pve-network: bridged setup: s/VMs/virtual guests/

[pve-docs.git] / vxlan-and-evpn.adoc

diff --git a/vxlan-and-evpn.adoc b/vxlan-and-evpn.adoc
index 4ec6f739097016ace8b7e3ed34a135a5d8593548..7f7e04b3c306023d1d2a7e94b3b8ce4a5aaca6c3 100644 (file)
--- a/vxlan-and-evpn.adoc
+++ b/vxlan-and-evpn.adoc
@@ -542,15 +542,6 @@ in each direction (always the destination VNI) across the routed infrastructure.
 
 image::images/vxlan-l3-asymmetric.svg["vxlan l3 asymmetric",align="center"]
 
-
-sysctl.conf tuning
-
-----
-#enable routing
-net.ipv4.ip_forward=1
-net.ipv6.conf.all.forwarding=1
-----
-
 * node1
 
 ----
@@ -584,7 +575,9 @@ iface vmbr2 inet static
         bridge_ports vxlan2
         bridge_stp off
         bridge_fd 0
-
+        ip-forward on
+        ip6-forward on
+        arp-accept on
 
 auto vxlan3
 iface vxlan3 inet manual
@@ -604,6 +597,9 @@ iface vmbr3 inet static
         bridge_ports vxlan3
         bridge_stp off
         bridge_fd 0
+        ip-forward on
+        ip6-forward on
+        arp-accept on
 ----
 
 
@@ -661,6 +657,9 @@ iface vmbr2 inet static
         bridge_ports vxlan2
         bridge_stp off
         bridge_fd 0
+        ip-forward on
+        ip6-forward on
+        arp-accept on
 
 
 auto vxlan3
@@ -681,6 +680,9 @@ iface vmbr3 inet static
         bridge_ports vxlan3
         bridge_stp off
         bridge_fd 0
+        ip-forward on
+        ip6-forward on
+        arp-accept on
 ----
 
 
@@ -738,7 +740,9 @@ iface vmbr2 inet static
         bridge_ports vxlan2
         bridge_stp off
         bridge_fd 0
-
+        ip-forward on
+        ip6-forward on
+        arp-accept on
 
 auto vxlan3
 iface vxlan3 inet manual
@@ -749,7 +753,6 @@ iface vxlan3 inet manual
         bridge-unicast-flood off
         bridge-multicast-flood off
 
-
 auto vmbr3
 iface vmbr3 inet static
         address 10.0.3.254
@@ -758,6 +761,9 @@ iface vmbr3 inet static
         bridge_ports vxlan3
         bridge_stp off
         bridge_fd 0
+        ip-forward on
+        ip6-forward on
+        arp-accept on
 ----
 
 
@@ -798,14 +804,6 @@ A vrf is needed for the L3VNI, so all vmbr bridge need to be in the vrf if they
 
 image::images/vxlan-l3-symmetric.svg["vxlan l3 symmetric",align="center"]
 
-sysctl.conf tuning
-
-----
-#enable routing
-net.ipv4.ip_forward=1
-net.ipv6.conf.all.forwarding=1
-----
-
 * node1
 
 ----
@@ -843,6 +841,9 @@ iface vmbr2 inet static
         netmask 255.255.255.0
         hwaddress 44:39:39:FF:40:94 #must be same on each node vmbr2
         vrf vrf1
+        ip-forward on
+        ip6-forward on
+        arp-accept on
 
 auto vxlan3
 iface vxlan3 inet manual
@@ -862,6 +863,9 @@ iface vmbr3 inet static
         netmask 255.255.255.0
         hwaddress 44:39:39:FF:40:94 #must be same on each node vmbr3
         vrf vrf1
+        ip-forward on
+        ip6-forward on
+        arp-accept on
 
 #interconnect vxlan-vfr l3vni
 auto vxlan4000
@@ -944,6 +948,9 @@ iface vmbr2 inet static
         netmask 255.255.255.0
         hwaddress 44:39:39:FF:40:94 #must be same on each node vmbr2
         vrf vrf1
+        ip-forward on
+        ip6-forward on
+        arp-accept on
 
 auto vxlan3
 iface vxlan3 inet manual
@@ -963,6 +970,9 @@ iface vmbr3 inet static
         netmask 255.255.255.0
         hwaddress 44:39:39:FF:40:94 #must be same on each node vmbr3
         vrf vrf1
+        ip-forward on
+        ip6-forward on
+        arp-accept on
 
 #interconnect vxlan-vfr l3vni
 auto vxlan4000
@@ -1046,6 +1056,9 @@ iface vmbr2 inet static
         netmask 255.255.255.0
         hwaddress 44:39:39:FF:40:94 #must be same on each node vmbr2
         vrf vrf1
+        ip-forward on
+        ip6-forward on
+        arp-accept on
 
 auto vxlan3
 iface vxlan3 inet manual
@@ -1065,6 +1078,9 @@ iface vmbr3 inet static
         netmask 255.255.255.0
         hwaddress 44:39:39:FF:40:94 #must be same on each node vmbr3
         vrf vrf1
+        ip-forward on
+        ip6-forward on
+        arp-accept on
 
 #interconnect vxlan-vfr l3vni
 auto vxlan4000
@@ -1139,6 +1155,8 @@ iface vmbr0 inet static
          bridge_ports eno1
          bridge_stp off
          bridge_fd 0
+         ip-forward on
+         ip6-forward on
 
 auto vxlan2
 iface vxlan2 inet manual
@@ -1158,6 +1176,9 @@ iface vmbr2 inet static
         netmask 255.255.255.0
         hwaddress 44:39:39:FF:40:94 #must be same on each node vmbr2
         vrf vrf1
+        ip-forward on
+        ip6-forward on
+        arp-accept on
 
 auto vxlan3
 iface vxlan3 inet manual
@@ -1177,6 +1198,9 @@ iface vmbr3 inet static
         netmask 255.255.255.0
         hwaddress 44:39:39:FF:40:94 #must be same on each node vmbr3
         vrf vrf1
+        ip-forward on
+        ip6-forward on
+        arp-accept on
 
 #interconnect vxlan-vfr l3vni
 auto vxlan4000
@@ -1200,6 +1224,8 @@ iface vmbr4000 inet manual
 frr.conf
 
 ----
+ip prefix-list deny seq 10 deny any
+!
 vrf vrf1
  vni 4000
  exit-vrf
@@ -1213,6 +1239,8 @@ router bgp 1234
  !
  address-family ipv4 unicast
   import vrf vrf1
+  neighbor 192.168.0.2 prefix-list deny out
+  neighbor 192.168.0.3 prefix-list deny out
  exit-address-family
  !
  address-family l2vpn evpn
@@ -1223,6 +1251,10 @@ router bgp 1234
 !
 router bgp 1234 vrf vrf1
 !
+ address-family ipv4 unicast
+  redistribute connected
+ exit-address-family
+ !
  address-family l2vpn evpn
   default-originate ipv4
  exit-address-family
@@ -1269,6 +1301,9 @@ iface vmbr2 inet static
         netmask 255.255.255.0
         hwaddress 44:39:39:FF:40:94 #must be same on each node vmbr2
         vrf vrf1
+        ip-forward on
+        ip6-forward on
+        arp-accept on
 
 auto vxlan3
 iface vxlan3 inet manual
@@ -1288,6 +1323,9 @@ iface vmbr3 inet static
         netmask 255.255.255.0
         hwaddress 44:39:39:FF:40:94 #must be same on each node vmbr3
         vrf vrf1
+        ip-forward on
+        ip6-forward on
+        arp-accept on
 
 #interconnect vxlan-vfr l3vni
 auto vxlan4000
@@ -1371,6 +1409,9 @@ iface vmbr2 inet static
         netmask 255.255.255.0
         hwaddress 44:39:39:FF:40:94 #must be same on each node vmbr2
         vrf vrf1
+        ip-forward on
+        ip6-forward on
+        arp-accept on
 
 auto vxlan3
 iface vxlan3 inet manual
@@ -1390,6 +1431,9 @@ iface vmbr3 inet static
         netmask 255.255.255.0
         hwaddress 44:39:39:FF:40:94 #must be same on each node vmbr3
         vrf vrf1
+        ip-forward on
+        ip6-forward on
+        arp-accept on
 
 #interconnect vxlan-vfr l3vni
 auto vxlan4000
@@ -1463,6 +1507,8 @@ iface vmbr0 inet static
          bridge_ports eno1
          bridge_stp off
          bridge_fd 0
+         ip-forward on
+         ip6-forward on
 
 auto vxlan2
 iface vxlan2 inet manual
@@ -1482,6 +1528,9 @@ iface vmbr2 inet static
         netmask 255.255.255.0
         hwaddress 44:39:39:FF:40:94 #must be same on each node vmbr2
         vrf vrf1
+        ip-forward on
+        ip6-forward on
+        arp-accept on
 
 auto vxlan3
 iface vxlan3 inet manual
@@ -1501,6 +1550,9 @@ iface vmbr3 inet static
         netmask 255.255.255.0
         hwaddress 44:39:39:FF:40:94 #must be same on each node vmbr3
         vrf vrf1
+        ip-forward on
+        ip6-forward on
+        arp-accept on
 
 #interconnect vxlan-vfr l3vni
 auto vxlan4000
@@ -1524,6 +1576,8 @@ iface vmbr4000 inet manual
 frr.conf
 
 ----
+ip prefix-list deny seq 10 deny any
+!
 vrf vrf1
  vni 4000
  exit-vrf
@@ -1537,6 +1591,8 @@ router bgp 1234
  !
  address-family ipv4 unicast
   import vrf vrf1
+  neighbor 192.168.0.2 prefix-list deny out
+  neighbor 192.168.0.3 prefix-list deny out
  exit-address-family
  !
  address-family l2vpn evpn
@@ -1547,6 +1603,10 @@ router bgp 1234
 !
 router bgp 1234 vrf vrf1
 !
+ address-family ipv4 unicast
+  redistribute connected
+ exit-address-family
+ !
  address-family l2vpn evpn
   default-originate ipv4
  exit-address-family
@@ -1575,6 +1635,8 @@ iface vmbr0 inet static
          bridge_ports eno1
          bridge_stp off
          bridge_fd 0
+         ip-forward on
+         ip6-forward on
 
 auto vxlan2
 iface vxlan2 inet manual
@@ -1594,6 +1656,9 @@ iface vmbr2 inet static
         netmask 255.255.255.0
         hwaddress 44:39:39:FF:40:94 #must be same on each node vmbr2
         vrf vrf1
+        ip-forward on
+        ip6-forward on
+        arp-accept on
 
 auto vxlan3
 iface vxlan3 inet manual
@@ -1613,6 +1678,9 @@ iface vmbr3 inet static
         netmask 255.255.255.0
         hwaddress 44:39:39:FF:40:94 #must be same on each node vmbr3
         vrf vrf1
+        ip-forward on
+        ip6-forward on
+        arp-accept on
 
 #interconnect vxlan-vfr l3vni
 auto vxlan4000
@@ -1637,6 +1705,8 @@ iface vmbr4000 inet manual
 frr.conf
 
 ----
+ip prefix-list deny seq 10 deny any
+!
 vrf vrf1
  vni 4000
  exit-vrf
@@ -1650,6 +1720,8 @@ router bgp 1234
  !
  address-family ipv4 unicast
   import vrf vrf1
+  neighbor 192.168.0.1 prefix-list deny out
+  neighbor 192.168.0.3 prefix-list deny out
  exit-address-family
  !
  address-family l2vpn evpn
@@ -1658,6 +1730,10 @@ router bgp 1234
   advertise-all-vni
  exit-address-family
 !
+ address-family ipv4 unicast
+  redistribute connected
+ exit-address-family
+ !
  address-family l2vpn evpn
   default-originate ipv4
  exit-address-family
@@ -1686,6 +1762,8 @@ iface vmbr0 inet static
          bridge_ports eno1
          bridge_stp off
          bridge_fd 0
+         ip-forward on
+         ip6-forward on
 
 auto vxlan2
 iface vxlan2 inet manual
@@ -1705,6 +1783,9 @@ iface vmbr2 inet static
         netmask 255.255.255.0
         hwaddress 44:39:39:FF:40:94 #must be same on each node vmbr2
         vrf vrf1
+        ip-forward on
+        ip6-forward on
+        arp-accept on
 
 auto vxlan3
 iface vxlan3 inet manual
@@ -1724,6 +1805,9 @@ iface vmbr3 inet static
         netmask 255.255.255.0
         hwaddress 44:39:39:FF:40:94 #must be same on each node vmbr3
         vrf vrf1
+        ip-forward on
+        ip6-forward on
+        arp-accept on
 
 #interconnect vxlan-vfr l3vni
 auto vxlan4000
@@ -1748,6 +1832,8 @@ iface vmbr4000 inet manual
 frr.conf
 
 ----
+ip prefix-list deny seq 10 deny any
+!
 vrf vrf1
  vni 4000
  exit-vrf
@@ -1761,6 +1847,8 @@ router bgp 1234
  !
  address-family ipv4 unicast
   import vrf vrf1
+  neighbor 192.168.0.1 prefix-list deny out
+  neighbor 192.168.0.2 prefix-list deny out
  exit-address-family
  !
  address-family l2vpn evpn
@@ -1771,6 +1859,10 @@ router bgp 1234
 !
 router bgp 1234 vrf vrf1
 !
+ address-family ipv4 unicast
+  redistribute connected
+ exit-address-family
+ !
  address-family l2vpn evpn
   default-originate ipv4
  exit-address-family
@@ -1782,13 +1874,14 @@ line vty
 Note
 ^^^^
 
-If your external router don't support ecmp static route to reach multiple proxmox nodes,
-you can setup an HA floating vip on proxmox nodes with vrrp
+If your external router doesn't support 'ECMP static routes' to reach multiple
+{pve} nodes, you can setup an HA floating vip on proxmox nodes by using the
+Virtual Router Redundancy Protocol (VRRP).
 
-In this example, we will setup an floating 192.168.0.10 ip on node1 and node2.
-Node1 is the primary and failover to node2 in case of failure.
+In this example, we will setup an floating 192.168.0.10 IP on node1 and node2.
+Node1 is the primary with failover to node2 in case of outage.
 
-This setup need vrrpd package (apt install vrrpd).
+This setup currently needs 'vrrpd' package (`apt install vrrpd`).
 #TODO : It should be possible to do it with frr directly with last version.
 
 * node1
@@ -1824,13 +1917,16 @@ iface vmbr0 inet static
 ----
 
 
-route reflectors
+Route Reflectors
 ^^^^^^^^^^^^^^^^
-If you have a lot of proxmox nodes, or multiple proxmox clusters,
-maybe do you want to avoid that each node peer with each others nodes.
-For this, you can create dedicated route reflectors servers. (Minimum 2 servers for redundancy).
-Here an example of configuration with frr, with rrserver1 (192.168.0.200) and rrserver2 (192.168.0.201).
+If you have a lot of proxmox nodes, or multiple proxmox clusters, you may want
+to avoid that all node peers with each others nodes.
+For this, you can create dedicated route reflectors (RR) servers. As a RR is a
+single point of failure, a minimum of two servers acting as an RR is highly
+recommended for redundancy.
 
+Below is an example of configuration with 'frr', with `rrserver1
+(192.168.0.200)' and `rrserver2 (192.168.0.201)`.
 
 rrserver1
 ----
@@ -1887,10 +1983,6 @@ router bgp 1234
  neighbor 192.168.0.200 remote-as 1234
  neighbor 192.168.0.201 remote-as 1234
  !
- address-family ipv4 unicast
-  import vrf vrf1
- exit-address-family
- !
  address-family l2vpn evpn
   neighbor 192.168.0.200 activate
   neighbor 192.168.0.201 activate