]>
Commit | Line | Data |
---|---|---|
1556b768 AD |
1 | [[chapter_pvesdn]] |
2 | Software Defined Network | |
3 | ======================== | |
4 | ifndef::manvolnum[] | |
5 | :pve-toplevel: | |
6 | endif::manvolnum[] | |
7 | ||
ee6e18c4 TL |
8 | The **S**oftware **D**efined **N**etwork (SDN) feature allows one to create |
9 | virtual networks (vnets) at datacenter level. | |
1556b768 | 10 | |
ee6e18c4 TL |
11 | WARNING: SDN is currently an **experimental feature** in {pve}. This |
12 | Documentation for it is also still under development, ask on our | |
13 | xref:getting_help[mailing lists or in the forum] for questions and feedback. | |
14 | ||
15 | ||
4e652aba | 16 | [[pvesdn_installation]] |
ee6e18c4 TL |
17 | Installation |
18 | ------------ | |
19 | ||
20 | To enable the experimental SDN integration, you need to install | |
21 | "libpve-network-perl" package | |
1556b768 AD |
22 | |
23 | ---- | |
24 | apt install libpve-network-perl | |
25 | ---- | |
26 | ||
ee6e18c4 TL |
27 | You need to have `ifupdown2` package installed on each node to manage local |
28 | configuration reloading without reboot: | |
1556b768 AD |
29 | |
30 | ---- | |
31 | apt install ifupdown2 | |
32 | ---- | |
33 | ||
ee6e18c4 TL |
34 | Basic Overview |
35 | -------------- | |
36 | ||
37 | The {pve} SDN allows separation and fine grained control of Virtual Guests | |
38 | networks, using flexible software controlled configurations. | |
39 | ||
8ac25ffe TL |
40 | Separation consists of zones, a zone is it's own virtual separated network area. |
41 | A 'VNet' is a type of a virtual network connected to a zone. Depending on which | |
42 | type or plugin the zone uses it can behave differently and offer different | |
43 | features, advantages or disadvantages. | |
44 | Normally a 'VNet' shows up as a common Linux bridge with either a VLAN or | |
45 | 'VXLAN' tag, but some can also use layer 3 routing for control. | |
46 | The 'VNets' are deployed locally on each node, after configuration was committed | |
47 | from the cluster wide datacenter SDN administration interface. | |
ee6e18c4 TL |
48 | |
49 | ||
1556b768 AD |
50 | Main configuration |
51 | ------------------ | |
52 | ||
ee6e18c4 TL |
53 | The configuration is done at datacenter (cluster-wide) level, it will be saved |
54 | in configuration files located in the shared configuration file system: | |
55 | `/etc/pve/sdn` | |
1556b768 | 56 | |
ee6e18c4 | 57 | On the web-interface SDN feature have 4 main sections for the configuration |
1556b768 | 58 | |
ee6e18c4 | 59 | * SDN: a overview of the SDN state |
1556b768 | 60 | |
ee6e18c4 | 61 | * Zones: Create and manage the virtual separated network Zones |
1556b768 | 62 | |
ee6e18c4 | 63 | * VNets: The per-node building block to provide a Zone for VMs |
1556b768 | 64 | |
8ac25ffe | 65 | * Controller: For complex setups to control Layer 3 routing |
1556b768 AD |
66 | |
67 | ||
4e652aba | 68 | [[pvesdn_config_main_sdn]] |
1556b768 AD |
69 | SDN |
70 | ~~~ | |
71 | ||
ee6e18c4 TL |
72 | This is the main status panel. Here you can see deployment status of zones on |
73 | different nodes. | |
1556b768 | 74 | |
ee6e18c4 TL |
75 | There is an 'Apply' button, to push and reload local configuration on all |
76 | cluster nodes nodes. | |
1556b768 AD |
77 | |
78 | ||
4e652aba | 79 | [[pvesdn_config_zone]] |
1556b768 AD |
80 | Zones |
81 | ~~~~~ | |
82 | ||
ee6e18c4 | 83 | A zone will define a virtually separated network. |
1556b768 | 84 | |
ee6e18c4 | 85 | It can use different technologies for separation: |
1556b768 | 86 | |
ee6e18c4 | 87 | * VLAN: Virtual LANs are the classic method to sub-divide a LAN |
1556b768 | 88 | |
ee6e18c4 | 89 | * QinQ: stacked VLAN (formally known as `IEEE 802.1ad`) |
1556b768 | 90 | |
ee6e18c4 | 91 | * VXLAN: (layer2 vxlan) |
1556b768 | 92 | |
ee6e18c4 | 93 | * bgp-evpn: vxlan using layer3 border gateway protocol routing |
1556b768 AD |
94 | |
95 | You can restrict a zone to specific nodes. | |
96 | ||
ee6e18c4 TL |
97 | It's also possible to add permissions on a zone, to restrict user to use only a |
98 | specific zone and only the VNets in that zone | |
1556b768 | 99 | |
4e652aba | 100 | [[pvesdn_config_vnet]] |
ee6e18c4 | 101 | VNets |
1556b768 AD |
102 | ~~~~~ |
103 | ||
ee6e18c4 TL |
104 | A `VNet` is in its basic form just a Linux bridge that will be deployed locally |
105 | on the node and used for Virtual Machine communication. | |
1556b768 | 106 | |
ee6e18c4 | 107 | VNet properties are: |
1556b768 | 108 | |
ee6e18c4 | 109 | * ID: a 8 characters ID to name and identify a VNet |
1556b768 | 110 | |
ee6e18c4 | 111 | * Alias: Optional longer name, if the ID isn't enough |
1556b768 | 112 | |
ee6e18c4 | 113 | * Zone: The associated zone for this VNet |
1556b768 | 114 | |
ee6e18c4 | 115 | * Tag: The unique VLAN or VXLAN id |
1556b768 | 116 | |
ee6e18c4 TL |
117 | * IPv4: an anycast IPv4 address, it will be configured on the underlying bridge |
118 | on each node part of the Zone. It's only useful for `bgp-evpn` routing. | |
1556b768 | 119 | |
ee6e18c4 TL |
120 | * IPv6: an anycast IPv6 address, it will be configured on the underlying bridge |
121 | on each node part of the Zone. It's only useful for `bgp-evpn` routing. | |
1556b768 AD |
122 | |
123 | ||
4e652aba | 124 | [[pvesdn_config_controllers]] |
1556b768 AD |
125 | Controllers |
126 | ~~~~~~~~~~~ | |
127 | ||
4e652aba TL |
128 | Some zone types need an external controller to manage the VNet control-plane. |
129 | Currently this is only required for the `bgp-evpn` zone plugin. | |
1556b768 AD |
130 | |
131 | ||
4e652aba | 132 | [[pvesdn_zone_plugins]] |
1556b768 AD |
133 | Zones Plugins |
134 | ------------- | |
1556b768 | 135 | |
ee6e18c4 TL |
136 | Common options |
137 | ~~~~~~~~~~~~~~ | |
1556b768 | 138 | |
4e652aba TL |
139 | nodes:: Deploy and allow to use a VNets configured for this Zone only on these |
140 | nodes. | |
1556b768 | 141 | |
4e652aba | 142 | [[pvesdn_zone_plugin_vlan]] |
ee6e18c4 TL |
143 | VLAN Zones |
144 | ~~~~~~~~~~ | |
1556b768 | 145 | |
ee6e18c4 TL |
146 | This is the simplest plugin, it will reuse an existing local Linux or OVS |
147 | bridge, and manage VLANs on it. | |
148 | The benefit of using SDN module, is that you can create different zones with | |
149 | specific VNets VLAN tag, and restrict Virtual Machines to separated zones. | |
1556b768 | 150 | |
ee6e18c4 | 151 | Specific `VLAN` configuration options: |
1556b768 | 152 | |
a91b3e7f | 153 | bridge:: Reuse this local bridge or OVS switch, already |
ee6e18c4 | 154 | configured on *each* local node. |
1556b768 | 155 | |
4e652aba | 156 | [[pvesdn_zone_plugin_qinq]] |
ee6e18c4 TL |
157 | QinQ Zones |
158 | ~~~~~~~~~~ | |
1556b768 | 159 | |
ee6e18c4 TL |
160 | QinQ is stacked VLAN. The first VLAN tag defined for the zone |
161 | (so called 'service-vlan'), and the second VLAN tag defined for the vnets | |
1556b768 | 162 | |
8ac25ffe | 163 | NOTE: Your physical network switches must support stacked VLANs! |
1556b768 | 164 | |
ee6e18c4 | 165 | Specific QinQ configuration options: |
1556b768 | 166 | |
4e652aba TL |
167 | bridge:: A local VLAN-aware bridge already configured on each local node |
168 | ||
169 | service vlan:: The main VLAN tag of this zone | |
170 | ||
ee6e18c4 TL |
171 | mtu:: Due to the double stacking of tags you need 4 more bytes for QinQ VLANs. |
172 | For example, you reduce the MTU to `1496` if you physical interface MTU is | |
173 | `1500`. | |
1556b768 | 174 | |
4e652aba | 175 | [[pvesdn_zone_plugin_vxlan]] |
ee6e18c4 TL |
176 | VXLAN Zones |
177 | ~~~~~~~~~~~ | |
1556b768 | 178 | |
ee6e18c4 TL |
179 | The VXLAN plugin will establish a tunnel (named overlay) on top of an existing |
180 | network (named underlay). It encapsulate layer 2 Ethernet frames within layer | |
181 | 4 UDP datagrams, using `4789` as the default destination port. You can, for | |
182 | example, create a private IPv4 VXLAN network on top of public internet network | |
183 | nodes. | |
184 | This is a layer2 tunnel only, no routing between different VNets is possible. | |
1556b768 | 185 | |
ee6e18c4 | 186 | Each VNet will have use specific VXLAN id from the range (1 - 16777215). |
1556b768 | 187 | |
ee6e18c4 | 188 | Specific EVPN configuration options: |
1556b768 | 189 | |
4e652aba TL |
190 | peers address list:: A list of IPs from all nodes through which you want to |
191 | communicate. Can also be external nodes. | |
192 | ||
193 | mtu:: Because VXLAN encapsulation use 50bytes, the MTU need to be 50 bytes | |
194 | lower than the outgoing physical interface. | |
1556b768 | 195 | |
4e652aba | 196 | [[pvesdn_zone_plugin_evpn]] |
ee6e18c4 TL |
197 | EVPN Zones |
198 | ~~~~~~~~~~ | |
1556b768 | 199 | |
ee6e18c4 | 200 | This is the most complex of all supported plugins. |
1556b768 | 201 | |
ee6e18c4 TL |
202 | BGP-EVPN allows one to create routable layer3 network. The VNet of EVPN can |
203 | have an anycast IP-address and or MAC-address. The bridge IP is the same on each | |
204 | node, with this a virtual guest can use that address as gateway. | |
1556b768 | 205 | |
ee6e18c4 TL |
206 | Routing can work across VNets from different zones through a VRF (Virtual |
207 | Routing and Forwarding) interface. | |
1556b768 | 208 | |
ee6e18c4 | 209 | Specific EVPN configuration options: |
1556b768 | 210 | |
ee6e18c4 TL |
211 | VRF VXLAN Tag:: This is a vxlan-id used for routing interconnect between vnets, |
212 | it must be different than VXLAN-id of VNets | |
1556b768 | 213 | |
ee6e18c4 TL |
214 | controller:: an EVPN-controller need to be defined first (see controller |
215 | plugins section) | |
1556b768 | 216 | |
ee6e18c4 TL |
217 | mtu:: because VXLAN encapsulation use 50bytes, the MTU need to be 50 bytes |
218 | lower than the outgoing physical interface. | |
1556b768 AD |
219 | |
220 | ||
4e652aba | 221 | [[pvesdn_controller_plugins]] |
1556b768 AD |
222 | Controllers Plugins |
223 | ------------------- | |
224 | ||
8ac25ffe TL |
225 | For complex zones requiring a control plane. |
226 | ||
4e652aba | 227 | [[pvesdn_controller_plugin_evpn]] |
ee6e18c4 TL |
228 | EVPN Controller |
229 | ~~~~~~~~~~~~~~~ | |
1556b768 | 230 | |
ee6e18c4 TL |
231 | For `BGP-EVPN`, we need a controller to manage the control plane. |
232 | The currently supported software controller is the "frr" router. | |
233 | You may need to install it on each node where you want to deploy EVPN zones. | |
1556b768 AD |
234 | |
235 | ---- | |
236 | apt install frr | |
237 | ---- | |
238 | ||
ee6e18c4 | 239 | Configuration options: |
1556b768 | 240 | |
4e652aba | 241 | asn:: A unique BGP ASN number. It's highly recommended to use private ASN |
ee6e18c4 TL |
242 | number (64512 – 65534, 4200000000 – 4294967294), as else you could end up |
243 | breaking, or get broken, by global routing by mistake. | |
1556b768 | 244 | |
4e652aba | 245 | peers:: An ip list of all nodes where you want to communicate (could be also |
ee6e18c4 | 246 | external nodes or route reflectors servers) |
1556b768 | 247 | |
ee6e18c4 TL |
248 | Additionally, if you want to route traffic from a SDN BGP-EVPN network to |
249 | external world: | |
1556b768 | 250 | |
ee6e18c4 TL |
251 | gateway-nodes:: The proxmox nodes from where the bgp-evpn traffic will exit to |
252 | external through the nodes default gateway | |
1556b768 | 253 | |
4e652aba TL |
254 | gateway-external-peers:: If you want that gateway nodes don't use the default |
255 | gateway, but, for example, sent traffic to external BGP routers, which handle | |
256 | (reverse) routing then dynamically you can use. For example | |
257 | `192.168.0.253,192.168.0.254' | |
1556b768 AD |
258 | |
259 | ||
4e652aba | 260 | [[pvesdn_local_deployment_monitoring]] |
ee6e18c4 | 261 | Local Deployment Monitoring |
1556b768 AD |
262 | --------------------------- |
263 | ||
ee6e18c4 TL |
264 | After applying the configuration through the main SDN web-interface panel, |
265 | the local network configuration is generated locally on each node in | |
266 | `/etc/network/interfaces.d/sdn`, and with ifupdown2 reloaded. | |
1556b768 | 267 | |
ee6e18c4 | 268 | You can monitor the status of local zones and vnets through the main tree. |
1556b768 | 269 | |
1556b768 | 270 | |
4e652aba | 271 | [[pvesdn_setup_example_vlan]] |
ee6e18c4 TL |
272 | VLAN Setup Example |
273 | ------------------ | |
1556b768 | 274 | |
ee6e18c4 TL |
275 | TIP: While we show plain configuration content here, almost everything should |
276 | be configurable using the web-interface only. | |
277 | ||
278 | Node1: /etc/network/interfaces | |
1556b768 | 279 | |
1556b768 AD |
280 | ---- |
281 | auto vmbr0 | |
282 | iface vmbr0 inet manual | |
ee6e18c4 TL |
283 | bridge-ports eno1 |
284 | bridge-stp off | |
285 | bridge-fd 0 | |
1556b768 AD |
286 | bridge-vlan-aware yes |
287 | bridge-vids 2-4094 | |
288 | ||
289 | #management ip on vlan100 | |
290 | auto vmbr0.100 | |
291 | iface vmbr0.100 inet static | |
292 | address 192.168.0.1/24 | |
293 | ||
294 | source /etc/network/interfaces.d/* | |
1556b768 AD |
295 | ---- |
296 | ||
ee6e18c4 | 297 | Node2: /etc/network/interfaces |
1556b768 AD |
298 | |
299 | ---- | |
300 | auto vmbr0 | |
301 | iface vmbr0 inet manual | |
ee6e18c4 TL |
302 | bridge-ports eno1 |
303 | bridge-stp off | |
304 | bridge-fd 0 | |
1556b768 AD |
305 | bridge-vlan-aware yes |
306 | bridge-vids 2-4094 | |
307 | ||
308 | #management ip on vlan100 | |
309 | auto vmbr0.100 | |
310 | iface vmbr0.100 inet static | |
311 | address 192.168.0.2/24 | |
312 | ||
313 | source /etc/network/interfaces.d/* | |
314 | ---- | |
315 | ||
ee6e18c4 | 316 | Create a VLAN zone named `myvlanzone': |
1556b768 AD |
317 | |
318 | ---- | |
ee6e18c4 | 319 | id: myvlanzone |
1556b768 AD |
320 | bridge: vmbr0 |
321 | ---- | |
322 | ||
ee6e18c4 TL |
323 | Create a VNet named `myvnet1' with `vlan-id` `10' and the previously created |
324 | `myvlanzone' as it's zone. | |
1556b768 AD |
325 | |
326 | ---- | |
327 | id: myvnet1 | |
328 | zone: myvlanzone | |
329 | tag: 10 | |
330 | ---- | |
331 | ||
ee6e18c4 TL |
332 | Apply the configuration through the main SDN panel, to create VNets locally on |
333 | each nodes. | |
1556b768 | 334 | |
ee6e18c4 | 335 | Create a Debian-based Virtual Machine (vm1) on node1, with a vNIC on `myvnet1'. |
1556b768 | 336 | |
ee6e18c4 | 337 | Use the following network configuration for this VM: |
1556b768 AD |
338 | |
339 | ---- | |
340 | auto eth0 | |
341 | iface eth0 inet static | |
ee6e18c4 | 342 | address 10.0.3.100/24 |
1556b768 AD |
343 | ---- |
344 | ||
ee6e18c4 TL |
345 | Create a second Virtual Machine (vm2) on node2, with a vNIC on the same VNet |
346 | `myvnet1' as vm1. | |
347 | ||
348 | Use the following network configuration for this VM: | |
349 | ||
1556b768 AD |
350 | ---- |
351 | auto eth0 | |
352 | iface eth0 inet static | |
ee6e18c4 | 353 | address 10.0.3.101/24 |
1556b768 AD |
354 | ---- |
355 | ||
ee6e18c4 | 356 | Then, you should be able to ping between both VMs over that network. |
1556b768 AD |
357 | |
358 | ||
4e652aba TL |
359 | [[pvesdn_setup_example_qinq]] |
360 | QinQ Setup Example | |
1556b768 | 361 | ------------------ |
ee6e18c4 TL |
362 | |
363 | TIP: While we show plain configuration content here, almost everything should | |
364 | be configurable using the web-interface only. | |
365 | ||
366 | Node1: /etc/network/interfaces | |
367 | ||
1556b768 AD |
368 | ---- |
369 | auto vmbr0 | |
370 | iface vmbr0 inet manual | |
ee6e18c4 TL |
371 | bridge-ports eno1 |
372 | bridge-stp off | |
373 | bridge-fd 0 | |
1556b768 AD |
374 | bridge-vlan-aware yes |
375 | bridge-vids 2-4094 | |
376 | ||
377 | #management ip on vlan100 | |
378 | auto vmbr0.100 | |
379 | iface vmbr0.100 inet static | |
380 | address 192.168.0.1/24 | |
381 | ||
382 | source /etc/network/interfaces.d/* | |
383 | ---- | |
384 | ||
ee6e18c4 | 385 | Node2: /etc/network/interfaces |
1556b768 AD |
386 | |
387 | ---- | |
388 | auto vmbr0 | |
389 | iface vmbr0 inet manual | |
ee6e18c4 TL |
390 | bridge-ports eno1 |
391 | bridge-stp off | |
392 | bridge-fd 0 | |
1556b768 AD |
393 | bridge-vlan-aware yes |
394 | bridge-vids 2-4094 | |
395 | ||
396 | #management ip on vlan100 | |
397 | auto vmbr0.100 | |
398 | iface vmbr0.100 inet static | |
399 | address 192.168.0.2/24 | |
400 | ||
401 | source /etc/network/interfaces.d/* | |
402 | ---- | |
403 | ||
ee6e18c4 | 404 | Create an QinQ zone named `qinqzone1' with service VLAN 20 |
1556b768 AD |
405 | |
406 | ---- | |
407 | id: qinqzone1 | |
408 | bridge: vmbr0 | |
409 | service vlan: 20 | |
410 | ---- | |
411 | ||
ee6e18c4 | 412 | Create another QinQ zone named `qinqzone2' with service VLAN 30 |
1556b768 AD |
413 | |
414 | ---- | |
415 | id: qinqzone2 | |
416 | bridge: vmbr0 | |
417 | service vlan: 30 | |
418 | ---- | |
419 | ||
ee6e18c4 TL |
420 | Create a VNet named `myvnet1' with customer vlan-id 100 on the previously |
421 | created `qinqzone1' zone. | |
1556b768 AD |
422 | |
423 | ---- | |
424 | id: myvnet1 | |
425 | zone: qinqzone1 | |
426 | tag: 100 | |
427 | ---- | |
428 | ||
ee6e18c4 TL |
429 | Create a `myvnet2' with customer VLAN-id 100 on the previously created |
430 | `qinqzone2' zone. | |
1556b768 AD |
431 | |
432 | ---- | |
433 | id: myvnet2 | |
434 | zone: qinqzone1 | |
435 | tag: 100 | |
436 | ---- | |
437 | ||
ee6e18c4 TL |
438 | Apply the configuration on the main SDN web-interface panel to create VNets |
439 | locally on each nodes. | |
1556b768 | 440 | |
ee6e18c4 | 441 | Create a Debian-based Virtual Machine (vm1) on node1, with a vNIC on `myvnet1'. |
1556b768 | 442 | |
ee6e18c4 | 443 | Use the following network configuration for this VM: |
1556b768 AD |
444 | |
445 | ---- | |
446 | auto eth0 | |
447 | iface eth0 inet static | |
448 | address 10.0.3.100/24 | |
449 | ---- | |
450 | ||
ee6e18c4 TL |
451 | Create a second Virtual Machine (vm2) on node2, with a vNIC on the same VNet |
452 | `myvnet1' as vm1. | |
453 | ||
454 | Use the following network configuration for this VM: | |
455 | ||
1556b768 AD |
456 | ---- |
457 | auto eth0 | |
458 | iface eth0 inet static | |
459 | address 10.0.3.101/24 | |
460 | ---- | |
461 | ||
ee6e18c4 TL |
462 | Create a third Virtual Machine (vm3) on node1, with a vNIC on the other VNet |
463 | `myvnet2'. | |
464 | ||
465 | Use the following network configuration for this VM: | |
1556b768 AD |
466 | |
467 | ---- | |
468 | auto eth0 | |
469 | iface eth0 inet static | |
470 | address 10.0.3.102/24 | |
471 | ---- | |
472 | ||
ee6e18c4 TL |
473 | Create another Virtual Machine (vm4) on node2, with a vNIC on the same VNet |
474 | `myvnet2' as vm3. | |
475 | ||
476 | Use the following network configuration for this VM: | |
477 | ||
1556b768 AD |
478 | ---- |
479 | auto eth0 | |
480 | iface eth0 inet static | |
481 | address 10.0.3.103/24 | |
482 | ---- | |
483 | ||
ee6e18c4 TL |
484 | Then, you should be able to ping between the VMs 'vm1' and 'vm2', also |
485 | between 'vm3' and 'vm4'. But, none of VMs 'vm1' or 'vm2' can ping the VMs 'vm3' | |
486 | or 'vm4', as they are on a different zone with different service-vlan. | |
1556b768 | 487 | |
1556b768 | 488 | |
4e652aba | 489 | [[pvesdn_setup_example_vxlan]] |
ee6e18c4 | 490 | VXLAN Setup Example |
1556b768 | 491 | ------------------- |
ee6e18c4 | 492 | |
4e652aba TL |
493 | TIP: While we show plain configuration content here, almost everything should |
494 | be configurable using the web-interface only. | |
495 | ||
1556b768 | 496 | node1: /etc/network/interfaces |
ee6e18c4 | 497 | |
1556b768 AD |
498 | ---- |
499 | auto vmbr0 | |
500 | iface vmbr0 inet static | |
501 | address 192.168.0.1/24 | |
502 | gateway 192.168.0.254 | |
ee6e18c4 TL |
503 | bridge-ports eno1 |
504 | bridge-stp off | |
505 | bridge-fd 0 | |
1556b768 AD |
506 | mtu 1500 |
507 | ||
508 | source /etc/network/interfaces.d/* | |
509 | ---- | |
510 | ||
511 | node2: /etc/network/interfaces | |
512 | ||
513 | ---- | |
514 | auto vmbr0 | |
515 | iface vmbr0 inet static | |
516 | address 192.168.0.2/24 | |
517 | gateway 192.168.0.254 | |
ee6e18c4 TL |
518 | bridge-ports eno1 |
519 | bridge-stp off | |
520 | bridge-fd 0 | |
1556b768 AD |
521 | mtu 1500 |
522 | ||
523 | source /etc/network/interfaces.d/* | |
524 | ---- | |
525 | ||
526 | node3: /etc/network/interfaces | |
527 | ||
528 | ---- | |
529 | auto vmbr0 | |
530 | iface vmbr0 inet static | |
531 | address 192.168.0.3/24 | |
532 | gateway 192.168.0.254 | |
ee6e18c4 TL |
533 | bridge-ports eno1 |
534 | bridge-stp off | |
535 | bridge-fd 0 | |
1556b768 AD |
536 | mtu 1500 |
537 | ||
538 | source /etc/network/interfaces.d/* | |
539 | ---- | |
540 | ||
ee6e18c4 TL |
541 | Create an VXLAN zone named `myvxlanzone', use the lower MTU to ensure the extra |
542 | 50 bytes of the VXLAN header can fit. Add all previously configured IPs from | |
543 | the nodes as peer address list. | |
1556b768 AD |
544 | |
545 | ---- | |
546 | id: myvxlanzone | |
547 | peers address list: 192.168.0.1,192.168.0.2,192.168.0.3 | |
548 | mtu: 1450 | |
549 | ---- | |
550 | ||
ee6e18c4 TL |
551 | Create a VNet named `myvnet1' using the VXLAN zone `myvxlanzone' created |
552 | previously. | |
1556b768 AD |
553 | |
554 | ---- | |
555 | id: myvnet1 | |
556 | zone: myvxlanzone | |
557 | tag: 100000 | |
558 | ---- | |
559 | ||
ee6e18c4 TL |
560 | Apply the configuration on the main SDN web-interface panel to create VNets |
561 | locally on each nodes. | |
1556b768 | 562 | |
ee6e18c4 | 563 | Create a Debian-based Virtual Machine (vm1) on node1, with a vNIC on `myvnet1'. |
1556b768 | 564 | |
ee6e18c4 | 565 | Use the following network configuration for this VM, note the lower MTU here. |
1556b768 AD |
566 | |
567 | ---- | |
568 | auto eth0 | |
569 | iface eth0 inet static | |
570 | address 10.0.3.100/24 | |
571 | mtu 1450 | |
572 | ---- | |
573 | ||
ee6e18c4 TL |
574 | Create a second Virtual Machine (vm2) on node3, with a vNIC on the same VNet |
575 | `myvnet1' as vm1. | |
576 | ||
577 | Use the following network configuration for this VM: | |
578 | ||
1556b768 AD |
579 | ---- |
580 | auto eth0 | |
581 | iface eth0 inet static | |
582 | address 10.0.3.101/24 | |
583 | mtu 1450 | |
584 | ---- | |
585 | ||
ee6e18c4 | 586 | Then, you should be able to ping between between 'vm1' and 'vm2'. |
1556b768 AD |
587 | |
588 | ||
4e652aba TL |
589 | [[pvesdn_setup_example_evpn]] |
590 | EVPN Setup Example | |
1556b768 | 591 | ------------------ |
ee6e18c4 | 592 | |
1556b768 AD |
593 | node1: /etc/network/interfaces |
594 | ||
595 | ---- | |
596 | auto vmbr0 | |
597 | iface vmbr0 inet static | |
598 | address 192.168.0.1/24 | |
599 | gateway 192.168.0.254 | |
600 | bridge-ports eno1 | |
601 | bridge-stp off | |
602 | bridge-fd 0 | |
603 | mtu 1500 | |
604 | ||
605 | source /etc/network/interfaces.d/* | |
606 | ---- | |
607 | ||
608 | node2: /etc/network/interfaces | |
609 | ||
610 | ---- | |
611 | auto vmbr0 | |
612 | iface vmbr0 inet static | |
613 | address 192.168.0.2/24 | |
614 | gateway 192.168.0.254 | |
615 | bridge-ports eno1 | |
616 | bridge-stp off | |
617 | bridge-fd 0 | |
618 | mtu 1500 | |
619 | ||
620 | source /etc/network/interfaces.d/* | |
621 | ---- | |
622 | ||
623 | node3: /etc/network/interfaces | |
624 | ||
625 | ---- | |
626 | auto vmbr0 | |
627 | iface vmbr0 inet static | |
628 | address 192.168.0.3/24 | |
629 | gateway 192.168.0.254 | |
630 | bridge-ports eno1 | |
631 | bridge-stp off | |
632 | bridge-fd 0 | |
633 | mtu 1500 | |
634 | ||
635 | source /etc/network/interfaces.d/* | |
636 | ---- | |
637 | ||
ee6e18c4 TL |
638 | Create a EVPN controller, using a private ASN number and above node addreesses |
639 | as peers. Define 'node1' and 'node2' as gateway nodes. | |
1556b768 AD |
640 | |
641 | ---- | |
642 | id: myevpnctl | |
643 | asn: 65000 | |
644 | peers: 192.168.0.1,192.168.0.2,192.168.0.3 | |
645 | gateway nodes: node1,node2 | |
646 | ---- | |
647 | ||
ee6e18c4 TL |
648 | Create an EVPN zone named `myevpnzone' using the previously created |
649 | EVPN-controller. | |
1556b768 AD |
650 | |
651 | ---- | |
652 | id: myevpnzone | |
653 | vrf vxlan tag: 10000 | |
654 | controller: myevpnctl | |
655 | mtu: 1450 | |
656 | ---- | |
657 | ||
ee6e18c4 TL |
658 | Create the first VNet named `myvnet1' using the EVPN zone `myevpnzone', a IPv4 |
659 | CIDR network and a random MAC address. | |
1556b768 AD |
660 | |
661 | ---- | |
662 | id: myvnet1 | |
663 | zone: myevpnzone | |
664 | tag: 11000 | |
665 | ipv4: 10.0.1.1/24 | |
8ac25ffe | 666 | mac address: 8C:73:B2:7B:F9:60 #random generate mac address |
1556b768 AD |
667 | ---- |
668 | ||
ee6e18c4 TL |
669 | Create the second VNet named `myvnet2' using the same EVPN zone `myevpnzone', a |
670 | different IPv4 CIDR network and a different random MAC address than `myvnet1'. | |
1556b768 AD |
671 | |
672 | ---- | |
673 | id: myvnet2 | |
674 | zone: myevpnzone | |
675 | tag: 12000 | |
676 | ipv4: 10.0.2.1/24 | |
677 | mac address: 8C:73:B2:7B:F9:61 #random mac, need to be different on each vnet | |
678 | ---- | |
679 | ||
ee6e18c4 TL |
680 | Apply the configuration on the main SDN web-interface panel to create VNets |
681 | locally on each nodes and generate the FRR config. | |
1556b768 AD |
682 | |
683 | ||
ee6e18c4 | 684 | Create a Debian-based Virtual Machine (vm1) on node1, with a vNIC on `myvnet1'. |
1556b768 | 685 | |
ee6e18c4 | 686 | Use the following network configuration for this VM: |
1556b768 AD |
687 | |
688 | ---- | |
689 | auto eth0 | |
690 | iface eth0 inet static | |
691 | address 10.0.1.100/24 | |
692 | gateway 10.0.1.1 #this is the ip of the vnet1 | |
693 | mtu 1450 | |
694 | ---- | |
695 | ||
ee6e18c4 TL |
696 | Create a second Virtual Machine (vm2) on node2, with a vNIC on the other VNet |
697 | `myvnet2'. | |
698 | ||
699 | Use the following network configuration for this VM: | |
700 | ||
1556b768 AD |
701 | ---- |
702 | auto eth0 | |
703 | iface eth0 inet static | |
704 | address 10.0.2.100/24 | |
705 | gateway 10.0.2.1 #this is the ip of the vnet2 | |
706 | mtu 1450 | |
707 | ---- | |
708 | ||
709 | ||
710 | Then, you should be able to ping vm2 from vm1, and vm1 from vm2. | |
711 | ||
ee6e18c4 TL |
712 | If you ping an external IP from 'vm2' on the non-gateway 'node3', the packet |
713 | will go to the configured 'myvnet2' gateway, then will be routed to gateway | |
714 | nodes ('node1' or 'node2') and from there it will leave those nodes over the | |
715 | default gateway configured on node1 or node2. | |
1556b768 | 716 | |
ee6e18c4 TL |
717 | NOTE: Of course you need to add reverse routes for the '10.0.1.0/24' and |
718 | '10.0.2.0/24' network to node1, node2 on your external gateway, so that the | |
719 | public network can reply back. | |
1556b768 | 720 | |
ee6e18c4 TL |
721 | If you have configured an external BGP router, the BGP-EVPN routes (10.0.1.0/24 |
722 | and 10.0.2.0/24 in this example), will be announced dynamically. |