6 unicast + import vrf vrf1 + exit-address-family + ! address-family l2vpn evpn neighbor 192.168.0.2 activate neighbor 192.168.0.3 activate @@ -1587,8 +1618,17 @@ router bgp 1234 ! router bgp 1234 vrf vrf1 ! + address-family ipv4 unicast + redistribute connected + exit-address-family + ! + address-family ipv6 unicast + redistribute connected + exit-address-family + ! address-family l2vpn evpn default-originate ipv4 + default-originate ipv6 exit-address-family ! line vty @@ -1615,6 +1655,8 @@ iface vmbr0 inet static bridge_ports eno1 bridge_stp off bridge_fd 0 + ip-forward on + ip6-forward on auto vxlan2 iface vxlan2 inet manual @@ -1698,14 +1740,27 @@ router bgp 1234 import vrf vrf1 exit-address-family ! + address-family ipv6 unicast + import vrf vrf1 + exit-address-family + ! address-family l2vpn evpn neighbor 192.168.0.1 activate neighbor 192.168.0.3 activate advertise-all-vni exit-address-family ! + address-family ipv4 unicast + redistribute connected + exit-address-family + ! + address-family ipv6 unicast + redistribute connected + exit-address-family + ! address-family l2vpn evpn default-originate ipv4 + default-originate ipv6 exit-address-family ! line vty @@ -1732,6 +1787,8 @@ iface vmbr0 inet static bridge_ports eno1 bridge_stp off bridge_fd 0 + ip-forward on + ip6-forward on auto vxlan2 iface vxlan2 inet manual @@ -1815,6 +1872,10 @@ router bgp 1234 import vrf vrf1 exit-address-family ! + address-family ipv6 unicast + import vrf vrf1 + exit-address-family + ! address-family l2vpn evpn neighbor 192.168.0.1 activate neighbor 192.168.0.2 activate @@ -1823,8 +1884,17 @@ router bgp 1234 ! router bgp 1234 vrf vrf1 ! + address-family ipv4 unicast + redistribute connected + exit-address-family + ! + address-family ipv6 unicast + redistribute connected + exit-address-family + ! address-family l2vpn evpn default-originate ipv4 + default-originate ipv6 exit-address-family ! line vty @@ -1877,6 +1947,91 @@ iface vmbr0 inet static ---- + +gateway node(s) with a upstream bgp router +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +Setup is almost the same than with a static gateway, but we'll connect to an upstream bgp router. + +example with node1 as gateway (192.168.0.1) for evpn-bgp, and an upstream bgp router (running frr too) 192.168.0.254. + +* node1 + +frr.conf +---- +vrf vrf1 + vni 4000 + exit-vrf +! +router bgp 1234 + bgp router-id 192.168.0.1 + no bgp default ipv4-unicast + coalesce-time 1000 + neighbor 192.168.0.2 remote-as 1234 + neighbor 192.168.0.3 remote-as 1234 + neighbor 192.168.0.254 remote-as external + ! + address-family ipv4 unicast + import vrf vrf1 + neighbor 192.168.0.254 activate + exit-address-family + ! + address-family ipv6 unicast + import vrf vrf1 + neighbor 192.168.0.254 activate + exit-address-family + ! + address-family l2vpn evpn + neighbor 192.168.0.1 activate + neighbor 192.168.0.2 activate + neighbor 192.168.0.254 activate + advertise-all-vni + exit-address-family +! +router bgp 1234 vrf vrf1 +! + address-family ipv4 unicast + redistribute connected + exit-address-family + ! + address-family ipv6 unicast + redistribute connected + exit-address-family + ! + address-family l2vpn evpn + default-originate ipv4 + default-originate ipv6 + exit-address-family +! +line vty +! +---- + +* bgp router + +frr.conf +---- +ip prefix-list NO32 seq 10 permit 0.0.0.0/0 ge 8 le 24 +ip prefix-list NO32 seq 20 deny any +! +router bgp 25253 + bgp router-id 192.168.0.254 + bgp bestpath as-path multipath-relax + neighbor 192.168.0.1 remote-as external + neighbor 192.168.0.1 capability extended-nexthop + ! + address-family ipv4 unicast + neighbor 192.168.0.1 default-originate + neighbor 192.168.0.1 prefix-list NO32 in #don't import /32 route from evpn + exit-address-family + ! + address-family ipv6 unicast + neighbor 192.168.0.1 default-originate + neighbor 192.168.0.1 prefix-list NO32 in #don't import /32 route from evpn + exit-address-family + ! +! +--- + Route Reflectors ^^^^^^^^^^^^^^^^ If you have a lot of proxmox nodes, or multiple proxmox clusters, you may want @@ -1943,10 +2098,6 @@ router bgp 1234 neighbor 192.168.0.200 remote-as 1234 neighbor 192.168.0.201 remote-as 1234 ! - address-family ipv4 unicast - import vrf vrf1 - exit-address-family - ! address-family l2vpn evpn neighbor 192.168.0.200 activate neighbor 192.168.0.201 activate @@ -1954,5 +2105,3 @@ router bgp 1234 exit-address-family ! ---- - -#TODO : Documentation with bgp upstream router.